Abstract of thesis entitled

Iso-Recursive Subtyping: New Theory and Extensions
Submitted by
Yaoda Z���for the degree of Doctor of Philosophy
at The University of Hong Kongin January, 2023
The Amber rules are well-known and widely used for subtyping iso-recursive types. They
were �rst brie�y and informally introduced in 1985 by Luca Cardelli in a manuscript describing
the Amber language. Despite their use over many years, important aspects of the metatheoryof the iso-recursive style Amber rules have not been studied in depth or turn out to be quite
challenging to formalize.
This dissertation proposes a new theory of iso-recursive subtyping. After revisiting the
problem of subtyping iso-recursive types, we introduce a novel declarative speci�cation for
Amber-style iso-recursive subtyping. Informally, the speci�cation states that two recursive
types are subtypes if all their �nite unfoldings are subtypes. With the help of intermediate
weakly positive subtyping rules, the Amber rules are shown to be sound and complete withrespect to this declarative speci�cation. We then show two variants of sound, complete anddecidable algorithmic formulations of subtyping that employ the idea of double unfoldings.
Compared to the Amber rules, the double unfolding rules have the advantage of: (1) being
modular; (2) not requiring re�exivity to be built-in; (3) leading to an easy proof of transitivityof subtyping; and (4) being easily applicable to subtyping relations that are not antisymmetric.
As far as we know, this is the �rst comprehensive treatment of iso-recursive subtyping dealing
with unrestricted recursive types in a theorem prover.
The new formulations not only shed new insights on the theory of subtyping iso-recursive
types, but they also enable extensions with more complex features. We show three extensions
in this thesis. Firstly, at the type level, we present an extension with record types and intersection types, showing how our new formulations can be applied non-antisymmetric subtyping.
Secondly, at the term level, we apply it to a record calculus with merge operators, solving a current open problem for such calculi of how to support recursive types and the binary methods.
Finally, we combine iso-recursive types with bounded quanti�cation conservatively, and showthat such integration is helpful to encode positive f-bounded polymorphism and subtyping
between algebraic datatypes.

An abstract of exactly 323 words

Iso-Recursive Subtyping: New Theory
and Extensions

by

Yaoda Z���
B.S. Shanghai Jiao Tong University

A Thesis Submitted in Partial Ful�lmentof the Requirements for the Degree ofDoctor of Philosophy

atUniversity of Hong Kong

C�������� ©2022, �� Y���� Z������ ������ ��������.

ii

Acknowledgements
When I graduated from SJTU, I hadn’t thought I would pursue a Ph.D. degree one day.
I worked for a startup but wasn’t happy at that time. Compared with the boring daily job, I
realized that I still loved to do some challenging research. I’d like to thank my friends Di Chen,
Yifei Xu, Yan Ji, Minghua Deng, and Hanqing Ge, who consoled me and encouraged me to seeka Ph.D. opportunity almost every night during the tough time.
I never know there is a programming language group in Hong Kong, so when I saw the
webpage of the HKU PL group I was surprised. As a Cantonese, Hong Kong is such a place that
I am very familiar with. Then I contacted my future supervisor, Prof. Bruno C. d. S. Oliveira.
The interview with Bruno was the worst performance during my career due to my laptop issue.
However, Bruno �nally trusted my passion and ability.
Bruno is the best supervisor I have seen. He is always so kind to every student. I felt
anxious at the end of my �rst-year Ph.D. since I had no progress on formalizing the Amber
rules. Bruno then spent lots of time helping me think about the iso-recursive subtyping, whichis the main topic of this dissertation. It �nally became a very wonderful paper and my �rst
publication, and I was more con�dent on research since then. I appreciate my supervisor forhis continuous discussion and academic training with me. Bruno, you teach me how to becomea better researcher.
Another important person for me is Litao Zhou, who accompanies me during the periodof thesis writing. In my mind, Litao is my cute and smart little brother. We share lots ofcommon points: same family name, both graduated from SJTU, similar hobbies, and somesecrets between us. Litao, I am glad that I can be your mentor for guiding and helping youat the early stage of your Ph.D. career. I enjoy every weekly meeting with you, also our daily
life. Our relationship is faithful, so as long as you need me, you can trust and rely on me at
anywhere anytime.
I also thank my co-author Jinxu Zhao. Without his insightful proof work, we won’t havesuch an amazing TOPLAS publication. Thank my other labmates Xuan Bi, Yanlin Wang, Ningning Xie, Weixin Zhang, Xuejing Huang, Baber Rehman, Yaozhu Sun, Mingqi Xue, Wenjia Ye,
Xu Xue, Chen Cui, Jinhao Tan, and Shengyi Jiang, for their valuable sharing in the weekly
seminar and discussion.
Some people also helped me during the Ph.D. period. They are Junru Shao, Zheng Guo,
Te Zeng, Junqiang Wu, Guangxiong Luo, Cheng Peng, Yufeng Tao, Jian Weng, Yuyang Huang,
Yuncong Hu, Haojun Ma, Chen Xia, Shuai Yang, Jiefeng Chen and other people. Sorry I cannot
list all of you due to the space reason.
Family has special signi�cance for me. Finally, I want to thank my mother, father, andmemorial grandmother, for their persistent support and unconditional love.
Yaoda Z���

University of Hong Kong

v

Contents
Abstracti

Acknowledgementsii

List of Figuresix

List of Tables

xi

I

Prologue

1

1 Introduction

3

1.1

The History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3

1.2

Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

1.3

Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

122 Background

II

15

2.1

Subtyping Recursive Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15

2.2

Object Encodings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

Basic Theory

3 A New Speci�cation for Iso-Recursive Subtyping

23
25

3.1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

25

3.2

Syntax, Well-Formedness and Subtyping . . . . . . . . . . . . . . . . . . . . .

29

3.3

Metatheory of Subtyping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

30

3.4

Type Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34

3.5

Mechanized Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

36

4 Algorithmic Subtyping for Iso-Recursive Subtyping

39

4.1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

4.2

Double Unfoldings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

43

4.3

The Soundness Theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

44

4.4

The Unfolding Lemma for the Double Unfolding Rules . . . . . . . . . . . . .

48

4.5

Nominal Unfolding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

50

4.6

Decidability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

53

4.7

Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

55

4.8

Mechanized Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

56

5 Weakly Positive Subtyping

III

59

5.1

Subtyping Based on a Weakly Positive Restriction . . . . . . . . . . . . . . . .

59

5.2

The Formalization of Amber Rules . . . . . . . . . . . . . . . . . . . . . . . . .

62

5.3

From the Amber Rules to the Speci�cation . . . . . . . . . . . . . . . . . . . .

64

5.4

From the Speci�cation to the Amber Rules . . . . . . . . . . . . . . . . . . . .

68

5.5

The Equivalence among All Formulations . . . . . . . . . . . . . . . . . . . . .

71

5.6

Mechanized Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

71

Extensions

75

6 Non-Antisymmetric Subtyping
6.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.2

The Formalization of Recursive Record Types . . . . . . . . . . . . . . . . . .

79

6.3

The Spurious Subtyping Problem, Revisited . . . . . . . . . . . . . . . . . . . .

83

6.4

Intersection Subtyping with Nominal Unfoldings . . . . . . . . . . . . . . . . .

85

6.5

The Calculus with Intersection Types . . . . . . . . . . . . . . . . . . . . . . .

86

6.6

Mechanized Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

87

7 A Calculus with the Merge Operator

91

7.1

Syntax, Well-Formedness and Subtyping . . . . . . . . . . . . . . . . . . . . .

7.2

Disjointness for Recursive Types . . . . . . . . . . . . . . . . . . . . . . . . . .

94

7.3

Static Semantics of li . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

98

7.4
7.5

µ

Dynamic Semantics of li . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
µ

91

99

Mechanized Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

8 Calculus with Bounded Quanti�cation

103

8.1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

8.2

Bounded Quanti�cation with Iso-Recursive Types . . . . . . . . . . . . . . . . 110

8.3

Metatheory of F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

8.4
8.5

IV

77
77

µ

Lower and Upper Bounded Quanti�cation . . . . . . . . . . . . . . . . . . . . 124
Mechanized Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Epilogue

133

9 Related Work

135

9.1

Subtyping Recursive Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

9.2

Object Encodings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

10 Conclusion and Future Work147

10.1 Recursive Subtyping with One-Step Unfolding . . . . . . . . . . . . . . . . . . 148
10.2 Distributive Iso-Recursive Subtyping . . . . . . . . . . . . . . . . . . . . . . . 149

10.3 Full F with Iso-Recursive Types . . . . . . . . . . . . . . . . . . . . . . . . . 149

10.4 Getting F-Bounded Polymorphism for Free . . . . . . . . . . . . . . . . . . . . 150
10.5 Higher-Order Type System with Iso-Recursive Types . . . . . . . . . . . . . . 151
Bibliography

153

ix

List of Figures
1.1

Recursive types in Haskell (left) and Java (right). . . . . . . . . . . . . . . . . .

2.1

The complete Amber subtyping rules by Amadio and Cardelli [5] for equi-4

recursive subtyping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18

3.1

Tree model for equi-recursive subtyping. . . . . . . . . . . . . . . . . . . . . .

27

3.2

Tree model for iso-recursive subtyping for the �rst 3 �nite unfoldings for µa. > !

3.3

Well-formedness and subtyping rules. . . . . . . . . . . . . . . . . . . . . . . .

30

3.4

Typing and reduction rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

35

4.1

Algorithmic subtyping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

44

4.2

Well-formedness and subtyping rules for nominal unfoldings. . . . . . . . . .

52

4.3

Comparison between paper and Coq statements for Lemma 25. . . . . . . . . .

58

5.1

Weakly positive subtyping rules. . . . . . . . . . . . . . . . . . . . . . . . . . .

60

5.2

A variant of the Amber rules, including well-formedness of types. . . . . . . .

64

5.3

Position allocation for weakly positive subtyping. . . . . . . . . . . . . . . . .

69

5.4

A diagram with the soundness and completeness lemmas in this work. . . . .

72

6.1

Well-formedness and subtyping rules for record types. . . . . . . . . . . . . .

80

6.2

Typing and reduction rules for record types . . . . . . . . . . . . . . . . . . .

82

6.3

Well-formedness and subtyping rules. . . . . . . . . . . . . . . . . . . . . . . .

86

6.4

Typing and reduction rules (with intersection type). . . . . . . . . . . . . . . .

88

7.1

Well-formedness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

93

7.2

Subtyping rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

94

7.3

Disjointness (Axiom). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

96

7.4

Disjointness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

97

7.5

Lower common supertype. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

97

7.6

µ
Typing rules for li . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

99

7.7

a  µa. nat ! a. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

28

Casting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

7.8

Small-step semantics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

8.1

Well-formedness and subtyping rules. . . . . . . . . . . . . . . . . . . . . . . . 111

8.2

Typing Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

8.3

Reduction Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

8.4

Algorithmic Typing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

8.5

The well-formed types for F . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

8.6
8.7
8.8
8.9

µ

The subtyping rules for F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126µµThe typing rules for F

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

The reduction rules for F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128µ

The new exposure function and additional algorithmic typing rules for F . . 130µxi

List of Tables
3.1

Paper-to-proofs correspondence guide in Chapter 3. . . . . . . . . . . . . . . .

37

3.2

Descriptions for the proof scripts in Chapter 3. . . . . . . . . . . . . . . . . . .

37

4.1

Paper-to-proofs correspondence guide in Chapter 4. . . . . . . . . . . . . . . .

57

4.2

Descriptions for the proof scripts in Chapter 4. . . . . . . . . . . . . . . . . . .

57

5.1

The equivalence theorems in Part II. . . . . . . . . . . . . . . . . . . . . . . . .

72

5.2

Paper-to-proofs correspondence guide in Chapter 5. . . . . . . . . . . . . . . .

73

5.3

Descriptions for the proof scripts in Chapter 5. . . . . . . . . . . . . . . . . . .

73

6.1

Paper-to-proofs correspondence guide in Chapter 6. . . . . . . . . . . . . . . .

89

6.2

Descriptions for the proof scripts in Chapter 6. . . . . . . . . . . . . . . . . . .

89

7.1

Paper-to-proofs correspondence guide in Chapter 7. . . . . . . . . . . . . . . . 102

7.2

Descriptions for the proof scripts in Chapter 7. . . . . . . . . . . . . . . . . . . 102

8.1

Paper-to-proofs correspondence guide in Chapter 8. . . . . . . . . . . . . . . . 131

8.2

Descriptions for the proof scripts in Chapter 8. . . . . . . . . . . . . . . . . . . 132

9.1

Comparison among di�erent work on extending F to recursive types. . . . . 141

1Part I

Prologue

3

Chapter 1

Introduction
Modern statically typed programming languages have increasingly sophisticated type systems
and subtyping relations. For example, Scala 3 [59], TypeScript [86], Flow [60] or Ceylon [58]include recursive types [88], intersection and union types [14] or bounded quanti�cation [37].
Scala also adds features such as path-dependent types or type bounds [9] to the mix. The
combination of such features enables for powerful and �exible type systems and subtyping
relations that allow more reusable code and programming abstractions.
Unfortunately, such power comes at a cost. Subtyping relations with those features (orjust a subset) are not well understood, or may even lack desirable properties, such transitivity,
decidability or even type soundness. There is a well-known history of problems.
The focus of this thesis is on recursive subtyping. That is we study subtyping relations
that include recursive types, and rules to relate recursive types via subtyping. We will also
study the interactions of recursive subtyping with some other features, including intersection
types and bounded quanti�cation.

1.1

The History

1.1.1

Recursive types

Recursive types are used in nearly all languages to de�ne recursive data structures like sequences or trees. They are also used in Object-Oriented Programming every time a methodneeds an argument or return type of the enclosing class. Recursive types come in two �avours:
equi-recursive types and iso-recursive types [52]. With equi-recursive types a recursive type isequal to its unfolding. With iso-recursive types, a recursive type and its unfolding are onlyisomorphic. To convert between the (iso-)recursive type and its isomorphic unfolding, explicit
folding and unfolding constructs are necessary. A fold expression constructs a recursive type,while an unfold expression opens a recursive type.
The main advantage of equi-recursive types is convenience, as no explicit conversions
are necessary. However, a disadvantage is that algorithms for languages with equi-recursive
types are quite complex. Furthermore, integrating equi-recursive types in type systems with

4

Chapter 1. Introduction
data List = Nil | Cons Int List
map :: (Int -> Int) -> List -> List
map f Nil=
Nil
map f (Cons x xs) =Cons (f x) (map f xs)

class Shape {int area() {...}
boolean compareArea(Shape s) {return s.area() == area();}
Shape clone() {return new Shape();}}Figure 1.1: Recursive types in Haskell (left) and Java (right).
advanced type features, while retaining desirable properties such as decidable type-checking,can be hard (or even impossible) [112, 65].
Many programming languages adopt an iso-recursive formulation. In practice, the inconvenience of iso-recursive types is mostly eliminated by “hiding” the explicit folding andunfolding in other constructs. For example, in functional languages, such as Haskell [71] orOCaml [79], a �avor of iso-recursive types is provided via datatypes.
Figure 1.1 (left) illustrates a simple recursive type in Haskell. The List datatype is recursive, as the Cons constructor requires a List as the second argument. Functions such asmap, can then be de�ned by pattern matching. While there are no explicit folding or unfolding
operations in the program, every use of the constructors (Nil and Cons) triggers folding of therecursive type. Conversely, the patterns on Nil and Cons trigger unfolding of the recursive
type. Similarly, in nominal Object-Oriented (OO) languages such as Java, iso-recursive types
can be introduced in class de�nitions such as the one to the right of Figure 1.1. This classde�nition requires recursive types because both compareArea and clone need to refer to theenclosing class. Like the Haskell program above, there are no explicit uses of folding and unfolding. Instead, constructors trigger folding of the recursive type; while method calls (such asarea()) trigger recursive type unfolding. The relationship between iso-recursive types, algebraic datatypes and pattern matching, and nominal OO class de�nitions is well-understood in
the research literature [113, 115, 100, 83, 118].

1.1.2

Recursive subtyping

For adding recursive types to a language with subtyping, it is desirable to have recursive subtyping between recursive types. The �rst rules for recursive subtyping, due to Cardelli [32],are the well-known Amber rules [32]. Recursive subtyping has been studied in two di�erent
forms: equi-recursive subtyping [5, 24, 62], and iso-recursive subtyping [84, 18].
Interestingly, the theory for algorithmic subtyping of iso-recursive types has received
little attention in the past. The Amber rules are well-known and widely used for subtyping iso-recursive types. They were brie�y and informally introduced in 1985 by Cardelli ina manuscript describing the Amber language [32]. Later on, Amadio and Cardelli [5] made acomprehensive study of the theory of recursive subtyping for a system with equi-recursive
types employing Amber-style rules. One nice result of their study is a declarative model
for specifying when two recursive types are in a subtyping relation. In essence, two (equi)recursive types are subtypes if their in�nite unfoldings are subtypes. Amadio and Cardelli’s

51.1. The History

study remains to the day a standard reference for the theory of equi-recursive subtyping, although newer work simpli�es and improves on the original theory [24, 62]. Since then variantsof the Amber rules have been employed multiple times in a variety of calculi and languages,
but often in an iso-recursive setting [1, 56, 18, 114, 44, 83]. Perhaps most prominently theseminal work on “A Theory of Objects” by Abadi and Cardelli [1] employs iso-recursive style
Amber rules.
The Amber rules are appealing due to their apparent simplicity, but the metatheory for
their iso-recursive formulation is not well studied. Unlike an equi-recursive formulation, which
has a clear declarative speci�cation, there is no similar declarative speci�cation for an isorecursive formulation so far. Moreover, there are fundamental di�erences between equi-recursive
and iso-recursive subtyping: while equi-recursive subtyping deals with in�nite trees and is naturally understood in a coinductive setting [24, 62], an Amber-style iso-recursive formulation
deals with �nite trees and ought to be understood in an inductive setting. Furthermore, important properties for algorithmic versions of the iso-recursive Amber rules are lacking or arequite di�cult to prove. In particular, there is very little work in the literature regarding proofof transitivity for algorithmic formulations of the Amber rules.
Finally, a fundamental lemma that arises in proofs of type preservation for calculi with
iso-recursive subtyping is:If µa. A  µa. B then [a 7! µa. A] A  [a 7! µa. B] B
We call this lemma the unfolding lemma. The unfolding lemma plays a similar role in preservation to the substitution lemma (which is needed for proving preservation of beta-reduction),and is used to prove the case dealing with recursive type unfolding. The proof for the unfolding
lemma is non-trivial, but there is also little work on proofs of this lemma for the Amber rules.
While there are some interesting alternatives for iso-recursive subtyping [72, 84], Amber-style
subtyping strikes a good balance between expressive power and simplicity, and is widely used.
Thus understanding Amber-style subtyping further is worthwhile.

1.1.3

Record calculi

Record calculi with a concatenation operator have attracted the attention of researchers due totheir ability to give the semantics of object-oriented languages with multiple inheritance [50,30, 36]. The foundational work by Cook and Palsberg [50], and Cardelli [30] work on thesemantics of the Obliq language are prime examples of the usefulness of untyped record calculi
with record concatenation to model the semantics of OOP with inheritance.
Unfortunately, typed calculi with record concatenation and subtyping have proven to bequite challenging to model. An important problem, identi�ed by Cardelli and Mitchell [36],is that subtyping can hide static type information that is needed to correctly model (common
forms of) record concatenation. Cardelli and Mitchell [36] illustrate the problem with a simple
example:let f2 ( r :{ x : Int }) ( s :{ y : Bool }) : { x : Int } & { y : Bool } = r , , s6Chapter 1. Introduction
in f2 ({ x =3 , y =4}) ({ y = true , x = false })Here f2 is a function that takes two records (r and s) as arguments, and returns a new recordthat concatenates the two records (r ,, s). For the return type of f2 we use record type concatenation (here denoted as R & S). Because of subtyping it is possible to invoke f2 with records
that have more �elds than the �elds expected by the static types of the arguments of f2. For instance, while the static type of the �rst argument of f2 is {x : Int}, the record that is actuallyprovided at the application ({x = 3, y = 4}) also has an extra �eld y.
The program above is �ne from a typing point of view, but what should the program evaluate to? There are a few common options for the semantics of record concatenation. Record
concatenation can be symmetric, only allowing the concatenation of records without con�icts;
or it can be asymmetric, implementing an overriding semantics where, in case of con�icts,
�elds on the left (or the right) record are given preference. Choosing a naive form of asymmetric concatenation does not work. For instance, with left-biased concatenation, the example
above would evaluate to {x = 3, y = 4}, which has the wrong type! Therefore, Cardelli and
Mitchell [36] state that:
we should now feel compelled to de�ne R & S only when R and S are disjoint: that iswhen any �eld present in an element of R is absent from every element of S, and viceversa.
hinting for an approach with symmetric concatenation, based on disjointness. But a naive
symmetric concatenation operation would result in a record {x = 3, y = 4, y = true, x =false} with con�icts, which should not be allowed! Thus, such a naive form of symmetricconcatenation does not work either.

1.1.4

Bounded quanti�cation

Bounded quanti�cation was introduced by Cardelli and Wegner [37] in the Fun language, andhas been widely studied [53, 35, 98]. Bounded quanti�cation addresses the interaction between
parametric polymorphism and subtyping, allowing polymorphic variables to have subtyping
bounds.
From the mid-80s and throughout the 90s there was a lot of work on establishing the typetheoretic foundations for OOP. Both recursive subtyping, as well as bounded quanti�cation
played a major part on this e�ort. The two features were perceived to be quite fundamental
to model objects. At that time the key ideas around F [53, 37, 35], which is a polymorphic

calculus with bounded quanti�cation (but no recursive types) were reasonably well understood
due to the early work on the Fun language by Cardelli and Wegner. Therefore F -like calculi
were being used in foundational work on OOP. Some landmark papers on the foundationsof OOP, which established important results such as the distinction between inheritance andsubtyping [49], f-bounded quanti�cation [29], or encodings of objects [49, 3, 28], all essentiallyassumed some F variant with recursive types. Typically, recursive subtyping was supported

via the Amber rules. However, F itself, as well as the extensions of F with recursive types,

had still not been developed and formally studied when many of those works were published.

7

1.1. The History

Unfortunately, the combination of those di�erent features turns out to have unsatisfactory properties later. One of the �rst, and the most well-known, problematic instance of asubtyping relation is that of (full) F , which is undecidable [98]. In this case the language

integrates parametric polymorphism with subtyping, leading to the seemingly natural notionof bounded quanti�cation. While in isolation parametric polymorphism and simple subtyping have various desirable properties, the combination and addition of bounded quanti�cation
leads to undecidability of subtyping. Even if we take decidable variants of F [37], adding othernatural features, such as f-bounded quanti�cation, can once again introduce problems [81, 70].
On the other hand, after the �rst formalization of F [53], Ghelli [65] questioned thestate-of-a�airs of bounded quanti�cation with recursive types, which implicitly assumed thatthe extension of F with recursive types was straightforward. He conducted the �rst formal

study for such an extension, and showed a wide range of negative results. Most importantly,
he showed that equi-recursive types are not conservative over full F . In other words, adding

equi-recursive types to full F changes the expressive power of the subtyping relation, evenwhen the types being compared do not involve any recursive types.

The simple addition of equi-recursive types allows well-formed, but invalid subtyping
statements in F to be valid in an extension with recursive types. Ghelli also shows that

applying equi-recursive types to full F invalidates transitivity elimination: we cannot drop
the transitivity rule without losing expressive power. In addition, while subtyping in full F

is undecidable [98], the change in expressive power, reopens questions about the decidability
or undecidability of the system.
Even if we choose the weaker form of bounded quanti�cation present in Fun language
and kernel F , the natural extension of Amadio and Cardelli [5]’s algorithm to kernel F isincomplete [46]. Nevertheless, instead of Amadio and Cardelli’s meet 2 times rules, Colazzo

and Ghelli [46] gave an alternative meet 3 times algorithm, accompanied by a very challenging correctness proof, showing that the subtyping relation is transitive and complete, but did
not prove conservativity. Based on an earlier draft from Colazzo and Ghelli [46], Je�rey [80]extended the system and proved it correct and complete. By transferring the polar bisimulations [109] technique from concurrency theory, Je�rey’s system is more general than Colazzo
equi
equi
and Ghelli’s, but it is only partially decidable. It is decidable for kernel F , but for full F ,only when the algorithm terminates it returns the correct answer, but it may not terminate.
equi

Furthermore, although more powerful, Je�rey’s full F

is not conservative over F either.

Perhaps motivated by the technical challenges and negative results posed by equi-recursive

types, some researchers set their sights on iso-recursive types. In their work on object encodings, Abadi et al. [3] proposed the F<:µ calculus, which supports bounded universal types,bounded existential types and iso-recursive types via the Amber rules. However, re�exivity
and transitivity are built-in, so the system is not algorithmic. Furthermore, while they presented the typing, subtyping and reduction rules, they have not proved any properties, including type-soundness or the conservativity over full F . One potential reason for the absenceof technical results is that the iso-recursive Amber rules are hard to work with formally, as8Chapter 1. Introduction

we mentioned in Chapter 1.1.2, which is di�cult to prove results such as transitivity, or de�nesound and complete algorithmic formulations.
More recently, there has been a �urry of work on the foundations for Scala via the DOT
calculus [7, 9, 108, 6, 117, 66, 74, 85]. Early work [9, 108] discovered that transitivity elimination
for DOT’s declarative subtyping, to obtain an algorithmic formulation, was very challenging.
That work also lead to the discovery that the algorithms used in Scala implementations at thetime broke transitivity and even type soundness. While Scala 3 has on the meantime �xed
known type soundness problems based on the work on DOT, as far as we know it still lacks
transitivity of subtyping. Some of the latest work on DOT, has proved that subtyping is undecidable [74], and known decidable fragments lack transitivity [74, 85].

1.2

Contributions

Given the history of problematic interactions of features in subtyping relations, it is perhaps
not too surprising that the theory of complex subtyping relations such as the one in DOT
or other languages is very challenging. Even for subsets of the features in those subtyping
relations, it is not known whether it is possible to obtain well-behaved subtyping relations.
Therefore, we believe it is useful to take a step back and study such features and interactions
among them more closely. Concretely, in this thesis, we study the following questions:

1.2.1

A new theory for iso-recursive subtyping

We revisit the problem of subtyping iso-recursive types. We start by introducing a novel declarative speci�cation for Amber-style iso-recursive subtyping. Informally, the speci�cation statesthat two recursive types have subtyping relation if all their �nite unfoldings have subtyping
relation. More formally, the subtyping rule for recursive types is:
G, a ` [a 7! A]n A  [a 7! B]n B
G ` µa. A  µa. B

8n = 1 · · · •S-RecHere the notation [a 7! A]n denotes the n-times �nite unfolding of a type. The n times unfolding applies n

1 substitutions to the type A (the recursive type body), and the rule checks that

all n-times unfoldings are subtypes. Such a declarative formulation plays a similar role to Amadio and Cardelli’s declarative speci�cation for equi-recursive types. Because the speci�cation
is de�ned with respect to the �nite unfoldings, this naturally leads to an inductive treatmentof the theory. For example, the proof of transitivity of subtyping is fairly straightforward, withthe more signi�cant challenge being the unfolding lemma. With all the metatheory in place,proving subject-reduction for a typed lambda calculus with recursive types is a routine exercise. Moreover, the Amber rules are shown to be equivalent (in terms of expressive power) tothis declarative speci�cation.
We also show alternative algorithmic formulations based on the idea of double unfoldings.
We discuss two variants of rules for subtyping recursive types. The �rst variant, which wecall the double unfolding rule, checks both 1-time and 2-times �nite unfoldings. The second

1.2. Contributions

9

variant can be seen as an optimization that checks only 2-times �nite unfoldings, by tracking the names of the recursive types to avoid the 1-time �nite unfolding check. We call thesecond variant nominal unfolding. Both rules accept all valid subtyping statements that theAmber rules accept, but they have important advantages. In particular the rules with double
unfoldings:• Enable modular proofs. The new subtyping rules for recursive types are modular
in the sense that proofs for properties such as transitivity or re�exivity only need toaccount for the new recursive case. All the other cases remain essentially the same as ina subtyping relation without recursive types. Key to this form of modularity is the use
standard environments, which are just a collection of type variables.
• Have easy proofs of transitivity of subtyping. A particular consequence of the previous point is an easy proof for transitivity, which has been a stumbling block in thepast for the iso-recursive Amber rules. The Amber rules have a pervasive impact inthe subtyping relation, which is the root cause of the di�culties in doing proofs suchas transitivity. To our knowledge the only transitivity proof for the Amber rules is due
to Bengtson et al. [18], and the proof is quite intricate, relying on a complex inductive
argument.
• Do not require built-in re�exivity. An additional bene�t is that re�exivity does nothave to be built in, but it can be derived instead. In the Amber rules built-in re�exivity
is necessary to deal with contravariant occurrences of recursive type variables.
• Are applicable to non-antisymmetric subtyping relations. Built-in re�exivity canbe problematic in some settings, including calculi with record subtyping or intersection/union types. Such calculi can have “isomorphic” subtyping where two syntacticallydi�erent types A and B can be subtypes of each other. In other words the subtyping
relation is not antisymmetric. Avoiding built-in re�exivity makes the rules easier to apply in such settings. As we show, the double unfolding rules can deal with record types
easily.
The focus of our work is on iso-recursive subtyping rules that enable easy metatheory,and improving the understanding of Amber-style iso-recursive subtyping. Therefore our work
will be useful to those interested on the theory of recursive types, as well as for formalizationsof calculi using iso-recursive subtyping. Formalizations can bene�t from our work to easily
develop calculi with recursive types and prove important properties, such as transitivity, decidability and type soundness. While the rules based on double unfolding rules are algorithmic
and therefore can be used in implementations, our focus is not on e�cient algorithms. For implementations, the use of the Amber rules may still be preferable if e�ciency is an importantconcern. Moreover, there are alternatives to the Amber rules, such as the complete rules by
Ligatti et al. [84], which may be preferable for extra expressive power in the subtyping relation,
as well as e�cient algorithms.
To validate all our results we have mechanically formalized all our results in the Coq
theorem prover. As far as we know this is the �rst comprehensive treatment of iso-recursive

10

Chapter 1. Introduction

subtyping dealing with unrestricted recursive types in a theorem prover.

1.2.2

Intersection types, recursive types and record concatenation

We apply nominal unfoldings to a calculus with a merge operator [106, 57] and disjoint intersection types [89, 4, 20, 21]. Such calculi generalize record calculi with subtyping and arecord concatenation operation, which are useful to model the semantics of OO languages
with forms of multiple inheritance [31, 50, 36, 30]. Moreover, calculi with disjoint intersection types have been used in recent years to model highly modular and compositional styles
of programming [119]. Languages built on top of calculi with disjoint intersection types, cannaturally solve the Expression Problem [116], and model very expressive and dynamic forms ofinheritance, while retaining static type-safety [19, 119]. Unfortunately, no calculi with disjoint
intersection types has support for iso-recursive types, limiting their applicability. We present
an iso-recursive extension of the li calculus [89, 77], called li , therefore addressing this openµproblem.

With li we can use a standard encoding of objects using recursive types [28, 31, 50,µ

49] in li to model objects with recursive types. For instance, we can de�ne an interface forµarithmetic expressions Exp using a recursive type:

Exp := µExp. {eval : nat, dbl : Exp, eq : Exp ! bool}
In Exp there are 3 methods: an evaluation method that returns the value of evaluating theexpression; a dbl method that doubles all the natural numbers in (the AST of) an expression;and an equality method that compares the expression with another expression. In li it is

only possible to express the type of eval. However, in li we can also express dbl and eq.
µ

Importantly, in li the record type {eval : nat, dbl : Exp, eq : Exp ! bool} is syntactic sugarµfor intersections of single �eld records [106, 57]. In other words, to de�ne the type Exp we needboth intersection types and recursive types.
To implement Exp we �rst need a few auxiliary functions (eval0 : Exp ! nat, dbl0 :Exp ! Exp and eq0 : Exp ! Exp ! bool) that unfold the recursive type1 . Then we de�ne
two recursive functions lit : nat ! Exp and add : Exp ! Exp ! Exp:
eval0 edbl0 eeq0 e1 e2
lit n
add e1 e2(unfold [Exp] e).eval(unfold [Exp] e).dbl(unfold [Exp] e1 ).eq e2fold [Exp]{eval = n, dbl = lit(n ⇤ 2),
eq = ˘e0 . (eval0 e0 == n) : Exp ! bool}= fold [Exp]{eval = eval0 e1 + eval0 e2 , dbl = add (dbl0 e1 ) (dbl0 e2 ),
eq = ˘e0 . (eval0 e0 == eval0 e1 + eval0 e2 ) : Exp ! bool}====

In this example the functions lit and add act as encodings of classes or traits. The function lit
is basic: it stores the literal, a double function and equality functions. In add, operations such
1 We assume the presence of recursive functions, and that records are lazy in the example.

