Strong Normalization of the Calculus of
Constructions with Type-Based Termination
Benjamin Grégoire and Jorge Luis Sacchini
INRIA Sophia Antipolis - Méditerranée, France
{Benjamin.Gregoire,Jorge-Luis.Sacchini}@inria.fr
Abstract. Termination of recursive functions is an important property
in proof assistants based on dependent type theories; it implies consistency and decidability of type checking. Type-based termination is
a mechanism for ensuring termination that uses types annotated with
size information to check that recursive calls are performed on smaller
arguments. Our long-term goal is to extend the Calculus of Inductive
Constructions with a type-based termination mechanism and prove its
logical consistency. In this paper, we present an extension of the Calculus of Constructions (including universes and impredicativity) with sized
natural numbers, and prove strong normalization and logical consistency.
Moreover, the proof can be easily adapted to include other inductive
types.
1
Introduction
Termination of recursive functions is an important property in proof assistants
based on dependent type theory; it implies consistency of the logic, and decidability of type checking. In current implementations, it is common to use syntactic criteria (called guard predicates) to ensure termination. Guard predicates
are applied to the body of recursive functions to check that recursive calls are
performed on structurally smaller arguments. However, these criteria are often
difficult to understand and implement.
An alternative approach is type-based termination. The basic idea is the use
of sized types, i.e., types decorated with size information. Termination is ensured
by typing constraints, restricting recursive calls to smaller arguments. Compared
to guard predicates, type-based termination provides a simple yet expressive
mechanism for ensuring termination.
In previous work by the first author [4], the Calculus of Inductive Constructions (CIC) was extended with a type-based termination mechanism. The
obtained system, called CICb, has many desirable metatheoretical properties,
including complete size inference. However, the logical consistency of CICb is
derived from a conjecture stating strong normalization of well-typed terms.
Our long-term goal is to define a type-based termination mechanism for CIC
that is proved consistent. This paper is a step in that direction. We present a
simplified version of CICb, called CICb− (Sect. 3).
2
Benjamin Grégoire and Jorge Luis Sacchini
Our main contribution is a proof of strong normalization (SN) and logical
consistency for CICb− restricted to one inductive type, namely natural numbers
(Sect. 4). The interpretation of natural numbers is done in a generic way, and
can be extended to other inductive types.
2
A Primer on Type-based Termination
Before giving the details of CICb− , this section introduces briefly the main ideas
of sized types and type-based termination. Consider the type of natural numbers,
defined by
nat : Type := O : nat | S : nat → nat .
With sized types, this defines a family of types of the form nats , where s is a
size (or stage) expression. Size information is used to type recursive functions,
as shown in the following (simplified) typing rule for fixpoint construction:
Γ (f : natı → U ) ` M : natbı → U [ı := bı]
Γ ` (fix f : nat → U := M ) : nats → U [ı := s]
where ı is a stage variable, and b· is the successor function on stages. Intuitively,
natı and natbı denote the type of natural numbers whose size is smaller than ı
and ı + 1, respectively. This intuition is reflected in the subtyping rule, stating
that natı ≤ natbı ≤ nat∞ , where nat∞ denotes the usual type of natural numbers.
In the typing rule above, the body of the fixpoint, M , is a function that takes
an argument of type natbı . The recursive calls to f in M are only allowed on terms
of type natı , that is, smaller than the size of the argument. This ensures that
recursion terminates. Note that the variable ı can appear (positively) in U , which
allows to write size-preserving functions. A typical example is the subtraction of
natural numbers, which has type nats → nat∞ → nats , for any s. We can then
write the division of natural numbers as1 :
fix div : nat → nat → nat :=
λ m n : nat. case mnat(bı) of
| O ⇒ Onat(bı)
| S m0nat(ı) ⇒ S (div (minus m0 n)nat(ı) n)nat(ı)
The type annotations are given for clarification only, and are not written in the
actual syntax. Since minus has type nats → nat∞ → nats , the recursive call in
div is well-typed. The function div also has type nats → nat∞ → nats .
Note in the case expression that m has type natbı , while the recursive argument m0 has a smaller type natı . This mechanism ensures that we can make
recursive calls on the recursive arguments of an inductive type. However, it is
more powerful than guard predicates, thanks to the possibility of typing sizepreserving functions. For example, extending the system with sized lists, typical
1
div m n computes
l
m
n+1
m
Strong Normalization of CC with Type-Based Termination
3
functions can be given more precise types:
map : Π(A B : Type).(A → B) → listı A → listı B
filter : Π(A : Type).(A → bool) → listı A → listı A × listı A
These functions allow to type programs that are not structurally recursive such
as quicksort:
fix qsort : list A → list A :=
λl : list A. case llist(bı) of
| nil ⇒ nil
| cons h tlist(ı) ⇒ let (s, g) = filter (< h) tlist(ı) in
append (qsort slist(ı) ) (cons h (qsort glist(ı) ))
Note that the precise typing of filter allows the recursive calls in the above
definition. However, in this case, qsort has type list∞ A → list∞ A. For further
examples and references, we refer the reader to [4].
3
System CICb−
CICb− is an extension of CIC with a type-based termination mechanism. In this
section we introduce the syntax and typing rules.
In order to treat impredicativity in the proof of SN, terms carry more type
annotations in the case of abstraction and application [2,10]. However, the system we intend to use has a more traditional presentation. In the traditional
presentation, abstractions have the form λx : T ◦ .M and applications have the
form M N . We give here the annotated presentation we use in the proof of SN.
The reduction rules and typing rules are adapted to the traditional presentation
in the obvious way. In App. A we give the complete presentation of CICb− in the
traditional form. In App. C we prove the equivalence between both presentations.
3.1
Syntax
We consider a predicative hierarchy of sorts Typei , for i ∈ N, and an impredicative sort Prop. The set of sorts is denoted U. We assume a denumerable set X of
term variables. We use u to denote sorts, and f , x, y to denote term variables.
Inductive types are annotated with stage expressions.
Definition 1 (Stages). The syntax of stages is given by the following grammar,
where XS denotes a denumerable set of stage variables.
S ::= XS | Sb | ∞
We use ı,  to denote stage variables, and s, r to denote stages. The base of
a stage expression is defined by bıc = ı and bb
sc = bsc (the base of a stage
containing ∞ is not defined).
4
Benjamin Grégoire and Jorge Luis Sacchini
The syntax features three classes of terms, whose difference lies in the type of
annotations that inductive types carry. (This helps to ensure subject reduction
and efficient type inference [4].) Bare terms carry no annotation. Position terms
carry either no annotation, or a ?, which is used to indicate recursive positions
in fixpoint functions. Finally, sized terms carry a stage expression.
Definition 2 (Terms). The generic set of terms over the set a is defined by
the grammar:
T [a] ::= X | U | λX :T ◦ .T ◦ T [a] | appX :T ◦ .T ◦ (T [a], T [a]) | ΠX : T [a].T [a]
| nata | O | S(T [a])
caseT ◦ X := T [a] of T [a], T [a] | fix X (X : nat? ) : T ? := T [a]
The set of bare terms, position terms and sized terms are defined by T ◦ ::= T [],
T ? ::= T [{, ?}], and T ::= T [S], respectively. We use M , N , P , T , U , C to
denote terms. Bare terms are usually denoted with a superscript ◦ and position
terms with a superscript ?, as in M ◦ and M ? .
To deal with the different classes of terms, we use two erasure functions: the
function |.| : T ? ∪ T → T ◦ removes all annotations from a term; the function
|.|ı : T → T ? replaces all stage annotations s with ? if bsc = ı, or by otherwise.
Given a term M , we write M ∞ to denote the term M where all size annotations
are replaced with ∞, and SV(M ) to denote the set of stage variables appearing
in M .
We write FV(M ) to denote the set of free term variables in M ; we omit its
definitions, since it is usual.
Definition 3. Reduction → is defined as the compatible closure of β-reduction,
ι-reduction and µ-reduction:
appx:T ◦ .U ◦ (λx:T ◦ .U ◦ M , N ) →β
caseT ◦ x := O of N0 , N1 →ι
caseT ◦ x := S(M ) of N0 , N1 →ι
appx:nat.|U ? | (F, C) →µ
M [x := N ]
N0
appy:nat.T ◦ [x:=S(y)] (N1 , M )
appx:nat.|U ? | (M [f := F ], C)
where F ≡ fix f (x : nat? ) : U ? := M and C is a term in constructor form (i.e.,
O or S(M ) for some term M ). We write ←, →∗ , ≈ and ↓ for the inverse relation, the reflexive transitive closure, the equivalence closure and the associated
joinability relation of →, respectively. (M ↓ N if M →∗ P and N →∗ P for
some P .)
The reduction relation defined above, usually called tight reduction, is not
confluent (on pseudoterms). However, is it confluent for well-typed terms (this
is a consequence of SN). (Note that the reduction in the traditional presentation
is confluent.)
Strong Normalization of CC with Type-Based Termination
5
Subtyping. We consider a subtyping relation derived from a partial order on
stages.
Definition 4 (Substage). The relation s is a substage of s0 , written s v s0 , is
defined by the rules:
svs
svr
rvp
svp
s v sb
sv∞
Definition 5 (Subtyping). The subtyping relation, ≤ ⊆ T × T , is defined by
following rules:
(sub-conv)
(sub-prod)
T ↓U
T ≤U
(sub-nat)
T →∗ Πx : T1 .T2
T →∗ nats
U →∗ Πx : U1 .U2
T ≤U
U →∗ natr
T ≤U
U1 ≤ T1
svr
T2 ≤ U2
We define a notion of positivity with respect to a stage variable. It is used in
the typing rules to restrict the types valid for recursion.
Definition 6. We say that ı is positive in T , written ı pos T , if for every pair
of stages s, r, such that s v r, T [ı := s] ≤ T [ı := r].
Remark: In the traditional presentation, the subtyping relation is defined in a
more standard way, as the reflexive transitive closure of the following rules:
T ≈U
T ≤U
U1 ≤ T1
T2 ≤ U2
Πx : T1 .T2 ≤ Πx : U1 .U2
svr
nats ≤ natr
We cannot use this definition in the annotated presentation, since reduction is
not confluent.
3.2
Typing rules
In the typing rules, we restrict the use of size variables appearing in types.
Intuitively, we only allow types that reduce to a term of the form
Πx1 : T1 .Πx2 : T2 . . . . Πxn : Tn .Tn+1 ,
(*)
where each Ti is of the form (*), or is of the form nats , or satisfies SV(Ti ) = ∅.
We call these types “simple”. Formally, we define a predicate simple with the
following clauses:
SV(T ) = ∅
simple(T )
simple(nats )
simple(T1 )
simple(T2 )
simple(Πx : T1 .T2 )
6
Benjamin Grégoire and Jorge Luis Sacchini
Contexts and judgments. A context is a sequence of the form (x1 : T1 )(x2 :
T2 ) . . . (xn : Tn ), where x1 , x2 , . . . , xn are distinct variables and T1 , T2 , . . . , Tn
are sized terms. We use Γ , ∆, Θ to denote contexts and [] to denote the empty
context.
