Higher-Order Subtyping with Intersection Types

een wetenschappelijke proeve op het gebied van de Wiskunde en Informatica

proefschrift

ter verkrijging van de graad van doctor aan de Katholieke Universiteit Nijmegen, volgens besluit van het College van Decanen

in het openbaar te verdedigen op maandag 30 januari 1995, des namiddags te 3.30 uur precies

door

Adriana Beatriz Compagnoni

geboren 23 december 1965 te Buenos Aires

Promotores: Professor M. Dezani-Ciancaglini,

Universit degli Studi di Torino, Turijn, Italië. Professor dr. H. P. Barendregt.

Higher-Order Subtyping with Intersection Types

Adriana Beatriz Compagnoni

Cover design: David Aspinall and Adriana Compagnoni

cip-data koninklijke bibliotheek, den haag

Compagnoni, Adriana Beatriz

Higher-order subtyping with intersection types Adriana Beatriz Compagnoni. - [S.l. : s.n.]. - I11. Thesis Nijmegen. - With ref. ISBN 90-9007860-6 Subject headings: lambda calculus. iv A Susana y Mario vi

Acknowledgements

Mariangiola Dezani is the most encouraging and enthusiastic computer scientist I have ever met. From her I learned to trust my intuition and follow it through to the very end. This research would not have been possible without her technical supervision and moral support. I would also like to thank my supervisor, Henk Barendregt. His lucid lectures on λ-calculus, his ability to hide irrelevant details, the clarity of his explanations, and his elegant technical prose have been constant guides.

I thank the people in the Netherlands, especially Erik Barendsen and Jan Kuper, for their help and friendship, and Steffen van Bakel and Paula Severi, for their comments on previous drafts of this thesis. Mieke Massink and Maria Fernández Ferreira started as colleagues and soon became two of my dearest friends.

I am grateful to Benjamin Pierce, who suggested the study of a λ-calculus combining higher-order polymorphism and intersection types. He and I defined the system F_{∧}^{ω}, whose study is, by and large, the theme of this thesis; together we wrote [CP93], from which chapters 5 and 6 arose. His fertile mind and his passion for hard work make him inspiring company.

I am indebted to Rod Burstall, who opened to me the doors of the Laboratory for Foundations of Computer Science. There I found a highly motivating research environment where I developed most of the results in this thesis, and a handful of friends who made my life in Edinburgh a beautifully rich experience. I enjoyed technical discussions with Stuart Anderson, David Aspinall, Philippa Gardner, Martin Hofmann, Stefan Kahrs, Zhaohui Luo, Savi Maharaj, James McKinna, Randy Pollack, and Dilip Sequeira. My special thanks to Healfdene Goguen for many helpful comments on draft versions of this thesis.

It has been an honour to have Jan Willem Klop, Giuseppe Longo, and Rob Nederpelt as members of the manuscript commission.

From my water-color teacher, Joost van Moll, I learned a technique which actually changed my way of doing research; it consists of carefully examining what has been done, learning from the successful ideas, and being brave enough to start over again regardless of the time invested in the previous try.

In the non-academic world, I want to thank my parents, Mario Compagnoni and Susana Brunsch, for their unconditional love. I want to mention (in the order in which they appeared in my life) Silvana Cantoni, Karin Gottschalk, Claudio Massa, Maribel Fernández, Javier Blanco, Cristina Abbate, Martin de Zuviría, and Esther Gerrits, because life would not be the same without friends.

Edinburgh, 6^{th} of December, 1994.

This research was supported by the Dutch organization for scientific research, NWO-SION project Typed lambda calculus, 612-316-030, and by EPSRC GRANT, GR/G 55792. Constructive logic as a basis for program development.

Contents

1 Introduction 1 1.1 Types and programs . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Subtyping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.3 Type inference and type checking . . . . . . . . . . . . . . . . . . . 3 1.4 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.5 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

I Higher-Order Subtyping 7

2 The F_{∧}^{ω} Calculus 9 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2 Syntax of F_{∧}^{ω} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.2.1 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.3 Confluence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

2.3.1 The Church-Rosser theorem for →_{β∧} . . . . . . . . . . . . . 20 2.3.2 The Church-Rosser theorem for →_{βfors} . . . . . . . . . . . . 24

2.4 Structural properties . . . . . . . . . . . . . . . . . . . . . . . . . . 31 2.5 Strong normalization of →_{β∧} . . . . . . . . . . . . . . . . . . . . . 37

3 Decidability of Subtyping in F_{∧}^{ω} 41 3.1 Normal Subtyping . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.2 Structural properties of NF_{∧}^{ω} . . . . . . . . . . . . . . . . . . . . . . 44 3.3 Equivalence of ordinary and normal subtyping . . . . . . . . . . . . 50

3.3.1 Least strict upper bound . . . . . . . . . . . . . . . . . . . . 54 3.3.2 Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

3.4 A subtype checking algorithm, AlgF_{∧}^{ω} . . . . . . . . . . . . . . . . . 56 3.5 Termination of subtype checking . . . . . . . . . . . . . . . . . . . . 57 3.6 Our decidability proof and full F_{≤} . . . . . . . . . . . . . . . . . . . 66

4 Typing in F_{∧}^{ω} 69 4.1 Type checking and type inference . . . . . . . . . . . . . . . . . . . 69 4.2 Minimal typing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 4.3 Decidability of type checking and type inference . . . . . . . . . . . 82 4.4 Subject reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 5 A PER Model for F_{∧}^{ω} 91

5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 5.2 Total combinatory algebras . . . . . . . . . . . . . . . . . . . . . . 92 5.3 Higher-order partial equivalence relations . . . . . . . . . . . . . . . 93 5.4 HOPER interpretation of F_{∧}^{ω} . . . . . . . . . . . . . . . . . . . . . 94

6 Multiple Inheritance 101 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 6.2 An example of multiple inheritance . . . . . . . . . . . . . . . . . . 103 6.3 Encoding multiple inheritance . . . . . . . . . . . . . . . . . . . . . 108

II First-Order Subtyping 115

7 Implicit and Explicit Subtyping 117 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 7.2 The subtyping relation . . . . . . . . . . . . . . . . . . . . . . . . . 119 7.3 Simply typed λ-calculus . . . . . . . . . . . . . . . . . . . . . . . . 127 7.4 λ_{⩽}, a system with implicit coercions . . . . . . . . . . . . . . . . . . 128 7.5 λ_{C}, a system with explicit coercions . . . . . . . . . . . . . . . . . 133 7.6 The relation between λ_{⩽} and λ_{C} . . . . . . . . . . . . . . . . . . . . 135 7.7 Simply typed λ-calculus and λ_{C} . . . . . . . . . . . . . . . . . . . 137 7.8 Confluence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 7.9 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

8 Future research 143

A Summary of Definitions 145

A.1 F_{∧}^{ω} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

A.1.1 Reduction rules for types . . . . . . . . . . . . . . . . . . . . 145 A.1.2 Reduction rules for terms . . . . . . . . . . . . . . . . . . . 145 A.1.3 Context formation rules . . . . . . . . . . . . . . . . . . . . 145 A.1.4 Kinding rules . . . . . . . . . . . . . . . . . . . . . . . . . . 146 A.1.5 Subtyping rules . . . . . . . . . . . . . . . . . . . . . . . . . 146 A.1.6 Typing rules . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 A.1.7 Subtype checking, AlgF_{∧}^{ω} subtyping rules . . . . . . . . . . . 147 A.1.8 Type inference . . . . . . . . . . . . . . . . . . . . . . . . . 148

A.2 First order subtyping . . . . . . . . . . . . . . . . . . . . . . . . . . 149 A.2.1 λ_{⩽} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 A.2.2 λ_{C} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Bibliography 151

Chapter 1

Introduction

1.1 Types and programs

One of the basic ideas in programming is the notion of algorithm. An algorithm is a description of the rules one must follow to accomplish a task. But for a machine to be able to perform such a task, this description must be expressed in a formal language, and in particular programming languages serve this purpose.

Alan Turing introduced a formal language for describing computable functions, now called Turing machines, from which imperative programming arose. The lambda calculus was invented by Alonso Church to define the notion of computable functions [Chu36]. Since then a variety of lambda calculi have been defined and used in the study of programming languages. Lambda calculi can be seen as simple programming languages, since they are formal and describe computations. In that sense, a program is a term of the lambda calculus. From a different perspective, lambda calculi constitute metalanguages for analyzing other programming languages. Although λ-calculi are particularly well-suited to studying functional programming languages, they have also been used to study imperative programming disciplines [Lan65].

Types are an important tool in programming languages and logic which serve to classify terms according to basic properties, such as being a number or being a function. For example, if we think of the integer number 5, the term is 5 and its type is integer. The addition function has a type expressing that it takes two integer numbers as arguments and returns an integer number as result, which we write as follows.

+ ∈ (integer × integer)→integer

One immediate advantage of types is that nonsensical expressions can be considered illegal. For example, the expression

3 + “good morning”

will not be part of the language because “good morning” is not an integer number, but a string of characters. Although this is a rather coarse example, this sort of mistake is very frequent in the development of programs.

Further in that direction, Automath [dB80], Martin-Löf Type Theory [Mar73], Coquand and Huet’s Calculus of Constructions [CH88], and Luo’s Extended Calculus of Constructions [Luo90] are rich type systems in which a type can not only prevent the formation of nonsensical expressions but can also state properties of terms. For example, in the case of a term corresponding to a sorting algorithm for lists, the type can express the fact that the output is an ordered list.

Type structures help organizing ideas and structuring programs in such a way that disciplines of programming and type systems walk hand in hand. The development of ideas about programming motivates the design of type systems that encourage programming in a particular style. Ideally, one would like to have tailor-made type systems for each particular style of programming, so that bad programming style results in illegal terms.

We refer the reader to [Bar90, Mit90c] for a more detailed analysis of the relation between lambda calculi and programming languages.

1.2 Subtyping

Subtyping is a primitive relation that uniformly captures concepts from diverse areas of computer science. If S and T are sets, then S ≤ T (S is a subtype of T) means that elements of S are also elements of T. If S and T are specifications, then elements satisfying specification S also satisfy T. In object-oriented programming, if S and T are object descriptions, then S ≤ T states that where an object with interface T is expected, it is safe to use an object with interface S. When S and T are module interfaces in a software system, an implementation of S is also an implementation of T. If S and T are theorems, then a proof of S is also a proof of T. Understanding the essence, subtleties, and general properties of subtyping illuminates a wide area.

The idea of subtypes appears quite naturally in programming languages. If we think of types as sets, we can easily picture what a subtype could be. Informally, we can say that a type S is a subtype of T if any element of S can be seen as an element of T. We say can be seen as and not directly is because the act of considering an element of type S as an element of type T might hide some transformation. Consider for example the types integer and real of integers and real numbers respectively. Usually, on a computer, integers are represented in a different way than real numbers are; even if we might think of the integers as a subset of the real numbers, there is a translation to be performed. The act of considering an element of type S as an element of type T will be called coercion. In other words, we say that an element of type S is coerced into an element of type T. Somehow an element of type S has enough information to be seen as an element of type T.

While dealing with coercions we can distinguish between an explicit style and an implicit style. A style with explicit coercions means that coercions are explicitly indicated and in an implicit style, as the name suggests, coercions are left unstated. In systems including subtyping there is usually a rule for typing coerced terms, in other words, a rule that provided t has type S and S is a subtype of T allows us to derive that t can be coerced into T. In an explicit style, the coercion rule might look as follows.

\frac{t ∈ S  S ≤ T}{c_{S,T} <t> ∈ T}  (Coercion)

Similarly, in an implicit style the corresponding rule is as follows.

\frac{t ∈ S  S ≤ T}{t ∈ T}  (Subsumption)

An implicit coercion is motivated by the fact that the same term can be considered as belonging to two different types without performing any change in the term, as for example is the case when one of the types is included in the other (with the intuitive idea of set inclusion), while an explicit coercion gives explicit information about the transformation. We can think, for example, of a function f with the real numbers as domain, and a (sub)set A of real numbers. If x is a variable of type A, then we would like to use f on x as well, without performing any extra calculation to apply f to x. But if instead f is used with the integer number 3 as input and f happens to use the decimal part of its argument, then 3 should be mapped into 3.0 first. Therefore one can argue that the meaning of f(3) is f(c_{integer,real}<3>).

One of the first applications of subtyping in λ-calculi was modeling the refinement of interfaces in object-oriented languages [Car88a]. The formal subtype relation S ≤ T models the assertion that the objects in some collection S provide more services than those in T, so that it is safe to use a member of S in any context where a member of T is expected.

1.3 Type inference and type checking

We can say that if a term has a type, it is, to a certain extent, correct. This correctness can be as simple as guaranteeing that computations will not fail by mismatch of the expected argument of a function, for example, and as elaborate as ensuring that certain specification or property is satisfied. With these ideas in mind, a first question one may ask is whether a given expression e is legal or correct, which in our framework means whether there exists a type T such that e ∈ T. This problem is traditionally called type inference. A related question, given a term e and a type T, is whether e ∈ T, known as type checking. In the presence of subtyping both problems, type checking and type inference, become more complicated because typing is defined in terms of subtyping. It is clear in the Subsumption and Coercion rules that in order to answer a question of the form e ∈ T we should be able to answer questions of the form S ≤ T. This shows that at the heart of the decidability of typing lies the question of whether the subtyping relation is decidable. In a system with the Subsumption rule, each term may be assigned more than one type. Then to answer the type checking and type inference questions we need a way to identify all possible types: for example, by finding some kind of representative of the types of each term. One plausible candidate is a minimal type with respect to the subtyping relation. Then type inference consists of finding a minimal type, and type checking whether e ∈ T consists of finding a minimal type S such that e ∈ S and checking if S ≤ T. Without the minimal type property, type checking becomes algorithmically intractable. Imagine that instead of having just one representative we have a (finite) set of them, say S_{1}, .., S_{n} such that for each type T of e there exists j such that S_{j} ≤ T. Imagine that e is an application, say e_{1} e_{2}: then, to find the set of representative types of e, we need to match each representative of e_{1} against each representative of e_{2}, which produces a combinatorial explosion.

1.4 Background

The formal study of subtyping in programming languages was begun by Reynolds [Rey80] and Cardelli [Car88a], who used a lambda-calculus with subtyping to model the refinement of interfaces in object oriented languages. This led to a considerable body of work, covering an increasing range of object-oriented features by combining subtyping with other type-theoretic constructs, including polymorphic functions [CW85, CG92, BCGS91]; records with update and extension operators [Car88a, CM91]; recursive types [AC93, BM92], and higher-order polymorphism [Car90, Mit90a].

Type systems with subtyping have also arisen from the study of lambda-calculi with intersection types at the University of Torino [CD80, BCD83]. Most of this work has been carried out in the setting of pure lambda-calculi, but it has also been applied to programming language design by Reynolds [Rey88]. Some work has begun on combining intersections with other typing features [Pie91, CDdL93].

The contribution of this thesis is to weave together these two threads by combining higher-order subtyping, which forms the cornerstone of several recent models of typed object-oriented programming [CHC90, Bru94, PT94], with intersection types, leading to an extended object model with multiple inheritance [CP93].

1.5 Results

This thesis is divided into two parts the first part consists of a detailed analysis of the meta-theory of a typed lambda calculus combining higher order bounded quantification and intersection types. Our research covers syntactic, semantic, and pragmatic aspects.

• Chapter 2 contains the definition of the system F_{∧}^{ω} and basic syntactic results.

– We define the typed lambda calculus F_{∧}^{ω}, a natural generalization of Girard’s system F^{ω} with intersection types and bounded polymorphism. A novel aspect of our presentation is the use of term rewriting techniques to present intersection types, which clearly splits the computational semantics (reduction rules) from the syntax (inference rules) of the system.

– The reduction rules of F_{∧}^{ω} can be divided into two main groups, reductions on types (→_{β∧}) and reductions on terms (→_{βfors}). Although confluence is not a modular property in general, in our case it is possible to provide a modular proof of it. In section 2.3, we combine the independent proofs of confluence for reductions on types and confluence for reduction on terms towards a proof of confluence of the reduction relation in the whole system.

– We prove the strong normalization property of →_{β∧} on well-formed types.

• Chapter 3 carries the most important result of this thesis. Our main contribution is the proof that subtyping in F_{∧}^{ω} is decidable. This yields as a corollary a solution to the previously open problem of the decidability of subtyping in F_{≤}^{ω}, its intersection free fragment, because F_{∧}^{ω} subtyping system is a conservative extension of that of F_{≤}^{ω}. Moreover, the decidability of subtyping is essential for the decidability of type checking and type inference. Another original feature is the use of a choice operator to model the behavior of variables during subtype checking. The proof of decidability is divided into the following steps.

– We define an algorithmic presentation of the subtyping relation where only types in normal form are considered.

– We prove that the algorithmic presentation is sound and complete with respect to the definition of subtyping, which means that it constitutes a deterministic procedure to check subtyping in F_{∧}^{ω}.

– Finally, we prove that the algorithmic presentation describes a terminating procedure. The proof of termination is reduced to the strong normalization property of the reduction on types enriched with a choice reduction which models the behavior of variables during subtype checking.

• In chapter 4, we prove that F_{∧}^{ω} satisfies the minimal type property, and we provide an algorithm for computing minimal types. We also prove that type inference and type checking in F_{∧}^{ω} are decidable. The minimal types property is used to prove that F_{∧}^{ω} satisfies the subject reduction property.

• In chapter 5, we define a model based on partial equivalence relations, and we prove that the subtyping relation and the type assignment system are sound with respect to the model.

• Although F_{∧}^{ω} was defined to provide a model of object-oriented programming with multiple inheritance, this thesis does not intend to provide an account on the foundations of object-oriented programming. In chapter 6, we show how to model multiple inheritance using intersection types. This is a continuation of the research on type-theoretic foundations of object-oriented programming by Pierce and Turner [PT94] where multiple inheritance is not captured.

The second part of this thesis is devoted to the study of two different styles of subtyping, subtyping with implicit coercions and subtyping with explicit coercions. We define and study two alternative presentations of subtyping for simply typed lambda calculus. The first one λ_{⩽}, a system with implicit coercions, and the second one λ_{C}, a system with explicit coercions. We show that the system λ_{⩽} can be translated into λ_{C}, and that λ_{C} can be translated into λ→. This means that from a pragmatic point of view, implicit or explicit coercions are just a matter of taste, and both disciplines can be compiled into the simply typed lambda calculus without subtyping.

Part I

Higher-Order Subtyping The F_{∧}^{ω} Calculus

2.1 Introduction

The system F_{∧}^{ω} was first introduced in [CP93], where it was shown to be rich enough to provide a typed model of object oriented programming with multiple inheritance. F_{∧}^{ω} is an extension of F^{ω} [Gir72] with bounded quantification and intersection types, which can be seen as a natural generalization of the type disciplines present in the current literature, for example in [CG92, Pie91, PT94, CP94]. Systems including either subtyping or intersection types or both have been widely studied for many years. What follows is not intended to be an exhaustive description, but a framework for the present work.

First-order type disciplines with intersection types have been investigated by the group in Torino [CDC78, BCD83] and elsewhere (see [CC90] for background and further references). A second-order λ-calculus with intersection types was studied in [Pie91]. Systems including subtyping were present in [CW85, Car88a]. Higher order generalizations of subtyping appear in [CCH^{+}89, CHC90, Mit90a, BM92]. F_{≤}, a second-order λ-calculus with bounded quantification, was studied in [Ghe90], and in [Pie91] it was proved that subtyping in F_{≤} was undecidable and that undecidability was caused by the subtyping rule for bounded quantification.

In [CP94] an alternative rule for subtyping quantified types was presented and the decidability of subtyping was proved for an extension of system F with bounded polymorphism, where all bounds appearing in S-All have the ground kind ⋆, a main limitation of that system.

Allowing bounds of functional kind forces us to introduce a conversion rule to have invariance of subtyping under β∧-conversion of types. Therefore, our subtyping relation relates types of a more expressive type system than that presented in [CP94]. In fact, treating the interaction between interface refinement and encapsulation of objects, in object oriented programming, has required higher-order generalizations of subtyping–the F-bounded quantification of Canning, Cook, Hill, Olthoff and Mitchell [CCH^{+}89] or Cardelli and Mitchell’s system F_{≤}^{ω} [Car90, Mit90a, BM92].

10 CHAPTER 2. THE F_{∧}^{ω} CALCULUS

Ghelli [Ghe94] remarked that the rule for subtyping between quantified types presented in [CP94] led to a well-behaved subtyping relation but that the typing relation fails to satisfy the minimal type property. This failure introduces serious problems in type checking and type inference, as we observed in chapter 1. At the moment it is not clear how to solve them or, even more problematic, whether the typing relation is decidable. A possible solution to overcome this problem is to replace the subtyping rule between quantifiers by the corresponding rule of Cardelli and Wegner’s kernel fun [CW85].

In chapter 3 we give a positive answer to the decidability of subtyping in the presence of β∧-convertible types. We prove that subtyping in F_{∧}^{ω} is decidable, which a fortiori gives the decidability of subtyping for the F_{≤}^{ω} fragment because the former is a conservative extension of the latter – namely, each subtyping statement derivable in F_{∧}^{ω} containing no intersections other than the empty ones is also derivable in F_{≤}^{ω}.

We present a definition of F_{∧}^{ω} that differs from the one introduced in [CP93] in two ways. First, Castagna and Pierce’s quantifier rule has been replaced by the Cardelli and Wegner rule. Second, we introduce a richer notion of reduction on types, and thereby the four distributivity rules become particular cases of the conversion rule. This new reduction is shown to be confluent and strongly normalizing. The latter simplification was motivated by structural properties of the former presentation. Furthermore, this new presentation provides a different view of the system that is the key to proving the decidability of subtyping.

This new perspective suggests that to prove the decidability of subtyping it is enough to concentrate on types in normal form. Note that the solution cannot be as simple as to restrict the subtyping rules of F_{∧}^{ω} to handle only types in normal form and replace conversion by reflexivity. The following is a good example of the problem to be solved. Consider Γ ≡ W:K, X ≤ ΛY:K.Y:K→K, Z ≤ X:K→K. Then Γ ⊢ X(Z W) ≤ W, which is not derivable without using conversion, i.e. without performing any β-reduction, even when the conclusion is in normal form.

The subtyping rules of F_{∧}^{ω} are not syntax directed, in the sense that the form of a derivable subtyping statement does not uniquely determine the last rule of its derivation (i.e. there might be more than one derivation of the same subtyping judgement). To develop a deterministic decision procedure to check subtyping, we need a new presentation of the subtyping relation that provides the foundations for a subtype-checking deterministic algorithm.

Our solution is divided in two main steps. First, we develop a normal subtyping system, NF_{∧}^{ω}, in which only types in normal form are considered. We prove that derivations in NF_{∧}^{ω} can be normalized by eliminating transitivity and simplifying reflexivity. This simplification yields an algorithmic presentation, AlgF_{∧}^{ω}. Moreover, we prove that AlgF_{∧}^{ω} is indeed an alternative presentation of the F_{∧}^{ω} subtyping relation, that is Γ ⊢ S ≤ T if and only if Γ^{nf} ⊢_{Alg} S^{nf} ≤ T^{nf} (proposition 3.4.3).

The second and last step towards the decidability of subtyping in F_{∧}^{ω} is to prove that the algorithm described by AlgF_{∧}^{ω} terminates, which is equivalent to showing that the definition of the AlgF_{∧}^{ω} is well-founded. We discuss this further in section 3.5.

2.2. SYNTAX OF F_{∧}^{ω} 11

Checking whether Γ ⊢_{Alg} S T ≤ A is reduced to checking if Γ ⊢_{Alg} lub_{Γ}(S T)^{nf} ≤ A, where lub_{Γ}(S T) substitutes the leftmost innermost variable of S T by its bound in Γ. Such replacements may produce a term that is not in normal form, in which case we normalize it afterwards. The main problem here is that the size of the types to be examined in the recursive call does not decrease. This indicates that the proof of termination of the algorithm is not immediate. In particular, the proof of termination presented in [CP94] cannot be modified to serve our purposes, because of the interaction between β∧-reduction and the substitution of type variables by their bounds in our system. We discuss this further in section 3.5.

In this chapter we present the syntax of F_{∧}^{ω}, we prove structural properties of the system, confluence, and the strong normalization property for the reduction on types.

2.2 Syntax of F_{∧}^{ω}

We now present the rules for kinding, subtyping, and typing in F_{∧}^{ω}. They are organized as proof systems for four interdependent judgement forms:

Γ ⊢ ok  well-formed context
Γ ⊢ T ∈ K well-kinded type
Γ ⊢ S ≤ T subtype
Γ ⊢ e ∈ T well-typed term.

We sometimes use the metavariable Σ to range over statements (right-hand sides of judgements) of any of these four forms.

Syntactic Categories

The kinds of F_{∧}^{ω} are those of F^{ω}: the kind ⋆ of proper types and the kinds K_{1}→K_{2} of functions on types (sometimes called type operators).

𝕂 ::= ⋆  types
𝕂 →𝕂 type operators

The language of types of F_{∧}^{ω} is a straightforward higher-order extension of F_{≤}, Cardelli and Wegner’s second-order calculus of bounded quantification. Like F_{≤}, it includes type variables (written X), function types (T →T′), and polymorphic types (∀X≤T:K.T′), in which the bound type variable X ranges over all subtypes of the upper bound T. Moreover, like F^{ω}, we allow types to be abstracted on types (ΛX:K.T) and applied to argument types (T T′); in effect, these forms introduce a simply typed λ-calculus at the level of types. Finally, we allow arbitrary finite intersections (⋀^{K}[T_{1}..T_{n}]), where all the T_{i}’s are members of the same kind K.

𝕋 ::= X  type variable
𝕋→𝕋  function type
∀X≤𝕋:𝕂 .𝕋 polymorphic type
ΛX:𝕂 .𝕋  operator abstraction
𝕋 𝕋  operator application
⋀^{𝕂}[𝕋..𝕋] intersection at kind 𝕂

We use the abbreviation ⊤^{K} for nullary intersections and sometimes X:K for X ≤ ⊤^{K}:K.

\begin{matrix}⊤^{K} & ≜ & ⋀^{K}[ ] \\ X:K & ≜ & X ≤ ⊤^{K}:K \end{matrix}

We drop the maximal type Top of F_{≤}, since its role is played here by the empty intersection ⊤^{⋆}. For technical convenience, we provide kind annotations on bound variables and intersections so that every type has an “obvious kind,” which can be read off directly from its structure and the kind declarations in the context.

The language of terms includes the variables (x), applications (e e) , and functional abstractions (λx:T.e) of the simply typed λ-calculus, plus the type abstraction (λX≤T:K.e) and application (e T) of F^{ω}. As in F_{≤}, each type variable is given an upper bound at the point where it is introduced.

Intersection types are introduced by expressions of the form “for(X∈T_{1}..T_{n})e”, which can be read as instructions to the type-checker to analyze the expression e separately under the assumptions X ≡ T_{1}, X ≡ T_{2}, …, X ≡ T_{n} and conjoin the results. For example, if + ∈ Int→Int→Int ∧ Real→Real→Real, then we can derive

for(X∈Int, Real)λx:X.x + x ∈ Int→Int ∧ Real→Real.

e ::= x  variable
λx:𝕋.e  abstraction
e e  application
λX≤𝕋:𝕂 .e type abstraction
e 𝕋  type application
for(X∈𝕋..𝕋)e alternation

The operational semantics of F_{∧}^{ω} is given by the following reduction rules on types and terms.

Definition 2.2.1 (Reduction rules for types)

1. (ΛX:K.T_{1})T_{2} →_{β∧} T_{1}[X←T_{2}] 2. S → ⋀^{⋆}[T_{1}..T_{n}] →_{β∧} ⋀^{⋆}[S→T_{1} .. S→T_{n}]

3. ∀X≤S:K.⋀^{⋆}[T_{1}..T_{n}] →_{β∧} ⋀^{⋆}[∀X≤S:K.T_{1} .. ∀X≤S:K.T_{n}]

4. ΛX:K_{1}.⋀^{K_{2}}[T_{1}..T_{n}] →_{β∧} ⋀^{K_{1}→K_{2}}[ΛX:K_{1}.T_{1} .. ΛX:K_{1}.T_{n}]

5. (⋀^{K_{1}→K_{2}}[T_{1}..T_{n}]) U →_{β∧} ⋀^{K_{2}}[T_{1} U .. T_{n} U]

6. ⋀^{K}[T_{1} .. ⋀^{K}[S_{1}..S_{n}] .. T_{m}] →_{β∧} ⋀^{K}[T_{1} .. S_{1}..S_{n} .. T_{m}]

The first rule is the usual β-reduction rule for types. Rules 2 through 5 express the fact that intersections in positive positions distribute with respect to the other type constructors. Rule 6 states that intersection is an associative operator. In section 2.5 we consider the reduction defined by rules 1 through 5 as →_{β∧}^{−} and the one defined by 6 as →_{a} (a comes from associativity). The left-hand side of each reduction rule is a redex and the right-hand side its reduct. The relation →_{β∧} is extended so as to become a compatible relation with respect to type formation, ↠_{β∧} is the transitive and reflexive closure of →_{β∧}, and =_{β∧} is the least equivalence relation containing →_{β∧}. The capture-avoiding substitution of S for X in T is written T [X←S]. Substitution is written similarly for terms, and is extended point-wise to contexts. The β∧-normal form of a type S is written S^{nf}, and is extended point-wise to contexts.

Definition 2.2.2 (Reduction rules for terms)

1. (λx:T_{1}.e_{1})e_{2} →_{βfors} e_{1}[x←e_{2}]

2. (λX≤T_{1}:K_{1}.e)T →_{βfors} e[X←T]

3. (for(X∈T_{1}..T_{n})e_{1})e_{2} →_{βfors} for(X∈T_{1}..T_{n})(e_{1} e_{2})

4. for(X∈T_{1}..T_{n})e →_{βfors} e, if X ∉ FV(e)

Rules 1 and 2 are the β-reductions on terms. Rule 3 says that the for constructor can be pushed to the outermost level. We consider the reduction defined by rules 1 through 3 as →_{βfor} and the one defined by 4 as →_{s} (s comes from simplification). The left-hand side of each reduction rule is a redex and the righthand side its reduct. The relation →_{βfors} is extended so as to become a compatible relation with respect to term formation, ↠_{βfors} is the transitive reflexive closure of →_{βfors}, and =_{βfors} is the least equivalence relation containing →_{βfors}.

Contexts

A context Γ is a finite sequence of typing and subtyping assumptions for a set of term and type variables.

The empty context is written ∅. Term variable bindings have the form x:T; type variable bindings have the form X≤T:K, where T is the upper bound of X and K is the kind of T.

Γ ::= ∅  empty context
Γ, x:T  term variable declaration
Γ, X≤T:K type variable declaration

When writing nonempty contexts, we omit the initial ∅. The domain of Γ is written dom(Γ). The functions FV(—) and FTV(—) give the sets of free term variables and free type variables of a term, type, or context. Since we are careful to ensure that no variable is bound more than once, we sometimes abuse notation and consider contexts as finite functions: Γ(X) yields the bound of X in Γ, where X is implicitly asserted to be in dom(Γ).

Types, terms, contexts, statements, and derivations that differ only in the names of bound variables are considered identical. The underlying idea is that variables are de Bruijn indexes [dB72].

Definition 2.2.3 (Closed)

1. A term e is closed with respect to a context Γ if FV(e) ∪ FTV(e) ⊆ dom(Γ).

2. A type T is closed with respect to a context Γ if FTV(T) ⊆ dom(Γ).

3. A typing statement Γ ⊢ e ∈ T is closed if e and T are closed with respect to Γ.

4. A kinding statement Γ ⊢ T ∈ K is closed if T is closed with respect to Γ.

5. A subtyping statement Γ ⊢ S ≤ T is closed if S and T are closed with respect to Γ.

We consider only closed typing statements. Observe that in the limit case of the rule T-Meet, when n = 0, not having the closure convention would allow nonsensical terms to be typed. On the other hand, the free variable lemma (lemma 2.4.3) guarantees that kinding statements are closed and the well-kindedness of subtyping (lemma 2.4.19) ensures that subtyping statements are closed as well.

Context Formation

The rules for well-formed contexts are the usual ones: a start rule for the empty context and rules allowing a given well-formed context to be extended with either a term variable binding or a type variable binding.

∅ ⊢ ok  (C-Empty)

\frac{Γ ⊢ T ∈ ⋆  x ∉ dom(Γ)}{Γ, x:T ⊢ ok}  (C-Var)

\frac{Γ ⊢ T ∈ K  X ∉ dom(Γ)}{Γ, X≤T:K ⊢ ok}  (C-TVar)

Type Formation

For each type constructor, we give a rule specifying how it can be used to build well-formed type expressions. The critical rules are K-OAbs and K-OApp, which form type abstractions and type applications (essentially as in a simply typed λ-calculus).

The well-formedness premise Γ ⊢ ok in K-Meet (and in T-Meet below) is required for the case where n = 0.

\frac{Γ_{1}, X≤T:K, Γ_{2} ⊢ ok}{Γ_{1}, X≤T:K, Γ_{2} ⊢ X ∈ K}  (K-TVar)

\frac{Γ ⊢ T_{1} ∈ ⋆  Γ ⊢ T_{2} ∈ ⋆}{Γ ⊢ T_{1}→T_{2} ∈ ⋆}  (K-Arrow)

\frac{Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆}{Γ ⊢ ∀X≤T_{1}:K_{1}.T_{2} ∈ ⋆}  (K-All)

\frac{Γ, X:K_{1} ⊢ T_{2} ∈ K_{2}}{Γ ⊢ ΛX:K_{1}.T_{2} ∈ K_{1}→K_{2}}  (K-OAbs)

\frac{Γ ⊢ S ∈ K_{1}→K_{2}  Γ ⊢ T ∈ K_{1}}{Γ ⊢ S T ∈ K_{2}}  (K-OApp)

\frac{Γ ⊢ ok  for each i∈\{1..n\} , Γ ⊢ T_{i} ∈ K}{Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ∈ K}  (K-Meet)

Subtyping

The rules defining the subtype relation are a natural extension of familiar calculi of bounded quantification. Aside from some extra well-formedness conditions, the rules S-Trans, S-TVar, and S-Arrow are the same as in the usual, second-order case. Rules S-OAbs and S-OApp extend the subtype relation point-wise to kinds other than ⋆. The rule of type conversion in F^{ω}, that is, if Γ ⊢ e ∈ T and T =_{β} T′ then Γ ⊢ e ∈ T′, is captured here as the subtyping rule S-Conv, which also gives reflexivity as a special case. The rule S-All is the rule of Cardelli’s Fun language [CW85] in which the bounds of the quantifiers are equal. Rules S-Meet-G and S-Meet-LB specify that an intersection of a set of types is the set’s order-theoretic greatest lower bound.

\frac{Γ ⊢ S ∈ K  Γ ⊢ T ∈ K  S =_{β∧} T}{Γ ⊢ S ≤ T}  (S-Conv)

\frac{Γ ⊢ S ≤ T  Γ ⊢ T ≤ U}{Γ ⊢ S ≤ U}  (S-Trans)

\frac{Γ_{1}, X≤T:K, Γ_{2} ⊢ ok}{Γ_{1}, X≤T:K, Γ_{2} ⊢ X ≤ T}  (S-TVar)

\frac{Γ ⊢ T_{1} ≤ S_{1}  Γ ⊢ S_{2} ≤ T_{2}  Γ ⊢ S_{1}→S_{2} ∈ ⋆}{Γ ⊢ S_{1}→S_{2} ≤ T_{1}→T_{2}}  (S-Arrow)

\frac{Γ, X≤U:K ⊢ S ≤ T  Γ ⊢ ∀X≤U:K.S ∈ ⋆}{Γ ⊢ ∀X≤U:K.S ≤ ∀X≤U:K.T}  (S-All)

\frac{Γ, X:K ⊢ S ≤ T}{Γ ⊢ ΛX:K.S ≤ ΛX:K.T}  (S-OAbs)

\frac{Γ ⊢ S ≤ T  Γ ⊢ S U ∈ K}{Γ ⊢ S U ≤ T U}  (S-OApp)

\frac{for each i∈\{1..n\} , Γ ⊢ S ≤ T_{i}  Γ ⊢ S ∈ K}{Γ ⊢ S ≤ ⋀^{K}[T_{1}..T_{n}]}  (S-Meet-G)

\frac{Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ∈ K}{Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ≤ T_{i}}  (S-Meet-LB)

Term Formation

Except for T-Meet and T-For, the term formation rules are precisely those of the second-order calculus of bounded quantification. T-For provides for type checking under any of a set of alternate assumptions. For each S_{i}, the type derived for the instance of the body e when X is replaced by S_{i} is a valid type of the for expression itself. The T-Meet rule can then be used to collect these separate typings into a single intersection. Type-theoretically, T-Meet is the introduction rule for the ∧ constructor; the corresponding elimination rule need not be given explicitly, since

it follows from T-Subsumption and S-Meet-LB.

\frac{Γ_{1}, x:T , Γ_{2} ⊢ ok}{Γ_{1}, x:T , Γ_{2} ⊢ x ∈ T}  (T-Var)

\frac{Γ, x:T_{1} ⊢ e ∈ T_{2}}{Γ ⊢ λx:T_{1}.e ∈ T_{1}→T_{2}}  (T-Abs)

\frac{Γ ⊢ f ∈ T_{1}→T_{2}  Γ ⊢ a ∈ T_{1}}{Γ ⊢ f a ∈ T_{2}}  (T-App)

\frac{Γ, X≤T_{1}:K_{1} ⊢ e ∈ T_{2}}{Γ ⊢ λX≤T_{1}:K_{1}.e ∈ ∀X≤T_{1}:K_{1}.T_{2}}  (T-TAbs)

\frac{Γ ⊢ f ∈ ∀X≤T_{1}:K_{1}.T_{2}  Γ ⊢ S ≤ T_{1}}{Γ ⊢ f S ∈ T_{2}[X←S]}  (T-TApp)

\frac{Γ ⊢ e[X←S]∈T  S ∈ \{S_{1}..S_{n}\}}{Γ ⊢ for(X∈S_{1}..S_{n})e ∈ T}  (T-For)

\frac{Γ ⊢ ok  for each i∈\{1..n\} , Γ ⊢ e ∈ T_{i}}{Γ ⊢ e ∈ ⋀^{⋆}[T_{1}..T_{n}]}  (T-Meet)

\frac{Γ ⊢ e ∈ S  Γ ⊢ S ≤ T}{Γ ⊢ e ∈ T}  (T-Subsumption)

Most of the rules include premises which have two rather different sorts: structural premises, which play an essential role in giving the rule its intended semantic force, and well-formedness premises, which ensure that the entities named in the rule are of the expected sorts. In an algorithmic presentation of the system (on which an implementation might be based), the well-formation premises would be replaced by the meta-theoretic observation that “recursive calls” in the premises of all the rules preserve the well-formedness of the “arguments” named in the conclusion.

In the interest of brevity, we omit well-formation premises that can be derived from others. For example, in the rule S-Arrow, we drop the premise Γ ⊢ T_{1}→T_{2} ∈ ⋆, since it follows from Γ ⊢ S_{1}→S_{2} ∈ ⋆ using the properties proved in section 2.4.

2.2.1 Discussion

An equivalent presentation of intersection types uses binary intersections as in [CDC78]. The intersection of S and T is then written S ∧ T, and there is a maximal element at each kind, ω^{K}. The rules of the system have to be modified according to this alternative notation. In most cases, each of our rules about intersection types has to be replaced by two rules, one for the binary case and another for the maximal element. For example, the reduction rule

∀X≤S:K.⋀^{⋆}[T_{1}..T_{n}] →_{β∧} ⋀^{⋆}[∀X≤S:K.T_{1} .. ∀X≤S:K.T_{n}]

is replaced by

\begin{aligned}∀X≤S:K.T_{1} ∧ T_{2} & →_{β∧} & ∀X≤S:K.T_{1} ∧ ∀X≤S:K.T_{2} & and \\ ∀X≤S:K.ω^{⋆} & →_{β∧} & ω^{⋆}. \end{aligned}

Similar replacement takes place for rules 3 through 5 in definition 2.2.1. The term formation rule K-Meet is replaced by the two following rules.

\frac{Γ ⊢ S ∈ K  Γ ⊢ T ∈ K}{Γ ⊢ S ∧ T ∈ K}  (K-Int)

\frac{Γ ⊢ ok}{Γ ⊢ ω^{K} ∈ K}  (K-Max)

The rule S-Meet-G is replaced by the following two rules.

\frac{Γ ⊢ S ≤ T_{1} Γ ⊢ S ≤ T_{2}}{Γ ⊢ S ≤ T_{1} ∧ T_{2}}  (S-Int-G)

\frac{Γ ⊢ S ∈ K}{Γ ⊢ S ≤ ω^{K}}  (S-Max)

In the λ-cube [Bar92], F^{ω}corresponds to λ_{ω}, the system defined by the rules (⋆, ⋆), (□, ⋆), and (□, □). If K is a kind defined by the grammar 𝕂, then

Γ ⊢_{λ_{ω}} K ∈ □.

The rule (□, □) corresponds to the recursive step in the definition of 𝕂; the rule (⋆, ⋆) corresponds to K-Arrow, and K-All is the parallel of rule (□, ⋆) enriched with subtyping.

2.3 Confluence

In this section, we show that the system F_{∧}^{ω} is confluent. By that we mean that the reduction →_{βfors} ∪ →_{β∧} defined by putting together the reduction on terms, →_{βfors} (definition 2.2.2), and the reduction on types, →_{β∧} (definition 2.2.1), satisfies the Church-Rosser property. We use the Hindley-Rosen lemma (c.f. 3.3.5 [Bar84]) to establish this result. This factors the proof into two parts:

1. proving that ↠_{βfors} and ↠_{β∧} commute, and

2. proving that →_{βfors} and →_{β∧} satisfy the Church-Rosser property, the results of sections 2.3.1 and 2.3.2.

Remember that two binary relations →_{1} and →_{2} commute if the following diagram commutes.

[figure: A; 1; B; C; 2; .; .; .; .; .; .; .; .; .; .; 1; D; . . . . . . . . . .; 2]

In order to prove that ↠_{βfors} and ↠_{β∧} commute we use the following lemma.

Lemma 2.3.1 (3.3.6 [Bar84]) Let →_{1} and →_{2} be two binary relations on a set X. Suppose

[figure: A; 1; B; C; 2; .; .; .; .; .; .; .; .; .; .; =1; D; . . . . . . . . .; 2]

where →_{=1} is the reflexive closure of →_{1}. Hence → →_{1} and → →_{2} commute.

We need the following auxiliary result to prove that ↠_{β∧} and ↠_{βfors} commute using the previous lemma.

Lemma 2.3.2 If T →_{β∧} T′, then e[X←T] ↠_{β∧} e[X←T′].

Proof: By induction on the structure of T. □

Lemma 2.3.3

E \overline{_{βfors}} F

[figure: G; β∧; .; .; .; .; .; .; .; .; .; .; =βfors; H; . . . . . . . . .; β∧]

Proof: By induction on the structure of E. Observe that if E is a type expression (E∈𝕋) then there can be only β∧-reductions starting from E, and the result holds vacuously. Consequently, the meaningful cases are when E is a term (E∈𝔼), and of those the interesting cases are when E is a βfors redex.

1. \begin{aligned}E & ≡ & (λx:T_{1}.e_{1})e_{2}, \\ F & ≡ & e_{1}[x←e_{2}], \\ G & ≡ & (λx:T′_{1}.e_{1})e_{2}, and \\ T_{1} & →_{β∧} & T′_{1}. \end{aligned}

Choose H ≡ F. Since (λx:T′_{1}.e_{1})e_{2} →_{βfors} e_{1}[x←e_{2}], the result follows.

2. \begin{aligned}E & ≡ & (λX≤T_{1}:K_{1}.e)S, \\ F & ≡ & e[X←S], \\ G & ≡ & (λX≤T_{1}:e.)S′, and \\ S & →_{β∧} & S′. \end{aligned}

Choose H ≡ e[X←S′]. Since (λX≤T_{1}:K_{1}.e)S′ →_{βfors} e[X←S′], the result follows by lemma 2.3.2.

3. E ≡ (for(X∈T_{1}..T_{i}..T_{n})e_{1})e_{2},

F ≡ for(X∈T_{1}..T_{i}..T_{n})(e_{1}e_{2}),
G ≡ (for(X∈T_{1}..T′_{i}..T_{n})e_{1})e_{2}, and
T_{i} →_{β∧} T′_{i}.

Choose H ≡ for(X∈T_{1}..T′_{i}..T_{n})(e_{1}e_{2}).

Since (for(X∈T_{1}..T′_{i}..T_{n})e_{1})e_{2} →_{βfors} for(X∈T_{1}..T′_{i}..T_{n})(e_{1}e_{2}) and for(X∈T_{1}..T_{i}..T_{n})(e_{1}e_{2}) →_{β∧} for(X∈T_{1}..T′_{i}..T_{n})(e_{1}e_{2})

the result follows.

4. E ≡ for(X∈T_{1}..T_{i}..T_{n})e,

F ≡ e,
G ≡ for(X∈T_{1}..T′_{i}..T_{n})e, and
T_{i} →_{β∧} T′_{i}.

Choose H ≡ F. Since for(X∈T_{1}..T′_{i}..T_{n})e →_{βfors} e, the result follows. □

Corollary 2.3.4 ↠_{β∧} and ↠_{βfors} commute.

2.3.1 The Church-Rosser theorem for →_{β∧}

In this section we prove the Church-Rosser property for the reduction defined in 2.2.1. The strategy we use here is similar to the one used in chapter 11 section 1 of [Bar84] to prove the corresponding result for →_{β} in the type-free λ-calculus.

In order to prove the Church-Rosser property for →_{β∧} it is sufficient to show the following strip lemma. If S, T_{1}, T_{2} in 𝕋 are such that S →_{β∧} T_{1} and S ↠_{β∧} T_{2}, then there exists T_{3} such that T_{1} ↠_{β∧} T_{3} and T_{2} ↠_{β∧} T_{3}. Graphically:

[figure: S; β∧; T_{2}; T_{1}; β∧; .; .; .; .; .; .; .; .; β∧; T_{3}; . . . . . . . .; β∧]

The idea of the proof is as follows. Let T_{1} be the result of replacing the redex R in S by its reduct R′. If we keep track of what happens with R during the reduction S ↠_{β∧} T_{2}, then we can find T_{3}. To be able to trace R we define a new set of terms \underline{𝕋} where redexes can appear underlined. Consequently, if we underline R in S we only need to reduce all occurrences of the underlined R in T_{2} to obtain T_{3}.

Definition 2.3.1.1 (Underlining)

1. \underline{𝕋} is the set of terms defined by the following abstract syntax.

\underline{𝕋} ::= X | \underline{𝕋}→\underline{𝕋}
| ∀X≤\underline{𝕋}:𝕂 .\underline{𝕋} | ΛX:𝕂 .\underline{𝕋}
| \underline{𝕋} \underline{𝕋} | ⋀^{𝕂}[\underline{𝕋}..\underline{𝕋}]
| (ΛX:𝕂. \underline{𝕋}) \underline{𝕋} | ⋀^{𝕂}[\underline{𝕋} .. \underline{⋀^{𝕂}[\underline{𝕋} .. \underline{𝕋}]} .. \underline{𝕋}]
| \underline{\underline{𝕋} → ⋀^{⋆}[\underline{𝕋} .. \underline{𝕋}]} | \underline{∀X≤\underline{𝕋}:𝕂 .⋀^{⋆}[\underline{𝕋} .. \underline{𝕋}]}
| \underline{ΛX:𝕂 .⋀^{𝕂}[\underline{𝕋} .. \underline{𝕋}]} | \underline{⋀^{𝕂 →𝕂}[\underline{𝕋} .. \underline{𝕋}] \underline{𝕋}}

Observe that only redexes are underlined.

2. Underlined (one step) reduction →\underline{β∧} is defined starting with the rewriting rules

(a) (ΛX:K.T_{1}) T_{2} →\underline{β∧} T_{1}[X←T_{2}]

(b) S → ⋀^{⋆}[T_{1}..T_{n}] →\underline{β∧} ⋀^{⋆}[S→T_{1} .. S→T_{n}]

(c) ∀X≤S:K.⋀^{⋆}[T_{1}..T_{n}] →\underline{β∧} ⋀^{⋆}[∀X≤S:K.T_{1} .. ∀X≤S:K.T_{n}]

(d) ΛX:K_{1}.⋀^{K_{2}}[T_{1}..T_{n}] →\underline{β∧} ⋀^{K_{1}→K_{2}}[ΛX:K_{1}.T_{1} .. ΛX:K_{1}.T_{n}]

(e) ⋀^{K_{1}→K_{2}}[T_{1}..T_{n}] U →\underline{β∧} ⋀^{K_{2}}[T_{1} U .. T_{n} U]

(f) ⋀^{K}[T_{1} .. ⋀^{K}[S_{1}..S_{n}] .. T_{m}] →\underline{β∧} ⋀^{K}[T_{1} .. S_{1}..S_{n} .. T_{m}]

2.3. CONFLUENCE 21

(g) \underline{(ΛX:K.T_{1}) T_{2}} →\underline{β∧} T_{1}[X←T_{2}]

(h) \underline{S → ⋀^{⋆}[T_{1}..T_{n}]} →\underline{β∧} ⋀^{⋆}[S→T_{1} .. S→T_{n}]
(i) \underline{∀X≤S:K.⋀^{⋆}[T_{1}..T_{n}]} →\underline{β∧} ⋀^{⋆}[∀X≤S:K.T_{1} .. ∀X≤S:K.T_{n}]
(j) \underline{ΛX:K_{1}.⋀^{K_{2}}[T_{1}..T_{n}]} →\underline{β∧} ⋀^{K_{1}→K_{2}}[ΛX:K_{1}.T_{1} .. ΛX:K_{1}.T_{n}]

(k) \underline{⋀^{K_{1}→K_{2}}[T_{1}..T_{n}] U} →\underline{β∧} ⋀^{K_{2}}[T_{1} U .. T_{n} U].