11

1.2. Contributions

as eval0 have to be called for subexpressions. To check if 2 ⇤ 7 = 2 ⇤ (3 + 4), we can de�nee1 : Exp = lit 7 and e2 : Exp = add (lit 3) (lit 4). Then, we check if eq0 (dbl0 e1 ) (dbl0 e2 ) issatis�ed.

In brief, with li , we can model certain forms of structurally typed object-oriented proµ

gramming and Compositional Programming, with an expressive form of inheritance and in thepresence of recursive types and binary methods [25].

1.2.3

Bounded quanti�cation and recursive subtyping

We present an extension of kernel F , called F , with iso-recursive types. In F we add isoµµrecursive subtyping using the nominal unfolding rules. With the nominal unfolding rules,

proving transitivity and other properties is easy, also enabling developing algorithmic formulations of subtyping instead. Furthermore, a nice property of the nominal unfolding rules isthat they are modular, allowing an existing calculus to be extended with recursive types without major impacts on existing de�nitions and proofs. In other words they allow reusing mostexisting metatheory and de�nitions that existed before the addition of iso-recursive types. Our
work shows that the nominal unfolding rules can be integrated modularly into F , while re-taining desirable properties. In particular, we prove, for the �rst time, the conservativity of an
extension of F with recursive types over the original F .
We also add two smaller extensions to F . The �rst one is a generalization of the kernel Frule for bounded quanti�cation that accepts equivalent rather than equal bounds. The second
extension is the use of so-called structural folding/unfolding rules, inspired by the structural
unfolding rule proposed by Abadi, Cardelli, and Viswanathan [3].
��������������

������������

G`e:A

G ` e : [ a 7 ! B] A

G ` A  µa. BG ` unfold [A] e : [a 7! A] B

G ` µa. A  B

G ` fold [B] e : B

The structural rules add expressive power to the more conventional folding/unfolding rulesin the literature, and they enable additional applications. The structural unfolding rule waspresented by Abadi et al. [3] for supporting structural update in the object calculus that was
being encoded into F with iso-recursive types. In their work, the structural unfolding ruleis presented with an informal explanation. We provide structural rules for both expressions,
together with the formalization of the type soundness for both rules. We illustrate how thestructural rules play an important role to model encodings of objects, as well as encodings ofalgebraic datatypes with subtyping.
We present several results, including: type soundness; transitivity and decidability of subtyping; the conservativity of F over F ; and a sound and complete algorithmic formulationµof F . Moreover, we also present an extension of F , called F , which has a bottom typeµµµand lower bounded quanti�cation in addition to the conventional (upper) bounded quanti�cation of F . As we show, lower bounded quanti�cation is particularly interesting to model thesubtyping of algebraic datatypes.

12

1.3

Chapter 1. Introduction

OutlineIn summary, the structure/contributions of this thesis are:
Chapter 3 A declarative speci�cation for iso-recursive subtyping: We propose a new speci�cation for the iso-recursive subtyping, called �nite unfolding rule, which is showed tobe re�exive and transitive. The unfolding lemma is proven via �nite approximation. We
also prove the type soundness for the simply typed lambda calculus with iso-recursive
subtyping, including preservation and progress theorems.
Chapter 4 Algorithmic subtyping based on double unfoldings: We propose two algorithmic
variants of iso-recursive subtyping, called double unfolding rule and nominal unfolding
rule. Both two rules are proved to be re�exive, transitive, decidable, and equivalent withrespect to the �nite unfolding rule. The unfolding lemma can be proved directly on thealgorithmic variants.
Chapter 5 Subtyping with a Weakly Positive Restriction: We propose another variant basedon the weakly positive restriction, called weakly positive unfolding rule. With the help of
weakly positive subtyping, we prove that our speci�cation is equivalent to the Amber
rules via soundness and completeness theorems.
Chapter 6 Iso-recursive subtyping with non-antisymmetric subtyping: We show that our
new formulations of iso-recursive subtyping can apply to non-antisymmetric subtyping
relations, such as record types and intersection types. We discuss the spurious subtyping
problem on intersection types and prove that our nominal unfolding rule can avoid it.
Chapter 7 Iso-recursive subtyping with record concatenation: We show that our new formulations of iso-recursive subtyping can apply to the calculus with record concatenation via
extending an existing calculus of disjoint interaction types and merge operator, called
li . The desirable properties, such as transitivity and decidability of subtyping, typeµsoundness and the unfolding lemma hold. Our li calculus illustrates one application ofµa subtyping relation with iso-recursive subtyping and intersection types, and addresses
an open problem in the previous line of work on disjoint intersection types.
Chapter 8 Iso-recursive subtyping with bounded quanti�cation: We show that our new formulations of iso-recursive subtyping can apply to the calculus with bounded quanti�cation. Our F calculus illustrates how to integrate iso-recursive types and kernel F .
µWe obtain a transitive and decidable subtyping relation, while the full calculus is shown
to be conservative over F and is proven to be type-sound. F is an extension of Fµµwith lower bounded quanti�cation and bottom types. Both F and F could serve asµµ

the theoretic foundation for object encodings and encodings of algebraic datatypes with
subtyping.
Furthermore, in Chapter 2, some necessary background for keeping the thesis as selfcontained as possible, including iso-recursive subtyping and object encodings, are presented.
We also discuss the related work on iso-recursive subtyping and object encodings in Chapter 9.

13

1.3. Outline

We have formalized all the calculi and proofs in this thesis in Coq. All the results are formalized
in the Coq theorem prover and can be found at:https://github.com/juda/dissertation-artifacts
This thesis is largely based on the drafts and publications by the author [121, 122, 120,82], as indicated below.
Chapter 3, 4 and 5 Yaoda Zhou, Bruno C. d. S. Oliveira and Jinxu Zhao. 2020. “Revisiting Iso-Recursive
Subtyping”. In Proc. of the 35th ACM International Conference on Object-Oriented Programming, Systems, Languages and Applications (OOPSLA 2020).
Yaoda Zhou, Jinxu Zhao and Bruno C. d. S. Oliveira. 2022. “Revisiting Iso-Recursive
Subtyping”. In ACM Transactions on Programming Languages and Systems (TOPLAS).
Chapter 7 Yaoda Zhou, Bruno C. d. S. Oliveira and Andong Fan. 2022. “A Calculus with Recursive
Types, Record Concatenation and Subtyping”. In Proc. of the 20th Asian Symposium on
Programming Languages and Systems (APLAS 2022).
Chapter 8 Litao Zhou*, Yaoda Zhou* and Bruno C. d. S. Oliveira. 2023. “Recursive Subtyping
for All”. In Proc. of the 50th ACM SIGPLAN Symposium on Principles of Programming
Languages (POPL 2023), conditionally accepted. (* Equal contribution)

15

Chapter 2

Background
This chapter sets the stage for some basic concepts that will be presented in later chapters. In
Chapter 2.1 recursive subtyping is introduced and discussed. In particular, we review the Amber rules [5], which have been widely used for recursive subtyping in the past. In Chapter 2.2
there is some discussion about the encoding of objects and datatypes, including intersection
types, merge operators and bounded quanti�cation. There is plenty of their related work to
those topics, which is discussed on the Chapter 9.

2.1

Subtyping Recursive Types

Subtyping is a widely-used inclusion relation that compares two types. Many calculi have notypes of “in�nite” size. In such calculi comparing two types is relatively easy. However, withthe existence of recursive types, comparing two types is no longer trivial. A recursive typeµa. A usually contains itself as a subpart, represented by the type variable a. Therefore, asubtyping relation (or another form of comparison) needs to treat these types in a special way.
We choose to use a minimal set of types throughout this work for illustration. A type
A, B, C, or D may refer to the primitive nat type, the top type >, a function type A ! B, atype variable a or a recursive type µa. A. The subtyping rules for the top type, primitive types
and function types are standard:A>

nat  nat

B1  A1A2  B2
A1 ! A2  B1 ! B2

Before diving into the design of subtyping relations for recursive types, we �rst lookat some examples. We also discuss the role of the unfolding lemma in checking whether asubtyping relation between two recursive types is valid or not.
Example 1 Any type should be a subtype of itself, including1• µa. a ! a  µa. a ! a,• µa. a ! nat  µa. a ! nat,

1 We assume that recursive types have lower priority. That is, µa. > ! a means µa. (> ! a ) not ( µa. >) ! a.

16

Chapter 2. Background• µa. nat ! a  µa. nat ! a.

An important aspect to pay attention to here is the negative occurrences of recursive type variables, which occur in the �rst two examples. The combination of contravariance of function
types and recursive types is a key cause to some complexity which is necessary when subtyping recursive types, even for the case of equal types. Indeed, this is the key reason why in theAmber rules a re�exivity rule is needed. We will come back to this point in Chapter 2.1.4.
Example 2

A second example is µa. > ! a  µa. nat ! a. This example illustrates

positive recursive subtyping, since the recursive variables are used only in positive positions,and the two types are not equal. The left type is a function that consumes in�nite values ofany type, and the right type consumes in�nite nat values. Hence, the left type is more generalthan the right type.
Example 3

The type µa. a ! nat is not a subtype of µa. a ! >. This �nal example serves

the purpose of illustrating negative recursive subtyping, where recursive type variables occur
in negative positions. If we ignore the recursive parts of these types, A ! nat  A ! >holds for any type A. But that does not imply that µa. a ! nat  µa. a ! >, because thetype variable a on di�erent sides refers to di�erent types. If we unfold both types twice, we
get:((µa.a ! nat) ! nat) ! nat v.s. ((µa.a ! >) ! >) ! >which should be rejected by the subtyping relation. Because of the contravariance of functions,
we need to check not only that nat  > but also that >  nat (which does not hold).
The role of the unfolding lemma

In Example 3 we argued that subtyping should be re-jected without actually de�ning a rule for subtyping of recursive types. The argument wasthat in such case subtyping should be rejected because unfolding the recursive type a few
times leads to a subtyping relation that is going to be rejected by some other rule not involving
recursive types. The unfolding lemma captures the essence of this argument formally:
If µa. A  µa. B then [a 7! µa. A] A  [a 7! µa. B] B
It states that unfolding the types one time in a valid subtyping relation between recursive
types always leads to a valid subtyping relation between the unfoldings. This property plays
an important role in type soundness, and it essentially guarantees the type preservation ofrecursive type unfolding.
In the following subsections, we brie�y review some possible designs for recursive subtyping.

17

2.1. Subtyping Recursive Types

2.1.1

A Rule That Only Works for Covariant Subtyping

As observed by Amadio and Cardelli [5], a �rst idea to compare two recursive types is to use
the following rules:

G, a ` A  B
G ` µa. A  µa. B

a2G
G`aa

which accept, for example, µa. > ! a  µa. nat ! a and µa. a ! a  µa. a ! a.

Unfortunately, these rules are unsound in the presence of negative recursive subtyping andcontravariant subtyping for function types. We can easily derive the following invalid relation
with those rules:µa. a ! nat  µa. a ! >If we ignore the recursive symbol µ, it is not immediately obvious that the subtyping relation
is problematic:
a ! nat  a ! >However, after unfolding the types twice the problem becomes obvious, as shown in Example
3:((µa. a ! nat) ! nat) ! nat  ((µa. a ! >) ! >) ! >Generally speaking, these rules are sound for positive recursive subtyping. However, contravariant recursive types, where the recursive type variables occur in negative positions, may
allow unsound subtyping statements, as shown above.

2.1.2

The Positive Restriction RuleTo �x the unsound rule in the presence of contravariant subtyping, we might restrict it withpositivity checks on the types:
G, a ` A  B

non-neg(a, A)
non-neg(a, B)G ` µa. A  µa. B

where non-neg(a, A) is false when a occurs in negative positions of A. This restriction, which
was also observed by Amadio and Cardelli [5], solves the unsoundness problem and is employed in some languages and calculi [12]. The logic behind this restriction is that all thesubderivations which encounter a  a (for some recursive type variable a) are valid. Sincesuch subderivations only occur in positive (or covariant) positions, the left a represents µa. A,
and the right a represents µa. B. Since the subtyping is covariant, the statement µa. A  µa. B
is valid, and all substatements a  a are valid as well.

The main drawback of this rule is that no negative recursive subtyping is possible. It

rejects some valid relations, such as µa. > ! a  µa. a ! a. Furthermore, at least with-out some form of re�exivity built-in, it even rejects subtyping of equal types with negative
recursive variables, such as µa. a ! a  µa. a ! a.

18

Chapter 2. Background

G`AB(Original Amber Rules)

OA���������

A=B
G`AB

OA����������

G`AB
G`BC
G`AC

OA����������

G ` B1  A1
G ` A2  B2
G ` A1 ! A2  B1 ! B2

OA����������

ab2G
G`ab

OA��������G`A>OA��������

G, a  b ` A  B
G ` µa. A  µb. B

Figure 2.1: The complete Amber subtyping rules by Amadio and Cardelli [5] for equi-recursive
subtyping.

2.1.3

The Amber Rules

The Amber rules were introduced in the Amber language by Cardelli [32]. Later, Amadio andCardelli [5] studied the metatheory for a subtyping relation that employs Amber-like rules.
These rules are presented in Figure 2.1. The subtyping relation is declarative as the transitivity rule (rule OA����������) is built-in. The rule OA�������� and rule OA���������� arestandard. Rule OA�������� is the most prominent one, describing subtyping between tworecursive types. The key idea in the Amber rules is to use distinct type variables for the tworecursive types being compared (a and b). These two type variables are stored in the environment. Later, if a subtyping statement of the form a  b is found, rule OA���������� isused to check whether that pair is in the environment. The nice thing about rule OA�����
��� and rule OA���������� is that they work very well for positive subtyping. Furthermore,they rule out some bad cases with negative subtyping, such as µa. a ! nat  µb. b ! >.

Unfortunately, rule OA�������� rules out too many cases with negative subtyping, including statements about equal types, such as µa. a ! nat  µb. b ! nat. To compensate for this, rule OA�������� is complemented by a (generalization of the) re�exivity rule

(rule OA���������). In the case of Amadio and Cardelli [5]’s original rules, rule OA��������
comes with a non-trivial de�nition of equality A = B (we refer to their paper for details).
Such equality allows deriving statements such as µa. nat ! a = µa. nat ! nat ! a or

µa. nat ! a = nat ! µa. nat ! a, which is used to ensure that recursive types andtheir unfoldings are equivalent. That is, generally speaking, the following equality holds at the
type-level:µa. A = [a 7! µa. A] A

In other words, the set of rules de�nes a subtyping relation for equi-recursive types. Amadio andCardelli [5] did a thorough study of the metatheory of such equi-recursive subtyping, including
providing an intuitive speci�cation for recursive subtyping. In essence two recursive types are
subtypes if their in�nite unfoldings are subtypes.

192.1. Subtyping Recursive Types

2.1.4

The iso-recursive Amber rules

Amadio and Cardelli [5]’s set of rules is more powerful than what is normally considered tobe the folklore Amber rules for iso-recursive subtyping. Many typical presentations of theAmber rule simply use a variant of syntactic equality2 in re�exivity, which is less powerful,
but it is enough to express iso-recursive subtyping. In what follows we consider the folklore
rules, where the equality (A = B) used in rule OA��������� is simpli�ed by just considering
syntactic equality. The iso-recursive rules can deal correctly with all the examples illustrated
so far, accepting the various examples that we have argued should be accepted, and rejecting
the other ones. Perhaps a small nitpicking point is the absence of well-formedness constraints
in the subtyping rules. By modern day standards, this may look a little suspicious, but thenagain well-formedness of environments and types is typically standard and straightforward.
Unfortunately, as it turns out, a suitable de�nition of well-formedness is non-trivial for Amber
subtyping. We will come back to this issue in Chapter 5. Setting the issue of well-formedness
aside for the moment, the Amber rules have some other important issues:Re�exivity cannot be eliminated

The re�exivity rule is essential to the subtyping relation.

As we have seen, one cannot even derive µa. a ! nat  µa. a ! nat without the re�exivity
rule, due to the contravariant positions of the variables. One possible �x is to add another rulethat allows variable subtyping in contravariant positions:
ab2G
G`ba

However, such rule allows unsound subtypes, for instance, µa. a ! nat  µa. a ! >. In
fact, adding this rule leads to a similar system to that in Chapter 2.1.1.

The re�exivity rule, if present in the subtyping relation, depends on a speci�c equivalence
judgment. Simple systems with antisymmetric subtyping relations might use syntactic equivalence or alpha-equivalence. Yet syntactic or alpha-equivalence might be insu�cient for othersystems. For example, permutation of �elds on record types should be considered as equivalent
types, thus we may accept the following subtyping statement:µa. { x : a, y : nat} ! nat  µa. {y : nat, x : a} ! nat
However, if the built-in re�exivity employs only alpha-equivalence, such a subtyping statement
may be rejected. For instance if record types are modelled as sequences in the abstract syntax(which is quite common [100]), then the two records { x : a, y : nat} and {y : nat, x : a}will be syntactically di�erent. In this case the subtyping relation is not antisymmetric. Thatis both { x : a, y : nat}  {y : nat, x : a} and {y : nat, x : a}  { x : a, y : nat} are true,

but the two types are not equal. Thus, a (strict) re�exivity rule employing syntactic equality
is not adequate in such cases. For record types it may be possible to avoid this issue by usinga di�erent representation in the abstract syntax. For instance, we could try to model record
2 More precisely, in a setting where binders and variables are encoded using names, alpha-equivalence is used. In

settings where De Bruijn indices are used, it amounts to syntactic equality.

20

Chapter 2. Backgroundtypes instead as �nite maps from �eld names to types. Then equality of �nite maps could havethe expected properties for equality and a standard re�exivity rule could su�ce. However,other type system features, such as union (A _ B) and intersection types (A ^ B) [51, 104, 15],
would pose similar challenges. In those type systems we wish to have A ^ B and B ^ A to beequivalent types, for example. A change of representation of abstract syntax does not seem tohelp for such features.
The reader may refer to work by Ligatti et al. [84] for a more extended discussion on thecomplications of having the re�exivity rule built-in. We will also come back to this point in
Chapter 6.
Finding an algorithmic formulation: transitivity elimination is non-trivial

In therules that Amadio and Cardelli [5] use, and assuming that equivalence in re�exivity is justalpha-equivalence, simply dropping transitivity (rule OA����������) to obtain an algorithmic
formulation loses expressive power. A simple example that illustrates this is:
a1  a2 , a2  a3 ` a1  a2

a1  a2 , a2  a3 ` a2  a3

a1  a2 , a2  a3 ` a1  a3���� ��� ����!

Such derivation is valid in a declarative formulation with transitivity, but invalid when transitivity is dropped. Therefore, either the declarative speci�cation must be changed to eliminate“invalid” derivations, or the simply dropping transitivity will not work and some changes in
the algorithmic rules are necessary.
Proofs of transitivity and other lemmas are hard A related problem is that proving transitivity of an algorithmic formulation with Amber-style rules is hard. Surprisingly to us, despite
the wide use of the Amber rules since 1985 for iso-recursive subtyping, there is very little workthat describes transitivity proofs. Many works simply avoid the problem by considering only
declarative rules with transitivity built-in [1, 83, 103, 38]. The only proof that we are aware offor transitivity of an algorithmic formulation of the iso-recursive Amber rules is by Bengtson
et al. [18]. Some researchers have tried, but failed, to formalize this proof in Coq [12]. They
found transitivity is hard to prove syntactically, as it requires a “very complicated inductive
argument”. Thus, they �nally adopt the positive restriction, as we discussed in Chapter 5. We
also tried to directly prove some of these properties in Coq with variations of the Amber rules,
but none of them works properly.
Non-orthogonality of the Amber rules

Finally, the Amber rules interact with other sub-typing rules. Besides requiring re�exivity, they require a speci�c kind of entries in the typing
environment, which is di�erent from typical entries in other subtyping relations. This a�ects
other rules, and in particular it a�ects the proofs for cases that are not related to recursive types.
For instance this is a key issue that we encountered when trying to prove transitivity and otherproperties. Furthermore, it also a�ects implementations, since adding the Amber rules to an
existing implementation of subtyping requires changing existing de�nitions and some cases

2.2. Object Encodings

21of the subtyping algorithm. In short, the Amber rules are not very modular: their addition
has signi�cant impact on existing de�nitions, rules, implementations and, most importantly,
proofs.

2.2

Object Encodings

2.2.1

Intersection types and merge operator

Intersection types [104, 51] are widely used in programming languages. For example, they
can model key aspects of multiple inheritance [48]. The Merge operator [106] is a term constructor that explicitly introduces a form of intersections. Unfortunately, the merge operator
is too powerful to obtain an unambiguous semantics, causing a program to possibly evaluate
to di�erent results.
In Chapter 1.1.3, we have discussed the challenges of the combination of record calculi
and subtyping. Recent work on calculi with disjoint intersection types [89] and a merge operator[106, 57], o�ers a solution to the Cardelli and Mitchell [36]’s problem for concatenation. Theli calculus is one of the calculi in this line of work, featuring a merge operator and disjoint

intersection types. In li , all expressions in a merge operator must have disjoint types.

In other words, the li calculus [89] adopts disjointness and restricts subsumption toaddress the challenges of symmetric concatenation/merge. Most importantly, li has a type-directed semantics to ensure proper information hiding and the preservation of the expected
modular type invariants. The application of the f2 function in li results in {x = 3, y = true}, which has no con�icts and is of the right type. Types are used at runtime to ensure that�elds hidden by subtyping are dropped from the record. This is enforced, for example, duringbeta-reduction, which uses the type of the argument to �lter any hidden �elds/values fromrecords/merges. Thus, before substitution, the �rst argument of f2, for instance, is �rst �lteredusing the type {x : Int}. The actual record that is substituted in the body of f2 is {x = 3}
(and not {x = 3, y = 4}).
li and other calculi with disjoint intersection types [89, 4, 20] have been shown to pro-vide �exible forms of dynamic multiple inheritance [19, 119]. Moreover, they enable a highly
modular and compositional programming style that addresses the Expression Problem [116]naturally. For simplicity, here we only illustrate brie�y the ability of such calculi to model�rst-class traits and a very dynamic form of inheritance [19]:addId ( super : Trait [ Person ] , idNumber : Int ) : Trait [ Student ]=trait inherits super = > { def id : Int = idNumber }In this code, written in the SEDEL language [19], there are two noteworthy points. Firstly,
unlike statically typed mainstream OOP languages, traits (which are similar to OOP classes)are �rst class. They can be passed as arguments (such as super), or returned as a result as above.
Secondly, the code uses a highly dynamic form of inheritance. The trait that is inherited (super) is a parameter of the function. In contrast, in languages like Java, for class A extends B, theclass B must be statically known. We refer the interested reader to the work by Bi and Oliveira

22

Chapter 2. Background[19] and Zhang et al. [119] for a much more extensive discussion on the applications of calculi
with disjoint intersection types, as well as how to encode source language features, such as�rst-class traits.

2.2.2

Bounded quanti�cation

Bounded quanti�cation allows types to be abstracted by type variables with a subtyping constraint (or bound). The standard calculus with bounded quanti�cation, F [37, 53, 35], has two

common variants when it comes to subtyping universal types. The full F variant [53, 35]
compares bounded quanti�ers with the following rule:S��������G ` A2  A1

G, a  A2 ` B  C

G ` 8(a  A1 ). B  8(a  A2 ). C

The most signi�cant characteristic of full F is that it allows two bounded quanti�ers to becontravariant on their bound types A1 and A2 when being compared. However, the rich ex-pressivity of full F results in an undecidable subtyping relation [98], which is undesirable.
In addition, as Ghelli [65] demonstrates, the rule S�������� may even prevent conservativeextensions of F in the presence of additional features, such as equi-recursive types. Ghelli
illustrates this with a simple example:⌘ 8a. (8(a0  a).
A ⌘ 8( b  B). b
B

where

a)

A0
R

⌘ 8( b  B). 8( b0  b). b⌘ 8( b  B). µX. 8( b0  X ).

X

A stands for A ! > and 8a. A is the abbreviation of 8(a  >). A. In full F ,0
A  A does not hold. However, both A  R and R  A0 can be derived in full F whenthe equi-recursive subtyping is allowed, even the subtyping between recursive types is weaker
than strong recursion [5, 65].
There are several ways to restrict bounded quanti�cation to a fragment with decidable
subtyping, such as removing top types, or assuming no bounds when comparing type abstraction bodies [41]. Among those the most widely used variant is the kernel F calculus. In

kernel F bounded quanti�ers can only be subtypes when their bound types are identical [37],which is stated in the rule S����������.

S����������G`A

G, a  A ` B  C

G ` 8(a  A). B  8(a  A). C

We can further generalize the rule S���������� to rule S�������� that accepts equivalent bounds instead. The use of rule S�������� enables more subtyping involving nonantisymmetric subtyping relations, such as records.
S��������G ` A1  A2

G ` A2  A1

G, a  A2 ` B  C

G ` 8(a  A1 ). B  8(a  A2 ). C

In the Chapter 8, we will focus on kernel F , in order to achieve decidable subtyping with

iso-recursive subtyping.

23

Part II

Basic Theory

25

Chapter 3

A New Speci�cation for
Iso-Recursive Subtyping
In Chapter 2.1.4, we describe the iso-recursive Amber rules, which are the most widely-usedsubtyping rules for iso-recursive types. While the Amber rules are simple, as we have argued,
there are important issues with the rules. In particular developing the metatheory for the
Amber rules is quite hard. As a �rst step towards understanding the essence of the Amber
rules, in the Chapter 3, we provide a new declarative speci�cation of iso-recursive subtyping
in terms of �nite unfoldings.

3.1

Overview

The key idea of the new rules is inspired by the rules presented for covariant subtyping in
Chapter 2.1.1. The logic of the covariant rules is to approximate recursive subtyping using
what we call a 1-time �nite unfolding. We say that the unfolding is �nite because we simply
use a instead of using the recursive type itself during unfolding. If we apply �nite unfoldings
to all recursive types, we eventually end up having a comparison of two types representing
�nite trees. The covariant rules work �ne in a setting with covariant subtyping only, but are
unsound in a setting that also includes contravariant subtyping. A plausible question is then:can we �x these rules to become sound in the presence of contravariant subtyping?
The answer to this question is yes! Let us have a second look at the unsound counterexample that was presented in Chapter 2.1.1:µa. a ! nat  µa. a ! >As we have argued, this subtyping statement should fail because unfolding the recursivetype twice leads to an invalid subtyping statement. However, with the 1-time �nite unfolding
used by the rules in Chapter 2.1.1, all that is checked is whether a ` a ! nat  a ! > holds.

Since such statement does hold, the rule unsoundly accepts µa. a ! nat  µa. a ! >. The
problem is that while the 1-time unfolding works, other n-times unfoldings do not. Therefore,
an idea is to check whether other n-times unfoldings work as well to recover soundness.

26

Chapter 3. A New Speci�cation for Iso-Recursive Subtyping

3.1.1

Declarative subtyping

Our declarative subtyping rules build on the previous observation and only accept the subtyping relation between two recursive types if and only if all their n-times �nite unfoldings are
subtypes for any positive integer n:
G, a ` [a 7! A]n A  [a 7! B]n B
G ` µa. A  µa. B

8n = 1 · · · •S�R��In comparison to the rules showed in Chapter 2.1.1, our subtyping rule S���� has a stricter
condition, by checking the subtyping relation for all n-times �nite unfoldings, instead of only
the 1-time �nite unfolding. Such restriction eliminates the false positives on contravariant
recursive types. The de�nition of n-times �nite unfolding used in the rule is as follows:De�nition 1 (n-times �nite unfolding).

[a 7! A]n B := [a 7! A][a 7! A] · · · [a 7! A] B|{z}(n 1) times

By de�nition, [a 7! A]n A is the n-times �nite unfolding of µa. A, but we use a slight generalization (mainly for proofs) to unfold a type B with another type A multiple times. For
example, for the recursive type µa. nat ! a, the 1-time �nite unfolding is nat ! a and thetwo times �nite unfolding is nat ! nat ! a. Note that the zero-times �nite unfolding would
be the recursive type itself, according to our terminology. In other words, we execute (n1)

times substitutions (where n corresponds to the arity of the �nite unfolding) of the body of
the recursive type to itself. For example, [a 7! A]1 A = A, [a 7! A]2 A = [a 7! A] A,[a 7! A]3 A = [a 7! A][a 7! A] A, etc. The counting scheme for the n-times �nite unfolding de�nition may look at little odd. One may expect the more natural looking de�nition
where the body is unfolded n times instead of n 1 times. However, using n times insteadof n 1 would disagree with our terminology for �nite unfoldings of recursive types. For instance, the 1-time unfolding of µa. nat ! a is nat ! a, and does zero (not one!) substitutionsin the body.
In rule S����, the number of times that the left and the right types are unfolded is exactly
the same. One may wonder if it makes sense to consider cases where we would unfold therecursive types a di�erent number of types on the left and on the right. We believe that suchapproach would lead to a type unsound rule, and that it is important that the number of �nite
unfoldings is the same. For instance, consider µa. nat ! a  µa. nat ! nat ! >. In thiscase if we choose to unfold the body of the left recursive type n + 1 times and the body of theright recursive type only n times (for all n) then we would get a valid subtyping statement.
However, those two types should not be subtypes since if we apply the unfolding lemma wewould obtain: nat ! (µa. nat ! a)  nat ! nat ! >. The latter is not a valid subtyping
statement.

27

3.1. Overview


!

!


!

>


!

>
>

nat


!

!
nat



!
nat

...

!
...

Figure 3.1: Tree model for equi-recursive subtyping.

3.1.2

Contrasting Equi and Iso-Recursive Types

It is useful to contrast the rule S���� and its formulation in terms of �nite unfoldings to Amadio
and Cardelli [5]’s speci�cation of equi-recursive subtyping in terms of in�nite unfoldings of therecursive types. In Amadio and Cardelli [5]’s work they use the notion of �nite approximationof a tree, which is closely related to the idea of �nite unfoldings. A simpli�ed1 speci�cation ofequi-recursive subtyping in terms of subtyping of in�nite trees can be reformulated in termsof �nite unfoldings as:S����G ` [ a 7 ! A] • A  [ a 7 ! B] • B
G ` µa. A  µa. B

Where the notation [a ! A]• A denotes applying in�nite substitutions to A. In other words,

we de�ne the equi-recursive comparison by just one comparison on the limit case, which
will potentially compare two in�nite trees. With rule S�E�� subtyping statements such asµa. > ! a  µa. nat ! a hold, just like with the rule S���� for iso-recursive subtyp-ing. However, unlike iso-recursive subtyping, subtyping statements such as µa. > ! a µa. nat ! nat ! a also hold, since we unfold both trees to the limit. Figure 3.1 visualizes

the tree model equi-recursive subtyping. Note that the �gure applies to both µa. > ! a µa. nat ! a and µa. > ! a  µa. nat ! nat ! a, since in both cases the in�nite unfoldingsof the trees in the subtyping statements are the same.

Instead of a single comparison in the limit case, the rule S���� for iso-recursive subtyping
requires in�nitely many comparisons, one for each n-time unfolding. For example, Figure 3.2
1 This de�nition is simpli�ed because the rule S�E�� compares only two recursive types. In general, in equirecursive formulations, any two types (recursive or not) can be unfolded and compared. For instance nat !
(µa. nat ! a)  µa. nat ! a should hold, since the in�nite unfoldings of the two types are the same.

28

Chapter 3. A New Speci�cation for Iso-Recursive Subtyping


!

!


nat

a

>

a

(a) Rank-1 tree


!

!


!

>

nat



nat

a

>

!
a

(b) Rank-2 tree


!
!

>

!



!

>
>

nat



!
nat

!
nat

a

a

(c) Rank-3 tree

Figure 3.2: Tree model for iso-recursive subtyping for the �rst 3 �nite unfoldings for µa. > !
a  µa. nat ! a.
visualizes the comparisons for µa. > ! a  µa. nat ! a in the iso-recursive model. In the�gure we show only the �rst 3 comparisons, which would correspond to the 1-time, 2-times
and 3-times �nite unfoldings respectively. However, there would be an in�nite number ofsuch comparisons for all n-times �nite unfoldings. Using rule S���� the subtyping statementµa. > ! a  µa. nat ! nat ! a fails, unlike in the equi-recursive model. It is easy
to see why this is the case. Since rule S���� requires that all comparisons are successful, toshow that two recursive types are not subtypes it is enough to show that one of the �nite
comparisons fails. For example, the comparison of 1-time �nite unfoldings, which amounts to3.2. Syntax, Well-Formedness and Subtyping

29> ! a  nat ! nat ! a, fails. Therefore, we can see that rule S���� rejects µa. > ! a µa. nat ! nat ! a.

3.2

Syntax, Well-Formedness and Subtyping

In this section we will introduce a full calculus with declarative subtyping and recursive types.
Our calculus is based on the simply typed lambda calculus extended with iso-recursive types
and subtyping. This declarative system captures the idea that, with iso-recursive types, tworecursive types are subtypes if all their �nite unfoldings are subtypes.