We define two typing judgments: WF(Γ ) means that context Γ is well formed;
Γ ` M : T means that the term M has type T in Γ . The typing rules are given
in Fig. 1. The side conditions in some of the rules ensure that we restrict to
simple types. If we remove these side conditions, the resulting system is that of
CICb. In rule (fix) the condition ı ∈
/ SV(Γ, M ) is therefore redundant, but we
keep it to emphasize the difference with CICb.
Most of the rules are similar to that of CICb, with exception of the added type
annotations. Note in rules (zero) and (succ) that constructors have a successor
stage as type. In rule (case), as we mentioned in Sect. 2, the argument has type
nat with a successor stage, allowing the recursive arguments to have smaller size.
Note that, because of subtyping, any term of type nat can be given a successor
size. In rule (fix) we introduce a fresh size variable for recursion. Not every type
is valid for recursion, since it might lead to inconsistencies [1]. In our case, we
require the size variable used for recursion to appear positively in the return type.
The body, M , has a product type (function) with domain natbı , while recursive
calls to f can only be performed on terms of type natı .
Simple metatheory. Usual metatheoretic results such as weakening, substitution
and subject reduction can be proved for CICb− in the same way as for CICb. See
App. B.
4
Strong Normalization
In this section we prove the main results of the paper: strong normalization of
CICb− , and logical consistency (Theorem 2). The proof is based on Λ-sets as
introduced by Altenkirch in his PhD thesis [2], and later used by Melliès and
Werner [10] to prove strong normalization for Pure Type Systems.
A Λ-set X is a pair (X◦ , |=), where X◦ is a set, and |= ⊆ SN × X◦ is a realizability relation2 (SN denotes the set of strongly normalizing terms). Intuitively,
we define a set-theoretical interpretation (products are interpreted by function
spaces, abstractions by functions and applications by function application), denoted [·], corresponding to the set part of a Λ-set.
We prove that the interpretation is sound: if Γ ` M : T , then [M ] ∈ [T ]
(Lemma 15). We can then prove that every term realizes its interpretation
(Lemma 17), i.e. M |= [M ]. Strong normalization (Corollary 1) follows from
the fact that every realizers is strongly normalizing by definition.
In the case of CICb− , the interpretation given above does not take size information into account. We therefore define a second (relational) interpretation to
show that terms respect the size information given in the type (Sect. 4.3).
2
Actually, for technical reasons, our definition is slightly different.
Strong Normalization of CC with Type-Based Termination
(empty)
(var)
(type)
(abs)
(app)
(nat)
Γ (x) = T
Γ `x:T
s
WF(Γ )
(prop)
Γ `T :u
Γ ` Prop : Type0
Γ (x : T ) ` U : Typej
Γ ` Πx : T.U : max(u, Typej )
Γ `T :u
Γ (x : T ) ` U : Prop
Γ ` Πx : T.U : Prop
Γ (x : T ) ` M : U
Γ ` λx:|T |.|U | M : Πx : T.U
Γ ` M : Πx : T.U
SV(M ) = ∅
Γ `N :T
Γ ` appx:|T |.|U | (M, N ) : U [x := N ]
WF(Γ )
Γ ` nat : Type0
(case)
WF(Γ )
WF(Γ )
(Π-prop)
simple(T )
WF(Γ (x : T ))
Γ ` Typei : Typei+1
(Π-type)
Γ `T :u
WF(Γ )
(cons)
WF([])
(zero)
WF(Γ )
s
b
Γ ` O : nat
SV(N ) = ∅
(succ)
Γ ` M : natsb
Γ (x : natsb) ` P : u
Γ ` N0 : P [x := O]
Γ ` N1 : Πy : nats .P [x := S(y)]
(fix)
Γ ` case|P | x := M of N0 , N1 : P [x := M ]
T ≡ Π(x : natı ).U
ı pos U
ı∈
/ SV(Γ, M )
Γ `T :u
Γ (f : T ) ` M : T [ı := bı]
Γ ` fix f (x : nat? ) : |U |ı := M : T [ı := s]
(conv)
Γ `M :T
Γ `U :u
T ≤U
Γ `M :U
Fig. 1. Typing rules of CICb−
Γ ` M : nats
Γ ` S(M ) : natsb
SV(M ) = ∅
SV(M ) = ∅
simple(U )
7
8
4.1
Benjamin Grégoire and Jorge Luis Sacchini
Preliminary Definitions
In this section we give the concepts necessary to define the interpretation of
terms. Namely, saturated sets, Λ-sets, and inaccessible cardinals.
Saturated sets. We define saturated sets in terms of elimination contexts:
E[] ::= [] | appX :T ◦ .T ◦ (E[], T ) | caseT ◦ X := E[] of T , T
| appX :T ◦ .T ◦ (fix X (X : nat? ) : T ? := T , E[])
A term is atomic if it is of the form E[x]. We denote the set of atomic
terms with AT, and the set of strongly normalizing terms with SN. Weak-head
reduction is defined as E[M ] →wh E[N ] iff M →βιµ N .
Definition 7 (Saturated set). A set of terms X ⊆ SN is saturated iff it
satisfies the following conditions:
(S1) AT ∩ SN ⊆ X;
(S2) if M ∈ SN and M →wh M 0 and M 0 ∈ X, then M ∈ X.
Λ-sets. As mentioned above, we use Λ-sets [2,10] in the proof. However, our
definition is slightly different, as explained below.
Definition 8 (Λ-set). A Λ-set is a triple X = (X◦ , |=X , ⊥X ) where X◦ is a
non-empty set, witnessed by ⊥X ∈ X◦ , and |=X ⊆ T × X◦ .
X◦ is the carrier-set and the elements of X◦ are called the carriers of X. The
terms M such that M |=X α for some α ∈ X◦ are called the realizers of α. The
element ⊥X is called the atomic element of X. We write α ∈ X for α ∈ X◦ . A
Λ-set X is included in a Λ-set Y , written X ⊆ Y , if X◦ ⊆ Y◦ , |=X ⊆ |=Y , and
⊥X = ⊥Y .
Definition 9 (Saturated Λ-set). A Λ-set X is said to be saturated if
1. every realizer is strongly normalizable;
2. the atomic element ⊥X is realized by any atomic strongly normalizable term;
3. for every α ∈ X◦ , if N |=X α, and M →wh N with M ∈ SN, then M |=X α
(i.e., the set of realizers is closed under weak-head expansion).
The difference between the definition in [2,10] and ours is that the atomic
element of a Λ-set is explicit in the definition. The use of the atomic element
will be evident in the definition of the interpretation of terms. However, the
difference in the definition is not essential in our proof.
We define some operations on Λ-sets.
Definition 10 (Product). Let X be a Λ-set and {Yα }α∈X◦ a X◦ -indexed family of Λ-sets. We define the Λ-set Π(X, Y ) by:
S
– Π(X, Y )◦ = {f ∈ X◦ → α∈X◦ (Yα )◦ : ∀α ∈ X◦ .f (α) ∈ (Yα )◦ };
Strong Normalization of CC with Type-Based Termination
9
– M |=Π(X,Y ) f ⇐⇒ ∀α ∈ X◦ . N |=X α.∀T ◦ , U ◦ ∈ SN.∀x ∈ X .appx:T ◦ .U ◦ (M, N ) |=Yα
f (α);
– ⊥Π(X,Y ) = α ∈ X◦ 7→ ⊥Yα .
Lemma 1. If X and every {Yα }α∈X◦ are saturated Λ-sets, so is Π(X, Y ).
Definition 11 (Cartesian product). Let X, Y be Λ-sets. We define the Λ-set
X × Y by: (X × Y )◦ = X◦ × Y◦ ; M |=X×Y (α, β) ⇐⇒ M |=X α ∧ M |=Y β;
and ⊥X×Y = (⊥X , ⊥Y ).
We write X 2 for X × X.
Lemma 2. If X and Y are saturated Λ-sets, so is X × Y .
Definition 12 (Λ-morphism). Let X and Y be Λ-sets. A Λ-morphism f from
X to Y is a function f : X◦ → Y◦ , such that M |=X α ⇒ M |=Y f (α), and
f (⊥X ) = ⊥Y .
Definition 13 (Λ-iso). Let X and Y be Λ-sets. A Λ-iso f from X to Y is a Λmorphism such that f is a one-to-one function, and M |=X α ⇐⇒ M |=Y f (α).
Inaccessible cardinals. We assume an increasing sequence of inaccessible cardinals {λi }i∈N . Let Vα be the cumulative hierarchy of sets. We define Ui to be the
set of saturated Λ-set whose carrier-set are in Vλi . The set Ui can be viewed as a
Λ-set (Ui , SN × Ui , {∅})3 . Following [9], we interpret the predicative sorts using
large universes.
4.2
The interpretation
Stages. Stages are interpreted by ordinals. We use a, b, . . . to denote ordinals.
Since we have only natural numbers as a sized type, we can safely interpret stages
with the smallest infinite ordinal, ω. If we include higher-order sized types (such
as well-founded trees), we need to interpret stages using higher ordinals.
Definition 14 (Stage interpretation). A stage assignment π is a function
from XS to ω. Given a stage assignment π, the interpretation of a stage s under
π, written LsMπ , is defined by:
LıMπ = π(ı),
L∞Mπ = ω,
Lb
sMπ = LsMπ +̂ 1
where a +̂ 1 = a + 1 if a < ω, and ω +̂ 1 = ω.
We use ∞ to denote the stage assignment such that ∞(ı) = ω for all ı.
Lemma 3 (Stage substitution). For any stages s, r and any stage assignment
π, Lr [ı := s]Mπ = LrMπ(ı:=LsMπ ) .
Proof. By induction on the structure of r.
3
We choose {∅} as atomic element, but any element of Ui will do.
t
u
10
Benjamin Grégoire and Jorge Luis Sacchini
Inductive types. Inductive types are interpreted as the least fixed point of a
monotone operator. For our case, we define a function FN , such that if X is a
Λ-set, FN (X) is also a Λ-set defined by:
– FN (X)◦ = {∅} ∪ {(0, ∅)} ∪ {(1, α) : α ∈ X◦ };
– M |=FN (X) α, with M ∈ SN, iff one the following conditions holds:
• α = ∅ and M →wh ∗ N ∈ AT;
• α = (0, ∅) and M →wh ∗ O; or
• α = (1, α0 ) and M →wh ∗ S(M 0 ) with M 0 |=X α0 .
– ⊥FN (X) = ∅,
It is clear that if X is a saturated Λ-set, then FN (X) is also a saturated Λ-set.
Note that FN is monotone, in the sense that if X ⊆ Y , then FN (X) ⊆ FN (Y ).
k
We write FN
to mean function FN iterated k times.
Consider the Λ-set ⊥ = ({∅}, SN ∩ AT × {∅}, ∅). A fixpoint of FN (X) is
ω
(⊥).
reached by iterating ω times, starting from ⊥. Let N = FN
Impredicativity. Following [10], we interpret the impredicative universe as the
set of degenerated Λ-sets.
Definition 15. A Λ-set X is degenerated, if the carrier-set X◦ is a singleton
{A}, where A is a saturated set, M |=X A iff M ∈ A, and ⊥X = A.
We write A for the degenerated Λ-set corresponding to a saturated set A.
A proposition, i.e. a term T of type Prop, is represented by a degenerated Λ-set,
whose only carrier represents a (possible) canonical proof.
