Library Fsub_LetSum_Soundness
Type-safety proofs for Fsub.
Authors: Brian Aydemir and Arthur Chargu\'eraud, with help from Aaron Bohannon, Jeffrey Vaughan, and Dimitrios Vytiniotis.
In parentheses are given the label of the corresponding lemma in the appendix (informal proofs) of the POPLmark Challenge.
Table of contents:
Authors: Brian Aydemir and Arthur Chargu\'eraud, with help from Aaron Bohannon, Jeffrey Vaughan, and Dimitrios Vytiniotis.
In parentheses are given the label of the corresponding lemma in the appendix (informal proofs) of the POPLmark Challenge.
Table of contents:
Lemma sub_weakening : forall E F G S T,
sub (G ++ E) S T ->
wf_env (G ++ F ++ E) ->
sub (G ++ F ++ E) S T.
Definition transitivity_on Q := forall E S T,
sub E S Q -> sub E Q T -> sub E S T.
Lemma sub_narrowing_aux : forall Q F E Z P S T,
transitivity_on Q ->
sub (F ++ Z ~ bind_sub Q ++ E) S T ->
sub E P Q ->
sub (F ++ Z ~ bind_sub P ++ E) S T.
Lemma sub_transitivity : forall Q,
transitivity_on Q.
Lemma sub_narrowing : forall Q E F Z P S T,
sub E P Q ->
sub (F ++ Z ~ bind_sub Q ++ E) S T ->
sub (F ++ Z ~ bind_sub P ++ E) S T.
Lemma sub_through_subst_tt : forall Q E F Z S T P,
sub (F ++ Z ~ bind_sub Q ++ E) S T ->
sub E P Q ->
sub (map (subst_tb Z P) F ++ E) (subst_tt Z P S) (subst_tt Z P T).
Lemma typing_weakening : forall E F G e T,
typing (G ++ E) e T ->
wf_env (G ++ F ++ E) ->
typing (G ++ F ++ E) e T.
Lemma sub_strengthening : forall x U E F S T,
sub (F ++ x ~ bind_typ U ++ E) S T ->
sub (F ++ E) S T.
Lemma typing_narrowing : forall Q E F X P e T,
sub E P Q ->
typing (F ++ X ~ bind_sub Q ++ E) e T ->
typing (F ++ X ~ bind_sub P ++ E) e T.
Lemma typing_through_subst_ee : forall U E F x T e u,
typing (F ++ x ~ bind_typ U ++ E) e T ->
typing E u U ->
typing (F ++ E) (subst_ee x u e) T.
We provide detailed comments for the following proof, mainly to
point out several useful tactics and proof techniques.
Starting a proof with "Proof with <some tactic>" allows us to specify a default tactic that should be used to solve goals. To invoke this default tactic at the end of a proof step, we signal the end of the step with three periods instead of a single one, e.g., "apply typing_weakening...".
Starting a proof with "Proof with <some tactic>" allows us to specify a default tactic that should be used to solve goals. To invoke this default tactic at the end of a proof step, we signal the end of the step with three periods instead of a single one, e.g., "apply typing_weakening...".
The proof proceeds by induction on the given typing derivation
for e. We use the remember tactic, along with generalize
dependent, to ensure that the goal is properly strengthened
before we use induction.
intros U E F x T e u TypT TypU.
remember (F ++ x ~ bind_typ U ++ E) as E'.
generalize dependent F.
induction TypT; intros F EQ; subst; simpl subst_ee...
The typing_var case involves a case analysis on whether the
variable is the same as the one being substituted for.
Case "typing_var".
destruct (x0 == x); try subst x0.
In the case where x0=x, we first observe that hypothesis
H0 implies that T=U, since x can only be bound once in
the environment. The conclusion then follows from hypothesis
TypU and weakening. We can use the analyze_binds_uniq
tactic, described in the MetatheoryEnv library, with H0 to
obtain the fact that T=U.
SCase "x0 = x".
analyze_binds_uniq H0.
injection BindsTacVal; intros; subst.
In order to apply typing_weakening, we need to rewrite
the environment so that it has the right shape. (We could
also prove a corollary of typing_weakening.) The
rewrite_env tactic, described in the Environment
library, is one way to perform this rewriting.