3.2.1

Syntax and well-formedness

The calculus that we model is a simply typed lambda calculus with subtyping. The syntax oftypes and contexts for this calculus is shown below.
Types

A, B, C, D

Expressions

e

Valuesv

Contexts

G

::=
::=

nat | > | A1 ! A2 | a | µa. A

::=
::=

i | lx : A. e | fold [ A] v

x | i | e1 e2 | lx : A. e | unfold [ A] e | fold [ A] e

· | G, a | G, x : A

Meta-variables A, B, C, D range over types. These types consist of: natural numbers (nat),
the top type (>), function types (A ! B), type variables (a) and recursive types (µa. A).
Expressions, denoted as e, include: term variables (x), natural numbers (i), applications (e1 e2 ),lambda expressions (lx : A. e). The expression unfold [ A] e is used to unfold the recursivetype of an expression e; while fold [ A] e is used to fold the recursive type of an expression e.
Some expressions are also values: natural numbers (i), lambda expressions (lx : A. e) as well
as fold expressions (fold [ A] v) if their inner expressions are also values. The context is used
to store variables with their type and type variables.
The de�nition of a well-formed environment ` G is standard (Figure 3.3), ensuring thatall variables in the environment are distinct. In a well-formed environment, repetition of variables is not allowed and the order of variables are not important. Note that, throughout the
paper, we adopt the convention that variables are distinct. For instance, in rule ������� thea introduced in G is distinct from other variables in G. In our Coq formalization the use of
a locally nameless [42] encoding for binders makes such informal conventions precise. The
middle of Figure 3.3 also shows the judgement for well-formed types. A type is well-formed
if all of its free variables are in the context. The rules of this judgement are mostly standard.
The rule ������� states that if the body of a recursive type is well-formed under an extended
context then the recursive type is well-formed.

3.2.2

Subtyping

The bottom of Figure 3.3 shows the declarative subtyping judgement. Our subtyping rules are
standard with the exception of the new rule for recursive types. Rule S���� states that any wellformed type A is a subtype of the > type. Rule S���� is a standard rule for type variables which
are introduced when unfolding recursive types: variable a is a subtype of itself. The rule for30

Chapter 3. A New Speci�cation for Iso-Recursive Subtyping`G(Well-Formed Environment)�������

���������

`G

`·
G`A

�������

a 62 G` G, a`Gx 62 GG`A` G, x : A(Well-Formed Type)�������

����T��

G ` natG`>�������

a2G
G`a���������G ` A1G ` A2G ` A1 ! A2

G`AB
S����

`G
G ` nat  nat�������

G, a ` A
G ` µa. A(Declarative Subtyping)
S����

`G
G`A
G`A>

S����

`G
G`a
G`aa

S������

G ` B1  A1
G ` A2  B2
G ` A1 ! A2  B1 ! B2

S����G, a ` [a 7! A]n A  [a 7! B]n B 8n = 1 · · · •G ` µa. A  µa. B
Figure 3.3: Well-formedness and subtyping rules.

function types (rule S������) is standard, but worth mentioning because it is contravariant on
input types. As illustrated in Chapter 2.1 (and various previous works), the interaction between
recursive types and contravariance has been a key di�culty in the development of subtyping
with recursive types. Finally, rule S���� is the most signi�cant: it tells us that a recursive typeµa. A is a subtype of µa. B, if all their corresponding �nite unfoldings are subtypes. Both[a 7! A]n A and [a 7! B]n B are used to denote n-times �nite unfolding, as De�nition 1 has
illustrated.

3.3

Metatheory of Subtyping

The metatheory of the subtyping relation includes three essential properties: re�exivity, transitivity and the unfolding lemma.

3.3.1

A better induction principle for subtyping properties

The �rst challenge that we face when looking at the metatheory of subtyping with recursive
types is to �nd adequate induction principles for various proofs. In particular the proofs ofre�exivity and transitivity can be non-trivial without a suitable induction principle. A �rst idea
to prove both re�exivity and transitivity is to use induction on well-formed types. However,the problem of using this approach is that there is a mismatch between the well-formedness
and subtyping rules for recursive types. The induction hypothesis that we get from rule ������� gives us a statement that works on 1-time �nite unfoldings, whereas in the subtyping rule
we have a premise expressed in terms of all �nite unfoldings.

31

3.3. Metatheory of Subtyping

Fortunately, we can de�ne an alternative variant of well-formedness that gives us a better
induction principle. The idea is to replace rule ������� with a rule that expresses that if all�nite unfoldings of a recursive type are well-formed then the recursive type is well-formed.
De�nition 2. Rule ������� is de�ned as:�������

G, a ` [a 7! A]n A

8n = 1 · · · •G ` µa. A

The two de�nitions of well-formedness are provably equivalent. In the proofs that follow,
when we use induction on well-formed types, we use the variant with the rule �������.

3.3.2

Re�exivity and transitivity

Next we prove re�exivity and transitivity. First of all, we know that subtyping is regular, i.e.
subtyping implies well-formedness of context and types:
Lemma 3. Regularity: If G ` A  B then ` G and G ` A and G ` B.

Another important property of our subtyping rules is that the order of variables in con-texts is irrelevant. That is we can always permute whole portions of the environment:
Lemma 4. If G1 , G2 , G3 , G4 ` A  B then G1 , G3 , G2 , G4 ` A  B.

Thanks to our standard context, the proofs of both re�exivity and transitivity are straightforward using the variant of well-formedness with rule �������. This contrasts with the Amber
rules [32], where re�exivity needs to be built-in and the proof of transitivity is quite complex(and hard to mechanize on a theorem prover) [18, 12].
Theorem 5. Re�exivity.
If ` G and G ` A then G ` A  A.
Theorem 6. Transitivity.
If G ` A  B and G ` B  C then G ` A  C.
Proof. From Lemma 3 we know all types and the environment are well-formed. Do induction
on G ` B (with the rule �������).
• Rule �������: Do inversion on both two subtyping statements, and we know that A isnat and C is nat or >.

• Rule ����T��: Do inversion on G ` >  C, and we know that C is >.

• Rule �������: Do inversion on both two subtyping statements, and we know that A is
a and C is a or >.

• Rule ���������: Assume B := B1 ! B2 .

32

Chapter 3. A New Speci�cation for Iso-Recursive Subtyping– Do inversion on G ` B1 ! B2  C, we know C is > or C := C1 ! C2 . The
former one is solved immediately. From the latter one, we obtain G ` C1  B1 andG ` B2  C2 .

– Do inversion on G ` A  B1 ! B2 , we know A := A1 ! A2 and obtain
G ` B1  A1 and G ` A2  B2 .

– Now the goal is G ` A1 ! A2  C1 ! C2 . Applying the arrow rule, what weneed to prove are G ` C1  A1 and G ` A2  C2 . The two goals can be solved by
the induction hypotheses.

• Rule �������: Assume B := µa. B0 .
– Firstly, it is worthwhile stating the induction hypothesis that we get from rule ������� explicitly: 8n A C, G, a ` A  [a 7! B0 ]n B0 ^ G, a ` [a 7! B0 ]n B0 C ) G, a ` A  C.

– Do inversion on G ` µa. B0  C, we know C is > or C := µa. C 0 . The former one
is solved immediately. From the latter one, we obtain 8n, G, a ` [a 7! B0 ]n B0 

[a 7! C 0 ]n C 0 .

– Do inversion on G ` A  µa. B0 , we know A := µa. A0 and obtain 8n, G, a `[a 7! A0 ]n A0  [a 7! B0 ]n B0 .

– Now the goal is G ` µa. A0  µa. C 0 . Applying the rule for recursive types, what

we need to prove is 8n, G, a ` [a 7! A0 ]n A0  [a 7! C 0 ]n C 0 , which can besolved by the induction hypothesis.

Modularity of the proofs

Note that in our transitivity proof, all the cases, except for therecursive case, are standard and essentially the same as in a calculus without recursive types.
In other words the proof is modular in the sense that existing cases of the proof are not significantly a�ected by the addition of recursive types. Other proofs, such as re�exivity or weakening, are similarly modular in the same sense. Existing proofs for previous formulations of
iso-recursive subtyping [18, 84] and in particular transitivity proofs are non-modular, and require signi�cant changes after the addition of recursive types. We discuss this in more detailin related work (Chapter 9.1).

3.3.3

Unfolding lemma

Next, we turn to the unfolding lemma:
If G ` µa. A  µa. B then G ` [a 7! µa. A] A  [a 7! µa. B] B.
which states: if two recursive types are in a subtyping relation, then substituting themselves
into their bodies preserves the subtyping relation. This lemma plays a crucial role in the proof

33

3.3. Metatheory of Subtypingof type preservation as we shall see in Chapter 3.4. However, the lemma cannot be proved
directly: we need to prove a generalized lemma �rst.
Lemma 7. If
1. G1 , a, G2 ` A  B;

2. G1 , G2 ` µa1 . C and G1 , G2 ` µa1 . D;
3. a does not occur free in C and D;

4. G1 , a1 , G2 ` [a1 7! C ]n [a 7! a1 ] A  [a1 7! D ]n [a 7! a1 ] B holds for all n,then G1 , G2 ` [a 7! µa1 . C ] A  [a 7! µa1 . D ] B.

Proof. Induction on G1 , a, G2 ` A  B. Cases rules S����, S����, and S������ are simple.

• Rule S����. Assume that A and B are variable b. If b 6= a, then the goal is provendirectly. Otherwise, the fourth premise is G1 , a1 , G2 ` [a1 7! C ]n a1  [a1 7! D ]n a1 ,where n is arbitrary. The goal becomes G1 , G2 ` µa1 . C  µa1 . D. Then we can apply
the rule for recursive types. Note that in the context, the order of variables is unimportant(see Lemma 4) we can permute the context without a�ecting the correctness. Therefore,
the goal is equal to the fourth premise after context permutation and alpha-conversion
between a1 and a, which is possible due to the premise (3). Note also, that premise (3)can be derived from premise (2), but we explicitly show it as a premise due to the role in
the proof.
• Rule S����. Assume that the shape of A is µa2 . A0 and the shape of B is µa2 . B0 .
– The fourth premise becomes 8n, G1 , a1 , G2 ` [a1 7! C ]n [a 7! a1 ] µa2 . A0 

[a 7! D ]n [a 7! a1 ] µa2 . B0 , which can be rewritten to 8n, G1 , a1 , G2 ` µa2 . [a 7!
C ]n [a 7! a1 ] A0  µa2 . [a 7! D ]n [a 7! a1 ] B0 .

– The goal becomes G1 , G2 ` [a 7! µa1 . C ] µa2 . A0  [a 7! µa1 . D ] µa2 . B0 , which
can be rewritten to G1 , G2 ` µa2 . [a 7! µa1 . C ] A0  µa2 . [a 7! µa1 . D ] B0 .

– If we apply rule S���� to the goal, we get: 8n, G1 , G2 , a2 ` [a2 7! ([a 7!
µa1 . C ] A0 )]n ([a 7! µa1 . C ] A0 )  [a2 7! ([a 7! µa1 . D ] B0 )]n ([a 7!
µa1 . D ] B0 ).

– We rewrite the goal above, getting: 8n, G1 , G2 , a2 ` [a 7! µa1 . C ][a2 7! A0 ]n A0 

[a 7! µa1 . D ][a2 7! B0 ]n B0 .

– The induction hypothesis is complex, so we write it here explicitly for readabilityof the proof: 8n, (8n0 , G1 , a1 , G2 ` [a1 7! C ]n [a 7! a1 ][a2 7! A0 ]n A0  [a1 7!
00

D ]n [a 7! a1 ][a2 7! B0 ]n B0 ) ) G1 , a2 , G2 ` [a 7! µa1 . C ][a2 7! A0 ]n A0 

[a 7! µa1 . D ][a2 7! B0 ]n B0 .

– By applying context permutation and induction hypothesis to the goal, we get:
08n, 8n0 , G1 , a1 , G2 ` [a1 7! C ]n [a 7! a1 ][a2 7! A0 ]n A0  [a1 7! D ]n [a 7!

34Chapter 3. A New Speci�cation for Iso-Recursive Subtyping
a1 ][a2 7! B0 ]n B0 , which can be proven by the inversion of fourth premise due to0

the fact that substitution is commutative.

Lemma 7 captures the idea of �nite approximation. It relates the boundless unfolding withlimited unfolding. This lemma is a generalization of the unfolding lemma, and when A = C
and B = D, one easily obtains the unfolding lemma.
Lemma 8. Unfolding Lemma.
If G ` µa. A  µa. B then G ` [a 7! µa. A] A  [a 7! µa. B] B.

3.4

Type Safety

In this section, we show that our system is type sound by proving preservation and progress.

3.4.1

Typing and reduction rules

As the top of Figure 3.4 shows, the typing rules are quite standard. Noteworthy are the rules
involving recursive types. Rule ������������� reveals that if e has type µa. A then, after
unfolding, its type becomes [a 7! µa. A] A. Rule ����������� says if e has type [a 7!

µa. A] A, after folding, its type becomes µa. A, with an additional type well-formedness checkon µa. A. The two constructs establish an isomorphism, which is used to deal with expressions
with iso-recursive types. The last rule is the standard subsumption rule (rule ����������).
The bottom of Figure 3.4 shows the reduction rules, which are also quite standard. We
only focus on the last three rules involving recursive types. Rule �������� cancels a pair of
unfold and fold. Note that the two types A and B are not necessarily the same. The last two
rules (rule ����������� and rule ���������) simply reduce the inner expressions for unfold’sand fold’s.

3.4.2

Type soundness

In this subsection, we brie�y illustrate how to prove type-soundness. The technique is mostly
conventional, except for the fundamental use of the unfolding lemma in the preservation proof(via Lemma 10). Firstly, we need a conventional substitution lemma to deal with beta reductionin preservation:
Lemma 9. Substitution lemma. If G1 , x : B, G2 ` e : A and G2 ` e0 : B then G1 , G2 ` [ x 7!
e0 ] e : A.

Then we show how the unfolding lemma is used in the proof on type soundness, via an inversion of typing lemma for fold expressions:Lemma 10. Inversion of typing for fold expressions: If G ` fold [ A] e : S and G ` S  µa. B,
then 9 T, G ` e : [a 7! µa. T ] T ^ G ` [a 7! µa. T ] T  [a 7! µa. B] B.

35

3.4. Type SafetyG`e:A(Typing)����������

����������`GG ` i : nat`G�������������

x:A2G
G`x:A

G ` e : µa. A
G ` unfold [µa. A] e : [a 7! µa. A] A����������

G ` e1 : A1 ! A2
G ` e2 : A1
G ` e1 e2 : A2

����������

G, x : A1 ` e : A2
G ` lx : A1 . e : A1 ! A2�����������

G ` e : [a 7! µa. A] A
G ` µa. A
G ` fold [µa. A] e : µa. A����������

G`e:A
G`AB
G`e:B

e1 ,! e2

(Reduction)���������

���������

(lx : A. e1 ) v2 ,! [ x 7! v2 ] e1

e1 ,! e10e1 e2 ,! e10 e2�����������

��������

unfold [A] (fold [B] v) ,! v

e ,! e0
unfold [A] e ,! unfold [A] e0���������

e2 ,! e20v1 e2 ,! v1 e20

���������

e ,! e0fold [A] e ,! fold [A] e0

Figure 3.4: Typing and reduction rules.
Proof. Do induction on G ` fold [ A] e : S.

• Rule �����������: the premises become G ` e : [a 7! µa. A0 ] A0 (assume A = µa. A0 )and G ` µa. A0  µa. B. In such situation, let T = A0 , we achieve the goal by applying
the unfolding lemma (Lemma 8).

• Rule ����������: trivial by applying transitivity (Theorem 6).

Finally, we can proceed to the preservation and progress theorems, and the proof strategy isquite standard.
Theorem 11. Preservation.
If G ` e : A and e ,! e0 then G ` e0 : A.
Proof. By induction on G ` e : A. Most cases are trivial or standard, except for• Rule �������������. In this case, e is decomposed into unfold [µa. A] e, and our goal
is to prove G ` e0 : [a 7! µa. A] A.

By inversion on unfold [µa. A] e ,! e0 , we will get two sub-cases.
– The case for rule ����������� is trivial: e0 continues to decompose into unfold [µa. A] e0 .
By applying rule ������������� and induction hypothesis, we achieve the goal.

36

Chapter 3. A New Speci�cation for Iso-Recursive Subtyping– As for case involving rule ��������, the �rst premise becomes G ` fold [ A0 ] v :µa. A. Then we do the inversion on the �rst premise again, get two sub-cases. The

�rst case is same as the goal. The second case, raised by rule ����������, needssome extra work: what we get now are G ` fold [ A0 ] v : S and G ` S  µa. A.
Then we apply Lemma 10 (where the unfolding lemma is used) and rule ����������
to achieve the goal.

Theorem 12. Progress.
If ` e : A then e is a value or exists e0 , e ,! e0 .
Proof. By induction on ` e : A.

3.5

Mechanized Proofs

The folder coq_theory includes all the Coq proofs about STLC extended with iso-recursive
subtyping, which is the calculus described in this chapter.

3.5.1

De�nitions

All the de�nitions in the Chapter 3 can be found in the �le Rules.v. Table 3.1 shows the correspondence of de�nitions between the paper and the Coq artifacts. The �le Rules.v contains thede�nitions for our type system. It has de�nitions of well-formedness, subtyping, typing, andreduction.
For encoding variables and binders, we use the locally nameless representation to express
all the types and terms. In the paper, we use only substitution to represent unfolding of arecursive type. In the Coq proof, due to the use of the locally nameless representation, we also
use of opening operation on pre-terms [11]. Furthermore, in the paper, we always use the same
notation for well-formedness with rule �������, rule �������. In the Coq formalization, we
have two distinct de�nitions of well-formedness, which are proved to be equivalent.

3.5.2

Lemmas and theorems

Table 3.2 shows the descriptions for all the proof scripts in Chapter 3. For succinctness, webrie�y describe the important lemmas and theorems.

37

3.5. Mechanized Proofs

Table 3.1: Paper-to-proofs correspondence guide in Chapter 3.
De�nition
Well-formed Type (Figure 3.3)
Well-formed Type (De�nition 2)
Declarative Subtyping (Figure 3.3)
Typing (Figure 3.4)
Reduction (Figure 3.4)

File
Rules.v
Rules.v
Rules.v
Rules.v
Rules.v

Name in Coq
WFA E AWFS E A
Sub E A B
typing E e A
step e1 e2Notation
G`A
G`A
G`AB
G`e:A
e1 ,! e2

Table 3.2: Descriptions for the proof scripts in Chapter 3.
Theorems
Theorem 5
Theorem 6
Lemma 8
Theorem 11
Theorem 12

Description
Re�exivity
Transitivity
Unfolding Lemma
Preservation
Progress

Files
FiniteUnfolding.v
FiniteUnfolding.v
FiniteUnfolding.v
Typesafety.v
Typesafety.v

Name in Coq
re�
Transitivity
unfolding_lemmapreservation
progress

39

Chapter 4

Algorithmic Subtyping for
Iso-Recursive Subtyping
In Chapter 3 we introduced a declarative formulation of subtyping with recursive types. Unfortunately, such formulation is not directly implementable since the rule of subtyping forrecursive types checks against an in�nite number of conditions (that all �nite unfoldings are
subtypes). In this chapter, we will present two sound and complete algorithmic formulationsof subtyping. These formulations replace the declarative rule S���� by rules based on double
unfoldings. A �rst rule, which we call the double unfolding rule, unfolds the recursive types
1-time and 2-times, respectively. The double unfolding rule relates to di�erent subtyping formulations in this thesis, playing a signi�cant role as a hub, as shown in Figure 5.4 in the next
Chapter. We then give another algorithmic variant, using the nominal unfolding rule, and�nally prove our subtyping rules for iso-recursive types are decidable.

4.1

Overview

An in�nite amount of conditions is impossible to check algorithmically. Therefore, we must�nd alternative formulations for rule S���� that are algorithmic for implementations. As wewill show in Chapter 5, a suitable formulation with iso-recursive Amber rules is equivalent toour declarative speci�cation. Thus, the Amber rules can, in principle, serve as a foundation
for an implementation. However, there are reasons to seek for alternative algorithmic rules.
Most importantly, as we have argued in Chapter 2.1.4, the Amber rules are hard to work within proofs and metatheory. Therefore, to provide a detailed account of the metatheory for isorecursive subtyping we propose alternative algorithmic de�nitions for subtyping of recursive
types. The new formulations of subtyping have important advantages over the Amber rules:
the new rules are more modular; they do not require re�exivity to be built-in; and transitivity
and various other lemmas are easier to prove. Furthermore, in Chapter 5, we prove that the newrules are also sound and complete with respect to the declarative speci�cation of iso-recursive
subtyping and the Amber rules.

40

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

4.1.1

Double unfoldings

It turns out that we only need to check 1-time and 2-times �nite unfoldings to obtain an algorithmic formulation that is sound, complete and decidable with respect to the declarative
formulation of subtyping. We can informally explain why 1-time and 2-times �nite unfoldings are enough by looking again at the counter-example in Chapter 2.1.1. The 2-times �nite
unfolding for the example is:a ` (a ! nat) ! nat  (a ! >) ! >When a recursive type variable in a negative position is unfolded twice, the types in the corresponding positive positions (i.e. the nat and >) will now appear in both negative and positive

positions. In turn, the subtyping relation now has to check both that nat  > (which is valid),and >  nat (which is invalid). Thus, the 2-times �nite unfolding fails. In general, more �nite
unfoldings (3-times, 4-times, etc.) will only repeat the same checks that are done by the 1-timeand 2-times �nite unfolding, thus not contributing anything new to the subtyping check. Thus,
the rule that we employ in the algorithmic formulation is the so-called double unfolding rule:S�������

G, a ` A  B

G, a ` [a 7! A] A  [a 7! B] B

G ` µa. A  µa. B

With this rule one may wonder if we can just check the 2-times �nite unfolding (and do
not do the 1-time �nite unfolding check). Unfortunately this would lead to an unsound rule,as the following counter-example illustrates:µa. nat ! a 6 µa. nat ! nat ! >This statement should fail because it violates the unfolding lemma:
nat ! (µa. nat ! a) 6 nat ! nat ! >But the 2-times �nite unfolding for this example (nat ! nat ! a  nat ! nat ! >)is a valid subtyping statement! By checking only the 2-times �nite unfolding, the subtyping
statement is wrongly accepted. We must also check the 1-time �nite unfolding (nat ! a 6nat ! nat ! >), which fails and is the reason why the double unfolding rule rejects thisexample.

4.1.2

The spurious subtyping problem

The double unfolding rule is interesting because it directly relates to the declarative formulation using �nite unfoldings. However, the double unfolding rules have exponential timecomplexity due to the two premises for both (1-time and 2-times) �nite unfoldings. At �rst,
the 1-time �nite unfolding appears unnecessary, since the 2-times unfolding seems to do all
the checks of the 1-time �nite unfolding. Unfortunately, as our previous counter-example has

41

4.1. Overview

shown, the 1-time �nite unfolding check cannot be avoided, due to some spurious subtypingthat exists when using only the 2-times �nite unfolding.
Type unsoundness with 2-times unfolding only

Some reader might ask if we can accept

the subtyping rule with 2-times �nite unfoldings only, like
G, a ` [a 7! A] A  [a 7! B] B
G ` µa. A  µa. B
As we have seen in Chapter 4.1.1, such a rule does not necessarily satisfy the unfolding lemma.
Unfortunately there is a more serious problem with the rule: it is not type sound.
For convenience, let’s denote A := µa. nat ! a and B := µa. nat ! nat ! >. Assume

that A  B holds, but nat ! A is not subtype of nat ! nat ! > (the unfolding lemma fails).
Then assume that we have the expression:e = fix( x : A). (fold [ A] (ly : nat. x ))Although the calculi we present do not include �xpoints, those can be easily added (thecalculus in Chapter 7 has �xpoints), with the rules:De�nition 13. The typing rule for �xpoint is:����������

G, x : A ` e : A

G ` fix x : A. e : A

De�nition 14. The reduction rule for �xpoint is:�������������

fix x : A. e ,! [ x 7! (fix x : A. e)] e

Now, consider such an expression (unfold [ B] e). Firstly, we show that it can be typechecked:
x : A ` ly : nat. x : nat ! A�����������
x : A ` fold [ A] (ly : nat. x ) : AAB����������
x : A ` fold [ A] (ly : nat. x ) : B
����������
` fix( x : A). (fold [ A] (ly : nat. x )) : B`e:B�������������
` unfold [ B] e : nat ! nat ! >Next, we show that (unfold [ B] e) can reduce to (unfold [ B] (fold [ A] (ly : nat. e))):�������������

fix( x : A). (fold [ A] (ly : nat. x ))fold [ A] (ly : nat. e)�����������
unfold [ B] e
unfold [ B] (fold [ A] (ly : nat. e))and then can reduce to (ly : nat. e):
unfold [ B] (fold [ A] (ly : nat. e))ly : nat. e��������

42

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

If the preservation theorem holds, we wish that (ly : nat. e) also has same type as(unfold [ B] e). However, the type of (ly : nat. e) isn’t nat ! nat ! >. Thus, the preservation
theorem is false.

4.1.3

Nominal unfolding

The double unfolding rule is costly. In an implementation, there are potentially some approaches to avoid the cost of the extra 1-time �nite unfolding check. For example, we canstore the result of 1-time �nite unfolding during subtype checking, and reuse that result as
part of subtype checking of the double unfoldings. This would avoid recomputation and leadto a more e�cient algorithm. However, it would be nicer to address this issue of the double
unfoldings in the formalism itself.
For avoiding the 1-time �nite unfolding in the double unfolding rule, we propose a variantof the rule. Having understood the nature of the spurious subtyping problem that appeared inour counter-example using only 2-times �nite unfoldings, the key idea to solve the problem issimple. We need to track the substituted types during double unfoldings to avoid accidental
subtyping. Our approach is to add an extra fresh label to exposure the substitution in the 2times �nite unfolding. This regulates the structure of the derivation tree. Formally, our nominal
unfolding rule is:S���������

G, a ` [a 7! Aa ] A  [a 7! Ba ] BG ` µa. A  µa. B

The nominal unfolding rules use labelled types Aa , to ensure that we only compare types
that arise from unfolding substitutions with related unfolded types. Labelled types are a syntactic devise used to prevent accepting subtyping statements such as µa. nat ! a  µa. nat !

nat ! >, which would be unsound in an iso-recursive formulation. They also provide a distinct nominal identity to the recursive types being compared, so that they cannot be comparedwith other unrelated recursive types. Note that, in the rule S��������, we have reused therecursive variable name for the label a. However, we used the red color to distinguish the label
and type variable names. Labels a should be the same in both substitutions, and distinct fromany other labels and bound variables used elsewhere. Since in the paper presentation we use
a nominal approach to represent binders, the label a should be interpreted as some uniquefreshly generated name1 .
Compared to the double unfolding rule, our nominal unfolding rule only has one subtyping check. More importantly, it avoids the spurious subtyping problem. In our new nominal unfolding rule, we do not need the extra check for the 1-time �nite unfolding (checking
G, a ` A  B). The derivation tree below re�ects the change for our simpler counter-exampleof the double unfolding rule (without the extra 1-time �nite unfolding check):

1 In our Coq formalization we use a locally nameless representation [11], which distinguishes free and bound variables naturally. With a locally nameless representation we can reuse the free variable name a for the label a.

43

4.2. Double Unfoldings
nat  nat
(nat ! a)a  nat ! > (fails!)
nat ! (nat ! a)a  nat ! nat ! >µa. nat ! a  µa. nat ! nat ! >The presence of the extra label means that we now get (nat ! a)a  nat ! > (whichfails) instead of nat ! a  nat ! > (which succeeds). In other words, the presence ofthe nominal label avoids the need for the extra 1-time �nite unfolding check to rule out thecounter-example.

4.2

Double Unfoldings

In this section, we present a variant of the calculus introduced in Chapter 3. The key di�erence is that instead of using the declarative rule for recursive subtyping, we employ a rulewith double unfoldings. Our formalization includes syntax, well-formedness, subtyping andcorresponding theorems.

4.2.1

Syntax, well-formedness and subtyping

The syntax and well-formedness of the double unfoldings share the same de�nitions as thedeclarative system presented in Chapter 3.2.
Well-Formedness

In the algorithmic version, we use G ` A to represent that A is well-formed. The rules of G ` A are the same as the top of Figure 3.3. Similarly to Chapter 3.2,

we de�ne an alternative variant of well-formedness with the rule ��������� to give us better
induction principles for the proofs.
De�nition 15. Rule ��������� is de�ned as:���������

G, a ` A

SubtypingG, a ` [a 7! A] A

G ` µa. A

Figure 4.1 shows the algorithmic subtyping judgment. All the rules, except the

one for recursive types, remain the same as the declarative system. In algorithmic subtyping,rule SA���� states that two recursive types are subtypes when: 1) their bodies are subtypes;
and 2) unfolding the bodies one additional time preserves subtyping. In other words, checking
1-time and 2-times �nite unfoldings rather than all �nite unfoldings is su�cient.

4.2.2

Re�exivity, transitivity and completenessOur algorithmic subtyping simply relaxes the condition for recursive types while keeping the
judgment form. Therefore, regularity, re�exivity and transitivity are easy to prove using similar
techniques to those used in the declarative system.
Lemma 16. Regularity: If G ` a A  B then ` G and G ` A and G ` B.

44

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

G `a A  B(Algorithmic Subtyping)SA����

SA������

SA����

SA����

`G
G `a nat  nat`GG`A
G `a A  >G `a B1  A1
G `a A2  B2
G `a A1 ! A2  B1 ! B2

SA����

G, a `a A  B`Ga2G
G `a a  a

G, a `a [a 7! A] A  [a 7! B] B
G `a µa. A  µa. B

Figure 4.1: Algorithmic subtyping.
Theorem 17. Re�exivity.
If ` G and G ` A then G ` a A  A.
Theorem 18. Transitivity.
If G ` a A  B and G ` a B  C then G ` a A  C.
Proof. Because G ` a A  B, we know that type B is well-formed by Lemma 16. Then proceed
by induction on G ` B.

Note that, like the declarative system (and unlike the Amber rules), the transitivity proof isvery simple with the double unfolding rule. The completeness of algorithmic subtyping is
obvious, since the declarative system has the same conditions of the algorithmic system (plusa few more).
Theorem 19. Completeness of algorithmic subtyping.
If G ` A  B then G ` a A  B.
Proof. By induction on G ` A  B. Then for recursive case, we know that for all n, thesubtyping relation is holds after unfolding n times. Choosing n = 1 and n = 2, we know thatthe two premises of algorithmic recursive subtyping are satis�ed.

4.3

The Soundness Theorem

The real challenge is the soundness of the algorithmic speci�cation with respect to the declarative system. For soundness, we wish to prove that:
If G ` a A  B then G ` A  B.
The key problem is to show that �nitely unfolding only one and two times is su�cient toguarantee that all �nite unfoldings are sound. Although it is easy to give an informal argument

45

4.3. The Soundness Theorem

as to why this is the case, as we did in Chapter 4.1, formalizing this argument is a wholedi�erent matter.

4.3.1

Finding the right generalization for soundness

The key idea to prove that 1-time and 2-times �nite unfolding implies n-times �nite unfolding
is to capture this informal idea formally as a lemma:G ` A  B ^ G ` [a 7! A] A  [a 7! B] B)

G ` [a 7! A]n A  [a 7! B]n B.

As we shall see this lemma is true but, unfortunately, it cannot be proved directly. The
obvious attempt would be to do induction on G ` A  B. The essential problem with suchan approach is that we wish to analyze the di�erent subcases for A and B, but we still want to
use the original A and B in the substitutions. For instance, suppose that we have A := nat !

A1 ! A2 and B := nat ! B1 ! B2 . Here A1 ! A2 and B1 ! B2 are contained in the type
A and B. Now consider the case for function types G ` A1 ! A2  B1 ! B2 , which would

occur as a subcase in the proof. What we would like to have is the conclusionG ` [a 7! A]n ( A1 ! A2 )  [a 7! B]n ( B1 ! B2 )However, what we get instead isG ` [a 7! ( A1 ! A2 )]n ( A1 ! A2 )  [a 7! ( B1 ! B2 )]n ( B1 ! B2 )In other words, what gets substituted are not the original types A and B, but only a part ofthose types (A1 ! A2 and B1 ! B2 ) that is being considered by the current case. Therefore,

it is clear that we need some generalization of this lemma. A �rst idea is to generalize it asfollows:)

G ` A  B ^ G ` C  D ^ G ` [a 7! C ] A  [a 7! D ] B
G ` [a 7! C ]n A  [a 7! D ]n B.