Given a Λ-set X and a function Y such that for each α ∈ X◦ , Yα is a
degenerated Λ-set (with carrier yα ), the carrier-set of Π(X, Y ) is a singleton (the
only element being α ∈ X◦ 7→ yα ). The canonical representation of Π(X, Y ) is
given by the degenerated Λ-set corresponding to the saturated set
↓(X, Y ) = {M ∈ SN : N |=X α ⇒ appx:T ◦ .U ◦ (M, N ) |=Yα yα } .
Note that there is a Λ-iso p(X, Y ) : Π(X, Y ) → ↓(X, Y ).
In the interpretation, we need to convert between the interpretation of a proof
term as an element of Π(X, Y ) (if it needs to be applied), or as the canonical
proof ↓(X, Y ). For this, we use the isomorphism p(X, Y ).
We define the functions ΠΓ `T , ↓Γ `T , ↑Γ `T that give the interpretation of
products, abstractions, and applications (respectively), depending if the type
T is a proposition or not. In the case of proposition, these functions convert
between Π(X, Y ) and the canonical representation ↓(X, Y ). Otherwise, there is
no conversion needed. Their definition is given by:
– if Γ ∞ ` T ∞ : Prop, then ΠΓ `T (X, Y ) = ↓(X, Y ), ↓Γ `T (X, Y ) = p(X, Y ),
and ↑Γ `T (X, Y ) = p−1 (X, Y );
– otherwise, ΠΓ `T (X, Y ) = Π(X, Y ), ↓Γ `T (X, Y ) = idΠ(X,Y ) , and ↑Γ `T
(X, Y ) = idΠ(X,Y ) .
Strong Normalization of CC with Type-Based Termination
11
Terms and contexts. The interpretation of an erased context Γ is denoted [Γ ]
(an erased context is a context formed by erased terms). Assume a stage assignment π. Given an erased context Γ , a term M and a sequence of values γ, the
interpretation of M under Γ is denoted [Γ ` M ]πγ .
We define the interpretation by induction on the structure of terms and
contexts. In the case of fixpoint construction we use Hilbert’s choice operator.
Definition 16 (Interpretation of terms and contexts).
[[]] = {∅}
[Γ (x : T )] = {(γ, α) : γ ∈ [Γ ] ∧ α ∈ [Γ ` T ∞ ]∞
γ }
[Γ ` Typei ]πγ = Ui
[Γ ` Prop]πγ = {X : X is a degenerated Λ-set}
[Γ ` x]πγ = γ(x)
[Γ ` Πx : T.U ]πγ = ΠΓ `Πx:T.U ([Γ ` T ]πγ , [Γ (x : T ) ` U ]πγ, )
[Γ ` λx:T ◦ .U ◦ M ]πγ = ↓Γ `Πx:T ◦ .U ◦ ([Γ (x : T ∞ ) ` M ]πγ, )
[Γ ` appx:T ◦ .U ◦ (M, N )]πγ = ↑Γ `Πx:T ◦ .U ◦ ([Γ ` M ]πγ )([Γ ` N ]πγ )
[Γ ` nats ]πγ = FN
LsMπ
(⊥)
= (0, ∅)
= (1, [Γ ` N ]πγ )


⊥[Γ (x : nat) ` P ∞ ]πγ,⊥
π
x := M of N0 , N1 ]γ = [Γ ` N0 ]πγ


↑Γ `T ([Γ ` N1 ]πγ )(α)
[Γ
[Γ ` caseP ◦
[Γ ` O]πγ
` S(N )]πγ
if [Γ ` M ]πγ = ∅;
if [Γ ` M ]πγ = (0, ∅);
if [Γ ` M ]πγ = (1, α)
where T = Πy : nat.P ◦ [x := S(y)]
[Γ ` fix f (x : nat? ) : U ? := M ]πγ = (F, P )
where F ∈ [Γ ` Πx : nat∞ .U ∞ ]πγ , P is the conjunction of the following properties:
↑(F )∅ = ⊥[Γ (x : nat) ` U ∞ ]πγ,∅ ;
(1)
↑(F )(0, ∅) = ↑([Γ (f : |T |) ` M ]πγ,F )(0, ∅);
↑(F )(1, α) = ↑([Γ (f : |T |) `
M ]πγ,F )(1, α), for
(2)
all (1, α) ∈ N
(3)
where we write |T | for Πx : nat.|U |, and ↑ for ↑Γ `|T | .
We write [Γ (x : T ) ` M ]πγ, as a short hand for
α ∈ [Γ ` T ]πγ 7→ [Γ (x : |T |) ` M ]πγ,α .
The conditions imposed on the interpretation of fixpoint construction ensure
the stability under µ-reductions. In the main soundness theorem, we prove that
the typing rules for fixpoint ensure the existence of a unique function F satisfying
the above conditions.
12
4.3
Benjamin Grégoire and Jorge Luis Sacchini
Interpretation of simple types.
We define a second (relational) interpretation for simple types. The intention of
this second interpretation is to cope with the lack of size annotations in types.
Consider the following derivation:
Γ (x : nats ) ` M : natr
Γ ` λx : nat.M : nats → natr
Note that s and r above could be any size expression. But this size information is
not present in the term λx : nat.M . The interpretation of this term is a function
in the set N → N, specifically α ∈ N 7→ [M ]α . To show that the term respects
the sizes s and r, we use the relational interpretation of the type. In the case of
nats → natr , the relational interpretation, denoted J·K, is
Jnats → natr K = {(f1 , f2 ) ∈ N → N : α < [s] ⇒ f1 α = f2 α < [r]}
Then, the interpretation satisfies ([λx : nat.M ], [λx : nat.M ]) ∈ Jnats → natr K.
The relational interpretation can be extended to simple types. Intuitively, the
soundness judgment says that if Γ ` M : T , then ([M ], [M ]) ∈ JT K.
The relational interpretation also satisfies the contravariance rule. Consider
0
a stage s0 v s; the relational interpretation of nats → natr gives
0
Jnats → natr K = {(f1 , f2 ) ∈ N → N : α < [s0 ] ⇒ f1 α = f2 α < [r]}
0
Since [s0 ] ≤ [s], we have Jnats → natr K ⊆ Jnats → natr K.
Definition. Assume a simple type T such that [Γ ` T ∞ ]πγ1 , [Γ ` T ∞ ]πγ2 , [Γ ` T ]πγ1 ,
and [Γ ` T ]πγ2 are Λ-sets and that [Γ ` T ]πγ1 = [Γ ` T ]πγ2 . The relational interpretation of T , denoted JΓ ` T Kπγ1 ,γ2 , is a Λ-set with a carrier-set included in
[Γ ` T ∞ ]πγ1 × [Γ ` T ∞ ]πγ2 .
It is defined as follows: if Γ ∞ ` T ∞ : Prop, then
JΓ ` T Kπγ1 ,γ2 = (X, |=, ⊥)
where
X = ([Γ ` T ∞ ]πγ1 )◦ × ([Γ ` T ∞ ]πγ2 )◦
M |= (α1 , α2 ) ⇐⇒ M ∈ [Γ ` T ]πγ1
⊥ = (⊥[Γ
, ⊥[Γ ` T ∞ ]πγ )
` T ∞ ]π
γ1
2
(remember that, in this case, the carrier-sets of [Γ ` T ]πγ1 and [Γ ` T ]πγ1 are
singletons); otherwise, it is defined by induction on the structure of T as follows:
Strong Normalization of CC with Type-Based Termination
13
– if T ≡ Πx : T1 .T2 and simple(T1 ) and simple(T2 ). Assume JΓ ` T1 Kπγ1 ,γ2 is
a defined Λ-set (denoted JT1 K), with a carrier-set included in [Γ ` T1∞ ]πγ1 ×
[Γ ` T1∞ ]πγ2 and, for every (α1 , α2 ) ∈ JT1 K, JΓ (x : |T1 |) ` T2 Kπ(γ1 ,α1 ),(γ2 ,α2 ) is a
defined Λ-set (denoted by JT2 K(α1 , α2 ). We define JΓ ` T Kπγ1 ,γ2 = (X, |=, ⊥),
where
X = {(f1 , f2 ) ∈ [Γ ` T ∞ ]πγ1 × [Γ ` T ∞ ]πγ2 :
(α1 , α2 ) ∈ JT1 K ⇒ (f1 (α1 ), f2 (α2 )) ∈ JT2 K(α1 , α2 )};
M |= (f1 , f2 ) ⇐⇒ ∀(α1 , α2 ) ∈ JT1 K.N |=JT1 K (α1 , α2 ).∀T ◦ , U ◦ ∈ SN.x ∈ X .
appx:T ◦ .U ◦ (M, N ) |=JT2 K(α1 ,α2 ) (f1 (α1 ), f2 (α2 ));
⊥ = (⊥[Γ
` T ∞ ]π
γ
1
, ⊥[Γ
` T ∞ ]π
γ
2
);
– if T ≡ nats , we define JΓ ` nats Kπγ1 ,γ2 = ([Γ ` nats ]πγ1 )2 ;
– otherwise, SV(T ) = ∅ and we define JΓ ` T Kπγ1 ,γ2 = ([Γ ` T ]πγ1 )2 .
Note that, intuitively, α1 and α2 are related in Jnats Kπ if they are equal, and the
“height” of α1 is less than LsMπ .
Given a simple type T , such that SV(T ) = ∅, there might be more than one
clause of the above definition that applies. The following lemma states that the
definition does not depend on which clause we use.
Lemma 4. Let T be a term such that simple(T ) and SV(T ) = ∅. If JΓ ` T Kπγ1 ,γ2
is defined and [Γ ` T ]πγ1 = [Γ ` T ]πγ2 , then JΓ ` T Kπγ1 ,γ2 = ([Γ ` T ]πγ1 )2 .
Proof. If Γ ∞ ` T ∞ : Prop, the result follows by definition. Otherwise, we proceed
by induction on the structure of T . The only interesting case is when T ≡ Πx :
T1 .T2 . Since JΓ ` T Kπγ1 ,γ2 is defined, we have that JΓ ` T1 Kπγ1 ,γ2 is defined, and
for every (α1 , α2 ) ∈ JΓ ` T1 Kπγ1 ,γ2 , JΓ (x : |T1 |) ` T2 Kπ(γ1 ,α1 ),(γ2 ,α2 ) is defined.
We write JT K for JΓ ` T Kπγ1 ,γ2 , JT1 K for JΓ ` T1 Kπγ1 ,γ2 and JT2 Kα1 ,α2 for
JΓ (x : |T1 |) ` T2 Kπ(γ1 ,α1 ),(γ2 ,α2 ) .
By IH, JT1 K = ([Γ ` T1 ]πγ1 )2 . Hence, (α1 , α2 ) ∈ JT1 K iff α1 = α2 ∈ [Γ ` T1 ]πγ1 .
Again by IH, JT2 Kα,α = ([Γ (x : |T1 |) ` T2 ]πγ1 ,α )2 for every α ∈ [Γ ` T1 ]πγ1 .
By definition, (f1 , f2 ) ∈ [Γ ` T ∞ ]πγ1 ×[Γ ` T ∞ ]πγ2 iff for all α ∈ JT1 K, (f1 (α), f2 (α)) ∈
JT2 Kα,α . Hence, f1 = f2 . Checking the other conditions is easy.
t
u
4.4
Properties of the interpretation
In this section we prove some simple properties of both interpretations.