(l) ⋀^{K}[T_{1} .. \underline{⋀^{K}[S_{1}..S_{n}]} .. T_{m}] →\underline{β∧} ⋀^{K}[T_{1} .. S_{1}..S_{n} .. T_{m}]

→\underline{β∧} is extended so as to become a compatible relation with respect to \underline{𝕋}, and ↠\underline{β∧} is the reflexive and transitive closure of →\underline{β∧}.

3. If T ∈ \underline{𝕋}, then |T | ∈ 𝕋 is obtained from T by erasing all underlinings.

4. The capture avoiding substitution for underlined terms is written as usual,

T [X←S]. Definition 2.3.1.2 The map φ : \underline{𝕋} → 𝕋 is defined inductively as follows.

1. φ(X) ≡ X;

2. φ(T_{1} → T_{2}) ≡ φ(T_{1}) → φ(T_{2});

3. φ(∀X≤T_{1}:K.T_{2}) ≡ ∀X≤φ(T_{1}):K.φ(T_{2});

4. φ(ΛX:K.T) ≡ ΛX:K.φ(T);

5. φ(T_{1} T_{2}) ≡ φ(T_{1}) φ(T_{2});

6. φ(⋀^{K}[T_{1}..T_{n}]) ≡ ⋀^{K}[φ(T_{1}) .. φ(T_{n})];

7. φ(\underline{(ΛX:K.T_{1}) T_{2}}) ≡ φ(T_{1})[X←φ(T_{2})];

8. φ(\underline{S → ⋀^{⋆}[T_{1}..T_{n}]}) ≡ ⋀^{⋆}[φ(S → T_{1}) .. φ(S → T_{n})];

9. φ(\underline{∀X≤S:K_{1}.⋀^{⋆}[T_{1}..T_{n}]}) ≡ ⋀^{⋆}[φ(∀X≤S:K_{1}.T_{1}) .. φ(∀X≤S:K_{1}.T_{n})];

10. φ(\underline{ΛX:K_{1}.⋀^{K_{2}}[T_{1}..T_{n}]}) ≡ ⋀^{K_{1}→K_{2}}[φ(ΛX:K_{1}.T_{1}) .. φ(ΛX:K_{1}.T_{n})];

11. φ(\underline{⋀^{K_{1}→K_{2}}[T_{1}..T_{n}] S}) ≡ ⋀^{K_{2}}[φ(T_{1} S) .. φ(T_{n} S)];

12. φ(⋀^{K}[T_{1} .. \underline{⋀^{K}[S_{1}..S_{n}]} .. T_{m}]) ≡ ⋀^{K}[φ(T_{1}) .. φ(S_{1}) .. φ(S_{n}) .. φ(T_{m})]. Observe that φ reduces all underlined redexes.

Notation: |T | ≡ S and φ(T) ≡ S will be written:

T  \overline{^{|−|}} S and T  \overline{^{φ}} S.

22 CHAPTER 2. THE F_{∧}^{ω} CALCULUS

Lemma 2.3.1.3 If T, S ∈ 𝕋 and T′ ∈ \underline{𝕋} are such that |T′| ≡ T and T ↠_{β∧} S, then there exists S′ ∈ \underline{𝕋} such that T′ ↠\underline{β∧} S′ and |S′| ≡ S. Graphically:

[figure: T′; .; .; .; .; .; .; .; .; .; \underline{β∧}; S′; T; |−|; β∧; S; |−|]

Proof: By induction on the definition of ↠_{β∧}.

1. T →_{β∧} S (in one step). Since S is obtained by contracting a redex in T, S′ can be obtained by contracting the corresponding redex in T′.

2. T ↠_{β∧} T. Take S′ ≡ T′.

3. T ↠_{β∧} U and U ↠_{β∧} S. Finally, the result follows by the induction hypo-

thesis and the transitivity of ↠\underline{β∧}. □ Lemma 2.3.1.4 Let S, T, and U ∈ \underline{𝕋}. Then

1. Suppose X ≠ Y and X ∉ FV(U). Then S[X←T][Y ←U] ≡ S[Y ←U][X←T [Y ←U]].

2. φ(S[X←T]) ≡ φ(S)[X←φ(T)].

3. If S ↠_{β∧} S′, then S[X←U] ↠_{β∧} S′[X←U].

4. If T, S ∈ \underline{𝕋} are such that T ↠\underline{β∧} S, then φ(T) ↠_{β∧} φ(S). Graphically:

[figure: T; \underline{β∧}; S; φ(T); φ; .; .; .; .; .; .; β∧; φ(S); φ]

Proof:

1. By induction on the structure of S.

2. By induction on the structure of S using (1) in the cases S ≡ \underline{(ΛX:K.S_{1}) S_{2}} and S ≡ (ΛX:K.S_{1}) S_{2}.

3. It is enough to show the result for →_{β∧}; the rest follows by induction. The interesting cases are when S is a redex: if S is a β-redex, then the result follows easily using (1); otherwise the result follows easily by the definition of substitution.

4. By induction on the generation of ↠\underline{β∧}, using (2). □

Lemma 2.3.1.5 Let T ∈ \underline{𝕋}. Then |T | ↠_{β∧} φ(T). Graphically:

T

[figure: |−|; φ]
|T | ...................... [figure: β∧] φ(T)

Proof: By induction on the structure of T. □ Lemma 2.3.1.6 (Strip) Let S, T_{1}, and T_{2} ∈ 𝕋. If S →_{β∧} T_{1} and S ↠_{β∧} T_{2}, then there exists T_{3} ∈ 𝕋 such that T_{1} ↠_{β∧} T_{3} and T_{2} ↠_{β∧} T_{3}. Graphically:

[figure: S; β∧; T_{2}; T_{1}; β∧; .; .; .; .; .; .; .; .; β∧; T_{3}; . . . . . . . .; β∧]

Proof: Suppose that T_{1} is obtained from S by replacing the occurrence redex R by its reduct R′. Then we can write S ≡ S[R] and T_{1} ≡ S[R′]. Let S[\underline{R}] be obtained from S by replacing R by its underlined version \underline{R}. Observe that |S[\underline{R}]| ≡ S[R] and φ(S[\underline{R}]) ≡ S[R′]. Then, by lemma 2.3.1.3, there exists T′_{2}, by lemma 2.3.1.4(4), S[R′] ↠_{β∧} φ(T′_{2}), and, by lemma 2.3.1.5, T_{2} ↠_{β∧} φ(T′_{2}), which justify the following diagram.

S[R]  [figure: β∧] T_{2}
[figure: |−|; |−|]
S[\underline{R}] ^{. . . . . . . . . .^{\underline{β∧}}}  [figure: .; .; .; .; .; .; .] T′_{2}
[figure: φ; φ]
[figure: S[R′]; β∧; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; β∧; φ(T′_{2}); . . . . . . . . . . . . . . . . . . . . .; β∧]

To complete the proof, let T_{3} ≡ φ(T′_{2}). □

Theorem 2.3.1.7 (Church-Rosser for →_{β∧})

If S, T_{1}, and T_{2} ∈ 𝕋 are such that S ↠_{β∧} T_{1} and S ↠_{β∧} T_{2}, then there exists T_{3} ∈ 𝕋 such that T_{1} ↠_{β∧} T_{3} and T_{2} ↠_{β∧} T_{3}. Graphically:

[figure: S; β∧; T_{2}; T_{1}; β∧; .; .; .; .; .; .; .; .; β∧; T_{3}; . . . . . . . .; β∧]

Proof: By induction on the generation of S ↠_{β∧} T_{1}.

1. S →_{β∧} T_{1}. By the strip lemma (2.3.1.6).

2. S ≡ T_{1}. Take T_{3} ≡ T_{2}.

3. S ↠_{β∧} T′_{1} and T′_{1} ↠_{β∧} T_{1}. By the induction hypothesis, we can find first T′_{3} and then T_{3}, such that T′_{1} ↠_{β∧} T′_{3}, T_{2} ↠_{β∧} T′_{3}, T_{1} ↠_{β∧} T_{3}, and T′_{3} ↠_{β∧} T_{3}. Hence the result follows by the transitivity of ↠_{β∧}. □

2.3.2 The Church-Rosser theorem for →_{βfor s}

In this section we prove the Church-Rosser property for the reduction defined in definition 2.2.2. The idea of the proof is as follows. We prove that →_{βfor} and →_{s} are Church-Rosser; that →_{s} reduction steps can be postponed (see lemma 2.3.2.2); and that, if e, e_{1}, and e_{2} ∈ 𝔼 are such that e ↠_{βfor} e_{1} and e ↠_{s} e_{2}, there exists e_{3} such that e_{1} ↠_{s} e_{3} and e_{2} ↠_{βfor} e_{3} (see lemma 2.3.2.3).

Those four results allow us to prove the Church-Rosser theorem for →_{βfors}. Let e, e_{1}, e_{2} ∈ 𝔼, such that e ↠_{βfors} e_{1} and e ↠_{βfors} e_{2}. Then, by s-postponement, there exist f_{1} and f_{2}; by Church-Rosser for →_{βfor}, there exists f_{3}; and, by lemma 2.3.2.3, there exist f_{4} and f_{5}, and finally, by Church-Rosser for →_{s}, there exists e_{3} which completes the following diagram.

[figure: e; βfor; f_{1}; s; e_{1}]

[figure: f_{2}; βfor; .; .; .; .; .; .; .; .; .; βfor; f_{3}; . . . . . . . .; βfor; .; .; .; .; .; .; .; .; .; s; f_{4}; . . . . . . . .; βfor]

[figure: e_{2}; s; .; .; .; .; .; .; .; .; .; βfor; f_{5}; . . . . . . . .; s; .; .; .; .; .; .; .; .; .; s; e_{3}; . . . . . . . . .; s]

In order to prove the s-postponement property we need the following auxiliary lemma. We will consider FV(e) as the set of free term and type variables of e.

Lemma 2.3.2.1

1. e_{1} →_{βfors} e_{2} implies FV(e_{2}) ⊆ FV(e_{1}).

2. e_{1} →_{s} e_{2} implies e_{1}[X←S] →_{s} e_{2}[X←S].

3. e_{1} →_{s} e_{2} implies e_{1}[x←e] →_{s} e_{2}[x←e].

4. e_{1} →_{s} e_{2} implies e[x←e_{1}] ↠_{s} e[x←e_{2}].

5. e_{1} →_{βfor} e_{2} implies e_{1}[x←e] →_{βfor} e_{2}[x←e].

6. e_{1} →_{βfor} e_{2} implies e[x←e_{1}] ↠_{βfor} e[x←e_{2}].

7. e_{1} ↠_{s} e_{2} and f_{1} ↠_{s} f_{2} implies f_{1}[x←e_{1}] ↠_{s} f_{2}[x←e_{2}].

8. e_{1} ↠_{βfor} e_{2} and f_{1} ↠_{βfor} f_{2} implies f_{1}[x←e_{1}] ↠_{βfor} f_{2}[x←e_{2}].

Proof: Items 1 through 6 follow by induction on the structure of e_{1}; item 7 is a corollary of items 3 and 4, and item 8 is a corollary of items 5 and 6. □

Lemma 2.3.2.2 (s-postponement) If e →_{s} e_{1} and e_{1} →_{βfor} e_{2}, then there exists e_{3} such that e →_{βfor} e_{3} and e_{3} ↠_{s} e_{1}.

Proof: By induction on the structure of e, using 2.3.2.1(1) for the case e ≡ for(X∈T_{1}..T_{n})f; 2.3.2.1(3) and (4) for the case e ≡ (λx:T.f_{1})f_{2}; and 2.3.2.1(2) for the case e ≡ (λX≤T:K.f)S. □

Lemma 2.3.2.3 If e, e_{1}, and e_{2} ∈ 𝔼 are such that e ↠_{βfor} e_{1} and e ↠_{s} e_{2} then there exists e_{3} such that e_{1} ↠_{s} e_{3} and e_{2} ↠_{βfor} e_{3}. Graphically:

e  [figure: βfor] e_{1}

[figure: e_{2}; s; .; .; .; .; .; .; .; .; .; βfor; e_{3}; . . . . . . . . .; s]

In order to prove this lemma, we prove first the corresponding result for a one step →_{βfor} reduction.

Lemma 2.3.2.4 If e, e_{1}, and e_{2} ∈ 𝔼 are such that e →_{βfor} e_{1} and e ↠_{s} e_{2}, then there exists e_{3} such that e_{1} ↠_{s} e_{3} and e_{2} ↠_{βfor} e_{3}. Graphically:

e  \overline{_{βfor}} e_{1}

[figure: e_{2}; s; .; .; .; .; .; .; .; .; .; βfor; e_{3}; . . . . . . . . .; s]

Proof of lemma 2.3.2.3: By induction on the derivation of e →_{βfor} e_{1}, using lemma 2.3.2.4. □

We now prove the Church-Rosser property for →_{s} using the Newman’s proposition 3.1.25 in [Bar84], by proving that →_{s} is strongly normalizing and weak Church-Rosser.

Lemma 2.3.2.5 (Strong normalization for →_{s}) Every s-reduction sequence starting from a term e terminates.

Proof: Straightforward, by induction on the number of symbols of the term being reduced. □

Lemma 2.3.2.6 (Weak Church-Rosser for →_{s}) If e, e_{1}, and e_{2} ∈ 𝔼 are such that e →_{s} e_{1} and e →_{s} e_{2}, then there exists e_{3} such that e_{1} ↠_{s} e_{3} and e_{2} ↠_{s} e_{3}. Graphically:

[figure: e; s; e_{1}; e_{2}; s; .; .; .; .; .; .; .; .; .; s; e_{3}; . . . . . . . . .; s]

Proof: By induction on the structure of e, using 2.3.2.1(1) for the case e ≡ for(X∈T_{1}..T_{n})f. □

Corollary 2.3.2.7 (Church-Rosser for →_{s}) If e, e_{1}, and e_{2} ∈ 𝔼 are such that e ↠_{s} e_{1} and e ↠_{s} e_{2}, then there exists e_{3} such that e_{1} ↠_{s} e_{3} and e_{2} ↠_{s} e_{3}. Graphically:

[figure: e; s; e_{1}; e_{2}; s; .; .; .; .; .; .; .; .; .; s; e_{3}; . . . . . . . . .; s]

We now prove the Church-Rosser theorem for the →_{βfor} reduction. This result is obtained following a similar strategy to the one used to prove the corresponding properties for →_{β∧}, the reduction on types, in section 2.3.1. In order to prove the Church-Rosser property for →_{βfor}, it is sufficient to show the following strip lemma. If e, f_{1}, and f_{2} in 𝔼 are such that e →_{βfor} f_{1} and e ↠_{βfor} f_{2}, then there exists f_{3} such that f_{1} ↠_{βfor} f_{3} and f_{2} ↠_{βfor} f_{3}. Graphically:

e  [figure: βfor] f_{2}

[figure: f_{1}; βfor; .; .; .; .; .; .; .; .; .; βfor; f_{3}; . . . . . . . .; βfor]

The idea of the proof is as follows. Let f_{1} be the result of replacing the redex R in e by its reduct R′. If we keep track of what happens with R during the reduction e ↠_{βfor} f_{2}, then we can find f_{3}. To be able to trace R we define a new set of terms \underline{𝔼} where redexes can appear underlined. Then if we underline R in e we only need to reduce all occurrences of the underlined R in f_{2} to obtain f_{3}.

Definition 2.3.2.8 (Underlining)

2.3. CONFLUENCE 27

1. \underline{𝔼} is the set of terms defined by the following abstract syntax.

\underline{𝔼} ::= x
| λx:𝔼.\underline{𝔼}
| \underline{𝔼} \underline{𝔼}
| λX≤𝕋:𝕂 .\underline{𝔼}
| \underline{𝔼} 𝕋
| for(X∈𝕋..𝕋)\underline{𝔼}
| \underline{(λx:𝕋.\underline{𝔼})\underline{𝔼}}
| \underline{(λX≤𝕋:𝕂 .\underline{𝔼})𝕋}
| \underline{(for(X∈𝕋..𝕋)\underline{𝔼})\underline{𝔼}}

Observe that only redexes are underlined.

2. Underlined (one step) reduction →\underline{βfor} is defined starting with the rewriting rules

(a) (λx:T_{1}.e_{1})e_{2} →\underline{βfor} e_{1}[x←e_{2}]

(b) (λX≤T_{1}:K_{1}.e)T →\underline{βfor} e[X←T]

(c) (for(X∈T_{1}..T_{n})e_{1})e_{2} →\underline{βfor} for(X∈T_{1}..T_{n})e_{1} e_{2}

(d) \underline{(λx:T_{1}.)e_{1}e_{2}} →\underline{βfor} e_{1}[x←e_{2}]

(e) \underline{(λX≤T_{1}:K_{1}.e)T} →\underline{βfor} e[X←T]

(f) \underline{(for(X∈T_{1}..T_{n})e_{1})e_{2}} →\underline{βfor} for(X∈T_{1}..T_{n})(e_{1} e_{2})

→\underline{βfor} is extended so as to become a compatible relation with respect to \underline{𝔼}, and ↠\underline{βfor} is the transitive reflexive closure of →\underline{βfor}.

3. If e ∈ \underline{𝔼}, then |e| ∈ 𝔼 is obtained from e by erasing all underlinings.

4. The capture-avoiding substitution for underlined terms is written as usual,

e[X←S] and e[x←f]. Definition 2.3.2.9 The map φ : \underline{𝔼} → 𝔼 is defined inductively as follows.

1. φ(x) ≡ x;

2. φ(λx:T.e) ≡ λx:T.φ(e);

3. φ(e_{1}e_{2}) ≡ φ(e_{1})φ(e_{2});

4. φ(λX≤T:K.e) ≡ λX≤T:K.φ(e);

5. φ(e_{1}T) ≡ φ(e_{1}) T;

6. φ(for(X∈T_{1}..T_{n})e) ≡ for(X∈T_{1}..T_{n})φ(e); 7. φ(\underline{(λx:T.e_{1})e_{2}}) ≡ φ(e_{1})[x←φ(e_{2})];

8. φ(\underline{(λX≤T:K.e)T}) ≡ φ(e)[X←T];

9. φ(\underline{for(X∈T_{1}..T_{n}))e_{1})e_{2}}) ≡ for(X∈T_{1}..T_{n})φ(e_{1} e_{2}). Observe that φ reduces all underlined redexes.

Notation: |e_{1}| ≡ e_{2} and φ(e_{1}) ≡ e_{2} will be written:

e_{1}  \overline{^{|−|}} e_{2} and e_{1}  \overline{^{φ}} e_{2}.

Lemma 2.3.2.10 If e, f ∈ 𝔼 and e′ ∈ \underline{𝔼} are such that |e′| ≡ e and e ↠_{βfor} f, then there exists f′ ∈ \underline{𝔼} such that e′ ↠\underline{βfor} f′ and |f′| ≡ f. Graphically:

[figure: e′; .; .; .; .; .; .; .; .; .; \underline{βfor}; f′; e; |−|; βfor; f; |−|]

Proof: By induction on the definition of ↠_{βfor}.

1. e →_{βfor} f (in one step). Then f is obtained by contracting a redex in e. f′ can be obtained by contracting the corresponding redex in e′.

2. e ↠_{βfor} e. Take f′ ≡ e′.

3. e ↠_{βfor} f_{1} and f_{1} ↠_{βfor} f. Hence the result follows by the induction hypo-

thesis and the transitivity of ↠\underline{βfor}. □ Lemma 2.3.2.11 Let e, f, and g ∈ \underline{𝔼} and S, T ∈ 𝕋. Then

1. (a) Suppose x ≠ y and x ∉ FV(g). Then

e[x←f][y←g] ≡ e[y←g][x←f[y←g]].

(b) Suppose X ≠ Y and X ∉ FV(S). Then e[X←T][Y ←S] ≡ e[Y ←S][X←T [Y ←S]].

(c) Suppose X ≠ Y. Then

e[x←f][X←T] ≡ e[X←T][x←f[X←T]].

2. (a) φ(e[x←f]) ≡ φ(e)[x←φ(f)].

(b) φ(e[X←T]) ≡ φ(e)[X←T].

3. If e and f ∈ \underline{𝔼} are such that e ↠\underline{βfor} f, then φ(e) ↠_{βfor} φ(f). Graphically:

[figure: e; \underline{βfor}; f; φ(e); φ; .; .; .; .; .; .; βfor; φ(f); φ]

Proof:

1. By induction on the structure of e.

2. By induction on the structure of e, using (1).

3. By induction on the generation of ↠\underline{βfor}, using (2). □

Lemma 2.3.2.12 If e ∈ \underline{𝔼}, then |e| ↠_{βfor} φ(e). Graphically:

e
[figure: |−|; φ]
|e| . . . . . . . . . . . . . . . . . . . . . . [figure: βfor] φ(e)

Proof: By induction on the structure of e, using 2.3.2.1(8). □

Lemma 2.3.2.13 (Strip) If e, f_{1}, and f_{2} ∈ 𝔼 are such that e →_{βfor} f_{1} and e ↠_{βfor} f_{2}, then there exists f_{3} ∈ 𝔼 such that f_{1} ↠_{βfor} f_{3} and f_{2} ↠_{βfor} f_{3}. Graphically:

e  [figure: βfor] f_{2}

[figure: f_{1}; βfor; .; .; .; .; .; .; .; .; .; βfor; f_{3}; . . . . . . . .; βfor]

Proof: Suppose that f_{1} is obtained from e by replacing the occurrence redex R with its reduct R′. Then we can write e ≡ e[R] and f_{1} ≡ e[R′]. Let e[\underline{R}] be obtained from e by replacing R by its underlined version \underline{R}. Observe that |e[\underline{R}]| ≡ e[R] and φ(e[\underline{R}]) ≡ e[R′]. Then, by lemma 2.3.2.10, there exists f′_{2}; by lemma 2.3.2.11(3), e[R′] ↠_{βfor} φ(f′_{2}), and, by lemma 2.3.2.12, f_{2} ↠_{βfor} φ(f′_{2}), which justify the following diagram.

To complete the proof, let f_{3} ≡ φ(f′_{2}). □

e[R]  [figure: βfor] f_{2}

[figure: |−|; |−|]

e[\underline{R}] ^{. . . . . . . . . .^{\underline{βfor}}}  [figure: .; .; .; .; .; .] f′_{2} [figure: φ; φ] [figure: e[R′]; βfor; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; βfor; φ(f′_{2}); . . . . . . . . . . . . . . . . . . . . .; βfor]

Theorem 2.3.2.14 (Church-Rosser for →_{βfor})

If e, f_{1}, and f_{2} ∈ 𝔼 are such that e ↠_{βfor} f_{1} and e ↠_{βfor} f_{2}, then there exists f_{3} ∈ 𝔼 such that f_{1} ↠_{βfor} f_{3} and f_{2} ↠_{βfor} f_{3}. Graphically:

e  [figure: βfor] f_{2}

[figure: f_{1}; βfor; .; .; .; .; .; .; .; .; .; βfor; f_{3}; . . . . . . . .; βfor]

Proof: By induction on the generation of e ↠_{βfor} f_{1}.

1. e →_{βfor} f_{1}. By the strip lemma.

2. e ≡ f_{1}. Take f_{3} ≡ f_{2}.

3. e ↠_{βfor} f′_{1} and f′_{1} ↠_{βfor} f_{1}. By the induction hypothesis we can find first f′_{3} and then f_{3}, such that f′_{1} ↠_{βfor} f′_{3}, f_{2} ↠_{βfor} f′_{3}, f_{1} ↠_{βfor} f_{3}, and f′_{3} ↠_{βfor} f_{3}. Hence the result follows by the transitivity of ↠_{βfor}. □

We have proved the confluence of the reduction →_{βfors} on terms.

Theorem 2.3.2.15 (Church-Rosser for →_{βfors})

Let e, f_{1}, f_{2} ∈ 𝔼. If e ↠_{βfors} f_{1} and e ↠_{βfors} f_{2}, then there exists f_{3} ∈ 𝔼 such that f_{1} ↠_{βfors} f_{3} and f_{2} ↠_{βfors} f_{3}. Graphically:

e [figure: βfors] f_{2}

[figure: f_{1}; βfors; .; .; .; .; .; .; .; .; .; βfors; f_{3}; . . . . . . . .; βfors]

Finally, we can state and prove the confluence property for the reduction relation of F_{∧}^{ω}.

Theorem 2.3.2.16 (Church-Rosser for →_{βfors} ∪ →_{β∧})

If E, F, and G ∈ 𝕋 ∪ 𝔼 are such that E ↠_{βfors∪β∧} F and E ↠_{βfors∪β∧} G, then there exists H ∈ 𝕋∪𝔼 such that F ↠_{βfors∪β∧} H and G ↠_{βfors∪β∧} H. Graphically:

E [figure: βfors∪β∧] F [figure: G; βfors∪β∧; .; .; .; .; .; .; .; .; .; .; .; .; .; βfors∪β∧; H; . . . . . . . . .; βfors∪β∧]

Proof: By the commutativity of ↠_{βfors} and ↠_{β∧} (corollary 2.3.4) and the Church-Rosser property of →_{βfors} and →_{β∧} (theorems 2.3.1.7 and 2.3.2.15). □

The Church-Rosser theorem has interesting corollaries that we will use in the sequel.

Corollary 2.3.2.17 See chapter 3 [Bar84]. Let R be a reduction satisfying the Church-Rosser property. Then

1. If T =_{R}S, then there exists U such that T → →_{R} U and S → →_{R} U.

2. If T is a normal form of S, then S → →_{R} T.

3. Each term has at most one R-normal form.

Fact 2.3.2.18

1. ∀X≤S:K.T =_{β∧} ⊤^{⋆} if and only if T =_{β∧} ⊤^{⋆}.

2. ΛX:K.T =_{β∧} ⊤^{⋆} if and only if T =_{β∧} ⊤^{⋆}.

3. S→T =_{β∧} ⊤^{⋆} if and only if T =_{β∧} ⊤^{⋆}.

4. T S =_{β∧} ⊤^{⋆} if and only if T =_{β∧} ⊤^{⋆}.

2.4 Structural properties

This section establishes a number of structural properties of F_{∧}^{ω}. Except where noted, the proofs proceed by structural induction and are straightforward when performed in the order in which they appear.

Lemma 2.4.1 If Γ ⊢ Σ and Γ_{1} is a prefix of Γ, then Γ_{1} ⊢ ok as a subderivation. Moreover, except for the case Γ_{1} ≡ Γ and Σ ≡ ok, the subderivation is strictly shorter.

Lemma 2.4.2 (Syntax-directedness of context judgements)

1. If Γ_{1}, X≤T:K, Γ_{2} ⊢ ok, then Γ_{1} ⊢ T ∈ K by a proper subderivation.

2. If Γ_{1}, x:T , Γ_{2} ⊢ ok, then Γ_{1} ⊢ T ∈ ⋆ by a proper subderivation.

Lemma 2.4.3 (Free variables)

1. If Γ ⊢ T ∈ K, then FTV(T) ⊆ dom(Γ).

2. If Γ ⊢ ok, then each variable or type variable in dom(Γ) is declared only once.

Lemma 2.4.4 (Weakening/Permutation) Let Γ and Γ′ be contexts such that Γ ⊆ Γ′ and Γ′ ⊢ ok. Then Γ ⊢ Σ implies Γ′ ⊢ Σ.

Proof: By induction on the length of a derivation of Γ ⊢ Σ.

K-OAbs We are given that Γ, X≤⊤^{K_{1}}:K_{1} ⊢ T_{2} ∈ K_{2}. Applying K-Meet to Γ′ ⊢ ok we obtain Γ′ ⊢ ⊤^{K_{1}} ∈ K_{1}; we can assume, without loss of generality, that X ∉ dom(Γ′). Then, by C-TVar, Γ′, X≤⊤^{K_{1}}:K_{1} ⊢ ok. By the induction hypothesis, Γ′, X≤⊤^{K_{1}}:K_{1} ⊢ T_{2} ∈ K_{2}, and the result follows applying K-OAbs.

T-Abs We are given that Γ, x:T_{1} ⊢ e ∈ T_{2}. By lemma 2.4.1 there exists a proper subderivation of Γ, x:T_{1} ⊢ ok; by lemma 2.4.2, there is a yet shorter subderivation of Γ ⊢ T_{1} ∈ ⋆. We can now apply the induction hypothesis to obtain Γ′ ⊢ T_{1} ∈ ⋆. As before, we can assume x ∉ dom(Γ′); by C-Var, Γ′, x:T_{1} ⊢ ok. By the induction hypothesis, we have Γ′, x:T_{1} ⊢ e ∈ T_{2}, and applying T-Abs yields the desired result.

Other cases If Σ ≡ ok there is nothing to prove. K-TVar, S-TVar, T-Meet and T-Var applying the corresponding rule to Γ′ ⊢ ok. S-OAbs similar to K-OAbs. K-All, S-All T-TAbs similar to T-Abs. All the other cases follow by straightforward application of the induction hypothesis. □

Lemma 2.4.5 (Context, kind, and term strengthening)

1. If Γ_{1}, X≤T:K, Γ_{2} ⊢ ok and X ∉ FTV(Γ_{2}), then Γ_{1}, Γ_{2} ⊢ ok.

2. If Γ_{1}, X≤T:K, Γ_{2} ⊢ S ∈ K′ and X ∉ FTV(Γ_{2}) ∪ FTV(S), then Γ_{1}, Γ_{2} ⊢ S ∈ K′.

3. If Γ_{1}, x:T , Γ_{2} ⊢ Σ and x ∉ FV(Σ), then Γ_{1}, Γ_{2} ⊢ Σ.

Moreover, the derivations of the conclusions are strictly shorter than the derivation of the premises.

Proof: We prove statements 1 and 2 by simultaneous induction on the length of derivations, and statement 3 by induction on the derivation of Γ_{1}, x:T , Γ_{2} ⊢ Σ.

1. C-Empty Vacuously true.

C-Var By part 2 of the induction hypothesis and C-Var. C-TVar Γ_{2} ≡ ∅. The result follows from lemma 2.4.1.

Γ_{2} ≢ ∅. By part 2 of the induction hypothesis and C-TVar.

2. K-TVar By part 1 of the induction hypothesis and K-TVar.

K-Arrow By part 2 of the induction hypothesis and K-Arrow. K-All We are given that Γ_{1}, X≤T:K, Γ_{2}, Y ≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆, and X ∉

FTV(Γ_{2}) ∪ FTV(∀(Y ≤T_{1}:K_{1})T_{2}). In particular, X ∉ FTV(T_{1}) ∪ FTV(T_{2}) − {Y }. Observe that, by lemma 2.4.3, X ≢ Y. Then X ∉ FTV(Γ_{2}, Y ≤T_{1}:K_{1}) ∪ FTV(T_{2}). Applying part 2 of the induction hypothesis and K-All the result follows.

2.4. STRUCTURAL PROPERTIES 33

K-OAbs Similar to the case K-All.

K-OApp By part 2 of the induction hypothesis and K-OApp.

K-Meet By parts 1 and 2 of the induction hypothesis and K-OApp.

3. Except for the cases we consider below and the case for C-Empty, which is trivially true, the result follows by straightforward application of the induction hypothesis and the corresponding rule in each case. C-Var Γ_{2} ≡ ∅. The result follows by lemma 2.4.1.

Γ_{2} ≢ ∅. By the induction hypothesis and C-Var. T-Abs Using lemma 2.4.3, the induction hypothesis, and T-Abs. T-For Using that FV(for(X ∈ T_{1}..T_{n})e) = FV(e) = FV(e[X←S]), the

induction hypothesis, and T-For. □

Proposition 2.4.6 (Syntax-directedness of kinding/Generation for kinding) 1. Γ ⊢ X ∈ K implies Γ ≡ Γ_{1}, X≤T:K, Γ_{2} for some Γ_{1}, T, and Γ_{2}.

2. Γ ⊢ T_{1}→T_{2} ∈ K implies K ≡ ⋆ and Γ ⊢ T_{1}, T_{2} ∈ ⋆.

3. Γ ⊢ ∀X≤T_{1}:K_{1}.T_{2} ∈ K implies K ≡ ⋆ and Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆.

4. Γ ⊢ Λ(X:K_{1})T_{2} ∈ K implies K ≡ K_{1}→K_{2} and Γ, X≤⊤^{K_{1}}:K_{1} ⊢ T_{2} ∈ K_{2}, for some K_{2}.

5. Γ ⊢ S T ∈ K implies Γ ⊢ S ∈ K′→K and Γ ⊢ T ∈ K′, for some K′.

6. Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ∈ K′ implies K ≡ K′ and Γ ⊢ ok and Γ ⊢ T_{i} ∈ K for each i. Moreover, the proofs of the consequents are all strictly shorter than those of the antecedents. Proof: In each case the antecedent uniquely determines the last rule of its derivation. The proof follows by inspection of the rules. □ Lemma 2.4.7 (Uniqueness of kinds) If Γ ⊢ T ∈ K and Γ ⊢ T ∈ K′, then K ≡ K′. Definition 2.4.8 (Size)

1. The size of a type expression T, size_{t}(T), is defined as follows.

(a) size_{t}(X) = 2,

(b) size_{t}(S→T) = size_{t}(∀X≤S:K.T) = size_{t}(S T) = size_{t}(S) + size_{t}(T) + 1,

(c) size_{t}(ΛX:K.T) = size_{t}(T) + 3,

(d) size_{t}(⋀^{K}[T_{1}..T_{n}]) = 2 + Σ_{1≤i≤n}size_{t}(T_{i}).

2. The homomorphic extension to contexts, size_{c}(Γ), is defined as follows.

(a) size_{c}(∅) = 0,

(b) size_{c}(Γ, X ≤ T:K) = size_{c}(Γ, x:T) = size_{c}(Γ) + size_{t}(T).

3. The size of a subtyping, kinding, or ok judgement J, size_{j}(J), is defined as follows.

(a) size_{j}(Γ ⊢ ok) = size_{c}(Γ) + 1,

(b) size_{j}(Γ ⊢ T ∈ K) = size_{c}(Γ) + size_{t}(T).

(c) size_{j}(Γ ⊢ S ≤ T) = size_{c}(Γ) + size_{t}(S) + size_{t}(T).

Lemma 2.4.9 (Well-foundedness of context formation and kinding rules)

1. For every kinding or ok judgement J, size_{j}(∅ ⊢ ok) ≤ size_{j}(J).

2. If \begin{aligned}J_{1} & .. & J_{n} \\ & J \end{aligned} is a kinding rule or a context formation rule, then size_{j}(J_{i}) <

size_{j}(J) for each i∈{1..n}.

Corollary 2.4.10

1. For any context Γ it is decidable whether Γ ⊢ ok.

2. For any context Γ, type expression T, and kind K, it is decidable whether Γ ⊢ T ∈ K.

Proof: Lemma 2.4.2 and proposition 2.4.6 imply that context formation rules and kinding rules determine an algorithm to check context judgements and kinding judgements and lemma 2.4.9 implies that the algorithm terminates. □

Lemma 2.4.11 (Type substitution) Let Γ_{1} ⊢ T ∈ K_{U}. Then

1. If Γ_{1}, X≤U:K_{U}, Γ_{2} ⊢ S ∈ K_{S}, then Γ_{1}, Γ_{2}[X←T] ⊢ S[X←T] ∈ K_{S}.

2. If Γ_{1}, X≤U:K_{U}, Γ_{2} ⊢ ok, then Γ_{1}, Γ_{2}[X←T] ⊢ ok.

Proof: By simultaneous induction on derivations of the premises. The proof of part 2 is straightforward using part 1 of the induction hypothesis. We consider the details of the proof of 1. The cases K-Arrow, K-All, K-OAbs, and K-OApp follow by straightforward application of part 1 of the induction hypothesis and the corresponding rule, while the case of K-Meet also uses part 2 of the induction hypothesis. We examine the case of K-TVar, where S ≡ Y for some variable Y. By proposition 2.4.6(1) Y ≤T_{Y}:K_{S} ∈ (Γ_{1}, X≤U:K_{U}, Γ_{2}) for some T_{Y}. There are three cases to consider.

Y ≤T_{Y}:K_{S}∈Γ_{1} Then we also have Y ≤T_{Y}:K_{S} ∈ (Γ_{1}, Γ_{2}[X←T]). By part 2 of the induction hypothesis, Γ_{1}, Γ_{2}[X←T] ⊢ ok. Applying K-TVar, we get Γ_{1}, Γ_{2}[X←T] ⊢ Y ∈ K_{S}.

Y ≤T_{Y}:K_{S} ≡ X≤U:K_{U} We know that Γ_{1} ⊢ T ∈ K_{S} ≡ K_{U}. From the premise of K-TVar and part 2 of the induction hypothesis, we have Γ_{1}, Γ_{2}[X←T] ⊢ ok. The result follows by weakening (lemma 2.4.4).

Y ≤T_{Y}:K_{S}∈Γ_{2} Then we have Y ≤T_{Y} [X←T]:K_{S} ∈ (Γ_{1}, Γ_{2}[X←T]). By part 2 of the induction hypothesis, Γ_{1}, Γ_{2}[X←T] ⊢ ok, from which the result follows by K-TVar. □

Lemma 2.4.12 (Subject reduction for kinding judgements) If S ↠_{β∧} T and Γ ⊢ S ∈ K, then Γ ⊢ T ∈ K.

Proof: In order to prove this result it is enough to prove the following statements by simultaneous induction on the derivation of Γ ⊢ S ∈ K. The rest follows by induction on the definition of ↠_{β∧}.

1. Γ ⊢ ok and Γ →_{β∧} Γ′ implies Γ′ ⊢ ok.

2. Γ ⊢ S ∈ K and S →_{β∧} T implies Γ ⊢ T ∈ K.

3. Γ ⊢ S ∈ K and Γ →_{β∧} Γ′ implies Γ′ ⊢ S ∈ K. □

In chapter 4 we prove that the subject reduction property also holds for typing judgements.

Theorem 2.4.13 (Kind invariance under type conversion) If Γ ⊢ S ∈ K_{S} and Γ ⊢ T ∈ K_{T}, with S =_{β∧} T, then K_{S} ≡ K_{T}.

Proof: By the Church-Rosser theorem 2.3.1.7, there exists U such that S ↠_{β∧} U and T ↠_{β∧} U, and the result follows by subject reduction and unicity of kinds. □

Lemma 2.4.14 Let Γ ⊢ S_{j} ∈ K for each j∈{1..m}. Then if for every i∈{1..n} there exists j∈{1..m} such that Γ ⊢ S_{j} ≤ T_{i}, then Γ ⊢ ⋀^{K}[S_{1}..S_{m}] ≤ ⋀^{K}[T_{1}..T_{n}].

A particular case of the previous lemma is the following.

Corollary 2.4.15 Let Γ ⊢ S_{i} ∈ K for each i∈{1..n}. Then Γ ⊢ S_{i} ≤ T_{i}, for every i∈{1..n}, implies Γ ⊢ ⋀^{K}[S_{1}..S_{n}] ≤ ⋀^{K}[T_{1}..T_{n}].

Lemma 2.4.16 Let Γ ⊢ S, T ∈ K. Then Γ ⊢ S ≤ T if and only if Γ ⊢ S^{nf} ≤ T^{nf}.

Proof: We shall consider only one part the other is similar.

⇒) By subject reduction, we have that Γ ⊢ S^{nf}∈K, then, by S-Conv, Γ ⊢ S^{nf} ≤ S. By similar reasoning we have Γ ⊢ T ≤ T^{nf}. The result follows by applying

S-Trans twice. □

Lemma 2.4.17 (Context modification) If Γ_{1} ⊢ U′ ∈ K and Σ is either ok or T ∈ K′, then Γ_{1}, X≤U:K, Γ_{2} ⊢ Σ implies Γ_{1}, X≤U′:K, Γ_{2} ⊢ Σ.

Lemma 2.4.18 Let Γ ⊢ S_{i} ∈ K for every i∈{1..n}. If for every j in {1..m} there exists i in {1..n} such that Γ ⊢ S_{i} ≤ T_{j}, then Γ ⊢ ⋀^{K}[S_{1}..S_{n}] ≤ ⋀^{K}[T_{1}..T_{m}].

Proposition 2.4.19 (Well-kindedness of subtyping) If Γ ⊢ S ≤ T, then Γ ⊢ S ∈ K and Γ ⊢ T ∈ K for some K.

Proof: By induction on the derivation of Γ ⊢ S ≤ T.

S-Conv We are given that Γ ⊢ S ∈ K and Γ ⊢ T ∈ K′ and S =_{β} T. By lemma 2.4.13, K ≡ K′.

S-Trans By the induction hypothesis and uniqueness of kinds (lemma 2.4.7).

S-TVar We are given that Γ_{1}, X≤T:K, Γ_{2} ⊢ ok. By K-TVar it follows that Γ_{1}, X≤T:K, Γ_{2} ⊢ X ∈ K. Moreover, by lemma 2.4.2, we have

Γ_{1} ⊢ T ∈ K, and by lemma 2.4.4, Γ_{1}, X≤T:K, Γ_{2} ⊢ T ∈ K.

S-Arrow We are given Γ ⊢ T_{1} ≤ S_{1} and Γ ⊢ S_{2} ≤ T_{2} and Γ ⊢ S_{1}→S_{2} ∈ ⋆. By proposition 2.4.6, Γ ⊢ S_{1}, S_{2} ∈ ⋆. Further, by the induction hypothesis together with uniqueness of kinds (lemma 2.4.7), we have Γ ⊢ T_{1}, T_{2} ∈ ⋆. Finally, the result follows by applying K-Arrow.

S-All We are given that Γ, X≤U:K_{1} ⊢ S_{2} ≤ T_{2} and Γ ⊢ ∀(X≤U:K_{1})S_{2} ∈ ⋆. By proposition 2.4.6, Γ, X≤U:K_{1} ⊢ S_{2} ∈ ⋆. Then, applying the induction hypothesis and lemma 2.4.7, we obtain Γ ⊢ T_{1} ∈ K_{1} and Γ, X≤⊤^{K_{1}}:K_{1} ⊢ T_{2} ∈ ⋆, from which the result follows by applying

K-All.

S-OAbs By the induction hypothesis and K-OAbs.

S-OApp Similar to S-All.

S-Meet-G Using the induction hypothesis, lemma 2.4.7, and K-Meet.

S-Meet-LB We are given Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ∈ K, which, by proposition 2.4.6, implies Γ ⊢ T_{i} ∈ K for each i. □

Proposition 2.4.20 (Well-kindedness of typing) If Γ ⊢ e ∈ T, then Γ ⊢ T ∈ ⋆.

Proof: By induction on the derivation of Γ ⊢ e ∈ T.

T-Var We are given Γ_{1}, x:T , Γ_{2} ⊢ ok. The result follows by lemma 2.4.2 and lemma 2.4.4.

T-Abs We are given Γ, x:T_{1} ⊢ e ∈ T_{2}. By the induction hypothesis, Γ, x:T_{1} ⊢ T_{2} ∈ ⋆. By lemma 2.4.5, it follows that Γ ⊢ T_{2} ∈ ⋆. Furthermore, by lemmas 2.4.1 and 2.4.2, Γ ⊢ T_{1} ∈ ⋆. Hence, K-Arrow yields Γ ⊢ T_{1}→T_{2} ∈ ⋆.

T-App By the induction hypothesis for Γ ⊢ f ∈ T_{1}→T and proposition 2.4.6.

2.5. STRONG NORMALIZATION OF →_{β∧} 37

T-TAbs We are given Γ, X≤T_{1}:K_{1} ⊢ e ∈ T_{2}. By the induction hypothesis, Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆. We obtain Γ ⊢ ∀(X≤T_{1}:K_{1})T_{2} ∈ ⋆ by apply-

ing K-All .

T-TApp We know that Γ ⊢ f ∈ ∀(X≤T_{1}:K_{1})T_{2} and also Γ ⊢ S ≤ T_{1}. By the induction hypothesis, Γ ⊢ ∀(X≤T_{1}:K_{1})T_{2} ∈ ⋆ and, by proposition 2.4.6, Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆. By lemmas 2.4.1 and 2.4.2, there exists a derivation of Γ ⊢ T_{1} ∈ K_{1}. By the well-kindedness of subtyping (proposition 2.4.19) and uniqueness of kinds (lemma 2.4.7), we have Γ ⊢ S ∈ K_{1}. Then, by the type substitution lemma (lemma 2.4.11), Γ ⊢ T_{2}[X←S] ∈ ⋆.

T-For By the induction hypothesis.

T-Meet We are given that Γ ⊢ ok and that Γ ⊢ e ∈ T_{i} for each i. We have to consider two cases.

n = 0. Applying K-Meet to Γ ⊢ ok we obtain Γ ⊢ ⊤^{⋆} ∈ ⋆.

n ≠ 0. By the induction hypothesis, Γ ⊢ T_{i} ∈ ⋆ for every i and, then the result follows by applying K-Meet.

T-Sub By the induction hypothesis, proposition 2.4.19 and lemma 2.4.7. □

2.5 Strong normalization of →_{β∧}

We prove that every type that has a kind in F_{∧}^{ω} is strongly normalizing in three steps. We first prove that →_{a} and also →_{β∧}^{−} are strongly normalizing. Then we prove that both reductions commute, i.e. if T →_{a} T_{1} and T_{1} →_{β∧}^{−} T_{2}, then there exists S such that S →_{a} T_{2} and T ↠_{β∧}^{−}^{>0} S(in at least one step). Finally, using the previous two steps we prove that →_{β∧} is strongly normalizing. A type T is called strongly normalizing if and only if all reduction sequences starting with T terminate. We write 𝕋 for the set of all type expressions and SN for the subset of 𝕋 of strongly normalizing type expressions. If A and B are subsets of 𝕋, then A → B denotes the following subset of 𝕋

A → B = {F ⊆ 𝕋 | for all a∈A F a∈B}.

Lemma 2.5.1 →_{a} is strongly normalizing.

Proof: By induction on the number of intersection symbols of the type expression being reduced. □

To prove strong normalization of →_{β∧}^{−} we use a model-theoretic argument interpreting kinds as sets of normalizing terms, and the soundness of the model gives, as a corollary, the strong normalization property. The interpretation of a kind K, notation [[K]], is defined as follows.

\begin{aligned}[[ ⋆]] & = & SN \\ [[K_{1}→K_{2}]] & = & [[K_{1}]] → [[K_{2}]]. \end{aligned}

38 CHAPTER 2. THE F_{∧}^{ω} CALCULUS

Definition 2.5.2 (Saturated set) S ⊆ SN is saturated if is satisfies the following conditions:

1. If R_{1}..R_{n} ∈ SN, then XR_{1}..R_{n} ∈ S.

2. If R_{1}..R_{n}, Q ∈ SN, then (a) if P [X←Q]R_{1}..R_{n} ∈ S, then (ΛX:K.P)QR_{1}..R_{n} ∈ S, for every K and (b) if (⋀^{K_{2}}[T_{1}Q, .., T_{m}Q])R_{1}, .., R_{n} ∈ S,

then (⋀^{K_{1}→K_{2}}[T_{1}, .., T_{m}])QR_{1}, .., R_{n} ∈ S, for every K_{1}.

Intuitively, a set of strongly normalizing type expressions is saturated if it contains all type variables and is closed under expansion of expressions which may have a kind of the form K_{1}→K_{2}. Lemma 2.5.3

1. SN is saturated.

2. If A, B are saturated, then A → B is saturated.

3. For any kind K, [[K]] is saturated. Definition 2.5.4

1. A valuation ρ in 𝕋 is a mapping from type variables to types.

2. The interpretation of a type with respect to ρ is

[[T]]_{ρ} = T [X_{1} ← ρ(X_{1})..X_{n} ← ρ(X_{n}), where FV(T) = {X_{1}..X_{n}}.

3. Let ρ be a valuation in 𝕋. Then ρ satisfies T ∈ K, written ρ ⊧ T ∈ K, if [[T]]_{ρ} ∈ [[K]] and ρ satisfies X≤T:K, written ρ ⊧ X≤T:K, if ρ(X) ∈ [[K]]. We say that ρ satisfies a context Γ, ρ ⊧ Γ, if ρ ⊧ X ≤ S:K for all X ≤ S:K ∈ Γ.

4. A context Γ satisfies T ∈ K, written Γ ⊧ T ∈ K, if for every ρ such that

ρ ⊧ Γ, it follows that ρ ⊧ T ∈ K. Lemma 2.5.5

1. ⊤^{K}∈[[K]].

2. If A_{i}∈[[K]] for each i∈{1..n}, then ⋀^{K}[A_{1}..A_{n}]∈[[K]]. Proof:

1. By induction on the structure of K.

K ≡ ⋆ ⊤^{⋆} is in normal form. Hence, ⊤^{⋆}∈SN ≡ [[K]].

K ≡ K_{1}→K_{2} By the induction hypothesis, ⊤^{K_{2}}∈[[K_{2}]]. Moreover, if B∈[[K_{1}]] then ⊤^{K_{1}→K_{2}}B∈[[K_{2}]], by the saturation of [[K_{2}]], which means

that ⊤^{K_{1}→K_{2}}∈[[K_{1}→K_{2}]].

2. By induction on the structure of K.

K ≡ ⋆ Then, by definition of [[K]], A_{i}∈SN for each i∈{1..n}. Since every reduction starting from ⋀^{K}[A_{1}..A_{n}] is a reduction consisting only of steps inside the A_{i}′s, one has ⋀^{K}[A_{1}..A_{n}]∈SN ≡ [[K]].

K ≡ K_{1}→K_{2} Let B∈[[K_{1}]]. By the definition of →, A_{i}B∈[[K_{2}]], for each i∈{1..n}. By the induction hypothesis, ⋀^{K_{2}}[A_{1}B..A_{n}B]∈[[K_{2}]]. Moreover, ⋀^{K_{1}→K_{2}}[A_{1}..A_{n}]B∈[[K_{2}]] by the saturation of [[K_{2}]], which means that ⋀^{K_{1}→K_{2}}[A_{1}..A_{n}]∈[[K_{1}→K_{2}]]. □

Proposition 2.5.6 (Soundness) If Γ ⊢ T ∈ K, then Γ ⊧ T ∈ K.