Now it is possible to do induction on G ` A  B without a�ecting the substituted types.
However, this lemma is false. A counter-example is:G ` > ! a  nat ! a ^ G ` a ! nat  a ! >^ G ` > ! a ! nat  nat ! a ! >6) G ` > ! (a ! nat) ! nat  nat ! (a ! >) ! >.
In this counter-example we choose n = 2. All the premises are satis�ed, but the conclusion
is false. Note that in the conclusion, because of the contravariance of function subtyping, we
eventually require that G ` a ! >  a ! nat, which is clearly false.

By further analyzing the counter-example, we can see that the in�uence of contravari-ance on variables is not re�ected in such a lemma. Therefore, our generalized soundness lemma

46

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

should deal with type variables at contravariant positions and covariant positions respectively,
but under the same pattern. In other words we need a pair of lemmas: one to deal with covariance, and another to deal with contravariance.

4.3.2

The generalized lemma

Learning from the lessons of the failed attempts at soundness we reach to the following lemma,
which holds:
Lemma 20. If,
1. G ` A  B;

2. G ` C  D;

3. G ` [a 7! C ]n C  [a 7! D ]n D.

then

1. G ` [a 7! C ] A  [a 7! D ] B implies G ` [a 7! C ]n+1 A  [a 7! D ]n+1 B and
2. G ` [a 7! D ] A  [a 7! C ] B implies G ` [a 7! D ]n+1 A  [a 7! C ]n+1 B.
Proof. By induction on G ` A  B.

• Case rule S����: In such case A = B = b. If b 6= a, we prove the goal trivially.
Otherwise,? Goal (1): We want to prove G ` [a 7! C ]n C  [a 7! D ]n D, which can beobtained from premise (3).
? Goal (2), We have premises G ` C  D by premise (2) and G ` D  C from thecondition of goal (2), thus C = D by Lemma 21. Goal (2) is proven by re�exivity.
• Case rule S������: In such case A = A1 ! A2 and B = B1 ! B2 .

? Goal (1):

We need to prove G ` [a 7! C ]n+1 ( A1 ! A2 )  [a 7! D ]n+1 ( B1 ! B2 ),which can be rewritten as G ` ([a 7! C ]n+1 A1 ) ! ([a 7! C ]n+1 A2 )  ([a 7!
D ]n+1 B1 ) ! ([a 7! D ]n+1 B2 ). By construction, we need to prove G ` [a 7!

D ]n+1 B1  [a 7! C ]n+1 A1 and G ` [a 7! C ]n+1 A2  [a 7! D ]n+1 B2 . The

former one can be proved by using the induction hypothesis arising from goal (2),while the latter one can be proved by using the induction hypothesis arising fromgoal (1).

? Goal (2):We need to prove G ` [a 7! D ]n+1 ( A1 ! A2 )  [a 7! C ]n+1 ( B1 ! B2 ),which can be rewritten as G ` ([a 7! D ]n+1 A1 ) ! ([a 7! D ]n+1 A2 )  ([a 7!
C ]n+1 B1 ) ! ([a 7! C ]n+1 B2 ). By construction, we need to prove G ` [a 7!

C ]n+1 B1  [a 7! D ]n+1 A1 and G ` [a 7! D ]n+1 A2  [a 7! C ]n+1 B2 . The

47

4.3. The Soundness Theorem

former one can be proved by using the induction hypothesis arising from goal (1),while the latter one can be proved by using the induction hypothesis arising fromgoal (2).
• Case rule S����: Now we assume A = µa0 . A0 and B = µa0 . B0 . Since in such case,

we do not need to consider the contravariance, we will just show how to prove goal (1).
Goal (2) can be proved using the same approach.
– The condition arising from the goal (1) becomes G ` [a 7! C ] µa0 . A  [a 7!
D ] µa0 . B. After inversion, we get 8n0 , G ` [a0 7! A0 ]n [a 7! C ] A0  [a0 7!
0

B0 ]n [a 7! D ] B0 , which can be rewritten as 8n0 , G ` [a 7! C ][a0 7! A0 ]n A0 
00

[a 7! D ][a0 7! B0 ]n B0 .
0

– The goal now is G ` [a 7! C ]n+1 µa0 . A0  [a 7! D ]n+1 µa0 . B0 , which can be
rewritten as G ` µa0 . [a 7! C ]n+1 A0  µa0 . [a 7! D ]n+1 B0 .

– Applying rule S���� on the goal, we get 8n0 , G, a0 ` [a0 7! A0 ]n [a 7! C ]n+1 A0 
0

[a0 7! B ] [a 7! D ]n+1 B0 , which can be rewritten as 8n0 , G, a0 ` [a 7!
00
C ] n +1 [ a 0 7 ! A 0 ] n A 0  [ a 7 ! D ] n +1 [ a 0 7 ! B 0 ] n B 0 .
0 n0– Finally, we apply the induction hypothesis, to prove goal (1).

Compared with our last failed attempt, there is an extra condition (condition 3). More
importantly, there are now two conclusions. These conclusions basically express two di�erent
lemmas. One lemma, with all the conditions and conclusion (1), and another lemma with allconditions and conclusion (2). Conclusion (1) covers covariant uses of the lemma, whereas
conclusion (2) covers contravariant uses of the lemma. Note that when we apply the lemmain our soundness theorem, we have that A = C and B = D. Those types will then becomedi�erent as the subcases of type A and B are processed. For covariant cases, A is a portion of
the type C, and B is a portion of the type D. Conclusion (1) covers this, and we can see that
we are substituting C in A and D in B. However, the contravariance of function types will
�ip the input types being checked for subtyping. This means that in e�ect, A is now a portionof D (in a contravariant position in D) and B is a portion of C (in a contravariant position in
C). Goal (2) captures such nuance and provides a formulation for the lemma that deals with
subparts of C and D, which are in contravariant positions.
The proof of Lemma 20 relies on the following property of the subtyping relation:
Lemma 21. Antisymmetry of declarative subtyping: If G ` A  B and G ` B  A thenA = B.

Also, from Lemma 20, we now can prove:
Lemma 22. If G ` A  B and G ` [a 7! A] A  [a 7! B] B, then 8n, G ` [a 7! A]n A [a 7! B]n B.

48

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

Proof. Do induction on n. For the base case, we simply apply the premise (1). For the induction
case, we apply Lemma 20 with C = A and D = B, then apply induction hypothesis.
The form of Lemma 22 is close to the shape of the in�nite unfolding rule (rule S����) forrecursive types. Finally, we can prove the soundness theorem:
Theorem 23. Soundness of algorithmic subtyping.
If G ` a A  B then G ` A  B.

4.4

The Unfolding Lemma for the Double Unfolding Rules

In Chapter 3.3.3, we showed how to prove the unfolding lemma for the declarative system.
It turns out that the unfolding lemma can also be proved relatively easily for the algorithmic
system using a technique similar to that employed in the proof of soundness in Chapter 4.3.
A direct proof of the unfolding lemma is useful for language designers wishing to skip thedeclarative system, and formulate only an algorithmic version.
Lemma 20 provides an interesting (and necessary) lemma for proving soundness between
double and �nite unfoldings. For that lemma a key insight is that we need two forms: onefor dealing with contravariant cases, and another to deal with covariant cases. Inspired bythis insight, we are able to prove the unfolding lemma directly for the double unfolding rules,
using a similar technique. Firstly we need a lemma similar to Lemma 21, but for the algorithmic
relation:
Lemma 24. Antisymmetry of algorithmic subtyping: If G ` a A  B and G ` a B  A thenA = B.

Then we can formulate the generalized lemma that is needed to prove the unfolding lemma as
follows:
Lemma 25. If
1. G1 , a, G2 , ` a A  B;

2. G1 , a, G2 , ` a C  D;

3. G1 , G2 ` a µa. C  µa. D;then

1. G1 , a, G2 ` a [a 7! C ] A  [a 7! D ] B implies G1 , G2 ` a [a 7! µa. C ] A  [a 7!
µa. D ] B and2. G1 , a, G2 ` a [a 7! D ] A  [a 7! C ] B implies G1 , G2 ` a [a 7! µa. D ] A  [a 7!
µa. C ] B.

4.4. The Unfolding Lemma for the Double Unfolding Rules

49

Proof. Note that premise (2) can be obtained by inversion of premise (3). We explicitly show
it here just for convenience. The whole proof follows a similar structure to Lemma 20: weproceed by induction on G1 , a, G2 ` a A  B.

• Case rule SA����: In such case A = B = b. If b 6= a, we simply achieve the goal.
Otherwise,? Goal (1): We want to prove G1 , G2 ` a µa. C  µa. D, which is actually premise(3).
? Goal (2): From the condition of goal (2), we have G1 , a, G2 , ` a D  C, which is theinverse of premise (2). Thus, we get C = D by Lemma 24. Goal (2) is proven byre�exivity.
• Case rule SA������: In such case A = A1 ! A2 and B = B1 ! B2 .

? Goal (1):

We need to prove G1 , G2 ` a [a 7! µa. C ] ( A1 ! A2 )  [a 7! µa. D ] ( B1 !

B2 ), which can be rewritten as G1 , G2 ` a ([a 7! µa. C ] A1 ) ! ([a 7!

µa. C ] A2 )  ([a 7! µa. D ] B1 ) ! ([a 7! µa. D ] B2 ).

By construction, we need to prove G1 , G2 ` a [a 7! µa. D ] B1  [a 7!
µa. C ] A1 and G1 , G2 ` a [a 7! µa. C ] A2  [a 7! µa. D ] B2 .

The former one can be proved by using induction hypothesis arising from goal(2), while the latter one can be proved by using induction hypothesis arisingfrom goal (1).

? Goal (2):We need to prove G1 , G2 ` a [a 7! µa. D ] ( A1 ! A2 )  [a 7! µa. C ] ( B1 !

B2 ), which can be rewritten as G1 , G2 ` a ([a 7! µa. D ] A1 ) ! ([a 7!

µa. D ] A2 )  ([a 7! µa. C ] B1 ) ! ([a 7! µa. C ] B2 ).

By construction, we need to prove G1 , G2 ` a [a 7! µa. C ] B1  [a 7!
µa. D ] A1 and G1 , G2 ` a [a 7! µa. D ] A2  [a 7! µa. C ] B2 .

The former one can be proved by using induction hypothesis arising from goal(1), while the latter one can be proved by using induction hypothesis arisingfrom goal (2).
• Case rule SA����: Now we assume A = µa0 . A0 and B = µa0 . B0 . Since in such case,

we do not need to consider the contravariance, we will just show how to prove goal (1).
Goal (2) can be proven with the same approach.
– The goal now is G1 , G2 ` a [a 7! µa. C ] µa0 . A0  [a 7! µa. D ] µa0 . B0 , which
can be rewritten as G1 , G2 ` a µa0 . [a 7! µa. C ] A0  µa0 . [a 7! µa. D ] B0 .

50

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping– The condition arising from the goal (1) becomes G1 , a, G2 ` a [a 7! C ] µa0 . A0 

[a 7! D ] µa0 . B0 , which can be rewritten as G1 , a, G2 ` a µa0 . [a 7! C ] A0 
µa0 . [a 7! D ] B0 .

– Do inversion on this condition and reorder the context and substitution, we get two
new conditions: G1 , a, G2 , a0 ` a [a 7! C ] A0  [a 7! D ] B0 and G1 , a, G2 , a0 ` a[a 7! C ][a0 7! A0 ] A0  [a 7! D ][a0 7! B0 ] B0 .

– Because of the double unfolding rule, we will have two induction hypotheses,
which are? I.H.(1), which comes from 1-time unfolding : G1 , a, G2 , ` a C  D ) G1 , G2 ` aµa. C  µa. D ) G1 , a, G2 , a0 ` a [a 7! C ] A0  [a 7! D ] B0 )G1 , G2 , a0 ` a [a 7! µa. C ] A0  [a 7! µa. D ] B0 .

? I.H.(2), which comes from 2-times unfolding : G1 , a, G2 , ` a C  D ) G1 , G2 ` aµa. C  µa. D ) G1 , a, G2 , a0 ` a [a 7! C ][a0 7! A0 ] A0  [a 7! D ][a0 7!
B0 ] B0 ) G1 , G2 , a0 ` a [a 7! µa. C ][a0 7! A0 ] A0  [a 7! µa. D ][a0 7!
B0 ] B0 .

– Apply construction on the goal, we obtain two sub-goals: G1 , G2 , a0 ` a [a 7!
µa. C ] A0  [a 7! µa. D ] B0 and G1 , G2 , a0 ` a [a0 7! A0 ][a 7! µa. C ] A0 

[a0 7! B0 ][a 7! µa. D ] B0 .

– For the former one, we apply the I.H.(1). As for the latter one, after rewriting thegoal to G1 , G2 , a0 ` a [a 7! µa. C ][a0 7! A0 ] A0  [a 7! µa. D ][a0 7! B0 ] B0 , weapply the I.H.(2).

Like Lemma 20, in Lemma 25 the two conclusions are basically re�ecting two lemmas: onefor covariant uses (when A is a part of C and B is a part of D), and another for contravariant
uses (when A is a part of D and B is a part of C). By letting C := A, D := B, we easily obtain:
Lemma 26. Unfolding Lemma.
If G ` a µa. A  µa. B then G ` a [a 7! µa. A] A  [a 7! µa. B] B.

4.5

Nominal Unfolding

In this section, we will describe the nominal unfolding rule, which is another algorithmic variant equivalent to declarative subtyping. Compared with the double unfolding rules, nominal
unfoldings have better e�ciency (since only one premise is needed), while eliminating spurious subtyping derivations that arise with double unfoldings (see example in Chapter 4.1). As
in the previous section, we present a variant of the calculus in Chapter 3, but this time using
the nominal unfolding rules instead.

51

4.5. Nominal Unfolding

4.5.1

Syntax and well-formedness

The syntax of contexts for this calculus is the same as Chapter 3.2. For the syntax of types,
based on the syntax in Chapter 3.2, we extend it with labelled types Aa . Labelled types can beviewed as a simple form of nominal types. They are essentially a pair that contains a name (ortype variable) a and a type.
The well-formedness G ` A is also de�ned as Chapter 3.2, but for recursive types andlabelled types (the top of Figure 4.2). To get a better induction hypothesis, we slightly modify
the form of well-formed recursive types, as rule ����������� shows. As before, rule ����������� is proven to be equivalent to rule �������. The �rst premise G, a ` A might appear
redundant at �rst glance, but it is indeed necessary, because from the second premise G, a `[a 7! Aa ] A, we cannot derive G, a ` A, which is the insurance with respect to the correctnessof substitution during the proof. Meanwhile, since we introduce labelled types, as rule ���������� shows, a labelled type is well-formed if its inner type is well-formed.

4.5.2

Subtyping

The bottom of Figure 4.2 shows the de�nition of subtyping with the nominal unfolding rule.
We denote subtyping for nominal unfoldings as G `n A  B. Rules SN����, SN����, SN����,and SN������ are the same as the corresponding double unfolding subtyping rules. Rule SN���� is new, stating that a labelled type is a subtype of another labelled type if the two types
are labelled with the same name and A  B.

Rule SN����, the nominal unfolding rule, is the most interesting one. This rule follows

an idea quite similar to the double unfolding rule. The body of the recursive type is unfolded
twice. However, for the innermost unfolding, the type that we substitute is not the type of the
body directly. Instead, we use a labelled type, where the label has a fresh name, and the typethat is labelled is the body of the recursive type. In other words, instead of using the double
unfolding [a 7! A] A we use [a 7! Aa ] A. The label is crucial to avoid spurious subtyping

derivations, and it is also the reason why in the nominal unfolding formulation we do notneed to check the subtyping of single unfoldings as well. In the double unfolding rule, there
is an extra premise that checks the single unfolding and prevents certain cases of spurious
subtyping. The absence of this extra premise also makes some of the metatheory simpler.

4.5.3

Basic properties

All the proofs about re�exivity, transitivity and unfolding lemma for nominal unfoldings arealmost the same as double unfoldings, since both subtyping rules are based on two times �nite unfoldings. We list all the theorems here and skip the details (the reader can consult ourmechanized proofs for full details).
Theorem 27. Re�exivity.
If ` G and G ` A then G `n A  A.

52

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

G`A(Well-Formed Type, Selected Rules)����������

�����������G`A
G ` AaG, a ` A

G, a ` [a 7! Aa ] AG ` µa. A

G `n A  B(Nominal Subtyping)SN����

SN����

SN����`G
G `n nat  nat`GG`A
G `n A  >SN������

G `n B1  A1
G `n A2  B2
G `n A1 ! A2  B1 ! B2

`GG`a
G `n a  aSN����

G `n A  B
G ` n Aa  Ba

SN����

G, a `n [a 7! Aa ] A  [a 7! Ba ] BG `n µa. A  µa. B

Figure 4.2: Well-formedness and subtyping rules for nominal unfoldings.
Theorem 28. Transitivity.
If G `n A  B and G `n B  C then G `n A  C.
Lemma 29. Unfolding Lemma.
If G `n µa. A  µa. B then G `n [a 7! µa. A] A  [a 7! µa. B] B.
Another important property is that, from the nominal unfolding rules, we can derive 1time �nite unfoldings. This lemma is important to show that nominal unfoldings subsume thedouble unfolding rule:Lemma 30. If G, a `n [a 7! Aa ] A  [a 7! Ba ] B then G, a `n A  B.

4.5.4

Equivalence between nominal unfoldings and double unfoldings

The subtyping relation presented in Chapter 4.5 is equivalent to a subtyping relation that uses
the double unfolding rules for recursive types. This equivalence is not surprising, since nominal unfoldings are essentially the double unfolding rule with an extra label and without the
1-time �nite unfolding premise. Lemma 30 and some other similar auxiliary lemmas are used
to formulate the equivalence between the two encodings. The most interesting aspect of theequivalence proof is that we need to translate types for the nominal unfolding formulation
into types of the double-unfolding formulation. Such a translation is necessary because nominal unfoldings require labelled types, which do not exist in the double unfolding formulation.
Thus, the translation simply erases the labels.

53

4.6. DecidabilityDe�nition 31. The erase (&) function is de�ned as:
nat&

>&
a&
( A ! B)&(µa. A)&
Aa&

=
=
=
=
=
=

nat

>
a
A& ! B&µa. A&A&

With the erasure function we can conclude that our nominal unfoldings are equivalent todouble unfoldings with the following two lemmas:
Theorem 32. If G `n A  B then G ` a A&  B& .
Theorem 33. If G ` a A  B then G `n A  B.

For Theorem 32 we wish to show that all valid subtyping statements using nominal unfoldings
are also valid under the double unfolding formulation. To show this result we have to apply
the erasure function to the types, since the types in the nominal unfolding formulation may
contain labels. For Theorem 33 no erasure function is necessary since the types in the double
unfolding formulation are a subset of those in the nominal unfolding formulation. Thus, they
can be directly mapped. As a consequence of the two theorems above, our nominal unfoldings
are also sound and complete with respect to our speci�cation using �nite unfoldings.
Corollary 34. If G `n A  B then G ` A&  B& .
Corollary 35. If G ` A  B then G `n A  B.

4.6

Decidability

Our subtyping rules are decidable. We have already proved the equivalence between the rules
employing nominal, double and �nite unfoldings. Since both the nominal and the double unfolding rules are syntax directed, they provide a useful foundation to prove decidability. We
have proved decidability based on our nominal rule and a measure that is based on the depthof the unfolded tree. A similar proof should be possible using the double unfolding rule, exceptthat with the double unfolding rule there is some extra work because of the extra 1-time �nite
unfolding premise.
Our subtyping rules are based on substitution, which can increase the size of types after
an unfolding. Therefore, a straightforward induction on the size of types will not work. A �rst
idea may be doing induction lexicographically on a pair with the number of nesting of recursive binders, and the size of types. The logic is that, after a nominal unfolding, the recursive
binder that we are going to unfold will not reappear again. However, this does not quite work
because the bodies of recursive types can contain other recursive types and the substitutions
may introduce new copies of those recursive types. Thus, the subtyping rule for recursive
types does not necessarily reduce the number of recursive binders. Consider, for instance, thefollowing example:µa. µb. a ! b

54

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

After the nominal unfolding and a-conversion, the type will become:µb. (µb0 . a ! b0 )a ! b
which does not decrease the number of recursive binders. Nevertheless, if we continue toprocess the types using nominal unfolding, we will �nally reach a type without any recursive
binders. After a few more steps in the subtyping derivation, we obtain:(µb0 . a ! b0 )a ! ((µb0 . a ! b0 )a ! b) b
and the inner recursive types µb0 . a ! b0 no longer contain recursive types in their bodies, andwe will �nally obtain types free of recursive types after another round of nominal unfolding.

4.6.1

Measure based on the depth of the unfolded tree

To provide a measure that decreases at every nominal unfolding, we de�ne a function basedon the depth of the expanded tree of a type. This function essentially simulates the unfolding
process of the tree using nominal unfoldings and allow us to obtain an (over-)approximationof the depth of the (fully) unfolded tree.
De�nition 36. The height of a type A in a context Y (Y := · | Y, a 7! i, where i represents
a natural number), written heightY ( A), is de�ned as follows:
heightY (nat)=heightY (>)=
heightY ( A1 ! A2 ) =heightY ( Aa )=heightY (a)=heightY (a)=heightY (µa. A)=

00max (heightY ( A1 ), heightY ( A2 )) + 1
heightY ( A) + 1
Y(a)(a 2 Y)0(a 62 Y)
let i = heightY, a7!0 ( A) in heightY, a7!i+1 ( A) + 1

The two interesting cases in the height function are for recursive variables and recursive types.
For a recursive variable, if it can be found in the context, we retrieve the corresponding heightassociated with the recursive variable from the context, whereas we return 0 if a is not in thecontext. Note that, when performing subtyping on two closed types (which is always the casein the subsumption rule) the latter case never happens. However, to make height total we haveto consider this case too, and therefore our height function applies even to types which are
not well-formed. For a recursive type, we �rstly compute the height of its body by assumingthat the height of its binder is 0. In other words i is the height of the 1-time �nite unfolding.
Then we compute the height of the body again, but this time assuming that the height of its
binder is i + 1 (i.e. the size of the 1-time unfolding plus 1). This basically computes the overall
height of the nominal unfolding. Since we compute the height two times for a recursive type,our height function is convex: its second derivative with respect to the number of recursive
types is non-negative thus a linear over-approximation is impossible.

55

4.7. Discussion

Finally, the measure of a type A is de�ned as height( A), which is the height of expanded
tree when the context Y is empty.

4.6.2

The decidability proof

With the new measure, now we can prove the decidability lemma. For a non-recursive type, it
is obvious that the height of a conclusion from any inputs is strictly greater than the height of
its any premises. For a recursive type, the measure will decrease by 1 after a nominal unfolding.
In other words, what we want to show isheight(µa. A)

1 = heighta7!heighta7!0 ( A)+1 ( A) = height([a 7! Aa ] A).

Firstly, it is easy to observe that heighta7!0 ( A) = height( A), because for a variable, it

is either found at the context, which is Y(a) = 0, or not found at the context, which will
return 0. Then, when we try to compute height([a 7! Aa ] A), since a is substituted by Aa

and a is not in the context, the formula can be rewritten as heighta7!height( Aa ) ( A), in which

we do not try to proceed with the substitution, but just return the result from the context. We
can continue to rewrite this formula as heighta7!height( A)+1 ( A). Through heighta7!0 ( A) =height( A), the formula is equal to heighta7!heighta7!0 ( A)+1 ( A). Therefore, we have proven our

proposition. Next we can prove that this measure su�ces to show the termination of subtyping
with nominal unfoldings:
Lemma 37. If max (height( A), height( B))  k, then G `n A  B or not G `n A  B.
Proof. Do induction on k, A and B, respectively.
Let k = max (height( A), height( B)), we obtain:
Theorem 38. Termination:
For any inputs G, A and B, we either have G `n A  B or not G `n A  B.

Finally, from termination and the soundness and completeness of subtyping based on nominal unfoldings with respect to subtyping based on �nite unfoldings we can conclude that our
speci�cation of iso-recursive subtyping is decidable.
Corollary 39. Decidability: Our speci�cation for iso-recursive subtyping is decidable.
As a �nal note, although we use height as measure here, we can also use weight as measure, which is no essentially di�erence. In other words, instead of a maximum function forfunction case, an addition function is also feasible. In later chapters, we will show an alternative by employing weight measure, demonstrating that our technique is very standard.

4.7

Discussion

As we shall see, both the double and the nominal unfolding rules are easy to work with in terms
of proofs and metatheory, and the nominal unfolding rules can even simplify some proofs due

56

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

to the single premise. The double unfolding rule is directly inspired by the �nite unfolding
speci�cation. The nominal unfolding rule additionally employs the idea of tracking the recursive type variable as a label to avoid spurious subtyping that arises from double unfoldings.
Therefore, it can avoid the extra 1-time �nite unfolding check. In the nominal unfolding rule
it is interesting to observe that the names of recursive type variables play an important role,
just as in the Amber rules. However, in the Amber rules, we use distinct type variable names
and track the subtyping relation between those variables. In the nominal unfolding rule we
use the same type variable name, which is su�cient to identify types that originate from the
double unfolding substitutions. Therefore, spurious subtyping when using only double unfoldings can be avoided in the nominal unfolding rule. We will have a more discussion on spurious
subtyping problem in Chapter 6.

4.7.1

Some �nal implementation considerations

The double unfolding and nominal unfolding rules are primarily designed with the goal ofleading to a simple metatheory and proofs. Both rules employ substitutions which, if useddirectly in an implementation, have signi�cant performance penalties. To avoid substitutions
one possibility would be to adopt explicit substitutions [2], which are a standard solution to
avoid the performance penalties associated with substitutions. Another possibility would beto adopt some ideas in the implementation approach proposed by Ligatti et al. [84]. Although
Ligatti et al. [84]’s rules have di�erent expressive power compared to the Amber rules andour rules, they also employ substitutions. They present an optimized O(mn) algorithm thatavoids the use of substitutions, and we believe that it should be possible to adopt some ofthose ideas to implement double/nominal unfoldings. Finally, a simple optimization for both
double and nominal unfoldings is to avoid substitutions in positive positions. As Chapter 2.1.1
discusses for covariant subtyping using G ` A  B in the premise of the recursive subtyping
rule is sound. Thus, we should not need to substitute recursive type variables that are found inpositive positions, which avoids extra subtype checks of the substituted types. In other words,
we could have the variant (here for nominal unfoldings):
G, a ` [a 7! Aa ]+ A  [a 7! Ba ]+ B
S-fnominal+G ` µa. A  µa. B
The idea is to employ a polarized form of substitution [a 7! A]m B, which is parametrized

by a positive (+) or negative ( ) mode m. This form of substitution would only perform
substitutions at negative occurrences of type variables. Thus, the special case of covariant
subtyping would behave equivalently to the rule presented in Chapter 2.1.1. We leave thedevelopment and proof of correctness for an e�cient algorithm for future work.

4.8

Mechanized Proofs

The folder coq_theory includes all the Coq proofs about algorithmic iso-recursive subtyping inthis chapter, namely double unfolding rules and nominal unfolding rules.

57

4.8. Mechanized Proofs
Table 4.1: Paper-to-proofs correspondence guide in Chapter 4.
De�nition
Well-formed Type (De�nition
15)
Well-formed Type (Figure 4.2)
Double Unfolding Rule (Figure 4.1)
Nominal Unfolding Rule (Figure 4.2)

File
Rules.v

Name in Coq
WF E A

Notation
G`A

NominalUnfolding.v
Rules.v

Nominal.WFS E A
sub E A B

G`A
G `a A  B

NominalUnfolding.v

Nominal.Sub E A B

G `n A  B

Table 4.2: Descriptions for the proof scripts in Chapter 4.
Theorems
Theorem 17
Theorem 18
Theorem 19
Theorem 23
Lemma 26
Theorem 27
Theorem 28
Lemma 29
Theorem 32
Theorem 33
Corollary 34
Corollary 35
Theorem 38

4.8.1

Description
Re�exivity (Double)
Transitivity (Double)
Completeness (Double)
Soundness (Double)
Unfolding
Lemma(Double)Re�exivity (Nominal)
Transitivity (Nominal)
Unfolding
Lemma(Nominal)
Nominal to Double
Double to Nominal
Soundness (Nominal)
Completeness (Nominal)
Decidability

Files
FiniteUnfolding.v
FiniteUnfolding.v
FiniteUnfolding.v

Name in Coq
re�_algotrans_algo
completenessDoubleUnfolding.v
DoubleUnfolding.v

soundness
unfolding_lemma_version2

NominalUnfolding.v
NominalUnfolding.v

Nominal.sub_re�
Nominal.Transitivity

NominalUnfolding.v

Nominal.unfolding_lemma

NominalUnfolding.v
NominalUnfolding.v
NominalUnfolding.v
NominalUnfolding.v

nominal_to_double
double_to_nominal
nominal_to_�nite
�nite_to_nominal

Decidability.v

decidabilityDe�nitions

All the de�nitions in the Chapter 4 can be found in �les Rules.v and NominalUnfolding.v. Table
4.1 shows the correspondence of de�nitions between the paper and the Coq artifacts. The �leRules.v contains the de�nitions for the double unfoldings. It has de�nitions of well-formedness,
subtyping, typing, and reduction. The �le NominalUnfolding.v contains the de�nitions involving nominal unfoldings.
Note that, in the rule rule SN����, we have reused the recursive variable name for the labela. However, the labels and type variable names should be considered distinct. Labels a shouldbe the same in both substitutions, and distinct from any other labels and bound variables used
elsewhere.

4.8.2

Lemmas and theorems

Table 4.2 shows the descriptions for all the proof scripts in Chapter 4. For succinctness, webrie�y describe the important lemmas and theorems.

58

Chapter 4. Algorithmic Subtyping for Iso-Recursive Subtyping

Lemma 25 in paper:If
1. G1 , a, G2 ` a A  B;
2. G1 , a, G2 ` a C  D;
3. G1 , G2 ` a µa. C  µa. D;then
1. G1 , a, G2 ` a [a 7! C ] A  [a 7! D ] B
implies G1 , G2 ` a [a 7! µa. C ] A [a 7! µa. D ] B and2. G1 , a, G2 ` a [a 7! D ] A  [a 7! C ] B
implies G1 , G2 ` a [a 7! µa. D ] A [a 7! µa. C ] B.

Lemma 25 in Coq:If

1. G1 , a, G2 ` a A  B;
2. G1 , G2 ` a µa. C  µa. D;
3. G1 , a, G2 ` a [a 7! C m D ] A  [a 7! D
C] B
then
G1 , G2 ` a [a 7! µa. C m D ] A  [a 7! µa. D
C]BFigure 4.3: Comparison between paper and Coq statements for Lemma 25.

An important di�erence between some of the lemma statements in the paper and the Coq
proofs is that we make more use of modes in Coq. This change is done for readability purposes.
In particular, all variants of the unfolding lemma in the paper are presented without modes in
the paper. Figure 4.3 illustrates the di�erence between the formulations with and withoutmodes for the unfolding lemma (note that the premise (2) is redundant since it is the inversionof the premise (3), thus in the Coq code we drop this premise while in the paper presentation
we keep it for readability). Our Coq formalization uses some meta-functions on modes instead
to formalize the same result. Using meta-functions on modes (De�nition 40), the same lemma
would look like the right part of Figure 4.3.
De�nition 40. Mode selector.
C

+D=C

C

D=D

In the Coq proof, we also de�ned some special notations for de�nitions representing ntimes �nite unfolding, and for the meta-functions on modes. Those de�nitions can be foundin the �le Rules.v.
Another important di�erence is in the decidability proof. Unlike the paper proof, wherein the context we store the variable names as keys, in the Coq proof we employ De Bruijn
indices to represent all recursive variables stored in the context.

m

m

59

Chapter 5

Weakly Positive Subtyping
In addition to the Amber rules and the �nite and the rules based on double unfoldings, we will
give another equivalent formulation of subtyping based on a weakly positive restriction of recursive variables. This variant captures precisely a folklore observation that the Amber rules
express two situations where a recursive variable can be a subtype of another type: positive
subtyping and re�exivity. This variant, presented as part of Chapter 5, is used as an intermediate step to prove the equivalence between the Amber rules and a formulation using double
unfolding.