Lemma 5 (Soundness of weakening).
1. If [Γ ∆] is defined, and z ∈
/ FV(∆), then [Γ (z : T ◦ )∆] is defined, and
[Γ (z : T ◦ )∆] = {(γ, ν, δ) : (γ, δ) ∈ [Γ ∆], ν ∈ [Γ ` T ∞ ]∞
γ };
2. if [Γ ∆ ` M ]πγ,δ is defined, and z ∈
/ FV(∆, M ), then [Γ (z : T ◦ )∆ ` M ]πγ,α,δ
is, and
[Γ (z : T ◦ )∆ ` M ]πγ,α,δ = [Γ ∆ ` M ]πγ,δ .
14
Benjamin Grégoire and Jorge Luis Sacchini
Proof. By induction on the constructions of [Γ ∆] and [Γ ∆ ` M ]πγ,δ . We treat
some relevant cases.
– We know that [Γ ∆] is defined. Then, either ∆ is empty and [Γ ∆] = [Γ ], or
∆ = ∆0 (y : U ◦ ) and [Γ ∆] is defined as
[Γ ∆0 (y : U ◦ )] = {(γ, δ, ζ) : (γ, δ) ∈ [Γ ∆0 ], ζ ∈ [Γ ∆0 ` U ∞ ]∞
γ,δ } .
In the former case, the result follows trivially. In the latter, by IH we have
[Γ (z : T ◦ )∆0 ] = {(γ, ν, δ) : (γ, δ) ∈ [Γ ∆0 ], ν ∈ [Γ ` T ∞ ]∞
γ }
0
∞ ∞
[Γ (z : T ◦ )∆0 ` U ∞ ]∞
γ,ν,δ = [Γ ∆ ` U ]γ,δ
By definition,
[Γ (z : T ◦ )∆0 (y : U ◦ )] = {(γ, ν, δ, ζ) : (γ, ν, δ) ∈ [Γ (z : T ◦ )∆0 ], ζ ∈ [Γ (z : T ◦ )∆0 ` U ∞ ]∞
γ,ν,δ }
The rhs being equal to
{(γ, ν, δ, ζ) : (γ, δ, ζ) ∈ [Γ ∆0 (y : U ◦ )], ν ∈ [Γ ` T ∞ ]∞
γ }
which is the desired result
– Suppose that M = x, then [Γ ∆] is defined and (γ, δ) ∈ [Γ ∆]. By IH,
[Γ (z : T )∆] is also defined, and, since z is different from x,
[Γ (z : T )∆ ` x]πγ,α,δ = [Γ ∆ ` x]πγ,δ .
– The other cases are similar. Note that in the case of product, abstraction,
application, case and fix, we need to use Weakening for the typing judgment.
Lemma 6 (Soundness of stage substitution). If [Γ ` M [ı := s]]πγ is deπ(ı:=LsMπ )
fined, then [Γ ` M ]γ
is defined, and
[Γ ` M ]γπ(ı:=LsMπ ) = [Γ ` M [ı := s]]πγ .
Proof. By induction on the construction of [Γ ` M [ı := s]]πγ . In the case where
M ≡ natr , we use Lemma 3.
Lemma 7 (Soundness of substitution). If Γ (x : T )∆ ` M : U and Γ `
N : T are derivable, SV(N ) = ∅, γ ∈ [Γ ]π , ν = [Γ ` N ]πγ is defined, (γ, ν, δ) ∈
[Γ (x : T )∆]π , and [Γ (x : T )∆ ` M ]πγ,ν,δ is defined, then [Γ, ∆ [x := N ] ` M [x := N ]]πγ,δ
is defined, and
[Γ, ∆ [x := N ] ` M [x := N ]]πγ,δ = [Γ (x : T )∆ ` M ]πγ,ν,δ .
Proof. By induction on the structure of M .
– M ≡ x. We want to prove that [Γ, ∆ [x := N ] ` N ]πγ,δ is defined, and that
[Γ, ∆ [x := N ] ` N ]πγ,δ = [Γ (x : T )∆ ` x]πγ,ν,δ .
The rhs is, by definition, equal to ν = [Γ ` N ]πγ . The result follows by applying Lemma 5 as many times as the length of ∆.
Strong Normalization of CC with Type-Based Termination
15
– M ≡ λy:P ◦ .Q◦ M 0 . Note that
[Γ (x : T )∆ ` M ]πγ,ν,δ =
↓Γ (x:T )∆`Πy:P ◦ .Q◦ ([Γ (x : T )∆ ` P ∞ ]πγ,ν,δ , [Γ (x : T )∆(y : P ∞ ) ` M 0 ]πγ,ν,δ, ) .
Assume that Γ (x : T )∆ ` Πy : P ∞ .Q∞ : W . By substitution,
Γ ∆ [x := N ] ` Πy : P ∞ [x := N ].Q∞ [x := N ] : W [x := N ] .
In particular, if W ≡ Prop, then W [x := N ] ≡ Prop. Then ↓Γ (x:T )∆`Πx:P.Q =
↓Γ ∆[x:=N ]`Πy:P ∞ [x:=N ].Q∞ [x:=N ] .
By IH on P ∞ , [Γ, ∆ [x := N ] ` P ∞ [x := N ]]πγ,δ is defined, and
[Γ, ∆ [x := N ] ` P ∞ [x := N ]]πγ,δ = [Γ (x : T )∆ ` P ∞ ]πγ,ν,δ .
Take α ∈ [Γ (x : T )∆ ` P ∞ ]πγ,ν,δ . We can also apply the IH on M 0 with
(γ, ν, δ, α) ∈ [Γ (x : T )∆(y : P ∞ )]π . The result follows easily.
– The rest of the cases are similar.
t
u
Lemma 8 (Soundness of subject reduction). Let Γ ` M : T and M → N .
If [Γ ` M ]πγ is defined, then [Γ ` N ]πγ is defined and
[Γ ` M ]πγ = [Γ ` N ]πγ
Proof. By induction on M → N . The key cases are when M is a redex.
β-redex Let M ≡ appx:T ◦ .U ◦ (λx:T ◦ .U ◦ M1 , M2 ), and N ≡ M1 [x := M2 ]. We
have two cases: if Γ ` Πx : T ◦ .U ◦ : Prop, and otherwise. Note that, in both
cases, ↑Γ `Πx:T ◦ .U ◦ ◦ ↓Γ `Πx:T ◦ .U ◦ = idΠ([Γ ` T ∞ ]π, [Γ (x : T ◦ ) ` U ∞ ]πγ, .
Then, [Γ ` M ]πγ = [Γ (x : T ◦ ) ` M1 ]πγ, ([Γ ` M2 ]πγ ). By Lemma 7, this is
equal to [Γ ` M1 [x := M2 ]]πγ which is [Γ ` N ]πγ .
ι-redex The result follows directly from the definition of the interpretation of
M.
µ-redex The result follows by Lemma 7. Note that the conditions imposed to
the interpretation of M ensure the invariance under µ-reductions.
The rest of the cases concern the compatible closure of →. They follow easily
by direct applications of the IH.
t
u
In the following we prove some properties of the relational interpretation:
soundness of weakening, substitution, and subtyping.
Lemma 9 (Soundness of weakening). If JΓ ∆ ` U Kπ(γ1 ,δ1 ),(γ2 ,δ2 ) is defined,
then JΓ (z : T )∆ ` U Kπ(γ1 ,α1 ,δ1 ),(γ2 ,α2 ,δ2 ) is defined and both are equal.
Proof. We consider two cases
If Γ ∞ ∆∞ ` T ∞ : Prop The result follows by Lemma 7.
16
Benjamin Grégoire and Jorge Luis Sacchini
If Γ ∞ ∆∞ 6` T ∞ : Prop We proceed by induction on the structure of U . We consider two cases.
U ≡ Πx : U1 .U2 . By IH, JΓ (z : T )∆ ` U1 Kπ(γ1 ,α1 ,δ1 ),(γ2 ,α2 ,δ2 ) is defined and
JΓ (x : T )∆ ` U1 Kπ(γ1 ,α1 ,δ1 ),(γ2 ,α2 ,δ2 ) = JΓ ∆ ` U1 Kπ(γ1 ,δ1 ),(γ2 ,δ2 ) .
Also, for every (ν1 , ν2 ) ∈ JΓ ∆ ` U1 Kπ(γ1 ,δ1 ),(γ2 ,δ2 ) , JΓ (z : T )∆(x : U1 ) `
U2 Kπ(γ1 ,α1 ,δ1 ,ν1 ),(γ2 ,α2 ,δ2 ,ν2 ) is defined and
JΓ (z : T )∆(x : U1 ) ` U2 Kπ(γ1 ,α1 ,δ1 ,ν1 ),(γ2 ,α2 ,δ2 ,ν2 ) = JΓ ∆(x : U1 ) ` U2 Kπ(γ1 ,δ1 ,ν1 ),(γ2 ,δ2 ,ν2 ) .
The result follows easily from the definition of the relational interpretation.
U ≡ nats The result is trivial, since the interpretation of nats does not depend on the context.
In the rest of the cases, since U is simple, we have SV(U ) = ∅. The result
follows by Lemma 7.
t
u
Lemma 10 (Soundness of stage substitution). If JΓ ` T [ı := s]Kπγ1 ,γ2 is
π(ı:=LsMπ )
defined, then JΓ ` T Kγ1 ,γ2
is defined, and both are equal.
Proof. We consider two cases.
If Γ ∞ ∆∞ ` T ∞ : Prop The result is trivial since both interpretations are defined in the same way.
If Γ ∞ ∆∞ 6` T ∞ : Prop We proceed by induction on the structure of T . All cases
follow easily, applying Lemma 6.
t
u
Lemma 11 (Soundness of substitution). Let Γ (x : U )∆ ` T : W and Γ `
N : U and SV(N ) = ∅. Let γi ∈ [Γ ]π , νi ≡ [Γ ` N ]πγi , (γi , νi , δi ) ∈ [Γ (x : U )∆]π ,
for i = 1, 2, and JΓ (x : U )∆ ` T Kπγ1 ,ν1 ,δ1 ,γ2 ,ν2 ,δ2 are defined. Then
JΓ ∆ [x := N ] ` T [x := N ]Kπ(γ1 ,δ1 ),(γ2 ,δ2 ) = JΓ (x : U )∆ ` T Kπ(γ1 ,ν1 ,δ1 ),(γ2 ,ν2 ,δ2 )
Proof. We follow the same scheme as in the two previous proofs. All cases follow
easily, using Lemma 7.
t
u
Lemma 12 (Soundness of subject reduction). Let Γ ` T : W and T → U .
If JΓ ` T Kπγ1 ,γ2 is defined, then JΓ ` U Kπγ1 ,γ2 is defined and
JΓ ` T Kπγ1 ,γ2 = JΓ ` U Kπγ1 ,γ2
Proof. By induction on the structure of T , using Lemma 8.