Proof: By induction on the derivation of Γ ⊢ T ∈ K.

We consider the case for K-Meet. The other cases follow by similar reasoning. Let T ≡ ⋀^{K}[T_{1}..T_{n}]. We have to consider two cases.

n ≢ 0 We are given Γ ⊢ T_{i} ∈ K for each i∈{1..n}, and, by the induction hypothesis, Γ ⊧ T_{i} ∈ K. Let ρ be a valuation such that ρ ⊧ Γ. Then [[T_{i}]]_{ρ}∈[[K]],

for each i∈{1..n}. By lemma 2.5.5(2), ⋀^{K}[[[T_{1}]]_{ρ}..[[T_{n}]]_{ρ}]∈[[K]].

n ≡ 0 T ≡ ⊤^{K}. Since [[⊤^{K}]]_{ρ} ≡ ⊤^{K}, the result follows by 2.5.5(1). □

Theorem 2.5.7 (Strong normalization for →_{β∧}^{−}) Γ ⊢ T ∈ K implies that every (β∧^{−})-reduction sequence starting from T is finite.

Proof: By soundness, Γ ⊧ T ∈ K. Choose ρ_{0} such that ρ_{0}(X) = X. Observe that ρ_{0} ⊧ Γ trivially. Hence T ≡ [[T]]_{ρ_{0}}∈[[K]] ⊆ SN. □

Lemma 2.5.8 If T →_{a} T_{1} and T_{1} →_{β∧}^{−} T_{2}, then there exists S such that T ↠_{β∧}^{−}^{>0} S and S →_{a} T_{2}.

Proof: By induction on the structure of T. □

Corollary 2.5.9 If T ↠_{a} T_{1} and T_{1} ↠_{β∧}^{−} T_{2}, then there exists S such that T ↠_{β∧}^{−}^{>0} S and S ↠_{a} T_{2}.

Proof: By induction on the generation of T ↠_{a} T_{1}. □ Finally, we can prove strong normalization for →_{β∧}.

Theorem 2.5.10 (Strong normalization for →_{β∧}) Γ ⊢ T ∈ K implies that every (β∧)-reduction sequence starting from T is finite.

Proof: Let Γ ⊢ T ∈ K. We reason by contradiction. Assume that there is an infinite β∧-reduction sequence starting from T. Then lemma 2.5.1 and theorem 2.5.7 imply that there are infinitely many alternations of →_{a} and →_{β∧}^{−} reduction sequences. Graphically:

T  [figure: a] T_{1}

[figure: T_{2}; β∧^{−}; a; T_{3}]

T_{4} [figure: β∧^{−}] . . . . . . .

By corollary 2.5.9, we can construct an infinite (β∧^{−})-reduction which contradicts theorem 2.5.7. Graphically:

T  [figure: a] T_{1}

[figure: S_{1}; β∧^{−}; a; T_{2}; β∧^{−}; a; T_{3}]

[figure: S_{3}; β∧^{−}; a; S_{2}; β∧^{−}; a; T_{4}; β∧^{−}; . . . . . . .]

….

□

Decidability of Subtyping in F_{∧}^{ω}

In this chapter we show that the subtyping relation of F_{∧}^{ω} is decidable. The solution is divided into two main parts. First, we develop a normal subtyping system, NF_{∧}^{ω}, in which only types in normal form are considered. We prove that proofs in NF_{∧}^{ω} can be normalized by eliminating transitivity and simplifying reflexivity. This simplification yields an algorithmic presentation, AlgF_{∧}^{ω}, whose rules are syntax directed. Moreover, we prove that AlgF_{∧}^{ω} is indeed an alternative presentation of the F_{∧}^{ω} subtyping relation. Formally, Γ ⊢ S ≤ T if and only if Γ^{nf} ⊢_{Alg} S^{nf} ≤ T^{nf} (proposition 3.4.3).

In the solution for the second order lambda calculus presented in [Pie91], the distributivity rules for intersection types are not considered as rewrite rules. For that reason, new syntactic categories have to be defined (composite and individual canonical types) and an auxiliary mapping (flattening) transforms a type into a canonical type. Our solution does not need either new syntactic categories or elaborate auxiliary mappings, since the role played there by canonical types is performed here by types in normal form.

Independently Steffen and Pierce proved a similar result for F_{≤}^{ω} [SP94]. There are several differences between our work and the proof of decidability of subtyping in [SP94]. First, our result is for a stronger system which also includes intersection types. Our proof of termination has the novel idea of using a choice operator to model the behavior of type variables during subtype checking. A second major difference is the choice of the intermediate subtyping system. We define the normal system NF_{∧}^{ω} which is not only the key to proving decidability of subtyping but helped understand the fine structure of subtyping, yielding the algorithm AlgF_{∧}^{ω}. In [SP94] the intermediate system, called a reducing system, leads to a much more complicated proof which involves dealing with several notions of reduction and further reformulation of the intermediate system.

42 CHAPTER 3. DECIDABILITY OF SUBTYPING IN F_{∧}^{ω}

3.1 Normal Subtyping

An important property of derivation systems is the information that a derivable judgement contains about its proofs. This information is essential to produce results which not only state properties about the subproofs, but also help identify ill formed judgements.

In F_{∧}^{ω} we can prove

W:K, X ≤ ΛY:K.Y:K→K, Z ≤ X:K→K ⊢ X(Z W) ≤ W (3.1)

This simple example already shows that S-Trans erases information obtained by S-Conv that is not present in the conclusion any longer (see 3.3.2 for a derivation). A first step towards an algorithm to check the subtyping relation is to design a set of rules in which the derivable judgements contain all the information about their derivations. To this end we define a set of rules, NF_{∧}^{ω}, in which conversion is reduced to a minimum and, as we show in lemma 3.2.6, transitivity can be eliminated. Both results are proved with a standard cut-elimination argument. This yields a syntax directed subtyping relation, AlgF_{∧}^{ω}, which constitutes a decision procedure for the original system.

In section 3.1, we present the subtyping system NF_{∧}^{ω}, which uses the context and type formation rules of F_{∧}^{ω}. We define rewriting rules for derivations in NF_{∧}^{ω} (definitions 3.2.3 and 3.2.4), and describe a terminating procedure to normalize proofs, which gives, as a consequence, the generation for subtyping (proposition 3.2.10) and an algorithmic presentation, AlgF_{∧}^{ω} (see definition 3.4.1).

Finally, in section 3.4, we show that there is an equivalence between subtyping in F_{∧}^{ω} and subtyping in AlgF_{∧}^{ω}, which is essential to prove the decidability of subtyping in F_{∧}^{ω}.

We now define the normal subtyping system, NF_{∧}^{ω}. Subtyping statements in NF_{∧}^{ω} are written Γ ⊢_{n} S ≤ T, and S, T, and all types appearing in Γ are in β∧-normal form.

Notation 3.1.1 A, B, and C range over types whose outermost constructor is not an intersection.

Remark 3.1.2 It is an immediate consequence of the β∧ reduction rules that, if T is in β∧ normal form, then T is either a variable X, S→A, ∀X≤S:K.A, ΛX:K.A, A S where A is not an abstraction, or ⋀^{K}[A_{1}..A_{n}]. We frequently use this notation as a reminder of the shape of types in normal form. Note that we do not fully use this convention in definition 3.1.4 in order to highlight the fact that

NS-Arrow, NS-All, and NS-OAbs have the same form as S-Arrow, S-All, and

S-OAbs respectively.

We now define lub_{Γ}(S). We prove in lemma 3.3.1 and corollary 3.3.1.2, that, when defined, it is the smallest type beyond S with respect to Γ.

Definition 3.1.3 (Least strict Upper Bound)

lub_{Γ}(X) = Γ(X),
lub_{Γ}(T S) = lub_{Γ}(T) S.

Definition 3.1.4 (NF_{∧}^{ω} subtyping rules)

\frac{Γ ⊢ S ∈ K}{Γ ⊢_{n} S ≤ S}  (NS-Refl)

\frac{Γ ⊢_{n} S ≤ T  Γ ⊢_{n} T ≤ U}{Γ ⊢_{n} S ≤ U}  (NS-Trans)

\frac{Γ ⊢_{n} Γ(X) ≤ A  X ≢ A}{Γ ⊢_{n} X ≤ A}  (NS-TVar)

\frac{Γ ⊢_{n} T_{1} ≤ S_{1}  Γ ⊢_{n} S_{2} ≤ T_{2}  Γ ⊢ S_{1}→S_{2} ∈ ⋆}{Γ ⊢_{n} S_{1}→S_{2} ≤ T_{1}→T_{2}}  (NS-Arrow)

\frac{Γ, X≤U:K ⊢_{n} S ≤ T  Γ ⊢ ∀X≤U:K.S ∈ ⋆}{Γ ⊢_{n} ∀X≤U:K.S ≤ ∀X≤U:K.T}  (NS-All)

\frac{Γ, X≤⊤^{K}:K ⊢_{n} S ≤ T}{Γ ⊢_{n} ΛX:K.S ≤ ΛX:K.T}  (NS-OAbs)

\frac{Γ ⊢_{n} (lub_{Γ}(T S))^{nf} ≤ A  Γ ⊢ T S ∈ K  T S ≢ A}{Γ ⊢_{n} T S ≤ A}  (NS-OApp)

\frac{∀i∈\{1..m\} Γ ⊢_{n} A ≤ T_{i}  Γ ⊢ A ∈ K}{Γ ⊢_{n} A ≤ ⋀^{K}[T_{1}..T_{m}]}  (NS-∀)

\frac{∃j∈\{1..n\} Γ ⊢_{n} S_{j} ≤ A  ∀k∈\{1..n\} Γ ⊢ S_{k} ∈ K}{Γ ⊢_{n} ⋀^{K}[S_{1}..S_{n}] ≤ A}  (NS-∃)

\frac{∀i∈\{1..m\} ∃j∈\{1..n\} Γ ⊢_{n} S_{j} ≤ T_{i}  ∀k∈\{1..n\} Γ ⊢ S_{k} ∈ K}{Γ ⊢_{n} ⋀^{K}[S_{1}..S_{n}] ≤ ⋀^{K}[T_{1}..T_{m}]}  (NS-∀∃)

As we mentioned in the introduction, an important factor to develop this system was to consider the distributivity rules of the presentation of F_{∧}^{ω} in [CP93] as reduction rules instead of subtyping rules. This new point of view suggested that an algorithmic system should, to a certain extent, concentrate on normal forms replacing the conversion rule by reflexivity. Consequently, a derivation of a subtyping statement should involve only types in normal form. But enlightened by the simple (counter)example (3.1) it is not possible to perform all reductions at once. In other words, the system does not satisfy an S-Conv postponement property. Without using S-Conv it is not possible to derive (3.1). Hence, the solution is not as simple as replacing S-Conv by NS-Refl.

In general, the interaction between S-Trans and S-Conv can be analyzed as follows. In S-Trans the metavariable T of the hypothesis is not present in the conclusion, but this is not a problem by itself (a similar situation appears in the simply typed lambda calculus in its application rule and the system is deterministic). The problem is that in the presence of S-Conv the vanishing T can be β∧-convertible to either S or U or to both S and U. What example (3.1) shows is that S and U may be different normal forms, which means that searching for T is inherently nondeterministic.

We cannot eliminate transitivity completely, we still need it on type variables and on type applications. In F_{≤} [Ghe90] transitivity is eliminated and hidden in a richer variable rule in which deciding whether Γ ⊢ X ≤ T when T ≢ X is reduced to deciding whether the bound of X is smaller than or equal to T. The bound of X has the particular property of being the least strict upper bound of X. This observation motivated the definition of our NS-OApp rule, in which we reduce the decision of whether Γ ⊢ T S ≤ A when A ≢ T S, to check if the least strict upper bound of T S is smaller than or equal to A (See lemma 3.3.1 and corollary 3.3.1.2). lub_{Γ}(T S) is obtained from T S by replacing its leftmost innermost variable by the corresponding bound in Γ. Consequently, lub_{Γ}(T S) may be other than a normal form. That is the reason we normalize it. The strength of the conversion rule that is not captured by reflexivity is hidden in this normalization step. Since T S is a well kinded type, by the free variables lemma (lemma 2.4.3), FTV(T S) ⊆ dom(Γ). Therefore, lub_{Γ}(T S) is defined. By lemma 3.3.1(1), lub_{Γ}(T S) is well-kinded, and since well-kinded types are strongly normalizing, its normal form exists. The rules

S-Meet-LB and S-Meet-G are replaced by NS-∃, NS-∀, and NS-∀∃.

3.2 Structural properties of NF_{∧}^{ω}

This section establishes a number of structural properties of NF_{∧}^{ω}. The proofs of lemmas 3.2.1 and 3.2.2 are similar to those of the corresponding properties for F_{∧}^{ω}.

Lemma 3.2.1 If Γ ⊢_{n} S ≤ T and Γ_{1} is a prefix of Γ, then Γ_{1} ⊢ ok as a subderivation. Moreover, the subderivation is strictly shorter.

Lemma 3.2.2 (Weakening/Permutation) Let Γ and Γ′ be contexts such that Γ ⊆ Γ′ and Γ′ ⊢ ok. Then Γ ⊢_{n} S ≤ T implies Γ′ ⊢_{n} S ≤ T.

We present rewriting rules on derivations to simplify instances of NS-Refl and NS-Trans. We give a terminating strategy to transform a given derivation into a derivation with occurrences of NS-Refl only applied to type variables or type applications and without occurrences of NS-Trans. To improve readability we omit kinding judgements in the transitivity elimination rules which appear as hypothesis in the redex or in a proper subderivation of the missing ones, as we proved in generation for kinding (proposition 2.4.6). The derivations of the kinding judgements of each reduct of the reflexivity rules are proper subderivations of the kinding judgements in its redex.

Definition 3.2.3 (Reflexivity simplification rules)

1. Γ ⊢ S→A ∈ ⋆ \overline{NS-Refl}

⇒_{R} Γ ⊢ S ∈ ⋆ ; \overline{NS-Refl} ; Γ ⊢_{n} S ≤ S Γ ⊢ A ∈ ⋆ ; \overline{NS-Refl} ; Γ ⊢_{n} A ≤ A

Γ ⊢_{n} S→A ≤ S→A

\overline{NS-Arrow} Γ ⊢_{n} S→A ≤ S→A

3.2. STRUCTURAL PROPERTIES OF NF_{∧}^{ω} 45

2. Γ ⊢ ∀X≤S:K.A ∈ ⋆ \overline{NS-Refl}

Γ ⊢_{n} ∀X≤S:K.A ≤ ∀X≤S:K.A

⇒_{R}

Γ, X≤S:K ⊢ A ∈ ⋆
\overline{NS-Refl}
Γ, X≤S:K ⊢_{n} A ≤ A
\overline{NS-All}
Γ ⊢_{n} ∀X≤S:K.A ≤ ∀X≤S:K.A

3. Γ ⊢ ΛX:K.A ∈ K→K′ \overline{NS-Refl}

Γ ⊢_{n} ΛX:K.A ≤ ΛX:K.A

⇒_{R}

Γ, X:K ⊢ A ∈ K′
\overline{NS-Refl}
Γ, X:K ⊢_{n} A ≤ A
\overline{NS-OAbs}
Γ ⊢_{n} ΛX:K.A ≤ ΛX:K.A

4. Γ ⊢ ⋀^{K}[A_{1}..A_{n}] ∈ K \overline{NS-Refl}

Γ ⊢_{n} ⋀^{K}[A_{1}..A_{n}] ≤ ⋀^{K}[A_{1}..A_{n}]

⇒_{R}

Γ ⊢ A_{i} ∈ K
\overline{NS-Refl}
Γ ⊢_{n} A_{i} ≤ A_{i} ∀i∈{1..n}
\overline{NS-∀∃}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{n}] ≤ ⋀^{K}[A_{1}..A_{n}]

Definition 3.2.4 (Transitivity elimination rules)

1. Γ ⊢ S ∈ K ; \overline{NS-Refl} ; Γ ⊢_{n} S ≤ S Γ ⊢_{n} S ≤ T

\overline{NS-Trans}
Γ ⊢_{n} S ≤ T

⇒_{T} Γ ⊢_{n} S ≤ T

2. Γ ⊢_{n} S ≤ T Γ ⊢ T ∈ K ; \overline{NS-Refl} ; Γ ⊢_{n} T ≤ T

\overline{NS-Trans}
Γ ⊢_{n} S ≤ T

⇒_{T} Γ ⊢_{n} S ≤ T

3.

Γ ⊢_{n} Γ(X) ≤ A

\overline{NS-TVar}

Γ ⊢_{n} X ≤ A Γ ⊢_{n} A ≤ B

Γ ⊢_{n} X ≤ B

⇒_{T}

Γ ⊢_{n} Γ(X) ≤ A Γ ⊢_{n} A ≤ B
\overline{NS-Trans}
Γ ⊢_{n} Γ(X) ≤ B
Γ ⊢_{n} X ≤ B

\overline{NS-Trans} \overline{NS-TVar}

46 CHAPTER 3. DECIDABILITY OF SUBTYPING IN F_{∧}^{ω} 4.

Γ ⊢_{n} T ≤ S Γ ⊢_{n} A ≤ B
\overline{NS-Arrow}

Γ ⊢_{n} S→A ≤ T →B

Γ ⊢_{n} U ≤ T Γ ⊢_{n} B ≤ C
\overline{NS-Arrow}
Γ ⊢_{n} T →B ≤ U→C
\overline{NS-Trans}
Γ ⊢_{n} S→A ≤ U→C

⇒_{T}

Γ ⊢_{n} U ≤ T Γ ⊢_{n} T ≤ S
\overline{NS-Trans}
Γ ⊢_{n} U ≤ S

Γ ⊢_{n} A ≤ B Γ ⊢_{n} B ≤ C
\overline{NS-Trans}
Γ ⊢_{n} A ≤ C
\overline{NS-Arrow}
Γ ⊢_{n} S→A ≤ U→C

5. Γ, X≤S:K ⊢_{n} A ≤ B ; \overline{NS-All} ; Γ ⊢_{n} ∀X≤S:K.A ≤ ∀X≤S:K.B Γ, X≤S:K ⊢_{n} B ≤ C ; \overline{NS-All} ; Γ ⊢_{n} ∀X≤S:K.B ≤ ∀X≤S:K.C

\overline{NS-Trans}
Γ ⊢_{n} ∀X≤S:K.A ≤ ∀X≤S:K.C

⇒_{T}

Γ, X≤S:K ⊢_{n} A ≤ B Γ, X≤S:K ⊢_{n} B ≤ C
\overline{NS-Trans}
Γ, X≤S:K ⊢_{n} A ≤ C
\overline{NS-All}
Γ ⊢_{n} ∀X≤S:K.A ≤ ∀X≤U:K.C

6.

Γ, X:K ⊢_{n} A ≤ B

\overline{NS-OAbs}

Γ ⊢_{n} ΛX:K.A ≤ ΛX:K.B

Γ, X:K ⊢_{n} B ≤ C
\overline{NS-OAbs}
Γ ⊢_{n} ΛX:K.B ≤ ΛX:K.C
\overline{NS-Trans}
Γ ⊢_{n} ΛX:K.A ≤ ΛX:K.C

⇒_{T}

Γ, X:K ⊢_{n} A ≤ B Γ, X:K ⊢_{n} B ≤ C
\overline{NS-Trans}
Γ, X:K ⊢_{n} A ≤ C
\overline{NS-OAbs}
Γ ⊢_{n} ΛX:K.A ≤ ΛX:K.C

7.

Γ ⊢_{n} lub_{Γ}(A S)^{nf} ≤ B

\overline{NS-OApp}

Γ ⊢_{n} A S ≤ B Γ ⊢_{n} B ≤ C

\overline{NS-Trans}
Γ ⊢_{n} A S ≤ C

⇒_{T}

Γ ⊢_{n} (lub_{Γ}(A S))^{nf} ≤ B Γ ⊢_{n} B ≤ C
\overline{NS-Trans}
Γ ⊢_{n} lub_{Γ}(A S))^{nf} ≤ C
\overline{NS-OApp}
Γ ⊢_{n} A S ≤ C

8. ∀i∈\{1..n\} Γ ⊢_{n} A ≤ A_{i} ; \overline{NS-∀} ; Γ ⊢_{n} A ≤ ⋀^{K}[A_{1}..A_{n}] ∃j∈\{1..n\} Γ ⊢_{n} A_{j} ≤ B ; \overline{NS-∃} ; Γ ⊢_{n} ⋀^{K}[A_{1}..A_{n}] ≤ B

\overline{NS-Trans}
Γ ⊢_{n} A ≤ B

⇒_{T} ∃j∈{1..n} Γ ⊢_{n} A ≤ A_{j} Γ ⊢_{n} A_{j} ≤ B \overline{NS-Trans}

Γ ⊢_{n} A ≤ B

3.2. STRUCTURAL PROPERTIES OF NF_{∧}^{ω} 47

9. Γ ⊢_{n} A ≤ B ∀i∈\{1..n\} Γ ⊢_{n} B ≤ A_{i} ; \overline{NS-∀} ; Γ ⊢_{n} B ≤ ⋀^{K}[A_{1}..A_{n}]

\overline{NS-Trans}

Γ ⊢_{n} A ≤ ⋀^{K}[A_{1}..A_{n}]

⇒_{T}

∀i∈{1..n} Γ ⊢_{n} A ≤ B Γ ⊢_{n} B ≤ A_{i}
\overline{NS-Trans}
∀i∈{1..n} Γ ⊢_{n} A ≤ A_{i}
\overline{NS-∀}
Γ ⊢_{n} A ≤ ⋀^{K}[A_{1}..A_{n}]

10. ∃j∈\{1..n\} Γ ⊢_{n} A_{j} ≤ B ; \overline{NS-∃} ; Γ ⊢_{n} ⋀^{K}[A_{1}..A_{n}] ≤ B Γ ⊢_{n} B ≤ A

\overline{NS-Trans}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{n}] ≤ A

⇒_{T}

∃j∈{1..n} Γ ⊢_{n} A_{j} ≤ B Γ ⊢_{n} B ≤ A
\overline{NS-Trans}
∃j∈{1..n} Γ ⊢_{n} A_{j} ≤ A
\overline{NS-∃}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{n}] ≤ A

11. ∃j∈\{1..m\} Γ ⊢_{n} A_{j} ≤ A ; \overline{NS-∃} ; Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ A ∀i∈\{1..n\} Γ ⊢_{n} A ≤ B_{i} ; \overline{NS-∀} ; Γ ⊢_{n} A ≤ ⋀^{K}[B_{1}..B_{n}]

\overline{NS-Trans}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ ⋀^{K}[B_{1}..B_{n}]

⇒_{T}

∃j∈{1..m} Γ ⊢_{n} A_{j} ≤ A ∀i∈{1..n} Γ ⊢_{n} A ≤ B_{i}
\overline{NS-Trans}
∀i∈{1..n} ∃j∈{1..m} Γ ⊢_{n} A_{j} ≤ B_{i}
\overline{NS-∀∃}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ ⋀^{K}[B_{1}..B_{n}]

12. \begin{matrix}∀i∈\{1..n\} ∃j∈\{1..m\} Γ ⊢_{n} A_{j} ≤ B_{i} \\ Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ ⋀^{K}[B_{1}..B_{n}] \end{matrix} ∀k∈\{1..r\} ∃i∈\{1..n\} Γ ⊢_{n} B_{i} ≤ C_{k} ; \overline{NS-∀∃} ; Γ ⊢_{n} ⋀^{K}[B_{1}..B_{n}] ≤ ⋀^{K}[C_{1}..C_{r}]

\overline{NS-Trans}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ ⋀^{K}[C_{1}..C_{r}]

⇒_{T}

∀k∈{1..r} ∃i∈{1..n} ∃j∈{1..m} Γ ⊢_{n} A_{j} ≤ B_{i}  Γ ⊢_{n} B_{i} ≤ C_{k}
\overline{NS-Trans}
∀k∈{1..r} ∃j∈{1..m} Γ ⊢_{n} A_{j} ≤ C_{k}
\overline{NS-∀∃}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ ⋀^{K}[C_{1}..C_{r}]

13. ∀i∈\{1..n\} ∃j∈\{1..m\} Γ ⊢_{n} A_{j} ≤ B_{i} ; \overline{NS-∀∃} ; Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ ⋀^{K}[B_{1}..B_{n}] ∃i∈\{1..n\} Γ ⊢_{n} B_{i} ≤ C ; \overline{NS-∃} ; Γ ⊢_{n} ⋀^{K}[B_{1}..B_{n}] ≤ C

\overline{NS-Trans}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ C

⇒_{T}

∃j∈{1..m} ∃i∈{1..n} Γ ⊢_{n} A_{j} ≤ B_{i} Γ ⊢_{n} B_{i} ≤ C
\overline{NS-Trans}
∃j∈{1..m} Γ ⊢_{n} A_{j} ≤ C
\overline{NS-∃}
Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ C

14. ∀i∈\{1..n\} Γ ⊢_{n} A ≤ B_{i} ; \overline{NS-∀} ; Γ ⊢_{n} A ≤ ⋀^{K}[B_{1}..B_{n}] ∀k∈\{1..r\} ∃i∈\{1..n\} Γ ⊢_{n} B_{i} ≤ C_{k} ; \overline{NS-∀∃} ; Γ ⊢_{n} ⋀^{K}[B_{1}..B_{n}] ≤ ⋀^{K}[C_{1}..C_{r}]

\overline{NS-Trans}
Γ ⊢_{n} A ≤ ⋀^{K}[C_{1}..C_{r}]

⇒_{T}

∀k∈{1..r} ∃i∈{1..n} Γ ⊢_{n} A ≤ B_{i}  Γ ⊢_{n} B_{i} ≤ C_{k}
\overline{NS-Trans}
∀k∈{1..r} Γ ⊢_{n} A ≤ C_{k}
\overline{NS-∀}
Γ ⊢_{n} A ≤ ⋀^{K}[C_{1}..C_{r}]

A derivation of a subtyping statement is in refl-normal form if it has no reflexivity redexes and it is in trans-normal form if it has no transitivity redexes, and it is in normal form if it has neither reflexivity nor transitivity redexes. The elimination of NS-Trans, and the simplification of NS-Refl follow a standard cut-elimination argument.

Lemma 3.2.5 (Reflexivity simplification) Let D be a derivation of a subtyping statement with only one application of NS-Refl. Then D has a refl-normal form.

Proof: Same argument as in lemma 3.2.6. □

Lemma 3.2.6 (Transitivity elimination) Let D be a derivation of a subtyping statement with only one application of NS-Trans. Then D has a trans-normal form.

Proof: By induction on the size of D following a case analysis of the last rule of D. If the last rule is not NS-Trans, then the result follows by the induction hypothesis. Otherwise we consider all possible last rules of the derivations of the premises and note that each possible configuration determines a trans-redex. Finally, observe that each reduction yields either a derivation in normal form or shorter derivations with only one occurrence of NS-Trans in which case the result follows by the induction hypothesis. □

An immediate corollary of this last result is that transitivity elimination terminates. Given a derivation D of Γ ⊢_{n} S ≤ T, iterate the previous lemma on all subderivations of D that have only one NS-Trans application. The number of times the lemma is applied is equal to the number of occurrences of NS-Trans in D. Furthermore, lemma 3.2.5 implies that reflexivity simplification terminates. The simplification rules are such that transitivity simplification rules do not create new reflexivity redexes. Therefore, we can reduce all instances of NS-Refl first and then all instances of NS-Trans, which is a terminating procedure to normalize a derivation. Consequently, we have proved the following corollary.

Corollary 3.2.7 (Existence of normal derivations) Given a derivation of Γ ⊢_{n} S ≤ T. Then there exists a derivation in normal form of Γ ⊢_{n} S ≤ T.

Lemma 3.2.8 3.2. STRUCTURAL PROPERTIES OF NF_{∧}^{ω} 49

1. A derivation in normal form whose last rule is NS-Refl is either a proof of Γ ⊢_{n} X ≤ X or Γ ⊢_{n} A T ≤ A T.

2. If the last rule of a subtyping derivation D is NS-Trans, then D is not in normal form.

Proof:

1. According to the reflexivity elimination rules, any other possible NS-Refl application is a redex.

2. By case analysis of the last rules of the premises of the last rule of D. In each case the result follows either by the induction hypothesis or because the last rule of at least one of the derivations of the premises of D constitutes a redex. □

We can summarise the previous results as follows.

Corollary 3.2.9 If Γ ⊢_{n} S ≤ T, then there exists a proof of the same judgement with no applications of NS-Trans and in which NS-Refl is only applied to type variables and type applications.

A consequence of the normalization of proofs is the following generation result.

Proposition 3.2.10 (Generation for normal subtyping)

1. Γ ⊢_{n} X ≤ B implies X ≡ B and Γ ⊢ X ∈ K for some K, or Γ ⊢_{n} Γ(X) ≤ B.

2. Γ ⊢_{n} S→A ≤ B implies B ≡ T →C, Γ ⊢_{n} T ≤ S, Γ ⊢_{n} A ≤ C, and Γ ⊢ S→A ∈ ⋆.

3. Γ ⊢_{n} ∀X≤S:K.A ≤ B implies B ≡ ∀X≤S:K.C, Γ, X≤S:K ⊢_{n} A ≤ C, and Γ ⊢ ∀X≤S:K.A ∈ ⋆.

4. Γ ⊢_{n} ΛX:K.A ≤ B implies B ≡ ΛX:K.C and Γ, X≤⊤^{K}:K ⊢_{n} A ≤ C.

5. Γ ⊢_{n} A S ≤ B implies B ≡ A S, or Γ ⊢_{n} (lub_{Γ}(A S))^{nf} ≤ B, and Γ ⊢ A S ∈ K.

6. Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ B implies that there exists j∈{1..m} such that Γ ⊢_{n} A_{j} ≤ B and ∀k∈{1..m} Γ ⊢ A_{k} ∈ K.

7. Γ ⊢_{n} A ≤ ⋀^{K}[B_{1}..B_{n}] implies that for each i∈{1..n} Γ ⊢_{n} A ≤ B_{i} and Γ ⊢ A ∈ K.

8. Γ ⊢_{n} ⋀^{K}[A_{1}..A_{m}] ≤ ⋀^{K}[B_{1}..B_{n}] implies that for each i∈{1..n} there exists j∈{1..m} such that Γ ⊢_{n} A_{j} ≤ B_{i} and ∀k∈{1..m} Γ ⊢ A_{k} ∈ K.

Moreover, given a normal proof of any of the antecedents, the proofs of the consequents are proper subderivations.

Proof: In each case, given a proof of the antecedent, there is also a proof in normal form. Due to lemma 3.2.8(2), such a derivation cannot end with an application of NS-Trans, and, because of lemma 3.2.8(1), if it ends with NS-Refl, then it is a derivation of a subtyping statement between type variables or type applications. Finally, the result follows by inspection of the other rules. □

Lemma 3.2.11

1. Γ ⊢_{n} T ≤ ⋀^{K}[A_{1}..A_{n}] if and only if Γ ⊢_{n} T ≤ A_{k} for each k∈{1..n} .

2. Γ ⊢_{n} T ≤ ⋀^{K}[A_{1}..A_{n}] if and only if Γ ⊢_{n} T ≤ ⋀^{K}[A_{k}] for each k∈{1..n} .

3. Let Γ ⊢ ⋀^{K}[A_{1}..A_{n}] ∈ K. Then Γ ⊢_{n} ⋀^{K}[A_{1}..A_{n}] ≤ T if and only if Γ ⊢_{n} A_{k} ≤ T for some k∈ {1..n} .

Proof: By induction on derivations, using lemma 3.2.7 and generation. □

3.3 Equivalence of ordinary and normal subtyping

In this section, we show that a subtyping statement is derivable in F_{∧}^{ω} if and only if the corresponding normalized statement is derivable in NF_{∧}^{ω}. This equivalence is proved in theorem 3.3.9. As usual, we need some auxiliary properties and definitions, among which we can highlight propositions 3.3.2 and 3.3.8.

Lemma 3.3.1 Let lub_{Γ}(S) be defined. Then

1. Γ ⊢ S ∈ K implies Γ ⊢ lub_{Γ}(S) ∈ K.

2. Γ ⊢ S ≤ lub_{Γ}(S).

Proof: Item 1 follows by induction on derivations, while item 2 follows by induction on the structure of S. □

Proposition 3.3.2 (Soundness) If Γ ⊢_{n} S ≤ T, then Γ ⊢ S ≤ T.

Proof: By induction on the derivation of Γ ⊢_{n} S ≤ T.

NS-Refl By S-Conv.

NS-TVar By the induction hypothesis, S-TVar and S-trans.

NS-OApp By the induction hypothesis, lemma 3.3.1(2), S-Conv and S-Trans.

NS-∃ We are given that for each k in {1..n} Γ ⊢ A_{k} ∈ K, and there is a j in {1..n} such that Γ ⊢_{n} A_{j} ≤ B. By K-Meet, Γ ⊢ ⋀^{K}[A_{1}..A_{n}] ∈ K, and, by S-Meet-LB Γ ⊢ ⋀^{K}[A_{1}..A_{n}] ≤ A_{k} for each k, in particular for j. Hence the result follows by the induction hypothesis and S-Trans.

NS-∀ We are given that Γ ⊢ A ∈ K, and for each i in {1..m} Γ ⊢_{n} A ≤ B_{i}. Hence the result follows by the induction hypothesis and S-Meet-G.

NS-∀∃ We are given that for each k in {1..n} Γ ⊢ A_{k} ∈ K, and for each i in {1..m} there is a j in {1..n} such that Γ ⊢_{n} A_{j} ≤ B_{i}. By K-Meet, Γ ⊢ ⋀^{K}[A_{1}..A_{n}] ∈ K, and, by S-Meet-LB, Γ ⊢ ⋀^{K}[A_{1}..A_{n}] ≤ A_{k} for each k. Hence the result follows by the induction hypothesis, S-Trans

and S-Meet-G.

Other cases By the induction hypothesis and the corresponding rule in the other system. □

The following lemma says that empty intersections, ⊤^{K}, are maximal elements of the subtyping order.

Lemma 3.3.3

1. Γ ⊢ T ∈ K implies Γ ⊢_{n} T ≤ ⊤^{K}.

2. Γ ⊢ T ∈ K implies Γ ⊢ T ≤ ⊤^{K}.

Proof: Statement 1 follows by the cases m = 0 in NS-∀ and NS-∀∃. Statement 2 is the case n = 0 in S-Meet-G. □

Lemma 3.3.4

1. Γ ⊢ ok implies Γ^{nf} ⊢ ok.

2. Γ ⊢ T ∈ K implies Γ^{nf} ⊢ T ∈ K.

3. Γ ⊢ S ≤ T implies Γ^{nf} ⊢ S ≤ T.

4. Let Γ_{1}, Γ_{2} ⊢ ok. Then Γ_{1}^{nf}, Γ_{2} ⊢ T ∈ K implies Γ_{1}, Γ_{2} ⊢ T ∈ K.

5. Let Γ_{1}, Γ_{2} ⊢ ok. Then Γ_{1}^{nf}, Γ_{2} ⊢ S ≤ T implies Γ_{1}, Γ_{2} ⊢ S ≤ T.

6. Let Γ ⊢ S, T ∈ K. Then Γ^{nf} ⊢ S^{nf} ≤ T^{nf} if and only if Γ ⊢ S ≤ T.

Proof: Statements 1 and 2 follow by simultaneous induction on the size of derivations using lemma 2.4.17. Statement 3 follows by induction on the derivation of Γ ⊢ S ≤ T using part 1, part 2, and lemma 2.4.17. Statement 4 follows by induction on the derivation of Γ_{1}^{nf}, Γ_{2} ⊢ T ∈ K. Item 5 follows by induction on the derivation of Γ_{1}^{nf}, Γ_{2} ⊢ S ≤ T, using part 4. Item 6 is a corollary of part 3, part 5 and lemma 2.4.16. □

In the last lemma, items 1, 2, and 3 show that well formation of contexts, kinding judgements, and subtyping judgements are invariant under normalization of contexts, while items 4 and 5 are the converse of 2 and 3 respectively.

The following lemma states that S-TVar is an admissible rule in NF_{∧}^{ω}.

Lemma 3.3.5 Let Γ be a context in normal form such that Γ ⊢ ok and Y ∈dom(Γ). Then Γ ⊢_{n} Y ≤ Γ(Y).

Proof: Let Γ ≡ Γ_{1}, Y ≤ T:K, Γ_{2}. By lemma 2.4.2, Γ_{1} ⊢ T ∈ K. If T is not an intersection, then, by NS-Refl and NS-TVar, we have Γ ⊢_{n} Y ≤ T. If T ≡ ⋀^{K′}[B_{1}..B_{m}], then by generation for kinding and unicity of kinds, Γ ⊢ B_{i} ∈ K for each i and K ≡ K′. By NS-Refl, Γ ⊢_{n} B_{i} ≤ B_{i} for each i. Then, by NS-∃ and NS-TVar, it follows that Γ ⊢_{n} Y ≤ B_{i} for each i, and, by NS-∀, Γ ⊢_{n} Y ≤ T. □

Lemma 3.3.6 (Substitution) If Γ ⊢ U ∈ K and Γ, X:K, Γ′ ⊢_{n} S ≤ T, then Γ, (Γ′[X←U])^{nf} ⊢_{n} (S[X←U])^{nf} ≤ (T [X←U])^{nf}.

Proof: By induction on the derivation of Γ, X:K, Γ′ ⊢_{n} S ≤ T. For the sake of clarity, we sometimes leave out kinding judgements and their justifications which follow easily from the structural properties in section 2.4. Let Γ′′ ≡ Γ, X:K, Γ′.

NS-Refl By the type substitution lemma 2.4.11, lemma 3.3.4(2), subject reduction for kinds (lemma 2.4.12), and NS-Refl.

NS-Trans By the induction hypothesis and NS-Trans.

NS-TVar We are given Γ′′ ⊢_{n} Γ′′(Y) ≤ A. We have to consider three cases.

1. Y ≡ X. By subject reduction, Γ ⊢ U^{nf} ∈ K, and by lemma 3.3.3(1), it follows that Γ ⊢_{n} U^{nf} ≤ ⊤^{K}. By weakening, it follows that Γ, (Γ′[X←U])^{nf} ⊢_{n} U^{nf} ≤ ⊤^{K} and, by the induction hypothesis, it follows that Γ, (Γ′[X←U])^{nf} ⊢_{n} ⊤^{K} ≤ (A[X←U])^{nf}. Finally, the result follows by NS-Trans.

2. Y ∈dom(Γ). By the free variables lemma, X ∉ FV(Γ(Y)) and X ≢ Y. By lemmas 2.4.11, 3.3.4(1), and 3.3.5, it follows that Γ, (Γ′[X←U])^{nf} ⊢_{n} Y ≤ Γ(Y), and, by the induction hypothesis, it follows that Γ, (Γ′[X←U])^{nf} ⊢_{n} Γ(Y) ≤ (A[X←U])^{nf}. Finally, the result follows by NS-Trans.

3. Y ∈dom(Γ′). By the induction hypothesis, it follows that

Γ, (Γ′[X←U])^{nf} ⊢_{n} (Γ′(Y)[X←U])^{nf} ≤ (A[X←U])^{nf}.

By lemmas 2.4.11, 3.3.4(1), and 3.3.5,

Γ, (Γ′[X←U])^{nf} ⊢_{n} Y ≤ (Γ, (Γ′[X←U])^{nf})(Y).

Furthermore, (Γ, (Γ′[X←U])^{nf})(Y) = (Γ′(Y)[X←U])^{nf}. Hence the result follows by NS-Trans.

NS-Arrow We are given that Γ′′ ⊢_{n} T_{1} ≤ S_{1} and Γ′′ ⊢_{n} S_{2} ≤ T_{2}. By the induction hypothesis, it follows that Γ, (Γ′[X←U])^{nf} ⊢_{n} (T_{1}[X←U])^{nf} ≤ (S_{1}[X←U])^{nf} and Γ, (Γ′[X←U])^{nf} ⊢_{n} (S_{2}[X←U])^{nf} ≤ (T_{2}[X←U])^{nf}. There are four cases to consider, since (T_{2}[X←U])^{nf} and (S_{2}[X←U])^{nf} may be intersections or not. We shall consider only two of them to illustrate the proof method.

1. (T_{2}[X←U])^{nf} and (S_{2}[X←U])^{nf} are not intersections. Then the result follows by applying NS-Arrow.

2. (S_{2}[X←U])^{nf} = ⋀^{⋆}[C_{1}..C_{n}] and (T_{2}[X←U])^{nf} is not an intersection. Then we have that ((T_{1}→T_{2})[X←U])^{nf} = (T_{1}[X←U])^{nf}→(T_{2}[X←U])^{nf} and ((S_{1}→S_{2})[X←U])^{nf}

= ⋀^{⋆}[(S_{1}[X←U])^{nf}→C_{1}..(S_{1}[X←U])^{nf}→C_{n}].

By lemma 3.2.10, it follows that for some i Γ, (Γ′[X←U])^{nf} ⊢_{n} C_{i} ≤ (T_{2}[X←U])^{nf}. Applying NS-Arrow, Γ, (Γ′[X←U])^{nf} ⊢_{n} (S_{1}[X←U])^{nf}→C_{i} ≤ (T_{1}[X←U])^{nf}→(T_{2}[X←U])^{nf}. Finally, the result follows by NS-∃.

Other cases NS-OApp is similar to the case for NS-TVar using lemma 2.3.1.4(3) and uniqueness of normal forms. All other cases are similar to that

of NS-Arrow. □

This substitution lemma is the key result we use in proving that S-OApp has a corresponding admissible rule in NF_{∧}^{ω}.

Lemma 3.3.7 Γ ⊢ S U ∈ K. Then Γ ⊢_{n} S ≤ T implies Γ ⊢_{n} (S U)^{nf} ≤ (T U)^{nf}.

Proof: By induction on the derivation of Γ ⊢_{n} S ≤ T, assuming a derivation in normal form. The cases for NS-Arrow and NS-All are impossible because of the assumption Γ ⊢ S U ∈ K.

NS-Refl By subject reduction for kinds and NS-Refl.

NS-TVar We are given Γ ⊢_{n} Γ(X) ≤ A. By the induction hypothesis, Γ ⊢_{n} (Γ(X)U)^{nf} ≤ (AU)^{nf}. We have to consider two cases.

(AU)^{nf} ≡ B By NS-OApp.

(AU)^{nf} ≡ ⋀^{K}[A_{1}..A_{n}] By lemma 3.2.11, Γ ⊢_{n} (Γ(X)U)^{nf} ≤ A_{k} for each k in {1..n}. By NS-OApp, Γ ⊢_{n} X U ≤ (A_{k}) for each k, which, by NS-∀, implies Γ ⊢_{n} X U ≤ (AU)^{nf}.

NS-OAbs We are given Γ, X:K ⊢_{n} S_{1} ≤ T_{1}. By the substitution lemma 3.3.6, it follows that Γ ⊢_{n} (S_{1}[X←U])^{nf} ≤ (T_{1}[X←U])^{nf}. On the other hand, we have that (ΛX:K.S_{1})U →_{β∧} S_{1}[X←U] and (ΛX:K.T_{1})U →_{β∧} T_{1}[X←U]. Finally, the result follows by the uniqueness of normal forms.

NS-OApp Similar to case NS-TVar.

NS-∀∃ By the induction hypothesis and NS-∀∃, using generation for subtyping.

NS-∃ and NS-∀ By the induction hypothesis, using lemma 3.2.11. □

Proposition 3.3.8 (Completeness) If Γ ⊢ S ≤ T, then Γ^{nf} ⊢_{n} S^{nf} ≤ T^{nf}.

Proof: By induction on the derivation of Γ ⊢ S ≤ T, using lemma 3.3.7 for the case of S-OApp. □

Theorem 3.3.9 (Equivalence of ordinary and normal subtyping) Let Γ ⊢ S ∈ K and Γ ⊢ T ∈ K. Then Γ ⊢ S ≤ T if and only if Γ^{nf} ⊢_{n} S^{nf} ≤ T^{nf}.

Proof:

⇒) By completeness (3.3.8).

⇐) By soundness (3.3.2), it follows that Γ^{nf} ⊢ S^{nf} ≤ T^{nf}, and, by lemma 3.3.4(6), it follows that Γ ⊢ S ≤ T. □

3.3.1 Least strict upper bound

So far we only used that lub_{Γ}(S) is an upper bound of S in the context Γ (See lemma 3.3.1(2)). We can now give the final motivation of the name we chose, showing that if lub_{Γ}(S) is defined and T ≠_{β∧} S, then Γ ⊢ S ≤ T implies Γ ⊢ lub_{Γ}(S) ≤ T. We first show that the corresponding property holds for the normalized system.

Lemma 3.3.1.1 Let lub_{Γ}(S) be defined. Then

1. If S ↠_{β∧} S′ and Γ ↠_{β∧} Γ′, then lub_{Γ}(S) ↠_{β∧} lub_{Γ′}(S′).

2. If Γ ⊢_{n} S ≤ T, then Γ ⊢_{n} lub_{Γ}(S)^{nf} ≤ T or S ≡ T.

Proof:

1. By induction on the structure of S, observing that if lub_{Γ}(S) is defined, so is lub_{Γ′}(S′).

2. By induction on the derivation of Γ ⊢_{n} S ≤ T. It is immediate for the case

NS-Refl; for NS-Arrow, NS-All, and NS-OAbs lub_{Γ}(S) is not defined; for

the other rules the result follows using the induction hypothesis. □

Corollary 3.3.1.2 Let lub_{Γ}(S) be defined. Then Γ ⊢ S ≤ T and T ≠_{β∧} S implies Γ ⊢ lub_{Γ}(S) ≤ T.

Proof: By completeness, it follows that Γ^{nf} ⊢_{n} S^{nf} ≤ T^{nf}. By lemma 3.3.1.1(2), Γ^{nf} ⊢_{n} (lub_{Γnf}(S^{nf}))^{nf} ≤ T^{nf}, because S^{nf} ≢ T^{nf}. By soundness, it follows that Γ^{nf} ⊢ (lub_{Γnf}(S^{nf}))^{nf} ≤ T^{nf}, which is equivalent to Γ ⊢ lub_{Γnf}(S^{nf}) ≤ T by lemma 3.3.4(6). Finally, (using lemmas 3.3.1(1) and 2.4.12, and proposition 2.4.19 to get the corresponding kinding judgements) it follows that Γ ⊢ lub_{Γ}(S) ≤ T by lemma 3.3.1.1(1), S-Conv and S-Trans. □

3.3.2 Example

In this section, we give the derivations in F_{∧}^{ω} and in NF_{∧}^{ω} of the example(3.1) mentioned in the introduction and in section 3.1.

Let Γ ≡ X ≤ ΛY:K.Y:K→K, Z ≤ X:K→K. We present a proof of

Γ ⊢ X(Z W) ≤ W

and a proof of its translation in the normal system

Γ^{nf} ⊢_{n} X(Z W)^{nf} ≤ W^{nf}.

Observe that \begin{matrix}Γ^{nf} ≡ Γ, \\ (X(Z W))^{nf} ≡ X(Z W), and \\ W^{nf} ≡ W. \end{matrix}

For the sake of readability we omit kinding judgements.

We have the following derivation in F_{∧}^{ω}:

Γ ⊢ ok
\overline{S-OApp}

(ΛY:K.Y)Z W =_{β∧} Z W ; \overline{S-Conv} ; (ΛY:K.Y)Z W ≤ Z W

\overline{S-Trans}

Γ ⊢ ok

\overline{S-TVar}

\overline{S-Trans}

\overline{S-OApp}

(ΛY:K.Y)W =_{β∧} W ; \overline{S-Conv} ; (ΛY:K.Y)W ≤ W

\overline{S-Trans}
Γ ⊢ Z W ≤ W
\overline{S-Trans}
Γ ⊢ X(Z W) ≤ W

The corresponding derivation in normal form in NF_{∧}^{ω} is substantially shorter:

Γ ⊢ W ∈ K
\overline{NS-Refl}
\overline{NS-OApp}

\overline{S-TVar} Γ ⊢ X ≤ ΛY:K.Y Γ ⊢ X(Z W) ≤ (ΛY:K.Y)Z W

Γ ⊢ X(Z W) ≤ Z W Γ ⊢ ok ; \overline{S-TVar} ; Γ ⊢ Z ≤ X

Γ ⊢ X ≤ ΛY:K.Y Γ ⊢ Z ≤ (ΛY:K.Y)

Γ ⊢ Z W ≤ (ΛY:K.Y)W

Γ ⊢ X(Z W) ≤ Z W Γ ⊢ Z W ≤ W

Γ ⊢_{n} ((ΛY:K.Y)W)^{nf} ≤ W

\overline{NS-OApp} Γ ⊢_{n} X W ≤ W Γ ⊢_{n} ((ΛY:K.Y)(Z W))^{nf} ≤ W

\overline{NS-OApp} Γ ⊢_{n} X(Z W) ≤ W

3.4 A subtype checking algorithm, AlgF_{∧}^{ω}

As it stands, NF_{∧}^{ω} as defined in section 3.1 is not a deterministic algorithm, because its rules are not syntax directed. Fortunately, we are not far away from an algorithmic presentation. In fact, corollary 3.2.9 is the bridge to the algorithmic presentation of the subtyping relation, AlgF_{∧}^{ω}, which states that transitivity steps can be eliminated and reflexivity steps can be simplified. AlgF_{∧}^{ω} is obtained from NF_{∧}^{ω} by removing NS-Trans and restricting NS-Refl to type variables and type applications.