5.1

Subtyping Based on a Weakly Positive Restriction

In this chapter we will show a variant of the Amber rules that is equivalent, in terms of expressive power, to our new formulation of subtyping based on �nite unfoldings. We provethe equivalence via soundness and completeness theorems between the two formulations ofsubtyping. The soundness lemma implies that if two types are subtypes under the Amber
rules, they are subtypes under our new formulation. The completeness lemma implies that if
two types are subtypes under our new formulation, they are subtypes under the Amber rules.
With both lemmas we can conclude that our formulation and the Amber rules have the same
expressiveness.
To prove the soundness and completeness with respect to a formulation based on �nite
unfoldings we create an intermediate subtyping relation to make the proof easier. This intermediate relation, presented in Figure 5.1, is equivalent to the Amber rules in Figure 5.2. The key
idea in this relation is to have a rule for recursive types (rule P��R������), which only accepts
weakly positive subtyping. This formulation is inspired by the existing positive formulationof subtyping for recursive types [5, 10, 12], but it is more general.
In essence, what we mean by weakly positive subtyping is that we can never �nd a contravariant subderivation a  a, where a is a recursive type variable, for non-equal recursive
types. For instance this excludes µa.a ! nat  µa.a ! >, since here a is used contravariantly, and a  a would appear as a subderivation. Notice, however, that weakly positive

subtyping still allows subtyping of recursive types with negative occurrences of the recursivetype variable in two cases:

60

Chapter 5. Weakly Positive Subtyping

a 2m A  B(Weakly Positive Restriction)P���������

P����������

P����������

a 2m nat  nat

a 2m A  >a 2m >  A

P�����������

P�������������

b 6 2 f v (A)b 2m µa. A  µa. A

a 6= ba 2m b  b

a 2+ a  aP���������

b 2m A  B
a 2+ A  B
b 2m µa. A  µa. B

G ` A + B
P��R������

P����������

P����������

a 2m B1  A1
a 2m A2  B2
a 2m A1 ! A2  B1 ! B2

a 6= b(Weakly Positive Subtyping)`GG ` nat + nat

P��R������`GG`A
G ` A + >P��R��������

G ` B1 + A1
G ` A2 + B2
G ` A1 ! A2 + B1 ! B2

P��R������

`Ga2G
G ` a + aP��R������

G, a ` A + B
a 2+ A  B
G ` µa. A + µa. B

P��R�������`GG ` µa. A
G ` µa. A + µa. A

Figure 5.1: Weakly positive subtyping rules.
• Equal types: If the recursive types are equal, then weakly positive subtyping still considers the two types to be subtypes. For instance µa.a ! nat  µa.a ! nat, is a valid
subtyping statement.
• The recursive type variable is a subtype of >: If a recursive type variable appears

negatively, but the only (negative) subderivations are of the form a  >, then that isallowed in weakly positive subtyping. For instance µa.> ! a  µa.a ! a is a valid
weakly positive subtyping statement.

These two exceptions are why we use the term “weakly” to characterize such formulation ofsubtyping. In contrast, existing formulations of positive subtyping, such as that described in
Chapter 2.1.1 or originally described by Amadio and Cardelli [5] do not make such exceptions
and would reject the subtyping statements that we have described above.

5.1.1

Well-formedness and weakly positive relation

Well-formed types are the same as in Figure 3.3. To examine whether a type variable occurs
positively in a subtyping relation, we de�ne a weakly positive restriction relation a 2m A  B

at the top of Figure 5.1. Here, a 2m A  B means that: type variable a occurs in the derivation

5.1. Subtyping Based on a Weakly Positive Restriction

61

A  B with a mode m, where a mode m is either positive (+) or negative (-)1 . This relation

checks that every instance of a  a in the proof derivation of A  B is found in a positive
position inside the proof (rule P�������). Moreover, for every subderivation of A  B withshape µb. A0  µb. B0 either 1) A0 = B0 and a is not free in A0 (rule P�������������), or 2)
b 2+ A0  B0 (rule P���������).

For example, a 2+ > ! a  a ! a holds, since the only instance of a  a occurs

positively and there are no recursive types inside, so the second condition does not apply. To
see the need for the second condition, consider:b 2+ µa. a ! b  µa. a ! b
which might seem to hold according to the syntax, since b appears only in positive positions.
However, it is rejected by both rule P��������� and rule P�������������. Rule P���������
requires that a also appears positively in subderivations, which does not hold in this example.
The reason we pose such restriction is because, for instance, unfolding both types results inthe following judgment
b 2+ (µa. a ! b) ! b  (µa. a ! b) ! b
where a negative occurrence of b  b would appear in a subderivation. A similar issue happens whenever a  a appears negatively and the recursive types are not equal to each other.

There are also some noteworthy points in the other rules for the weakly positive restric-tion relation. In rule P�����������, for the contravariant types, we switch their mode by a
�ip operation m: + == +. Rule P���������� states that if a is not equal to b, we
do not care what the mode for b is. Rule P����������, at �rst glance, looks suspicious, since
it seems to indicate that >  A is valid. In this rule the choice of notation for the relation,using , may be a little misleading. Although normally we follow the derivation of the subtyping relation, the mode is determined by the position and not by whether the two types are
subtypes. The addition of rule P���������� is not harmful: the relation is always accompanied by weakly positive subtyping derivations, and >  A never occurs in such subtyping
derivations. The reason to include rule P���������� is that we wish that our weakly positive
restriction relation is symmetric: if a 2m A  B then a 2m B  A. This symmetry property
is important for the proof of Lemma 50.

5.1.2

and

Subtyping

Most subtyping rules are identical to those of the Amber rules, and the only di�erences arerule P��R������, rule P��R������ and rule P��R�������. The rule P��R������ is similar to ourformulations, checking whether two variables are same. The latter two rules state that: 1) two
recursive types are subtypes if they are equal (rule P��R�������); or 2) the recursive variablesatis�es the weakly positive restriction and the two bodies are subtypes (rule P��R������).
1 Note that 2

m is just part of the syntax of the relation, rather than a separate operator.

62

Chapter 5. Weakly Positive Subtyping

5.1.3

Basic properties

The re�exivity is straightforward since we have explicit re�exivity built-in for recursive types.
Theorem 41. Re�exivity.
If ` G and G ` A then G ` A + A.
As for transitivity, because we have the weakly positive restriction for recursive subtyping, the proof is a bit complex. We need to prove an auxiliary lemma in advance:
Lemma 42. If
1. G ` A + B;
2. G ` B + C;

3. a 2m A  B;
4. a 2m B  C,

then G ` A + C and a 2m A  C.
Proof. Induction on G ` B.
Then we can have the transitivity theorem.
Theorem 43. Transitivity.
If G ` A + B and G ` B + C then G ` A + C.
Proof. Induction on G ` B. For the recursive case, apply lemma 42, we have all premises.
Finally, it is also possible to prove the unfolding lemma for weakly positive subtyping:
Lemma 44. Unfolding Lemma.
If G ` µa. A + µa. B then G ` [a 7! µa. A] A + [a 7! µa. B] B.
The proof employs similar techniques to those used for the soundness lemma (Lemma 52). We
skip the details here.

5.2

The Formalization of Amber Rules

In the following sections, we are going to show all the equivalence theorems. However, there
is still a challenge: how to de�ne iso-recursive Amber rules formally. In the original Amber rules by Amadio and Cardelli [5] (Figure 2.1) there are no well-formedness constraints.
Unfortunately, de�ning such well-formedness constraints is not entirely trivial. Furthermore,

63

5.2. The Formalization of Amber Rules

for those interested in mechanical formalization using theorem provers (as we are), such details need to be spelled out clearly. Well-formedness usually plays an important role in themetatheory, since some proofs can be more easily proved by considering well-formed types
and environments only. One typical property of subtyping that we may hope to have is theso-called regularity of subtyping:
If G ` A  B then ` G ^ G ` A ^ G ` B.

which states that if a subtyping statement is valid then the context and types are well-formed.
Regularity is typically used in many other proofs, such as the proof of transitivity in algorithmic
formulations. Note that, in the Amber rules, the rule for recursive types uses two distinct typevariables a and b in the recursive types. The use of such distinct type variables is a crucial
feature of the Amber rules and is used to prevent subderivations of the form G ` b  a, where
G only contains a  b but not b  a. Otherwise, if such subderivations would be accepted,
type soundness would be broken.
With the Amber rules an intuitive idea is that the subtyping environment consists of asequence of pairs of type variables a  b and that the a’s are in scope on the type at theleft-side of the subtyping relation (A), while the b’s are in scope in the type at the right-sideof the subtyping relation (B). Sadly, this idea is not that simple to realise. Note that in thesubtyping rule of function types (rule A����������), the input arguments are swapped, so
without any changes in the environment the type variables in the types would go out-of scope,and this breaks the regularity lemma. Furthermore, trying to perhaps swap the variables in theenvironment to keep them in-scope changes the meaning of the environment (a  b becomesb  a). Trying to ensure that the a’s are only in scope in one side of the relation, while the b’s

are only in scope in the other side, turns out to be quite tricky. Therefore, to make progress, we
propose a weaker restriction in this section: we allow both a’s and b’s to be in scope for bothtypes. Thus, the following subtyping statement is valid with our variant of the Amber rules:a  b ` a ! b  >. In other words, we accept some subtyping statements that one would

perhaps expect to be ill-formed or rejected. That is, in the Amber rules, if we have a  b inG, we would not expect that a and b appear in the same type. Rather we would expect thatthe a appears in one of the types, and b in the other one. However, accepting such subtyping
statements is not harmful: we can still prove the soundness and completeness of this variant
with respect to our new formulation of subtyping.

5.2.1

Well-formed environment and types

In the Amber rules, the subtyping context stores pairs of distinct type variables. We use:
D := · | D, a  b
to denote the context for Amber rules. Figure 5.2 shows a set of standard Amber rules with abuilt-in re�exivity rule.
A well-formed environment ( ` D) requires that all pairs of variables (a  b) in the en-

vironment D are distinct. Well-formed types are almost standard, except that both a and b are

64

Chapter 5. Weakly Positive Subtyping

D`A(Well-Formed Type of Amber Rules)

WFA��������

WFA�����T��

`D
D ` nat`D
D`>WFA���������

`D

WFA����������

D ` A1
D ` A2
D ` A1 ! A2

WFA���������

ab2D
D`a

`D

WFA��������

D, a  b ` A
b is freshD ` µa. A

D ` amb A  B
A��������

`DD ` amb nat  nat

ab2D
D`b

(Amber Rules)A��������`DD`A
D ` amb A  >A��������

`Dab2D
D ` amb a  bA��������

A����������

D ` amb B1  A1
D ` amb A2  B2
D ` amb A1 ! A2  B1 ! B2

D, a  b ` amb A  B
D ` amb µa. A  µb. B

A���������`DD ` µa. A
D ` amb µa. A  µa. A

Figure 5.2: A variant of the Amber rules, including well-formedness of types.
considered declared by a pair (a  b) in the context (rule WFA��������� and rule WFA���������), and rule WFA�������� introduces a pair of fresh variables into the context, although thesecond variable is never used. Rule WFA�������� simply mimics the left-hand side derivationof rule A�������� of the Amber subtyping relation, as we shall see next. With our de�nitionof well-formed types regularity is easy to obtain:
Lemma 45. Regularity: If D ` amb A  B then ` D and D ` A and D ` B.

5.2.2

Subtyping

The subtyping relation is almost the same as the original rules by Amadio and Cardelli [5]in Figure 2.1. The noticeable di�erence is the addition of various well-formedness checks invarious rules. For instance, base cases such as rule A�������� and rule A�������� check
whether the environments are well-formed. Moreover, in rule A��������� we require therecursive type to be well-formed (D ` µa. A).

5.3

From the Amber Rules to the Speci�cation

To prove the soundness theorem with respect to our new speci�cation of iso-recursive subtyping, we need to prove that Amber subtyping is sound with respect to weakly positive subtyping
and the double unfolding rules.

5.3.1

From the Amber rules to weakly positive subtyping

The �rst step is to translate the environments and types used in the Amber formulation, since
they have di�erent forms.

65

5.3. From the Amber Rules to the Speci�cationDe�nition 46. Translation of environments and types from the Amber rules.

|·| = ·

|D, a  b| = |D|, a(·)( A) = A(D, a  b)( A) = (D)([ b 7! a] A)

The translation functions, | · | and (·)( A), simply drop every second variable de�ned in

the context D. For example, a subtyping judgment in the Amber system a  b ` a ! > b ! > is translated to a ` a ! >  a ! >.

Before showing the relationship between the Amber subtyping and our subtyping withthe positive restriction, we must prove an important auxiliary lemma:
Lemma 47. If D ` amb A  B and (a  b) 2 D, then

1. a 62 f v( B) and b 62 f v( A) implies a 2+ (D)( A)  (D)( B) and2. a 62 f v( A) and b 62 f v( B) implies a 2 (D)( A)  (D)( B).

Proof. Do induction on D ` amb A  B.

• Rule A��������: In such case A = a0 and B = b0 .

? Goal (1): If a 6= a0 , we achieve the goal (recall that a 2m a0  a0 always holds
for any mode m). Otherwise, we know that a = a0 . Since (a  b) 2 D, the goal
becomes a 2+ a  a.
? Goal (2): a 62 f v( A) implies a 6= a0 .

• Rule A��������: Assume A = µa0 . A0 and B = µb0 . B0 , then the goal becomes a 2m

(D)(µa0 . A0 )  (D)(µb0 . B0 ) (m is + and , respectively, for two goals), which can be
rewritten as a 2m µa0 . (D)( A0 )  µb0 . (D)( B0 ).
The induction hypotheses becomes:

1. (a  b) 2 D, (a0  b0 ) ) a 62 f v( B0 ) ) b 62 f v( A0 ) ) a 2+ (D)( A0 ) (D)( B0 ) and

2. (a  b) 2 D, (a0  b0 ) ) a 62 f v( A0 ) ) b 62 f v( B0 ) ) a 2(D)( B0 ).

(D)( A0 ) ? For goal (1): we apply rule P���������, then we need to check if a0 2+ (D)( A0 ) (D)( B0 ) and a 2+ (D)( A0 )  (D)( B0 ). Both cases can be solved by applying
induction hypothesis (1).
? For goal (2): we apply rule P���������, then we need to check if a0 2 (D)( A0 ) (D)( B0 ) and a 2+ (D)( A0 )  (D)( B0 ). For the former one we apply induction
hypothesis (2), and for the latter one we apply induction hypothesis (1).
• Rule A���������: Assume A = B = µa0 . A0 . From the condition of the goal, we knowthat a 62 f v( A0 ) always holds, thus a 2m (D)( A)  (D)( B) is true for any mode m.

66

Chapter 5. Weakly Positive Subtyping
With the help of Lemma 47, we can prove that if two types are subtypes under the Amber

rules, they are also subtypes under weakly positive subtyping:
Theorem 48. If D ` amb A  B then |D| ` (D)( A) + (D)( B).
Proof. Do induction on D ` amb A  B. We show only the more interesting case for recursive
types.

• Rule A��������: Assume A = µa0 . A0 and B = µb0 . B0 . The goal becomes |D| `(D)(µa0 . A0 )  (D)(µb0 . B0 ), which can be rewritten as |D| ` µa0 . (D)( A0 ) µb0 . (D)( B0 ). Apply rule P��R������, the �rst premise |D, a  b| ` (D)( A0 ) (D)( B0 ) can be solved by induction hypothesis. Since we know D, a0  b0 ` amb A0 
B0 , we apply Lemma 47 to it. By obtaining a0 2+ (D)( A0 )  (D)( B0 ), we can solve thesecond premise.

5.3.2

From weakly positive subtyping to double unfoldings

We are now one step away from the soundness theorem: to prove that the weakly positive subtyping implies double unfolding subtyping. The main di�erence is on rule P��R������, whichcorresponds to rule SA���� in the double unfolding subtyping. The proof requires the following lemma which reveals an important property to prove that the weakly positive subtyping
implies double unfolding subtyping:
Lemma 49. If a 2m A  B and b 2+ A  B then a 2m [ b 7! A] A  [ b 7! B] B.

This lemma tells us that the positive restriction respects the mode on non-negative substitutions.
The proof of Lemma 49, as other substitution lemmas we have showed before, requires
a generalization. Such a generalization is a bit tricky, since we allow equal types in the positive restriction. For readers interested in the details of the generalization, we refer to ourmechanized proof.
This lemma is important because it shows that, with Lemma 49 proved, we can derive
the following lemma, which relates weakly positive subtyping to our algorithmic subtyping
relation in the double unfolding form:
Lemma 50. If G ` a A  B and G ` a C  D, then

1. a 2+ A  B implies G ` a [a 7! C ] A  [a 7! D ] B and2. a 2B  A implies G ` a [a 7! D ] A  [a 7! C ] B.

Proof. Do induction on G ` a A  B. We only show how to prove the function case.
• Rule SA������: Assume A = A1 ! A2 and B = B1 ! B2 .

? Goal (1):67

5.3. From the Amber Rules to the Speci�cation∗ The goal becomes G ` a [a 7! C ] ( A1 ! A2 )  [a 7! D ] ( B1 ! B2 ),which can be rewritten as G ` a ([a 7! C ] A1 ) ! ([a 7! C ] A2 )  ([a 7!
D ] B1 ) ! ([a 7! D ] B2 ).

∗ The condition from Goal (1) becomes a 2+ A1 ! A2  B1 ! B2 . By
inversion, we obtain a 2

B1  A1 and a 2+ A2  B2 .

∗ Apply the constructor on the goal, we need to prove: G ` a [a 7! D ] B1 

[a 7! C ] A1 and G ` a [a 7! C ] A2  [a 7! D ] B2 .

∗ For the latter one, we apply the induction hypothesis (1).
∗ For the former one, we apply the induction hypothesis (2). However, we needto prove a 2
so from a 2? Goal (2):A1  B1 . Recall that the positive restriction is commutative,

B1  A1 we can prove a 2

A1  B1 .

∗ The goal becomes G ` a [a 7! D ] ( A1 ! A2 )  [a 7! C ] ( B1 ! B2 ),which can be rewritten as G ` a ([a 7! D ] A1 ) ! ([a 7! D ] A2 )  ([a 7!
C ] B1 ) ! ([a 7! C ] B2 ).

∗ The condition from Goal (1) becomes a 2

inversion, we obtain a 2+ A1  B1 and a 2

B1 ! B2  A1 ! A2 . By
B2  A2 .

∗ Apply the constructor on the goal, we need to prove: G ` a [a 7! C ] B1 

[a 7! D ] A1 and G ` a [a 7! D ] A2  [a 7! C ] B2 .

∗ For the latter one, we apply the induction hypothesis (2).
∗ For the former one, we apply the induction hypothesis (1). However, we needto prove a 2+ B1  A1 . Because the positive restriction is commutative, froma 2+ A1  B1 we can prove a 2+ B1  A1 .

Corollary 51. If a 2+ A  B and G ` a A  B then G ` a [a 7! A] A  [a 7! B] B.

With the Corollary 51, the relation between positive restriction and the algorithmic double

unfolding subtyping is easy to establish:
Theorem 52. If G ` A + B then G ` a A  B.

5.3.3

The soundness theorem

Combining Lemmas 23, 48 and 52, we have
Corollary 53. Soundness of the Amber rules with respect to declarative formulation.
If D ` amb A  B then |D| ` (D)( A)  (D)( B).

68

Chapter 5. Weakly Positive Subtyping

5.4

From the Speci�cation to the Amber Rules

The completeness theorem with respect to our new speci�cation of iso-recursive subtyping,to some degree, is more di�cult than soundness theorem. Because the Amber rules are more
complex in terms of shape than the double unfolding rule, more cases need to be discussed
when we do induction on a simpler formulation.

5.4.1

From double unfoldings to weakly positive subtyping

Firstly, let us consider how to convert the double unfolding rule to weakly positive subtyping.
The double unfolding rule and weakly positive subtyping share the same context, which means
the only source of di�erence comes from the treatment of recursive types. For weakly positive
subtyping, the following inversion lemma is useful:Lemma 54. If G ` A + B and G ` C + D, then

1. G ` [a 7! C ] A + [a 7! D ] B implies a 2+ A  B or C = D;
2. G ` [a 7! D ] A + [a 7! C ] B implies a 2

A  B or C = D.

This lemma states that if after substitution the subtyping relation is preserved, then either

C and D are equal; or the type variable respects the weakly positive restriction.
Now we can prove that weakly positive subtyping is complete with respect to the double
unfolding formulation.
Theorem 55.
If G ` a A  B then G ` A + B.
Proof. Induction on G ` a A  B. All cases are straightforward except when A is µa. A0 and

B is µa. B0 . By induction hypothesis, we know that G ` A0 + B0 . By applying lemma 54

with A := A0 , B := B0 , C := A0 , D := B0 , and mode +, we get that either a 2+ A0  B0 or

A0 = B0 . For the former case, we apply constructor rule P��R������. For the latter case, weapply re�exivity.

5.4.2

Form weakly positive subtyping to the Amber rules

The translation from weakly positive subtyping to the Amber rules is quite tricky due to thedi�erent shapes of the contexts. To illustrate the di�culty consider the following subtyping
statement using weakly positive subtyping:G, a ` > ! a + nat ! awhere the environment binds the type variable a. For proving the subtyping relationship, we
need to prove:
G, a ` a + a

69

5.4. From the Speci�cation to the Amber Rules
G ` A + B B P(Position Allocation)���������

��������

· ` A + B B ·a 2m A  B
G ` A + B B P
G, a ` A + B B P, m

Figure 5.3: Position allocation for weakly positive subtyping.
However, if we want to prove the same statement using the Amber rules, we need to change
the relationship to:D, a  b ` amb > ! a  nat ! b
andD, a  b ` amb a  b
Note that, in weakly positive subtyping, we only need to store the free variables in the environment, while in the Amber rules, we have more variables and store the subtyping relationshipbetween those variables as well.
The recipe of the conversion is to �rst generate a bundle of variables and match them toexisting variables. Then we determine the mode for each variable in weakly positive subtyping,which helps us to allocate every pair of generated variables. After converting the context andtypes to the form of Amber rules, we prove that they preserve the subtyping relationship underthe Amber rules.
As a second example, assume that we want to convert the following judgment into an
Amber judgmenta, b ` b ! a + b ! awe �rst generate new variables a0 , b0 and assume the subtyping relations a  a0 , b  b0 .
Then we examine the positivity of both variables and �nd out that these relations holda 2+ b ! a  b ! a and b 2

b!ab!aIn the next step, we substitute the variables in the typing judgment, according to the mode andlocation. If the variable is in the left-hand side and occurs positively, or right-hand side andoccurs negatively, we keep the variable as it is. Otherwise, we substitute the variable with its
corresponding one (a 7! a0 and b 7! b0 ). After these steps, the �nal result becomes a normal
Amber judgment, which has the same meaning of the initial judgment:a  a0 , b  b0 ` amb b0 ! a  b ! a0
We prove that this subtyping relation holds under the Amber rules.
Position Allocation

As Figure 5.3 shows, we de�ne a relation that relates each variable to amode. The mode in P has a one-to-one correspondence to the variables in G in the same order.

70

Chapter 5. Weakly Positive Subtyping

The de�nition of P is
P := · | P, + | P,
Note that it is not necessarily the case that P is unique. For example, a variable that neveroccurs can be accepted by both modes, therefore its corresponding element in P can be anymode.
De�nition 56. Generation of a bundle of fresh variables.

hGi := {(a  b) | 8a 2 G, b is fresh}
After we have a list of pairs of variables (denoted as hGi) and the mode for each variable,

we design a function that converts the types according to our information. Note that hGi hassame form as the contexts in the Amber setting.

De�nition 57. We design a function convert(D, P, A, m) for converting types from weakly
positive subtyping setting to the Amber setting, which takes four inputs: a context for Amber
formulation, a stack of modes, a type A and a mode. This function returns the converted typeas output. Note that the P is computed as Figure 5.3 shown, thus its length is equal to thelength of D.
8
>
>
A
>
<
convert(D, P, A, m) = convert(D0 , P0 , [a 7! b] A, m)>>>:convert(D0 , P0 , A, m)

If D and P are empty.
If D = D0 , a  b and P = P0 , m
If D = D0 , a  b and P = P0 , m

We can now state the completeness theorem with De�nition 57, where the subtyping

relation of weakly positive subtyping preserves under the Amber rules.
Theorem 58. Completeness of the Amber rules: If G ` A + B and G ` A + B B P,
denoted hGi as D, thenD ` amb convert(D, P, A,)  convert(D, P, B, +).

For simplicity, we skip the procedure of the proof for this theorem. Theorem 58 has a very
long mechanized proof in the thesis, which relies on plenty of auxiliary lemmas distinguishingwhether two recursive types are equal carefully.
The theorem involves some manipulation of the context and types, due to the inconsistency of contexts between our system and the Amber rules. However, it is very easy to obtaina simple form of corollary where the contexts are empty:
Corollary 59.
If · ` A + B then · ` amb A  B.
The statement is less general than Theorem 58, but it does reveal that the programmer
cannot distinguish between our algorithm and the Amber one, since in the subsumption rule,5.5. The Equivalence among All Formulations

71

the subtyping judgment always starts with an empty subtyping context. That is, type variablesin the double unfolding formulations, and subtyping relations between type variables in theAmber formulations are only introduced by the subtyping relation, and not by the typing relation. The only information that should be in the context during the subsumption rule is thetype information for variables.

5.4.3

The completeness theorem

Combining Lemma 19, Lemma 55 and Lemma 59, we have:
Corollary 60. Completeness of the Amber rules with respect to declarative formulation.
If · ` A  B then · ` amb A  B.

5.5

The Equivalence among All Formulations

So far, we have proven all directions of each equivalence. With the equivalence theorems,
transitivity and unfolding lemma for our formulations (Lemmas 60, 53, 6 and 8), we can claim
the Amber rules are transitive and satisfy the unfolding lemma.
Corollary 61. Transitivity of the Amber rules.
If · ` amb A  B and · ` amb B  C then · ` amb A  C.
Corollary 62. Unfolding lemma for the Amber rules.
If · ` amb µa. A  µa. B then · ` amb [a 7! µa. A] A  [a 7! µa. B] B.
Notably, for transitivity, it is interesting to observe that transitivity holds under an empty
environment. In Chapter 2.1.4, we discussed the issues with transitivity and showed a counterexample. That counter-example does not apply to our transitivity lemma because it uses nonempty environments. Therefore, a possible “�x” to the declarative formulation in Figure 5.2 isto restrict the transitivity rule to use only empty environments.
Finally, Table 5.1 and Figure 5.4 summarize some key lemmas and theorems until thischapter. In particular, it shows that all �ve formulations of subtyping presented in Chapter 3,
4 and 5 are equivalent in terms of expressive power.

5.6

Mechanized Proofs

The folder coq_theory includes all the Coq proofs about the weakly positive subtyping, a variantof Amber rules, and all equivalence shown in this chapter.

72

Chapter 5. Weakly Positive Subtyping
Table 5.1: The equivalence theorems in Part II.
Amber Rules
Finite Unfolding
Double Unfolding
Nominal Unfolding
Weakly Positive SubtypingRe�exivity
Built-in
Theorem 5
Theorem 17
Theorem 27
Theorem 41

Corollary 34
Finite Unfolding(Speci�cation)
G`AB(Figure 3.3)
Corollary 53

Transitivity
Corollary 61
Theorem 6
Theorem 18
Theorem 28
Theorem 43

Corollary 35

Amber Rules
D ` amb A  B(Figure 5.2)

Nominal Unfolding
G `n A  B(Figure 4.2)
Theorem 33

Theorem 23

Theorem 48
Theorem 59

Theorem 32

Double Unfolding
G `a A  B(Figure 4.1)

Theorem 19

Corollary 60

Unfolding Lemma
Corollary 62
Lemma 8
Lemma 26
Lemma 29
Lemma 44

Theorem 52

Theorem 55

Weakly Positive Subtyping
G ` A + B
(Figure 5.1)

Figure 5.4: A diagram with the soundness and completeness lemmas in this work.

5.6.1

De�nitions

All the de�nitions in the Chapter 5 can be found in �le AmberBase.v. Table 5.2 shows thecorrespondence of de�nitions between the paper and the Coq artifacts. The �le AmberBase.v,
contains the de�nitions for the Amber rules and the intermediate subtyping relation based ona weakly positive restriction presented in this chapter.

5.6.2

Lemmas and theorems

Table 5.3 shows the descriptions for all the proof scripts in Chapter 5. For succinctness, webrie�y describe the important lemmas and theorems.

5.6.3

Alternative weakly positive subtyping

During the proof of completeness of Amber rules, we found that the built-in re�exivity inthe weakly positive subtyping disturbs the computation of position allocation for recursive
types. Thus, in the mechanized proof, we use an alternative (De�nition 63) for weakly positive
subtyping to compute the mode more precisely: the default positive mode for equal recursive
types.
The key idea is to unify rule P��R������� and rule P��R������ into one rule, then we“hide” the problematic re�exivity subtly by rule P��R���������:73

5.6. Mechanized Proofs
Table 5.2: Paper-to-proofs correspondence guide in Chapter 5.
De�nition
Well-formed Type (Figure 5.2)
Amber Rules (Figure 5.2)
Weakly Positive Restriction (Figure 5.1)
Weakly Positive Subtyping (Figure 5.1)
Weakly Positive Subtyping (De�nition 63)

FileAmberBase.v
AmberBase.v
AmberBase.v

Name in Coq
wf_amber E A
sub_amber E A B
posvar m X A B

NotationD`A
D ` amb A  B
a 2m A  B

PositiveBase.v

wk_sub E A B

G ` A + B

AmberBase.v

sub_amber2 E A B

G `u A + B

Table 5.3: Descriptions for the proof scripts in Chapter 5.
Theorems
Theorem 41
Theorem 43
Lemma 44
Theorem 48
Theorem 52
Corollary 53
Theorem 55
Theorem 59
Corollary 60
Corollary 61
Corollary 62

Description
Re�exivity (Positive)
Transitivity (Positive)
Unfolding
Lemma(Positive)
Amber to Positive
Positive to Double
Soundness (Amber)
Double to Positive
Positive to Amber
Completeness (Amber)
Transitivity (Amber)
Unfolding
Lemma(Amber)Files
AmberBase.v
PositiveBase.v
PositiveBase.v

Name in Coq
sub_amber2_re�
sub_amber2_transunfolding_for_pos

AmberBase.v
AmberSoundness.v
AmberSoundness.v
PositiveSubtyping.v
AmberCompleteness.v
AmberCompleteness.v

sub_amber_to_amber_2
sub_amber_2_to_sub
amber_soundness2
sub_to_amber2
amber_complete_aux
amber_complete2

AmberCompleteness.v
AmberCompleteness.v

amber_transitivity
amber_unfoldingDe�nition 63. An alternative rule for checking if two recursive types are subtypes in weakly
positive subtyping:P��R���������

G, a ` A + B

b is freshb 2+ µa. A  µa. BG ` µa. A + µa. B

Denoting G `u A + B as the weakly positive subtyping with the alternative rule P��R���

������ for recursive types, we show that it has same expressiveness as the original de�nitionof weakly positive subtyping (Figure 5.1):
Lemma 64. The two representations of weakly positive subtyping are equivalent:G `u A + B , G ` A + B.
Proof. We actually need to prove both directions:• ()): Induction on G `u A + B.

– Rule P��R���������: Assume A = µa. A0 and B = µa. B.

74

Chapter 5. Weakly Positive Subtyping∗ We know G, a `u A0 + B0 , and from hypothesis induction, we can derive
G, a ` A0 + B0 .

∗ Among the conditions we also know b 2+ µa. A0  µa. B0 . Do inversion on
it, we get two sub-cases:· Rule P���������: we have the condition a 2+ A0  B0 , thus we apply
rule P��R������.

· Rule P�������������: the goal becomes G ` µa. A0 + µa. B0 . Apply
rule P��R�������.

• ((): Induction on G ` A + B.

– Rule P��R������: Assume A = µa. A0 and B = µa. B0 .
∗ We know G, a ` A0 + B0 , and from hypothesis induction, we can derive
G, a `u A0 + B0 .

∗ We also know a 2+ A0  B0 . Our goal now is b 2+ µa. A0  µa. B0 .

∗ Apply constructor rule P������������, then the �rst premise b 2+ A0  B0
is always held because b is fresh. The second premise is a 2+ A0  B0 .

– Rule P��R�������: Apply Theorem 41.

5.6.4

Variable generation

Another di�culty worth mentioning is generating a bundle of variables in De�nition 56. Suchde�nition actually does two things: (1) generate a set of fresh variables; (2) match every fresh
variable with an existing variable. This is a bit involved in Coq.
File AmberCompleteness.v gives the details showing how to solve this issue. We iterateeach variable (denote as a) in context G, generate a fresh variable b and store both variables.
One possibility is that the name of a might be used in previous stored set of variables. In thatcase, we generate one more fresh variable and store it. After that, we have a set of mixed
variables containing all variables in context G and the number of new fresh variables is thesame as the size of context G. All the variables in the set are distinct. Then we �lter variables
that belong to G and match them with variables in G one by one. Finally, we have a valid hGi,
as De�nition 56 describes.