Lemma 13 (Soundness of subtyping). Assume Γ ` T, U : u, and simple(T, U )
and T ≤ U . If JΓ ` T Kπγ1 ,γ2 and JΓ ` U Kπγ1 ,γ2 are defined, then JΓ ` T Kπγ1 ,γ2 ⊆
JΓ ` U Kπγ1 ,γ2
Strong Normalization of CC with Type-Based Termination
17
Proof. We proceed by induction on the derivation of T ≤ U . Rule (sub-nat) is
easy. In rule (sub-conv) we use the previous lemma. We consider the case of rule
(sub-prod). Assume that T →∗ Πx : T1 .U1 , U →∗ Πx : U1 .U2 , U1 ≤ T1 and
T2 ≤ U2 . By the previous lemma, applied to T and U , JΓ ` Πx : T1 .T2 Kπγ1 ,γ2
JΓ ` Πx : U1 .U2 Kπγ1 ,γ2 are defined and
JΓ ` T Kπγ1 ,γ2 = JΓ ` Πx : T1 .T2 Kπγ1 ,γ2
JΓ ` U Kπγ1 ,γ2 = JΓ ` Πx : U1 .U2 Kπγ1 ,γ2 .
By IH, JΓ ` U1 Kπγ1 ,γ2 ⊆ JΓ ` T1 Kπγ1 ,γ2 and JΓ ` T2 Kπγ1 ,γ2 ⊆ JΓ ` U2 Kπγ1 ,γ2 . The
result follows from the definition of the relational interpretation of a product.
Note that T1∞ ↓ U1∞ , therefore [Γ ` T1∞ ]πγ1 = [Γ ` U1∞ ]πγ1 .
Lemma 14 (Soundness of stage monotonicity). Let s, r be stages such that
π(ı:=s)
s v r. If JΓ ` T Kπγ1 ,γ2 is defined, and ı pos T , then JΓ ` T Kγ1 ,γ2 ⊆ JΓ `
π(ı:=r)
T Kγ1 ,γ2
Proof. By the previous lemma and the definition of pos.
4.5
t
u
Soundness
We extend the relational interpretation of types to contexts in the following way:
J[]Kπ = {(∅, ∅)}
JΓ (x : T )Kπ = {((γ1 , α1 ), (γ2 , α2 )) : (γ1 , γ2 ) ∈ JΓ Kπ ∧ (α1 , α2 ) ∈ JΓ ` T Kπγ1 ,γ2 }
Below is the main soundness theorem. In the following, we write [Γ ` M ]πγ1 ,γ2
to mean ([Γ ` M ]πγ1 , [Γ ` M ]πγ2 ).
Lemma 15 (Soundness).
1. If Γ ` M : T and (γ1 , γ2 ) ∈ JΓ Kπ , then [Γ ` M ]πγ1 ,γ2 , JΓ ` T Kπγ1 ,γ2 are defined
and
[Γ ` M ]πγ1 ,γ2 ∈ JΓ ` T Kπγ1 ,γ2 .
2. If Γ ` T : u, simple(T ), and (γ1 , γ2 ) ∈ JΓ Kπ , then JΓ ` T Kπγ1 ,γ2 is a defined
Λ-set.
3. If WF(Γ ) and (γ1 , γ2 ) ∈ JΓ Kπ , then (γ1 , γ1 ) ∈ JΓ Kπ and (γ1 , γ1 ) ∈ JΓ K∞ .
Proof. We prove all statements simultaneously, by induction on the type derivation. We consider only the most relevant cases.
(fix) Let M ≡ fix f (x : nat? ) : U ? := N , and T ≡ Π(x : natı ).U , with ı pos U .
We first prove that [Γ ` M ]πγ is defined if (γ, γ) ∈ JΓ Kπ . This means proving
that it satisfies Equations (1), (2) and (3).
Let γ such that (γ, γ) ∈ JΓ Kπ . Then (γ, γ) ∈ JΓ K∞ .
Some notation. We write
– [U ]α for [Γ (x : nat) ` U ]πγ,α ;
18
Benjamin Grégoire and Jorge Luis Sacchini
– [T ] for [Γ ` T ]πγ ;
– ∞(ı := a) for the stage valuation that assigns a to ı and ∞ to every
other stage variable;
∞(ı:=a)
– f1 ∼ı:=a f2 for (f1 , f2 ) ∈ JΓ ` T Kγ,γ
; we use the same notation for
ı:=a
sets of functions: F1 ∼
F2 iff for all f1 ∈ F1 , f2 ∈ F2 , f1 ∼ı:=a f2 ;
– ↑ for ↑Γ `T .
Given a function f ∈ [T ], we define f⊥ as
(
⊥[U ]β if β = ⊥;
f⊥ (β) =
f (β) otherwise
for β ∈ N .
We write F(f ) for [Γ (f : T ) ` N ]πγ,f , and F⊥ (f ) for ([Γ (f : T ) ` N ]πγ,f )⊥ .
The IH gives us:
1. JΓ ` T Kπγ1 ,γ2 is defined;
2. if f1 ∼ı:=a f2 for some ordinal a, then F(f1 ) ∼ı:=a+1 F(f2 );
LaM
3. for all f1 ∼ı:=a f2 and α ∈ FN π , (↑(f1 )(α), ↑(f2 )(α)) ∈ JΓ (x : natı ) `
∞(ı:=a)
U K(γ,α),(γ,α) . Since ı pos U , by IH, ↑(f1 )(α) = ↑(f2 )(α).
We define a sequence of sets F0 , F1 , . . . as follows:
F0 = {f ∈ [T ] : ∀↑(f )(∅) = ⊥[U ]∅ }
Fk+1 = F⊥ (Fk ), for k > 0
T
We prove that there exists a unique function F ∈ k≥0 Fk . (We then define
[Γ ` M ]πγ as F .)
Note that if f1 ∼ı:=a f2 , then (f1 )⊥ ∼ı:=a (f2 )⊥ .
By definition, F1 ⊆ F0 . Then, F2 ⊆ F1 , . . .
We have Fk ∼ı:=0 Fj , for k, j ≥ 0. By 2, Fk+1 ∼ı:=1 Fj+1 . And in general,
Fk+n ∼ı:=n Fj+n .
Since ı pos U , Fk+n and Fj+n coincide for the first n numbers. . We can
then define a function F such that for all α ∈ N ,
F (α) = Fk (α)
k
for some k such that α ∈ FN
. This function is well defined: given k1 , k2 such
k1
k2
that α ∈ FN ∩ FN , Fk1 (α) = Fk2 (α).
We now prove that F satisfies Equations (1), (2) and (3). Eq. (1) is satisfied
by definition. Eq. (2) states that ↑(F )(0, ⊥) = ↑(F(F ))(0, ⊥). Since F ∼ı:=0
F0 , F(F ) ∼ı:=1 F1 . Then ↑(F(F ))(0, ⊥) = ↑(F1 )(0, ⊥) = ↑(F )(0, ⊥).
Finally, Eq. (3) states that for all (1, α) ∈ N , ↑(F )(1, α) = ↑(F(F ))(1, α).
k
We proceed similarly to the previous case. Let k such that α ∈ FN
. Since
ı:=k
ı:=k+1
F ∼
Fk , F(F ) ∼
Fk+1 . Then ↑(F(F ))(1, α) = ↑(Fk+1 )(1, α) =
↑(F )(1, α).
We define [Γ ` M ]πγ = F . This completes the first part of the proof. The
second part is to prove that if (γ1 , γ2 ) ∈ JΓ Kπ , then [Γ ` M ]πγ1 ,γ2 ∈ JΓ `
π(ı:=LsMπ )
T [ı := s]Kπγ1 ,γ2 . Note that JΓ ` T [ı := s]Kπγ1 ,γ2 is the same as JΓ ` T Kγ1 ,γ2
.
Strong Normalization of CC with Type-Based Termination
19
We proceed by induction on LsMπ . The base case is trivial. For the inductive case, assume that the property is valid for LsMπ = k. That is,
π(ı:=k)
π(ı:=k)
[Γ ` M ]γ1 ,γ2 ∈ JΓ ` T Kγ1 ,γ2 .
π(ı:=k)
π(ı:=k)
By IH, [Γ (f : T ) ` N ](γ1 ,[Γ ` M ]π ),(γ2 ,[Γ ` M ]π ) ∈ JΓ (f : T ) ` T [ı := bı]K(γ1 ,[Γ ` M ]π ),(γ2 ,[Γ
γ1
γ2
γ1
That is,
[Γ ` N [f := M ]]γπ(ı:=k+1)
∈ JΓ ` T Kπ(ı:=k+1)
.
γ1 ,γ2
1 ,γ2
k+1
By definition, for all α ∈ FN
,
↑([Γ ` M ]πγi )(α) = ↑([Γ ` N [f := M ]]πγi )(α),
and the result follows.
(abs) By IH, (γ1 , γ1 ) ∈ JΓ K∞ . Take α ∈ [Γ ` T ]πγ1 . Then (α, α) ∈ JΓ ` T K∞
γ1 ,γ1 ,
and ((γ1 , α), (γ1 , α)) ∈ JΓ K∞ . By IH, [Γ (x : T ) ` M ]πγ1 ,α is defined.
The other part follows directly from the IH.
4.6
Strong normalization
In this section we prove our main result: strong normalization of CICb− .
A substitution is a mapping θ from variables to terms, such that θ(x) 6= x
for a finite number of variables x. We use θ to denote substitutions, and ε to
denote the identity substitution. We write θ(x 7→ M ) for the substitution that
gives M when applied to x and θ(y) when applied to y 6= x. We write M θ for
the capture-avoiding substitution of the free variables of M with θ.
Definition 17. Let (γ1 , γ2 ) ∈ JΓ Kπ . We define θ |=Γπ (γ1 , γ2 ) by the following
clauses:
θ |=Γπ (γ1 , γ2 )
M |=JΓ `T Kπγ ,γ (α1 , α2 )
1
ε |=Γπ []
2
θ(x 7→ M ) |=Γπ (x:T ) (γ1 , α1 ), (γ2 , α2 )
Lemma 16. If Γ ` T : u, and simple(T ), and |=Γπ θ, then
`T
N |=Γγ,π
⊥[Γ
` T ]π
γ
for all strongly-normalizing atomic term N .
Lemma 17. If Γ ` M : T and (γ1 , γ2 ) ∈ JΓ Kπ and θ |=Γπ (γ1 , γ2 ), then
M θ |=JΓ `T Kπγ
1 ,γ2
[Γ ` M ]πγ1 ,γ2
Proof. We proceed by induction on the derivation of Γ ` M : T . We consider
only the most relevant cases.
(fix) Let M ≡ fix f (x : nat? ) : |U |ı := N , with T ≡ Π(x : natı ).U and ı pos U .
We want to prove that
`T [ı:=s]
M θ |=Γγ,π
[Γ ` M ]πγ
(4)
.
` M ]π
γ )
2
20
Benjamin Grégoire and Jorge Luis Sacchini
We consider two cases. In the first case, we assume that Γ ` T : Typei for
some i.
Γ `T [ı:=s]
`T
Note that (|=γ,π
) = (|=Γγ,π(ı:=LsM
). We write π 0 for π(ı := LsMπ ). To
π)
prove (4) we need to show that for every
Γ `(x:natı )
Q |=γ,π0
we have
α
Γ (x:natı )`U
appx:nat.|U | (M θ, Q) |=(γ,α),π0
(5)
[Γ ` M ]πγ (α)
(6)
We proceed by induction on LsMπ .