Definition 3.4.1 (AlgF_{∧}^{ω} subtyping rules)

\frac{Γ ⊢ X ∈ K}{Γ ⊢_{Alg} X ≤ X}  (AlgS-TVarRefl)

\frac{Γ ⊢ T S ∈ K}{Γ ⊢_{Alg} T S ≤ T S}  (AlgS-OAppRefl)

\frac{Γ ⊢_{Alg} Γ(X) ≤ A  X ≢ A}{Γ ⊢_{Alg} X ≤ A}  (AlgS-TVar)

\frac{Γ ⊢_{Alg} T_{1} ≤ S_{1}  Γ ⊢_{Alg} S_{2} ≤ T_{2}  Γ ⊢ S_{1}→S_{2} ∈ ⋆}{Γ ⊢_{Alg} S_{1}→S_{2} ≤ T_{1}→T_{2}}  (AlgS-Arrow)

\frac{Γ, X≤U:K ⊢_{Alg} S ≤ T  Γ ⊢ ∀X≤U:K.S ∈ ⋆}{Γ ⊢_{Alg} ∀X≤U:K.S ≤ ∀X≤U:K.T}  (AlgS-All)

\frac{Γ, X≤⊤^{K}:K ⊢_{Alg} S ≤ T}{Γ ⊢_{Alg} ΛX:K.S ≤ ΛX:K.T}  (AlgS-OAbs)

\frac{Γ ⊢_{Alg} (lub_{Γ}(T S))^{nf} ≤ A  Γ ⊢ T S ∈ K  T S ≢ A}{Γ ⊢_{Alg} T S ≤ A}  (AlgS-OApp)

\frac{∀i∈\{1..m\} Γ ⊢_{Alg} A ≤ T_{i}  Γ ⊢ A ∈ K}{Γ ⊢_{Alg} A ≤ ⋀^{K}[T_{1}..T_{m}]}  (AlgS-∀)

\frac{∃j∈\{1..n\} Γ ⊢_{Alg} S_{j} ≤ A  ∀k∈\{1..n\} Γ ⊢ S_{k} ∈ K}{Γ ⊢_{Alg} ⋀^{K}[S_{1}..S_{n}] ≤ A}  (AlgS-∃)

\frac{∀i∈\{1..m\} ∃j∈\{1..n\} Γ ⊢_{Alg} S_{j} ≤ T_{i}  ∀k∈\{1..n\} Γ ⊢ S_{k} ∈ K}{Γ ⊢_{Alg} ⋀^{K}[S_{1}..S_{n}] ≤ ⋀^{K}[T_{1}..T_{m}]}  (AlgS-∀∃)

Lemma 3.4.2 (Equivalence of normal and algorithmic subtyping)

Let Γ ⊢ S, T ∈ K. Then Γ ⊢_{n} S ≤ T if and only if Γ ⊢_{Alg} S ≤ T.

Proof: (⇒) By corollary 3.2.9. (⇐) Immediate. □

We have thereby proved that AlgF_{∧}^{ω} is indeed a sound and complete algorithm to compute F_{∧}^{ω}’s subtyping relation. We conclude the proof of decidability of subtyping in F_{∧}^{ω} by establishing in section 3.5 that AlgF_{∧}^{ω} always terminates.

Proposition 3.4.3 (Equivalence of ordinary and algorithmic subtyping)

Let Γ ⊢ S ∈ K and Γ ⊢ T ∈ K. Then Γ ⊢ S ≤ T if and only if Γ^{nf} ⊢_{Alg} S^{nf} ≤ T^{nf}.

Proof: By the equivalence of ordinary and normal subtyping (theorem 3.3.9) and the equivalence of normal and algorithmic subtyping (lemma 3.4.2). □

3.5 Termination of subtype checking

The last step in proving the decidability of the subtyping relation of F_{∧}^{ω} is proving the termination or well-foundedness of the relation defined by the AlgF_{∧}^{ω} subtyping rules. We show this by reducing the well-foundedness of AlgF_{∧}^{ω} to the strong normalization property of the →_{β∧+} relation.

We begin by extending the language of types with the constructor + as follows.

𝕋^{+} ::= X  type variable
| 𝕋^{+}→𝕋^{+}  function type
| ∀(X≤𝕋^{+}:𝕂)𝕋^{+} polymorphic type
| Λ(X:𝕂)𝕋^{+}  operator abstraction
| 𝕋^{+} 𝕋^{+}  operator application
| ⋀^{𝕂}[𝕋^{+}..𝕋^{+} ] intersection at kind 𝕂
| 𝕋^{+} + 𝕋^{+}  choice

Since we have enriched the language of types with a new type constructor, we need to extend our kinding judgements (section 2.2) with the following kinding rule.

\frac{Γ ⊢_{+} S ∈ K  Γ ⊢_{+} T ∈ K}{Γ ⊢_{+} S + T ∈ K}  (K-Plus)

→_{β∧+} is obtained from →_{β∧} by adding the reductions associated with the choice operator +, S + T →_{β∧+} S and S + T →_{β∧+} T. We also need the corresponding kinding rule saying that Γ ⊢ S + T ∈ K whenever Γ ⊢ S, T ∈ K. As far as we are aware, choice operators have not been used before to analyze subtyping.

Notation 3.5.1 We write + modulo commutativity and associativity.

We now define a new reduction →_{β∧+}.

Definition 3.5.2 (→_{β∧+}) The reduction on types →_{β∧+} is obtained from →_{β∧} (definition 2.2.1) by adding the following two rules:

1. S + T →_{β∧+} S, and

2. S + T →_{β∧+} T.

We also write →_{+} to refer to these two new reduction rules.

As usual, →_{β∧+} is extended to become a compatible relation with respect to type formation, ↠_{β∧+} is the reflexive, transitive closure of →_{β∧+}, and =_{β∧+} is the reflexive, symmetric, and transitive closure of →_{β∧+}.

Proposition 3.5.3 (Strong normalization for →_{β∧+}) If Γ ⊢_{+} T ∈ K, then every β∧+-reduction sequence starting from T is finite.

Proof: The result follows using the strategy used to prove that the reduction →_{β∧} is strongly normalizing on well kinded types (see theorem 2.5.10). We only need to modify the definition of saturated sets by adding the following closure condition: if T, U, R_{1}..R_{n}∈SN^{+}, then T R_{1}..R_{n}∈S and UR_{1}..R_{n}∈S imply (T +U)R_{1}..R_{n}∈S. □

Next, we define a measure for subtyping statements such that, given a subtyping rule, the measure of each hypothesis is smaller than that of the conclusion. Most measures for showing the well-foundedness of a relation defined by a set of inference rules involve a clever assignment of weights to judgements, often involving the number of symbols. We need a more sophisticated measure, since in AlgS-OApp it is not necessarily the case that the size of the hypothesis is smaller than the size of the conclusion.

We introduce a new mapping from types to types in the extended language in order to define a new measure on subtyping statements. To motivate the definition of this new measure, we analyze the behavior of type variables during subtype checking. Assume that we want to check if Γ ⊢_{Alg} S ≤ T, where S is a variable or a type application. It can be the case that the judgement is obtained with an application of AlgS-TVar or AlgS-OApp, in which case we have to consider a new statement Γ ⊢_{Alg} S′ ≤ T, where S′ is obtained from S by replacing a variable by its bound (and eventually normalizing). However, we do not replace every variable by its bound, as this would constitute an unsound operation with respect to subtyping.

Example 3.5.4 Two unrelated variables may have the same bound.

\begin{matrix}X≤⊤^{⋆}:⋆, Y ≤⊤^{⋆}:⋆ ⊬ X ≤ Y, but \\ X≤⊤^{⋆}:⋆, Y ≤⊤^{⋆}:⋆ ⊢ ⊤^{⋆} ≤ ⊤^{⋆}. \end{matrix}

Our new mapping, plus, includes in each type expression this nondeterministic behavior of its type variables.

Definition 3.5.5 (plus)

The mapping plus_{Γ} : 𝕋→𝕋^{+} is defined as follows.

1. plus_{Γ_{1}, X≤T:K, Γ_{2}}(X) = X + plus_{Γ_{1}}(T),

2. plus_{Γ}(T →S) = plus_{Γ}(T)→plus_{Γ}(S),

3. plus_{Γ}(∀X≤T:K.S) = ∀X≤plus_{Γ}(T):K.plus_{Γ,X≤T:K}(S), 4. plus_{Γ}(ΛX:K.S) = ΛX:K.plus_{Γ,X:K}(S),

5. plus_{Γ}(S T) = plus_{Γ}(S) plus_{Γ}(T),

6. plus_{Γ}(⋀^{K}[S_{1}..S_{n}]) = ⋀^{K}[plus_{Γ}(S_{1})..plus_{Γ}(S_{n})].

Example 3.5.6 plus_{X≤⊤^{⋆}:⋆, Y ≤X:⋆, Z≤Y:⋆}(Z) = Z + Y + X + ⊤^{⋆}.

We need to show that plus is well defined on well kinded arguments.

Lemma 3.5.7 (Well-foundedness of plus)

If Γ ⊢ T ∈ K, then plus_{Γ}(T) is defined.

Proof: Observe that the size_{j} of the kinding judgements of the arguments strictly decreases in each recursive call. Consider

rank(plus_{Γ}(S)) = size_{j}(Γ ⊢ S ∈ kind(Γ, S)),

where size_{j}(Γ ⊢ S ∈ K) is the size of the derivation of the kinding judgement (see definition 2.4.8). The function kind can be defined straightforwardly using proposition 2.4.6, such that kind(Γ, S) = K if Γ ⊢ S ∈ K, and gives a constant NoKind otherwise. Moreover, lemma 2.4.9 implies that the function kind is total. Given that Γ ⊢ S ∈ K, by lemmas 2.4.2(1) and 2.4.6, the rank decreases in each recursive call and the least value is that of size(⊢ ⊤^{K} ∈ K). □

Lemma 3.5.8 If Γ ⊢ T ∈ K, then Γ ⊢_{+} plus_{Γ}(T) ∈ K.

Proof: By induction on the derivation of Γ ⊢ T ∈ K, observing that Γ ⊢ T ∈ K implies Γ ⊢_{+} T ∈ K. It is straightforward to verify that ⊢_{+} satisfies weakening (see lemma 2.4.4). We consider here the case for K-TVar, the rest follows by straightforward induction. We are given, Γ_{1}, X ≤ T:K, Γ_{2} ⊢ ok. By lemma 2.4.2, there is a proper subderivation of Γ_{1} ⊢ T ∈ K. Finally, the result follows by the induction hypothesis, weakening, and K-Plus. □

Lemma 3.5.9 (Strengthening for plus)

1. Let X ∉ FTV(Γ_{2}) ∪ FTV(S). Then Γ_{1}, X≤T_{X}:K_{X}, Γ_{2} ⊢ S ∈ K implies plus_{Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}}(S) = plus_{Γ_{1}, Γ_{2}}(S).

2. Γ_{1}, x:T , Γ_{2} ⊢ S ∈ K implies plus_{Γ_{1}, x:T , Γ_{2}}(S) = plus_{Γ_{1}, Γ_{2}}(S).

Proof:

1. By lemma 3.5.7, plus_{Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}}(S) is defined, therefore we can reason by induction on the number of unfolding steps of plus. We proceed by case analysis on the form of S.

S ≡ Y. We have to consider two cases.

(a) Γ_{1} ≡ Δ_{1}, Y ≤T_{1}:K_{1}, Δ_{2}. Then, by definition,

plus_{Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}}(Y) = Y + plus_{Δ_{1}}(T_{1}). On the other hand, also by the definition of plus,

plus_{Γ_{1}, Γ_{2}}(Y) = Y + plus_{Δ_{1}}(T_{1}).

(b) Γ_{2} ≡ Δ_{1}, Y ≤T_{1}:K_{1}, Δ_{2}. By the definition of plus,

plus_{Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}}(Y) = Y + plus_{Γ_{1}, X≤T_{X}:K_{X}, Δ_{1}}(T_{1}). By lemma 2.4.1,

Γ_{1}, X≤T_{X}:K_{X}, Γ_{2} ⊢ ok, and, by lemma 2.4.2(1),

Γ_{1}, X≤T_{X}:K_{X}, Δ_{1} ⊢ T_{1} ∈ K_{1}. Moreover, since X ∉ FTV(Γ_{2}), it follows that X ∉ FTV(Δ_{1}) ∪ FTV(T_{1}). Then, applying the induction hypothesis we obtain

Y + plus_{Γ_{1}, X≤T_{X}:K_{X}, Δ_{1}}(T_{1}) = Y + plus_{Γ_{1}, Δ_{1}}(T_{1}), and the result follows by the definition of plus.

S ≡ ∀Y ≤T_{1}:K_{1}.T_{2}. By the definition of plus,

plus_{Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}}(∀Y ≤T_{1}:K_{1}.T_{2}) = ∀Y ≤plus_{Γ_{1}, ≤T_{X}:K_{X}, Γ_{2}}(T_{1}):K_{1}.plus_{Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}, Y ≤T_{1}:K_{1}}(T_{2}).

By generation for kinding (proposition 2.4.6),

Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}, Y ≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆,

and, since X ∉ FTV(Γ_{2}, Y ≤T_{1}:K_{1}) ∪ FTV(T_{2}), by the induction hypothesis,

∀Y ≤plus_{Γ_{1}, ≤T_{X}:K_{X}, Γ_{2}}(T_{1}):K_{1}.plus_{Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}, Y ≤T_{1}:K_{1}}(T_{2}) = ∀Y ≤plus_{Γ_{1}, ≤T_{X}:K_{X}, Γ_{2}}(T_{1}):K_{1}.plus_{Γ_{1}, Γ_{2}, Y ≤T_{1}:K_{1}}(T_{2}).

By lemma 2.4.1,

Γ_{1}, X≤T_{X}:K_{X}, Γ_{2}, Y ≤T_{1}:K_{1} ⊢ ok,

by syntax directedness of context judgements (lemma 2.4.2(1)),

Γ_{1}, X≤T_{X}:K_{X}, Γ_{2} ⊢ T_{1} ∈ K_{1}.

Since X ∉ FTV(Γ_{2}) ∪ FTV(T_{1}), by the induction hypothesis,

∀Y ≤plus_{Γ_{1}, ≤T_{X}:K_{X}, Γ_{2}}(T_{1}):K_{1}.plus_{Γ_{1}, Γ_{2}, Y ≤T_{1}:K_{1}}(T_{2}) = ∀Y ≤plus_{Γ_{1}, Γ_{2}}(T_{1}):K_{1}.plus_{Γ_{1}, Γ_{2}, Y ≤T_{1}:K_{1}}(T_{2}) = plus_{Γ_{1}, Γ_{2}}(∀Y ≤T_{1}:K_{1}.T_{2}).

For all the other cases, the result follows by straightforward application of the induction hypothesis, using generation for kinding (proposition 2.4.6).

2. the definition of plus does not depend on the assumptions of term variables. □

Lemma 3.5.10 (Weakening for plus) If Γ′ ⊢ ok, Γ ⊆ Γ′, and Γ ⊢ S ∈ K, then plus_{Γ}(S) = plus_{Γ′}(S).

Proof: The assumptions ensure that plus_{Γ}(S) is defined, so we can proceed by induction on the number of unfolding steps of the definition of plus. We proceed by case analysis on the form of S.

S ≡ X. By generation for kinding (proposition 2.4.6) and the fact that Γ ⊆ Γ′,

Γ ≡ Γ_{1}, X≤T:K, Γ_{2} and
Γ′ ≡ Γ′_{1}, X≤T:K, Γ′_{2}.

There are two cases to consider.

1. If Γ_{1} ≡ Γ′_{1}, then the result follows by the definition of plus.

2. If Γ_{1} ≢ Γ′_{1}, then Γ_{1} ⊆ Γ′_{1} ∪ Γ′_{2}. By the definition of plus,

plus_{Γ}(X) = X + plus_{Γ_{1}}(T).

By lemmas 2.4.1 and 2.4.2(1), it follows that Γ_{1} ⊢ T ∈ K. Hence, by the induction hypothesis,

X + plus_{Γ_{1}}(T) = X + plus_{Γ′}(T).

Since Γ′ ⊢ ok, from lemma 2.4.2(1), it follows that Γ′_{1} ⊢ T ∈ K. Consequently, ({X} ∪ FTV(Γ′_{2})) ∩ FTV(T) = ∅ by the free variables lemma (lemma 2.4.3). Hence, starting from the last declaration in Γ′_{2}, we can iterate the strengthening lemma for plus (lemma 3.5.9 items 1 and 2) to obtain

X + plus_{Γ′}(T) = X + plus_{Γ′_{1}}(T) = plus_{Γ′}(X).

S ≡ ∀X≤T_{1}:K_{1}.T_{2}. By the definition of plus,

plus_{Γ}(∀X≤T_{1}:K_{1}.T_{2}) = ∀X≤plus_{Γ}(T_{1}):K_{1}.plus_{Γ, X≤T_{1}:K_{1}}(T_{2}).

By generation for kinding (proposition 2.4.6) and lemmas 2.4.1 and 2.4.2(1), it follows that Γ ⊢ T_{1} ∈ K_{1}. Then, by the induction hypothesis,

∀X≤plus_{Γ}(T_{1}):K_{1}.plus_{Γ, X≤T_{1}:K_{1}}(T_{2}) = ∀X≤plus_{Γ′}(T_{1}):K_{1}.plus_{Γ, X≤T_{1}:K_{1}}(T_{2}).

By generation for kinding, Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆. By weakening for kinding (lemma 2.4.4), Γ′ ⊢ T_{1} ∈ K_{1}, and, by C-TVar, Γ′, X≤T_{1}:K_{1} ⊢ ok. Applying again the induction hypothesis, it follows that

∀X≤plus_{Γ′}(T_{1}):K_{1}.plus_{Γ, X≤T_{1}:K_{1}}(T_{2})
= ∀X≤plus_{Γ′}(T_{1}):K_{1}.plus_{Γ′, X≤T_{1}:K_{1}}(T_{2})
= plus_{Γ′}(∀X≤T_{1}:K_{1}.T_{2}).

S ≡ ΛX:K.T. By the definition of plus,

plus_{Γ}(ΛX:K.T) = ΛX:K.plus_{Γ, X:K}(T).

By K-Meet, it follows that Γ′ ⊢ ⊤^{K} ∈ K, and, by C-TVar, Γ′, X≤⊤^{K}:K ⊢ ok. Finally, the result follows by the induction hypothesis.

In all other cases, the proof follows by straightforward application of the induction hypothesis. □

The operation plus does not have the usual properties under substitution; as following example shows, the equality

plus_{Γ_{1}, X≤S:K_{1}, Γ_{2}}(T_{2})[X←plus_{Γ_{1}}(T_{1})] = plus_{Γ_{1}, Γ_{2}[X←T_{1}]}(T_{2}[X←T_{1}])

does not hold in general.

Example 3.5.11 Consider the case where Γ_{1} ≡ Y ≤⊤^{⋆}:⋆, Γ_{2} ≡ ∅, S ≡ Y, T_{1} ≡ Y, and T_{2} ≡ X. Then

plus_{Y ≤⊤^{⋆}:⋆, X≤Y:⋆}(X)[X←plus_{Y ≤⊤^{⋆}:⋆}(Y)] = (X + Y + ⊤^{⋆})[X←(Y + ⊤^{⋆})]
= Y + ⊤^{⋆} + Y + ⊤^{⋆}.

On the other hand,

plus_{Y ≤⊤^{⋆}:⋆}(X[X←Y]) = plus_{Y ≤⊤^{⋆}:⋆}(Y) = Y + ⊤^{⋆}.

We therefore need a lemma which says that the well-typed types are wellbehaved under substitution with respect to the plus operation.

Lemma 3.5.12 (Substitution for plus) If Γ_{1}, X≤S:K_{1}, Γ_{2} ⊢ T_{2} ∈ K_{2} and Γ_{1} ⊢ T_{1} ∈ K_{1}, then

plus_{Γ_{1}, X≤S:K_{1}, Γ_{2}}(T_{2})[X←plus_{Γ_{1}}(T_{1})] ↠_{β∧+} plus_{Γ_{1}, Γ_{2}[X←T_{1}]}(T_{2}[X←T_{1}]).

Proof: By induction on the size of the derivation of Γ_{1}, X≤S:K_{1}, Γ_{2} ⊢ T_{2} ∈ K_{2}. We proceed by case analysis on the form of T_{2}.

T_{2} ≡ Y. By the free variables lemma (lemma 2.4.3), Y ∈dom(Γ_{1}, X≤S:K_{1}, Γ_{2}). Then there are three cases to consider.

Y ∈dom(Γ_{1}). Let Γ_{1} ≡ Δ_{1}, Y ≤U:K, Δ_{2}. Then

plus_{Γ_{1}, X≤S:K_{1}, Γ_{2}}(Y)[X←plus_{Γ_{1}}(T_{1})],

by the definitions of plus and substitution, = Y + (plus_{Δ_{1}}(U)[X←plus_{Γ_{1}}(T_{1})])

since X ∉ FTV(U) ∪ FTV(Δ_{1}), X ∉ FTV(plus_{Δ_{1}}(U)).

= Y + plus_{Δ_{1}}(U),
= plus_{Γ_{1}, Γ_{2}[X←T_{1}]}(Y [X←T_{1}]).

Y ≡ X. Then

plus_{Γ_{1}, X≤S:K_{1}, Γ_{2}}(X)[X←plus_{Γ_{1}}(T_{1})],

by the definitions of plus and substitution, = plus_{Γ_{1}}(T_{1}) + (plus_{Δ_{1}}(U)[X←plus_{Γ_{1}}(T_{1})]), →_{+} plus_{Γ_{1}}(T_{1}). On the other hand, plus_{Γ_{1}, Γ_{2}[X←T_{1}]}(X[X←T_{1}]) = plus_{Γ_{1}, Γ_{2}[X←T_{1}]}(T_{1}),

since FTV(T_{1}) ∪ dom(Γ_{1}), by strengthening for plus(3.5.9), = plus_{Γ_{1}}(T_{1}).

Y ∈dom(Γ_{2}). Let Γ_{2} ≡ Δ_{1}, Y ≤U:K, Δ_{2}. Then

plus_{Γ_{1}, X≤S:K_{1}, Γ_{2}}(Y)[X←plus_{Γ_{1}}(T_{1})],

by the definitions of plus and substitution, = Y + (plus_{Γ_{1}, X≤S:K_{1}, Δ_{1}}(U)[X←plus_{Γ_{1}}(T_{1})]),

by generation (2.4.6) and the induction hypothesis, →_{β∧+} Y + plus_{Γ_{1}, Δ_{1}[X←T_{1}]}(U[X←T_{1}]), = plus_{Γ_{1}, Γ_{2}[X←T_{1}]}(Y [X←T_{1}]).

T_{2} ≡ ∀Y ≤S_{1}:K.S_{2}. Let Γ ≡ Γ_{1}, X≤S:K_{1}, Γ_{2}. Then

plus_{Γ}(∀Y ≤S_{1}:K.S_{2})[X←plus_{Γ_{1}}(T_{1})],

by the definitions of plus and substitution, = ∀Y ≤plus_{Γ}(S_{1})[X←plus_{Γ_{1}}(T_{1})]:K.plus_{Γ, Y ≤S_{1}:K}(S_{2})[X←plus_{Γ_{1}}(T_{1})],

by generation (proposition 2.4.6) and the induction hypothesis, →_{β∧+} ∀Y ≤plus_{Γ_{1}, Γ_{2}[X←T_{1}]}(S_{1}[X←T_{1}]):K.

plus_{Γ_{1}, Γ_{2}[X←T_{1}], Y ≤S_{1}[X←T_{1}]:K}(S_{2}[X←T_{1}])

by the definitions of plus and substitution, = plus_{Γ_{1}, Γ_{2}[X←T_{1}]}((∀Y ≤S_{1}:K.S_{2})[X←T_{1}]).

Other cases. All the other cases are similar to the case T_{2} ≡ ∀Y ≤S_{1}:K.S_{2}. □

Lemma 3.5.13 (Monotonicity of plus with respect to →_{β∧}) If Γ ⊢ T ∈ K, then

1. Γ →_{β∧} Γ′ implies plus_{Γ}(T) ↠_{β∧+} plus_{Γ′}(T).

2. T →_{β∧} T′ implies plus_{Γ}(T) ↠_{β∧+}^{>0} plus_{Γ}(T′).

Proof: By simultaneous induction on the size of the derivation of Γ ⊢ T ∈ K. We proceed by case analysis on the form of T.

1. Γ →_{β∧} Γ′.

T ≡ X. Let Γ ≡ Γ_{1}, X≤S:K_{1}, Γ_{2}. Then we have to consider three cases.

(a) Γ_{1} →_{β∧} Γ′_{1}. Then

plus_{Γ}(X) = X + plus_{Γ_{1}}(S)

by lemma 2.4.2 and part (1) of the induction hypothesis, ↠_{β∧} X + plus_{Γ′_{1}}(S) = plus_{Γ′_{1}}(X).

(b) S →_{β∧} S′. By lemma 2.4.2 and part (2) of the induction hypothesis.

(c) Γ_{2} →_{β∧} Γ′_{2}. By the definition of plus.

T ≡ ∀X≤T_{1}:K_{1}.T_{2}. By generation for kinds (proposition 2.4.6), there are proper subderivations of Γ ⊢ T_{1} ∈ K_{1} and Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆. Then, by part (1) of the induction hypothesis, it follows that

plus_{Γ}(T_{1}) ↠_{β∧} plus_{Γ′}(T_{1}), and
plus_{Γ, X≤T_{1}:K_{1}}(T_{2}) ↠_{β∧} plus_{Γ′, X≤T_{1}:K_{1}}(T_{2}).

The result follows by the definitions of plus and ↠_{β∧}.

Other cases. The rest of the cases are similar to the case T ≡ ∀X≤T_{1}:K_{1}.T_{2}, using generation for kinding (proposition 2.4.6) and part 1 of the induction hypothesis.

2. T →_{β∧} T′.

T ≡ ∀X≤T_{1}:K_{1}.T_{2}. We have to consider three cases.

(a) T_{1} →_{β∧} T′_{1}. By generation for kinding (proposition 2.4.6), there are proper subderivations of Γ ⊢ T_{1} ∈ K_{1} and Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆. Then, by parts (2) and (1) of the induction hypothesis respectively, it follows that

plus_{Γ}(T_{1}) ↠_{β∧}^{>0} plus_{Γ}(T′_{1}), and
plus_{Γ, X≤T_{1}:K_{1}}(T_{2}) ↠_{β∧} plus_{Γ, X≤T_{1}′:K_{1}}(T_{2}).

The result follows by the definitions of plus and ↠_{β∧}.

(b) T_{2} →_{β∧} T′_{2}. By part (2) of the induction hypothesis.

(c) ∀X≤T_{1}:K_{1}.⋀^{⋆}[S_{1}..S_{n}] →_{β∧} ⋀^{⋆}[∀X≤T_{1}:K_{1}.S_{1}..∀X≤T_{1}:K_{1}.S_{n}].

plus_{Γ}(∀X≤T_{1}:K_{1}.⋀^{⋆}[S_{1}..S_{n}])

= ∀X≤plus_{Γ}(T_{1}):K.⋀^{⋆}[plus_{Γ, X≤T_{1}:K_{1}}(S_{1})..plus_{Γ, X≤T_{1}:K_{1}}(S_{n})] →_{β∧+} ^{⋀⋆}[∀X≤plus_{Γ}(T_{1}):K.plus_{Γ, X≤T_{1}:K_{1}}(S_{1})..

..∀X≤plus_{Γ}(T_{1}):K.plus_{Γ, X≤T_{1}:K_{1}}(S_{n})] = plus_{Γ}(⋀^{⋆}[∀X≤T_{1}:K_{1}.S_{1}..∀X≤T_{1}:K_{1}.S_{n}])

T ≡ T_{1} T_{2}. We have to consider four cases.

(a) T_{1} →_{β∧} T′_{1},

(b) T_{2} →_{β∧} T′_{2},

(c) T ≡ ⋀^{⋆}[S_{1}..S_{n}] and ⋀^{⋆}[S_{1}..S_{n}]T_{2} →_{β∧} ⋀^{⋆}[S_{1} T_{2}..S_{n} T_{2}].

(d) T ≡ ΛX:K.S_{1} and (ΛX:K.S_{1}) T_{2} →_{β∧} S_{1}[X←T_{2}] Cases 2a, 2b, and 2c follow using similar arguments to those used for the case T ≡ ∀X≤T_{1}:K_{1}.T_{2}. Consider case 2d. plus_{Γ}((ΛX:K.S_{1}) T_{2}) = (ΛX:K.plus_{Γ, X≤⊤^{K}:K}(S_{1}))plus_{Γ}(T_{2})

→_{β∧} plus_{Γ, X≤⊤^{K}:K}(S_{1})[X←plus_{Γ}(T_{2})],

by lemma 3.5.12, ↠_{β∧+} plus_{Γ}(S_{1}[X←T_{2}]).

Other cases. The rest of the cases follows using a similar argument to the one used in the case T ≡ ∀X≤T_{1}:K_{1}.T_{2}. □

Lemma 3.5.14 Let lub_{Γ}(S) be defined and Γ ⊢ S ∈ K. Then plus_{Γ}(S) ↠_{+}^{>0} plus_{Γ}(lub_{Γ}(S)).

Proof: By induction on the structure of S. Since lub_{Γ}(S) is defined, it is enough to consider the following two cases.

S ≡ X. Let Γ ≡ Γ_{1}, X ≤ T:K, Γ_{2}.

plus_{Γ}(X) = X + plus_{Γ_{1}}(T)
= X + plus_{Γ}(T)  by weakening (lemma 3.5.10),
→_{+} plus_{Γ}(T)
= plus_{Γ}(lub_{Γ}(X))

S ≡ A T. By the induction hypothesis. □

Our measure to show the well-foundedness of AlgF_{∧}^{ω} considers the β∧+-reduction paths of the plus versions of the types in the subtyping judgements. As we mentioned before, in AlgS-TVar and AlgS-OApp the types appearing in the hypothesis may be larger than those in their conclusions. Therefore, the well foundedness of the AlgF_{∧}^{ω} relation is not immediate. The next corollary gathers the previous results to serve our purposes.

Corollary 3.5.15

1. If Γ ⊢ X ∈ K, then plus_{Γ}(X) ↠_{β∧+}^{>0} plus_{Γ}(Γ(X)).

2. If Γ ⊢ A T ∈ K then plus_{Γ}(A T) ↠_{β∧+}^{>0} plus_{Γ}(lub_{Γ}(A T)^{nf}).

Proof: Item 1 is a particular case of the previous lemma (lemma 3.5.14), and item 2 is a consequence of lemma 3.5.14 and the monotonicity of plus with respect to →_{β∧+} (3.5.13(2)). □

Finally, we can define our measure.

Definition 3.5.16 (Weight)

1. weight(Γ ⊢_{Alg} S ≤ T) = <max-red(plus_{Γ}(S)) + max-red(plus_{Γ}(T), size_{j}(Γ ⊢ S ≤ T))>,

2. weight(Γ ⊢ T ∈ K) = <0, 0>,

where max-red(S) is the length of a maximal β∧+-reduction path starting from S, and size_{j} is defined in definition 2.4.8.

Pairs are ordered lexicographically. Note that <0, 0> is the least weight.

Proposition 3.5.17 (Well-foundedness of AlgF_{∧}^{ω}) If \begin{aligned}J_{1} & .. & J_{n} \\ & J \end{aligned} is an AlgF_{∧}^{ω} rule,

then weight(J_{i}) < weight(J), for each i∈{1..n}.

Proof: By inspection of the rules of AlgF_{∧}^{ω}. □ Finally, we can state our main result.

Theorem 3.5.18 (Decidability of subtyping in F_{∧}^{ω})

For any context Γ and for any two types S and T, it is decidable whether Γ ⊢ S ≤ T.

3.6 Our decidability proof and full F_{≤}

In the introduction to chapter 2 we mentioned that subtyping in F_{≤}, a secondorder λ-calculus with bounded quantification defined by Curien and Ghelli in 1989, is undecidable. A question that comes to mind is: if we try to apply our proof of the decidability of subtyping in F_{∧}^{ω} to F_{≤}, where will it fail?

If we consider the algorithm for the subtyping relation in [Ghe90], the place where our proof does not go through is when we try to prove that the algorithm terminates by calculating the maximal length of the plus versions of the types in the rule for subtyping quantified types. Remember that the subtyping rule for quantified types in full F_{≤} is:

\frac{Γ ⊢ T_{1} ≤ S_{1} Γ, X≤T_{1} ⊢ S_{2} ≤ T_{2}}{Γ ⊢ ∀X≤S_{1}. S_{2} ≤ ∀X≤T_{1}. T_{2}}  (F_{≤}- S-All)

Consider now the following case.

\begin{aligned}Γ & ≡ & Y_{4}≤⊤^{⋆}, Y_{3}≤Y_{4}, Y_{2}≤Y_{3}, Y_{1}≤Y_{2}, \\ T_{1} & ≡ & Y_{1}, \\ S_{1} & ≡ & ⊤^{⋆}, \\ T_{2} & ≡ & X→X, and \\ S_{2} & ≡ & X→X. \end{aligned}

3.6. OUR DECIDABILITY PROOF AND FULL F_{≤} 67

The plus versions of the types in the subtyping statements of this example are as follows.

plus_{Γ, X≤Y_{1}}(S_{2}) ≡ (X + Y_{1} + Y_{2} + Y_{3} + Y_{4} + ⊤^{⋆})→(X + Y_{1} + Y_{2} + Y_{3} + Y_{4} + ⊤^{⋆}) plus_{Γ, X≤Y_{1}}(T_{2}) ≡ (X + Y_{1} + Y_{2} + Y_{3} + Y_{4} + ⊤^{⋆})→(X + Y_{1} + Y_{2} + Y_{3} + Y_{4} + ⊤^{⋆}) plus_{Γ}(∀X≤S_{1}. S_{2}) ≡ ∀X≤⊤^{⋆}. (X + ⊤^{⋆})→(X + ⊤^{⋆}) plus_{Γ}(∀X≤T_{1}. T_{2}) ≡ ∀X≤Y_{1} + Y_{2} + Y_{3} + Y_{4} + ⊤^{⋆}.

(X + Y_{1} + Y_{2} + Y_{3} + Y_{4} + ⊤^{⋆})→(X + Y_{1} + Y_{2} + Y_{3} + Y_{4} + ⊤^{⋆})

The length of a maximal +-reduction in each case is:

max-red(plus_{Γ, X≤Y_{1}}(S_{2}))  = 10
max-red(plus_{Γ, X≤Y_{1}}(T_{2}))  = 10
max-red(plus_{Γ}(∀X≤S_{1}. S_{2})) = 2
max-red(plus_{Γ}(∀X≤T_{1}. T_{2})) = 14.

The weight of the conclusion Γ ⊢ ∀X≤S_{1}. S_{2} ≤ ∀X≤T_{1}. T_{2}, as defined in definition 3.5.16, is smaller than the weight of the hypothesis Γ, X≤T_{1} ⊢ S_{2} ≤ T_{2}, because the maximal length of a +-reduction starting from the plus version of the conclusion is shorter than the maximal length of a +-reduction starting from the plus version of that hypothesis. To be more precise,

max-red(plus_{Γ}(∀X≤S_{1}. S_{2})) + max-red(plus_{Γ}(∀X≤T_{1}. T_{2}))
<
max-red(plus_{Γ, X≤Y_{1}}(S_{2})) + max-red(plus_{Γ, X≤Y_{1}}(T_{2})).

68 CHAPTER 3. DECIDABILITY OF SUBTYPING IN F_{∧}^{ω}

Typing in F_{∧}^{ω}

4.1 Type checking and type inference

Given a context Γ, a term e, and a type T, type checking consists of analyzing whether the judgement Γ ⊢ e ∈ T is derivable from a given set of inference rules. Type checking algorithms for lambda calculi, unless they are formulated using Gentzen’s sequent calculus style, involve guessing the type of subterms. For example, when e is e_{1} e_{2}, the type of e_{2} is not necessarily a subexpression of T, and in order to corroborate or to refute the assertion Γ ⊢ e ∈ T we need to infer a type for e_{2}.

In this section, we present an algorithm for inferring minimal types in F_{∧}^{ω}. Given Γ and e, the type S constructed by the algorithm is a subtype of every T such that Γ ⊢ e ∈ T. In this way, we reduce the problem of whether Γ ⊢ e ∈ T to that of inferring a type S such that Γ ⊢ e ∈ S and Γ ⊢ S ≤ T. Solving this problem involves not only the typing rules but all the inference rules of F_{∧}^{ω}: the rule T-Subsumption depends on a subtyping judgement, the rule T-Var depends on an ok judgement, and the ok judgements depend on kinding judgements. Consequently, type checking uses the full power of the F_{∧}^{ω} system.

As an example, consider type checking the following judgement:

Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ f a ∈ T_{2}.

The application f a can only be formed if f has an arrow type. Using T-Var we can assign type X to f, which means that in order to obtain an arrow type for f we have to replace X by its bound, which has the right form. Observe how this replacement is performed by T-Subsumption in the following derivation.

\begin{matrix}Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ ok \\ Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ f ∈ X \end{matrix} \begin{matrix}Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ ok \\ Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ X ≤ T_{1}→T_{2} \end{matrix}
\overline{T-Sub}

Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ f ∈ T_{1}→T_{2}

Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ f ∈ T_{1}→T_{2} \begin{matrix}Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ ok \\ Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ a ∈ T_{1} \end{matrix}
\overline{T-App}

Γ, X ≤ T_{1}→T_{2}, f:X, a:T_{1} ⊢ f a ∈ T_{2}

70 CHAPTER 4. TYPING IN F_{∧}^{ω}

Note that, in the presence of T-Subsumption, we may actually perform the application when the type of a is a subtype of T_{1}. Namely, if

Γ, X ≤ T_{1}→T_{2}, f:X, a:U_{1} ⊢ a ∈ U_{1} Γ, X ≤ T_{1}→T_{2}, f:X, a:U_{1} ⊢ U_{1} ≤ T_{1}

\overline{T-Sub}

Γ, X ≤ T_{1}→T_{2}, f:X, a:U_{1} ⊢ a ∈ T_{1}

Moreover, we may want to check whether

Γ, X ≤ T_{1}→T_{2}, f:X, a:U_{1} ⊢ f a ∈ U_{2},

where T_{2} is a subtype of U_{2}.

The situation gets more complicated if f has an intersection type. Suppose that

Γ, X ≤ T_{1}→T_{2}, Y ≤ S_{1}→S_{2}, f:X ∧ Y ∧ ∀Z≤V_{1}:K.V_{2}, a:U_{1} ⊢ f a ∈ U_{2},

where U_{1} is a subtype of T_{1} and S_{1}. An algorithm should not consider the type ∀Z≤V_{1}:K.V_{2} for f since, in this case, f is applied to a term and not to a type. Then it has to replace X and Y by their bounds, T_{1}→T_{2} and S_{1}→S_{2}. Moreover, given that the type of a, U_{1}, is a subtype of both S_{1} and T_{1}, it should check whether S_{2} ∧ T_{2} is a subtype of U_{2}.

Another source of problems in the search for an algorithmic presentation of the typing rules is that types may not be in normal form. Consider the judgement

Γ, X ≤ T_{1}→T_{2}, Z ≤ ΛY: ⋆ .Y , f:Z X, a:T_{1} ⊢ f a ∈ T_{2}, (4.1)

In order to type the application, f should be assigned type T_{1}→T_{2}. To do that, Z should be replaced by its bound in Z X. This replacement produces a type which is not in normal form, so ΛY: ⋆ .Y X has to be normalised to obtain X. Finally, X is replaced by its bound and then the application can be typed.

The main new source of difficulty is the interaction between the need for normalization and the presence of intersection types.

An algorithm to infer types should proceed structurally on the form of the term whose type is to be inferred. This requires us to remove the rules which make our typing rules non-deterministic: we should eliminate T-Subsumption and T-Meet from the original presentation, and modify the other rules in such a way that we can still type the same set of terms.

We give some preliminary definitions and results before presenting the rules of our new system:

• We define the mapping flub, which performs the “replacements” which we motivated with the previous examples.

• We define the function arrows, to filter arrow types in order to deal with term application.

• We define the function alls to filter polymorphic types to deal with type application.

The function lub (definition 3.1.3) is a partial function which is only defined for type variables and type applications. Here, we extend the definition of lub to intersection types in such a way that it is defined if the least upper bound is defined for at least one of the types in the intersection.

Definition 4.1.1 (Homomorphic extension of lub to intersections, lub^{∗})

lub_{Γ}^{∗}(X) = Γ(X),
lub_{Γ}^{∗}(S T) = lub_{Γ}^{∗}(S) T,
lub_{Γ}^{∗}(⋀^{K}[T_{1}..T_{n}]) = ⋀^{K}[T′_{1}..T′_{n}], if ∃i∈{1..n} such that lub_{Γ}^{∗}(T_{i})↓,

where T′_{i} is lub_{Γ}^{∗}(T_{i}), if lub_{Γ}^{∗}(T_{i})↓, and T_{i} otherwise.

Lemma 4.1.2 If lub_{Γ}^{∗}(T) is defined, then Γ ⊢ T ≤ lub_{Γ}^{∗}(T).

Proof: By induction on the complexity of T, using corollary 2.4.15. □

Lemma 4.1.3 Let lub_{Γ}^{∗}(T) be defined and Γ ⊢ T ∈ K. Then plus_{Γ}(T) ↠_{β∧+}^{>0} plus_{Γ}(lub_{Γ}^{∗}(T)).

Proof: The proof follows by induction on the structure of T. If T ≡ X or T ≡ S T, then the argument is the same as in lemma 3.5.14. The case remaining to be checked is when T ≡ ⋀^{K}[T_{1}..T_{n}]. Then

plus_{Γ}(⋀^{K}[T_{1}..T_{n}]) = ⋀^{K}[plus_{Γ}(T_{1})..plus_{Γ}(T_{n})]
plus_{Γ}(lub_{Γ}^{∗}(⋀^{K}[T_{1}..T_{n}])) = ⋀^{K}[plus_{Γ}(T′_{1})..plus_{Γ}(T′_{n})],

where T′_{1} ≡ T_{i} or T′_{i} = lub_{Γ}^{∗}(T_{i}). Since lub_{Γ}^{∗}(T) is defined, there exists j∈{1..n} such that lub_{Γ}^{∗}(T_{j}) is defined. Now, for every k such that lub_{Γ}^{∗}(T_{k}) is defined, by the induction hypothesis, we have that

plus_{Γ}(T_{k}) ↠_{β∧+}^{>0} plus_{Γ}(lub_{Γ}^{∗}(T_{k})).

Hence,

plus_{Γ}(⋀^{K}[T_{1}..T_{n}]) ↠_{β∧+}^{>0} plus_{Γ}(lub_{Γ}^{∗}(⋀^{K}[T_{1}..T_{n}])).  □

We define the mapping flub which given a type T (and a context Γ) finds the smallest type larger than T (with respect to the subtype relation) having structural information to perform an application.

Definition 4.1.4 (Functional Least Upper Bound) The functional least upper bound of a type T, in a context Γ, flub_{Γ}(T) is defined as follows.

flub_{Γ}(T) = \{ \begin{matrix}flub_{Γ}(lub_{Γ}^{∗}(T^{nf})), & if lub_{Γ}^{∗}(T^{nf})↓; \\ T^{nf}, & otherwise.^{1} \end{matrix}

The intuition behind the definition of the function flub is to find T_{1}→T_{2} starting form ZX in the example 4.1 above. In other words, flub_{Γ}(Z X) = T_{1}→T_{2}. For simplicity we assume T_{1}→T_{2} in normal form. Step by step,

flub_{Γ}(Z X) = flub_{Γ}(lub_{Γ}^{∗}(Z X))
= flub_{Γ}((ΛY:K.Y) X)
= flub_{Γ}(lub_{Γ}^{∗}(((ΛY:K.Y) X)^{nf}))
= flub_{Γ}(lub_{Γ}^{∗}(X))
= flub_{Γ}(T_{1}→T_{2})
= T_{1}→T_{2}.

More generally, flub climbs the subtyping hierarchy until it finds an arrow, a quantifier, or an intersection of these two. To show that flub is well-defined we use a similar argument to that used in section 3.5 to show that the relation defined by AlgF_{∧}^{ω} is well-founded. We show in lemma 4.1.5 that a maximal β∧+-reduction path of the plus version of the argument of flub is strictly longer than a maximal β∧+-reduction path of the plus version of the argument of its recursive call.

Lemma 4.1.5 (Well-foundedness of flub)

If Γ ⊢ T ∈ K, then flub_{Γ}(T) is defined.

Proof: If lub_{Γ}^{∗}(T^{nf}) is undefined, flub terminates because →_{β∧} is strongly normalizing on well kinded types. Otherwise, define

weight(flub_{Γ}(T)) = max-red(plus_{Γ}(T)), where max-red(S) is the length of a maximal β∧+-reduction path starting from S. Lemma 3.5.8 and the strong normalization property of →_{β∧+} imply that weight is well defined and always positive on well kinded types. Since lub_{Γ}^{∗}(T^{nf}) is defined,

plus_{Γ}(T) ↠_{β∧+} plus_{Γ}(T^{nf}),  by lemma 3.5.13(2),
↠_{β∧+}^{>0} plus_{Γ}(lub_{Γ}^{∗}(T^{nf})), by lemma 4.1.3.

Then the weight of the arguments of flub reduces in each recursive call, which proves that flub is well-founded. □

Lemma 4.1.6 Let Γ ⊢ S, T ∈ ⋆ and S =_{β∧} T. Then flub_{Γ}(S) ≡ flub_{Γ}(T).

Definition 4.1.7 (arrows and alls )

1. arrows (T_{1}→T_{2})  = {T_{1}→T_{2}},

arrows (⋀^{⋆}[T_{1}..T_{n}]) = ∪_{i∈{1..n}} arrows (T_{i}),
arrows (T)  = ∅, if T ≢ T_{1}→T_{2} and T ≢ ⋀^{⋆}[T_{1}..T_{n}].

1This step can be optimised in an implementation of the type checking algorithm, allowing us to avoid the normalization of T when T is either an arrow type or a quantified type.

2. alls (∀X≤T_{1}:K.T_{2}) = {∀X≤T_{1}:K.T_{2}},

alls (⋀^{⋆}[T_{1}..T_{n}])  = ∪_{i∈{1..n}} alls (T_{i}),
alls (T)  = ∅, if T ≢ ∀X≤T_{1}:K.T_{2} and T ≢ ⋀^{⋆}[T_{1}..T_{n}].

The situation here is significantly more complex than in [Pie91] for F_{∧}, an extension of the second order λ-calculus. There it is enough to recursively search for arrows or polymorphic types in the context, because in F_{∧} there is no reduction on types. The information to be searched for is explicit in the context, so the job done here by flub is simply an extra case in the definition of arrows and alls . Namely,

arrows (X) = arrows (Γ(X)) and
alls (X) = alls (Γ(X)).

Moreover, to prove that flub is well-founded is similar for us in complexity to proving termination of subtype checking. The similarity comes from the fact that computing flub involves replacing variables by their bounds in a given context and normalizing with respect to →_{β∧}, as in lemma 4.1.5. In contrast, in [Pie91] it is enough to observe that well-formed contexts cannot contain cycles of variable references.

Notation 4.1.8 We introduce a new notation for intersection types. We write ⋀^{K}[T | ϕ(T)], meaning the intersection of all types T such that ϕ(T) holds. Note that this is an alternative notation to ⋀^{K}[T_{1}..T_{n}] such that ϕ(T_{i}) holds if and only if i∈{1..n}.

We can now define a type inference algorithm for F_{∧}^{ω}.

Definition 4.1.9 (A type inference algorithm, inf)

\frac{Γ_{1}, x:T , Γ_{2} ⊢ ok}{Γ_{1}, x:T , Γ_{2} ⊢_{inf} x ∈ T}  (AT-Var)

\frac{Γ, x:T_{1} ⊢_{inf} e ∈ T_{2}}{Γ ⊢_{inf} λx:T_{1}.e ∈ T_{1}→T_{2}}  (AT-Abs)

\frac{Γ ⊢_{inf} f ∈ T  Γ ⊢_{inf} a ∈ S}{Γ ⊢_{inf} f a ∈ ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}]}  (AT-App)

\frac{Γ, X≤T_{1}:K_{1} ⊢_{inf} e ∈ T_{2}}{Γ ⊢_{inf} λX≤T_{1}:K_{1}.e ∈ ∀X≤T_{1}:K_{1}.T_{2}}  (AT-TAbs)

\frac{Γ ⊢_{inf} f ∈ T}{Γ ⊢_{inf} f S ∈ ⋀^{⋆}[T_{i}[X←S] | ∀X≤S_{i}:K.T_{i} ∈ alls (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}]}

(AT-TApp)

\frac{for all i∈\{1..n\} Γ ⊢_{inf} e[X←S_{i}] ∈ T_{i}}{Γ ⊢_{inf} for(X∈S_{1}..S_{n})e ∈ ⋀^{⋆}[T_{1}..T_{n}]}  (AT-For)

The algorithmic information of rule AT-App is that in order to find a type for f a in Γ, we need to infer a type S for a and a type T for f, and to take the intersection of all the T′_{i}s such that T_{i}→S_{i} ∈ arrows (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}.

4.2 Minimal typing

In this section we show that F_{∧}^{ω} satisfies the minimal typing property (theorem 4.2.11). We first prove that the algorithm inf is sound with respect to F_{∧}^{ω}: if Γ ⊢_{inf} e ∈ T, then Γ ⊢ e ∈ T (proposition 4.2.4). We then prove that every closed term is typeable using either set of typing rules (lemma 4.2.8). Finally, we prove that inf computes minimal types for F_{∧}^{ω} terms (proposition 4.2.10).

Lemma 4.2.1 Let Γ ⊢ T ∈ ⋆. Then Γ ⊢ T ≤ flub_{Γ}(T).

Proof: Since flub is well-founded, we can proceed by induction on the number of unfolding steps in flub_{Γ}(T). If flub_{Γ}(T) = T^{nf}, the result follows by S-Conv. Otherwise, flub_{Γ}(T) = flub_{Γ}(lub_{Γ}^{∗}(T^{nf})). By S-Conv,

Γ ⊢ T ≤ T^{nf}.

