Library Fsub_LetSum_Soundness

Type-safety proofs for Fsub.

Authors: Brian Aydemir and Arthur Chargu\'eraud, with help from Aaron Bohannon, Jeffrey Vaughan, and Dimitrios Vytiniotis.

In parentheses are given the label of the corresponding lemma in the appendix (informal proofs) of the POPLmark Challenge.

Table of contents:

Require Export Fsub_LetSum_Lemmas.

Properties of subtyping


Reflexivity (1)


Lemma sub_reflexivity : forall E T,
  wf_env E ->
  wf_typ E T ->
  sub E T T.

Weakening (2)


Lemma sub_weakening : forall E F G S T,
  sub (G ++ E) S T ->
  wf_env (G ++ F ++ E) ->
  sub (G ++ F ++ E) S T.

Narrowing and transitivity (3)


Definition transitivity_on Q := forall E S T,
  sub E S Q -> sub E Q T -> sub E S T.

Lemma sub_narrowing_aux : forall Q F E Z P S T,
  transitivity_on Q ->
  sub (F ++ Z ~ bind_sub Q ++ E) S T ->
  sub E P Q ->
  sub (F ++ Z ~ bind_sub P ++ E) S T.


Lemma sub_transitivity : forall Q,
  transitivity_on Q.

Lemma sub_narrowing : forall Q E F Z P S T,
  sub E P Q ->
  sub (F ++ Z ~ bind_sub Q ++ E) S T ->
  sub (F ++ Z ~ bind_sub P ++ E) S T.

Type substitution preserves subtyping (10)


Lemma sub_through_subst_tt : forall Q E F Z S T P,
  sub (F ++ Z ~ bind_sub Q ++ E) S T ->
  sub E P Q ->
  sub (map (subst_tb Z P) F ++ E) (subst_tt Z P S) (subst_tt Z P T).

Properties of typing


Weakening (5)


Lemma typing_weakening : forall E F G e T,
  typing (G ++ E) e T ->
  wf_env (G ++ F ++ E) ->
  typing (G ++ F ++ E) e T.

Strengthening (6)


Lemma sub_strengthening : forall x U E F S T,
  sub (F ++ x ~ bind_typ U ++ E) S T ->
  sub (F ++ E) S T.

Narrowing for typing (7)


Lemma typing_narrowing : forall Q E F X P e T,
  sub E P Q ->
  typing (F ++ X ~ bind_sub Q ++ E) e T ->
  typing (F ++ X ~ bind_sub P ++ E) e T.

Substitution preserves typing (8)


Lemma typing_through_subst_ee : forall U E F x T e u,
  typing (F ++ x ~ bind_typ U ++ E) e T ->
  typing E u U ->
  typing (F ++ E) (subst_ee x u e) T.

We provide detailed comments for the following proof, mainly to point out several useful tactics and proof techniques.

Starting a proof with "Proof with <some tactic>" allows us to specify a default tactic that should be used to solve goals. To invoke this default tactic at the end of a proof step, we signal the end of the step with three periods instead of a single one, e.g., "apply typing_weakening...".

Proof with simpl_env;
           eauto 4 using wf_typ_strengthening,
                         wf_env_strengthening,
                         sub_strengthening.

The proof proceeds by induction on the given typing derivation for e. We use the remember tactic, along with generalize dependent, to ensure that the goal is properly strengthened before we use induction.

  intros U E F x T e u TypT TypU.
  remember (F ++ x ~ bind_typ U ++ E) as E'.
  generalize dependent F.
  induction TypT; intros F EQ; subst; simpl subst_ee...

The typing_var case involves a case analysis on whether the variable is the same as the one being substituted for.

  Case "typing_var".
    destruct (x0 == x); try subst x0.

In the case where x0=x, we first observe that hypothesis H0 implies that T=U, since x can only be bound once in the environment. The conclusion then follows from hypothesis TypU and weakening. We can use the analyze_binds_uniq tactic, described in the MetatheoryEnv library, with H0 to obtain the fact that T=U.

    SCase "x0 = x".
      analyze_binds_uniq H0.
        injection BindsTacVal; intros; subst.

In order to apply typing_weakening, we need to rewrite the environment so that it has the right shape. (We could also prove a corollary of typing_weakening.) The rewrite_env tactic, described in the Environment library, is one way to perform this rewriting.

        rewrite_env (empty ++ F ++ E).
        apply typing_weakening...

In the case where x0<>x, the result follows by an exhaustive case analysis on exactly where x0 is bound in the environment. We perform this case analysis by using the analyze_binds tactic, described in the MetatheoryEnv library.