75Part III

Extensions

77

Chapter 6

Non-Antisymmetric Subtyping
So far we considered calculi where the subtyping relation is antisymmetric. For instance, forthe calculus presented in Chapter 3 and 4, Lemmas 21 and 24 hold. Both the Amber rules
and the new rules proposed by us work well for antisymmetric subtyping relations. However,as explained in Chapter 2.1.4, applying the Amber rules in subtyping relations that are notantisymmetric is non-trivial due to the built-in re�exivity rule. The purpose of this section is
to show that, unlike the Amber rules, the double/nominal unfolding rules can be easily applied
to subtyping relations that are not antisymmetric. In this chapter we show the type soundness
for two extensions of the calculus in Chapter 4. One is with records and records types, and theother one is with intersection types. Both type systems lead to a subtyping relation that is notantisymmetric. An important �nding in this chapter is that, for the system with intersection
types, the double unfolding and nominal unfolding rules are not equivalent. For subtyping
with intersection types the nominal unfolding rules work well, but the problem of spurious
subtyping in the double unfolding rules (see Chapter 6.3) cannot be prevented with the extra
1-time �nite unfolding premise.

6.1

Overview

In Chapter 2.1.4, we have discussed that the Amber rules cannot deal well with some formsof subtyping. In particular, the re�exivity rule is limiting when the subtyping relation is notantisymmetric. In the context of subtyping, antisymmetry is the property that if two types areboth subtypes of each other, then the two types are (syntactically) equal. More formally:G ` A  B^G ` B  A ) A = B
In simple subtyping relations, such as for instance a simply typed lambda calculus extended
with the top type and recursive types, this property holds. For instance, the calculus in Chapter
3 has an antisymmetric subtyping relation.
Unfortunately, many languages contain subtyping relations that are not antisymmetric.
For instance, if a language contains some form of record types (which includes essentially all
OOP languages), then the subtyping relation is not antisymmetric. In the example below, the78

Chapter 6. Non-Antisymmetric Subtyping

subtyping statementµa. { x : a, y : nat} ! nat  µa. {y : nat, x : a} ! natshould hold, since { x : a, y : nat} and {y : nat, x : a} are subtypes of each other. How-ever, the two types are not syntactically equal. In such a setting, the use of the Amber rules
would require that, instead of using syntactic equality in the re�exivity rule, we should use anequivalence relation on types. However, we cannot simply de�ne equivalence to be:
G ` A ⇠ B := G ` A  B ^ G ` B  A
because then the re�exivity rule would become (by a simple unfolding of the equivalence definition):

D`AB D`BA
Amber-Re�-Wrong
D`AB

which would lead to a circular (and ill-behaved) subtyping relation. Instead, a separate equivalence relation needs to be de�ned to ensure that record types are equivalent up-to permutation.
But adding such a separate relation on types would add complexity, since we would need a new
set of rules and theorems about such relation.
In contrast, with the formulations based on the double unfoldings, because re�exivity is
not built-in, we can simply de�ne the equivalence relation above (G ` A ⇠ B) via subtyping.

Thus, the double and nominal unfolding rules do not require a separate de�nition of equivalence, and they also do not rely on the subtyping relation being antisymmetric.
The calculus in this chapter illustrates the addition of records and records types to thecalculus in Chapter 4. This addition has minimal impact of the calculus and metatheory: theproof techniques are similar, except that instead of syntactic equality we use our equivalencede�nition for types when proving the unfolding lemma.
When modelling the abstract syntax of types, we can pick a data structure, such as a �nite
map, that gives us the properties that we want for record types (and records) for free. That is,
we can de�ne record types to be something like:{String 7! Type}instead of a list of pairs of Strings and Types. Using lists introduces accidental complexity
because order becomes relevant, and we need to ensure that the �eld names are distinct. For
record types, a better choice of representation could help. However, presentations of records
using sequences are quite common. Our own presentation in Chapter 6.2 is based on Pierce’s
one in Types and Programming Language [100], and he basically uses a list of pairs for his
presentation and implementations.
Regarding more interesting examples of antisymmetry, we believe that type systems withbinary intersection types would be an example. In those type systems we wish to have A ^ B

6.2. The Formalization of Recursive Record Types79

and B ^ A to be equivalent types, for example. Unlike the case for records, a clever representation of syntax does not seem to help in such systems. Therefore, besides records and records
types, we also illustrate the addition of intersection types to the calculus in Chapter 4.

6.2

The Formalization of Recursive Record Types

As explained in Chapter 6.1, applying the Amber rules in subtyping relations that are notantisymmetric is non-trivial due to the built-in re�exivity rule. The purpose of this section
is to show that, unlike the Amber rules, the double unfolding rules can be easily applied tosubtyping relations that are not antisymmetric. In this section we show the type soundness
for an extension of the calculus in Chapter 4 with records and records types, which leads to a
subtyping relation that is not antisymmetric when record types are represented as a sequenceof pairs of labels and types.

6.2.1

Syntax and well-formedness

The syntax of the calculus is:
TypesA, B, C, D

Expressions

e

Valuesv::=::=

nat | > | A1 ! A2 | a | µa. A | {li : Ai i21···n }::={li = ei i21···n } | e.l
i | lx : A. e | fold [ A] v | {li = vi i21···n }x | i | e1 e2 | lx : A. e | unfold [ A] e | fold [ A] e |Natural numbers, arrow types, the top type, type variables and recursive types are thesame as before (Chapter 3.2). The additional syntax related to records and record types ishighlighted with a bold font. The notation of record types is {li : Ai i21···n }. Every label

represents a type and all labels are required to be distinct. A record expression has the form of{li = ei i21···n }, and e.l is the record projection expression.

In the type system with record types, we use G ` A to represent that A is well-formed.

The rules of G ` A include most of the rules at the top of Figure 3.3. The rule ������� is newand ensures the well-formedness of record types. Similarly to Chapter 4, we use rule ��������� for recursive types.

6.2.2

SubtypingOur subtyping rules follow the rules in Figure 4.1, but are extended with an algorithmic formulation of record subtyping. The de�nition of record subtyping (rule SA����) is standard [100]:a record type A is a subtype of another record type B when: 1) all the labels in A are a subsetof the labels in B; and 2) the �eld types of the corresponding labels are subtypes.
After adding record types, re�exivity and transitivity are still preserved.
Theorem 65. Re�exivity
If ` G and G ` A then G ` a A  A.

80

Chapter 6. Non-Antisymmetric Subtyping

G`A(Well-Formed Type (with Record Types))���������

G, a ` A�������

for each i

G ` AiG, a ` [a 7! A] A
G ` µa. A

G ` {li : Ai i21···n }G `a A  B(Subtyping)SA����

`G
G `a nat  nat`GG`A
G `a A  >SA������

SA����

G `a B1  A1
G `a A2  B2
G `a A1 ! A2  B1 ! B2

SA����

`GG ` {k j : A j j21···m }SA����

SA����

G, a `a A  B`Ga2G
G `a a  a

G, a `a [a 7! A] A  [a 7! B] B
G `a µa. A  µa. B{li i21···n } ✓ {k j j21···m }G `a { k j : A j

j21···m}  { l i : Bik j = li implies G `a A j  Bi

i 21···n}Figure 6.1: Well-formedness and subtyping rules for record types.
Theorem 66. Transitivity
If G ` a A  B and G ` a B  C then G ` a A  C.
Unlike the proof for the unfolding lemma in Chapter 4, we cannot rely on the antisymmetry lemma (Lemma 24) for proving the unfolding lemma. Instead of alpha-equivalence orsyntactic equality, we introduce a weaker form of equivalence.
De�nition 67 (Equivalence).
G ` a A ⇠ B := G ` a A  B ^ G ` a B  A
With De�nition 67, two record types { x : Int, y : Bool } and {y : Bool, x : Int} areconsidered to be equivalent: the only di�erence between two types is that one type is a permutation of the other type. In other words, the equivalence shows that the order in which thelabels appear in a record type does not matter. One essential lemma is
Lemma 68. If G ` a A  B and G ` a C ⇠ D, then G ` a [a 7! C ] A  [a 7! D ] B.

This lemma states that if two types are subtypes, then after substituting a recursive type variable a with two equivalent types, the subtyping relationship is preserved. The proof of thislemma is straightforward. With Lemma 68, we can prove our core lemma, as we did before.
Lemma 69. If
1. G1 , a, G2 ` a A  B;

2. G1 , a, G2 ` a C  D;

6.2. The Formalization of Recursive Record Types

81

3. G1 , G2 ` a µa. C  µa. D;then

1. G1 , a, G2 ` a [a 7! C ] A  [a 7! D ] B implies G1 , G2 ` a [a 7! µa. C ] A  [a 7!
µa. D ] B and2. G1 , a, G2 ` a [a 7! D ] A  [a 7! C ] B implies G1 , G2 ` a [a 7! µa. D ] A  [a 7!
µa. C ] B.

Proof. By induction on G1 , a, G2 ` a A  B. Other cases are the same as proof of Lemma 25,
except for:• Case rule SA����: In such case A = B = b. If a 6= b, the goal is trivial.

– Otherwise, for goal (1), we want to prove G1 , G2 ` a µa. C  µa. D, which isactually premise (3).

– For goal (2), we have G1 , a, G2 ` a C  D from premise (2), and G1 , a, G2 ` a D  Cfrom the condition of goal (2), thus G1 , a, G2 ` a C ⇠ D. By Lemma 68, we get
G1 , a, G2 ` a [a 7! D ] D  [a 7! C ] C. As a result, we have G1 , G2 ` a µa. D µa. C.

Finally, we can prove the unfolding lemma:
Lemma 70. Unfolding Lemma
If G ` a µa. A  µa. B then G ` a [a 7! µa. A] A  [a 7! µa. B] B.
A �nal remark is that the same technique that we employ here to prove the unfolding
lemma could have been used in the calculus in Chapter 4 as well. In other words, we do notneed to rely on the antisymmetry lemmas in Chapter 4. We opted to present the two techniquesin the paper to also emphasize the di�erence between antisymmetric and non-antisymmetric
relations, since for the Amber rules such di�erence is quite important.

6.2.3

Type safety

We use the same typing and reduction rules as Chapter 3, extended with extra rules for records
and record types.
As the top of Figure 6.2 shows, we have two typing rules for record types. Rule ����������
states that a record is well-typed if we know that all its �elds are well-typed. Rule �����������
checks that the record that we are projecting from is well-typed, and contains the �eld labelthat we are projecting.
As the bottom of Figure 6.2 shows, we have three reduction rules for record types. Rule �����
������� retrieves a component of a record. Rule ��������� reduces the record expression being
projected. Rule �������� implements a left-to-right evaluation order to reduce a record.

82

Chapter 6. Non-Antisymmetric SubtypingG`e:A(Typing)����������

����������`GG ` i : nat`G����������

����������

G, x : A1 ` e : A2
G ` lx : A1 . e : A1 ! A2�����������

G ` e : µa. A
G ` unfold [µa. A] e : [a 7! µa. A] A
for each i

G`e:A
G`AB
G`e:B

G ` e1 : A1 ! A2
G ` e2 : A1
G ` e1 e2 : A2

�������������

����������

����������

x:A2G
G`x:A

G ` e : [a 7! µa. A] A
G ` µa. A
G ` fold [µa. A] e : µa. A�����������

G ` e : {li : Ai i21···n }G ` e.li : Ai

G ` ei : Ai

G ` {li = ei i21···n } : {li : Ai i21···n }e1 ,! e2

(Reduction)���������

���������

(lx : A. e1 ) v2 ,! [ x 7! v2 ] e1�����������

��������

e ,! e0
unfold [A] e ,! unfold [A] e0

unfold [A] (fold [B] v) ,! v

{ l i = vi��������

e2 ,! e20v1 e2 ,! v1 e20

���������

e ,! e0fold [A] e ,! fold [A] e0���������

������������
i 21···n���������

e1 ,! e10e1 e2 ,! e10 e2}.l j ,! v je ,! e0
e.l j ,! e0 .l j

e j ,! e0j{li = vi i21··· j 1 , l j = e j , lk = ek k2 j+1···n } ,! {li = vi i21··· j 1 , l j = e0j , lk = ek k2 j+1···n }Figure 6.2: Typing and reduction rules for record types
The proof technique of proving type soundness is conventional, without any special approach, except for the use of the unfolding lemma in preservation (just as in Chapter 4). Therefore, we can directly prove preservation and progress.
Theorem 71. Preservation.
If G ` e : A and e ,! e0 then G ` e0 : A.
Theorem 72. Progress.
If ` e : A then e is a value or exists e0 , e ,! e0 .

83

6.3. The Spurious Subtyping Problem, Revisited

6.3

The Spurious Subtyping Problem, Revisited

In Chapter 4.1, we have brie�y mentioned that compared to the double unfolding rule, thenominal unfolding avoids the spurious subtyping problem.
In some simple calculi like STLC, such spurious subtyping problem will not cause failureof the type soundness. Unfortunately, the simple approach employed by rule S������� to avoid
spurious subtyping does not work for calculi with intersection types. We illustrate the issue via
a counter-example showing that the unfolding lemma does not hold with intersection types.
Because the unfolding lemma does not hold, type preservation does not hold either.

6.3.1

Intersection subtyping

Intersection types are used to express that a value has multiple types. Subtyping relations withintersection types only have been unproblematic and their metatheory is well-established [16,14, 99]. It enables the languages to employ �nite polymorphism [99].
Before showing the counter-example we recall the basic subtyping rules for intersection
types [16]:S����S����LG ` A  B1

G ` A  B2

G ` A  B1 &B2

G ` A2S����RG ` A1  B

G ` A1 &A2  B

G ` A1G ` A2  B

G ` A1 &A2  B

Rule S���� states that a type is a subtype of an intersection type B1 &B2 , if it is the subtypeof all components (B1 and B2 ). Rules S����L and S����R state that an intersection type is thesubtype of a type B, as long as at least one of the components is a subtype of B. An important
point is that, with intersection subtyping, subtyping is no longer syntax-directed. For example,
both rule S����L and rule S����R can be used to derive the subtyping statement A&A  A.

6.3.2

The counter-example

Due to the fact the subtyping derivations with intersection types are not unique, we can construct a counter-example for the unfolding lemma. One of the counter-examples is when we
have A := µa. nat&(nat ! nat)&(a ! nat) and B := µa. nat&(a ! nat)1 . For conve-

nience, here we denote A1 and B1 as, respectively, the 1-time �nite unfolding of A and B; andA2 and B2 as, respectively, the 2-times �nite unfolding of A and B. That is:
A1
B1
A2
B2

:=
:=
:=
:=

nat&(nat ! nat)&(a ! nat)
nat&(a ! nat)[a 7! A1 ] A1 = nat&(nat ! nat)&( A1 ! nat)[a 7! B1 ] B1 = nat&( B1 ! nat)Type A should not be the subtype of type B, because the unfoldings of A and B are notsubtypes. In other words, if A  B then the unfolding lemma does not hold. The following
derivation shows that the unfoldings of A and B are not subtypes:

1 Note that we assume that the intersection operator & has the highest priority, both compared to the recursivetype binder and function types. In particular, µa. A&B is equivalent to µa. ( A&B).

84

Chapter 6. Non-Antisymmetric Subtyping

B  A (fail!)nat  nat
S������
A ! nat  B ! nat
S����R(nat ! nat)&( A ! nat)  B ! nat
nat  nat
S����LS����Rnat&(nat ! nat)&( A ! nat)  nat
nat&(nat ! nat)&( A ! nat)  B ! natS����
nat&(nat ! nat)&( A ! nat)  nat&( B ! nat)[a 7! A] A1  [a 7! B] B1

In the derivation above (and later), we highlight important portions. We use colors for three
types, two on an intersection on the left (the color red and blue, respectively), and one type on
the right. Note that if the type on the right has a di�erent color from a type on the left then the
two types are not related by subtyping. In the derivation above the important point to noticeis that nat ! nat 6 B ! nat, since a recursive type is not subtype of a natural number (B 6nat). That is, attempting to use rule S����L (instead of rule S����R) would soon fail. We will
come back to this point soon.
Unfortunately, with the double unfolding rules, A  B does hold, breaking the unfolding

lemma. For showing this fact, according to the rule S�������, we just need to check both the
1-time and 2-times �nite unfoldings for A  B.

It is easy to show that the 1-time �nite unfolding (A1  B1 ) holds:

a ! nat  a ! nat
S����R(nat ! nat) &(a ! nat)  a ! nat
nat  nat
S����LS����Rnat&(nat ! nat)&(a ! nat)  nat
nat&(nat ! nat)&(a ! nat)  a ! natS����
nat&(nat ! nat)&(a ! nat)  nat&(a ! nat)
Here we note that the 1-time derivation follows a similar structure to that of the (failed)derivation for the unfoldings of A and B. In particular, we make similar choices with respect
rules S����R and S����L.
Furthermore, the 2-times �nite unfolding (A2  B2 ) also holds:
B1  nat
nat  nat
S������
nat ! nat  B1 ! nat
S����L(nat ! nat) &( A1 ! nat )  B1 ! nat
nat  nat
S����LS����Rnat&(nat ! nat)&( A1 ! nat)  nat
nat&(nat ! nat)&( A1 ! nat)  B1 ! natS����
nat&(nat ! nat)&( A1 ! nat)  nat&( B1 ! nat)
Let us review why this counter-example passes the subtyping check. The subtyping be-

tween the unfoldings of A and B gets stuck when we attempt to check A ! nat  B ! nat.

Since both A and B are in a contravariant position, we need to �ip the subtyping relation, andB  A does not hold. As a result, A ! nat 6 B ! nat and the derivation fails.

During the double �nite unfolding, we expect that, similarly to the unfolding of the recur-

sive types A and B, the function cases lead to a failed derivation, since A1 ! nat 6 B1 ! nat.

However, those relations are derived from intersection types, which allow us to choose another85

6.4. Intersection Subtyping with Nominal Unfoldings

derivation. While in the unfolding of the recursive types A and B, those alternative derivations immediately fail, in the double �nite unfolding they succeed as nat ! nat  B1 ! nat

holds (recall that B1 := nat&(a ! nat)). The key point is that such alternative derivation (viarule S����L) should not hold. For instance in nat ! nat  B1 ! nat, the origin of the typeB1 is the result of a substitution of a recursive type variable by B1 . The information that is lostin the double unfolding is that the origin of type B1 is from an unfolding substitution, and such

type should not be comparable to regular types. In the derivation of unfolding lemma for therecursive types A and B, such information is present and what we have instead is nat ! nat

6 B ! nat, which fails.

In summary, a form of spurious subtyping leads to a valid subtyping derivation with the

double unfolding rules. Unlike the setting without intersection types, the 1-time unfolding is
unable to prevent such form of spurious subtyping. The key di�erence is that the presence ofintersection types o�ers a choice in how to proceed with the derivation, greatly complicating
the detection of spurious subtyping. This fatal issue breaks the preservation theorem, which
relies on the unfolding lemma. In Chapter 4.1.2 we already show a counter-example to theunfolding lemma that we have presented is also a counter-example of type preservation.

6.4

Intersection Subtyping with Nominal Unfoldings

With the nominal unfolding rule, the spurious subtyping problem can be solved nicely. For thecounter-example above, we will show that
µa. nat&(nat ! nat)&(a ! nat) 6 µa. nat&(a ! nat)works well with the nominal unfolding rules.
The failed subtyping derivation for the counter-example using the nominal unfolding
rules is:B1  A1 (fails!)
B1a  A1anat  nat

S������
A1a ! nat  B1a ! nat
S����R(nat ! nat) & (A1a ! nat)  B1a ! nat
nat  nat
S����R
S����Lnat& . . . & . . .  nat
nat&(nat ! nat)&( A1a ! nat)  B1a ! natS����
nat&(nat ! nat)&( A1a ! nat)  nat&( B1a ! nat)

µa. nat&(nat ! nat)&(a ! nat)  µa. nat&(a ! nat)S����

Now the derivation tree is what we expect. After adding a label, the function type nat !

nat does not match with the function type B1a ! nat, because the labelled type B1a is not a
subtype of nat. Thus, we avoid an accidental subtyping derivation using rule S����L.

86

Chapter 6. Non-Antisymmetric Subtyping

G`A(Well-Formed Type)�������

����T��

����B��

G ` natG`>G`?

�������

�������

a2G
G`aG, a ` A
G ` µa. A���������G ` A1G ` A2G ` A1 ! A2�������

����������G`A
G ` AaG`A
G`B
G ` A&B

G`AB(Subtyping)

S����

S����

`G
G ` nat  nat

`G
G`A
G`A>

S������

S���������

S����

S����LG ` B1  A1
G ` A2  B2
G ` A1 ! A2  B1 ! B2
G ` A  B1
G ` A  B2
G ` A  B1 &B2S����S�������

`G
G`A
G`?A

G`AB
G ` Aa  Ba

G, a ` [a 7! Aa ] A  [a 7! Ba ] BG ` µa. A  µa. B

G ` A2G ` A1  B
G ` A1 &A2  B

S����

`G
G`a
G`aa

S����RG ` A1G ` A2  B
G ` A1 &A2  B

Figure 6.3: Well-formedness and subtyping rules.

6.5

The Calculus with Intersection Types

In this section we present a subtyping relation with iso-recursive subtyping and intersection
types. Unlike the problematic approach with the double unfolding rules (as discussed in Chapter 6.3), our new approach with nominal unfoldings works well and retains desirable properties. Among others, we prove transitivity of subtyping, the unfolding lemma and decidabilityof subtyping.

6.5.1

Syntax and well-formedness

The syntax of types, expressions, values and contexts is shown below, and the de�nition ofwell-formed types is shown at the top of Figure 6.3. Compared with the de�nition of types in
Chapter 3.2, we just add intersection types and label types. Compared with the de�nition ofwell-formedness in Figure 4.2, we just add intersection types.

6.5.2

Types

A, B

Expressions

e

Valuesv

Contexts

G

::=
::=

nat | > | ? | A1 ! A2 | Aa | a | µa. A | A&B

::=
::=

i | lx : A. e | fold [ A] v

i | x | e1 e2 | lx : A. e | unfold [ A] e | fold [ A] e

· | G, a | G, x : A

Subtyping

Subtyping is re�exive and transitive, and the unfolding lemma also holds:

87

6.6. Mechanized Proofs
Theorem 73 (Re�exivity). If ` G and G ` A then G ` A  A.

Theorem 74 (Transitivity). If G ` A  B and G ` B  C then G ` A  C.
Lemma 75. Unfolding Lemma.

If G ` µa. A  µa. B then G ` [a 7! µa. A] A  [a 7! µa. B] B.
Our size measure approach also works well with intersection types since the size of any
premise is strictly less than the size of conclusion among all three rules for intersection types.
Not surprisingly, we can extend the measure in Chapter 4.6 by addingheightY ( A1 &A2 ) = max (heightY ( A1 ), heightY ( A2 )) + 1
Theorem 76 (Decidability of Subtyping). If ` G, G ` A and G ` B, then G ` A  B isdecidable.

6.5.3

Typing and reduction

The de�nition of typing and reduction rules are shown as Figure 6.4. Compared with Figure
3.4, we add the usual typing rule for intersection types (rule �������): it says if an expression
e is of type A and of type B, then it is of type A&B. With the addition to intersection types, avalue can have multiple possibilities of types. For example, both 1 : nat&> and lx : ((nat !
nat)&(bool ! bool)). x are allowed in our type assignment system.

6.5.4

Type soundness

Compared with the type-safety proof in Chapter 3, after adding intersection types, the proofs
are also straightforward, except for some modi�cations of auxiliary lemmas. All the proofs aremechanized and provided as supplementary material.
Theorem 77 (Preservation). If G ` e : A and ee0 then G ` e0 : A.

Proof. By induction on G ` e : A. Most cases are routine except for the case rule ����������,where we must apply the unfolding lemma (Lemma 75).

Theorem 78 (Progress). If ` e : A then e is a value or 9e0 , e

6.6

e0 .

Mechanized Proofs

The folder coq_record includes all the Coq proofs about STLC extended with iso-recursive subtyping and record types. The folder coq_intersection includes all the Coq proofs about STLC
extended with iso-recursive subtyping and record types.

88

Chapter 6. Non-Antisymmetric SubtypingG`e:A(Typing)����������`GG ` i : nat����������

`G

x:A2G
G`x:A

�������������

G ` e : µa. A
G ` unfold [µa. A] e : [a 7! µa. A] A����������

G ` e1 : A1 ! A2
G ` e2 : A1
G ` e1 e2 : A2
e1����������

����������

G, x : A1 ` e : A2
G ` lx : A1 . e : A1 ! A2�����������

G ` e : [a 7! µa. A] A
G ` µa. A
G ` fold [µa. A] e : µa. A����������

G`e:A
G`AB
G`e:B

G`e:A
G`e:B
G ` e : A&B

e2(Reduction)���������

���������

(lx : A. e1 ) v2 ,! [ x 7! v2 ] e1�����������

��������

unfold [A] (fold [B] v) ,! v

���������

e1 ,! e10e1 e2 ,! e10 e2

e ,! e0
unfold [A] e ,! unfold [A] e0

e2 ,! e20v1 e2 ,! v1 e20

���������

e ,! e0fold [A] e ,! fold [A] e0

Figure 6.4: Typing and reduction rules (with intersection type).

6.6.1

De�nitions

The folder src_record includes all the Coq proofs about STLC with iso-recursive subtyping andrecord types, which corresponds to the calculus in Chapter 6.2. All the de�nitions in Chapter
6.2 can be found in �les de�nition.v.
The folder src_intersection includes all the Coq proofs about STLC with iso-recursive subtyping and intersection types, which corresponds to the calculus in Chapter 6.5. All the de�nitions in Chapter 6.5 can be found in �les de�nition.v.
Table 6.1 shows the correspondence of de�nitions between the paper and the Coq artifacts.

6.6.2

Lemmas and theorems

Table 6.2 shows the descriptions for all the proof scripts in Chapter 6.

89

6.6. Mechanized Proofs

Table 6.1: Paper-to-proofs correspondence guide in Chapter 6.
De�nition

File
Name in Coq
in folder coq_record
Well-formed Type (Figure 6.1) de�nition.v WF E A
Subtyping (Figure 6.1)
de�nition.v Sub E A B
Typing (Figure 6.2)
de�nition.v typing E e A
Reduction (Figure 6.2)
de�nition.v step e1 e2
in folder coq_intersection
Well-Formed Type (Figure 6.3) de�nition.v WFS E A
Subtyping (Figure 6.3)
de�nition.v Sub E A B
Typing (Figure 6.4)
de�nition.v typing E e A
Reduction (Figure 6.4)
de�nition.v step e1 e2Notation
G`A
G`AB
G`e:A
e1 ,! e2
G`A
G`AB
G`e:A
e1
e2

Table 6.2: Descriptions for the proof scripts in Chapter 6.
Theorems
Theorem 65
Theorem 66
Lemma 70
Theorem 71
Theorem 72
Theorem 73
Theorem 74
Theorem 76
Lemma 75
Theorem 77
Theorem 78

DescriptionFiles
in folder coq_record
Re�exivity
subtyping.v
Transitivity
subtyping.v
Unfolding Lemma unfolding.v
Preservation
typesafety.v
Progresstypesafety.v
in folder coq_intersection
Re�exivity
infra.v
Transitivity
infra.v
Decidability
decidability.v
Unfolding Lemma unfolding.v
Preservation
typesafety.v
Progresstypesafety.v

Name in Coq
sub_re�Transitivity
unfolding_lemmapreservation
progressRe�exivity
Transitivity
decidability
unfolding_lemmapreservation
progress

91

Chapter 7

A Calculus with the Merge
Operator
In Chapter 2.2.1, we introduce the calculi with disjoint intersection types [89]. One calculus
supporting nested composition, based on the disjoint intersection types, is called li [20]. In
brief, in li , any term constructed via a merge operator has disjoint types or they are the same.

For example, both 1, , true and 2, , 2 are a valid term while 1, , 2 is invalid. Within li , the typed
�rst-class traits, and other advanced features, are supported [19].

An important limitation of existing calculi with disjoint intersection types is that theylack recursive types. For typed model of objects, supporting recursive types is important,since many object encodings require recursive types [28]. Without recursive types binary
methods [25] and other types of methods, that refer to the current object type cannot be easilymodelled.
In this chapter, a calculus that combines iso-recursive types with disjoint intersection
types [89] and a merge operator [106, 57], called li , is presented. The merge operator generµ

alizes symmetric record concatenation, and the calculus supports subtyping as well as recursive
types. We use the nominal unfolding rules to add iso-recursive types to a calculus with disjoint
intersection types and a merge operator. The main challenge lies in the disjointness de�nition
with iso-recursive subtyping. We show the type soundness of the calculus, decidability of
subtyping, as well as the soundness and completeness of our disjointness de�nition.

7.1

Syntax, Well-Formedness and Subtyping

This section presents the syntax, well-formedness and subtyping of li . We prove transitivityµ

of subtyping, the unfolding lemma and decidability of subtyping.

7.1.1

Syntax and well-formedness

The syntax of our calculus is:

92

Chapter 7. A Calculus with the Merge Operator
Types

A, B

Expressions

e

Valuesv

Contexts

G
,

Modes

::=
::=

nat | > | ? | A1 ! A2 | {a : A} | a | µa. A | A1 &A2

::=
::=

| unfold [ A] e | fold [ A] e | {a = e} | e1 , , e2 | e.ai | > | lx .e : A ! B | fold [ A] v | v1 , , v2 | {a = v}
· | G, a | G, x : A
(|)

::=

i | > | x | lx. e : A ! B | e1 e2 | fix x : A. e | e : A

Meta-variables A, B range over types. Types are mostly standard and consist of: natural numbers (nat), the top type (>), the bottom type (?), function types (A ! B), type variables (a),and recursive types (µa. A). The most interesting feature is the presence of new notation oflabelled types {a : A}. Here, labelled types are re-denoted as single-�eld record types, while
in Chapter 4.5, the labelled types are denoted as Aa . The a in the �eld of {a : A} and the ain the superscript of Aa should be considered as the same syntactic constructs, and are different from the recursive variables. We do not change the semantics of labelled types, but we(ab)use such a notation of single-�eld record types in two di�erent ways: 1) we use them with
the nominal unfolding rules for iso-recursive subtyping, as in Chapter 4.5; and 2) we also usethem to model records and records types in combination with intersection types and the merge
operator. It is also possible to have an alternative design, which should work just as well, thathas separate notions of labelled types and records, but such design comes with the cost of afew more subtyping and well-formedness rules.
Expressions, which are denoted as e, include: a top value (>), lambda expressions (lx. e :A ! B) and �xpoints (fix x : A. e). Note that for lambda expressions, we annotate both input
and output types, since the output types are necessary in a Type-Directed Operational Semantics (TDOS) during reduction, which will be described in Chapter 7.4.1. We also introduce themerge operator (e1 , , e2 ) [106, 57], and annotated expressions (e : A).
Values include a canonical top value (>), lambda expressions (lx.e : A ! B), mergesof values (v1 , , v2 ) and record values ({a = v}). For proving type-safety, the contexts also
store the types of variables used in the program. We employ bi-directional type checking inthe system, thus (/) represent the checking mode and synthesis mode, respectively.

The syntactic sugar for record types and records is also shown below, illustrates the stan-

dard encoding [57, 106] in terms of intersection types, labelled types and merges.

{ a1 : A1 , . . . , a n : A n }{ a 1 = e1 , . . . , a n = e n }⌘⌘{ a1 : A1 } & . . . & { a n : A n }{ a 1 = e1 } , , . . . , , { a n = e n }The de�nition of well-formed types is mostly standard, as Figure 7.1 shows. An environment is well-formed if all the variables are distinct.

7.1.2 Subtyping
Figure 7.2 shows the subtyping relation. Rule S���� states that any well-formed type A is asupertype of the ? type. Rule S���� is a standard rule for type variables: variable a is a subtype

93

7.1. Syntax, Well-Formedness and Subtyping`G(Well-Formed Environment)�������

���������

`G`·a 62 G` G, aG`A�������

`G

x 62 GG`A` G, x : A(Well-Formed Type)�������

����T��

����B��

G ` natG`>G`?

���������

�������G`A
G ` { a : A}�������

a2G
G`aG, a ` A
G ` µa. A���������G ` A1G ` A2G ` A1 ! A2�������G`A
G`B
G ` A&B

Figure 7.1: Well-formedness.
of itself. The rule for function types (rule S������) and intersection types are standard. Rule S������ states that a labelled type is a subtype of another labelled type if the two types arelabelled with the same name and A  B. Rule S��������� is the nominal unfolding rule. It is

the same as the rule SN���� in Chapter 4.5, except that we adapt the notation of substitution
to [a 7! {a : A}] A.

A toplike type, whose de�nition is shown as rule S��������, is both a supertype and asubtype of >. In calculi with disjoint intersection types, the de�nition of toplike types plays

an important role, since disjointness is de�ned in terms of toplike types. Allowing a larger setof toplike types enables more types to be disjoint. In particular, the motivation for li to include

rule ��������� in subtyping is to allow certain function types to be disjoint [20, 76, 89]. The
rule ��������� itself is inspired from the well-known BCD-subtyping [17] relation, which
also states that any function type that returns a toplike type is itself toplike. Rule ���������
was �rst adopted in calculi with disjoint intersection types by Bi, Oliveira, and Schrijvers [20],and we follow that approach as well here. Without such rule two function types can never
be disjoint, disallowing more than one function in a merge (where all expressions must havedisjoint types). Similarly, in li the rule ������� enables merges that can contain more thanµ

one expression with a recursive type.