By lemma 4.1.2,

Γ ⊢ T^{nf} ≤ lub_{Γ}^{∗}(T^{nf}).

By the induction hypothesis,

Γ ⊢ lub_{Γ}^{∗}(T^{nf}) ≤ flub_{Γ}(lub_{Γ}^{∗}(T^{nf})).

Finally, by S-Trans, the result follows. □

Lemma 4.2.2 Let Γ ⊢ T ∈ ⋆. Then

1. Γ ⊢ T ≤ ⋀^{⋆}[S | S ∈ arrows (flub_{Γ}(T))].

2. Γ ⊢ T ≤ ⋀^{⋆}[S | S ∈ alls (flub_{Γ}(T))].

Proof:

1. Using lemma 4.2.1, we reduce our problem to proving that

Γ ⊢ T ≤ ⋀^{⋆}[S | S ∈ arrows (T)],

which follows by induction on the structure of T.

2. Similar to 1. □

Lemma 4.2.3

1. If Γ ⊢ T ≤ T_{1}→T_{2}, then Γ ⊢ ⋀^{⋆}[S | S∈arrows (flub_{Γ}(T))] ≤ T_{1}→T_{2}.

2. If Γ ⊢ T ≤ ∀X≤T_{1}:K.T_{2}, then Γ ⊢ ⋀^{⋆}[S | S∈alls (flub_{Γ}(T))] ≤ ∀X≤T_{1}:K.T_{2}.

Proof:

1. By induction on the derivation of Γ ⊢ T ≤ T_{1}→T_{2}. The last rule of a derivation of this subtyping statement can only be S-Conv, S-TVar, S-Trans, or S-Meet-LB. The first three cases use similar arguments, therefore we consider here only the cases for S-Conv and S-Meet-LB.

S-Conv We are given that T =_{β∧} T_{1}→T_{2}. By lemma 4.1.6 and the definition of flub, we have that

arrows (flub_{Γ}(T)) = arrows (flub_{Γ}(T_{1}→T_{2})),
= arrows ((T_{1}→T_{2})^{nf})

We now have two cases to analyze.

(a) If (T_{1}→T_{2})^{nf} = T_{1}^{nf}→T_{2}^{nf}, then the result follows by S-Meet-LB

and S-Conv.

(b) Otherwise, let (T_{1}→T_{2})^{nf} = ⋀^{⋆}[T_{1}^{nf}→U_{1}..T_{1}^{nf}→U_{n}], where T_{2}^{nf} =

⋀^{⋆}[U_{1}..U_{n}]. Then,

arrows (flub_{Γ}(T)) = {T_{1}^{nf}→U_{1}..T_{1}^{nf}→U_{n}}.

Consequently,

⋀^{⋆}[S | S ∈ arrows (flub_{Γ}(T))] = (T_{1}→T_{2})^{nf}, and the result follows by S-Conv.

S-Meet-LB We are given that

Γ ⊢ ⋀^{⋆}[S_{1}..T_{1}→T_{2}..S_{n}] ≤ T_{1}→T_{2}.

By the definition of flub,

flub_{Γ}(⋀^{⋆}[S_{1}..T_{1}→T_{2}..S_{n}])
= ⋀^{⋆}[....T_{1}^{nf}→A_{1}..T_{1}^{nf}→A_{m}....],

where \begin{matrix}T_{2}^{nf} = ⋀^{⋆}[A_{1}..A_{m}] or \\ T_{2}^{nf} = A_{1} \end{matrix}

Now,

arrows (flub_{Γ}(⋀^{⋆}[S_{1}..T_{1}→T_{2}..S_{n}]))
⊇ {T_{1}^{nf}→A_{1}..T_{1}^{nf}→A_{m}}

Then, if T_{2}^{nf} = ⋀^{⋆}[A_{1}..A_{m}], by lemma 2.4.18; and, if T_{2}^{nf} = A_{1}, by S-Meet-LB, we have that

Γ ⊢ ⋀^{⋆}[S | S ∈ arrows (flub_{Γ}(⋀^{⋆}[S_{1}..T_{1}→T_{2}..S_{n}]))] ≤ (T_{1}→T_{2})^{nf}. Finally, the result follows by S-Conv.

2. Similar to previous item. □

Proposition 4.2.4 (Soundness of inf) If Γ ⊢_{inf} e ∈ T, then Γ ⊢ e ∈ T.

Proof: By induction on the derivation of Γ ⊢_{inf} e ∈ T. The interesting cases are when the last applied rule is either AT-App and AT-TApp.

AT-App We are given that

Γ ⊢_{inf} f a ∈ ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}]

is derived from Γ ⊢_{inf} f ∈ T and Γ ⊢_{inf} a ∈ S.

If ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}] =_{β∧} ⊤^{⋆}, then the result follows immediately using T-Meet. Otherwise, by the induction hypothesis, we have that Γ ⊢ f ∈ T. By lemma 4.2.2(1), S-Meet-LB, S-Trans, and T-Subsumption, Γ ⊢ f ∈ S_{i}→T_{i}. By the induction hypothesis and T-Subsumption, Γ ⊢ a ∈ S_{i}. By T-App, Γ ⊢ f a ∈ T_{i}. Finally, by T-Meet,

Γ ⊢ f a ∈ ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}].

AT-TApp We are given that

Γ ⊢_{inf} f S ∈
⋀^{⋆}[T_{i}[X←S] | ∀X≤S_{i}:K.T_{i} ∈ alls (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}]

is derived from Γ ⊢_{inf} f ∈ T.

If ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}] =_{β∧} ⊤^{⋆}, then the result follows immediately, using T-Meet. Otherwise, assume

alls (flub_{Γ}(T)) ≡ ⋀^{⋆}[∀X≤S_{1}:K.T_{1}..∀X≤S_{n}:K.T_{n}].

By the induction hypothesis, we have that, Γ ⊢ f ∈ T. By lemma

4.2.2(2), S-Meet-LB, S-Trans, and T-Subsumption, it follows that

Γ ⊢ f ∈ ∀X≤S_{i}:K.T_{i}. Since Γ ⊢ S ≤ S_{i}, by T-App, Γ ⊢ f S ∈ T_{i}[X←S]. Finally, by T-Meet,

Γ ⊢ f S ∈

⋀^{⋆}[T_{i}[X←S] | ∀X≤S_{i}:K.T_{i} ∈ alls (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}]. □

Lemma 4.2.5 (Term application)

If Γ ⊢ ⋀^{⋆}[S_{1}→T_{1}..S_{n}→T_{n}] ≤ S→T and Γ ⊢ U ≤ S, then Γ ⊢ ⋀^{⋆}[T_{j} | Γ ⊢ U ≤ S_{j}] ≤ T.

Proof: There are two cases to be considered according to the normal form of S→T. The case when (S→T)^{nf} ≡ S^{nf}→T^{nf} is similar to but simpler than the one we consider here. Assume

(S→T)^{nf} ≡ ⋀^{⋆}[S^{nf}→A_{1}..S^{nf}→A_{m}], where T^{nf} ≡ ⋀^{⋆}[A_{1}..A_{m}]. By the equivalence of ordinary and normal subtyping (theorem 3.3.9),

Γ^{nf} ⊢_{n} ⋀^{⋆}[S_{1}^{nf}→B_{1}^{1}..S_{1}^{nf}→B_{1}^{k_{1}}..S_{n}^{nf}→B_{n}^{1}..S_{n}^{nf}→B_{n}^{k_{n}}] ≤ ⋀^{⋆}[S^{nf}→A_{1}..S^{nf}→A_{m}],

where T_{i}^{nf} = \{ \begin{matrix}B_{i}^{1}, & if it is not an intersection; \\ ⋀^{⋆}[B_{i}^{1}..B_{i}^{k_{i}}], & otherwise. \end{matrix} By generation for normal subtyping (proposition 3.2.10), for each i∈{1..m} there exist j∈{1..n} and l_{j}∈{i..k_{j}} such that

Γ^{nf} ⊢_{n} S_{j}^{nf}→B_{j}^{l_{j}} ≤ S^{nf}→A_{i}

Again, by generation for normal subtyping (proposition 3.2.10), for each i∈{1..m} there exist j∈{1..n} and l_{j}∈{i..k_{j}} such that

Γ^{nf} ⊢_{n} S^{nf} ≤ S_{j}^{nf} and
Γ^{nf} ⊢_{n} B_{j}^{l_{j}} ≤ A_{i}

By NS-Trans and the equivalence of ordinary and normal subtyping (theorem 3.3.9), for each i∈{1..m} there exist j∈{1..n} and l_{j}∈{i..k_{j}} such that

\begin{matrix}Γ ⊢ U ≤ S_{j} and \\ Γ^{nf} ⊢_{n} B_{j}^{l_{j}} ≤ A_{i}. \end{matrix}

By NS-∃, for each i∈{1..m} there exist j∈{1..n} such that

\begin{matrix}Γ ⊢ U ≤ S_{j} and \\ Γ^{nf} ⊢_{n} ⋀^{⋆}[B_{j}^{1}..B_{j}^{k_{j}}] ≤ A_{i}. \end{matrix}

By the equivalence of ordinary and normal subtyping (theorem 3.3.9), for each i∈{1..m} there exist j∈{1..n} such that

\begin{matrix}Γ ⊢ U ≤ S_{j} and \\ Γ ⊢ T_{j} ≤ A_{i}. \end{matrix}

By lemma 2.4.14, S-Conv, and S-Trans,

Γ ⊢ ⋀^{⋆}[T_{j} | Γ ⊢ U ≤ S_{j}] ≤ T.  □

Lemma 4.2.6 (Substitution for subtyping)

If Γ_{1} ⊢ S_{1} ≤ T_{1} and Γ_{1}, X≤T_{1}:K_{1}, Γ_{2} ⊢ S_{2} ≤ T_{2}, then Γ_{1}, Γ_{2}[X←S_{1}] ⊢ S_{2}[X←S_{1}] ≤ T_{2}[X←S_{1}].

Proof: By straightforward induction on the derivation of Γ_{1}, X≤T_{1}:K_{1}, Γ_{2} ⊢ S_{2} ≤ T_{2}, using the weakening lemma (lemma 2.4.4), the type substitution lemma (lemma 2.4.11), and lemma 2.3.1.4(3). □

Lemma 4.2.7 (Type application)

If Γ ⊢ ⋀^{⋆}[∀X≤S_{1}:K_{1}.T_{1}..∀X≤S_{n}:K_{n}.T_{n}] ≤ ∀X≤S:K.T and Γ ⊢ U ≤ S, then Γ ⊢ ⋀^{⋆}[T_{j}[X←U] | Γ ⊢ U ≤ S_{j}] ≤ T [X←U].

Proof: There are two cases to be considered according to the normal form of ∀X≤S:K.T. The case when (∀X≤S:K.T)^{nf} ≡ ∀X≤S^{nf}:K.T^{nf} is similar to but simpler than the one we consider here. Assume

(∀X≤S:K.T)^{nf} ≡ ⋀^{⋆}[∀X≤S^{nf}:K.A_{1}..∀X≤S^{nf}:K.A_{m}]

where T^{nf} ≡ ⋀^{⋆}[A_{1}..A_{m}]. By the equivalence of ordinary and normal subtyping (theorem 3.3.9),

Γ^{nf} ⊢_{n} ⋀^{⋆}[∀X≤S_{1}^{nf}:K_{1}.B_{1}^{1}..∀X≤S_{1}^{nf}:K_{1}.B_{1}^{k_{1}}..∀X≤S_{n}^{nf}:K_{n}.B_{n}^{1}..∀X≤S_{n}^{nf}:K_{n}.B_{n}^{k_{n}}] ≤ ⋀^{⋆}[∀X≤S^{nf}:K.A_{1}..∀X≤S^{nf}:K.A_{m}],

where T_{i}^{nf} = \{ \begin{matrix}B_{i}^{1}, & if it is not an intersection; \\ ⋀^{⋆}[B_{i}^{1}..B_{i}^{k_{i}}], & otherwise. \end{matrix}

By generation for normal subtyping (proposition 3.2.10), for each i∈{1..m} there exist j∈{1..n} and l_{j}∈{i..k_{j}} such that

Γ^{nf} ⊢_{n} ∀X≤S_{j}^{nf}:K_{j}.B_{j}^{l_{j}} ≤ ∀X≤S^{nf}:K.A_{i}

Again, by generation for normal subtyping (proposition 3.2.10), for each i∈{1..m} there exist j∈{1..n} and l_{j}∈{i..k_{j}} such that

K ≡ K_{j},
S^{nf} ≡ S_{j}^{nf}, and
Γ^{nf}, X≤S_{j}^{nf}:K ⊢_{n} B_{j}^{l_{j}} ≤ A_{i}.

By NS-∀∃, for each i∈{1..m} there exist j∈{1..n} such that

Γ^{nf}, X≤S_{j}^{nf}:K ⊢_{n} T_{j}^{nf} ≤ A_{i}.

By the equivalence of ordinary and normal subtyping (theorem 3.3.9), for each i∈{1..m} there exist j∈{1..n} such that

Γ, X≤S_{j}:K ⊢ T_{j} ≤ A_{i}.

Furthermore, by S-Conv and S-Trans,

Γ ⊢ U ≤ S_{j}.

Then, by the substitution lemma for subtyping (lemma 4.2.6), for each i∈{1..m} there exist j∈{1..n} such that

Γ ⊢ T_{j}[X←U] ≤ A_{i}[X←U].

By NS-∀∃,

Γ ⊢ ⋀^{⋆}[T_{j}[X←U] | Γ ⊢ U ≤ S_{j}] ≤ ⋀^{⋆}[A_{1}[X←U]..A_{m}[X←U]].

By the definition of substitution,

Γ ⊢ ⋀^{⋆}[T_{j}[X←U] | Γ ⊢ U ≤ S_{j}] ≤ T^{nf}[X←U].

Finally, by lemma 2.3.1.4(3), S-Conv, and S-Trans,

Γ ⊢ ⋀^{⋆}[T_{j}[X←U] | Γ ⊢ U ≤ S_{j}] ≤ T [X←U],  □

Usually, the next step to prove the accuracy of an algorithm, inf in our case, would be to prove a completeness result: if the term e has type T with respect to the context Γ in the the typing system F_{∧}^{ω} then the algorithm inf finds a type T′ for e in Γ. In the present situation this result is not strong enough, since every closed term is typeable in both systems. One easily proves that

Lemma 4.2.8

1. If e is closed in Γ, then there exists T such that Γ ⊢ e ∈ T.

2. If e is closed in Γ, then there exists T such that Γ ⊢_{inf} e ∈ T.

We use the fact that inf is deterministic, which means that the rules are invertible, to prove the important property that it finds a minimal type.

Proposition 4.2.9 (Generation for inf)

1. If Γ ⊢_{inf} x ∈ T, then T ≡ Γ(x).

2. If Γ ⊢_{inf} λx:T_{1}.e ∈ T, then T ≡ T_{1}→T_{2}, where Γ, x:T_{1} ⊢_{inf} e ∈ T_{2} as a subderivation.

3. If Γ ⊢_{inf} f a ∈ T, then

T ≡ ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(U)) and Γ ⊢ S ≤ S_{i}],

where Γ ⊢_{inf} f ∈ U and Γ ⊢_{inf} a ∈ S as subderivations.

4. If Γ ⊢_{inf} λX≤T_{1}:K_{1}.e ∈ T, then

T ≡ ∀X≤T_{1}:K_{1}.T_{2},

where Γ, X≤T_{1}:K_{1} ⊢_{inf} e ∈ T_{2} as a subderivation.

5. If Γ ⊢_{inf} f S ∈ T, then

T ≡ ⋀^{⋆}[T_{i}[X←S] | ∀X≤S_{i}:K.T_{i} ∈ alls (flub_{Γ}(U)) and Γ ⊢ S ≤ S_{i}],

where Γ ⊢_{inf} f ∈ U as a subderivation.

6. If Γ ⊢_{inf} for(X∈S_{1}..S_{n})e ∈ T, then T ≡ ⋀^{⋆}[T_{1}..T_{n}], where Γ ⊢_{inf} e[X←S_{i}] ∈ T_{i}, for each i∈{1..n}, as subderivations.

Proof: The form of the term in the antecedent uniquely determines the last rule of its derivation.

Proposition 4.2.10 (Minimal typing)

If Γ ⊢ e ∈ T and Γ ⊢_{inf} e ∈ T′, then Γ ⊢ T′ ≤ T.

Proof: By induction on the derivation of Γ ⊢ e ∈ T.

T-Var By generation for inf (proposition 4.2.9), T′ ≡ T, and then the result follows by S-Conv.

T-Abs We are given that

e ≡ λx:T_{1}.e_{2},
T ≡ T_{1}→T_{2}, and
Γ, x:T_{1} ⊢ e_{2} ∈ T_{2}.

By generation for inf (proposition 4.2.9),

\begin{matrix}T′ ≡ T_{1}→T′_{2} and \\ Γ, x:T_{1} ⊢_{inf} e_{2} ∈ T′_{2}. \end{matrix}

By the induction hypothesis, Γ, x:T_{1} ⊢ T′_{2} ≤ T_{2}, and by strengthening (lemma 2.4.5), Γ ⊢ T′_{2} ≤ T_{2}, from which it follows that Γ ⊢ T′ ≤ T.

T-App We are given that

e ≡ f a,
Γ ⊢ f ∈ V →T , and
Γ ⊢ a ∈ V.

By generation for inf (proposition 4.2.9),

Γ ⊢_{inf} f ∈ U,
Γ ⊢_{inf} a ∈ S, and
T′ ≡ ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(U)) and Γ ⊢ S ≤ S_{i}].

By the induction hypothesis,

\begin{matrix}Γ ⊢ U ≤ V →T, and \\ Γ ⊢ S ≤ V. \end{matrix}

By lemma 4.2.3(1),

Γ ⊢ ⋀^{⋆}[S_{i}→T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(U))] ≤ V →T.

Finally, by the term application lemma (lemma 4.2.5), it follows that

Γ ⊢ ⋀^{⋆}[T_{i} | Γ ⊢ S ≤ S_{i}] ≤ T,

where S_{i}→T_{i} ∈ arrows (flub_{Γ}(U)).

In other words,

Γ ⊢ ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(U))] ≤ T.

T-TAbs We are given that

e ≡ λX≤T_{1}:K_{1}.e_{2}, T ≡ ∀X≤T_{1}:K_{1}.T_{2}, and Γ, X≤T_{1}:K_{1} ⊢ e ∈ T_{2}.

By generation for inf (proposition 4.2.9),

\begin{matrix}T′ ≡ ∀X≤T_{1}:K_{1}.T′_{2} and \\ Γ, X ≤ T_{1}:K_{1} ⊢_{inf} e_{2} ∈ T′_{2}. \end{matrix}

By the induction hypothesis, Γ, X ≤ T_{1}:K_{1} ⊢ T′_{2} ≤ T_{2}. Then, by S-All it follows that Γ ⊢ T′ ≤ T.

T-TApp We are given that

e ≡ f S, T ≡ T_{2}[X←S]Γ ⊢ f ∈ ∀X≤T_{1}:K.T_{2}, and Γ ⊢ S ≤ T_{1}.

By generation for inf (proposition 4.2.9),

T′ ≡ ⋀^{⋆}[U_{i} | ∀X≤S_{i}:K_{i}.U_{i} ∈ alls (flub_{Γ}(U)) and Γ ⊢ S ≤ S_{i}], and Γ ⊢_{inf} f ∈ U.

By the induction hypothesis, Γ ⊢ U ≤ ∀X≤T_{1}:K.T_{2}. By lemma 4.2.3(2),

Γ ⊢ ⋀^{⋆}[∀X≤S_{i}:K_{i}.U_{i} | ∀X≤S_{i}:K_{i}.U_{i} ∈ alls (flub_{Γ}(U))] ≤ ∀X≤T_{1}:K.T_{2}. Then, by the type application lemma (lemma 4.2.7), it follows that

Γ ⊢ ⋀^{⋆}[U_{i}[X←S] | Γ ⊢ S ≤ S_{i}] ≤ T_{2}[X←S],

where ∀X≤S_{i}:K_{i}.U_{i} ∈ alls (flub_{Γ}(U)). Namely, Γ ⊢ ⋀^{⋆}[U_{i}[X←S] | ∀X≤S_{i}:K_{i}.U_{i} ∈ alls (flub_{Γ}(U)) and Γ ⊢ S ≤ S_{i}] ≤ T_{2}[X←S].

T-For We are given that

e ≡ for(X∈S_{1}..S_{n})e_{2} Γ ⊢ e_{2}[X←S] ∈ T, and S ∈ {S_{1}..S_{n}}.

By generation for inf (proposition 4.2.9),

T′ ≡ ⋀^{⋆}[T_{1}..T_{m}], and

Γ ⊢_{inf} e_{2}[X←S] ∈ T_{i} for each i in {1..m} .

By the induction hypothesis, S-Meet-LB, and S-Trans, we have that

Γ ⊢ ⋀^{⋆}[T_{1}..T_{m}] ≤ T.

T-Meet By the induction hypothesis and S-Meet-G.

T-Sub By the induction hypothesis and S-Trans. □

Finally, we have proved the following result.

Theorem 4.2.11 (Minimal typing for F_{∧}^{ω}) Given a term e and a context Γ, there exists T such that for every T′, if Γ ⊢ e ∈ T′, then Γ ⊢ T ≤ T′.

4.3 Decidability of type checking and type inference

In the previous section we proved that the algorithm inf is sound and computes minimal types for the F_{∧}^{ω} typing system. The next step is to prove that the algorithm inf always terminates. This result completes the proof of decidability of type checking and type inference in F_{∧}^{ω}.

We first define a measure for terms such that the type information inside the terms is considered to have constant value. The intuition behind the definition is to find a measure on terms which is invariant under type substitution (see lemma 4.3.2).

Definition 4.3.1 (size ∥−∥)

\begin{aligned}∥x∥ & = & 1, \\ ∥λx:T.e∥ & = & 1 + ∥e∥, \\ ∥e_{1} e_{2}∥ & = & ∥e_{1}∥ + ∥e_{2}∥, \\ ∥λX≤T:K.e∥ & = & 1 + ∥e∥, \\ ∥e T ∥ & = & 1 + ∥e∥, \\ ∥for(X∈T_{1}..T_{n})e∥ & = & 1 + ∥e∥. \end{aligned}

Lemma 4.3.2 ∥e∥ = ∥e[X←T]∥.

Proposition 4.3.3 (Well-foundedness of inf)

The inference rules for inf define a terminating algorithm.

Proof: In the case of AT-Var, the termination follows from the decidability of ok judgements (see corollary 2.4.10(1)). Furthermore, for each rule R of inf, if Γ ⊢ e ∈ T is a hypothesis and Γ ⊢ e′ ∈ T′ is the conclusion of R, then ∥e∥ < ∥e′∥. Moreover, in the cases for AT-App and AT-TApp, Γ ⊢ f ∈ T by the soundness of inf (proposition 4.2.4), Γ ⊢ T ∈ ⋆ by well-kindedness of typing (proposition 2.4.20). Hence flub_{Γ}(T) is defined by lemma 4.1.5. Furthermore, arrows and alls define finite sets, and, as we proved in section 3.5, subtyping is decidable. Hence, the algorithm inf always terminates. □

We can now state and prove that type checking in F_{∧}^{ω} is decidable.

Theorem 4.3.4 (Decidability of type checking in F_{∧}^{ω})

For any context Γ, and for any term e and type T closed in Γ, it is decidable whether Γ ⊢ e ∈ T.

Proof: Infer a minimal type T′ for e in Γ using inf, which is decidable by proposition 4.3.3, and check whether Γ ⊢ T′ ≤ T, which is also decidable by theorem 3.5.18. □

Every term e closed in a context Γ has type ⊤^{⋆}. We are interested in finding types other than ⊤^{⋆}, namely non-trivial types. Since inf computes minimal types and ⊤^{⋆} is the largest type (modulo =_{β∧}) , if a term has a non trivial type in a given context, then the algorithm inf finds it.

Theorem 4.3.5 (Decidability of type inference in F_{∧}^{ω})

For any context Γ and for any term e closed in Γ, it is decidable whether there exists a type T such that Γ ⊢ e ∈ T and T ≠_{β∧} ⊤^{⋆}.

Proof: Infer a minimal type T for e in Γ using inf, which is decidable by proposition 4.3.3, and reduce T to normal form which is decidable because →_{β∧} is strongly normalising (see theorem 2.5.10). Finally, check whether T^{nf} ≡ ⊤^{⋆}. □

4.4 Subject reduction

The F_{∧}^{ω} system is layered in three syntactic categories: kinds, types, and terms. Since terms do not appear in either types or kinds, reductions in type expressions can be studied independently from the reductions of terms. In section 2.2, we proved that reduction on types preserves kinding properties: the sub-language of types and kinds satisfies the subject reduction property (lemma 2.4.12):

if Γ ⊢ S ∈ K and S ↠_{β∧} T, then Γ ⊢ T ∈ K.

In this section, we show the subject reduction property for typing judgements (proposition 4.4.7):

if Γ ⊢ e ∈ T and e ↠_{βfor} e′, then Γ ⊢ e′ ∈ T.

In other words, reductions on terms are also safe.

Lemma 4.4.1 If Y ∉ FV(S), then

1. e[Y ←T][X←S] ≡ e[X←S][Y ←T [X←S]]

2. U[Y ←T][X←S] ≡ U[X←S][Y ←T [X←S]]

Proof: By induction on the structure of e and U respectively. □

Lemma 4.4.2 (Substitution for typing)

1. If Γ_{1} ⊢ e_{1} ∈ S_{1} and Γ_{1}, x:S_{1}, Γ_{2} ⊢ e_{2} ∈ S_{2}, then Γ_{1}, Γ_{2} ⊢ e_{2}[x←e_{1}] ∈ S_{2}.

2. If Γ_{1} ⊢ S≤S_{1} and Γ_{1}, X≤S_{1}:K_{1}, Γ_{2} ⊢ e_{2} ∈ S_{2}, then Γ_{1}, Γ_{2}[X←S] ⊢ e_{2}[X←S] ∈ S_{2}[X←S].

Proof:

1. By induction on the derivation of Γ_{1}, x:S_{1}, Γ_{2} ⊢ e_{2} ∈ S_{2}.

2. By induction on the derivation of Γ_{1}, X≤S_{1}:K_{1}, Γ_{2} ⊢ e_{2} ∈ S_{2}, using the type substitution lemma (lemma 2.4.11) in the T-Var and T-Meet cases; the substitution lemma for subtyping (lemma 4.2.6) and lemma 4.4.1 in the case for T-TApp; lemma 4.4.1 in the T-For case, and the substitution lemma for subtyping (lemma 4.2.6) in the T-Subsumption case. □

Lemma 4.4.3 Γ ⊢ ⊤^{⋆} ≤ T if and only if T =_{β∧} ⊤^{⋆} and Γ ⊢ T ∈ ⋆.

Proof: If T =_{β∧} ⊤^{⋆}, then the result follows by S-Conv. Otherwise, if Γ ⊢ ⊤^{⋆} ≤ T, by the well-kindedness of subtyping (proposition 2.4.19), T-Meet, and uniqueness of kinds (lemma 2.4.7), Γ ⊢ T ∈ ⋆. By the equivalence of ordinary and algorithmic subtyping (proposition 3.4.3), Γ^{nf} ⊢_{Alg} ⊤^{⋆} ≤ T^{nf}, which can only be derived using AlgS-∀∃ where T^{nf} is the empty intersection. □

Given Γ ⊢ S ≤ T, generation for normal subtyping (proposition 3.2.10) and the equivalence of ordinary and normal subtyping (theorem 3.3.9) provide subtyping information about the normal forms of S and T. We can also show that subtyping is structural for arrow types, quantified types and type operators, without reducing the terms in the subtyping relation to normal form. An implementation of a subtyping algorithm for F_{∧}^{ω} could take advantage of this fact by delaying normalizing steps, which might result in having to consider fewer recursive calls or calls with smaller arguments.

Lemma 4.4.4 (Generation for ordinary subtyping)

1. Γ ⊢ T_{1}→T_{2} ≤ S_{1}→S_{2} and S_{2} ≠_{β∧} ⊤^{⋆} if and only if Γ ⊢ S_{1} ≤ T_{1} and Γ ⊢ T_{2} ≤ S_{2}

2. Γ ⊢ ∀X≤T_{1}:K_{T} .T_{2} ≤ ∀X≤S_{1}:K_{S}.S_{2} and S_{2} ≠_{β∧} ⊤^{⋆} if and only if K_{S} ≡ K_{T}, T_{1} =_{β∧} S_{1}, and Γ, X≤T_{1}:K_{T} ⊢ T_{2} ≤ S_{2}.

3. Γ ⊢ ΛX:K_{T} .T_{2} ≤ ΛX:K_{S}.S_{2} and S_{2} ≠_{β∧} ⊤^{⋆} if and only if Γ, X:K_{S} ⊢ T_{2} ≤ S_{2} and K_{T} ≡ K_{S}.

Proof: The three statements are proved using a similar argument. We consider here the proof of part 2. If K_{S} ≡ K_{T}, T_{1} =_{β∧} S_{1}, and Γ, X≤T_{1}:K_{T} ⊢ T_{2} ≤ S_{2}, then, by S-All and S-Conv, Γ ⊢ ∀X≤T_{1}:K_{T} .T_{2} ≤ ∀X≤S_{1}:K_{S}.S_{2}. Conversely, let

Γ ⊢ ∀X≤T_{1}:K_{T} .T_{2} ≤ ∀X≤S_{1}:K_{S}.S_{2} and S_{2} ≠_{β∧} ⊤^{⋆}.

Lemma 4.4.3 implies that T_{2}^{nf} ≠_{β∧} ⊤^{⋆}. Then we have to consider four cases according to whether S_{2}^{nf} and T_{2}^{nf} are intersection types or not. We illustrate the proof argument considering just one case. Let

(∀X≤T_{1}:K_{T} .T_{2})^{nf} ≡ ∀X≤T_{1}^{nf}:K_{T} .T_{2}^{nf}, and
(∀X≤S_{1}:K_{S}.S_{2})^{nf} ≡ ⋀^{⋆}[∀X≤S_{1}^{nf}:K_{S}.A_{1}..∀X≤S_{1}^{nf}:K_{S}.A_{n}],

where S_{2}^{nf} ≡ ⋀^{⋆}[A_{1}..A_{n}]. By the equivalence of ordinary and normal subtyping (theorem 3.3.9) and generation for normal subtyping (proposition 3.2.10), for each i∈{1..n}

Γ^{nf} ⊢_{n} ∀X≤T_{1}^{nf}:K_{T} .T_{2}^{nf} ≤ ∀X≤S_{1}^{nf}:K_{S}.A_{i}

and, again generation for normal subtyping (proposition 3.2.10) implies that

Γ^{nf}, X≤T_{1}^{nf}:K_{T} ⊢_{n} T_{2}^{nf} ≤ A_{i}, and
T_{1}^{nf} ≡ S_{1}^{nf}.

By NS-∀,

Γ^{nf}, X≤T_{1}^{nf}:K_{T} ⊢_{n} T_{2}^{nf} ≤ S_{2}^{nf}

and, by the equivalence of ordinary and normal subtyping (theorem 3.3.9),

Γ, X≤T_{1}:K_{T} ⊢ T_{2} ≤ S_{2}.  □

Lemma 4.4.5 (Generation for typing)

1. If Γ ⊢ λx:S_{1}.e ∈ S, then there exists S_{2} such that Γ, x:S_{1} ⊢ e ∈ S_{2} and Γ ⊢ S_{1}→S_{2} ≤ S.

2. If Γ ⊢ λX≤S_{1}:K_{1}.e ∈ S, then there exists S_{2} such that Γ, X≤S_{1}:K_{1} ⊢ e ∈ S_{2} and Γ ⊢ ∀X≤S_{1}:K_{1}.S_{2} ≤ S.

3. If Γ ⊢ for(X∈{U_{1}..U_{n}})e ∈ T, then there exist T_{1}..T_{n} such that, for each i in {1..n}, Γ ⊢ e[X←U_{i}] ∈ T_{i} and Γ ⊢ ⋀^{⋆}[T_{1}..T_{n}] ≤ T.

Proof: Each statement is proved by induction on the derivation of the typing statement in the antecedent. We exhibit here the proof of part 3. We proceed by case analysis on the last rule of the derivation of Γ ⊢ for(X∈{U_{1}..U_{n}})e ∈ T.

T-For We are given that Γ ⊢ e[X←U] ∈ T for some U∈{U_{1}..U_{n}}. Since every closed term has a type, we have that, for each i in {1..n}, Γ ⊢ e[X←U_{i}] ∈ T_{i}, and, by S-Meet-LB, Γ ⊢ ⋀^{⋆}[T_{1}..T ..T_{n}] ≤ T.

T-Meet Let T ≡ ⋀^{⋆}[S_{1}..S_{k}]. We are given that,

Γ ⊢ ok and
Γ ⊢ for(X∈{U_{1}..U_{n}})e ∈ S_{j}, for each j in {1..k}.

By the induction hypothesis, for each j∈{1..k} and each i∈{1..n}, there exist T_{j_{i}} such that

\begin{matrix}Γ ⊢ e[X←U_{i}] ∈ T_{j_{i}}, & and \\ Γ ⊢ ⋀^{⋆}[T_{j_{1}}..T_{j_{n}}] ≤ S_{j}, \end{matrix}

and, by the minimal type property (theorem 4.2.11), there exist T_{1}..T_{n} such that

\begin{matrix}Γ ⊢ e[X←U_{i}] ∈ T_{i}, & and \\ Γ ⊢ T_{i} ≤ T_{j_{i}}, \end{matrix}

by lemma 2.4.18, it follows that Γ ⊢ ⋀^{⋆}[T_{1}..T_{n}] ≤ ⋀^{⋆}[T_{j_{1}}..T_{j_{n}}], and by S-Trans, Γ ⊢ ⋀^{⋆}[T_{1}..T_{n}] ≤ S_{j}. Finally, by S-Meet-G, it follows that

Γ ⊢ ⋀^{⋆}[T_{1}..T_{n}] ≤ ⋀^{⋆}[S_{1}..S_{k}].

T-Sub We are given that

Γ ⊢ for(X∈{U_{1}..U_{n}})e ∈ S, and
Γ ⊢ S ≤ T.

The result follows by the induction hypothesis and S-Trans. □

Since terms cannot occur in types, subject reduction for terms does not need to consider reductions in contexts.

Proposition 4.4.6 (One step subject reduction for typing judgements) If Γ ⊢ e ∈ T and e →_{βfor} e′, then Γ ⊢ e′ ∈ T.

Proof: Since every term has type ⊤^{⋆}, the interesting case is when T ≠_{β∧} ⊤^{⋆}. This proposition follows by induction on the derivation of Γ ⊢ e ∈ T. We consider the cases where e is a redex; the other cases follow by straightforward application of the induction hypothesis.

T-App There are two possibilities for e to be a redex.

1. e ≡ (λx:S_{1}.e_{1}) e_{2}, e′ ≡ e_{1}[x←e_{2}], and T ≡ T_{2} . We are given that

Γ ⊢ λx:S_{1}.e_{1} ∈ T_{1}→T_{2} and Γ ⊢ e_{2} ∈ T_{1}.

By the generation lemma for typing (lemma 4.4.5), there exists S_{2} such that,

Γ, x:S_{1} ⊢ e_{1} ∈ S_{2} and Γ ⊢ S_{1}→S_{2} ≤ T_{1}→T_{2}.

Since T_{2} ≠_{β∧} ⊤^{⋆}, by the generation lemma for ordinary subtyping (lemma 4.4.4),

Γ ⊢ T_{1} ≤ S_{1} and Γ ⊢ S_{2} ≤ T_{2}.

Then, by T-Subsumption, it follows that

Γ, x:S_{1} ⊢ e_{1} ∈ T_{2} and Γ ⊢ e_{2} ∈ S_{1}.

Finally, by the substitution lemma for typing (lemma 4.4.2(1)),

Γ ⊢ e_{1}[x←e_{2}] ∈ T_{2}.

2. e ≡ (for(X∈U_{1}..U_{n})e_{2}) e_{1}, e′ ≡ for(X∈U_{1}..U_{n})(e_{2} e_{1}), and T ≡ T_{2}. We are given that

Γ ⊢ for(X∈U_{1}..U_{n})e_{2} ∈ T_{1}→T_{2} and Γ ⊢ e_{1} ∈ T_{1}.

By the generation lemma for typing (lemma 4.4.5), there exist V_{1}..V_{n} such that

Γ ⊢ e_{2}[X←U_{i}] ∈ V_{i} for each i∈{1..n}, and
Γ ⊢ ⋀^{⋆}[V_{1}..V_{n}] ≤ T_{1}→T_{2}.

We write V_{i}^{nf} ≡ A_{i_{1}}, if it is not an intersection, V_{i}^{nf} ≡ ⋀^{⋆}[A_{i_{1}}..A_{i_{k_{i}}}], otherwise.

Note that ⋀^{⋆}[V_{1}..V_{n}]^{nf} ≡ ⋀^{⋆}[A_{1_{1}}..A_{1_{k_{1}}}..A_{n_{1}}..A_{n_{kn}}]. By the equivalence of ordinary and normal subtyping (theorem 3.3.9),

Γ^{nf} ⊢_{n} ⋀^{⋆}[A_{1_{1}}..A_{1_{k_{1}}}..A_{n_{1}}..A_{n_{kn}}] ≤ (T_{1}→T_{2})^{nf}.

We have to consider two cases according to the form of (T_{1}→T_{2})^{nf}.

(a) (T_{1}→T_{2})^{nf} ≡ T_{1}^{nf}→T_{2}^{nf}. By generation for normal subtyping (proposition 3.2.10), there exist l∈{1..n} and j∈{1..k_{l}} such that

Γ^{nf} ⊢_{n} A_{l_{j}} ≤ T_{1}^{nf}→T_{2}^{nf},

and, by NS-∃ or NS-Refl,

Γ^{nf} ⊢_{n} V_{l}^{nf} ≤ A_{l_{j}},

by NS-Trans,

Γ^{nf} ⊢_{n} V_{l}^{nf} ≤ T_{1}^{nf}→T_{2}^{nf}, and, by the equivalence of ordinary and normal subtyping (theorem 3.3.9),

Γ ⊢ V_{l} ≤ T_{1}→T_{2}.

Then, by T-Subsumption,

Γ ⊢ e_{2}[X←U_{l}] ∈ T_{1}→T_{2}.

By T-App,

Γ ⊢ (e_{2}[X←U_{l}]) e_{1} ∈ T_{2}, and since X is not a free variable of e_{1} we have that,

Γ ⊢ e_{2} e_{1}[X←U_{l}] ∈ T_{2}. Finally, applying T-For, we have that

Γ ⊢ for(X∈U_{1}..U_{n})e_{2} e_{1} ∈ T_{2}.

(b) (T_{1}→T_{2})^{nf} ≡ ⋀^{⋆}[T_{1}^{nf}→B_{1}..T_{1}^{nf}→B_{r}], where T_{2}^{nf} ≡ ⋀^{⋆}[B_{1}..B_{r}]. By generation for normal subtyping (proposition 3.2.10), for every s∈{1..r} there exist l∈{1..n} and j∈{1..k_{l}} such that

Γ^{nf} ⊢_{n} A_{l_{j}} ≤ T_{1}^{nf}→B_{s},

and, by NS-∃ or NS-Refl,

Γ^{nf} ⊢_{n} V_{l}^{nf} ≤ A_{l_{j}}, by NS-Trans, for every s∈{1..r} there exists l∈{1..n} such that

Γ^{nf} ⊢_{n} V_{l}^{nf} ≤ T_{1}^{nf}→B_{s},

and, by the equivalence of ordinary and normal subtyping (theorem 3.3.9),

Γ ⊢ V_{l} ≤ T_{1}→B_{s}. By T-Subsumption, for every s∈{1..r} there exists l∈{1..n}

Γ ⊢ e_{2}[X←S_{l}] ∈ T_{1}→B_{s}. By T-App, for every s∈{1..r} there exists l∈{1..n}

Γ ⊢ (e_{2}[X←S_{l}]) e_{1} ∈ B_{s}, and since X is not a free variable of e_{1} we have that, for every s∈{1..r} there exists l∈{1..n}

Γ ⊢ e_{2} e_{1}[X←S_{l}] ∈ B_{s}. Applying T-For, we get that for every s∈{1..r}

Γ ⊢ for(X∈U_{1}..U_{n})e_{2} e_{1} ∈ B_{s},

by T-Meet,

Γ ⊢ for(X∈U_{1}..U_{n})e_{2} e_{1} ∈ T_{2}^{nf}.

Finally, by S-Conv and T-Subsumption,

Γ ⊢ for(X∈U_{1}..U_{n})e_{2} e_{1} ∈ T_{2}.

T-TApp There are two possibilities for e to be a redex. The case when e ≡ (for(X∈U_{1}..U_{n})e_{2}) S follows a similar argument to the one used for the case e ≡ (for(X∈U_{1}..U_{n})e_{2}) e_{1}) in T-App.

If e ≡ (λX≤S_{1}:K_{S}.e_{2}) S e′ ≡ e_{2}[X←S], and T ≡ T_{2}[X←S], we have that Γ ⊢ λX≤S_{1}:K_{S}.e_{1} ∈ ∀X≤T_{1}:K_{T} .T_{2} and Γ ⊢ S ≤ T_{1}. By the generation lemma for typing (lemma 4.4.5), there exists S_{2} such that

\begin{matrix}Γ, X≤S_{1}:K_{S} ⊢ e_{2} ∈ S_{2} and \\ Γ ⊢ ∀X≤S_{1}:K_{S}.S_{2} ≤ ∀X≤T_{1}:K_{T} .T_{2}. \end{matrix}

Since T_{2}[X←S] ≠_{β∧} ⊤^{⋆}, lemma 2.3.1.4(3) implies that T_{2} ≠_{β∧} ⊤^{⋆}. Then, by the generation lemma for ordinary subtyping (lemma 4.4.4),

Γ, X≤S_{1}:K_{S} ⊢ S_{2} ≤ T_{2}, S_{1} =_{β∧} T_{1}, and K_{S} ≡ K_{T} .

By T-Subsumption, Γ, X≤S_{1}:K_{S} ⊢ e_{2} ∈ T_{2}, and, by S-Trans and S-

Conv, Γ ⊢ S ≤ S_{1}. Finally, by the substitution lemma for typing (lemma 4.4.2(2)), Γ ⊢ e_{2}[X←S] ∈ T_{2}[X←S].

T-For Let e ≡ for(X∈U_{1}..U_{n})e_{1}, where X ∉ FTV(e_{1}) and e′ ≡ e_{1}. We are given that Γ ⊢ e_{1}[X←U] ∈ T, with U∈{U_{1}..U_{n}}. Since e_{1} ≡ e_{1}[X←U], the result holds. □

We now have all the results needed in order to prove that reduction on terms preserves typing. The following proposition, the subject reduction property for F_{∧}^{ω} terms, is a consequence of the previous one.

Proposition 4.4.7 (Subject reduction for typing judgements)

If Γ ⊢ e ∈ T and e ↠_{βfor} e′, then Γ ⊢ e′ ∈ T.

Proof: By induction on the derivation of e ↠_{βfor} e′, using proposition 4.4.6. □

90 CHAPTER 4. TYPING IN F_{∧}^{ω}

A PER Model for F_{∧}^{ω}

5.1 Introduction

This chapter is based on [CP93]. The differences come from having replaced the distributivity subtyping rules by reduction rules. Among simplest models for typed λ-calculi are those based on partial equivalence relations (PERs). A model in this style is essentially untyped: terms are interpreted by erasing all type information and interpreting the resulting pure λ-term as an element of the model. A type, in this setting, is just a subset of the model along with an appropriate notion of equivalence of elements. Coercions between types are interpreted as inclusion of PERs.

Our PER model for F_{∧}^{ω} extends the model of F_{∧} given in [Pie91], which is based on Bruce and Longo’s model for F_{≤} [BL90]. The usual interpretation of a quantified type ∀X.𝕋 in a PER model is the PER-indexed intersection of all possible instances of T. Bruce and Longo refined this definition to interpret ∀X≤S.𝕋 as the intersection of all the instances of T where X is interpreted as a sub-PER of the interpretation of S. This intuition also serves for intersection types: ⋀^{⋆}[T_{1}..T_{n}] is interpreted as the intersection of the PERs interpreting each of the T_{i}’s. We generalize this model to ω-order polymorphism (and subtyping) by interpreting type operators as functions over PERs.

To deal correctly with intersection types, we need to make one significant technical departure here from PER models of ordinary bounded quantification: instead of allowing the elements of our PERs to be drawn from the carrier of an arbitrary partial combinatory algebra D, we require that D be a total combinatory algebra. This restriction is needed to validate instances of S-Conv, which have the form Γ ⊢ ⊤^{⋆} ≤ S → ⊤^{⋆}. For example, let S = ⊤^{⋆}. The empty intersection ⊤^{⋆} is interpreted by the everywhere-defined PER, i.e., [[⊤^{⋆}]] relates every m to itself. To validate the distributivity law, it must therefore be the case that [[⊤^{⋆} → ⊤^{⋆}]] relates every element to itself. But this will only be true if the application of any element to any other element is defined. This observation is due to QingMing Ma.

Cardelli and Longo [CL91] and Bruce and Mitchell [BM92] have given related models for variants of F^{ω} including subtyping, but without intersections.

92 CHAPTER 5. A PER MODEL FOR F_{∧}^{ω}

The notation and fundamental definitions used here are based on papers of Bruce and Longo [BL90], Freyd, Mulry, Rosolini, and Scott [FMRS90], and others. A helpful basic reference for PER models of second-order λ-calculi is [Mit90b]; also see [BMM90] for more general discussion of second-order models and [Bar84, HS86] for general discussion of combinatory models.

5.2 Total combinatory algebras

A total combinatory algebra is a tuple D = ⟨D, ▪, k, s⟩ comprising a set D of elements, an application function ▪ with type D → (D → D), and distinguished elements k, s ∈ D such that, for all d_{1}, d_{2}, d_{3} ∈ D,

\begin{matrix}k ▪ d_{1} ▪ d_{2} = d_{1} \\ s ▪ d_{1} ▪ d_{2} ▪ d_{3} = (d_{1} ▪ d_{3}) ▪ (d_{2} ▪ d_{3}). \end{matrix}

Throughout this section, we work with a fixed, but unspecified, total combinatory algebra D. (C.f. [Sco76] for examples.)

The set of pure λ-terms is defined by the following grammar:

M ::= x | λ(x)M | M_{1} M_{2}

The set of combinator terms is:

C ::= x | C_{1} C_{2} | K | S

The bracket abstraction of a combinator term C with respect to a variable x, written fun^{⋆} (x) C, is defined as follows:

fun^{⋆} (x) C  = K C  when x ∉ FV(C)
fun^{⋆} (x) x  = S K K
fun^{⋆} (x) C_{1} C_{2} = S (fun^{⋆} (x) C_{1}) (fun^{⋆} (x) C_{2}) when x∈FV(C_{1} C_{2})

The combinator translation of a pure λ-term M, written |M|, is defined as follows:

\begin{aligned}|x| & = & x \\ |λ(x)M| & = & fun^{⋆} (x) |M| \\ |M_{1} M_{2}| & = & |M_{1}| |M_{2}| \end{aligned}

A term environment η is a finite function from term variables to elements of D. When x ∉ dom(η), we write η[x←d] for the environment that maps x to d and agrees with η everywhere else. We write η\x for the environment like η except that η(x) is undefined; η\Γ is like η but undefined on all the variables in dom(Γ). We say that η′ extends η when dom(η) ⊆ dom(η′) and η and η′ agree on dom(η).

Let C be a combinator term and η a term environment such that FV(C) ⊆ dom(η). Then the interpretation of C under η, written [[C]]_{η}, is defined as follows:

\begin{aligned}[[x]]_{η} & = & η(x) \\ [[C_{1} C_{2}]]_{η} & = & [[C_{1}]]_{η} ▪ [[C_{2}]]_{η} \\ [[K]]_{η} & = & k \\ [[S]]_{η} & = & s. \end{aligned}

Lemma 5.2.1

1. If η′ extends η and FV(C) ⊆ dom(η), then [[C]]_{η} = [[C]]_{η′}.

2. [[fun^{⋆} (x) C]]_{η} ▪ m = [[C]]_{η[x←m]}.

Proof: Standard. □

5.3 Higher-order partial equivalence relations

A partial equivalence relation (PER) on a combinatory algebra D is a symmetric and transitive relation A on D. We write m {A} n when A relates m and n. The domain of A, written dom(A), is the set {n | n {A} n}. (Note that m {A} n implies m ∈ dom(A).) We write PER for the class of all PERs.

If A and B are relations, then A → B is the relation where m {A → B} n iff, for all p, q∈D, p {A} q m▪p {B} n▪q. It is not hard to show that A → B is a PER when A and B are PERs, and that the intersection of any set of PERs is a PER. To interpret type operators, we need to consider not only PERs, but arbitrary function spaces built on PER. An element of such a function space (including, as a special case, an element of PER itself), is called a higher-order PER (HOPER). The interpretation of a kind K is a suitable space of HOPERs:

\begin{aligned}[[ ⋆]] & = & PER and \\ [[K_{1}→K_{2}]] & = & [[K_{1}]] → [[K_{2}]]. \end{aligned}

We generalize the familiar graph-inclusion of relations to HOPERs as follows:

A ⊆^{⋆} B  iff A, B ∈ [[ ⋆]] and
m {A} n implies m {B} n for all m, n∈D;
A ⊆^{K_{1}→K_{2}} B iff A, B ∈ [[K_{1}→K_{2}]] and
A P ⊆^{K_{2}} B P for all P ∈ [[K_{1}]].