Base case: LsMπ = 0. Take Q, α satisfying (5). Then Q is an atomic strongly
normalizing term, and α = ∅. Then appx:nat.|U | (M θ, Q) is also an atomic
term and [Γ ` M ]πγ (∅) = ⊥[Γ (x : nat) ` U ∞ ]πγ,∅ . Therefore, Eq. (6) is satisfied.
Inductive case: LsMπ = k + 1. We want to prove that
`T
M θ |=Γγ,π(ı=k+1)
[Γ ` M ]πγ
(7)
`T
M θ |=Γγ,π(ı=k)
[Γ ` M ]πγ
(8)
`T
`T
γ, f |=Γγ,π
θ ⇒ N θ |=Γγ,π
[Γ (f : T ) ` N ]πγ,f
(9)
The inner IH says
The outer IH says
π(ı:=k)
Take F ≡ [Γ ` M ]πγ . From soundness we know that [Γ ` F ]γ,γ
π(ı:=k)
.
T ı Kγ,γ
Let us define θf = θ(f 7→ M θ). Then
∈ JΓ `
Γ (f :T )
θf |=π(ı:=k) (γ, F )
By Eq. (9), we have
`T
N θf |=Γγ,π(ı:=k+1)
[Γ (f : T ) ` N ]πγ,F
(10)
Let Q, α satisfy (5). We want to prove that
Γ ∆(x:natı )`U ı
appx:nat.|U | (M θ, Q) |=(γ,δ,α),π(ı:=k+1) F (α)
(11)
`α
We have Q |=Γγ,π(ı:=k+1)
α. If α = ⊥, then we proceed as in the base case.
Otherwise, α = (0, ⊥) or α = (1, α0 ). In both cases, Q →wh ∗ C where C is a
`α
term in constructor form, with C |=Γγ,π(ı:=k+1)
α. Then
appx:nat.|U | (M θ, Q) →wh ∗
appx:nat.|U | (M θ, C) ≡ appx:nat.|U | (fix f (x : nat? ) : |U |ı θ := N θ, C) →wh
appx:nat.|U | (N θ [f := M θ], C) ≡ appx:nat.|U | (N θf , C)
Strong Normalization of CC with Type-Based Termination
21
By Eq. (10),
Γ (x:natı )`U
appx:nat.|U | (N θf , C) |=(γ,α),π(ı:=k+1) [Γ (f : T ) ` N ]πγ,F (α)
Γ (x:natı )`U
Note that [Γ (f : T ) ` N ]πγ,F (α) = F (α), and Eq. (11) follows, since |=(γ,α),π(ı:=k+1)
is closed under weak-head expansion.
Corollary 1. If Γ ` M : T then M is strongly normalizing.
Proof. It is not difficult to see that ε |=Γπ ⊥Γ , where ⊥Γ is the sequence of atomic
elements of relational interpretation the types of Γ . The result follows from the
previous lemma, and the fact that realizers are strongly normalizing.
t
u
As a consequence of soundness and strong normalization, we can easily derive
canonicity and logical consistency. Canonicity is the property that closed terms
of inductive types reduce to canonical forms. In our case, a term N is in canonical
form if N ≡ O, or N ≡ S(N 0 ) and N 0 is in canonical form.
Logical consistency states that there are types that are not inhabited.
Theorem 1 (Canonicity). If Γ ` M : nats and M is closed, then M reduces
to a canonical form.
Theorem 2. There is no term M such that ` M : Πx : Prop.x.
Proof. Assume there exits an M such that ` M : Πx : Prop.x. By strong
normalization, we can assume that M is in normal form. It is not difficult to see
that M must be of the form λx : Prop.N , with (x : Prop) ` N : x. Since N is
in normal form, we can prove that it must be an atomic term, i.e., N ≡ E[x],
for some elimination context E (note that the head variable must be x). By
case analysis on E, we have that either (x : Prop) ` x : nats for some s, or
(x : Prop) ` x : Πx : T1 .T2 for some T1 , T2 . Both cases are impossible.
t
u
5
Related Work
The idea of using sized types to ensure termination and productivity was initiated by Hughes, Pareto and Sabry [7]. Abel [1] extended system Fω with sized
(co-)inductive types. In turn, CICb− is derived from CICb [4]. We refer to these
papers for further information and examples, and focus on work related to strong
normalization.
Our proof of strong normalization closely follows the work of Melliès and
Werner [10]. The authors use Λ-sets to develop a generic proof of strong normalization for Pure Type Systems. They avoid the use of inaccessible cardinals, but
it is unlikely that the same can be achieved in the presence of inductive types.
Λ-sets were introduced by Altenkirch in [2]. He develops a generic model
for the Calculus of Constructions (CC), that can be instantiated with Λ-sets to
obtain a proof of strong normalization. He also extends the proof to include one
inductive type (trees) at the impredicative level.
22
Benjamin Grégoire and Jorge Luis Sacchini
There are in the literature several proofs of strong normalization for (nondependent) typed lambda calculi extended with sized types. We refer the reader
to [1,4] for further references.
On dependent types, an extension with type-based termination was first considered by Giménez [6]. However, stages are not explicitly represented, which
complicates the definition of mutually recursive functions.
Barras [3] has formalized in Coq a proof of consistency CCω extended with
natural numbers. Termination of recursive functions is ensured by a restricted
form of sized types, inspired by the work of Giménez. However, it is not possible
to express size-preserving functions, which prevents the typing of quicksort.
Blanqui [5] uses sized types to ensure termination of CC extended with
higher-order rewrite rules. In our case, we use just fix/case instead of rewrite
rules. However, he makes some assumptions on the confluence and subject reduction of the combination of rewriting and β-reduction. Nevertheless, it is of
interest to see if these techniques can be extended to CICb− .
Finally, let us mention the work of Wahlstedt [11]. He proves weak normalization of a predicative type theory in the style of Martin-Löf type theory.
Termination is ensured using the size-change principle [8]. While this principle
is very powerful, his system cannot express size-preserving functions.
6
Conclusions
We presented CICb− , an extension of CIC with a type-based termination mechanism. We have restricted to one inductive type, namely natural numbers, and
we have proved that the system is strongly normalizing and logically consistent.
The interpretation can be extended to other (positive) inductive types (in the
predicative universes). This is a intermediate result towards our goal of proving logical consistency of an extension of CIC with a type-based termination
mechanism.
There are some issues related with CICb that are present in CICb− and have
not been addressed in this work, namely, global definitions and mutually recursive functions. We have preliminary results in this direction.
Acknowledgments. The authors would like to thank Bruno Barras, Hugo
Herbelin, and Benjamin Werner for many discussions on strong normalization
and type-based termination.
References
1. Andreas Abel. A Polymorphic Lambda-Calculus with Sized Higher-Order Types.
PhD thesis, Ludwig-Maximilians-Universität München, 2006.
2. Thorsten Altenkirch. Constructions, Inductive Types and Strong Normalization.
PhD thesis, University of Edinburgh, November 1993.
3. Bruno Barras. Sets in Coq, Coq in sets. 1st Coq Workshop, August 2009.
Strong Normalization of CC with Type-Based Termination
23
4. Gilles Barthe, Benjamin Grégoire, and Fernando Pastawski. CICb: Type-based
termination of recursive definitions in the Calculus of Inductive Constructions. In
Miki Hermann and Andrei Voronkov, editors, Logic for Programming, Artificial
Intelligence, and Reasoning, 13th International Conference, LPAR 2006, Phnom
Penh, Cambodia, November 13-17, 2006, Proceedings, volume 4246 of Lecture Notes
in Computer Science, pages 257–271. Springer, 2006.
5. Frédéric Blanqui. A type-based termination criterion for dependently-typed higherorder rewrite systems. In Vincent van Oostrom, editor, Rewriting Techniques and
Applications, 15th International Conference, RTA 2004, Aachen, Germany, June
3-5, 2004, Proceedings, volume 3091 of Lecture Notes in Computer Science, pages
24–39. Springer, 2004.
6. Eduardo Giménez. Structural recursive definitions in type theory. In Kim Guldstrand Larsen, Sven Skyum, and Glynn Winskel, editors, Automata, Languages
and Programming, 25th International Colloquium, ICALP’98, Aalborg, Denmark,
July 13-17, 1998, Proceedings, volume 1443 of Lecture Notes in Computer Science,
pages 397–408. Springer, 1998.
7. John Hughes, Lars Pareto, and Amr Sabry. Proving the correctness of reactive
systems using sized types. In POPL, pages 410–423, 1996.
8. Chin Soon Lee, Neil D. Jones, and Amir M. Ben-Amram. The size-change principle
for program termination. In POPL, pages 81–92, 2001.
9. Zhaohui Luo. Computation and reasoning: a type theory for computer science.
Oxford University Press, Inc., New York, NY, USA, 1994.
10. Paul-André Melliès and Benjamin Werner. A generic normalisation proof for pure
type systems. In Eduardo Giménez and Christine Paulin-Mohring, editors, Types
for Proofs and Programs, International Workshop TYPES’96, Aussois, France,
December 15-19, 1996, Selected Papers, volume 1512 of LNCS, pages 254–276.
Springer, 1996.
11. David Wahlstedt. Dependent Type Theory with Parameterized First-Order Data
Types and Well-Founded Recursion. PhD thesis, Chalmers University of Technology, 2007. ISBN 978-91-7291-979-2.
A
The conversion presentation
In this section, we present CICb− in a more traditional form using conversion. The
syntax is similar, except for the application where there are no type annotations,
and the abstraction, where the type annotation include only the domain of the
function.
We refer to the system in the paper as the annotated presentation of CICb− ,
and to the system in this section as the conversion presentation of CICb− .
Definition 18 (Terms). The generic set of terms over the set a is defined by
the grammar:
T [a] ::= X | U | λX : T ◦ .T [a] | T [a] T [a] | ΠX : T [a].T [a]
| nata | O | S(T [a])
caseT ◦ X := T [a] of T [a], T [a] | fix X (X : nat? ) : T ? := T [a]
The set of bare terms, position terms and sized terms are defined by T ◦ ::= T [],
T ? ::= T [{, ?}], and T ::= T [S], respectively.
24
Benjamin Grégoire and Jorge Luis Sacchini
As in the annotated presentation, we use the erasure functions |.| : T ? ∪ T →
T and |.|ı : T → T ? . Given a term M , we write M ∞ to denote the term M
where all size annotations are replaced with ∞, and SV(M ) to denote the set of
stage variables appearing in M .
◦
Definition 19. Reduction →c is defined as the compatible closure of the following relation:
(λx : T ◦ .M )N
caseT ◦ x := O of N0 , N1
caseT ◦ x := S(M ) of N0 , N1
(fix f (x : nat? ) : U ? := M )C
→c
→c
→c
→c
M [x := N ]
N0
N1 M
(M [f := fix f (x : nat? ) : U ? := M ])C
where C is a term in constructor form. We write →c ∗ and ≈c for the reflexivetransitive closure and the equivalence closure of →c , respectively.
Lemma 18. The reduction relation →c defined above is confluent.
The substage relation and the notion of simple types are defined in the same
way, so we do not repeat the definitions here. However, the subtyping relation
is defined in a more standard way.