    SCase "x0 <> x".
      analyze_binds H0.
        eauto using wf_env_strengthening.
        eauto using wf_env_strengthening.

Informally, the typing_abs case is a straightforward application of the induction hypothesis, which is called H0 here.

  Case "typing_abs".

We use the "pick fresh and apply" tactic to apply the rule typing_abs without having to calculate the appropriate finite set of atoms.

    pick fresh y and apply typing_abs.

We cannot apply H0 directly here. The first problem is that the induction hypothesis has (subst_ee open_ee), whereas in the goal we have (open_ee subst_ee). The lemma subst_ee_open_ee_var lets us swap the order of these two operations.

    rewrite subst_ee_open_ee_var...

The second problem is how the concatenations are associated in the environments. In the goal, we currently have

(y ~ bind_typ V ++ F ++ E),


where concatenation associates to the right. In order to apply the induction hypothesis, we need

((y ~ bind_typ V ++ F) ++ E).


We can use the rewrite_env tactic to perform this rewriting, or we can rewrite directly with an appropriate lemma from the MetatheoryEnv library.

    rewrite <- app_assoc.

Now we can apply the induction hypothesis.

    apply H0...

The remaining cases in this proof are straightforward, given everything that we have pointed out above.

  Case "typing_tabs".
    pick fresh Y and apply typing_tabs.
    rewrite subst_ee_open_te_var...
    rewrite <- app_assoc.
    apply H0...
  Case "typing_let".
    pick fresh y and apply typing_let...
    rewrite subst_ee_open_ee_var...
    rewrite <- app_assoc.
    apply H0...
  Case "typing_case".
    pick fresh y and apply typing_case...
      rewrite subst_ee_open_ee_var...
        rewrite <- app_assoc.
        apply H0...
      rewrite subst_ee_open_ee_var...
        rewrite <- app_assoc.
        apply H2...
Qed.

Type substitution preserves typing (11)


Lemma typing_through_subst_te : forall Q E F Z e T P,
  typing (F ++ Z ~ bind_sub Q ++ E) e T ->
  sub E P Q ->
  typing (map (subst_tb Z P) F ++ E) (subst_te Z P e) (subst_tt Z P T).

Preservation


Inversion of typing (13)


Lemma typing_inv_abs : forall E S1 e1 T,
  typing E (exp_abs S1 e1) T ->
  forall U1 U2, sub E T (typ_arrow U1 U2) ->
     sub E U1 S1
  /\ exists S2, exists L, forall x, x `notin` L ->
     typing (x ~ bind_typ S1 ++ E) (open_ee e1 x) S2 /\ sub E S2 U2.


Lemma typing_inv_tabs : forall E S1 e1 T,
  typing E (exp_tabs S1 e1) T ->
  forall U1 U2, sub E T (typ_all U1 U2) ->
     sub E U1 S1
  /\ exists S2, exists L, forall X, X `notin` L ->
     typing (X ~ bind_sub U1 ++ E) (open_te e1 X) (open_tt S2 X)
     /\ sub (X ~ bind_sub U1 ++ E) (open_tt S2 X) (open_tt U2 X).

Lemma typing_inv_inl : forall E e1 T,
  typing E (exp_inl e1) T ->
  forall U1 U2, sub E T (typ_sum U1 U2) ->
  exists S1, typing E e1 S1 /\ sub E S1 U1.


Lemma typing_inv_inr : forall E e1 T,
  typing E (exp_inr e1) T ->
  forall U1 U2, sub E T (typ_sum U1 U2) ->
  exists S1, typing E e1 S1 /\ sub E S1 U2.


Preservation (20)


Lemma preservation : forall E e e' T,
  typing E e T ->
  red e e' ->
  typing E e' T.


Progress


Canonical forms (14)


Lemma canonical_form_abs : forall e U1 U2,
  value e ->
  typing empty e (typ_arrow U1 U2) ->
  exists V, exists e1, e = exp_abs V e1.

Lemma canonical_form_tabs : forall e U1 U2,
  value e ->
  typing empty e (typ_all U1 U2) ->
  exists V, exists e1, e = exp_tabs V e1.

Lemma canonical_form_sum : forall e T1 T2,
  value e ->
  typing empty e (typ_sum T1 T2) ->
  exists e1, e = exp_inl e1 \/ e = exp_inr e1.

Progress (16)


Lemma progress : forall e T,
  typing empty e T ->
  value e \/ exists e', red e e'.


This page has been generated by coqdoc