Let {A_{i} ∈ [[K]]}_{i∈I} be a set of HOPERs indexed by a set I. Then ⋂_{i∈I}^{K} A_{i} is the HOPER defined by

m {⋂_{i∈I}^{⋆} A_{i}} n iff for every i, m {A_{i}} n
⋂_{i∈I}^{K_{1}→K_{2}} A_{i}  = λP ∈[[K_{1}]]. ⋂_{i∈I}^{K_{2}} A_{i} P

Lemma 5.3.1

1. Each ⊆^{K} is transitive.

2. If A_{j} ∈ [[K]] for each j∈I, then ⋂_{i∈I}^{K} A_{i} ∈ [[K]].

3. If A ⊆^{K} B_{j} for each j, then A ⊆^{K} ⋂_{i∈I}^{K} B_{i}.

4. ⋂_{i∈I}^{K} A_{i} ⊆^{K} A_{j} for each j.

5. ⋂_{i∈I}^{⋆} A→B_{i} ⊆^{⋆} A → ⋂_{i∈I}^{⋆} B_{i}.

6. ⋂_{i∈I}^{⋆} ⋂_{P ⊆^{K}A}^{⋆} B_{i} ⊆^{⋆} ⋂_{P ⊆^{K}A}^{⋆} ⋂_{i∈I}^{⋆} B_{i}.

7. ⋂_{i∈I}^{K_{1}→K_{2}} λP ∈[[K_{1}]]. B_{i} P ⊆^{K_{1}→K_{2}} λP ∈[[K_{1}]]. ⋂_{i∈I}^{K_{2}} B_{i} P, if each B_{i} ∈ [[K_{1}→K_{2}]].

8. ⋂_{i∈I}^{K_{2}} B_{i} A ⊆^{K_{2}} (⋂_{i∈I}^{K_{1}→K_{2}} B_{i}) A, where A∈[[K_{1}]].

Indeed, in cases 4 through 8 the inclusions are equalities.

Proof: Straightforward. □

Each collection [[K]] of HOPERs has a maximal element under the ordering ⊆^{K}. This element is written ⊤^{K} and can be calculated as follows: ⊤^{⋆} is the total relation on D and ⊤^{K_{1}→K_{2}} = λP ∈[[K_{1}]]. ⊤^{K_{2}}.

Fact 5.3.2 Let A ∈ [[K]]. Then:

1. A ⊆^{K} ⊤^{K}.

2. ⊤^{K} ⊆^{K} A implies A = ⊤^{K}.

5.4 HOPER interpretation of F_{∧}^{ω}

An environment η is a finite function from type variables to HOPERs and from term variables to elements of D. The notations for environment extension, restriction, and agreement are carried over from term environments. By an abuse of notation, type environments are used in place of term environments from now on.

The erasure of an F_{∧}^{ω} term e, written erase(e), is the pure λ-term defined as follows:

erase(x)  = x
erase(λx:T.e)  = λ(x)erase(e)
erase(e_{1} e_{2})  = erase(e_{1}) erase(e_{2})
erase(λX≤T:K.e)  = erase(e)
erase(e T)  = erase(e)
erase(for(X∈T_{1}..T_{n})e) = erase(e).

Let η be a term environment and e an expression such that FV(e) ⊆ dom(η). Then the interpretation of e under η, written [[e]]_{η}, is [[|erase(e)|]]_{η}.

5.4. HOPER INTERPRETATION OF F_{∧}^{ω} 95

If η is an environment and T a type expression such that FTV(T) ⊆ dom(η), then the interpretation of T under η, written [[T]]_{η}, is the HOPER defined as follows:

\begin{aligned}[[X]]_{η} & = & η(X) \\ [[T_{1} → T_{2}]]_{η} & = & [[T_{1}]]_{η} → [[T_{2}]]_{η} \\ [[∀X≤T_{1}:K_{1}.T_{2}]]_{η} & = & ⋂_{P ⊆^{K_{1}}[[T_{1}]]_{η}}^{⋆} [[T_{2}]]_{η[X←P]} \\ [[⋀^{K}[T_{1}..T_{n}]]]_{η} & = & ⋂_{1≤i≤n}^{K} [[T_{i}]]_{η} \\ [[S T]]_{η} & = & [[S]]_{η} [[T]]_{η} \\ [[ΛX:K.T]]_{η} & = & λP ∈[[K]]. [[T]]_{η[X←P]} \end{aligned}

We say that an environment η satisfies a context Γ, written η ⊧ Γ, if dom(η) = dom(Γ) and

1. Γ ≡ ∅; or

2. Γ ≡ Γ_{1}, x:T, where η\x satisfies Γ_{1} and either [[T]]_{η\x}↑ or η(x) ∈ dom([[T]]_{η\x}); or

3. Γ ≡ Γ_{1}, X≤T:K, where η\X satisfies Γ_{1} and either [[T]]_{η\X}↑ or η(X) ⊆^{K} [[T]]_{η\X}.

Iterating the definition immediately yields that either [[T]]_{η\Γ_{2}\X}↑ or [[T]]_{η\Γ_{2}\X} ∈ [[K]], whenever η ⊧ Γ_{1}, X≤T:K, Γ_{2}. Also, note that if η′ extends η and FTV(T) ⊆ dom(η), then either [[T]]_{η}↑ and [[T]]_{η′}↑, or else both are defined and [[T]]_{η} = [[T]]_{η′}.

Lemma 5.4.1 Let T be a type, Γ a context, and η an environment such that FTV(T) ⊆ dom(η) and η ⊧ Γ. If Γ ⊢ T ∈ K, then [[T]]_{η}↓ and [[T]]_{η} ∈ [[K]].

Proof: We need to check the desired result together with an additional fact:

1. If Γ ⊢ T ∈ K, then [[T]]_{η} is defined and [[T]]_{η} ∈ [[K]].

2. If Γ_{1}, X≤T:K, Γ_{2} ⊢ ok, then [[T]]_{η\Γ_{2}\X}↓ and [[T]]_{η\Γ_{2}\X} ∈ [[K]].

The two are proved by simultaneous induction on derivations. We give only the interesting cases; the rest follow by straightforward use of the induction hypothesis and simple properties of HOPERs.

1. K-TVar We are given that Γ ≡ Γ_{1}, X≤T:K, Γ_{2} and that Γ ⊢ ok. By part 2 of the induction hypothesis, [[T]]_{η\Γ_{2}\X}↓. By the definition of satisfaction, (η\Γ_{2})(X) ⊆^{K} [[T]]_{η\Γ_{2}\X}, which implies in particular that η(X) ∈ [[K]]. By the definition of interpretation, [[X]]_{η} = η(X) ∈ [[K]].

K-All We are given that K ≡ ⋆ and T ≡ ∀X≤T_{1}:K_{1}.T_{2}, and that Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆. By lemma 2.4.1, there exists a shorter derivation of Γ, X≤T_{1}:K_{1} ⊢ ok, and, by part 2 of the induction hypothesis, we have that [[T_{1}]]_{η}↓ and [[T_{1}]]_{η} ∈ [[K_{1}]]. Now, suppose P ⊆^{K_{1}} [[T_{1}]]_{η}. Then the definition of satisfaction yields η[X←P] ⊧ Γ, X≤T_{1}:K_{1}. By part 1 of the induction hypothesis, [[T_{2}]]_{η[X←P]}↓ and [[T_{2}]]_{η[X←P]} ∈ [[ ⋆ ]]. Since PER is closed under intersections, [[T]]_{η} = ⋂_{P ⊆^{K_{1}}[[T_{1}]]_{η}}^{⋆} [[T_{2}]]_{η[X←P]} ∈ [[ ⋆]].

K-OAbs Similar.

2. C-Var We are given that Γ ≡ Γ′, x:S, where Γ′ ≡ Γ_{1}, X≤T:K, Γ′_{2} and that Γ′ ⊢ S ∈ ⋆. By lemma 2.4.1, Γ′ ⊢ ok. By the definition of satisfaction, η\x ⊧ Γ′. By the induction hypothesis, the result follows.

C-TVar The case where Γ_{2} ≢ ∅ is similar to the previous case. When Γ_{2} ≡ ∅, we are given that Γ ≡ Γ_{1}, X≤T:K and that Γ_{1} ⊢ T ∈ K. By the definition of satisfaction, η\X ⊧ Γ′. By the induction hypothesis, the result follows. □

In order to prove the soundness of subtyping we need some technical results about substitution and β-conversion.

Lemma 5.4.2

Let η be an environment with X ∉ dom(η) and such that FTV(S[X←T]) ⊆ dom(η) and [[S]]_{η[X←[[T]]_{η}]}↓. Then [[S[X←T]]]_{η} = [[S]]_{η[X←[[T]]_{η}]}.

Proof: By induction on the structure of S. □

Lemma 5.4.3 Let η be an environment such that FTV(S) ⊆ dom(η). If S =_{β∧} T and [[S]]_{η}↓, then [[S]]_{η} = [[T]]_{η}.

Proof: By induction on the definition of β∧-conversion, it is easy to see that it suffices to show the statement for a one-step reduction S →_{β∧} T. This is proved by induction on the structure of S. The only interesting cases are when S is a β∧-redex and T its reduct. Let S ≡ (ΛX:K.T_{2}T_{1} and T ≡ T_{1}[X←T_{2}]. Then

[[(ΛX:K.T_{2}T_{1}]]_{η} = (λP ∈[[K]]. [[T_{2}]]_{η[X←P]})[[T_{1}]]_{η} by definition of [[ −]]_{η}
= [[T_{2}]]_{η[X←[[T_{1}]]_{η}]}
= [[T_{2}[X←T_{1}]]]_{η}  by lemma 5.4.2.

For the other redexes the result follows from lemma 5.3.1 given that for items 4 through 8 the inclusions are equalities. □

Our main semantic results are the soundness of subtyping and typing.

Theorem 5.4.4 (Soundness of subtyping) If Γ ⊢ S ≤ T and Γ ⊢ S ∈ K, and if η ⊧ Γ, then [[S]]_{η} ⊆^{K} [[T]]_{η}.

Proof: The proof proceeds by induction on the structure of a derivation of Γ ⊢ S ≤ T. For the sake of readability, we often make implicit use of the fact that if Γ ⊢ S ≤ T and Γ ⊢ S ∈ K, then, by proposition 2.4.19 and lemmas 2.4.7 and 5.4.1, [[S]]_{η} and [[T]]_{η} are defined and belong to [[K]] whenever η ⊧ Γ. S-Conv We are given that S =_{β∧} T. Then, by lemma 5.4.3, [[S]]_{η} = [[T]]_{η}

S-Trans By the induction hypothesis and the transitivity of ⊆^{K} (lemma 5.3.1).

S-TVar We are given Γ_{1}, X≤T:K, Γ_{2} ⊢ ok. Now, [[X]]_{η} = η(X) ⊆^{K} [[T]]_{η\X}, because η ⊧ Γ and, as η extends η\X, [[T]]_{η\X} = [[T]]_{η}.

S-Arrow We are given Γ ⊢ T_{1} ≤ S_{1} and Γ ⊢ S_{2} ≤ T_{2}, with Γ ⊢ S_{1}→S_{2} ∈ ⋆. By the uniqueness of kinds (lemma 2.4.7), K ≡ ⋆. Now by the wellkindedness of subtyping (proposition 2.4.19) and syntax directedness of kinds (proposition 2.4.6) we have Γ ⊢ S_{2}, T_{1} ∈ ⋆. By the induction hypothesis, [[S_{2}]]_{η} ⊆^{⋆} [[T_{2}]]_{η} and [[T_{1}]]_{η} ⊆^{⋆} [[S_{1}]]_{η}. Hence, by the covariance on the right and contravariance on the left of the function space constructor on PERs (easily verified from its definition), [[S_{1}]]_{η}→[[S_{2}]]_{η} ⊆^{⋆} [[T_{1}]]_{η}→[[T_{2}]]_{η}, i.e. [[S_{1}→S_{2}]]_{η} ⊆^{⋆} [[T_{1}→T_{2}]]_{η}.

S-All We are given that

\begin{matrix}Γ, X≤U:K_{1} ⊢ S_{2} ≤ T_{2} and \\ Γ ⊢ ∀X≤U:K_{1}.S_{2} ∈ ⋆. \end{matrix}

By proposition 2.4.6, Γ, X≤U:K_{1} ⊢ S_{2} ∈ ⋆. Let P ∈ [[U]]_{η}. Then, by the definition of satisfaction, η[X←P] ⊧ Γ, X≤U:K_{1}. Now, by the induction hypothesis, it follows that [[S_{2}]]_{η[X←P]} ⊆^{⋆} [[T_{2}]]_{η[X←P]}. Hence, ⋂_{P ⊆^{K_{1}}[[U]]_{η}}^{⋆} [[S_{2}]]_{η[X←P]} ⊆^{⋆} ⋂_{P ⊆^{K_{1}}[[U]]_{η}}^{⋆} [[T_{2}]]_{η[X←P]}. Consequently, [[∀X≤U:K_{1}.S_{2}]]_{η} ⊆^{⋆} [[∀X≤U:K_{1}.T_{2}]]_{η}.

S-OAbs We are given Γ, X≤⊤^{K_{1}}:K_{1} ⊢ S ≤ T and Γ ⊢ ΛX:K_{1}.S ∈ K. By the syntax-directedness of kinding, K ≡ K_{1}→K_{2} and Γ, X≤⊤^{K_{1}}:K_{1} ⊢ S ∈ K_{2} for some K_{2}. If P ∈ [[K_{1}]]_{η} then η[X←P] ⊧ Γ, X≤⊤^{K_{1}}:K_{1}. Now by the induction hypothesis, [[S]]_{η[X←P]} ⊆^{K_{2}} [[T]]_{η[X←P]}. Then λP ∈ [[K_{1}]]. [[S]]_{η[X←P]} ⊆^{K_{1}→K_{2}} λP ∈[[K_{1}]]. [[T]]_{η[X←P]}. Consequently, [[ΛX:K_{1}.S]]_{η} ⊆^{K_{1}→K_{2}} [[ΛX:K_{1}.T]]_{η}.

S-OApp By induction hypothesis, using the syntax-directedness of kinding.

S-Meet-G By the induction hypothesis and lemma 5.3.1(3).

S-Meet-LB By lemma 5.3.1(4). □

The type context Γ/T V obtained from a context Γ is defined in the obvious way:

∅/T V = ∅,
(Γ, x:T)/T V = Γ/T V,
(Γ, X≤T:K)/T V = Γ/T V , X≤T:K.

Theorem 5.4.5 Let η_{1} ⊧ Γ and η_{2} ⊧ Γ, such that η_{1}/T V = η_{2}/T V and, for all x∈dom(Γ), η_{1}(x) {[[Γ(x)]]_{η}} η_{2}(x), where η = η_{1}/T V. Then [[e]]_{η_{1}} {[[T]]_{η}} [[e]]_{η_{2}}.

Proof: From Γ ⊢ e ∈ T it follows by the well-kindedness of typing (proposition 2.4.20) that Γ ⊢ T ∈ ⋆. Note that FTV(T) ⊆ dom(Γ/T V); then, by strengthening (lemma 2.4.5), Γ/T V ⊢ T ∈ ⋆. Note also that η ⊧ Γ/T V; by lemma 5.4.1, [[T]]_{η} is defined and in [[ ⋆]]. We often use this fact implicitly in the following. The proof now proceeds by induction on a derivation of Γ ⊢ e ∈ T.

T-Var From the assumption that for every x in dom(Γ). η_{1}(x) {[[Γ(x)]]_{η}} η_{2}(x).

T-Abs We are given that Γ, x:T_{1} ⊢ e ∈ T_{2}. Suppose that p ∈ D and q ∈ D are such that p {[[T_{1}]]_{η}} q. Then η_{1}[x←p] ⊧ Γ, x:T_{1} and η_{2}[x←q] ⊧ Γ, x:T_{1}. By the induction hypothesis, [[e]]_{η_{1}[x←p]} {[[T_{2}]]_{η}} [[e]]_{η_{2}[x←q]}, that is, [[|erase(e)|]]_{η_{1}[x←p]} {[[T_{2}]]_{η}} [[|erase(e)|]]_{η_{2}[x←q]}. From lemma 5.2.1(2) it follows that [[fun^{⋆} (x) |erase(e)|]]_{η_{1}}. p {[[T_{2}]]_{η}} [[fun^{⋆} (x) |erase(e)|]]_{η_{2}}. q, that is, [[λx:T_{1}.e]]_{η_{1}}. p {[[T_{2}]]_{η}} [[λx:T_{1}.e]]_{η_{2}}. q. Since p and q were chosen freely, we have that[[λx:T_{1}.e]]_{η_{1}} {[[T_{1}]]_{η}→[[T_{2}]]_{η}} [[λx:T_{1}.e]]_{η_{2}}, in other words [[λx:T_{1}.e]]_{η_{1}} {[[T_{1}→T_{2}]]_{η}} [[λx:T_{1}.e]]_{η_{2}}.

T-App By the induction hypothesis, using the fact that [[fa]]_{η} = [[f]]_{η}[[a]]_{η}.

T-TAbs We are given that Γ, X≤T_{1}:K_{1} ⊢ e ∈ T_{2}. Suppose that P ⊆^{K_{1}} [[T_{1}]]_{η}. Then it follows that η_{1}[X←P] ⊧ Γ, X≤T_{1}:K_{1} and that η_{2}[X←P] ⊧ Γ, X≤T_{1}:K_{1}. Since [[e]]_{η_{1}} = [[e]]_{η_{1}[X←P]}, we have by the induction hypothesis that [[e]]_{η_{1}} {[[T_{2}]]_{η[X←P]}} [[e]]_{η_{2}}. Since P was chosen freely, we have that [[e]]_{η_{1}} {⋂_{P ⊆^{K_{1}}[[T_{1}]]_{η}}^{⋆} [[T_{2}]]_{η[X←P]}} [[e]]_{η_{2}}. Now the result follows from the definition [[ −]]_{η} and the fact that [[λX≤T_{1}:K_{1}.e]]_{η} = [[e]]_{η} = [[e]]_{η[X←P]}.

T-TApp We are given that Γ ⊢ f ∈ ∀X≤T_{1}:K_{1}.T_{2} and that Γ ⊢ S ≤ T_{1}. By the induction hypothesis, [[f]]_{η_{1}} {[[∀X≤T_{1}:K_{1}.]]_{η}} [[f]]_{η_{2}}, which means that, [[f]]_{η_{1}} {⋂_{P ⊆^{K_{1}}}^{⋆} [[T_{2}]]_{η[X←P]}} [[f]]_{η_{2}}. By the well-kindedness of typing, syntax directedness of kinds, and well-kindedness of subtyping, Γ ⊢ S ∈ K_{1}, and, by soundness of subtyping, [[S]]_{η} ⊆^{K_{1}} [[T_{1}]]_{η}. So we have [[f]]_{η_{1}} {[[T_{2}]]_{η[X←[[S]]_{η}]}} [[f]]_{η_{2}}, which, by lemma 5.4.2 and the fact that [[f]]_{η} = [[fS]]_{η} for any η, is [[fS]]_{η_{1}} {[[T_{2}[X←S]]]_{η}} [[fS]]_{η_{2}}.

T-For Immediate from the induction hypothesis, because erase(e[X←S]) = erase(e).

T-Meet We are given that Γ ⊢ ok and also Γ ⊢ e ∈ T_{i} for each i in {1 .. n}. The result follows by the induction hypothesis and the definitions of ^{⋂⋆} and [[ −]]_{η}.

T-Sub We are given that Γ ⊢ e ∈ S and that Γ ⊢ S ≤ T. By the induction hypothesis, [[e]]_{η_{1}} {[[S]]_{η}} [[e]]_{η_{2}}. By well-kindedness of typing Γ ⊢ S ∈ ⋆, and by the soundness of subtyping [[S]]_{η} ⊆^{⋆} [[T]]_{η}. Hence, [[e]]_{η_{1}} {[[T]]_{η}} [[e]]_{η_{2}}. □

5.4. HOPER INTERPRETATION OF F_{∧}^{ω} 99 Corollary 5.4.6 (Soundness of typing) Let η be an environment such that η ⊧ Γ. Then Γ ⊢ e ∈ T implies [[e]]_{η}∈dom([[T]]_{η}). Proof: Take η_{1} = η_{2} = η. □

100 CHAPTER 5. A PER MODEL FOR F_{∧}^{ω}

Multiple Inheritance

6.1 Introduction

This chapter is extracted from [CP93]. The reader is invited to read [Bru94, FM94, PT94] for a complete account on the foundations of object-oriented programming. Here we intend to illustrate how the concept of multiple inheritance is captured by intersection types. We use records and record types which are not part of the syntax of F_{∧}^{ω}. The reader is referred to [Car92] for an implementation of records in a typed lambda calculus.

Informally, in class based object-oriented programming there are entities called objects which are organised in classes, and each class of objects is associated with a set of functions or methods. This set of methods is known as the interface of the objects of a class. The use of a method of the interface to access an object is called message passing. A suitable type theory for an object-oriented programming discipline should prevent access to objects other than through the corresponding interface. This protection against illegal access is known as encapsulation.

Existing classes may be used to create new ones. In this way, classes are organised in a hierarchy or genealogy, where ancestors are super-classes and descendants are subclasses. The mechanism through which a subclass of objects use methods of a superclass is known as inheritance. So far we used the word class as a synonym of collection. In the sequel the word class is used formally to refer to a term of the F_{∧}^{ω} language.

The common goal of studies in this area is to prove the safety of a type system describing a set of high-level syntactic constructs for object encapsulation, message passing, and inheritance. Our approach consists of translating the high-level syntax into a more conventional λ-calculus, whose own type-safety is established separately; the soundness of the typing rules for the object features then follows from the soundness of the target system. So, for example, the keyword new, which by itself does not represent any entity in an object-oriented programming language, is interpreted as a term which given suitable arguments creates an object. One advantage of this style is that we can verify type safety automatically using a type checker for the underlying λ-calculus.

The object model of Pierce and Turner [PT94], on which the present study is based, encodes objects as expressions of F_{≤}^{ω}, an extension of Girard’s System F^{ω} [Gir72] with bounded quantification. Given a description M of a public interface — the names and types of a set of methods — the type Object(M) denotes the type of objects satisfying this description. Technically, object interfaces are type operators of kind ⋆→⋆, maps from types to types, and Object∈ (⋆→⋆) → ⋆ is a higher-order constructor. See sections 6.2 and 6.3 for details and [PT94] for a longer discussion. For example, if PointM describes the interface of one-dimensional point objects responding to the messages setX and getX then Object(PointM) is the type of points. Associated with each such collection of objects is a group of functions for sending messages, with types like:

    Point'setX  :  All(M < PointM)
                             Object(M) -> Int -> Object(M)

The bounded quantifier All(M<PointM) expresses the fact that the message setX can actually be sent to any object whose interface refines the interface of points. Given such an object and an integer representing its new x-coordinate, Point'setX returns a new object with an appropriately updated position. The foregoing accounts for the fundamental features of object encapsulation and interface refinement (and correctly handles their interaction; this is the difficult part). But it omits some characteristic features of popular object-oriented languages, notably inheritance.

In general terms, inheritance is a mechanism allowing the implementations of different sorts of objects that share some of their behavior to be factored so that the common behavior is written just once.

In our framework a class is a term containing the type of the internal representation of objects its objects, a default value for the private data and an implementation of the methods. Therefore, a class can be used in two ways: as a template for creating new objects, because it has a default value and the set of methods which is all that is needed to create an object, and as the basis for defining subclasses by incremental extension of the set of methods. If M is an object interface, then Class(M) is the type of classes that can be used to create objects of type Object(M). The polymorphic function new maps a class into a new object:

    new : All(M:*->*) Class(M) -> Object(M)

Another function, extend, takes an existing class and a description of some new methods and constructs a new class combining the old and new behaviors:

    extend : All(SuperM:*->*)
             All(SelfM<SuperM)
               Class(SuperM) -> ... -> Class(SelfM)

(The details hidden here by ... are revealed in the following section and section 6.3.) The bounded quantifier All(SelfM<SuperM) ensures that the interface of the new class refines that of the old: Object(SelfM) is a subtype of

Object(SuperM).

To handle multiple inheritance in this setting, we must enrich the extend function to take two or more superclasses as arguments. Consider the case where the new class inherits methods from two superclasses. This version — call it extend2 (there will be an analogous one for each n) — should have a type like:

 extend2 : All(SuperM1:*->*)    % the interface of one superclass
           All(SuperM2:*->*)    % the interface of the other superclass
           All(SelfM<???)       % the interface of the class being built
                Class(SuperM1)  % the first superclass
             -> Class(SuperM2)  % the second superclass
             -> ...             % (how to build the new class)
             -> Class(SelfM)    % the new class itself

But the upper bound of SelfM presents a problem: we must ensure that SelfM is a subtype of both SuperM1 and SuperM2, which falls outside the expressive scope of our target λ-calculus F_{≤}^{ω}.

Intuitively, what we want to write is

   extend2 : All(SuperM1:*->*) All(SuperM2:*->*)
             All(SelfM < SuperM1 "and" SuperM2)
                  Class(SuperM1)
               -> Class(SuperM2)
               -> ...
               -> Class(SelfM)

where, informally, "and" forms the conjunction of the two superclass specifications. Fortunately, a type constructor with exactly this meaning has already appeared in the literature. First-order type systems with intersection types have been investigated by the group in Torino [CDC78, BCD83] and elsewhere. (See [CC90] for background and further references.) A second-order λ-calculus with intersection types was studied by Pierce [Pie91]. The calculus needed here is the ω-order extension of this system.

A type system combining intersection types with a powerful form of polymorphism is of independent interest. Reynolds [Rey88] has argued that intersection types can form the basis of elegant language designs. But his Forsythe language has only a first-order type system, and thus lacks some of the expressive possibilities of polymorphic languages like ML. Our work represents a step toward a synthesis of these styles of language design.

The following section shows some examples of multiple inheritance using a simple high-level syntax, and section 6.3 develops an implementation of inheritance in this setting.

6.2 An example of multiple inheritance

We begin by recalling the encodings of some basic concepts of object-oriented programming in F_{≤}^{ω} and showing a simple example of multiple inheritance in this setting.

In this setting, an object interface specification is modelled as a function from types to types, describing the behaviors of a collection of methods as transformations on the object’s internal state. For example, the interface of one-dimensional point objects supporting the messages getX, setX, and bump is captured by the type operator

# PointM = Fun(Rep){| setX: Rep->Int->Rep,
#                     getX: Rep->Int,
#                     bump: Rep->Rep |};
PointM : *->*

which expresses the fact that the getX method of a point interrogates its internal state and returns an integer, that the set method transforms the internal state and a new position into an updated internal state, and that bump, which increases the position by one, maps one internal state to another. (The # in the left-hand margin indicates that this expression has been checked by our implementation; the typechecker’s response follows.) The abstraction over the type Rep of the internal state hides the actual internal state from outside view. Concretely, a point whose internal state type is {|x:Int|} — a one-field record containing an integer — will contain a record of methods with types

   {|  setX: {|x:Int|} -> Int -> {|x:Int|},
       getX: {|x:Int|} -> Int,
       bump: {|x:Int|} -> {|x:Int|}         |}

while a point whose internal state type is richer, say {|x:Int,y:Int|}, will have correspondingly richer concrete types for its methods:

   {|  setX: {|x:Int,y:Int|} -> Int -> {|x:Int,y:Int|},
       getX: {|x:Int,y:Int|} -> Int,
       bump: {|x:Int,y:Int|} -> {|x:Int,y:Int|}          |}

Externally, we expect the difference between these two to be invisible; thus, the public interface to the methods, PointM, abstracts away from any particular representation type. Both point objects are elements of the type Object(PointM). (For present purposes, it is not important how Object itself is defined. C.f. [PT94, HP95].)

New objects are created by applying the polymorphic function new to a class. Given an interface M and a class for this interface — that is, a class whose instances are objects with interface M — new creates and returns such an object. New classes, in turn, are created by applying the polymorphic function extend to an existing class along with a specification of an incremental change to its behavior:

extend = <val>
       : All(SuperM)
         All(SelfM<SuperM)
         All(SelfDiffR)
              (Class SuperM)
           -> SelfDiffR

        -> (All(FinalR)
                (Extractor FinalR SelfDiffR)
              ->(SuperM FinalR)
              ->(SelfM FinalR)
              ->(SelfM FinalR))
        -> (Class SelfM)

In detail, the arguments expected by extend comprise:

• The interface SuperM of the existing class.

• The interface SelfM of the new class that will be returned by extend.

• The type SelfDiffR, which describes the difference between the representation of the superclass (whatever it may be) and the representation of the new class. In conventional terminology, this is the set of new instance variables introduced by the subclass.

• The superclass itself — an element of Class(SuperM) (our typechecker prints

  it as Class SuperM).

• An initial value — an element of SelfDiffR — for the new part of the state.

• A polymorphic “method builder” function.

Given all these, extend returns a class for the interface SelfM.

The method builder function, which does the work of constructing the vector of methods to be used in instances of the new class, must itself take several parameters:

• The “final” representation type FinalR, which is fixed at the moment when new is applied to a class.

• An “extractor,” which provides a mapping back and forth between the final representation type and the local representation type, allowing the local methods to access the part of the state that interests them.

• The “super methods” of the existing class.

• The “self methods” of the new class, which are used to model the characteristic object-oriented feature of “sending a message to self.”

Given these, the method builder must return a collection of methods for the new object.

For uniformity, let us assume that there is just one base class — the class of “things,” whose instances are objects with no behavior at all:

# ThingM = Fun(Rep) {| |};
ThingM : *->*
thingClass = <val> : Class ThingM

106 CHAPTER 6. MULTIPLE INHERITANCE

To build a class of points extending thingClass, we first choose the “local” part of the representation of points.

# PointDiffR = {| x:Int |};
PointDiffR : *

Now we create pointClass by applying extend as follows (see section 6.3 for more details).

# pointClass =
#  extend
#   ThingM                            % superclass interface
#   PointM                            % interface for new class
#   PointDiffR                        % local state type
#   thingClass                        % the superclass itself
#   { x = 0 }                         % initial value for local state
#   (fun(FinalR)                      % "method builder" function...
#    fun(e: Extractor FinalR PointDiffR)  % mapping a "state extractor"
#    fun(super: ThingM FinalR)            % and the "super methods"
#    fun(self: PointM FinalR)             % and the "self methods"
#      {getX = fun(s:FinalR)              % to a getX method
#                (e.get s).x,             %   that returns
#                                         %   the local x field
#       setX = fun(s:FinalR)              % and a setX method
#                fun(i:Int) e.put s {x=i},%   that overwrites
#                                         %   the x field
#       bump = fun(s:FinalR)              % and a bump method
#                self.setX s              %   that calls setX on self
#                  (plus (self.getX s) 1) %   to set x to one more
#      });                                %   than self.getX
pointClass = <val> : Class PointM

Of course, this definition of pointClass is quite verbose. It is not hard to design higher-level syntax for objects, message passing, and class extension that looks like ordinary object-oriented source code, but since we are building a foundational model here, we prefer the low-level notation.

Similarly, we can define the interface for “colored objects” — objects supporting the messages setC and getC — as follows:

# ColoredM = Fun(Rep) {| setC: Rep->Color->Rep, getC: Rep->Color |};
ColoredM : *->*

Again, one instance variable suffices to represent the color of a colored object:

# ColoredDiffR = {| c:Color |};
ColoredDiffR : *

A class of colored objects can now be created by extending thingClass as we did

to build pointClass:

6.2. AN EXAMPLE OF MULTIPLE INHERITANCE 107

# coloredClass =
#   extend ThingM ColoredM ColoredDiffR thingClass
#   { c = black }
#   (fun(FinalR)
#    fun(e: Extractor FinalR ColoredDiffR)
#    fun(super: ThingM FinalR)
#    fun(self: ColoredM FinalR)
#      {getC = fun(s:FinalR) (e.get s).c,
#       setC = fun(s:FinalR) fun(newc:Color) e.put s {c=newc}
#      });
coloredClass = <val> : Class ColoredM

Now we have reached the point where we can use multiple inheritance to combine the classes of point objects and colored objects, yielding a new class of colored points. The interface of colored points contains all the messages of both superclasses:

# CPointM = Fun(Rep) {| setX: Rep->Int->Rep,
#                       getX: Rep->Int,
#                       bump: Rep->Rep,
#                       setC: Rep->Color->Rep,
#                       getC: Rep->Color |};
CPointM : *->*

For this simple implementation, no additional instance variables are needed: we

can set CPointDiffR = {| |}.

To make the example more interesting, we take the methods getX, setC, and getC unchanged from the superclasses, while overriding the definition of setX so that, in addition to setting the x coordinate as usual, it also sets the color to, say, blue:

# cpointClass =
#   extend2 PointM ColoredM CPointM
#     CPointDiffR pointClass coloredClass { }
#     (fun(FinalR)
#      fun(e: Extractor FinalR CPointDiffR)
#      fun(super1: PointM FinalR)
#      fun(super2: ColoredM FinalR)
#      fun(self: CPointM FinalR)
#       {setX = fun(s:FinalR) fun(i:Int)% the new setX method:
#         let s1 = super1.setX s i in   % use pointClass's setX
#                                       % to set position
#         let s2 = super2.setC s1 blue  % and coloredClass's setC
#                                       % to set color
#         in s2   end end,
#        getX = super1.getX,            % copy all the remaining
#        bump = super1.bump,            % methods from the
#        setC = super2.setC,            % appropriate superclass
#        getC = super2.getC

#       });
cpointClass = <val> : Class CPointM

Here, the low level at which we are working is reflected in the fact that the old methods getX, bump, setC, and getC must be copied explicitly from the superclasses to the new class. Introducing high-level syntax for multiple inheritance would, of course, raise all the usual questions (must each inherited method appear in only one of the superclasses? if it appears in more than one, which should be copied to the subclass? etc.), for which the usual solutions will apply.

To test what we have done, let’s build a colored point and send it some messages:

# p = new CPointM cpointClass;
p = <val> : Object CPointM
# Colored'getC CPointM p;
black : Color
# p1 = Point'bump CPointM p;
p1 = <val> : Object CPointM
# Point'getX CPointM p1;
1 : Int
# Colored'getC CPointM p1;
blue : Color

Note that sending our colored point the bump method has the effect of changing its color to blue: the overridden behavior of the setX method is observable in the behavior of bump method, even though bump was not redefined in the subclass.

6.3 Encoding multiple inheritance

We close with a full implementation of the extend2 function, generalising the extend function in section 7 of [PT94]. As we suggested in the introduction, an intersection type must be used at one point (marked *** in the definition of extend) to obtain a sound typing; the rest is straightforward.

This implementation of classes and inheritance makes the local state of each class inaccessible both to clients of objects and to methods defined in subclasses. Other variations are possible; we chose this one to simplify the presentation of section 6.2.

If M is an object interface — an operator of kind *->* — then Class(M) is the set of classes whose instances have type Object(M). Each such class consists of a local representation type MyR (whose identity is hidden by an existential quantifier), an element initstate∈MyR that is used as the initial value of the state in new objects created from this class, and a function buildM that can be used to construct the methods of the new objects:

# Class =
#   Fun(M:*->*)
#     Some(R)

#       {| initstate: R,
#          buildM: ClassMethods M R |};
Class : (*->*)->*

To cope with different representations of local state in subclasses, the methodbuilding function is abstracted on two parameters: a type FinalR representing the “full” state of an eventual subclass, and an “extractor” giving access to the components of interest to the methods being built. The method builder is also abstracted on a collection of self-methods of the same types as its own methods. Given these, it yields a concrete collection of methods specialized to work properly in an object with representation type FinalR:

# ClassMethods =
#   Fun(MyM:*->*)
#   Fun(MyR)
#     All(FinalR)
#     (Extractor FinalR MyR) ->
#     (MyM(FinalR)) ->
#     (MyM(FinalR));
ClassMethods : (*->*)->*->*

Finally, an extractor is just a pair of maps, get and put.

# Extractor = Fun(SS) Fun(TT) {| get: SS->TT, put: SS->TT->SS |};
Extractor : *->*->*

Intuitively, get extracts the “superclass part” of an element of a subclass’s state, while put overwrites the superclass part, yielding a new subclass state.

For example, the point class of section 6.2 can be defined directly (rather than as an extension of thingClass) as follows:

# pointClass =
#   < {|x:Int|},
#     {initstate = {x=0},
#      buildM = fun(FinalR)
#               fun(e: Extractor FinalR {|x:Int|})
#               fun(self: PointM FinalR)
#                 {getX = fun(s:FinalR) (e.get s).x,
#                  setX = fun(s:FinalR) fun(i:Int) e.put s {x=i},
#                  bump = fun(s:FinalR) e.put s {x = plus 1 (e.get s).x}
#                 }}
#    > : Class PointM;
pointClass = <val> : Class PointM

(We use the ascii syntax “<R,b>:T” for introducing elements of existential types: R is the hidden witness type, b is the body, and T is the existential type where the result is to live. The corresponding elimination form is written “open e as <R,x> in b.”)

A class with two superclasses generates objects whose internal states have three parts: one for each superclass and one for the new components local to the class itself. For example, an instance of cpointClass contains a point state of type {|x:Int|}, a colored-object state of type {|c:Color|}, and an empty local state. The extend2 function takes two classes, an initial local state, and a function for incrementally building a collection of new methods from the old ones, and constructs a subclass of this form.

# extend2 =                             %Arguments:
#  fun(SuperM1: *->*)                       %first superclass interface
#  fun(SuperM2: *->*)                       %second superclass interface
#  fun(MyM < SuperM1/\SuperM2)     %***     %new subclass interface
#  fun(MyLocalR: *)                         %local state type
#  fun(superClass1: Class SuperM1)          %first superclass
#  fun(superClass2: Class SuperM2)          %second superclass
#  fun(myinitstate: MyLocalR)               %initial local state
#  fun(mymethods:                           %incr method extension fun
#                                           %with arguments
#         All(FinalR)                         %a final rep type
#           (Extractor FinalR MyLocalR) ->    %an extractor
#                                             %for the local state
#           (SuperM1(FinalR)) ->              %the first superclass's
#                                             %methods
#           (SuperM2(FinalR)) ->              %the second superclass's
#                                             %methods
#           (MyM(FinalR)) ->                  %the self-methods
#           (MyM(FinalR)))                    %returning the new methods
#  open superClass1
#       as <SuperR1,superData1> in          %open the first superclass
#  open superClass2
#       as <SuperR2,superData2> in          %open the second superclass
#  let MyR =                                %define the new state type
#       Triple SuperR1 SuperR2 MyLocalR in  %(a triple)
#   <                                    %Result: a new class
#    MyR,                                   %with state type MyR
#    {initstate =                           %and initial state
#         triple SuperR1 SuperR2 MyLocalR   %a triple of
#                    (superData1.initstate)   %first super's
#                                             %initial state
#                    (superData2.initstate)   %second super's
#                                             %initial state
#                    myinitstate,             %local initial state
#     buildM =                              %and method-builder,
#                                           %a fun with args
#      fun(FinalR)                            %a final rep type
#      fun(e: Extractor FinalR MyR)           %an extractor
#      fun(self: MyM(FinalR))                 %and a collection
#        let eself =                          %of self-methods...
#          composeExtractors
#             FinalR MyR MyLocalR e

6.3. ENCODING MULTIPLE INHERITANCE 111

#             (extract3of3 SuperR1 SuperR2 MyLocalR) in
#        let esuper1 =
#          composeExtractors
#             FinalR MyR SuperR1 e
#             (extract1of3 SuperR1 SuperR2 MyLocalR) in
#        let esuper2 =
#          composeExtractors
#             FinalR MyR SuperR2 e
#             (extract2of3 SuperR1 SuperR2 MyLocalR) in
#        mymethods FinalR eself             %returning
#                                           %methods built by mymethods
#         (superData1.buildM FinalR esuper1 self)%when applied to
#                                                %concrete methods
#         (superData2.buildM FinalR esuper2 self)%of the superclasses
#          self                                  %and the self-methods
#        end end end}
#    > : Class MyM
#   end end end;
extend2 = <val>
        : All(SuperM1)
          All(SuperM2)
          All(MyM<SuperM1/\SuperM2)
          All(MyLocalR)
               (Class SuperM1)
            -> (Class SuperM2)
            -> MyLocalR
            -> (All(FinalR)
                    (Extractor FinalR MyLocalR)
                  ->(SuperM1 FinalR)
                  ->(SuperM2 FinalR)
                  ->(MyM FinalR)
                  ->(MyM FinalR))
            -> (Class MyM)

This definition uses a utility function for composing extractors in the obvious way:

# composeExtractors =
#   fun(T1) fun(T2) fun(T3)
#     fun(e1: Extractor T1 T2)
#       fun(e2: Extractor T2 T3)
#         {get = fun(t1:T1) e2.get (e1.get t1),
#          put = fun(t1:T1) fun(t3:T3)
#                  e1.put t1 (e2.put (e1.get t1) t3)};
composeExtractors = <val>
                  : All(T1)
                    All(T2)
                    All(T3)
                         (Extractor T1 T2)
                      -> (Extractor T2 T3)

                      -> {|get:T1->T3, put:T1->T3->T1|}

For forming triples, we use the type abbreviation

# Triple = Fun(T1) Fun(T2) Fun(T3) {| fst:T1, snd:T2, thd:T3 |};
Triple : *->*->*->*

with the constructor

# triple =
#   fun(T1) fun(T2) fun(T3)
#   fun(t1:T1) fun(t2:T2) fun(t3:T3)
#     {fst=t1, snd=t2, thd=t3};
triple = <val>
       : All(T1)
         All(T2)
         All(T3)
           T1 -> T2 -> T3 -> {|fst:T1, snd:T2, thd:T3|}

and the projections

# extract1of3 =
#  fun(T1) fun(T2) fun(T3)
#    {get = fun(p: Triple T1 T2 T3) p.fst,
#     put = fun(p: Triple T1 T2 T3)
#              fun(t:T1)
#                 {fst=t, snd=p.snd, thd=p.thd} };
extract1of3 = <val>
            : All(T1)
              All(T2)
              All(T3)
              {|get: (Triple T1 T2 T3)->T1,
                put: (Triple T1 T2 T3)->T1->{|fst:T1, snd:T2, thd:T3|}|}

and extract2of3 and extract3of3, which are defined similarly.

A slightly different formulation of the extend2 function provides an alternative perspective on its behavior. The original extend2 is parametric on three class interfaces, SuperM1, SuperM2, and MyM, where MyM is constrained to refine both SuperM1 and SuperM2. The type of the following function extend2' emphasizes the fact that MyM is typically formed by adding some new methods to those given by SuperM1 and SuperM2: it is parameterized on SuperM1, SuperM2, and a “partial interface” MyOwnM, which is conjoined with the other two to form MyM:

# extend2' =
#  fun(SuperM1: *->*)                     % first superclass interface
#  fun(SuperM2: *->*)                     % second superclass interface
#  fun(MyOwnM: *->*)                      % new methods specification
#  let MyM = SuperM1/\SuperM2/\MyOwnM in  % new class interface
#     % ...(the rest, as before)...
extend2' = <val>

6.3. ENCODING MULTIPLE INHERITANCE 113

: All(SuperM1)
All(SuperM2)
All(MyOwnM)
All(MyLocalR)
   (Class SuperM1)
-> (Class SuperM2)
-> MyLocalR
-> (All(FinalR)
        (Extractor FinalR MyLocalR)
      ->(SuperM1 FinalR)
      ->(SuperM2 FinalR)
      ->(SuperM1/\(SuperM2/\MyOwnM) FinalR)
      ->(SuperM1/\(SuperM2/\MyOwnM) FinalR))
-> (Class (SuperM1/\(SuperM2/\MyOwnM)))

Note that all of the quantifiers in this version are unbounded: bounded quantification has been replaced by unbounded quantification and intersection.

114 CHAPTER 6. MULTIPLE INHERITANCE

Part II First-Order Subtyping Implicit and Explicit Subtyping

7.1 Introduction

In the analysis of λ-calculi we can distinguish between two main groups of systems, namely, explicitly typed systems, usually called à la Church and implicitly typed systems also called à la Curry. In the implicitly typed systems type free lambda terms are assigned a type and this is why these calculi à la Curry are sometimes called systems of type assignment. On the other hand, in the explicitly typed systems the terms are not terms of the type-free λ-calculus but terms themselves containing type information. To illustrate the difference we write the canonical example of typing the corresponding identity term in both styles.

\begin{matrix}⊢_{Curry} λx.x ∈ σ→σ \\ ⊢_{Church} λx:σ.x ∈ σ→σ. \end{matrix}

Observe that the Church style term has extra typing information, namely ’:σ’. This explicit mention of types in a term makes it easier to decide whether a term has a certain type. For some systems à la Curry this question is undecidable. See [Bar92] for some examples. In these systems the problem of finding a type for a given term involves solving sets of equations. (See [Wan87] for an elegant and concise algorithm of type inference for simply typed λ-calculus à la Curry).

The idea of subtype appears quite naturally in programming languages. If we think of types as sets, we can easily picture what a subtype could be. Informally, we can say that a type σ is a subtype of τ (σ ≤ τ) if any element of σ can be seen as an element of τ. We say can be seen as and not directly is because the act of considering an element of type σ as an element of type τ might hide some transformation. Consider for example the types Int and Real of integers and real numbers respectively. Usually, on a computer, integer numbers are represented in a different way than real numbers are; even if we might think of the integers as a subset of the real numbers, there is a translation going on. The act of considering an element of type σ as an element of type τ will be called coercion. In other words, we say that an element of type σ is coerced into an element of type τ. Somehow an element of type σ has enough information to be seen as an element of type τ.

While dealing with coercions we can again distinguish between an explicit style and an implicit style. A style with explicit coercions means that coercions are explicitly indicated and in an implicit style, as the name suggests, coercions are left implicit. In systems including subtyping there is usually a rule for typing coerced terms. Then, in an explicit style the coercion rule might look as follows.

\frac{Γ ⊢ M ∈ σ σ ≤ τ}{Γ ⊢ c_{στ}<M> ∈ τ}  (Coercion)

Similarly, in an implicit style the corresponding rule is as follows.

\frac{Γ ⊢ M ∈ σ σ ≤ τ}{Γ ⊢ M ∈ τ}  (Subsumption)

From the previous discussion it follows that we can split subtyping systems into four main groups combining implicit or explicit typing with implicit or explicit coercions. Explicit coercions have been used as a way of giving semantics to systems with implicit coercions in [CG92]. In [CL91], PER models for Quest, a higher order lambda calculus with subsumption, and Quest_{C}, a higher order lambda calculus with coercion, are studied.

An implicit coercion is motivated by the fact that the same term can be considered as belonging to two different types without performing any change in the term, as for example is the case when one of the types is included in the other (with the intuitive idea of set inclusion), while an explicit coercion wishes to state explicitly that there is a transformation going on. We can think, for example, of a function f with the real numbers as domain, and a (sub)set A of real numbers. If x is a variable of type A, then we would like to use f on x as well, without performing any extra calculation to apply f to x.

The system λ_{⩽} (lambda sub), an extension of the simply typed λ-calculus à la Church with subtyping, is presented in section 7.4. The extension consists of adding the previously mentioned Subsumption rule, in other words, coercions are left implicit. The subtyping relation mentioned in the rule is based on a finite set of subtyping axioms, closed under reflexivity and transitivity, and extended to arrow types in the standard way. We show that λ_{⩽} satisfies the minimal types property, and we exhibit an algorithm to compute minimal types (Algλ_{⩽}). Moreover, we show that type checking and type inference are decidable.

The subtyping relation is studied in section 7.2, where a method to establish whether two types are in the subtype relation is given and proven sound and complete with respect to the definition of the subtyping relation. The decidability of the predicate σ ≤ τ was already stated in [Mit84]. Types in the subtype relation are looked at through the magnifying glass to establish the relation between the structure of σ and τ when σ is less than or equal to τ.

In section 7.5, λ_{C} (lambda coerce), another extension of the simply typed lambda calculus with subtyping, is introduced. This time the rule added is the previously mentioned Coercion rule. Basic properties of this system are established, and, in section 7.6 we show that the “invisible” coercions in a λ_{⩽} typing statement can be uniformly reconstructed producing a legal statement of λ_{C}. The fact that we translate typing statements instead of typing derivations as in [CG92] and [BCGS91], avoids coherence problems.

Finally, in section 7.7, a translation of λ_{C} into the simply typed lambda calculus λ→ is developed. This means that a system with two different kinds of judgements, typing judgements and subtyping judgements, is translated into a system without subtyping. The idea is to mimic λ_{C} inside λ→. The translation of the typing system is straightforward; the Coercion rule is omitted. The translation of the subtyping statements is as follows: the subtyping axioms are collected as a so called environment (like a signature in ELF [AH87]), and the subtyping rules are perfectly captured by computational properties of the λ-calculus. A proof of a subtyping statement is then a λ→-term containing constants of the environment. This translation together with the translation from λ_{⩽} into λ_{C}, imply that subtyping can be coded into a system without subtyping.

The λ→ that we define in section 7.7 is not exactly the one presented in [Bar92]. We prefer a formulation in which constants are syntactically different from variables, the rules prevent abstraction over constants, and there is a typing rule for constants, so that nothing that is ilegal can be derived from the rules without extra proviso in the metalanguage.

Convention 7.1.1 Throughout this chapter the metavariables α, β, γ and δ will range over type variables, σ, τ, and ρ will range over types, M, N, and P will range over terms, x, y, and z over term variables, Γ will range over contexts, and Σ over environments.

7.2 The subtyping relation

The relation ⩽_{C}

In the present section we define the subtyping relation, ⩽_{C}, and an algorithm, Subtype, to check whether two types are in the subtyping relation. In proposition 7.2.7, we prove the correctness of the algorithm Subtype with respect to the definition of ⩽_{C}.

Let 𝕍 be a set of type variables, 𝕋 a set of types defined by

𝕋::=𝕍 | 𝕋→𝕋,

and let C ⊂ 𝕍 × 𝕍 a finite set of subtyping axioms, where if (α, β)∈C then α, β are different variables.