Definition 20 (Subtyping). Given a relation on terms, R, stable under substitution of terms and stages, the subtyping relation on R, ≤R ⊆ T × T , is
defined by following rules:
T ≤R T
T ≈c U
T ≤R U
T ≤R W
W ≤R U
T ≤R U
U1 ≤R T1
T2 ≤R U2
Πx : T1 .T2 ≤R Πx : U1 .U2
svr
nat ≤R natr
s
We write ≤c for ≤≈c .
The typing rules are very similar, and are given in Fig. 2 for completeness.
We finish this section by proving some properties about the subtyping relation. First, we define an alternative subtyping relation, similarly to the definition
given in Sect. 3, and prove that both relations are equivalent.
An alternative definition of subtyping is the following.
Definition 21 (Subtyping (alternative)). The alternative subtyping relation, denoted by ≤a , is defined by the following rules:
T ↓U
T ≤a U
T →c ∗ Πx : T1 .T2
T →c ∗ nats
U →c ∗ natr
T ≤a U
U →c ∗ Πx : U1 .U2
T ≤a U
U1 ≤a T1
svr
T2 ≤a U2
Strong Normalization of CC with Type-Based Termination
25
We prove that both definitions are equivalent. Note that it is easy to prove
that T ≤a U ⇒ T ≤c U . For the other direction, we first show that ≤a is
transitive. We need first the following lemma.
Lemma 19. If T ≈ T 0 ≤a U 0 ≈ U , then T ≤a U , with a derivation of the same
height.
Proof. We proceed by induction on the derivation of T 0 ≤a U 0 . All cases follow
easily by IH and confluence.
t
u
Lemma 20. If T1 ≤a T2 and T2 ≤a T3 , then T1 ≤a T3 .
Proof. We proceed by induction on the sum of the derivations of T1 ≤a T2 , and
T2 ≤a T3 , and case analysis in the last rule used. For the case when both use
the product rule, we use the previous lemma.
t
u
Lemma 21. If T ≤ U , then T ≤a U
Proof. All rules are admissible, using the previous lemma for the transitive rule.
t
u
Lemma 22. Assume that T ≤≡ U . If T →c T 0 (resp. U →c U 0 ), then there
exists U 0 (resp. T 0 ) such that U →c U 0 (resp. T →c T 0 ) and T 0 ≤≡ U 0 .
Lemma 23. Assume T1 ≤c T2 . Then, there exists U1 and U2 such that T1 →c ∗
U1 ≤≡ U2 ←c ∗ T2 .
Proof. By induction on the derivation of T1 ≤ T2 . The only interesting case is the
transitivity rule. Assume T1 ≤ T2 is derived from T1 ≤ T3 and T3 ≤ T2 . By IH,
there exists P1 , P3 , Q3 and Q2 such that T1 →c ∗ P1 ≤≡ P3 ←c ∗ T3 and T3 →c ∗
Q3 ≤≡ Q2 ←c ∗ T2 . By confluence, there exists N such that P3 →c ∗ N3 ←c ∗ Q3 .
By the previous lemma, there exists N1 and N2 such that P1 →c ∗ N1 ≤≡ N3 and
N3 ≤≡ N2 ←c ∗ Q2 . Then N1 and N2 satisfy the requirements, since N1 ≤≡ N2 .
t
u
The above property is not valid for the annotated system because reduction is
not confluent. However, it is valid for well-typed terms, as proved in Lemma ??.
Lemma 24. Let ≤t≡ be the relation ≤≡ without considering rules (sub-refl) and
(sub-trans). Then, ≤t≡ =≤≡ .
Proof. Rule (sub-refl) is admissible in ≤t≡ , since it is the same as rule (sub-conv).
We now prove that rule (sub-trans)is also admissible.
Consider T1 ≤t≡ T2 and T2 ≤t≡ T3 . We want to prove that T1 ≤≡ T3 . We
proceed by mutual induction on the derivations, and case analysis on the last
rule used.
– If the last rule of T1 ≤t≡ T2 is (sub-conv), then T1 ≡ T2 and the result follows.
Similarly if the last rule of T2 ≤t≡ T3 is (sub-conv).
– If the last rule of both derivations is (sub-prod), the result follows from IH.
26
Benjamin Grégoire and Jorge Luis Sacchini
– If the last rule of both derivations is (sub-nat), the result follows from transitivity of the substage relation.
– The remaining cases (one rule is (sub-prod) and the other is (sub-nat)) are
impossible.
t
u
(empty)
WF([])
(var)
(type)
(abs)
(app)
s
Γ (x) = T
WF(Γ )
(prop)
Γ `c T : u
Γ `c Prop : Type0
Γ (x : T ) `c U : Typej
Γ `c Πx : T.U : max(u, Typej )
Γ `c T : u
Γ (x : T ) `c U : Prop
Γ `c Πx : T.U : Prop
Γ (x : T ) `c M : U
Γ `c λx : |T |.M : Πx : T.U
SV(M ) = ∅
Γ `c N : T
SV(N ) = ∅
Γ `c M N : U [x := N ]
Γ ` nat : Type0
simple(T )
Γ `c x : T
Γ `c M : Πx : T.U
WF(Γ )
(case)
WF(Γ )
WF(Γ )
(Π-prop)
Γ `c T : u
WF(Γ (x : T ))
Γ `c Typei : Typei+1
(Π-type)
(nat)
WF(Γ )
(cons)
(zero)
WF(Γ )
Γ ` O : natsb
(succ)
Γ `c M : nats
Γ `c S(M ) : natsb
Γ `c M : natsb
Γ (x : natsb) `c P : u
Γ `c N0 : P [x := O]
Γ `c N1 : Πy : nats .P [x := S(y)]
Γ `c case|P | x := M of N0 , N1 : P [x := M ]
(fix)
T ≡ Π(x : natı ).U
ı pos U
ı∈
/ SV(Γ, M )
Γ `c T : u
Γ (f : T ) `c M : T [ı := bı]
Γ `c fix f (x : nat? ) : |U |ı := M : T [ı := s]
(conv)
Γ `c M : T
Γ `c U : u
Γ `c M : U
T ≤U
SV(M ) = ∅
SV(M ) = ∅
simple(U )
Fig. 2. Typing rules for the conversion presentation of CICb−
A.1
Metatheory
The metatheory of the system of this section is proved similarly to CICb. We
state the required lemmas without proof.
Strong Normalization of CC with Type-Based Termination
27
Lemma 25 (Inversion of subtyping).
1. If Πx : T1 .T2 ≤c Πx : U1 .U2 , then U1 ≤c T1 and T2 ≤c U2 .
2. If natr ≤c U , then U ≈c nats and r v s.
3. If T ≤c nats , then T ≈c natr and r v s.
Lemma 26 (Weakening). If Γ `c M : T and WF(Γ ∆), then Γ ∆ `c M : T .
Lemma 27 (Stage substitution). If Γ `c M : U , then Γ [ı := s] `c M [ı := s] :
U [ı := s].
Lemma 28 (Substitution). If Γ (x : T )∆ `c M : U , and Γ `c N : T , and
SV(N ) = ∅ then Γ ∆ [x := N ] `c M [x := N ] : U [x := N ].
Lemma 29 (Subject Reduction). If Γ `c M : T and M → M 0 , then Γ `c
M0 : T.
Lemma 30 (Type validity). If Γ `c M : T , then Γ `c T : u and simple(T ).
Lemma 31 (Type uniqueness). If Γ `c M : T and Γ `c M : T 0 , then
|T | ≈ |T 0 |.
B
Simple Metatheory of CICb−
In this section we prove some simple metatheoretical properties of CICb− including weakening, substitution and subject reduction.
Some properties of subtyping:
Lemma 32. Let R1 and R2 be two relations on terms. Then
1. If R1 ⊆ R2 , then ≤R1 ⊆ ≤R2 .
The following lemmas are proved in the same fashion as for CICb.
Lemma 33 (Free variables). If Γ ` M : T , then FV(M ) ⊆ dom(Γ ) and
FV(T ) ⊆ dom(Γ ).
Proof. By induction on the derivation of Γ ` M : T .
Lemma 34 (Context). If Γ ` M : T , then WF(Γ ).
Proof. By induction on the derivation of Γ ` M : T .
Lemma 35 (Weakening). If Γ ` M : T and WF(Γ ∆), then Γ ∆ ` M : T .
Lemma 36 (Stage substitution). If Γ ` M : U , then Γ [ı := s] ` M [ı := s] :
U [ı := s].
Lemma 37 (Substitution). If Γ (x : T )∆ ` M : U , and Γ ` N : T , and
SV(N ) = ∅ then Γ ∆ [x := N ] ` M [x := N ] : U [x := N ].
28
Benjamin Grégoire and Jorge Luis Sacchini
Some properties on simple types:
Lemma 38. If simple(T ) and SV(M ) = ∅, then simple(T [x := M ]).
Proof. By induction on the derivation of simple(T ). Note that SV(T [x := M ]) ⊆
SV(T ) ∪ SV(M ).
Lemma 39. If simple(T [x := M ]) with SV(M ) = ∅, and SV(N ) = ∅, then
simple(T [x := N ]).
Proof. Note that if simple(T [x := M ]), then simple(T ).
Lemma 40. If WF(Γ ), and (x : T ) ∈ Γ , then simple(T ).
Proof. By induction on the derivation of WF(Γ ).
Lemma 41. If Γ ` M : T , then simple(T ).
Proof. By induction on the derivation of Γ ` M : T . We treat two cases.
(fix) By IH, noting that if simple(T [ı := bı]), then T [ı := s] for any stage s.
(case) By IH, using Lemma 39.
To prove Subject Reduction, we need to prove inversion of products for subtyping. While this property is not true for terms that are not well-typed, we can
prove a particular case which is enough to prove Subject Reduction (Cor. 2). We
use some definitions given in App. C. Namely, Def. 22 and Lemma 47.
Lemma 42. Let T and U be two terms such that |T | ≡ |U |, simple(T ), simple(U )
and bT c ≤c bU c. Then, T ≤ U .
Proof. By simultaneous induction on simple(T ) and simple(U ). We proceed by
case analysis.
– If T ≡ Πx : T1 .T2 , then U ≡ Πx : U1 .U2 . The result follows from IH on
(T1 , U1 ) and (T2 , U2 ), using inversion of products for ≤c .
– If T ≡ natr , then U ≡ nats . By inversion of ≤c , we have r v s. Then
natr ≤ nats .
– The only remaining case is SV(T ) = ∅ and SV(U ) = ∅. In this case T ≡ U
and the result follows.
t
u
Corollary 2. If T ≡ Πx : T1 .T2 ≤ . . . ≤ U ≡ Πx : U1 .U2 , simple(T ),
simple(U ), and |T | = |U |, then U1 ≤ T1 and T2 ≤ U2 .
Proof. Note that bT c ≤c bU c, and therefore, bU1 c ≤c bT1 c and bT2 c ≤c bU2 c.
The result follows by applying the previous lemma.
t
u
Lemma 43 (Subject Reduction). If Γ ` M : T and M → M 0 , then Γ `
M0 : T.
In the following lemma, we add the invariant that types are always simple.
Lemma 44 (Type validity). If Γ ` M : T , then Γ ` T : u and simple(T ).