Subtyping is re�exive and transitive:
Theorem 79 (Re�exivity). If ` G and G ` A then G ` A  A.

Theorem 80 (Transitivity). If G ` A  B and G ` B  C then G ` A  C.

Furthermore, we have also proved the unfolding lemma, which plays an important rolein type preservation. The proof strategy is similar to the approach used in Chapter 4.4.
Lemma 81 (Unfolding Lemma). If G ` µa. A  µa. B then G ` [a 7! µa. A] A  [a 7!
µa. B] B.

94

Chapter 7. A Calculus with the Merge Operator

e Ad(Toplike Type)�������

��������

eAd
eBd
eA&Bd

e>d

���������eBd
G`A
eA ! Bd�������

�������

eAdeµa. AdeAd
e{a : A}dG`AB

(Subtyping)

S����

`G
G ` nat  nat

S��������

`G
eBd
G`AB

S������

G ` B1  A1
G ` A2  B2
G ` A1 ! A2  B1 ! B2

S����

`G
G`A
G`?A

S������G`AB
G ` { a : A}  { a : B}S����G ` A  B1
G ` A  B2
G ` A  B1 &B2S����RG ` A1G ` A2  B
G ` A1 &A2  B

S����

`G
G`a
G`aa

S����LG ` A2G ` A1  B
G ` A1 &A2  B

S���������

G, a ` [a 7! {a : A}] A  [a 7! {a : B}] B
G ` µa. A  µa. B
Figure 7.2: Subtyping rules.

The proof of decidability is similar to the one used in Theorem 76, except for the cases
raised from rule S��������.
Theorem 82 (Decidability of Subtyping). If ` G, G ` A and G ` B, then G ` A  B isdecidable.

7.2

Disjointness for Recursive Types

The disjointness restriction is an essential feature in calculi with disjoint intersection types.
Such restriction ensures that certain merges of values, that could lead to ambiguity, are forbidden. For instance, in the example above merges are used to encode records. A record{ x = 1, y = true} is encoded as the merge of two single �eld records { x = 1}, , {y = true}.

Here the operator , , is the merge operator [106, 57], which can be viewed as a generalizationof record concatenation. Ambiguity can arise with the merge operator if the two values in themerge overlap. For instance, with records, we would like to forbid r = { x = 1, x = 2} (arecord with two �elds with the same name and type), since r.x would be ambiguous. With themerge operator we can merge not only records, but also arbitrary values. Thus, we need toforbid merges such as 1, , 2 which provides two values of type Int. The disjointness restriction
is employed when type-checking merges to ensure that the types being merged do not overlap.
A standard speci�cation of disjointness [89, 77] is:95

7.2. Disjointness for Recursive Types

De�nition 83 (Speci�cation of disjointness). G ` A ⇤s B ⌘ 8C, (G ` A  C ^ G ` B C ) )eC d

The intuition is that two types are disjoint when all their supertypes are (isomorphic to) >.
The notation e · d represents toplike types, which are both supertypes and subtypes of >. In

essence ambiguity arises from upcasts on values. For instance if we cast 1, , 2 under type Int
there can be two possible results. Disjointness prevents merges with values having common
supertypes (with the exception of >). Therefore, when such disjoint merges are upcast we canensure that only one value will be extracted for any given (non toplike) type.

One of the challenges in the design of li is to �nd an algorithmic rule to check whetherµ

two recursive types are disjoint and prove that it is complete with respect to the speci�cation.
As part of the completeness proof we must be able to �nd common supertypes of two types, but
this is non-trivial for recursive types due to contravariance. For example, assume that we have
two recursive types µa. ((nat ! a) ! nat) and µa. ((> ! a) ! nat), then µa. ((nat !

a)&(> ! a) ! nat) is not a valid common supertype because a is contravariant. In contrast,

for covariant recursive types and non-recursive types, �nding a common supertype is simpler.
For instance, for the recursive types µa. (String ! a) and µa. (nat ! a), the intersectionof the two inputs types of the function in the recursive type gives us a common supertypeµa. (String&nat ! a).

7.2.1

Algorithmic rules of disjointness

Figure 7.4 shows an algorithmic formulation of disjointness. Most rules are standard and follow
from previous work [89, 76, 21]. Toplike types are disjoint with other types (rules �������L and�������R). Intersection types need to check the disjointness of every component (rules �������L and �������R). Two labelled types are disjoint if they have distinct labels or the typesof the label are disjoint (rules ����R��R�� and ����R��R��E�). Two di�erent variables arealways disjoint (rule ����V��V��). Rule ����A��A�� states that, for two function types, wejust need to check if their output types are disjoint or not.
The most interesting one is the disjointness of recursive types. Without toplike types, it
could be very simple: any two recursive types are not disjoint because µa. > is a non top-

like common supertype for all recursive types. However, the introduction of toplike types
complicates the interaction between any two recursive types. Nevertheless, rule ����R��R��
is surprisingly simple: two recursive types are disjoint if their bodies are disjoint. Finally,
two types with di�erent type constructors (e.g. record types and recursive types) are disjoint(rule ���������).
The soundness lemma showing that our rules satisfy the speci�cation is straightforward:
Lemma 84 (Soundness). If G ` A ⇤ B then G ` A ⇤s B.
Proof. By induction on G ` A ⇤ B.

96

Chapter 7. A Calculus with the Merge Operator

G ` A ⇤ axiom B(Disjointness (Axiom))������I��A��

������A��I��

������I��R��

G ` nat ⇤ axiom A1 ! A2

G ` A1 ! A2 ⇤ axiom nat

G ` nat ⇤ axiom µa. A������R��I��

������A��R��

������R��A��G ` µa. A ⇤ axiom nat

G ` A1 ! A2 ⇤ axiom µa. AG ` µa. A ⇤ axiom A1 ! A2������I��V��������V��I��

������A��V��

G ` nat ⇤ axiom a

G ` a ⇤ axiom nat

G ` A1 ! A2 ⇤ axiom a������V��A��

������R��V��������V��R��

G ` a ⇤ axiom A1 ! A2

G ` µa. A ⇤ axiom b

G ` b ⇤ axiom µa. A������R��I��

������I��R��

������R��V��

G ` {a : A} ⇤ axiom nat

G ` nat ⇤ axiom {a : A}G ` {a : A} ⇤ axiom b������V��R��

������R��A��

������A��R��

G ` b ⇤ axiom {a : A}G ` {a : A} ⇤ axiom A1 ! A2

G ` A1 ! A2 ⇤ axiom {a : A}������R��R��

������R��R��G ` µa. A ⇤ axiom { b : B}

G ` { b : B} ⇤ axiom µa. A

Figure 7.3: Disjointness (Axiom).

7.2.2

Completeness of disjointness

The most challenging part of the formalization of li is to show that algorithmic disjointness isµ

complete with respect to the speci�cation. The di�culty is brought by rule ����R��R��. If tworecursive types µa. A and µa. B satisfy the speci�cation, then for any type C, G ` µa. A 

C ^ G ` µa. B  C implies that C is toplike. By rule ����R��R��, we want to prove that any

type D satisfying G, a ` A  D ^ G, a ` B  D implies that D is toplike. Clearly C andD should be related since in one case C is the supertype of two recursive types, and in theother case D is the supertype of the bodies of the two recursive types. However, the relation
between C and D is intricate.
Lower common supertype To help relating C and D, we de�ne a new function t, whichis shown in Figure 7.5. The function t computes a lower supertype of type A and B. A simpli�cation that we employ in our de�nition is that types of common supertypes in contravariant
positions are all ?. Strictly speaking this means that the supertype that we �nd is not the low-

est one in the subtyping lattice. But in our setting this does not matter, because the disjointnessof arrow types (see rule ����A��A��) does not account for input types. If the input types didmatter for disjointness then we would likely need a dual de�nition for �nding greater common
subtypes, making the de�nition more involved. We can prove some useful properties for t:
Lemma 85 (t is supertype). For any A and B, G ` A  A t B and G ` B  A t B.

97

7.2. Disjointness for Recursive Types
G ` A⇤B�������LeBd
G ` A⇤B(Disjointness)�������R

�������LG ` A1 ⇤ B
G ` A2 ⇤ B
G ` A1 &A2 ⇤ B

eAd
G ` A⇤B

����V��V��

a 6= bG ` a⇤b

����A��A��

G ` A2 ⇤ B2
G ` A1 ! A2 ⇤ B1 ! B2

����R��R��E�

�������R

G ` A ⇤ B1
G ` A ⇤ B2
G ` A ⇤ B1 &B2

����R��R��

a 6= bG ` { a : A} ⇤ { b : B}

����R��R��

G ` A⇤BG ` { a : A} ⇤ { b : B}

G, a ` A ⇤ B
G ` µa. A ⇤ µa. B���������G ` A ⇤ axiom B
G ` A⇤B

Figure 7.4: Disjointness.

>tA
=
>
At>
=
>
ata
=
a
atb
=
> (a 6= b)
A t B&C=
A&B t A&C
A&B t C
= A&C t B&C? t µa. A=µa. (? t A)
µa. A t ?
=µa. ( A t ?)? t {a : A}={a : ? t A}
{a : A} t ?
={a : A t ?}? t A1 ! A2
= ? ! (? t A2 )A1 ! A2 t ?
= ? ! ( A2 t ?)µa. A t µa. B=µa. ( A t B)
{a : A} t { b : B} => (a 6= b)
A1 ! A2 t B1 ! B2 = ? ! ( A2 t B2 ){a : A} t {a : B} ={a : A t B}
otherwise: ? t A = A, A t ? = A, A t A = A, A t B = >Figure 7.5: Lower common supertype.
Lemma 86. If G ` A  C and G ` B  C and A t B is toplike, then C is toplike.

Lemma 86 is the most important one: A t B is not the least common supertype of A andB, but if it is toplike then all supertypes of A and B are toplike. With the previous lemmas we
can prove the completeness lemma:
Lemma 87 (Completeness). For types A and B, if G ` A ⇤s B then G ` A ⇤ B.

Proof. Do induction on A and B, respectively. All cases are straightforward, except for thecase where both types are recursive types. In such case, A is decomposed into µa. A0 and B isdecomposed into µa. B0 .

1. One of the premises is: 8 C, G ` µa. A0  C ^ G ` µa. B0  C )eC d.

2. The induction hypothesis is (8 D, G, a ` A0  D ^ G, a ` B0  D ) )e D d)` A0 ⇤ B0 .

3. The goal is G ` µa. A0 ⇤ µa. B0 . By applying rule ����R��R�� and the induction hypothesis, we have two more conditions:(a) G, a ` A0  D;(b) G, a ` B0  D.

And the goal becomes checking if D is toplike.

98

Chapter 7. A Calculus with the Merge Operator
4. We could also know two more lemmas from Lemma 85:(a) G ` µa. A0  µa. A0 t µa. B0 ;(b) G ` µa. B0  µa. A0 t µa. B0 .

5. From conditions (1) (4a) and (4b), we get: µa. A0 t µa. B0 is toplike.

6. According to the de�nition of lower common supertype for two recursive types, fromcondition (5), we could know µa. ( A0 t B0 ) is toplike.

7. By inversion of condition (6), we obtain A0 t B0 is toplike.

8. Apply Lemma 86 with conditions (3a) and (3b), and we achieve the goal.

7.3µ

Static Semantics of li

We use bidirectional type checking in li , following li [77]. Bi-directional typechecking isµ

helpful to eliminate a source of ambiguity (and non-determinism) that arises from an unrestricted subsumption rule in conventional type assignment systems in the presence of a concatenation/merge operator (a point which was also noted by Cardelli and Mitchell [36]). The
typing rules are shown in Figure 7.6. There are two standard modes: G ` e ) A synthesises

the type A of expression e under the context G, and G ` e ( A checks if expression e has type
A under the context G.

Many rules are standard. There are two rules for merge expressions, which follow fromprevious work by Huang et al. [77]. Rule ������������� employs a disjointness restriction,and only allows two expressions with disjoint types to be merged. The disjointness restriction
prevents ambiguity that could arise merging types with common (non-toplike) supertypes. For
instance, if 1, , 2 would be allowed, then in an expression like (1, , 2) + 3 we could have two
possible results: 4 and 5. The merge of duplicated values such as 1, , 1 is not harmful, since noambiguity arises in this case, and such values can arise from reduction. Thus, there is also arule ��������������, which allows merging two consistent values regardless of their types.
The consistency relation is:De�nition 88 (Consistency). v1 ⇡spec v2 ⌘ 8 A, (v1 ,! A v10 ^ v2 ,! A v20 ) ) v10 = v20

In this relation, two values are consistent if for any type A casting of those two values undertype A produces the same result. We introduce the casting relation v1 ,! A v2 , which reduces
the value v1 to v2 under the type A in Chapter 7.4.1. A key property relating consistency anddisjointness is:

Lemma 89 (Consistency of disjoint values). If ` v1 ) A and ` v2 ) B and ` A ⇤s B thenv1 ⇡spec v2 .

99µ

7.4. Dynamic Semantics of li
G`e,A(Typing)�����������

G`e ) AG`AB
G`e ( B�����������

�����������

�����������

G ` e1 ) A1 ! A2
G ` e2 ( A1
G ` e1 e2 ) A2

������������

G ` e ) { a : A}G ` e.a ) A�����������

������������

G`e ( AG`e: A ) A�����������

G`e ) AG ` { a = e} ) { a : A}

G, x : A1 ` e ( A2
G ` lx : A1 ! A2 . e ) A1 ! A2�����������

G ` e ( µa. A
G ` unfold [µa. A] e ) [a 7! µa. A] A

G, x : A ` e ( AG ` fix x : A. e ) A�������������

· ` v1 ) A

`G
x:A2G
G`x ) A`GG ` i ) nat

��������������

��������������

�����������

`GG`> ) >G ` e1 ) A
G ` e2 ) B
G ` e1 , , e2 ) A&B

G ` A⇤B������������

G ` e ( [a 7! µa. A] A
G ` µa. A
G ` fold [µa. A] e ) µa. A· ` v2 ) B
v1 ⇡spec v2
G ` v1 , , v2 ) A&B

Figure 7.6: Typing rules for li .
µ

µ

7.4

Dynamic Semantics of li

We now introduce the Type-Directed Operational Semantics (TDOS) for li . TDOS, originallyµproposed by Huang and Oliveira [76] and Huang et al. [77], is a variant of small-step opera-

tional semantics. In TDOS, type annotations are operationally relevant, since selecting values
from merged values is type-directed. We show that li is deterministic and type sound.
µ

7.4.1

µ

A Type-Directed Operational Semantics for li

The de�ning feature of a TDOS is a relation called casting (originally called typed reduction by
Huang et al.). Casting plays an important role: based on the contextual type information, values
are further reduced to match the type structure precisely. In many conventional operationalsemantics a value is the �nal result in a program, but with TDOS further reduction can happen
if the type that is required for the value has a mismatch with the shape of the value. For
example, if we have the merge 1, ,0 c0 at type Int then casting will produce 1. However, thesame value at type Int&Char would remain unchanged (1, ,0 c0 ).

The rules for casting are shown at the Figure 7.7. All non-intersection types are ordinary
types. Casting v1 ,! A v2 denotes that the value v1 is reduced to v2 under the type A. From

the de�nitions, we can see that the A is the supertype of the principal type of v1 , and v2 is the

100

Chapter 7. A Calculus with the Merge Operator

ord A(Ordinary Type)�������

�������

�������

�������

�������

�������

ord nat

ord >

ord ?

ord A ! B

ord µa. A

ord a�������

ord {l : A}
v1 ,! A v2

(Casting)��������

��������

ord A

i ,!nat i����������L

eAd

v ,!A Av1 ,!A v
ord A
v1 , , v2 ,!A v†

��������

⇠eµa. Bd
· ` µa. A  µa. B
fold [µa. A] v ,!µa. B fold [µa. B] v��������

����������R

v2 ,!A v
ord A
v1 , , v2 ,!A v

����������

⇠eB2 d· ` B1  A1
· ` A2  B2
lx : A1 ! A2 . e ,!B1 !B2 lx : A1 ! B2 . e��������

v ,!A v1
v ,!B v2
v ,!A&B v1 , , v2

v1 ,!A v2⇠e{l : A}d{a = v1 } ,!{l:A} {a = v2 }Figure 7.7: Casting.
value compatible with A. The most special one is rule ��������: if the type is toplike, then avalue will reduce to the corresponding top value, where the A† is de�ned as:( A ! B)†{a : A}†= lx .> : A ! B(µa. A)†={a : A† }( A&B)†
otherwise:A† = >= fold [µa. A] >=A† , , B†

7.4.2 Reduction
The de�nition of reduction is shown at the Figure 7.8. Most rules are standard. Casting is usedin rule ���������� for adjusting the argument value to the expected type for the input of thefunction. Casting is also used in rule ���������� for annotations. Rules ��������� and �����
���� are for unfold expressions. Finally, there is also a special rule ��������� for recursive
types as well as intersection types.

7.4.3 Determinism
One of the properties of our semantics is determinism: expressions will always reduce to thesame value. Lemma 90 says that if a value can be type-checked, then it reduces to a same value
under the type A. Lemma 91 says that if an expression can be type-checked, then it reduces toa unique expression.
Lemma 90 (Determinism of ,! A ). If G ` v ) B and v ,! A v1 and v ,! A v2 then v1 = v2 .
Proof. By induction on v ,! A v1 .

101

µ

7.4. Dynamic Semantics of li
e1 ,! e2

(Reduction)����������

v1 ,!A1 v2(lx : A1 ! A2 . e) v1 ,! ([ x 7! v2 ] e) : A2
���������

�����������

e ,! e0
e.l j ,! e0 .l j����������

v ,!A v0v : A ,! v0

e2 ,! e20v1 e2 ,! v1 e20

���������

e2 ,! e20v1 , , e2 ,! v1 , , e20

e ,! e0e : A ,! e0 : A���������

��������

e ,! e0fold [A] e ,! fold [A] e0

fix x : A. e ,! ([ x 7! fix x : A. e] e) : A�����������

e ,! e0{a = e} ,! {a = e0 }v1 ,![a7!µa. A] A v2

���������

e1 ,! e10e1 e2 ,! e10 e2�����������

e1 ,! e10
e1 , , e2 ,! e10 , , e2����������

���������

���������

e ,! e0
unfold [A] e ,! unfold [A] e0���������

⇠eµa. Ad

unfold [µa. A] (fold [µa. B] v1 ) ,! v2
���������

v1 ,![a7!µa. A] A v2

v1 , , v2 ,!µa. A v⇠eµa. Ad
unfold [µa. A] (v1 , , v2 ) ,! unfold [µa. A] v

eµa. Ad

unfold [µa. A] v1 ,! v2

��������������

{a = v}.a ,! v

Figure 7.8: Small-step semantics.
Lemma 91 (Determinism of ,!). If G ` e ,! A and e ,! e1 and e ,! e2 then e1 = e2 .
Proof. By induction on e ,! e1 .

7.4.4

Type safety

We prove type safety following a similar approach to the previous work by Huang, Zhao, andOliveira [77], and by showing progress and preservation theorems. The following lemmas andtheorems show that our system is type-safe.
Theorem 92 (Preservation). If ` e1 , A and e1 ,! e2 then ` e2 ( A.
Proof. By induction on ` e1 , A.
Lemma 93 (Progress of ,! A ). If ` v1 ( A then 9v2 , v1 ,! A v2 .
Proof. By induction on A.
Theorem 94 (Progress). If ` e1 , A then e1 is a value or 9e2 , e1 ,! e2 .
Proof. By induction on ` e1 , A.

102

Chapter 7. A Calculus with the Merge Operator
Table 7.1: Paper-to-proofs correspondence guide in Chapter 7.

De�nition
Well-formed Type (Figure 7.1)
Toplike type (Figure 7.2)
Subtyping (Figure 7.2)
Disjointness (Figure 7.4)
Disjointness (De�nition 83)
Lower common supertype (Figure 7.5)
Typing (Figure 7.6)
Casting (Figure 7.7)
Reduction (Figure 7.8)

File
def_typ.v
def_typ.v
def_typ.v
def_typ.v
disjoint.v
lub.v
def_exp.v
def_exp.v
def_exp.v

Name in Coq
WFS E A
toplike E A
Sub E A B
dis E A B
disjointSpec E A B
Lub E A B
typing E e A
typ_reduce e1 A e2
step e1 e2Notation
G`A
e Ad
G`AB
G ` A⇤B
G ` A ⇤s B
AtB
G`e:A
e1 ,! A e2
e1 ,! e2

Table 7.2: Descriptions for the proof scripts in Chapter 7.
Theorems
Theorem 79
Theorem 80
Theorem 82
Lemma 81
Lemma 84
Lemma 87
Lemma 90
Lemma 91
Theorem 92
Lemma 93
Theorem 94

7.5

Description
Re�exivity
Transitivity
Decidability
Unfolding Lemma
Soundness of disjointness
Completeness of disjointness
Determinism of Casting
Determinism of Reduction
Preservation
Progress of Casting
Progress

Files
infra.v
infra.v
decidability.v
unfolding.v
disjoint.v
disjoint.v
typereduce.v
progress.v
typesafety.v
progress.v
typesafety.v

Name in Coq
Re�exivity
Transitivity
decidability
unfolding_lemma
disjoint_soundness
disjoint_completenessTypedReduce_unique
step_uniquepreservation
TypedReduce_progress
progress

Mechanized Proofs

The folder coq_merge includes all the Coq proofs about STLC extended with iso-recursive subtyping, intersection types and merge operator, which is the calculus described in this chapter.

7.5.1

De�nitions

Table 7.1 shows the correspondence of de�nitions between the paper and the Coq artifacts. File
def_typ.v contains de�nitions regarding types and some infrastructure lemmas for the locallynameless representation. Note that in the coq proof, the toplike relation is a pair of a context
and a type, which is di�erent from the paper. In the paper, for readability, the context is omitted,
instead, we use the notation e Ad to denote the relation. File lub.v contains de�nitions of lower
common supertypes and lemmas regarding them. File def_exp.v contains de�nitions regarding
expressions and some infrastructure lemmas for the locally nameless representation.

7.5.2

Lemmas and theorems

Table 7.2 shows the descriptions for all the proof scripts in Chapter 7.

103

Chapter 8

Calculus with Bounded
Quanti�cation
In this chapter an extension of kernel F , called F , with iso-recursive types, is presented. Fµis a well-known polymorphic calculus with bounded quanti�cation. In F we add iso-recursiveµtypes, and correspondingly extend the subtyping relation with iso-recursive subtyping using
the recently proposed nominal unfolding rules. We also add two smaller extensions to F .
The �rst one is a generalization of the kernel F rule for bounded quanti�cation that accepts

equivalent rather than equal bounds. The second extension is the use of so-called structural
folding/unfolding rules, inspired by the structural unfolding rule proposed by Abadi et al. [3].
The structural rules add expressive power to the more conventional folding/unfolding rulesin the literature, and they enable additional applications. We present several results, including: type soundness; transitivity and decidability of subtyping; the conservativity of F overµF ; and a sound and complete algorithmic formulation of F . Moreover, we study an extenµsion of F with both top and bottom types, and both upper and lower bounds instead of theµconventional (upper) bounded quanti�cation of F .

8.1

Overview

Both bounded quanti�cation and recursive types are the prominent features in many modern
programming languages, such as Java, Scala or TypeScript. The classic application for bothfeatures is encodings of objects [28]. In addition, the two features are useful to model encodingsof algebraic datatypes with subtyping.

8.1.1

Object encodings

A simple and well-known typed encoding of objects is the recursive records encoding [28, 29,49]. In this encoding the idea is that object types are encoded as recursive record types, andobjects are encoded as records. We will use a simpli�ed form of the encoding, where we do
not deal with self-references. But self-references could be dealt with in standard ways. For

104

Chapter 8. Calculus with Bounded Quanti�cation

example, we can de�ne a type Point:
Point , µ pnt.{x : Int, y : Int, move : Int ! Int ! pnt}
which consists of its coordinates and a move function. We use a recursive type because moveshould return an updated point. To implement Point we de�ne some auxiliary functions:function getX ( p : Point ) = ( unfold [ Point ] p ) . x
function getY ( p : Point ) = ( unfold [ Point ] p ) . yfunction moveTo ( p : Point , x : Int , y : Int ) = ( unfold [ Point ] p ). move x ythen a constructor mkPoint can be de�ned as:function mkPoint ( x 1 : Int , y 1 : Int ) = fold [ Point ] { x = x 1 , y = y 1 ,move = lx 2 y 2 . mkPoint ( x 2 , y 2 ) }Note that the auxiliary functions above would not be needed in a source language, since asource language would treat p.x as syntactic sugar for (unfold [Point] p).x. Similarly, the source
language would automatically insert a fold in the object constructor. In other words, in a source
language with iso-recursive subtyping the fold’s and unfold’s do not need to be explicitly written and are automatically inserted by the compiler. For instance, this is what Abadi, Cardelli,and Viswanathan [3]’s translation of a language with objects into an iso-recursive extensionof F does.
With subtyping, we can develop subtypes of Point, such as:
ColorPoint , µ pnt.{x : Int, y : Int, move : Int ! Int ! pnt, color : String}

EqPoint , µ pnt.{x : Int, y : Int, move : Int ! Int ! pnt, eq : pnt ! Bool}Now we wish to translate the coordinates by one unit for a point, but we do not want to write
such a translation function for all subclasses of Point. This is achieved with a polymorphic
function:function translate [ P  Point ] ( p : P ) = ( unfold [ Point ] p ) . move( getX p + 1) ( getY p + 1)

The type of this translate function is 8(P  Point). P ! Point, which is obtained from thefollowing typing derivation (some parts ommited):

P  Point, p : P ` p : P
P  Point, p : P ` P  PointP  Point, p : P ` p : Point()
x : Int, y : Int,P  Point, p : P ` (unfold [Point] p) :move : Int ! Int ! Point����������
�������������
...

` translate : 8(P  Point). P ! Point

In the derivation, the conventional unfolding rule is used. Recall the traditional typing
rules for folding and unfolding recursive types:

105

8.1. Overview�������������

�������������

G ` e : µa. A

G ` unfold [µa. A] e : [a 7! µa. A] A

G ` e : µa. A

G ` unfold [µa. A] e : [a 7! µa. A] A

In both the rule ������������� and rule ����������� the annotation must be a recursive type.
However, this type is unsatisfying because it loses type precision: it returns a Point instead ofa P. The type that we want instead is:8(P  Point). P ! P
Unfortunately, it is impossible to obtain this more general type with only bounded quanti�cation, and the conventional unfolding rule �������������. If we wish to return P, then weshould be able to use unfold with the annotation P, which is not a recursive type, but rathera type variable. Some advanced techniques, such as f-bounded quanti�cation [29], have been
proposed to address this issue. F uses a less intrusive approach to achieve the desired typingµfor translate, namely the structural rules, which contains��������������

��������������

G`e:A

G`e:A

G ` A  µa. BG ` unfold [A] e : [a 7! A] B

G ` A  µa. BG ` unfold [A] e : [a 7! A] B

The key point about the structural rules is that the annotations are generalized to be a subtype/supertype of a recursive type, instead of exactly a recursive type. In particular, this generalization enables annotating fold/unfold with a bounded type variable, which is a subtype/supertypeof a recursive type. This is forbidden in the traditional rules. In the rule ��������������, itis worthwhile to mention that when we have A  µa. B where a appears negatively in B,

then there are very limited choices to what A can be. Essentially it can be µa. B itself andlittle else. In other words, negative recursive types have very restricted subtyping, which is
why the structural unfolding rule can be type safe. Note also that, since the structural unfolding rules provide almost no �exibility for negative recursive subtyping, they are insu�cient tofully express f-bounded quanti�cation for negative recursive types.

8.1.2

Encoding positive f-bounded quanti�cation

Fortunately, with the structural rules, we are allowed to use a type variable as an annotation for
unfold. This enables us to encode forms of f-bounded quanti�cation with positive occurrencesof recursive variables, which is the case for the Point recursive type. For example, we canchange the unfold annotation in translate from the recursive type Point to its subtype, thebounded universal type variable P, as follows:
function translate [ P  Point ] ( p : P ) = ( unfold [ P ] p ) . move (getX p + 1) ( getY p + 1)

After this change the type of translate is 8(P  Point). P ! P, as the derivation shows:

106

Chapter 8. Calculus with Bounded Quanti�cation��������������
...

P  Point, p : P ` p : P

P  Point, p : P ` P  Point()
x : Int, y : Int,P  Point, p : P ` (unfold [P] p) :move : Int ! Int ! P` translate : 8(P  Point). P ! P

Then we can apply translate to Point or any of its subtypes, without losing static precision.
Thus, if we call translate [EqPoint] (mkEqPoint 0 0), then we obtain an EqPoint object at (1, 1).
Note that here mkEqPoint is a constructor for objects with type EqPoint, which contain abinary method [25] eq.
function mkEqPoint ( x 1 : Int , y 1 : Int ) = fold [ EqPoint ]{ x = x 1 , y = y 1 , move = lx 2 y 2 . mkEqPoint ( x 2 , y 2 ) , eq = lp . (getX p == x 1 ) ^ ( getY p == y 1 ) }8.1.3

Encodings of algebraic datatypes

It is well-known that in the polymorphic lambda calculus (System F) [67, 107], we can use
Church encodings [45] to encode algebraic datatypes [22]. However, Church encodings make it
hard to encode some operations, or worst they can prevent the encoding of certain operations
with the correct time complexity. A well-known example of this, due to Church himself, isthe encoding of the predecessor function on natural numbers, which has to be a linear time
operation with Church encodings instead of a constant time operation.
An alternative encoding of datatypes in the untyped lambda calculus, which avoids theissues of Church encodings, is due to Scott [110]. Unfortunately, Scott encodings cannot be
encoded in plain System F. However, the addition of recursive types to a polymorphic lambda
calculus allows a typed encoding for Scott encodings [93]. Moreover, in the presence of subtyping, we can also encode algebraic datatypes with subtyping, enabling certain forms of reusethat are not possible without subtyping. Oliveira [90] has shown this assuming a F -like language with recursive types, records and higher kinds, but he has not formalized such a language. Here we revisit Oliveira’s example. A similar encoding for datatypes can be achieved inF . For example, one may de�ne a datatype Exp1 for mathematical expressions, with numeric,µaddition, and subtraction constructors:

data Exp 1 = Num Int | Add Exp 1 Exp 1 | Sub Exp 1 Exp 1

The encoding in F of this datatype can be de�ned as follows:µExp1 , µE. 8A. {num : Int ! A, add : E ! E ! A, sub : E ! E ! A} ! A
If we unfold the recursive type, this encoding is indeed a polymorphic higher order function
and takes a record with three �elds (num, add and sub) as input. Each �eld corresponds to a
constructor in the datatype de�nition. This encoding is particularly useful for case analysis,
since the polymorphic function essentially encodes case analysis directly. To write a functionthat performs case analysis on this datatype, one can unfold the recursive type, instantiate
A with the result type, and then provide a record that maps each case to its implementation

107

8.1. Overview

function that takes the constructor components as input and returns a result of type A. For
example, given a datatype instance e typed Exp1 , a case analysis-based evaluation function canbe written as:function eval ( e : Exp 1 ) = ( unfold [ Exp 1 ] e ) [ Int ]{ num = ln . n ,add = le1 e2 . eval e1 + eval e2 ,sub = le1 e2 .

eval e1 - eval e2 }where we use [. . .] to represent type instantiation. Here Exp1 is instantiated with the evaluation

result type Int. A record of three functions is supplied to implement case analysis. The num�eld implements a function that returns the integer component n of Num constructor directly,
while the functions in add and sub �elds perform the evaluation process recursively.
To construct concrete instances of the datatype, each constructor also comes with a corresponding encoding in the calculus:
function Num 1 ( n : Int ) = fold [ Exp 1 ] (L A . l e . ( e . num n ) )function Add 1 ( e 1 : Exp 1 , e 2 : Exp 1 ) = fold [ Exp 1 ] (L A . l e . ( e .
add e 1 e 2 ) )function Sub 1 ( e 1 : Exp 1 , e 2 : Exp 1 ) = fold [ Exp 1 ] (L A . l e . ( e .
sub e 1 e 2 ) )One can easily check, using rule �����������, that the result type of each constructor
encoding becomes Exp1 after a recursive type folding. Therefore, in this encoding, the use of

constructors and case analysis functions is natural: one can construct the expression 1 + 2
directly with the encoded constructors as Add1 (Num1 1) (Num1 2), and get its evaluation
result by calling eval (Add1 (Num1 1) (Num1 2)).