We will restrict our attention to the particular case when C ⊂ 𝕍 × 𝕍, given that the more general case when C ⊂ 𝕋 × 𝕋 could allow typing non-terminating terms like for example (λx:σ.xx)(λx:σ.xx).

Definition 7.2.1 (Subtyping) The relation ⩽_{C} ⊂ 𝕋 × 𝕋 is the smallest relation closed under the following rules.

(α, β)∈C ⇒ α ⩽_{C} β  S-Incl,
σ ⩽_{C} σ  S-Refl,
σ ⩽_{C} τ, τ ⩽_{C} ρ ⇒ σ ⩽_{C} ρ  S-Trans,
σ ⩽_{C} σ′, τ′ ⩽_{C} τ ⇒ σ′→τ′ ⩽_{C} σ→τ S-Arrow.

The S-Arrow rule deserves a close look. If we consider the relation ⩽_{C} as an ordering, then → is monotonic in the second argument and antimonotonic in the first argument. Intuitively, if every value of type σ can be treated as a value of type σ′, then every function which maps σ′ to τ also maps σ to τ.

In what follows we define the algorithm Subtype, which is a decision procedure for the ⩽_{C} relation; as it is shown in proposition 7.2.7. But first we need the following definition.

Definition 7.2.2 (Transitive Closure of C)

1. (α, β)∈C ⇒ (α, β)∈Trans(C),

(α, β) and (β, γ)∈Trans(C) ⇒ (α, γ)∈Trans(C).

2. trans(σ, τ, C) = true if and only if (σ, τ) belongs to Trans(C).

We can now write down the algorithm.

Definition 7.2.3 (Subtype) Subtype : 𝕋 × 𝕋 × 2^{𝕍×𝕍}→Bool

Subtype(σ, τ, C) = if σ ≡ τ

then true

else if σ and τ are variables then trans(σ, τ, C) else if σ ≡ σ_{1}→σ_{2} and τ ≡ τ_{1}→τ_{2}

then Subtype(τ_{1}, σ_{1}, C) and Subtype(σ_{2}, τ_{2}, C) else false

Where ≡ is the syntactic equality.

Since C is finite, Trans(C) is also finite. Consequently, trans(σ, τ, C) is decidable. Moreover, the recursive calls have arguments of strictly smaller size. Hence, the algorithm Subtype always terminates.

Definition 7.2.4 The Shadow of a type is defined as follows.

Shadow(α)  =  •  if α∈𝕍
Shadow(σ → τ) =  →
[figure]
Shadow(σ)  Shadow(τ)

The difference between the usual underlying tree structure and the shadow of a type expression is that different type variables have different underlying trees but the same shadow. Then two type expressions that only differ in their atomic subexpressions (type variables), have the same shadow.

Lemma 7.2.5 Let α, β∈𝕍 and σ, τ∈𝕋. Then, 1. If trans(α, β, C), then α ⩽_{C} β.

2. If σ ⩽_{C} τ, then Shadow(σ) = Shadow(τ).

3. If α ⩽_{C} β, then trans(α, β, C) or α ≡ β.

Proof:

1. By induction on the definition of Trans(C).

2. By induction on the derivation of σ ⩽_{C} τ.

3. By induction on the derivation of α ⩽_{C} β. □

Lemma 7.2.6 Let σ_{1}, σ_{2}, τ_{1}, and τ_{2}∈𝕋. Then

σ_{1}→σ_{2} ⩽_{C} τ_{1}→τ_{2} if and only if τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}.

Proof: From right to left, it is just the S-Arrow rule. From left to right, the proof follows by induction on the derivation of σ_{1}→σ_{2} ⩽_{C} τ_{1}→τ_{2} . Since C only contains pairs of type variables, the S-Incl rule could not have been the last rule of the derivation.

S-Refl σ_{1}→σ_{2} ≡ τ_{1}→τ_{2} and this means that τ_{1} ≡ σ_{1} and σ_{2} ≡ τ_{2}. Hence, by S-Refl, it follows that τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}.

S-Trans We are in the case that for some ρ, σ_{1}→σ_{2} ⩽_{C} ρ and ρ ⩽_{C} τ_{1}→τ_{2}. By lemma 7.2.5(2), ρ is of the form ρ_{1}→ρ_{2}. Then, by the induction hypothesis, ρ_{1} ⩽_{C} σ_{1}, σ_{2} ⩽_{C} ρ_{2}, τ_{1} ⩽_{C} ρ_{1}, and ρ_{2} ⩽_{C} τ_{2}. Then, by S-Trans, we conclude that τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}.

S-Arrow If the last rule was S-Arrow, then the only possibility for the hypothesis is τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}. □

We can now show that the algorithm Subtype is correct with respect to definition 7.2.1. The correctness is split into two parts, usually called soundness and completeness. Soundness means that if Subtype(σ, τ, C) = true, then it is the case that σ ⩽_{C} τ. Conversely, completeness means that if σ ⩽_{C} τ, then the algorithm outputs true when called with arguments σ, τ and C.

Proposition 7.2.7 (Soundness and completeness of Subtype)

Subtype(σ, τ, C) = true if and only if σ ⩽_{C} τ.

Proof:

⇒) By induction on the complexity of σ and τ.

Case 1. σ, τ∈𝕍. Then we have to consider the following two cases.

Case 1a. If σ ≡ τ, then, by S-Refl, σ ⩽_{C} τ.

Case 1b. If trans(σ, τ, C) = true, then, by lemma 7.2.5(1), we know that σ ⩽_{C} τ.

Case 2. If either σ or τ is a variable and the other one is not, then the algorithm never yields true.

Case 3. Neither σ nor τ is a variable. Again we have to consider two cases.

σ ≡ τ. Then, by S-Refl, σ ⩽_{C} τ.

σ ≢ τ. Say σ ≡ σ_{1}→σ_{2} and τ ≡ τ_{1}→τ_{2}. Then it is the case that

Subtype(τ_{1}, σ_{1}, C) = true and Subtype(σ_{2}, τ_{2}, C) = true.

By the induction hypothesis, τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}. Hence,

due to the S-Arrow rule, σ_{1}→σ_{2} ⩽_{C} τ_{1}→τ_{2}.

⇐) By induction on the complexity of σ.

σ ∈ 𝕍. Then, by lemma 7.2.5(2), τ is also a variable. By lemma 7.2.5(3), it follows that trans(σ, τ, C) = true or σ ≡ τ, and in both cases we have that Subtype(σ, τ, C) = true.

σ ≡ σ_{1}→σ_{2}. Then, by lemma 7.2.5(2), τ is of the form τ_{1}→τ_{2}, and, because of lemma 7.2.6, we know that τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}. Then Subtype(τ_{1}, σ_{1}, C) = true and Subtype(σ_{2}, τ_{2}, C) = true, by the induction hypothesis. Hence, Subtype(σ, τ, C) = true. □

A closer look at the algorithm uncovers some proof theoretic properties of the subtyping relation ⩽_{C}. Observe that in the algorithm the S-Trans rule is considered only at the level of variables, in other words, the S-Trans rule is never used as the last rule of a proof of a statement of the form σ_{1}→σ_{2} ⩽_{C} τ_{1}→τ_{2}. The corollary is then, that, if there exists a proof of σ ⩽_{C} τ, then there exists also a proof of σ ⩽_{C} τ in which the applications of the S-Trans rule are only on statements of the form α ⩽_{C} β and β ⩽_{C} γ, where α, β, and γ are type variables. This fact can be read as follows: the system in which the S-Trans rule is replaced by

S-Trans’ α ⩽_{C} β, β ⩽_{C} γ ⇒ α ⩽_{C} γ, where α, β, γ∈𝕍.

can prove the same subtyping statements as the original system defined in 7.2.1.

From the proof theoretic point of view there is another possible refinement that consists of restricting the application of the S-Refl rule to type variables. In other words, we could replace S-Refl by

S-Refl’ α ⩽_{C} α for all α∈𝕍.

But, from an algorithmic point of view, this is not a very satisfactory choice, because the proofs with the S-Refl rule can be shorter. The use of the S-Refl rule instead of the S-Refl’ rule avoids superfluous recursive calls. For example, to prove α→(β→α) ⩽_{C} α→(β→α) requires two applications of the S-Arrow rule and three applications of the S-Refl’ rule, while it can be proved in one step with the original S-Refl rule.

About the sets {τ∈𝕋 | τ ⩽_{C} σ} and {τ∈𝕋 | σ ⩽_{C} τ}

In this section we focus our attention on the sets of types which are smaller and bigger than a given type with respect to ⩽_{C}. We define simultaneously the functions after and before that, given a type, retrieve the set of bigger and smaller types respectively, as we prove in lemma 7.2.9(3).

Definition 7.2.8 after,before :𝕋 → 2^{𝕋}.

before(α) = {α} ∪ {β∈𝕍 | trans(β, α, C) = true},  if α∈𝕍.
after(α) = {α} ∪ {β∈𝕍 | trans(α, β, C) = true},  if α∈𝕍.
before(σ→τ) = {σ′→τ′∈𝕋 | σ′∈after(σ) and τ′∈before(τ)}.
after(σ→τ) = {σ′→τ′∈𝕋 | σ′∈before(σ) and τ′∈after(τ)}.

Lemma 7.2.9 Let σ, τ∈𝕋.

1. σ∈before(σ) and σ∈after(σ).

2. σ∈before(τ) ⇔ τ∈after(σ)

3. σ ⩽_{C} τ ⇔ σ∈before(τ).

4. {τ∈𝕋 | τ ⩽_{C} σ} and {τ∈𝕋 | σ ⩽_{C} τ} are finite sets.

Proof:

1. Straightforward.

2. By induction on the structure of σ

3. ⇒) By induction on the structure of σ using proposition 7.2.7 and 1.

⇐) By induction on the structure of σ.

4. By items 2 and 3, we know that

{τ∈𝕋 | τ ⩽_{C} σ} = before(σ), and
{τ∈𝕋 | σ ⩽_{C} τ} = after(σ),

Since C is finite, before(σ) and after(σ) are finite sets. □.

About the form of types in the ⩽_{C} relation

In order to study types in the subtyping relation it is useful fo have a language which enables us to refer to a specific subexpresion of a given type. Having in mind the underlying tree structure of a type, say σ, we define the notion of binary code. Each binary code uniquely determines a subtree of the underlying tree of σ, which in its turn, is linked to a subexpresion of σ.

Definition 7.2.10 1. A binary code is a possibly empty sequence of zeros and ones.

2. A positive binary code is a binary code with an even number of ones.

3. A negative binary code is a binary code with an odd number of ones.

Definition 7.2.11 The subexpression of code b in the type expression σ, notation Sub(b, σ), is defined as follows. Sub : {0, 1}^{∗}×𝕋 → 𝕋

Sub([], σ) = σ
Sub(1b, σ→τ) = Sub(b, σ)
Sub(0b, σ→τ) = Sub(b, τ)

Observe that Sub is a partial function; not every binary code indicates a subexpression of a given type. For example, Sub(10,α) with α∈𝕍 is undefined.

Notation 7.2.12 we will write b(σ) instead of Sub(b, σ). We frequently use code instead of binary code.

Definition 7.2.13

1. b is called a code in σ if b(σ) is defined.

2. b is called a binary leaf code in σ if b(σ)∈𝕍.

Intuitively, a binary code in a type σ is a path starting from the root of the underlying tree of σ, where left is indicated with 1, and right with 0. Note that each code in σ uniquely determines a subexpression of σ. Then we can say that a subexpression is positive if it has a positive code, and negative otherwise. Note that then in the path from the root of the underlying tree of σ to the root of a positive (respectively negative) subexpression we have chosen an even (respectively odd) number of times the left branch of an arrow node.

Lemma 7.2.14 Shadow(σ) = Shadow(τ) if and only if every leaf code of σ is a leaf code of τ.

Proof: From left to right, the result follows by straightforward induction on the structure of σ. From right to left. By induction on the structure of σ.

σ∈𝕍. [] is the only (leaf) code of σ. Since [] is also a leaf code of τ, it follows that τ is a variable. Hence, Shadow(σ) = Shadow(τ).

σ ≡ σ_{1}→σ_{2}. The leaf codes of σ are of the form 1b_{1} and 0b_{2}, for every leaf code b_{1} of σ_{1} and for every leaf code b_{2} of σ_{2}. Since 1b_{1} and 0b_{2} are also leaf codes of τ, τ is of the form τ_{1}→τ_{2}. Then b_{1} is a leaf code of τ_{1} and b_{2} of τ_{2}. Then by the induction hypothesis and the definition of Shadow, it follows that Shadow(σ) = Shadow(τ).

Proposition 7.2.15

If for every positive leaf code b in σ, b(σ) ⩽_{C} b(τ),
and for every negative leaf code b in σ, b(τ) ⩽_{C} b(σ), then σ ⩽_{C} τ.

Proof: By induction on the complexity of σ.

σ ∈ 𝕍. Then the only code in σ is the empty code, and as the empty code is positive, we have that [](σ)⩽_{C} [](τ), but [](σ) is σ and [](τ) is τ.

σ ≡ σ_{1}→σ_{2}. Then the codes in σ are of the form 1b_{1} and 0b_{2}, where b_{1} is a code in σ_{1} and b_{2} is a code in σ_{2}.

Since b is a leaf code of σ, b(σ) is a variable, and since b(σ) ⩽_{C} b(τ), by the correctness of the algorithm Subtype, b(τ) is also a variable. Hence, b is a leaf code of τ. By lemma 7.2.14, it follows that Shadow(σ) = Shadow(τ). Then we know that τ is of the form τ_{1}→τ_{2}. Our goal is to prove that σ_{1}→σ_{2} ⩽_{C} τ_{1}→τ_{2}. For that, it is enough to show that τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}.

• Let b_{1} be a negative leaf code in σ_{1}. By the definition of code, b_{1}(σ_{1}) = 1b_{1}(σ), and by assumption, since 1b_{1} is a positive code, also 1b_{1}(σ) ⩽_{C} 1b_{1}(τ), and, as 1b_{1}(τ) = b_{1}(τ_{1}), we conclude b_{1}(σ_{1}) ⩽_{C} b_{1}(τ_{1}).

• Let b_{1} be a positive leaf code in σ_{1}. By definition of code, b_{1}(σ_{1}) = 1b_{1}(σ), then as 1b_{1} is a negative code in σ, 1b_{1}(τ) ⩽_{C} 1b_{1}(σ), and, as 1b_{1}(τ) = b_{1}(τ_{1}), we have that b_{1}(τ_{1}) ⩽_{C} b_{1}(σ_{1}).

We conclude that τ_{1} ⩽_{C} σ_{1} by the induction hypothesis. Similarly, it follows that σ_{2} ⩽_{C} τ_{2}. □

Lemma 7.2.16 Suppose σ ⩽_{C} τ. Then,

b is a code in σ if and only if b is a code in τ.

Proof: By induction on the complexity of σ.

σ ∈ 𝕍. Then, by lemma 7.2.5(2), τ is also a variable. Then the only possible code is the empty code, and [] is a code in every element of 𝕋.

σ ≡ σ_{1}→σ_{2}. Then, by lemma 7.2.5(2), τ is of the form τ_{1}→τ_{2}. By lemma 7.2.6, τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}.

⇒) Let b be a code in σ, then the following cases have to be considered.

Case 1. b ≡ 0b′ with b′ a code in σ_{2}. Then, by the induction hypothesis, b′ is also a code in τ_{2}, but this means that 0b′ is a code in τ.

Case 2. b ≡ 1b′ with b′ a code in σ_{1}. By the induction hypothesis, b′ is a code in τ_{1}. Hence, 1b′ is a code in τ.

⇐) Similar to the proof of ⇒), interchanging the roles of σ and τ. □

Proposition 7.2.17 Suppose σ ⩽_{C} τ. Then, for every leaf code b in σ

if b is positive, then b(σ) ⩽_{C} b(τ) and
if b is negative, then b(τ) ⩽_{C} b(σ).

Proof: By induction on the complexity of σ.

σ ∈ 𝕍. This means that the only code in σ is the empty code. Hence b(σ) is σ and b(τ) is τ. The empty code is positive and, by hypothesis, σ ⩽_{C} τ, so there is nothing else to prove.

σ ≡ σ_{1}→σ_{2}. Then, by lemma 7.2.5(2), τ is of the form τ_{1}→τ_{2}. By lemma 7.2.6, τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}. We are in the case that b ≡ db′ with d = 1 and b′ a code in σ_{1}, or d = 0 and b′ a code in σ_{2}. According to the possible codes in σ we have to consider the following two cases.

• b is positive.

Case 1. d ≡ 0 and b′ positive. As b′ is a code in σ_{2}, by the induction hypothesis, b′(σ_{2}) ⩽_{C} b′(τ_{2}), what, by definition of

code, can be read as 0b′(σ) ⩽_{C} 0b′(τ).

Case 2. d ≡ 1 and b′ negative. By lemma 7.2.16, b′ is also a code in τ_{1} and, by the induction hypothesis, b′(σ_{1}) ⩽_{C} b′(τ_{1}), what, by definition of code, is 1b′(σ) ⩽_{C} 1b′(τ).

• b is negative.

Case 1. d ≡ 0 and b′ negative. By the induction hypothesis, b′(τ_{2}) ⩽_{C} b′(σ_{2}), what means that 0b′(τ) ⩽_{C} 0b′(σ). Case 2. d ≡ 1 and b′ positive. Lemma 7.2.16 implies that b′ is

also a code in τ_{1}. Then, by the induction hypothesis, b′(τ_{1}) ⩽_{C} b′(σ_{1}). Finally, by the definition of code, it follows that 1b′(τ) ⩽_{C} 1b′(σ). □

Theorem 7.2.18

σ ⩽_{C} τ if and only if for every leaf code b in σ
if b is positive, then b(σ) ⩽_{C} b(τ) and
if b is negative, then b(τ) ⩽_{C} b(σ).

Proof: By propositions 7.2.15 and 7.2.17. □

This theorem suggests yet another way to check whether σ ⩽_{C} τ, by only looking at the leaves of the underlying trees of σ and τ.

7.3. SIMPLY TYPED λ-CALCULUS 127

7.3 Simply typed λ-calculus

We use a slightly different version of λ→ than the one in [Bar92], the difference being that our version contains constants as pseudo-terms that are syntactically different from variables. Constants are assigned a type in an environment as in [AH87], and there is a rule for typing constants.

Definition 7.3.1 The typed λ-calculus, λ→, is defined as follows.

1. The set of pseudo-terms Λ = Λ(λ→) is defined by the following syntax.

Λ::=V | K | λV:𝕋.Λ | ΛΛ,

where V is a set of (term) variables and K is a set of constants such that V and K are disjoint sets.

2. An environment is a set of statements with only distinct constants as subjects. The symbol Σ is used for environments.

The set of types 𝕋 and the concepts of statement, typing assumption, subject, context, derivable statement and legal term are as in definition 7.4.1.

Definition 7.3.2 (Typing rules)

Γ ⊢_{Σ} k ∈ σ, if k:σ∈Σ  (T-Cons)
Γ ⊢_{Σ} x ∈ σ, if x:σ∈Γ  (T-Var)
\frac{Γ, x:σ ⊢_{Σ} M ∈ τ}{Γ ⊢_{Σ} λx:σ.M ∈ σ→τ}  (T-Abs)
\frac{Γ ⊢_{Σ} M ∈ σ→τ  Γ ⊢_{Σ} N ∈ σ}{Γ ⊢_{Σ} MN ∈ τ}  (T-App)

Basic properties of λ→

Let us mention the following properties of λ→ without giving their proofs. The interested reader can find more about these results in [Bar92]. There the λ→- system presented does not have constants, but the proofs of the propositions below are straightforward extensions of the proofs given in [Bar92]; nevertheless the strong normalization property deserves a more careful examination. Let us use ⊢ for derivability in the λ→-system presented in [Bar92] where we consider K ∪ V as the set of variables. Note that if Γ ⊢_{Σ} M ∈ σ then Σ, Γ ⊢ M ∈ σ. Then the strong normalization property for the system in which our constants are treated as free variables implies the corresponding result for the system with constants.

Let F V (M) denote, as usual, the set of free variables of M and Dom(Γ) the domain of Γ, i.e. the set of subjects of Γ.

Lemma 7.3.3

1. (Free Variable) If Γ ⊢_{Σ} M ∈ σ, then F V (M) ⊂ Dom(Γ).

2. (Weakening for λ→)

Let Γ and Γ′ be contexts such that Γ⊆Γ′. Then if Γ ⊢_{Σ} M ∈ σ, then Γ′ ⊢_{Σ} M ∈ σ.

Proposition 7.3.4

1. (Generation for λ→)

(a) If Γ ⊢_{Σ} k ∈ σ, then k:σ∈Σ.

(b) If Γ ⊢_{Σ} x ∈ σ, then x:σ∈Γ.

(c) If Γ ⊢_{Σ} MN ∈ σ, then there exists τ such that Γ ⊢_{Σ} M ∈ τ→σ and Γ ⊢_{Σ} N ∈ τ.

(d) If Γ ⊢_{Σ} λx:σ.M ∈ ρ, then there exists τ such that ρ ≡ σ→τ and Γ, x:σ ⊢_{Σ} M ∈ τ.

2. (Unicity of types for λ→) If Γ ⊢_{Σ} M ∈ σ and Γ ⊢_{Σ} M ∈ σ′, then σ ≡ σ′.

3. (Strong normalization for λ→) If Γ ⊢_{Σ} M ∈ σ, then M is strongly normalizing.

7.4 λ_{⩽}, a system with implicit coercions

We define the system λ_{⩽} (lambda sub), an extension of the simply typed λ-calculus with subtyping. The difference between the simply typed λ-calculus and λ_{⩽} is the following rule.

\frac{Γ ⊢ M ∈ σ σ ⩽_{C} τ}{Γ ⊢ M ∈ τ}  (T-Subsumption)

An immediate consequence of the addition of this rule is the loss of the unicity of types property. Fortunately, the system has instead the minimal type property. Namely, if Γ ⊢ M ∈ σ, then there exists τ such that Γ ⊢ M ∈ τ and τ ⩽_{C} σ. That property is relevant in the design of type checking and type inference algorithms. Consider the case of type checking. Knowing that if a term is typeable, then it has a minimal type, we try to identify a fragment of the system in which every typeable term is assigned a minimal type. In our case, we define a subsystem of λ_{⩽}, Algλ_{⩽}, which has the unicity of types property and is syntax directed, in such a way that that Algλ_{⩽} defines an algorithm to compute minimal types in λ_{⩽}.

We give now the formal definition of a simply typed λ-calculus with implicit coercions, λ_{⩽}.

Definition 7.4.1 The typed λ-calculus with implicit coercions, λ_{⩽}, is defined as follows.

1. The set of types 𝕋 = Type(λ_{⩽}) is defined by

𝕋 ::= 𝕍 | 𝕋→𝕋,

where 𝕍 is a set of (type) variables.

7.4. λ_{⩽}, A SYSTEM WITH IMPLICIT COERCIONS 129

2. The set of pseudo-terms Λ = Λ(λ_{⩽}) is defined as follows.

Λ::=V | λV:𝕋.Λ | ΛΛ,

where V is a set of (term) variables.

3. A statement is of the form M ∈ σ (M is of type σ) with M∈Λ and σ∈𝕋. The term M is called the subject of the statement. A typing assumption is an expression of the form x:σ. The variable x is called the subject of the typing assumption.

4. A context is a set of typing assumptions with distinct variables as subjects.

Definition 7.4.2 (Typing rules)

Γ ⊢_{λ_{⩽}} x ∈ σ if x:σ∈Γ  (T-Var)
\frac{Γ, x:σ ⊢_{λ_{⩽}} M ∈ τ}{Γ ⊢_{λ_{⩽}} λx:σ.M ∈ σ→τ}  (T-Abs)

\frac{Γ ⊢_{λ_{⩽}} M ∈ σ→τ  Γ ⊢_{λ_{⩽}} N ∈ σ}{Γ ⊢_{λ_{⩽}} MN ∈ τ}  (T-App)

\frac{Γ ⊢_{λ_{⩽}} M ∈ σ σ ⩽_{C} τ}{Γ ⊢_{λ_{⩽}} M ∈ τ}  (T-Subsumption)

Definition 7.4.3 A statement M ∈ σ is derivable from the context Γ, we write Γ ⊢_{λ_{⩽}} M ∈ σ – Γ yields M of type σ –, if Γ ⊢_{λ_{⩽}} M ∈ σ can be obtained using the rules T-Var, T-Abs, T-App, and T-Subsumption in definition 7.4.2. A λ_{⩽}-term M is legal, if there exist Γ and σ such that Γ ⊢_{λ_{⩽}} M ∈ σ, In other words, a legal term is the subject of a derivable statements.

The typing rules in definition 7.4.2, are not syntax directed. In order to describe a type inference algorithm, we need an alternative presentation of the typing rules in which the term to be typed uniquely determines the last rule of the derivation of its typing statement. In the next section, we define Algλ_{⩽}, an algorithmic presentation of λ_{⩽}. This presentation has the property of finding a minimal type for λ_{⩽}.

Definition 7.4.4 (A type inference algorithm)

Γ ⊢_{Algλ_{⩽}} x ∈ σ if x:σ∈Γ  (T-Var)
\frac{Γ, x:σ ⊢_{Algλ_{⩽}} M ∈ τ}{Γ ⊢_{Algλ_{⩽}} λx:σ.M ∈ σ→τ}  (T-Abs)

\frac{Γ ⊢_{Algλ_{⩽}} M ∈ σ→τ  Γ ⊢_{Algλ_{⩽}} N ∈ ρ ρ ⩽_{C} σ}{Γ ⊢_{Algλ_{⩽}} MN ∈ τ}  (T-App_{⩽})

Proposition 7.4.5 (Generation for Algλ_{⩽})

1. If Γ ⊢_{Algλ_{⩽}} x ∈ σ, then x:σ∈Γ.

2. If Γ ⊢_{Algλ_{⩽}} λx:τ.M ∈ σ, then there exists ρ such that Γ, x:τ ⊢_{Algλ_{⩽}} M ∈ ρ and σ ≡ τ→ρ.

3. If Γ ⊢_{Algλ_{⩽}} MN ∈ σ, then there exist ρ and ρ′ such that Γ ⊢_{Algλ_{⩽}} M ∈ ρ→σ, ρ′ ⩽_{C} ρ, and Γ ⊢_{Algλ_{⩽}} N ∈ ρ′.

Proof: Since the system is syntax directed, the form of each judgement uniquely determines the last rule of its derivation. □

Proposition 7.4.6 (Unicity of types for Algλ_{⩽}) If Γ ⊢_{Algλ_{⩽}} M ∈ σ and Γ ⊢_{Algλ_{⩽}} M ∈ σ′, then σ ≡ σ′.

Proof: By induction on the complexity of M, using that the system is syntax directed. □

Lemma 7.4.7 (Well-foundedness of Algλ_{⩽}) The Algλ_{⩽} rules (7.4.4) define a terminating algorithm.

Proof: Since Γ is finite T-Var cannot cause non-termination. In rules T-App_{⩽} and T-Abs, the size of the subject in each of the premises is strictly smaller than the size of the subject in the corresponding conclusion. Moreover, the relation ⩽_{C} is decidable because the algorithm Subtype, which is sound and complete with respect to ⩽_{C}, always terminates. □

Proposition 7.4.8 (Decidability of type inference for Algλ_{⩽}) For any Γ and M it is decidable whether there exists σ such that Γ ⊢_{Algλ_{⩽}} M ∈ σ.

Proof: By the well-foundedness of Algλ_{⩽}.

Proposition 7.4.9 (Decidability of type checking for Algλ_{⩽})

Given Γ, M, and σ, it is decidable whether Γ ⊢_{Algλ_{⩽}} M ∈ σ.

Proof: Because of the unicity of types property of Algλ_{⩽}, the decidability of type inference (7.4.8) implies the decidability of type checking.

To prove the strong normalization property for Algλ_{⩽} we use the corresponding result for λ→ in section 7.3. We first provide some definitions that allow us to relate Algλ_{⩽}-terms to λ→-terms in such a way that β-reductions are preserved.

Definition 7.4.10 Let δ_{0}∈𝕋(λ→). ^{δ_{0}} : 𝕋(Algλ_{⩽})→𝕋(λ→).

α^{δ_{0}} = δ_{0}  if α∈𝕍.
(σ→τ)^{δ_{0}} = σ^{δ_{0}}→τ^{δ_{0}}

The homomorphic extension to contexts is defined as follows.

{}^{δ_{0}} = {}
(Γ ∪ {x:σ})^{δ_{0}} = Γ^{δ_{0}} ∪ {x:σ^{δ_{0}}}

Definition 7.4.11 ↓ :Λ(Algλ_{⩽})→Λ(λ→)

x ↓ = x
(λx:σ.M) ↓ = λx:σ^{δ_{0}}.M ↓
(MN) ↓ = M ↓ N ↓

The choice of δ_{0} is irrelevant, the essential feature is that it is fixed.

Lemma 7.4.12 Let σ, τ∈𝕋. If Shadow(σ) = Shadow(τ), then σ^{δ_{0}} ≡ τ^{δ_{0}}.

Lemma 7.4.13 Let M∈Λ(Algλ_{⩽}). If Γ ⊢_{Algλ_{⩽}} M ∈ σ, then Γ^{δ_{0}} ⊢_{Σ} M ↓ ∈ σ^{δ_{0}}.

Proof: By induction on the derivation of Γ ⊢_{Algλ_{⩽}} M ∈ σ. Consider the case of the T-App_{⩽} rule. Then the situation is as follows.

Γ ⊢_{Algλ_{⩽}} P ∈ τ→σ Γ ⊢_{Algλ_{⩽}} N ∈ ρ ρ ⩽_{C} τ
Γ ⊢_{Algλ_{⩽}} P N ∈ σ,

where M ≡ P N. By the induction hypothesis, the definition of ^{δ_{0}}, and lemmas 7.2.5(2) and 7.4.12, we have that

Γ^{δ_{0}} ⊢_{Σ} P ↓∈ τ^{δ_{0}}→σ^{δ_{0}} and Γ^{δ_{0}} ⊢_{Σ} N ↓∈ τ^{δ_{0}}.

Finally, by T-App and the definition of ↓, it follows that Γ^{δ_{0}} ⊢_{Σ} P N ↓∈ σ^{δ_{0}}. □

Lemma 7.4.14 (Substitution) Let M, N in Λ(Algλ_{⩽}). Then,

(M[x:=N])↓ ≡ M↓[x:=N ↓].

Proof: By induction on the complexity of M. □

Lemma 7.4.15 (Reduction preservation)

Let M, N in Λ(Algλ_{⩽}). If M →_{β} N, then M ↓ →_{β} N ↓.

Proof: The proof is by straightforward induction on the complexity of M. In particular, the case when M is a redex is a consequence of lemma 7.4.14. □

Proposition 7.4.16 (Strong normalization for Algλ_{⩽}) If Γ ⊢_{Algλ_{⩽}} M ∈ σ, then M is strongly normalizing.

Proof: The result follows from lemmas 7.4.13 and 7.4.15, using a similar argument as in theorem 7.7.12. □

The system Algλ_{⩽} does not satisfy the subject reduction property. Consider the following simple example. Let α ⩽_{C} γ, then z:α ⊢_{Algλ_{⩽}} (λx:γ.x)z ∈ γ and (λx:γ.x)z →_{β} z, but z:α ⊬_{Algλ_{⩽}} z:γ. This example illustrates the fact that a step of β-reduction of a term may reduce its original type. The reason being that, in order to type (λx:γ.x)z, α ⩽_{C} γ is used, and such information can only be used by the application rule, T-App_{⩽}. The β-reduction step “erases” the application. Therefore the subtyping information cannot be used any longer. Nevertheless, the following monotonic subject reduction property holds. The following result is necessary to prove proposition 7.4.18.

Lemma 7.4.17 If Γ, x:σ ⊢_{Algλ_{⩽}} M ∈ τ, Γ ⊢_{Algλ_{⩽}} N ∈ σ′, and σ′ ⩽_{C} σ, then there exists τ′ such that Γ ⊢_{Algλ_{⩽}} M[x:=N] ∈ τ′ and τ′ ⩽_{C} τ.

Proof: By induction on the complexity of M. □

Proposition 7.4.18 (Monotonic subject reduction)

If Γ ⊢_{Algλ_{⩽}} M ∈ σ and M →_{β} M′, then there exists τ such that Γ ⊢_{Algλ_{⩽}} M′ ∈ τ and τ ⩽_{C} σ.

Proof: By straightforward induction on the complexity of M, using lemma 7.4.17. Let us consider the case when M is a redex and M′ its reduct, that is the only case that demands some work. Then the situation is as follows.

Γ ⊢_{Algλ_{⩽}} (λx:ρ.M_{1})M_{2} ∈ σ.

By generation (proposition 7.4.5), we have that

Γ, x:ρ ⊢_{Algλ_{⩽}} M_{1} ∈ σ, Γ ⊢_{Algλ_{⩽}} M_{2} ∈ ρ′ and ρ′ ⩽_{C} ρ.

By lemma 7.4.17, there exists σ′ such that Γ ⊢_{Algλ_{⩽}} M_{1}[x:=M_{2}] ∈ σ′ and σ′ ⩽_{C} σ.

□

Observe that because of the unicity of types property M′ cannot have type σ as well.

Here we show that Algλ_{⩽} describes an effective procedure to compute minimal types in λ_{⩽}.

Proposition 7.4.19

1. (Soundness) If Γ ⊢_{Algλ_{⩽}} M ∈ σ, then Γ ⊢_{λ_{⩽}} M ∈ σ.

2. (Completeness and minimal typing) If Γ ⊢_{λ_{⩽}} M ∈ τ, then there exists σ such that σ ⩽_{C} τ and Γ ⊢_{Algλ_{⩽}} M ∈ σ.

Proof:

1. By induction on the derivation of Γ ⊢_{Algλ_{⩽}} M ∈ σ.

2. By induction on the derivation of Γ ⊢_{λ_{⩽}} M ∈ σ. We consider the case for T-App, the other cases follow with similar or simpler arguments. We are given that

M ≡ M_{1} M_{2},
Γ ⊢_{λ_{⩽}} M_{1} ∈ τ→σ, and
Γ ⊢_{λ_{⩽}} M_{2} ∈ τ.

By the induction hypothesis, there exist ρ_{1} and ρ_{2} such that

Γ ⊢_{Algλ_{⩽}} M_{1} ∈ ρ_{1} where ρ_{1} ⩽_{C} τ→σ, and
Γ ⊢_{Algλ_{⩽}} M_{2} ∈ ρ_{2} where ρ_{2} ⩽_{C} τ.

By the correctness of the algorithm Subtype (7.2.3), we know that ρ_{1} ≡ τ_{1}→σ_{1}, and by lemma 7.2.6, we have that τ ⩽_{C} τ_{1} and σ_{1} ⩽_{C} σ. By S-Trans, ρ_{2} ⩽_{C} τ_{1}. Finally, by T-App_{⩽}, we have that Γ ⊢_{Algλ_{⩽}} M_{1} M_{2} ∈ σ_{1}. □ 7.5. λ_{C}, A SYSTEM WITH EXPLICIT COERCIONS 133

The last proposition says that λ_{⩽} and Algλ_{⩽} type the same set of terms, in other words, the set of legal terms of λ_{⩽} is equal to that of Algλ_{⩽}. The difference is that they may assign different types to the same term. Note that item 1 says that Algλ_{⩽}-typing statements are also λ_{⩽}-typing statements, the converse is not true. Consider the following simple example.

Let C = {(α, β)}. Then x:α ⊢_{λ_{⩽}} x ∈ β, but x:α ⊢_{Algλ_{⩽}} x ∈ β is not a derivable statement.

Observe that the typing information present in the λ_{⩽} terms is essential for the minimal type property. Consider the following example in the system presented in [Mit84], i.e. a simply typed λ-calculus à la Curry with implicit coercions to see that it might be the case that neither the unicity of types property nor the minimal type property are satisfied.

Let C = {(α, β)} and let α, β, and γ be different type variables. Then the identity function, λx.x, has as type scheme σ→τ where σ ⩽_{C} τ. In particular we have that

Γ ⊢ λx.x:α→β and Γ ⊢ λx.x:γ→γ,

but there is no type ρ such that

Γ ⊢ λx.x:ρ, ρ ⩽_{C} α→β, and ρ ⩽_{C} γ→γ.

Unlike the system Algλ_{⩽} the system λ_{⩽} satisfies the subject reduction property.

Proposition 7.4.20 (Subject reduction for λ_{⩽})

If Γ ⊢_{λ_{⩽}} M ∈ σ and M →_{β} M′, then Γ ⊢_{λ_{⩽}} M′ ∈ σ.

Proof: By lemma 7.4.19(2), we know that there exists τ such that Γ ⊢_{Algλ_{⩽}} M ∈ τ and τ ⩽_{C} σ. By monotonic subject reduction (7.4.18), Γ ⊢_{Algλ_{⩽}} M ∈ τ′, for some τ′ ⩽_{C} τ. Then, by lemma 7.4.19(1), it follows that Γ ⊢_{λ_{⩽}} M ∈ τ′. Finally, since τ′ ⩽_{C} σ, by T-Subsumption, it follows that Γ ⊢_{λ_{⩽}} M′ ∈ σ. □

7.5 λ_{C}, a system with explicit coercions

Definition 7.5.1 The typed λ-calculus with explicit coercions, λ_{C}, is defined as follows. The set of pseudo-terms Λ = Λ(λ_{C}) is defined by the following grammar.

Λ::=V | λV:𝕋.Λ | ΛΛ | Q<Λ>,

where V is a set of (term) variables and Q is a set of constants with c_{σ,τ}∈Q if and only if σ ⩽_{C} τ.

The set of types 𝕋 and the concepts of statement, typing assumption, subject, context, derivable statement, and legal term are as in definition 7.4.1.

Definition 7.5.2

Γ ⊢_{λ_{C}} x ∈ σ, if x:σ∈Γ  (T-Var)

\frac{Γ, x:σ ⊢_{λ_{C}} M ∈ τ}{Γ ⊢_{λ_{C}} λx:σ.M ∈ σ→τ}  (T-Abs)

\frac{Γ ⊢_{λ_{C}} M ∈ σ→τ  Γ ⊢_{λ_{C}} N ∈ σ}{Γ ⊢_{λ_{C}} MN ∈ τ}  (T-App)

\frac{Γ ⊢_{λ_{C}} M ∈ σ σ ⩽_{C} τ}{Γ ⊢_{λ_{C}} c_{σ,τ}<M> ∈ τ}  (T-Coerce)

The standard notions of reduction and substitution are extended with the following rules.

1. If M →_{β} M′, then c_{σ,τ}<M> →_{β} c_{σ,τ}<M′>.

2. c_{σ,τ}<N>[x:=M] = c_{σ,τ}<N[x:=M]>.

Lemma 7.5.3 (Weakening for λ_{C}) Let Γ and Γ′ be contexts such that Γ ⊂ Γ′. Then, if Γ ⊢_{λ_{C}} M ∈ σ, then Γ′ ⊢_{λ_{C}} M ∈ σ.

Proof: By induction on the derivation of Γ ⊢_{λ_{C}} M ∈ σ. □

Proposition 7.5.4 (Generation for λ_{C})

1. If Γ ⊢_{λ_{C}} x ∈ σ, x:σ∈Γ.

2. If Γ ⊢_{λ_{C}} MN ∈ σ, there exists τ such that Γ ⊢_{λ_{C}} M ∈ τ→σ and Γ ⊢_{λ_{C}} N ∈ τ.

3. If Γ ⊢_{λ_{C}} λx:ρ.M ∈ σ, there exists τ such that σ ≡ ρ→τ and Γ, x:σ ⊢_{λ_{C}} M ∈ τ.

4. If Γ ⊢_{λ_{C}} c_{ρ,τ}<M> ∈ σ, Γ ⊢_{λ_{C}} M ∈ ρ, τ ≡ σ, and ρ ⩽_{C} τ.

Proof: Since the system is syntax directed, the form of the subject uniquely determines the last rule of the derivation of the typing statement. □

Lemma 7.5.5 Let M∈Λ(λ_{C}).

If Γ, x:τ ⊢_{λ_{C}} M ∈ σ and Γ ⊢_{λ_{C}} N ∈ τ, then Γ ⊢_{λ_{C}} M[x:=N] ∈ σ.

Proof: By induction on the complexity of M. □

Proposition 7.5.6 (Subject reduction for λ_{C})

If Γ ⊢_{λ_{C}} M ∈ σ and M →_{β} M′, then Γ ⊢_{λ_{C}} M′ ∈ σ.

Proof: By induction on the complexity of M. Let us consider the case when M is an application and in particular a redex. Then, M ≡ (λx:τ.P)N and M′ ≡ P [x:=N]. By generation, we have that Γ, x:τ ⊢_{λ_{C}} P ∈ σ and Γ ⊢_{λ_{C}} N ∈ τ. Finally, due to lemma 7.5.5, we get Γ ⊢_{λ_{C}} P [x:=N] ∈ σ. □

It is instructive to compare these last two results with lemma 7.4.17 and proposition 7.4.18, the corresponding results for Algλ_{⩽}.

7.6. THE RELATION BETWEEN λ_{⩽} AND λ_{C} 135

7.6 The relation between λ_{⩽} and λ_{C}

If we go back to the discussion in the introduction, the T-Coerce rule is more than what we actually need to be able to apply a function to an argument of a type smaller than its domain type. On the other hand, the T-App_{⩽} rule fits perfectly in our requirements. In the introduction we mention the difference between implicit and explicit coercions; in this framework Algλ_{⩽} has implicit coercions and furthermore, given a (legal) term M in Λ(Algλ_{⩽}), there is a uniform way to find a term M′ in Λ(λ_{C}) that is the explicitly coerced version of M, as will be defined in definition 7.6.3. This can be read as: there is no need to write the coercions because they can be automatically recovered.

Definition 7.6.1 (The implicitly coerced version of M)

| | : Λ(λ_{C}) → Λ(Algλ_{⩽}).

|x| = x,
|λx:σ.M| = λx:σ.|M|,
|MN| = |M||N|,
|c_{σ,τ}<M>| = |M|.

Lemma 7.6.2 If Γ ⊢_{λ_{C}} M ∈ σ, then there exists τ such that Γ ⊢_{Algλ_{⩽}} |M| ∈ τ and τ ⩽_{C} σ.

Proof: By induction on the derivation of Γ ⊢_{λ_{C}} M ∈ σ. □

This lemma says that the implicitly coerced version of a (legal) λ_{C}-term is a (legal) Algλ_{⩽}-term.

Definition 7.6.3 dec : Context×Λ(Algλ_{⩽})→Λ(λ_{C})

dec_{Γ}(x) = x
dec_{Γ}(λx:σ.M) = λx:σ.dec_{Γ,x:σ}(M)
dec_{Γ}(MN) = dec_{Γ}(M)c_{ρ,σ}<dec_{Γ}(N)>
where Γ ⊢_{Algλ_{⩽}} N ∈ ρ
and Γ ⊢_{Algλ_{⩽}} M ∈ σ→τ

dec stands for decoration.

Observe that dec is a partial mapping given that there may not be such ρ or σ→τ in the application case, and that it may not be the case that ρ ⩽_{C} σ, in which case there is no c_{ρ,σ} constant. On the other hand, the next result shows that dec is total on the subset of legal Algλ_{⩽}-terms.

Lemma 7.6.4 Let M∈Λ(Algλ_{⩽}). then Γ ⊢_{Algλ_{⩽}} M ∈ σ if and only if Γ ⊢_{λ_{C}} dec_{Γ}(M) ∈ σ.

Proof:

⇐) By induction on the complexity of M.

⇒) By induction on the derivation of Γ ⊢_{Algλ_{⩽}} M ∈ σ. Let us consider the case of the T-App_{⩽} rule. Then, the situation is as follows.

Γ ⊢_{Algλ_{⩽}} P ∈ τ→σ Γ ⊢_{Algλ_{⩽}} N ∈ ρ ρ ⩽_{C} τ
Γ ⊢_{Algλ_{⩽}} P N ∈ σ

where M ≡ P N.

By the induction hypothesis Γ ⊢_{λ_{C}} dec_{Γ}(P) ∈ τ→σ and Γ ⊢_{λ_{C}} dec_{Γ}(N) ∈ ρ and by the T-Coerce rule Γ ⊢_{λ_{C}} c_{ρ,τ}<dec_{Γ}(N)> ∈ τ. Finally, by the T-App rule, it follows that Γ ⊢_{λ_{C}} dec_{Γ}(P)c_{ρ,τ}<dec_{Γ}(N)> ∈ σ and, by proposition 7.4.6, we conclude dec_{Γ}(P N) ≡ dec_{Γ}(P)c_{ρ,τ}<dec_{Γ}(N)>. □

Lemma 7.6.5 Γ ⊢_{λ_{⩽}} M ∈ σ if and only if there exists τ, such that Γ ⊢_{λ_{C}} c_{τ,σ}<dec_{Γ}(M)> ∈ σ.

Proof:

1. If Γ ⊢_{λ_{C}} c_{τ,σ}<dec_{Γ}(M)> ∈ σ, by generation for λ_{C} (proposition 7.5.4),

Γ ⊢_{λ_{C}} dec_{Γ}(M) ∈ τ and τ ⩽_{C} σ.

By lemma 7.6.4, Γ ⊢_{Algλ_{⩽}} M ∈ τ, and, by the soundness of Algλ_{⩽} (7.4.19), Γ ⊢_{λ_{⩽}} M ∈ τ. Finally, the result follows by T-Subsumption. □

2. If Γ ⊢_{λ_{⩽}} M ∈ σ, then, by the completeness of Algλ_{⩽} (7.4.19), there exists τ such that

\begin{matrix}Γ ⊢_{Algλ_{⩽}} M ∈ τ, and \\ τ ⩽_{C} σ. \end{matrix}

Then, by lemma 7.6.4, it follows that Γ ⊢_{λ_{C}} dec_{Γ}(M) ∈ τ. Finally, the result follows by T-Coerce. □

This last lemma says that λ_{⩽} can be translated into λ_{C}. Moreover, together with theorem 7.7.9, implies that λ_{⩽} can be translated into λ→.

We could compare the systems Algλ_{⩽} and λ_{C} using an auxiliary system, call it λ_{C}^{−}, obtained by replacing the rules T-App and T-Coerce of λ_{C} by the following rule.

\frac{Γ ⊢_{λ_{C}}^{−} M ∈ σ→τ  Γ ⊢_{λ_{C}}^{−} N ∈ ρ ρ ⩽_{C} σ}{Γ ⊢_{λ_{C}}^{−} M c_{ρ,σ}<N> ∈ τ}  (T-App_{C})

It is easy to check that λ_{C}^{−} satisfies the unicity of types property. Unfortunately, the system λ_{C}^{−} is not sufficiently well-behaved to be of independent interest. For example, it does not satisfy the subject reduction property. The failure is such that β-reductions on well typed terms can yield illegal terms. For example, if C = {(β, α)}, then y:β ⊢_{λ_{C}}^{−} (λx:α.x)c_{β,α}<y> ∈ α, but y:β ⊢_{λ_{C}}^{−} c_{β,α}<y> ∈ α is not a derivable statement.

The following lemma shows that λ_{C}^{−} is an intermediate step between Algλ_{⩽} and λ_{C}.

7.7. SIMPLY TYPED λ-CALCULUS AND λ_{C} 137

Lemma 7.6.6 1. If Γ ⊢_{λ_{C}}^{−} M ∈ σ then Γ ⊢_{λ_{C}} M ∈ σ.

2. If Γ ⊢_{λ_{C}} M ∈ σ then there exists τ such that τ ⩽_{C} σ and Γ ⊢_{λ_{C}}^{−} M ∈ τ.

3. If Γ ⊢_{λ_{C}}^{−} M ∈ σ then Γ ⊢_{Algλ_{⩽}} |M| ∈ σ.

4. If Γ ⊢_{Algλ_{⩽}} M ∈ σ then Γ ⊢_{λ_{C}}^{−} dec_{Γ}(M) ∈ σ.

5. If Γ ⊢_{λ_{C}}^{−} M ∈ σ then dec_{Γ}(|M|) = M.

6. If Γ ⊢_{Algλ_{⩽}} M ∈ σ then |dec_{Γ}(M)| = M.

Observe that lemma 7.6.2 is now a consequence of items 2 and 3 of the last lemma; and the last four items say that Algλ_{⩽} and λ_{C}^{−} are equivalent in the sense that every term that can be typed in Algλ_{⩽} has its explicitly coerced version in λ_{C}^{−}, and every term that can be typed in λ_{C}^{−} has its implicitly coerced version in Algλ_{⩽}. Furthermore, the translation between the two systems does not cause any loss of information as long as no reduction is involved.

7.7 Simply typed λ-calculus and λ_{C}

In this section we show how to translate λ_{C} into λ→. The first step of this translation consists of representing subtyping statements as λ→-terms. For this we define an environment in which there is a typing statement for each subtyping axiom of C as follows.

Definition 7.7.1 The environment Σ_{C}. Let k_{α_{1},β_{1}}...k_{α_{n},β_{n}} be different constants of K. Then,

Σ_{C} = {k_{α_{1},β_{1}}:α_{1}→β_{1}, ..., k_{α_{n},β_{n}}:α_{n}→β_{n}},

such that (α_{i}, β_{i})∈C if and only if k_{α_{i},β_{i}}∈Σ_{C}.

Observe that k_{α_{i},β_{i}} is just a mnemonic name for a constant. Next we define the function find that finds a term that performs the coercion from σ to τ if σ ⩽_{C} τ. For that we use the following auxiliary definition.

Definition 7.7.2 (Typed composition)

f ∘_{σ} g = λx:σ.f(gx).

For the sake of readability we use simply ∘.

If we look at C as a directed graph, there may be more than one path between two variables of C, and that is the reason why a choice is involved. An example of such situation is the following.