Strong Normalization of CC with Type-Based Termination
C
29
Equivalence between both presentations
In this section we prove that there is an equivalence between both presentations
of the system. As a corollary, we obtain that the conversion presentation is also
strongly normalizing.
There is one side of the equivalence that is easy to establish.
Definition 22. We define the map b.c from terms of the annotated presentation
to terms of the conversion presentation by:
bxc = x
buc = u
bλ
x:T ◦ .U ◦
M c = λx : bT ◦ c.bM cbappx:T ◦ .U ◦ (M, N )c
= bM c bN c
bΠx : T.U c = Πx : bT c.bU c
bcaseP ◦ x := M of N0 , N1 c = casebP ◦ c x := bM c of bN0 c, bN1 c
bfix f (x : nat) : U ? := M c = fix f (x : nat) : bU ? c := bM c
The following lemma is easy to prove.
Lemma 45. If Γ ` M : T , then bΓ c `c bM c : bT c.
The other direction is a bit more complicated to prove. We begin by defining
a loose reduction for the annotated system.
Definition 23. Loose reduction →l is defined as the compatible closure of the
following relation:
appx:T2 ◦ .U2 ◦ (λx:T1 ◦ .U1 ◦ M , N ) →l
caseT ◦ x := O of N0 , N1 →l
caseT ◦ x := S(M ) of N0 , N1 →l
appx:T ◦ .U ◦ (F, C) →l
M [x := N ]
N0
appy:nat.T ◦ [x:=S(y)] (N1 , M )
appx:T ◦ .U ◦ (M [f := F ], C)
where F ≡ fix f (x : nat? ) : U ? := M and C is a term in constructor form. We
write →l ∗ and ≈l for the reflexive-transitive closure and the equivalence closure
of →l , respectively.
Lemma 46. Loose reduction is confluent.
The following lemma states some simple properties of the three reduction
relations defined.
Lemma 47. 1. M ↓ M 0 ⇒ bM c ≈c bM 0 c;
2. M ≈l M 0 ⇒ bM c ≈c bM 0 c;
3. T ≤ U ⇒ bT c ≤c bU c;
4. if bM c →c N , then there exists P such that M →l P and bP c ≡ N ;
We define the grammar for normal terms and neutral normal terms.
30
Benjamin Grégoire and Jorge Luis Sacchini
Definition 24. Normal terms, N , and neutral normal terms, R, are defined by
the following grammars:
N ::= λx:N ◦ .N ◦ N | R | u | O | S(N ) | Πx : N.N | fix f (x : nat? ) : N ? := N
R ::= x | appx:N ◦ .N ◦ (R, N ) | caseN ◦ x := R of N, N
| appx:N ◦ .N ◦ (fix f (x : nat? ) : N ? := N , R)
Lemma 48.
1. Let appx:T2 ◦ .U2 ◦ (λx:T1 ◦ .U1 ◦ M , N ) be a well-typed term in some context Γ .
Then T1 ◦ ≈l T2 ◦ and U1 ◦ ≈l U2 ◦ .
2. Let appx:T1 ◦ .T2 ◦ (fix f (x : nat? ) : U ? := M , N ) be a well-typed term in some
context Γ . Then T1 ◦ ≈l nat and T2 ◦ ≈l |U ? |.
Proof. We prove the first part, since the second part is similar.
By inversion on the type derivation, the term λx:T1 ◦ .U1 ◦ M has type W1 with
|W1 | ≡ Πx : T1 ◦ .U1 ◦ , and it also has type W2 with |W2 | ≡ Πx : T2 ◦ .U2 ◦ and
W1 ≤ . . . ≤ W2 . Therefore, |W1 | ≈l |W2 |. Since →l satisfies inversion of products,
the conclusion follows.
t
u
Lemma 49. Let M and M 0 be two well-typed terms under context Γ . If M ≈l
M 0 and M and M 0 are in normal form (for →), then M ≡ M 0 .
Proof. By mutual induction on the size of M and M 0 . We prove first that M
and M 0 are in normal form for →l . Assume that there is a loose redex in M . We
have two cases:
I. The redex is of the form
appx:T2 ◦ .U2 ◦ (λx:T1 ◦ .U1 ◦ N , P ) .
Then by the previous lemma, T1 ◦ ≈l T2 ◦ and U1 ◦ ≈l U2 ◦ . Since T1∞ and
T2∞ are well-typed in context Γ ∞ , by IH, T1∞ ≡ T2∞ . Hence, T1 ◦ ≡ T2 ◦ .
Similarly, U1 ◦ ≡ U2 ◦ , since U1∞ and U2∞ are well-typed under context
Γ ∞ (x : T1∞ ). But then, the above redex is actually a tight redex, which
contradicts the hypothesis that M is in normal form.
II. The redex is of the form
appx:T1 ◦ .T2 ◦ (fix f (x : nat? ) : U ? := N , C) .
We proceed in the same way as in the previous case.
We have M ≈l M 0 and that both are in normal form for →l . Since →l is
confluent, we conclude that M ≡ M 0 .
t
u
Corollary 3. Let M and M 0 be two well-typed terms under context Γ . If M ≈l
M 0 , then M and M 0 have a common unique normal form.
Strong Normalization of CC with Type-Based Termination
31
Proof. Let N and N 0 be normal forms (for →) of M and M 0 respectively. Then,
N ≈l N 0 . By Subject Reduction, N and N 0 are well-typed in Γ . Applying the
previous lemma, we obtain N ≡ N 0 .
t
u
Corollary 4. Let M be a well-typed term in normal form for →. Then bM c is
in normal form for →c .
Proof. If bM c had a →c -redex, then M would have a →l -redex, but this is
impossible.
t
u
Lemma 50. Assume Γ1 ` M1 : T1 and Γ2 ` M2 : T2 , with |Γ1 | = |Γ2 |. If
bM1 c ≈c bM2 c and M1 and M2 are in normal form (for →), then M1 ≡ M2 .
Proof. From the proof of Lemma 49, M1 and M2 are in normal form for →l .
Therefore, bM1 c ≡ bM2 c. We proceed by induction on the size of M1 and M2 ,
and case analysis on the shape of M1 and M2 .
Most cases are easy consequence of the IH. We treat the most relevant cases
here.
– M1 ≡ λx1 :T1 ◦ .U1 ◦ N1 and M2 ≡ λx2 :T2 ◦ .U2 ◦ N2 . Since M1 and M2 are in
normal form for →l , then T1 ◦ ≈l T2 ◦ , U1 ◦ ≈l U2 ◦ and N1 ≈l N2 .
From IH on T1∞ and T2∞ (well-typed on context Γ1∞ ), we obtain that T1∞ ≡
T2∞ (and T1 ◦ ≡ T2 ◦ ). Similarly, applying IH to U1∞ and U2∞ (well-typed on
context Γ1∞ (x1 : T1∞ )), we obtain U1 ◦ ≡ U2 ◦ .
There exists Wi , for i = 1, 2 such that |Wi | = Ti ◦ , and Ni is well-typed under
context Γi (xi : Wi ). The IH applies, and N1 ≡ N2 .
– M1 and M2 are neutral normal terms. We proceed by induction on the
structure of M1 and M2 . We consider the case M1 ≡ appx1 :T1 ◦ .U1 ◦ (R1 , N1 )
and M2 ≡ appx2 :T2 ◦ .U2 ◦ (R2 , N2 ), where R1 and R2 are neutral normal terms.
By IH, R1 ≡ R2 and N1 ≡ R2 . In context Γ1∞ (≡ Γ2∞ ), R1 has types
Πx : T1∞ .U1∞ and Πx : T2∞ .U2∞ . The IH applies, and both types are equal.
The rest of the cases of neutral normal terms are easy.
t
u
Corollary 5. Let M1 and M2 be well-typed terms under context Γ . If bM1 c ≈c
bM2 c, then M1 ↓ M2 .
Lemma 51. Let M1 and M2 be well-typed terms under context Γ . If bM1 c ≤≡
bM2 c, then M1 ≤ M2 .
Proof. We proceed by induction on bM1 c ≤≡ bM2 c. From Lemma 24 we do
not need to consider the rules (sub-refl) and (sub-trans). In the case of rule
(sub-conv), the result follows from Lemma 50. For rule (sub-prod), the result
follows from IH. Finally, the case of rule (sub-nat) is trivial.
t
u
Corollary 6. Let M1 and M2 be well-typed terms under context Γ . If bM1 c ≤c
bM2 c, then M1 ≤ M2 .
32
Benjamin Grégoire and Jorge Luis Sacchini
Proof. From Lemma 23 we know that there exists P1 and P2 such that bM1 c →c ∗
P1 ≤≡ P2 ←c ∗ bM2 c. Let N1 and N2 be the normal form (for →) of M1 and
M2 respectively. Then, by Corollary 4, bN1 c and bN2 c are also in normal form
(for →c ). Hence, P1 →c ∗ bN1 c, P2 →c ∗ bN2 c and bN1 c ≤≡ bN2 c. To see that
N1 and N2 satisfy the required properties, it remains to prove that N1 ≤ N2 .
We proceed by induction on bN1 c ≤≡ bN2 c. From Lemma 24 we do not need to
consider the rules (sub-refl) and (sub-trans). In the case of rule (sub-conv), the
result follows from Lemma 50. For rule (sub-prod), the result follows from IH.
Finally, the case of rule (sub-nat) is trivial.
t
u
Theorem 3. If Γ `c M : T , then there exists a judgment Γ + ` M + : T + such
that bΓ + c = Γ , bM + c = M and bT + c = T .
Proof. By induction on the derivation of Γ `c M : T . We use the following
properties in the proof:
– SV(T ) = SV(bT c);
– simple(bT c) ⇒ simple(T );
We consider the case (conv). The judgment Γ `c M : T is derived from Γ `c
M : U , Γ ` T : u, simple(U ), and U ≤c T . By IH, there exists Γ + , M + , U + such
that Γ + ` M + : U + . Also by IH, there exists ∆+ , T + such that ∆+ ` T + : u.
Since bΓ + c ≡ b∆+ c, we have Γ + ↓ ∆+ , and Γ + ` T + : u. By Cor. 6, T ≤ U ,
and the result follows by an application of rule (conv).
t
u
Theorem 4. If Γ ` M : T and bM c →c N , then there exists N 0 such that
M →+ N 0 and bN 0 c = N .
Proof. We proceed by induction on bM c →c N . The interesting case is when
bM c is a β-redex. Then M is of the form appx2 :T2 ◦ .U2 ◦ (λx1 :T1 ◦ .U1 ◦ M1 , M2 ) and
N ≡ bM1 [x1 := M2 ]c. By Lemma 48, T1 ◦ ≈l T2 ◦ and U1 ◦ ≈l U2 ◦ . By Cor. 3,
there exists T3 ◦ and U3 ◦ such that T1 ◦ , T2 ◦ →∗ T3 ◦ and U1 ◦ , U2 ◦ →∗ U3 ◦ .
Then, M →∗ appx2 :T3 ◦ .U3 ◦ (λx1 :T3 ◦ .U3 ◦ M1 , M2 ) → M1 [x1 := M2 ] We can take
N 0 = M1 [x1 := M2 ].
t
u
Corollary 7. If Γ `c M : T , then M is strongly normalizing.
Proof. Follows easily from Thm. 3 and Thm. 4.