Relational program veri cation is a variant of program veri cation where one can reason about two programs and as a special case about two executions of a single program on di erent inputs. Relational program veri cation can be used for reasoning about a broad range of properties, including equivalence and re nement, and specialized notions such as continuity, information ow security or relative cost. In a higher-order se ing, relational program veri cation can be achieved using relational re nement type systems, a form of re nement types where assertions have a relational interpretation. Relational re nement type systems excel at relating structurally equivalent terms but provide limited support for relating terms with very di erent structures.We present a logic, called Relational Higher Order Logic (RHOL), for proving relational properties of a simply typed λ-calculus with inductive types and recursive de nitions. RHOL retains the type-directed avour of relational re nement type systems but achieves greater expressivity through rules which simultaneously reason about the two terms as well as rules which only contemplate one of the two terms. We show that RHOL has strong foundations, by proving an equivalence with higher-order logic (HOL), and leverage this equivalence to derive key meta-theoretical properties: subject reduction, admissibility of a transitivity rule and set-theoretical soundness. Moreover, we de ne sound embeddings for several existing relational type systems such as relational re nement types and type systems for dependency analysis and relative cost, and we verify examples that were out of reach of prior work.
ACM Reference format:Contributions. We present a new logic, called Relational Higher Order Logic (RHOL, § 5), for reasoning about relational properties of higher-order programs wri en in a variant of Plotkin's PCF ( § 2). e logic manipulates judgments of the form:where Γ is a simply typed context, σ 1 and σ 2 are (possibly di erent) simple types, t 1 and t 2 are terms, Ψ is a set of assertions, and ϕ is an assertion. Our logic retains the type-directed nature of (relational) re nement type systems, and features typing rules for reasoning about structurally similar terms. However, disentangling types from assertions also makes it possible to de ne type-directed rules operating on a single term (le or right) of the judgment. is confers great expressivity to the logic, without signi cantly a ecting its type-directed nature, and opens the possibility to alternate freely between two-sided and one-sided reasoning, as done in rst-order imperative languages. e validity of judgments is expressed relative to a set-theoretical semantics-our variant of PCF is restricted to terms which admit a set-theoretical semantics, including strongly normalizing terms. More precisely, a judgment Γ | Ψ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | ϕ is valid if for every valuation ρ (mapping variables in the context Γ to elements in the interpretation of their types), the interpretation of ϕ is true whenever the interpretation of (a...