Type soundness proofs with definitional interpreters

Abstract

While type soundness proofs are taught in every graduate PL class, the gap between realistic languages and what is accessible to formal proofs is large. In the case of Scala, it has been shown that its formal model, the Dependent Object Types (DOT) calculus, cannot simultaneously support key metatheoretic properties such as environment narrowing and subtyping transitivity, which are usually required for a type soundness proof. Moreover, Scala and many other realistic languages lack a general substitution property. The first contribution of this paper is to demonstrate how type soundness proofs for advanced, polymorphic, type systems can be carried out with an operational semantics based on high-level, definitional interpreters, implemented in Coq. We present the first mechanized soundness proofs in this style for System F<: and several extensions, including mutable references. Our proofs use only straightforward induction, which is significant, as the combination of big-step semantics, mutable references, and polymorphism is commonly believed to require coinductive proof techniques. The second main contribution of this paper is to show how DOT-like calculi emerge from straightforward generalizations of the operational aspects of F<:, exposing a rich design space of calculi with path-dependent types inbetween System F and DOT, which we dub the System D Square. By working directly on the target language, definitional interpreters can focus the design space and expose the invariants that actually matter at runtime. Looking at such runtime invariants is an exciting new avenue for type system design. Categories and Subject Descriptors D.3.3 [Programming Languages]: Language Constructs and Features

Intrinsically-Typed Mechanized Semantics for Session Types

“…Several aspects of the formalization are standard: intrinsically typed abstract syntax with de Bruijn indexing [Benton et al 2012;Poulsen et al 2018;Wadler 2018], type-indexed values, and gas-driven evaluation [Amin and Rompf 2017;Owens et al 2016; Siek 2013]. In addition, we address the following key challenges.…”

“…The use of indexing to tame potential nontermination can be traced back to Appel and McAllester [2001]. It has been rejuvenated in the context of big-step semantics by Siek [2013] and Owens et al [2016], in proving type soundness with definitional interpreters [Amin and Rompf 2017], and in definitional interpretation for imperative languages [Poulsen et al 2018]. As these interpreters are universally quantified over gas, the respective properties hold for all terminating and nonterminating computations.…”

A Generalized Modality for Recursion

“…We will say that the evaluation of e occurred "at step n", or simply "at n" following the intuition that n is a Kripke world. Another intuition is that this judgment describes an interpreter receiving a certain amount n of "fuel" which controls how many times recursive definitions have to be unrolled [1].…”

A monadic framework for relational verification: applied to information security, program equivalence, and optimizations

“…We could then reason about the partial correctness of a program declared in this effect or to prove its termination after its definition. Going back to the while interpreter from §5.1, we could forget about the decreasing metric and use either Bove and Capretta's 2005 termination witnesses or step-indexing as in §3.3 (Amin and Rompf 2017;Owens et al 2016), proving, for example, noninterference of reachable states of an interactive non-terminating program. Observational purity Another desirable feature would be to hide the effect of a term if it is proven observationally pure, e.g., in §6.1 this would provide the ability to replace the original pure code by its equivalent memoized variant.…”