In the case where x0<>x, the result follows by an exhaustive
case analysis on exactly where x0 is bound in the
environment. We perform this case analysis by using the
analyze_binds tactic, described in the MetatheoryEnv
library.
SCase "x0 <> x".
analyze_binds H0.
eauto using wf_env_strengthening.
eauto using wf_env_strengthening.
Informally, the typing_abs case is a straightforward
application of the induction hypothesis, which is called H0
here.
Case "typing_abs".
We use the "pick fresh and apply" tactic to apply the rule
typing_abs without having to calculate the appropriate
finite set of atoms.
We cannot apply H0 directly here. The first problem is that
the induction hypothesis has (subst_ee open_ee), whereas in
the goal we have (open_ee subst_ee). The lemma
subst_ee_open_ee_var lets us swap the order of these two
operations.
The second problem is how the concatenations are associated in
the environments. In the goal, we currently have
where concatenation associates to the right. In order to apply the induction hypothesis, we need
We can use the rewrite_env tactic to perform this rewriting, or we can rewrite directly with an appropriate lemma from the MetatheoryEnv library.
(y ~ bind_typ V ++ F ++ E),
where concatenation associates to the right. In order to apply the induction hypothesis, we need
((y ~ bind_typ V ++ F) ++ E).
We can use the rewrite_env tactic to perform this rewriting, or we can rewrite directly with an appropriate lemma from the MetatheoryEnv library.
Now we can apply the induction hypothesis.
apply H0...
The remaining cases in this proof are straightforward, given
everything that we have pointed out above.
Case "typing_tabs".
pick fresh Y and apply typing_tabs.
rewrite subst_ee_open_te_var...
rewrite <- app_assoc.
apply H0...
Case "typing_let".
pick fresh y and apply typing_let...
rewrite subst_ee_open_ee_var...
rewrite <- app_assoc.
apply H0...
Case "typing_case".
pick fresh y and apply typing_case...
rewrite subst_ee_open_ee_var...
rewrite <- app_assoc.
apply H0...
rewrite subst_ee_open_ee_var...
rewrite <- app_assoc.
apply H2...
Qed.
Lemma typing_through_subst_te : forall Q E F Z e T P,
typing (F ++ Z ~ bind_sub Q ++ E) e T ->
sub E P Q ->
typing (map (subst_tb Z P) F ++ E) (subst_te Z P e) (subst_tt Z P T).
Lemma typing_inv_abs : forall E S1 e1 T,
typing E (exp_abs S1 e1) T ->
forall U1 U2, sub E T (typ_arrow U1 U2) ->
sub E U1 S1
/\ exists S2, exists L, forall x, x `notin` L ->
typing (x ~ bind_typ S1 ++ E) (open_ee e1 x) S2 /\ sub E S2 U2.
Lemma typing_inv_tabs : forall E S1 e1 T,
typing E (exp_tabs S1 e1) T ->
forall U1 U2, sub E T (typ_all U1 U2) ->
sub E U1 S1
/\ exists S2, exists L, forall X, X `notin` L ->
typing (X ~ bind_sub U1 ++ E) (open_te e1 X) (open_tt S2 X)
/\ sub (X ~ bind_sub U1 ++ E) (open_tt S2 X) (open_tt U2 X).
Lemma typing_inv_inl : forall E e1 T,
typing E (exp_inl e1) T ->
forall U1 U2, sub E T (typ_sum U1 U2) ->
exists S1, typing E e1 S1 /\ sub E S1 U1.
Lemma typing_inv_inr : forall E e1 T,
typing E (exp_inr e1) T ->
forall U1 U2, sub E T (typ_sum U1 U2) ->
exists S1, typing E e1 S1 /\ sub E S1 U2.
Lemma canonical_form_abs : forall e U1 U2,
value e ->
typing empty e (typ_arrow U1 U2) ->
exists V, exists e1, e = exp_abs V e1.
Lemma canonical_form_tabs : forall e U1 U2,
value e ->
typing empty e (typ_all U1 U2) ->
exists V, exists e1, e = exp_tabs V e1.
Lemma canonical_form_sum : forall e T1 T2,
value e ->
typing empty e (typ_sum T1 T2) ->
exists e1, e = exp_inl e1 \/ e = exp_inr e1.
This page has been generated by coqdoc