Example 7.7.3 Suposse C = {(α, β); (β, γ); (α, δ); (δ, γ)}. Then there are two non-convertible terms that perform the coercion from α to γ, namely

k_{β,γ} ∘ k_{α,β} and k_{δ,γ} ∘ k_{α,δ}.

Therefore, we assume a choice function choose so that find is well defined.

Definition 7.7.4 find : 𝕋 × 𝕋 × 2^{𝕍×𝕍}→Λ(λ→).

find(σ, σ, C) = λx:σ.x,
find(α, β, C) = choose{k_{γ_{n−1},γ_{n}} ∘ ... ∘ k_{γ_{0},γ_{1}}|γ_{0} ≡ α,

γ_{n} ≡ β and (γ_{i}, γ_{i+1})∈C, for every i∈{1..n} },

find(σ_{1}→σ_{2}, τ_{1}→τ_{2}, C) = λx:σ_{1}→σ_{2}.find(σ_{2}, τ_{2}, C) ∘ x ∘ find(τ_{1}, σ_{1}, C).

where α ≠ β, σ_{1} ≠ τ_{1} and σ_{2} ≠ τ_{2}.

Observe that find is a partial mapping, given that choose may fail, and it is only defined when the first and second arguments are in the ⩽_{C} relation. Note that if we impose the restriction that C must be transitively closed, then we can simplify the function find and redefine the second clause as

find(α, β, C) = k_{α,β}.

The next lemma states that if σ ⩽_{C} τ, then find(σ, τ, C) is a codification of a subtyping statement in the simply typed lambda calculus without subtyping.

Lemma 7.7.5 If σ ⩽_{C} τ, then ⊢_{Σ_{C}} find(σ, τ, C) ∈ σ→τ.

Proof: By induction on the complexity of σ.

Case 1. σ is a variable. Then, by lemma 7.2.5(2), τ is also a variable. According to lemma 7.2.5(3), we can distinguish two cases.

Case 1a. σ ≡ τ. Then, by definition, find(σ, τ, C) ≡ λx:σ.x. Furthermore, it holds that ⊢_{Σ_{C}} λx:σ.x ∈ σ→σ.

Case 1b. trans(σ, τ, C). Then, as ⊢_{λ_{C}} k_{γ_{i},γ_{j}} ∈ γ_{i}→γ_{j}, by the definition of

Σ_{C}, we have that ⊢_{Σ_{C}} k_{γ_{n−1},γ_{n}} ∘ ... ∘ k_{γ_{0},γ_{1}} ∈ σ→τ.

Case 2. σ ≡ σ_{1}→σ_{2}. Then, by lemma 7.2.5(2), τ ≡ τ_{1}→τ_{2}. If σ ≡ τ, the result follows as in Case 1a. Otherwise, by lemma 7.2.6, τ_{1} ⩽_{C} σ_{1} and σ_{2} ⩽_{C} τ_{2}. By the induction hypothesis, we have

⊢_{Σ_{C}} find(τ_{1}, σ_{1}, C) ∈ τ_{1}→σ_{1} and
⊢_{Σ_{C}} find(σ_{2}, τ_{2}, C) ∈ σ_{2}→τ_{2}.

Hence, ⊢_{Σ_{C}} λx:σ_{1}→σ_{2}.find(σ_{2}, τ_{2}, C) ∘ x ∘ find(τ_{1}, σ_{1}, C)σ→τ ∈ . □

Observe that, actually, this result could be obtained as a corollary of these two facts:

• If σ ⩽_{C} τ, then find(σ, τ, C) is defined, and

• If find(σ, τ, C) is defined, then ⊢_{Σ_{C}} find(σ, τ, C) ∈ σ→τ.

With the following definition we can relate the system λ_{C} with λ→.

Definition 7.7.6 M^{→} (The λ→ version of M). ^{→}:Λ(λ_{C}) → Λ(λ→).

x^{→} = x,
(λx:σ.M)^{→} = λx:σ.M^{→},
(MN)^{→} = M^{→}N^{→},
(c_{σ,τ}<M>)^{→} = find(σ, τ, C)M^{→}.

Then, M^{→} is obtained from M by replacing the coercion constants by terms that will perform the corresponding coercion.

Note that ^{→} is a total function because the existence of c_{σ,τ} implies σ ⩽_{C} τ.

Proposition 7.7.7 Let M in Λ(λ_{C}). Then, If Γ ⊢_{λ_{C}} M ∈ σ, then Γ ⊢_{Σ_{C}} M^{→} ∈ σ.

Proof: By induction on the derivation of Γ ⊢_{λ_{C}} M ∈ σ.

T-Var Let M ≡ x. Then x:σ∈Γ. As x^{→} ≡ x, using the T-Var rule in λ→ we get Γ ⊢_{Σ_{C}} x^{→} ∈ σ.

T-Abs Let M ≡ λx:ρ.N and σ ≡ ρ→τ. Then Γ ⊢_{λ_{C}} λx:ρ.N ∈ ρ→τ follows from Γ, x:ρ ⊢_{λ_{C}} N ∈ τ. By the induction hypothesis, it follows that Γ, x:ρ ⊢_{Σ_{C}} N^{→} ∈ τ. By T-Abs, we conclude Γ ⊢_{Σ_{C}} λx:ρ.N^{→} ∈ ρ→τ, and, by the definition of ^{→}, Γ ⊢_{Σ_{C}} (λx:ρ.N)^{→} ∈ ρ→τ.

T-App M ≡ NP, and Γ ⊢_{λ_{C}} NP ∈ σ follows from the statements Γ ⊢_{λ_{C}} P ∈ τ and Γ ⊢_{λ_{C}} N ∈ τ→σ for some τ. By the induction hypothesis, the T-App rule of λ→, and the definition of ^{→}, the result follows.

T-Coerce M is c_{τ,σ}<N> and Γ ⊢_{λ_{C}} c_{τ,σ}<N> ∈ σ follows from Γ ⊢_{λ_{C}} N ∈ τ and τ ⩽_{C} σ. By the induction hypothesis, Γ ⊢_{Σ_{C}} N^{→} ∈ τ, and due to lemma 7.7.5, ⊢_{Σ_{C}} find(τ, σ, C) ∈ τ→σ. Finally, using the weakening lemma together with the T-App rule of λ→, and the definition of ^{→}, we get Γ ⊢_{Σ_{C}} (c_{τ,σ}<N>)^{→} ∈ σ. □

Proposition 7.7.8 Let M in Λ(λ_{C}). Then

Γ ⊢_{Σ_{C}} M^{→} ∈ σ ⇒ Γ ⊢_{λ_{C}} M ∈ σ.

Proof: By induction on the complexity of M.

Case 1. M ≡ x∈V. Then M^{→} ≡ x. By the free variable lemma of λ→, we can conclude that x:σ∈Γ, and, by T-Var Γ ⊢_{λ_{C}} x ∈ σ.

Case 2. M ≡ P Q. Then M^{→} ≡ P^{→}Q^{→}. By generation, there exists τ such that

Γ ⊢_{Σ_{C}} P^{→} ∈ τ→σ and Γ ⊢_{Σ_{C}} Q^{→} ∈ τ.

By the induction hypothesis,

Γ ⊢_{λ_{C}} P ∈ τ→σ and Γ ⊢_{λ_{C}} Q ∈ τ.

By T-App, we get Γ ⊢_{λ_{C}} P Q ∈ σ.

Case 3. M ≡ λx:τ.N. Then M^{→} ≡ λx:τ.N^{→}. By generation, it follows that Γ, x:τ ⊢_{Σ_{C}} N^{→} ∈ ρ and σ ≡ τ→ρ. We now can apply the induction hypothesis and we get Γ, x:τ ⊢_{λ_{C}} N ∈ ρ, and to that we only have to apply the T-Abs rule to get Γ ⊢_{λ_{C}} λx:τ.N ∈ σ.

Case 4. M ≡ c_{τ,σ}<N>. Then, M^{→} ≡ find(τ, σ, C)N^{→}. Recall that the constant c_{τ,σ} exists if and only if τ ⩽_{C} σ. Then using lemma 7.7.5, we know that ⊢_{Σ_{C}} find(τ, σ, C) ∈ τ→σ. By generation, the unicity of types lemma, and the weakening lemma, it follows that Γ ⊢_{Σ_{C}} N^{→} ∈ τ. By the induction hypothesis, we have Γ ⊢_{λ_{C}} N ∈ τ. Finally, by applying T-Coerce, it follows that Γ ⊢_{λ_{C}} c_{τ,σ}<N> ∈ σ. □

Putting together the last two propositions we can state the following theorem.

Theorem 7.7.9 Let M in Λ(λ_{C}). Then,

Γ ⊢_{λ_{C}} M ∈ σ ⇔ Γ ⊢_{Σ_{C}} M^{→} ∈ σ.

This last result can be read as follows. The simply typed λ-calculus without subtyping is an appropriate model for the simply typed λ-calculus with subtyping. We can also extract from it the conclusion that the simply typed λ-calculus with explicit subtyping is a conservative extension of the λ-calculus without subtyping, because if M is a λ→ term then M^{→} ≡ M.

Metatheory of λ_{C}

The system λ_{C} is of independent interest. The previous theorem and the fact that M^{→} is always defined, imply that the type checking and type inference problems are decidable given that the corresponding problems in λ→ are (see [Bar92]). Recall that a pseudoterm M is called strongly normalizing if there is no infinite reduction chain starting from M. We reduce the strong normalization property of λ_{C} to the strong normalization result for λ→ (see [Bar92]).

First, we prove some auxiliary results first.

Lemma 7.7.10 (Substitution lemma) Let M, N in Λ(λ_{C}) and x∈V. Then

(M[x:=N])^{→} = M^{→}[x:=N^{→}]

7.7. SIMPLY TYPED λ-CALCULUS AND λ_{C} 141

Proof: By induction on the complexity of M. We consider here only two cases, the missing ones are proven in a similar way.

• M ≡ x.

(x[x:=N])^{→} = N^{→}  by definition of [:=].
= x[x:=N^{→}]  by definition of [:=].
= x^{→}[x:=N^{→}] by definition of ^{→}.

• M ≡ c_{σ,τ}<P >.

(c_{σ,τ}<P >[x:=N])^{→} = c_{σ,τ}<P [x:=N]>^{→}  by definition of [:=].
= find(σ, τ, C)(P [x:=N])^{→}  by definition of ^{→}.
= find(σ, τ, C)(P^{→}[x:=N^{→}]) by the induction

hypothesis.

= (find(σ, τ, C)P^{→})[x:=N^{→}]
= (c_{σ,τ}<P >)^{→}[x:=N^{→}]  by definition of ^{→}.

Observe that find(σ, τ, C) is a closed term. □ Lemma 7.7.11 (Reduction preservation) Let M, N in Λ(λ_{C}). Then, if M →_{β} N, then M^{→} →_{β} N^{→}. Proof: By induction on the complexity of M. Case 1. If M∈V the result is vacuously true. Case 2. M ≡ λx:σ.M_{1}. Then N is of the form λx:σ.N_{1}, where M_{1} →_{β} N_{1}. By the

induction hypothesis and the definition of ^{→}, the result holds. Case 3. M ≡ M_{1}M_{2}. Then we have the following three cases.

1. N ≡ N_{1}M_{2}, where M_{1} →_{β} N_{1},

2. N ≡ M_{1}N_{2}, where M_{2} →_{β} N_{2} and,

3. M ≡ (λx:σ.P)M_{2} and N ≡ P [x:=M_{2}]. The first two cases follow from the induction hypothesis and the definition of ^{→} and the third is a consequence of the substitution lemma.

Case 4. M ≡ c_{σ,τ}<M_{1}>. The result follows from the induction hypothesis and

the definition of ^{→}. □ Theorem 7.7.12 (Strong normalization for λ_{C})

If Γ ⊢_{λ_{C}} M ∈ σ, then M is strongly normalizing.

Proof: Suppose, towards a contradiction, that M is not strongly normalizing. This means that there exists an infinite reduction chain starting from M. By the reduction preservation lemma (7.7.11), we know that there is also an infinite chain of reductions starting from M^{→}, and using proposition 7.7.7, we know that

Γ ⊢_{Σ_{C}} M^{→} ∈ σ.

But, we also know that λ→ has the strong normalization property which yields a contradiction. Hence, M is strongly normalizing. □

7.8 Confluence

Using the results about confluence of orthogonal combinatory reduction systems (CRSs) in [vR92], we can state that the systems λ_{C} and λ_{⩽} are confluent as a consequence of what we have already proven in this chapter. The sets of pseudoterms Λ(λ_{C}) with the β-reduction rule and Λ(λ_{⩽}) with the β-reduction rule are, according to the definitions of [vR92], two orthogonal CRSs. The subject reduction property of λ_{C} (7.5.6) and of λ_{⩽} (7.4.20), imply that the corresponding sets of legal terms are two substructures of Λ(λ_{C}) and Λ(λ_{⩽}) respectively. Since substructures of orthogonal CRSs are also orthogonal, it follows that the systems λ_{C} and λ_{⩽} are confluent.

7.9 Conclusions

In this chapter we analyze two different styles of subtyping, subtyping with implicit coercions and subtyping with explicit coercions. We define and study two alternative presentations of subtyping for simply typed lambda calculus. The first one λ_{⩽}, a system with implicit coercions, and the second one λ_{C}, a system with explicit coercions. We show that the system λ_{⩽} can be translated into λ_{C}, and, in its turn, λ_{C} can be translated into λ→. In other words, both disciplines can be compiled into the simply typed lambda calculus without subtyping.

Future research

The study of the meta-theory of a rich typed lambda-calculus such as F_{∧}^{ω} has drawn our attention towards open and challenging problems such as the ones listed below.

A normalizing fragment of F_{∧}^{ω}

Although the reduction on types →_{β∧} is strongly normalizing on well-kinded types, the reductions on terms are not strongly normalizing for the simple reason that every closed term can be assigned a type. Therefore we would like to characterize a normalizing subset of the language of terms. A similar situation arises for the intersection type discipline à la Curry studied by the group in Torino. In their framework, a term e is strongly normalizing if and only if there exists a derivation of a typing statement with e as subject which does not contain the maximal type ω. In our case, this statement is not true. A very simple counterexample is the term

λx:⊤^{⋆}.x,

which is in normal form and all whose derivations contain the maximal type ⊤^{⋆}. This problem is subject of current research by Mariangiola Dezani and the author of this thesis.

Bounded operator abstraction

In F_{∧}^{ω} and also in F_{≤}^{ω}, abstraction on types is of the form ΛX:K.T, and its associated formation rule is

\frac{Γ, X≤⊤^{K_{1}}:K_{1} ⊢ T_{2} ∈ K_{2}}{Γ ⊢ ΛX:K_{1}.T_{2} ∈ K_{1}→K_{2}.}  (K-OAbs)

A natural enrichment of the theory would replace ΛX:K.T by ΛX≤S:K.T, using the following formation rule.

\frac{Γ, X≤S:K_{1} ⊢ T_{2} ∈ K_{2}}{Γ ⊢ ΛX≤S:K.T ∈ ∀X≤S:K_{1}.K_{2}.}  (K-Bounded-OAbs)

This means that we need to modify the language of kinds because S, the bound of X, is required in order to assign a kind to a type operator application. Then the formation rule is as follows.

\frac{Γ ⊢ T ∈ ∀X≤S:K_{1}.K_{2} Γ ⊢ S′ ≤ S}{Γ ⊢ T S′ ∈ K_{2}[X←S′]}  (K-Bounded-OApp)

Consequently, the kind inference and kind checking algorithms become more complicated, since they involve checking a subtyping judgement. The meta-theory and applications of this extension are the subject of current research by Paula Severi and the author of this thesis.

Subtyping dependent types

The type-theoretic foundations of proof development systems include the Automath family of calculi [dB80], the Edinburgh Logical Framework [HHP92], the Calculus of Constructions [CH88], Extended Calculus of Constructions [Luo90], and Martin-Löf type theory [SNP90]. Implementations of these theories have been used in a number of proof development systems (Automath at Eindhoven, Coq at INRIA, Lego at the LFCS, and Alf at Göteborg). A common feature of these systems is their heavy reliance on dependent types, and the consequent difficulty of their meta-theoretic analysis.

The interaction of subtyping with dependent types seems to be the principal obstacle to its integration in proof development systems. Some work in this area has been started by Cardelli [Car87, Car88b], who gives basic definitions and some ideas about type checking algorithms, and by Pfenning [Pfe93], who has proposed variants of the Logical Framework and the Calculus of Constructions with refinement types, a simple form of intersection types whose interaction with type conversion and dependency is strictly controlled. Aside from these preliminary efforts, the area remains unexplored.

The system λP is an extension of the simply typed lambda calculus with dependent types [Bar92]. The meta-theory of λP_{≤}, an extension of λP with subtyping, is being developed by David Aspinall and the author of this thesis.

Appendix A

Summary of Definitions

A.1 F_{∧}^{ω}

A.1.1 Reduction rules for types

1. (ΛX:K.T_{1})T_{2} →_{β∧} T_{1}[X←T_{2}]

2. S → ⋀^{⋆}[T_{1}..T_{n}] →_{β∧} ⋀^{⋆}[S→T_{1} .. S→T_{n}]

3. ∀X≤S:K.⋀^{⋆}[T_{1}..T_{n}] →_{β∧} ⋀^{⋆}[∀X≤S:K.T_{1} .. ∀X≤S:K.T_{n}]

4. ΛX:K_{1}.⋀^{K_{2}}[T_{1}..T_{n}] →_{β∧} ⋀^{K_{1}→K_{2}}[ΛX:K_{1}.T_{1} .. ΛX:K_{1}.T_{n}]

5. ⋀^{K_{1}→K_{2}}[T_{1}..T_{n}] U →_{β∧} ⋀^{K_{2}}[T_{1} U .. T_{n} U]

6. ⋀^{K}[T_{1} .. ⋀^{K}[S_{1}..S_{n}] .. T_{m}] →_{β∧} ⋀^{K}[T_{1} .. S_{1}..S_{n} .. T_{m}]

A.1.2 Reduction rules for terms

1. (λx:T_{1}.e_{1})e_{2} →_{βfors} e_{1}[x←e_{2}]

2. (λX≤T_{1}:K_{1}.e)T →_{βfors} e[X←T]

3. (for(X∈T_{1}..T_{n})e_{1})e_{2} →_{βfors} for(X∈T_{1}..T_{n})e_{1} e_{2}

4. for(X∈T_{1}..T_{n})e →_{βfors} e, if X ∉ FV(e)

A.1.3 Context formation rules

∅ ⊢ ok  (C-Empty)

\frac{Γ ⊢ T ∈ ⋆ x ∉ dom(Γ)}{Γ, x:T ⊢ ok}  (C-Var)

\frac{Γ ⊢ T ∈ K  X ∉ dom(Γ)}{Γ, X≤T:K ⊢ ok}  (C-TVar)

146 APPENDIX A. SUMMARY OF DEFINITIONS

A.1.4 Kinding rules

\frac{Γ_{1}, X≤T:K, Γ_{2} ⊢ ok}{Γ_{1}, X≤T:K, Γ_{2} ⊢ X ∈ K}  (K-TVar)
\frac{Γ ⊢ T_{1} ∈ ⋆ Γ ⊢ T_{2} ∈ ⋆}{Γ ⊢ T_{1}→T_{2} ∈ ⋆}  (K-Arrow)
\frac{Γ, X≤T_{1}:K_{1} ⊢ T_{2} ∈ ⋆}{Γ ⊢ ∀(X≤T_{1}:K_{1})T_{2} ∈ ⋆}  (K-All)
\frac{Γ, X≤⊤^{K_{1}}:K_{1} ⊢ T_{2} ∈ K_{2}}{Γ ⊢ Λ(X:K_{1})T_{2} ∈ K_{1}→K_{2}}  (K-OAbs)
\frac{Γ ⊢ S ∈ K_{1}→K_{2} Γ ⊢ T ∈ K_{1}}{Γ ⊢ S T ∈ K_{2}}  (K-OApp)
\frac{Γ ⊢ ok for each i, Γ ⊢ T_{i} ∈ K}{Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ∈ K}  (K-Meet)

A.1.5 Subtyping rules

\frac{Γ ⊢ S ∈ K  Γ ⊢ T ∈ K  S =_{β∧} T}{Γ ⊢ S ≤ T}  (S-Conv)
\frac{Γ ⊢ S ≤ T  Γ ⊢ T ≤ U}{Γ ⊢ S ≤ U}  (S-Trans)
\frac{Γ_{1}, X≤T:K, Γ_{2} ⊢ ok}{Γ_{1}, X≤T:K, Γ_{2} ⊢ X ≤ T}  (S-TVar)
\frac{Γ ⊢ T_{1} ≤ S_{1} Γ ⊢ S_{2} ≤ T_{2} Γ ⊢ S_{1}→S_{2} ∈ ⋆}{Γ ⊢ S_{1}→S_{2} ≤ T_{1}→T_{2}}  (S-Arrow)
\frac{Γ, X≤U:K ⊢ S ≤ T Γ ⊢ ∀X≤U:K.S ∈ ⋆}{Γ ⊢ ∀X≤U:K.S ≤ ∀X≤U:K.T} (S-All)
\frac{Γ, X≤⊤^{K}:K ⊢ S ≤ T}{Γ ⊢ ΛX:K.S ≤ ΛX:K.T}  (S-OAbs)
\frac{Γ ⊢ S ≤ T Γ ⊢ S U ∈ K}{Γ ⊢ S U ≤ T U} (S-OApp)
\frac{for each i, Γ ⊢ S ≤ T_{i} Γ ⊢ S ∈ K}{Γ ⊢ S ≤ ⋀^{K}[T_{1}..T_{n}]}  (S-Meet-G)
\frac{Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ∈ K}{Γ ⊢ ⋀^{K}[T_{1}..T_{n}] ≤ T_{i}}  (S-Meet-LB)

A.1. F_{∧}^{ω} 147

A.1.6 Typing rules

\frac{Γ_{1}, x:T , Γ_{2} ⊢ ok}{Γ_{1}, x:T , Γ_{2} ⊢ x ∈ T}  (T-Var)
\frac{Γ, x:T_{1} ⊢ e ∈ T_{2}}{Γ ⊢ λx:T_{1}.e ∈ T_{1}→T_{2}}  (T-Abs)
\frac{Γ ⊢ f ∈ T_{1}→T_{2} Γ ⊢ a ∈ T_{1}}{Γ ⊢ f a ∈ T_{2}}  (T-App)
\frac{Γ, X≤T_{1}:K_{1} ⊢ e ∈ T_{2}}{Γ ⊢ λX≤T_{1}:K_{1}.e ∈ ∀X≤T_{1}:K_{1}.T_{2}}  (T-TAbs)
\frac{Γ ⊢ f ∈ ∀X≤T_{1}:K_{1}.T_{2} Γ ⊢ S ≤ T_{1}}{Γ ⊢ f S ∈ T_{2}[X←S]}  (T-TApp)
\frac{Γ ⊢ e[X←S] ∈ T S ∈ \{S_{1}..S_{n}\}}{Γ ⊢ for(X∈S_{1}..S_{n})e ∈ T} (T-For)
\frac{Γ ⊢ ok for each i, Γ ⊢ e ∈ T_{i}}{Γ ⊢ e ∈ ⋀^{⋆}[T_{1}..T_{n}]}  (T-Meet)
\frac{Γ ⊢ e ∈ S  Γ ⊢ S ≤ T}{Γ ⊢ e ∈ T}  (T-Subsumption)

A.1.7 Subtype checking, AlgF_{∧}^{ω} subtyping rules

\frac{Γ ⊢ X ∈ K}{Γ ⊢_{Alg} X ≤ X}  (AlgS-TVarRefl)
\frac{Γ ⊢ T S ∈ K}{Γ ⊢_{Alg} T S ≤ T S}  (AlgS-OAppRefl)
\frac{Γ ⊢_{Alg} Γ(X) ≤ A X ≢ A}{Γ ⊢_{Alg} X ≤ A}  (AlgS-TVar)
\frac{Γ ⊢_{Alg} T_{1} ≤ S_{1} Γ ⊢_{Alg} S_{2} ≤ T_{2} Γ ⊢ S_{1}→S_{2} ∈ ⋆}{Γ ⊢_{Alg} S_{1}→S_{2} ≤ T_{1}→T_{2}} (AlgS-Arrow)
\frac{Γ, X≤U:K ⊢_{Alg} S ≤ T Γ ⊢ ∀X≤U:K.S ∈ ⋆}{Γ ⊢_{Alg} ∀X≤U:K.S ≤ ∀X≤U:K.T} (AlgS-All)
\frac{Γ, X≤⊤^{K}:K ⊢_{Alg} S ≤ T}{Γ ⊢_{Alg} ΛX:K.S ≤ ΛX:K.T}  (AlgS-OAbs)
\frac{Γ ⊢_{Alg} (lub_{Γ}(T S))^{nf} ≤ A Γ ⊢ T S ∈ K T S ≢ A}{Γ ⊢_{Alg} T S ≤ A} (AlgS-OApp)
\frac{∀i∈\{1..m\} Γ ⊢_{Alg} A ≤ T_{i} Γ ⊢ A ∈ K}{Γ ⊢_{Alg} A ≤ ⋀^{K}[T_{1}..T_{m}]}  (AlgS-∀)
\frac{∃j∈\{1..n\} Γ ⊢_{Alg} S_{j} ≤ A ∀k∈\{1..n\} Γ ⊢ S_{k} ∈ K}{Γ ⊢_{Alg} ⋀^{K}[S_{1}..S_{n}] ≤ A}  (AlgS-∃)

\frac{∀i∈\{1..m\} ∃j∈\{1..n\} Γ ⊢_{Alg} S_{j} ≤ T_{i} ∀k∈\{1..n\} Γ ⊢ S_{k} ∈ K}{Γ ⊢_{Alg} ⋀^{K}[S_{1}..S_{n}] ≤ ⋀^{K}[T_{1}..T_{m}]} (AlgS-∀∃)

A.1.8 Type inference

Definition [Homomorphic extension of lub to intersections, lub^{∗}]

lub_{Γ}^{∗}(X) = Γ(X),
lub_{Γ}^{∗}(S T) = lub_{Γ}^{∗}(S) T,
lub_{Γ}^{∗}(⋀^{K}[T_{1}..T_{n}]) = ⋀^{K}[T′_{1}..T′_{n}], if ∃i∈{1..n} such that lub_{Γ}^{∗}(T_{i})↓,

where T′_{i} is lub_{Γ}^{∗}(T_{i}), if lub_{Γ}^{∗}(T_{i})↓, and T_{i} otherwise.

Definition [Functional Least Upper Bound] The functional least upper bound of a type T, in a context Γ, flub_{Γ}(T) is defined as follows.

flub_{Γ}(T) = \{ \begin{matrix}flub_{Γ}(lub_{Γ}^{∗}(T^{nf})), & if lub_{Γ}^{∗}(T^{nf})↓; \\ T^{nf}, & otherwise.^{1} \end{matrix}

Definition [arrows and alls ]

1. arrows (T_{1}→T_{2})  = {T_{1}→T_{2}},

arrows (⋀^{⋆}[T_{1}..T_{n}]) = ∪_{i∈{1..n}} arrows (T_{i}),
arrows (T)  = ∅,
if T ≢ T_{1}→T_{2} and T ≢ ⋀^{⋆}[T_{1}..T_{n}].

2. alls (∀X≤T_{1}:K.T_{2}) = {∀X≤T_{1}:K.T_{2}},

alls (⋀^{⋆}[T_{1}..T_{n}])  = ∪_{i∈{1..n}} alls (T_{i}),
alls (T)  = ∅,
if T ≢ ∀X≤T_{1}:K.T_{2} and T ≢ ⋀^{⋆}[T_{1}..T_{n}].

Type inference rules

\frac{Γ_{1}, x:T , Γ_{2} ⊢ ok}{Γ_{1}, x:T , Γ_{2} ⊢_{inf} x ∈ T}  (AT-Var)
\frac{Γ, x:T_{1} ⊢_{inf} e ∈ T_{2}}{Γ ⊢_{inf} λx:T_{1}.e ∈ T_{1}→T_{2}}  (AT-Abs)
\frac{Γ ⊢_{inf} f ∈ T  Γ ⊢_{inf} a ∈ S}{Γ ⊢_{inf} f a ∈ ⋀^{⋆}[T_{i} | S_{i}→T_{i} ∈ arrows (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}]}  (AT-App)
\frac{Γ, X≤T_{1}:K_{1} ⊢_{inf} e ∈ T_{2}}{Γ ⊢_{inf} λX≤T_{1}:K_{1}.e ∈ ∀X≤T_{1}:K_{1}.T_{2}}  (AT-TAbs)

\frac{Γ ⊢_{inf} f ∈ T}{Γ ⊢_{inf} f S ∈ ⋀^{⋆}[T_{i}[X←S] | ∀X≤S_{i}:K.T_{i} ∈ alls (flub_{Γ}(T)) and Γ ⊢ S ≤ S_{i}]}

(AT-TApp)

\frac{for all i∈\{1..n\} Γ ⊢_{inf} e[X←S_{i}]∈T_{i}}{Γ ⊢_{inf} for(X∈S_{1}..S_{n})e ∈ ⋀^{⋆}[T_{1}..T_{n}]}  (AT-For)

A.2. FIRST ORDER SUBTYPING 149

A.2 First order subtyping

A.2.1 λ_{⩽}

Γ ⊢_{λ_{⩽}} x ∈ σ if x:σ∈Γ  (T-Var)
\frac{Γ, x:σ ⊢_{λ_{⩽}} M ∈ τ}{Γ ⊢_{λ_{⩽}} λx:σ.M ∈ σ→τ}  (T-Abs)
\frac{Γ ⊢_{λ_{⩽}} M ∈ σ→τ Γ ⊢_{λ_{⩽}} N ∈ σ}{Γ ⊢_{λ_{⩽}} MN ∈ τ} (T-App)
\frac{Γ ⊢_{λ_{⩽}} M ∈ σ σ ⩽_{C} τ}{Γ ⊢_{λ_{⩽}} M ∈ τ}  (T-Subsumption)

A.2.2 λ_{C}

Γ ⊢_{λ_{C}} x ∈ σ, if x:σ∈Γ  (T-Var)
\frac{Γ, x:σ ⊢_{λ_{C}} M ∈ τ}{Γ ⊢_{λ_{C}} λx:σ.M ∈ σ→τ}  (T-Abs)
\frac{Γ ⊢_{λ_{C}} M ∈ σ→τ Γ ⊢_{λ_{C}} N ∈ σ}{Γ ⊢_{λ_{C}} MN ∈ τ} (T-App)
\frac{Γ ⊢_{λ_{C}} M ∈ σ σ ⩽_{C} τ}{Γ ⊢_{λ_{C}} c_{σ,τ}<M> ∈ τ}  (T-Coerce)

150 APPENDIX A. SUMMARY OF DEFINITIONS

Bibliography

[AC93] Roberto M. Amadio and Luca Cardelli. Subtyping recursive types. ACM Transactions on Programming Languages and Systems, 15(4):575–631, 1993. A preliminary version appeared in POPL ’91 (pp. 104–118), and as DEC Systems Research Center Research Report number 62, August 1990.

[AH87] A. Avron and I. Honsell, F.and Mason. Using typed lambda calculus to implement formal systems on a machine. Technical Report ECS-LFCS-87-31, LFCS, University of Edinburgh, July 1987.

[Bar84] H. P. Barendregt. The Lambda Calculus. North Holland, revised edition, 1984.

[Bar90] Henk P. Barendregt. Functional programming and lambda calculus. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science, volume B: Formal Models and Semantics, chapter 7, pages 323–363. Elsevier Science Publishers B. V. (North-Holland), 1990.

[Bar92] H. Barendregt. Lambda calculi with types. In T. S. E. Maibaum S. Abramsky, Dov M. Gabbay, editor, Handbook of Login in Computer Science, volume 2, pages 117–309. Clarendon Press. Oxford, 1992.

[BCD83] H. P. Barendregt, M. Coppo, and M. Dezani-Ciancaglini. A filter lambda model and the completeness of type assignment. Journal of Symbolic Logic, 48(4):931–940, 1983.

[BCGS91] Val Breazu-Tannen, Thierry Coquand, Carl Gunter, and Andre Scedrov. Inheritance as implicit coercion. Information and Computation, 93:172–221, 1991.

[BL90] Kim B. Bruce and Giuseppe Longo. A modest model of records, inheritance, and bounded quantification. Information and Computation, 87:196– 240, 1990. Also in [GM94]. An earlier version appeared in the proceedings of the IEEE Symposium on Logic in Computer Science, 1988.

[BM92] Kim Bruce and John Mitchell. PER models of subtyping, recursive types and higher-order polymorphism. In Proceedings of the Nineteenth ACM Symposium on Principles of Programming Languages, Albequerque, NM, January 1992.

[BMM90] Kim B. Bruce, Albert R. Meyer, and John C. Mitchell. The semantics of second-order lambda calculus. In Huet [Hue90], pages 213–272. Also appeared in Information and Computation 84, 1 (January 1990).

[Bru94] Kim B. Bruce. A paradigmatic object-oriented programming language: Design, static typing and semantics. Journal of Functional Programming, 4(2), April 1994. A preliminary version appeared in POPL 1993 under the title “Safe Type Checking in a Statically Typed Object-Oriented Programming Language”.

[Car87] Luca Cardelli. Typechecking dependent types and subtypes. In Proc. of the Workshop on Foundations of Logic and Functional Programming, Trento, Italy, December 1987.

[Car88a] Luca Cardelli. A semantics of multiple inheritance. Information and Computation, 76:138–164, 1988. Preliminary version in Semantics of Data Types, Kahn, MacQueen, and Plotkin, eds., Springer-Verlag LNCS 173, 1984.

[Car88b] Luca Cardelli. Structural subtyping and the notion of power type. In Proceedings of the 15th ACM Symposium on Principles of Programming Languages, pages 70–79, San Diego, CA, January 1988.

[Car90] Luca Cardelli. Notes about F_{<:}^{ω}. Unpublished manuscript, October 1990.

[Car92] Luca Cardelli. Extensible records in a pure calculus of subtyping. Research report 81, DEC Systems Research Center, January 1992. Also in [GM94].

[CC90] Felice Cardone and Mario Coppo. Two extensions of Curry’s type inference system. In Piergiorgio Odifreddi, editor, Logic and Computer Science, number 31 in APIC Studies in Data Processing, pages 19–76. Academic Press, 1990.

[CCH^{+}89] Peter Canning, William Cook, Walter Hill, Walter Olthoff, and John Mitchell. F-bounded quantification for object-oriented programming. In Fourth International Conference on Functional Programming Languages and Computer Architecture, pages 273–280, September 1989.

[CD80] M. Coppo and M. Dezani-Ciancaglini. An extension of the basic functionality theory for the λ-calculus. Notre-Dame Journal of Formal Logic, 21(4):685– 693, October 1980.

[CDC78] M. Coppo and M. Dezani-Ciancaglini. A new type-assignment for λ-terms. Archiv. Math. Logik, 19:139–156, 1978.

[CDdL93] Felice Cardone, Mariangiola Dezani-Ciancaglini, and Ugo de’ Liguoro. Combining type disciplines, 1993. Manuscript.

[CG92] Pierre-Louis Curien and Giorgio Ghelli. Coherence of subsumption: Minimum typing and type-checking in F_{≤}. Mathematical Structures in Computer Science, 2:55–91, 1992. Also in [GM94].

[CH88] Thierry Coquand and Gérard Huet. The Calculus of Constructions. Information and Computation, 76(2/3):95–120, February/March 1988.

[CHC90] William R. Cook, Walter L. Hill, and Peter S. Canning. Inheritance is not subtyping. In Seventeenth Annual ACM Symposium on Principles of Programming Languages, pages 125–135, San Francisco, CA, January 1990. Also in [GM94].

[Chu36] Alonzo Church. An unsolvable problem of elementary number theory. Amer. J. Math, 58:354–363, 1936.

[Chu41] Alonzo Church. The Calculi of Lambda Conversion. Princeton University Press, 1941.

[CL91] Luca Cardelli and Giuseppe Longo. A semantic basis for Quest. Journal of Functional Programming, 1(4):417–458, October 1991. Preliminary version in ACM Conference on Lisp and Functional Programming, June 1990. Also available as DEC SRC Research Report 55, Feb. 1990.

[CM91] Luca Cardelli and John Mitchell. Operations on records. Mathematical Structures in Computer Science, 1:3–48, 1991. Also in [GM94], and available as DEC Systems Research Center Research Report #48, August, 1989, and in the proceedings of MFPS ’89, Springer LNCS volume 442.

[Com94] Adriana B. Compagnoni. Subtyping in F_{∧}^{ω} is decidable. Technical Report ECS-LFCS-94-281, LFCS, University of Edinburgh, January 1994. Presented at Computer Science Logic, September 1994, under the title “Decidability of Higher-Order Subtyping with Intersection Types”.

[CP93] Adriana B. Compagnoni and Benjamin C. Pierce. Multiple inheritance via intersection types. Technical Report ECS-LFCS-93-275, LFCS, University of Edinburgh, August 1993. Also available as Catholic University Nijmegen computer science technical report 93-18.

[CP94] Giuseppe Castagna and Benjamin Pierce. Decidable bounded quantification. In Proceedings of Twenty-First Annual ACM Symposium on Principles of Programming Languages, Portland, OR. ACM, January 1994.

[CW85] Luca Cardelli and Peter Wegner. On understanding types, data abstraction, and polymorphism. Computing Surveys, 17(4), December 1985.

[dB72] Nicolas G. de Bruijn. Lambda-calculus notation with nameless dummies: a tool for automatic formula manipulation with application to the Church-Rosser theorem. Indag. Math., 34(5):381–392, 1972.

[dB80] Nicolas G. de Bruijn. A survey of the project AUTOMATH. In J. P. Seldin and J. R. Hindley, editors, To H. B. Curry: Essays in Combinatory Logic, Lambda Calculus, and Formalism, pages 589–606. Academic Press, 1980.

[FM94] Kathleen Fisher and John Mitchell. Notes on typed object-oriented programming. In Proceedings of Theoretical Aspects of Computer Software, Sendai, Japan, pages 844–885. Springer-Verlag, April 1994. LNCS 789.

[FMRS90] P. Freyd, P. Mulry, G. Rosolini, and D. Scott. Extensional PERs. In Fifth Annual Symposium on Logic in Computer Science (Philadelphia, PA), pages 346–354. IEEE Computer Society Press, June 1990.

[Ghe90] Giorgio Ghelli. Proof Theoretic Studies about a Minimal Type System Integrating Inclusion and Parametric Polymorphism. PhD thesis, Università di Pisa, March 1990. Technical report TD–6/90, Dipartimento di Informatica, Università di Pisa.

[Ghe94] Giorgio Ghelli, January 1994. Message to the Types mailing list.

[Gir72] Jean-Yves Girard. Interprétation fonctionelle et élimination des coupures de l’arithmétique d’ordre supérieur. PhD thesis, Université Paris VII, 1972.

[GM94] Carl A. Gunter and John C. Mitchell. Theoretical Aspects of Object-Oriented Programming: Types, Semantics, and Language Design. The MIT Press, 1994.

[HHP92] Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. Journal of the ACM, 40(1):143–184, 1992. Preliminary version in LICS’87.

[HP95] Martin Hofmann and Benjamin Pierce. A unifying type-theoretic framework for objects. Journal of Functional Programming, 1995. To appear. Previous versions appeared in the Symposium on Theoretical Aspects of Computer Science, 1994, and, under the title “An Abstract View of Objects and Subtyping (Preliminary Report),” as University of Edinburgh, LFCS technical report ECS-LFCS-92-226, 1992.

[HS86] J. Roger Hindley and Jonathan P. Seldin. Introduction to Combinators and λ-Calculus, volume 1 of London Mathematical Society Student Texts. Cambridge University Press, 1986.

[Hue90] Gérard Huet, editor. Logical Foundations of Functional Programming. University of Texas at Austin Year of Programming Series. Addison-Wesley, 1990.

[Lan65] P. J. Landin. A correspondence between ALGOL–60 and Church’s lambda notation. Communications of the ACM, 8:89–101, 1965.

[Luo90] Zhaohui Luo. An Extended Calculus of Constructions. PhD thesis, University of Edinburgh, 1990.

[Mar73] Per Martin-Löf. An intuitionistic theory of types: predicative part. In H. E. Rose and J. C. Shepherdson, editors, Logic Colloquium, ’73, pages 73–118, Amsterdam, 1973. North Holland.

[Mit84] J. C. Mitchell. Lambda Calculus Models of Typed Programming Languages. PhD thesis, Massachusetts Institute of Technology, 1984.

[Mit90a] John C. Mitchell. Toward a typed foundation for method specialization and inheritance. In Proceedings of the 17th ACM Symposium on Principles of Programming Languages, pages 109–124, January 1990. Also in in [GM94].

[Mit90b] John C. Mitchell. A type-inference approach to reduction properties and semantics of polymorphic expressions. In Huet [Hue90], pages 195–212.

[Mit90c] John C. Mitchell. Type systems for programming languages. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science, volume B: Formal Models and Semantics, chapter 8, pages 365–458. Elsevier Science Publishers B. V. (North-Holland), 1990.

[Pfe93] Frank Pfenning. Refinement types for logical frameworks. In Informal Proceedings of the 1993 Workshop on Types for Proofs and Programs, pages 315–328, May 1993.

[Pie91] Benjamin C. Pierce. Programming with Intersection Types and Bounded Polymorphism. PhD thesis, Carnegie Mellon University, December 1991. Available as School of Computer Science technical report CMU-CS-91-205.

[PT94] Benjamin C. Pierce and David N. Turner. Simple type-theoretic foundations for object-oriented programming. Journal of Functional Programming, 4(2):207–247, April 1994. A preliminary version appeared in Principles of Programming Languages, 1993, and as University of Edinburgh technical report ECS-LFCS-92-225, under the title “Object-Oriented Programming Without Recursive Types”.

[Rey80] John Reynolds. Using category theory to design implicit conversions and generic operators. In N. D. Jones, editor, Proceedings of the Aarhus Workshop on Semantics-Directed Compiler Generation, number 94 in Lecture Notes in Computer Science. Springer-Verlag, January 1980. Also in [GM94].

[Rey88] John C. Reynolds. Preliminary design of the programming language Forsythe. Technical Report CMU-CS-88-159, Carnegie Mellon University, June 1988.

[Sco76] Dana Scott. Data types as lattices. SIAM Journal on Computing, 5(3):522– 587, 1976.

[SNP90] Jan Smith, Bengt Nordström, and Kent Petersson. Programming in Martin-Löf’s Type Theory. An Introduction. Oxford University Press, 1990.

[SP94] Martin Steffen and Benjamin Pierce. Higher-order subtyping. In IFIP Working Conference on Programming Concepts, Methods and Calculi (PRO-COMET), June 1994. An earlier version appeared as University of Edinburgh technical report ECS-LFCS-94-280 and Universität Erlangen-Nürnberg Interner Bericht IMMD7-01/94, February 1994.

[vR92] Femke. van Raamsdonk. A simple proof of confluence for weakly orthogonal combinatory reduction systems. Technical Report CS-R9234, CWI, Amsterdam, August 1992.

[Wan87] Mitchell Wand. A simple algorithm and proof for type inference. Fundamenta Informaticae X, pages 115–122, 1987. North Holland.

156 BIBLIOGRAPHY

Curriculum Vitæ

July 1984 - December 1986 Courses of the Licenciatura en Ciencias Matemáticas

at Universidad de Buenos Aires, Argentina.

March 1987 - December 1989 Licenciatura en Informática

at Escuela Superior Latino-Americana de Informática, Buenos Aires, Argentina.

January 1990 Undergraduate degree: Licenciada en Informática

Escuela Superior Latino-Americana de Informática,

June 1990 - May 1994 PhD program at the Katholieke Universiteit Nijmegen,

Nijmegen, The Netherlands. NWO-SION project Typed lambda calculus, 612-316-030.

October 1993 - April 1994 Visited the Laboratory for Foundations of Computer Science,

University of Edinburgh, Scotland.

From June 1994 Research Fellow

at the Laboratory for Foundations of Computer Science, University of Edinburgh, Scotland. EPSRC GRANT, GR/G 55792. Constructive logic as a basis for program development.

158

Samenvatting

Subtypering is een primitieve relatie waarmee op een uniforme wijze begrippen uit diverse gebieden van de informatica kunnen worden beschreven. In het geval dat S en T verzamelingen zijn, betekent S ≤ T (S is een subtype van T): elementen van S zijn ook elementen van T. Als S en T specificaties zijn, dan voldoen elementen die aan de specificatie S voldoen, ook aan T. Als S en T objectbeschrijvingen zijn in objectgeoriënteerd programmeren, dan betekent S ≤ T dat het op plaatsen waar een object met interface T wordt verwacht, ook een object met interface S gebruikt mag worden. Wanneer S en T module interfaces zijn in een software systeem, dan is een implementatie van S ook een implementatie van T. Als S en T stellingen zijn, dan is een bewijs van S ook een bewijs van T. Het begrijpen van de essentie, de subtiliteiten, en de algemene eigenschapen van subtypering, werpt licht op een omvangrijk gebied.

Dit proefschift bevat twee delen. Het eerste deel geeft een gedetailleerde analyse van de meta-theorie van een getypeerde lambda calculus waarin intersectietypes en hogereorde begrensde quantificatie worden gecombineerd. Ons onderzoek betreft syntactische, semantische en pragmatische aspecten.

• In hoofdstuk 2 definiëren we het systeem F_{∧}^{ω}, en bewijzen we een aantal elementaire eigenschappen.

– We definëren de getypeerde lambda calculus F_{∧}^{ω}, een natuurlijke generalisatie van Girard’s systeem F^{ω} met intersectietypes en begrensd polymorfisme. Een nieuw aspect van onze presentatie is het gebruik van termherschrijftechnieken om intersectietypes te definiëren, waardoor de computationele semantiek (reductieregels) duidelijk van de syntax (inferentieregels) van het systeem wordt gescheiden.

– De reductieregels van F_{∧}^{ω} kunnen gesplitst worden in twee hoofdgroepen: reductie van types (→_{β∧}) en reductie van termen (→_{βfors}). Hoewel confluentie in het algemeen niet een modulaire eigenschap is, is het in ons geval wel mogelijk om een modulair bewijs te geven. In sectie 2.3, combineren we de onafhankelijke bewijzen van confluentie voor reductie van types en confluentie voor reductie van termen, tot een bewijs van confluentie van de reductierelatie van het gehele systeem.

– We bewijzen de sterke normalisatie eigenschap van →_{β∧} op goedgevormde types.

• Hoofdstuk 3 bevat het meest belangrijke resultaat van dit proefschrift. Onze voornaamste bijdrage is het bewijs van het feit dat subtypering in F_{∧}^{ω} beslisbaar is. Dit resultaat heeft een oplossing tot gevolg voor het tot nu toe open probleem van de beslisbaarheid van subtypering in F_{≤}^{ω}, het intersectie-vrije deel van F_{∧}^{ω}, omdat het subtyperinssysteem van F_{∧}^{ω} een conservatieve uitbreiding van de subtyperingsrelatie van F_{≤}^{ω} is. Verder is de beslisbaarheid van subtypering essentieel voor de beslisbaarheid van type checking en type inferentie. Een andere oorspronkelijke bijdrage is het gebruik van een keuzeoperator om het gedrag van variabelen tijdens subtype checking te modelleren. Het bewijs van de beslisbaarheid wordt opgesplitst in de volgende stappen.

– We definiëren een algoritmische presentatie van de subtyperingsrelatie, waarbij we alleen types in normaalvorm beschouwen.

– We bewijzen dat deze algoritmische presentatie sound en complete is met betrekking tot de definitie van subtypering, dat wil zeggen dat hij een deterministische procedure bepaalt voor het checken van subtypering in F_{∧}^{ω}.

– Tenslotte bewijzen we dat de door de algoritmische presentatie beschreven procedure termineert. Het bewijs van terminatie wordt herleid tot de sterke normalisatie-eigenschap van reductie op types, uitgebreid met een keuzereductie die het gedrag van variabelen tijdens het checken van subtypering modelleert.

• In hoofdstuk 4 bewijzen we dat F_{∧}^{ω} de minimale type-eigenschap heeft, en we beschrijven een algoritme voor het berekenen van de minimale types. Bovendien bewijzen we dat type inferentie en type checking in F_{∧}^{ω} beslisbaar zijn. De minimale type-eigenschap wordt gebruikt om te bewijzen dat F_{∧}^{ω} de subject reductieeigenschap heeft.

• In hoofdstuk 5 definiëren we een model gebaseerd op partiële equivalentierelaties, en we bewijzen dat de subtyperingsrelatie sound is met betrekking tot dit model.

• Hoewel F_{∧}^{ω} gedefinieerd was om een model te creëren voor object georiënteerd programmeren met multiple inheritance, is het niet de bedoeling van dit proefschrift om de grondslagen van object georiënteerd programmeren te behandelen. In hoofdstuk 6, laten we zien hoe multiple inheritance met behulp van subtypering gemodelleerd kan worden. Dit is een voortzetting van het onderzoek naar de type-theoretische grondslagen van object georiënteerd programmeren door Pierce en Turner [PT94], die multiple inheritance buiten beschouwing laten.

In het tweede deel van dit proefschrift worden twee verschillende stijlen van subtypering bestudeerd: subtypering met impliciete coërcies en subtypering met expliciete coërcies. We definiëren en bestuderen twee alternatieve presentaties van subtypering voor de simpel getypeerde lambda calculus. De eerste, λ_{⩽}, is een systeem met impliciete coërcies, en de tweede, λ_{C}, is een systeem met expliciete coërcies. We laten zien dat het systeem λ_{⩽} vertaald kan worden in λ_{C}, en dat λ_{C} vertaald kan worden in λ→. Vanuit een pragmatische invalshoek betekent dat, dat impliciete of expliciete coërcies slechts een kwestie van smaak zijn, en dat beide benaderingen vertaald kunnen worden in de simpel getypeerde lambda calculus zonder subtypering.

Translated by Jan Kuper