8.1.4

Subtyping between datatypes

Now consider a larger datatype Exp2 , which extends the Exp1 datatype with a new constructor
Neg, for denoting negative numbers.

data Exp 2 = Num Int | Add Exp 2 Exp 2 | Sub Exp 2 Exp 2 | Neg Exp 2

This datatype is encoded in F as:µExp2 , µE. 8A. {num : Int ! A, add : E ! E ! A, sub : E ! E ! A, neg : E ! A} ! A
The datatype Exp2 di�ers from Exp1 only in the new constructor. However, other constructors are just the same. To reduce code duplication, polymorphism on datatype constructors isdesirable. Note that Exp2 has more constructors than Exp1 , so it should be safe to coerce Exp1

expressions into Exp2 expressions, i.e. Exp1  Exp2 . Therefore, we would like the constructor
for Add to have the following type, so that both Exp1 and Exp2 can use this constructor:
Add8 : 8(EExp1 ). E ! E ! E

108

Chapter 8. Calculus with Bounded Quanti�cation

There are two problems here. Firstly, similarly to the issue that we have faced in the translatefunction, we would like to use a type variable in the fold’s of the constructors. This way
we can make the constructors polymorphic. Secondly, as evidenced by the desired type for
Add, we need lower bounded quanti�cation, but in F (and F ) we only have upper boundedµquanti�cation.

8.1.5

Polymorphic constructors with lower bounded quanti�cation

For applications such as encodings of algebraic datatypes, the dual form of bounded quanti�cation (lower bounded quanti�cation) seems to be more useful. Thus we have an extended sysµtem, called F , that has both upper and lower bounded quanti�cation. Polymorphic datatypeconstructors become typeable with the structural folding rule. For example, we can encode thepolymorphic Add constructor as:function Add 8 [ Ee . add e 1 e 2 ) )Exp 1 ] ( e 1 : E , e 2 : E ) = fold [ E ] (L A . l e . (With lower bounded quanti�cation and the structural folding rules we can get the correct
typing for the polymorphic Add constructor:···E������������

8
9>>< num : Int ! A,=
Exp1 , e1 : E, e2 : E ` LA. le. (e.add e1 e2 ) : 8A.
!A
add : E ! E ! A,>>:;
sub : E ! E ! A...

E

Exp1 , e1 : E, e2 : E ` fold [E] (LA. le. (e.add e1 e2 )) : E` Add8 : 8(E Exp1 ). E ! E ! E

Other polymorphic constructors such as Num8 and Sub8 can be encoded similarly.

With polymorphic datatype constructors, more useful programming patterns can be further exploited. For example, if we want to implement a compiler that uses Exp1 as its corelanguage, but also want to support richer datatype constructors in a source language like Exp2

does, we would like to be able to reduce code duplication across the two similar languages. For
instance, if we de�ne a pretty printer function for Exp2 :function print (e: Exp 2 ) = ( unfold [ Exp 2 ] e) [ string ] {num = l n . ( int_to_string n ) ,add = l e 1 e 2 . (( print e 1 ) ++ "+" ++ ( print e 2 ) ) ,sub = l e 1 e 2 . (( print e 1 ) ++ " -" ++ ( print e 2 ) ) ,neg = l e . (" -" ++ ( print e ) )}It should be natural to use this function to print Exp1 expressions as well, since all the con-structors in Exp1 are also in Exp2 and have their pretty printing methods de�ned in the above

function. In fact, with subtyping between algebraic datatypes, it holds that Exp1  Exp2 , so it

is safe in our encodings to apply this print function to values of type Exp1 , without requiring
another pretty printing function for Exp1 .

109

8.1. Overview

Suppose that we wish to implement a simple desugaring function that transforms Exp2

into Exp1 , by transforming negative numbers

n into subtractions 0

n. This function should

do case analysis on Exp2 and use only the constructors in Exp1 to produce the result, i.e. it
should have a type Exp2 ! Exp1 . The following code can have the desired precise typing
naturally with polymorphic datatype constructors:

function desugar (e: Exp 2 ) = ( unfold [ Exp 2 ] e) [ Exp 1 ] {num = l n . Num 8 [ Exp 1 ] n ,add = l e 1 e 2 . Add 8 [ Exp 1 ] ( desugar e 1 ) ( desugar e 2 ) ,sub = l e 1 e 2 . Sub 8 [ Exp 1 ] ( desugar e 1 ) ( desugar e 2 ) ,}neg = l e . Sub 8 [ Exp 1 ] ( Num 8 [ Exp 1 ] 0) ( desugar e )In contrast, in many practical programming languages this task either involves code duplication or loss of type precision. In a typical functional language, we can de�ne both Exp1 andExp2 and also obtain precise static typing guarantees for the desugar function. But this comesat the cost of duplication, since the constructors for the two datatypes are di�erent, and many

operations, such as pretty printing need to be essentially duplicated. In F , in addition toµpolymorphic constructors, we would just need to de�ne the pretty printer for Exp2 , and thatfunction would also work for Exp1 . Alternatively, one could de�ne only Exp2 and type desugarwith the imprecise type Exp2 ! Exp2 , which does not statically guarantee that the Neg con-structor has been removed. This solution avoids the duplication at the cost of static typing
guarantees. In Fµwe do not need such compromise: we can avoid code duplication andpreserve the static typing guarantees.

8.1.6

µ

F : kernel F with iso-recursive types

As Chapter 1.1.4 mentioned, no previous calculi with bounded quanti�cation and recursive
types are fully satisfactory. Equi-recursive types are quite problematic, since they can change
the expressive power of the subtyping relation in unexpected ways. More importantly, adding
equi-recursive subtyping to F requires novel algorithms, and the extension is non-modular,requiring several changes to existing de�nitions and proofs.

Our type system directly combines kernel F and the nominal unfolding rules together.

Surprisingly, more or less, these two rules are orthogonal in our system. The addition of thenominal unfolding rules has almost no e�ect in the original proofs in kernel F . That is theproofs for important lemmas, such as transitivity, are nearly the same as those in kernel F ,except that we need a new case to deal with recursive types. Thus proofs that have been very
hard in the past, such as transitivity, are very simple in F .
µ

The more challenging aspect in the metatheory of F lies in the unfolding lemma:µ

G ` µa. A  µa. B)

G ` [a 7! µa. A] A  [a 7! µa. B] B

which reveals an important property for iso-recursive types: if two iso-recursive types are
subtypes, then their one-step unfoldings are also subtypes. To prove the unfolding lemma, a110Chapter 8. Calculus with Bounded Quanti�cation

generalized lemma is needed, as explained in Chapter 4.4. In F , we show that the previousµ

generalized approach is insu�cient, due to bounded quanti�cation. Therefore, a more generallemma is proposed.
Another challenge is decidability. Although both kernel F and the nominal unfolding

rules (for simple calculi) have been independently proved decidable, their decidability proofs
use very di�erent measures. A natural combination is problematic, thus we need a new approach.
After overcoming those challenges, we will see that, F performs well in various dimenµsions: it is transitive, decidable, conservative and modular. Furthermore, there is a simple,
sound and complete algorithmic type system to enable implementations, and to provide important help in the proofs of results such as conservativity of typing.
Finally, we have also formalized an extension of F with bottom and lower bounded quanµµti�cation, called F

. All the same results that are proved for F are also proved for F ,µµincluding transitivity, decidability and type soundness.

8.2

Bounded Quanti�cation with Iso-Recursive Types

This section introduces a full calculus, called F , with bounded quanti�cation, records andµµrecursive types. F is an extension of kernel F [37] with iso-recursive types.

8.2.1

Syntax and Well-Formedness

The syntax of types and contexts for F is shown below.
µ

Types

A, B, . . .

::=Expressions

e::=

Valuesv

Contexts

G

::=
::=

nat | > | A1 ! A2 | a | µa. A | Aa | 8(a  A). B| {li : Ai i21···n }x | i | e1 e2 | lx : A. e | e A | L(a  A). e| unfold [ A] e | fold [ A] e | {li = ei i21···n } | e.l
i | lx : A. e | fold [ A] v | L(a  A). e | {li = vi i21···n }· | G, a  A | G, x : A

Meta-variables A, B, C, D range over types. Types consist of: natural numbers (nat), the top
type (>), function types (A ! B), type variables (a), recursive types (µa. A), labelled types(Aa ), universal types (8(a  A). B), and record types ({li : Ai i21···n }). Labelled types

are types that are annotated with a type variable. They are used for dealing with subtypingof iso-recursive types as part of the nominal unfolding approach. Expressions, denoted bymeta-variable e, include: term variables (x), natural numbers (i), applications (e1 e2 ), abstrac-

tions (lx : A. e), type applications (e A), type abstractions (L(a  A). e), fold expressions(fold [ A] e), and unfold expressions (unfold [ A] e), records ({li = ei i21···n }) and record selec-tion (e.l). Among them, natural numbers, abstractions and type abstractions are values. Fold
expressions and records can be values if their inner expressions are also values. The context isused to store type variables with their bounds, and term variables with their types. Note that
it is unnecessary to distinguish recursive variables and universal variables.

111

8.2. Bounded Quanti�cation with Iso-Recursive Types
G`A(Well-formed Type)�������

����T��

G ` natG`>���������

��������

�������G ` A1G ` A2G ` A1 ! A2�������

aA2G
G`a

G`A
G, a  A ` B
G ` 8(a  A). B
�������

����������

G, a ` A
G ` µa. A

G ` AiG`A
G ` AaG ` {li : Ai i21···n }G`AB(Subtyping)

S����

`G
G ` nat  nat

S����

`G
G`A
G`A>

S����

S������

`G
G`a
G`aa

G ` B1  A1
G ` A2  B2
G ` A1 ! A2  B1 ! B2

S�����

S�������

G, a  > ` [a 7! Aa ] A  [a 7! Ba ] BG ` µa. A  µa. B

G`AB
G ` Aa  Ba

S��������

S���������G ` A1  A2
G ` A2  A1
G, a  A2 ` B  C
G ` 8(a  A1 ). B  8(a  A2 ). C
S����

`G

for each i

G ` {k j : A j j21···m }

G`BA
aB2G
G`aA

{li i21···n } ✓ {k j j21···m }G ` {k j : A j

j21···m}  { l i : Bii 21···nk j = li implies G ` A j  Bi}

Figure 8.1: Well-formedness and subtyping rules.
The de�nition of a well-formed environment ` G is standard, ensuring that all variablesin the environment are distinct and all types in the environment are well-formed. The top of
Figure 8.1 shows the judgement for well-formed types. A type is well-formed if all of its freevariables are in the context. The rules of this judgement are straightforward.

8.2.2

Subtyping

The bottom of Figure 8.1 shows the subtyping judgement. Our subtyping rules are mostly
standard. The rules essentially include the rules of the algorithmic version of kernel F [37,35], but the rule for bounded quanti�cation is generalized. The rules S���� and S���������
are standard F rules. Note that since we do not distinguish universal and recursive variables,

those rules apply also to recursive type variables. The rule for function types (rule S������)is contravariant on the input types and covariant on the output types.
The rule for bounded quanti�cation is interesting, stating that two universal types are
subtypes if their bounds are equivalent (i.e. they are subtypes of each other) and the bodies
are subtypes. Note that rule S�������� is more general than rule S���������� since the latter
one requires the bounds are equal. The reason to have the more general rule using equivalent

112

Chapter 8. Calculus with Bounded Quanti�cation

bounds is that, for records, we wish to accept subtyping statements such as:8(a  { x : nat, y : nat}). a ! a  8(a  {y : nat, x : nat}). a ! awhere the bounds can be syntactically di�erent, but equivalent types. In the presence of records
or other features (such as intersection and union types [104, 51, 15]) we can have such equivalent, but not syntactically equal types. Therefore, we should generalize the rule for bounded
quanti�cation do deal with those cases. This generalization to equivalent bounds retains decidable subtyping just as kernel F as we shall see in Chapter 8.3.2.
For dealing with iso-recursive subtyping we employ the nominal unfolding rules (rule S���������), which have equivalent expressive power to the iso-recursive Amber rules. The
nominal unfolding rules have been discussed in Chapter 4.5. The reason to choose the nominal
unfolding rules is that they enable us to prove important metatheoretical results easily, suchas transitivity and develop an algorithmic formulation of subtyping.
We extend the rule S��������� to the rule S����� in F , by bounding recursive variablesµwith > when they are introduced into the context.

Therefore, recursive variables are also treated as universal variables, and we do not needµ
to adjust the form of contexts in F for F . Apart from this, no other changes are necessary,
making the addition of recursive types mostly non-invasive. Consequently, the proofs of nar-rowing, re�exivity and transitivity are the same as the original one for F , except for the newcases dealing with recursive types and minor adjustments to the rule of bounded quanti�cation
due to the generalization to equivalent bounds.
Lemma 95 (Narrowing). If G1 ` C  C 0 and G1 , a  C 0 , G2 ` A  B then G1 , a  C, G2 `A  B.

Theorem 96 (Re�exivity). If ` G and G ` A then G ` A  A.

Theorem 97 (Transitivity). If G ` A  B and G ` B  C then G ` A  C.

Another important lemma is the unfolding lemma, which reveals that: if two recursive

types are subtypes, then their unfoldings are also subtypes. The unfolding lemma is importantfor proving preservation in a system with iso-recursive subtyping. A key di�culty in theformalization of F is proving the unfolding lemma which, due to the presence of boundedµquanti�cation, requires a di�erent proof technique compared to the proofs in Chapter 4. We
discuss the proof of the unfolding lemma in Chapter 8.3.1.
Lemma 98 (Unfolding Lemma). If G ` µa. A  µa. B then G ` [a 7! µa. A] A  [a 7!
µa. B] B.

8.2.3

Type Soundness

Figure 8.2 and 8.3 show the typing rules and reduction rules. Most rules are standard except for
the typing rule for unfold and fold. For these two expressions we use structural rules instead(rule �������������� and rule ������������), as we explained in Chapter 8.1.6.

113

8.2. Bounded Quanti�cation with Iso-Recursive Types
G`e:A(Typing)����������`GG ` i : nat����������

`G����������

����������

x:A2G
G`x:A

G, x : A1 ` e : A2
G ` lx : A1 . e : A1 ! A2��������������G`e:A
G ` A  µa. BG ` unfold [A] e : [a 7! A] B
�����������

G ` e : {li : Ai i21···n }G ` e.li : Ai�����������

G ` e : 8(a  B1 ). B2
G ` A  B1
G ` e A : [a 7! A] B2

G`e:A
G`AB
G`e:B

������������

G ` e : [ a 7 ! B] A
G ` µa. A  B
G ` fold [B] e : B����������

G ` e1 : A1 ! A2
G ` e2 : A1
G ` e1 e2 : A2

�����������

G, a  A ` e : B
G ` L(a  A). e : 8(a  A). B
����������

for each i

G ` { l i = eii 21···n

G ` ei : Ai

} : {li : Ai i21···n }Figure 8.2: Typing Rules.
Structural unfolding lemma

Since the typing rules that we adopt for fold/unfold expres-sions are the structural rules, which generalize the conventional rules, we need a more generalform for the unfolding lemma. The generalization of the lemma is necessary for the type preservation proof with the structural folding/unfolding rules. We call the new lemma the structural
unfolding lemma:
Lemma 99 (Structural unfolding lemma). If G ` µa. A  µa. C  µa. D  µa. B thenG ` [a 7! µa. C ] A  [a 7! µa. D ] B.

Proof. By applying transitivity (Theorem 97) to the 3 conditions below:
1. G ` µa. A  µa. C implies G, a  > ` A  C by Lemma 107, implies G ` [a 7!
µa. C ] A  [a 7! µa. C ] C by substitution lemma.

2. G ` µa. C  µa. D implies G ` [a 7! µa. C ] C  [a 7! µa. D ] D by unfolding lemma(Lemma 98).

3. G ` µa. D  µa. B implies G, a  > ` D  B by Lemma 107, implies G ` [a 7!
µa. D ] D  [a 7! µa. D ] B by substitution lemma.

In this lemma, in the one-step unfolding the recursive types substituted in the bodies are,respectively, a supertype and a subtype of µa. A and µa. B. In contrast, in the unfolding
lemma in previous chapters (Lemma 8, 26, 81, etc.), the recursive types that get substituted in

114

Chapter 8. Calculus with Bounded Quanti�cation

e1 ,! e2

(Reduction)���������

���������

���������

e1 ,! e10e1 e2 ,! e10 e2(lx : A. e1 ) v2 ,! [ x 7! v2 ] e1

e2 ,! e20v1 e2 ,! v1 e20

�����������

��������

unfold [A] (fold [B] v) ,! v
���������

e ,! e0
unfold [A] e ,! unfold [A] e0

e ,! e0fold [A] e ,! fold [A] e0���������

���������

e1 ,! e2
e1 A ,! e2 A���������

(L(a  A). e) B ,! [a 7! B] ee ,! e0
e.l j ,! e0 .l j������������

{li = vi i21···n }.l j ,! v j��������

e j ,! e0j{li = vi i21··· j 1 , l j = e j , lk = ek k2 j+1···n } ,! {li = vi i21··· j 1 , l j = e0j , lk = ek k2 j+1···n }Figure 8.3: Reduction Rules.
the bodies are the same. As Chapter 8.3.1 will discuss, both forms of the unfolding lemma canbe proved using a more general lemma.
Type Soundness

To see how the structural unfolding lemma is used in the proof of typepreservation, assume that C 0 is µa. C and D 0 is µa. D, let us consider such expression unfold[ D 0 ](fold[C 0 ] e).

������������

G ` e : [a 7! C0 ] A����������

G ` µa. A  C 0

G ` fold[C ] e : C 0��������������

G ` fold[C ] e : D 0

G ` C0  D0

G ` D 0  µa. BG ` unfold[ D 0 ](fold[C 0 ] e) : [a 7! D 0 ] BStarting from a closed expression, both C 0 and D 0 must be recursive types. The type of

unfold[ D 0 ](fold[C 0 ] e) becomes [a 7! µa. D ] B, and it should be a subtype of [a 7! µa. C ] A,
which is the type of reduction result e.

The other parts of the type soundness proof are standard, thus we have:
Theorem 100 (Preservation). If ` e : A and e ,! e0 then ` e0 : A.

Theorem 101 (Progress). If ` e : A then e is a value or exists e0 , e ,! e0 .

8.2.4

Algorithmic typing

The rules that we have presented in Figure 8.2 are declarative. The subsumption rule overlaps
in type syntax with all other rules, making it non-trivial to derive an implementation from therules.

115

8.2. Bounded Quanti�cation with Iso-Recursive TypesG`A*B(Upper Exposure)
XA��������aA2GG`A * BG`a * BXA���A is not type variableG`A * AG`A+B

(Lower Exposure)
XA�����

XA����

A is not type variable or >G`A + AG ` > + µa. >G `a e : A(Algorithmic Typing)��������

G `a e1 : A���������G ` A * A1 ! A2
G `a e2 : B
G `a e1 e2 : A2

G `a e : B

G ` B * 8(a  B1 ). B2
G ` a e A : [ a 7 ! A ] B2

G ` B  A1

G ` A  B1������������

G `a e : A
G ` B * µa. C
G`ABG `a unfold [B] e : [a 7! B] C����������

G `a e : A

G ` C + µa. B
G ` A  [ a 7 ! C] B
G `a fold [C] e : C
Figure 8.4: Algorithmic Typing.

Figure 8.4 shows the algorithmic rules for typing. We only present new rules and rulesthat di�er from Figure 8.2. Compared with the declarative typing rules, the subsumption
rule (����������) is removed. Besides, application (����������), type application (�����������), structural folding (������������) and structural unfolding (��������������) rules are
replaced by rules ��������, ���������, ���������� and ������������, respectively. In thealgorithmic typing rules we take the standard approach of distributing subtyping checks inappropriate places in the other rules, thus eliminating the need for the subsumption rule.
One interesting point is the two exposure relations * and + in F . In F , there is onlyµthe upper exposure function (G ` A * B), which is used to �nd the least non-variable upperbound for a variable in the context [100]. Thus, the upper exposure function plays an importantrole for �nding the minimal type with the algorithmic typing rules. To make our rules moregeneral, we additionally de�ne the lower exposure function (G ` A + B) to �nd the greatest

non-variable subtype B for A. For F , lower exposure only helps to �nd the correct shape forµ

the recursive type body to be folded in rule ���������� by mapping > to µa. >. The lower
exposure function will be more useful when we have lower bounded variables in the system,
as we will see in Chapter 8.4.

116

Chapter 8. Calculus with Bounded Quanti�cation
The algorithmic rules are equivalent (sound and complete) with respect to the declarative

rules:
Theorem 102 (Soundness of the algorithmic rules). If G ` a e : A then G ` e : A.

Theorem 103 (Completeness of the algorithmic rules). If G ` e : A then there exists a B suchthat G ` a e : B and G ` B  A.

Theorem 103 implies that our algorithm can always �nd a minimal type, which is an

important property for F .
µ

8.3

µ

Metatheory of F

In this section we discuss the most interesting and di�cult aspects of the metatheory of Fµin more detail. We cover three key properties: the unfolding lemma, decidability of subtyping
and the conservativity of F over the original F . The interaction between iso-recursive typesµand bounded quanti�cation requires signi�cant changes in the proofs of the unfolding lemmaand decidability. In addition, conservativity cannot be proved using a declarative formulationof F , and we need to employ the algorithmic formulation instead.
µ

8.3.1

Unfolding lemma

The unfolding lemma (Lemma 98) is a core lemma for the metatheory of a calculus with isorecursive subtyping. Though the statement of the unfolding lemma is quite simple and intuitive
to understand, the lemma cannot be proved directly. We will �rstly review the previous approach to prove the unfolding lemma, which does not account for bounded quanti�cation, andthen show how to transfer this approach to a system with bounded quanti�cation.
The previous approach for proving the unfolding lemma.

Because the premise of theunfolding lemma is a subtyping relation between two recursive types µa. A  µa. B, a direct
induction on such subtyping relation is problematic. Thus, we need to prove a generalized
lemma �rst. Following the idea from Chapter 4 that lemma would have the following form:
Lemma 104 (The generalized unfolding lemma for nominal unfoldings in Chapter 4). If wehave G1 , a, G2 , ` A  B and G1 ` µa. C  µa. D then

1. G1 , a, G2 ` [a 7! C a ] A  [a 7! D a ] B implies G1 , G2 ` [a 7! µa. C ] A  [a 7!
µa. D ] B;

2. G1 , a, G2 ` [a 7! D a ] A  [a 7! C a ] B implies G1 , G2 ` [a 7! µa. D ] A  [a 7!
µa. C ] B.

Due to the tricky interaction between rule S���� and rule S������, in the generalized unfolding lemma we need two mutual dependent lemmas: one is used for covariant cases (1) and theother one is used for contravariant cases (2). The proof for this lemma proceeds by induction
on G1 , a, G2 , ` A  B. In the inductive proof we need to switch between covariance andcontravariance. In particular, in the rule S������ case for functions, we need an induction

117

µ

8.3. Metatheory of F

hypothesis that arises from conclusion (2) to prove the contravariant premise G ` B1  A1
relating the input types of the function.

For the generalized unfolding lemma in F , Lemma 104 is unfortunately not generalµenough. In a setting with bounded quanti�cation, G2 may contain bounds with the type vari-able a, and those variables are not being substituted in Lemma 104. Let us consider the e�ectof adding rule S���������. In the conclusion of Lemma 104, the variable a is substituted byanother type and tracked in the context G2 . In the premises of rule S���������, we need to�nd the upper bound of variable a in the contexts G1 and G2 . With those two observations, in
our new attempt, the context also needs to do substitutions. Thus, a natural attempt to solve
this problem is to reformulate the lemma into the following form (for the covariant case (1)):
Proposition 105 (A �rst attempt at the generalized unfolding lemma). If G1 , a  >, G2 , `A  B and G1 ` µa. C  µa. D then G1 , a  >, G2 [a 7!?a ] ` [a 7! C a ] A  [a 7! D a ] B

implies G1 , G2 [a 7! µa. ?] ` [a 7! µa. C ] A  [a 7! µa. D ] B.

Here, the syntax G[a 7! S] denotes that all the occurrences of a in context G will be replaced
by a speci�ed type S. However, we do not know yet what type should be �lled in the hole ?

in Proposition 105, so we leave the hole there for now. Although we omit conclusion (2) in
Proposition 105, similar reasoning applies to that conclusion.
Let us now consider the e�ect of adding the rule S��������: Assume that A := 8( b 

U1 ). T1 and B := 8( b  U2 ). T2 . The goal would look like:

G1 , G2 [a 7! µa. ?] ` [a 7! µa. C ] 8( b  U1 ). T1  [a 7! µa. D ] 8( b  U2 ). T2
After simpli�cation and applying rule S��������, one of the goals becomes:
G1 , G2 [a 7! µa. ?], b  [a 7! µa. D ] U2 ` [a 7! µa. C ] T1  [a 7! µa. D ] T2
From the above, we would expect that the hole ? is �lled with D because all the substitutions in
the context must be the same in order to apply induction hypothesis. Thus, a second attempt
at the generalized unfolding lemma looks like:
Proposition 106 (The second attempt at the generalized unfolding lemma (1)). If G1 , a >, G2 , ` A  B and G1 ` µa. C  µa. D then G1 , a  >, G2 [a 7! D a ] ` [a 7! C a ] A [a 7! D a ] B implies G1 , G2 [a 7! µa. D ] ` [a 7! µa. C ] A  [a 7! µa. D ] B.

Proposition 106 deals with rule S��������� and S�������� successfully. However, the function case, which is correctly proven in Lemma 104, will break. Consider A := A1 ! A2 andB := B1 ! B2 , and apply rule S������. We need to prove two subgoals:
1. G1 , G2 [a 7! µa. D ] ` [a 7! µa. C ] A2  [a 7! µa. D ] B2 ;2. G1 , G2 [a 7! µa. D ] ` [a 7! µa. D ] B1  [a 7! µa. C ] A1 .

Note that we do not have any induction hypothesis for proving subgoal (2) because occurrencesof a in G2 have been substituted by µa. D, but we expect the a’s to have been replaced byµa. C for applying the induction hypothesis. Even if we add the second conclusion back to the118

Chapter 8. Calculus with Bounded Quanti�cation

Proposition 106, we still have problems. For conclusion (2), the type used for the substitution
in the context should be same as the type used for the substitution in the right-hand side of
the subtyping. If we �ll the hole ? with C in Proposition 105, the subgoal (1) in case S������
will get stuck for a similar reason. Therefore, the type in the hole ? cannot be the type C or D.
In summary, in the previous approach showed in Chapter 4, without bounded quanti�cation, only the interaction of covariance/contravariance between types has to be considered.
In contrast, with bounded quanti�cation, the interaction of covariance/contravariance amongcontexts and types also needs to be considered. Our generalization should be able to deal
with all the complications arising from rule S����, rule S���������, rule S������ and rule S��������.
µThe generalized unfolding lemma for F .

Surprisingly, the generalization is relatively

straightforward. For solving the issue we mention above, instead of picking type C or type D,
we pick an intermediate type S between C and D. We need the following auxiliary lemma:
Lemma 107. If G, a  > ` [a 7! Aa ] A  [a 7! Ba ] B then G, a  > ` A  B.
The generalized unfolding lemma for F is:µLemma 108 (The generalized unfolding lemma for F ). If (1) G1 , a  >, G2 ` A  B, (2)µG1 ` µa. C  µa. S and (3) G1 ` µa. S  µa. D then

1. G1 , a  >, G2 [a 7! Sa ] ` [a 7! C a ] A  [a 7! D a ] B implies G1 , G2 [a 7! µa. S] `[a 7! µa. C ] A  [a 7! µa. D ] B;

2. G1 , a  >, G2 [a 7! Sa ] ` [a 7! D a ] A  [a 7! C a ] B implies G1 , G2 [a 7! µa. S] `[a 7! µa. D ] A  [a 7! µa. C ] B.

By applying Lemma 108 with G1 = G, G2 = ·, S = A, C = A and D = B, we prove theunfolding lemma (Lemma 98). The premises can be obtained by inversion on G ` µa. A µa. B, and then applying Lemma 107. Next we give an overview of the key points in the proof

of Lemma 108 for the four tricky cases. Assume that we do induction on premise (1).
• Rule S����: This case mostly follows the previous approach. The interesting point isthat we cannot obtain µa. C  µa. D directly from the conditions raised by the goals,
but have one extra step via transitivity (Theorem 97).

• Rule S���������: For this case we need to consider two subcases. If A = a then from thecontext a  > we can easily know that B is > too. Otherwise, we apply the induction
hypothesis directly.

• Rule S������: This case is surprisingly easy: we can follow the previous approach for
dealing with the contravariant case for subtyping input types of functions, and apply
the induction hypothesis derived from conclusion (2) directly. Note that the key pointof avoiding the issue we discussed before is that, by picking an intermediate type S, wedecouple the substitution in the context and in the subtyping relation for the function
case. That is, the substitution with type µa. S is invariant in both subgoals, independentof the substitution in the subtyping relation.

µ8.3. Metatheory of F

119• Rule S��������: This case is the most interesting one. Assume A = 8( b  U1 ). T1

and B = 8( b  U2 ). T2 . Let us consider how to prove the goal (1). Doing inversion
on condition arising from the goal, we obtain that [a 7! C a ] U1 and [a 7! D a ] U2

are equivalent. Meanwhile, we know U1 and U2 that are equivalent. There are two

possibilities: either C and D are equivalent or a is not in type U1 nor U2 . For the latter

case, we can rewrite the substituted types in the contexts for aligning the contexts, thensolve the issue we discussed above. The former case is quite subtle: since S lies in the
middle of C and D, the three types are all equivalent. In other words, we can change thesubstituted types arbitrarily and get the equivalent types and contexts. The critical pointis that, although the substitution in the context is indeed a�ected by the substitution in
the supertype, since the bounds are equivalent, the type S will converge into the types
C and D.
RemarkSome readers might want to know if we can combine the bounded quanti�cation

with double unfolding rule. Unfortunately, the unfolding lemma cannot be proved successfully.
Our generalized unfolding lemma relies on the inversion lemma for rule S���������:Lemma 109. If a  A 2 G, G ` a  B, and a 6= B then G ` A  B.

but this inversion lemma cannot be correctly applied when double unfolding rule is used.
Assume we have a generalized unfolding lemma (as Lemma 108) for double unfoldings.
By omitting the second part, it is like:
Proposition 110 (The generalized unfolding lemma with double unfoldings). If
1. G1 , a  >, G2 ` A  B;

2. G1 ` µa. C  µa. S and G1 ` µa. S  µa. D;

3. G1 , a  >, G2 [a 7! S] ` [a 7! C ] A  [a 7! D ] B

then G1 , G2 [a 7! µa. S] ` [a 7! µa. C ] A  [a 7! µa. D ] B.

Assume we do induction on premise (1) and deal with the case rule S���������. What

if when A := b, B := a, b  U 2 G2 and a 6= b? Assume premise (2) holds and D := b.
Then, the goal becomes G1 , G2 [a 7! µa. S] ` b  [a 7! µa. D ] B. We might want to apply
rule S��������� to the goal, and then we need to prove G1 , G2 [a 7! µa. S] ` [a 7! µa. S] U [a 7! µa. D ] B. By applying induction hypothesis, we need to prove G1 , G2 [a 7! S] ` [a 7!
S] U  [a 7! D ] B, which is raised from premise (3). Premise (3) now is G1 , a  >, G2 `b  [a 7! D ] B, and we want to prove the new goal by applying inversion lemma (Lemma
109) on it. However, since B := a and D := b, premise (3) becomes G1 , a  >, G2 ` b  b,thus we cannot apply inversion lemma (Lemma 109) to it.
Note that although we get stuck in Proposition 110, it does not necessarily mean theunfolding lemma is not true. We have no idea how to �nd an alternative generalized unfolding
lemma for double unfoldings, thus we leave this as the future work.

120

8.3.2

Chapter 8. Calculus with Bounded Quanti�cation

Decidability

Decidability is one of the important properties of F . We �rst start by reviewing the approachesµto prove decidability in kernel F , and nominal unfoldings, and then describe our approachto prove decidability. These two previous approaches to prove decidability employ di�erent
measures, which creates a challenge for proving the decidability of F .
µDecidability of kernel F

It is well-known that bounded quanti�cation for full F is un-

decidable [98]. However, for the kernel F , identical bounds make the system decidable. A

common practice is to de�ne a weight function to compute the size of a type [100]. The interesting cases are for type variables, universal and function types:
weightG (>)=
weightG1 ,a A,G2 (a)=weightG (8(a  A). B) =weightG ( A ! B)=

1
1 + weightG1 ( A)
1 + weightG,a A ( B)

1 + weightG ( A) + weightG ( B)

For universal types, we store its bound into a context G, and when we meet the universal
variable, we retrieve its bound from the context and compute the size recursively. Since thesize of a conclusion is always greater than any premise, this measure can be used to show thatthe subtyping algorithm in kernel F terminates for all inputs.
Decidability of nominal unfoldings.

The nominal unfolding rule in simple calculi with

subtyping is also decidable, as Chapter 4.6 showed. Compared with kernel F , the decidability

proof of nominal unfoldings is trickier. In Chapter 4.6, we choose a size measure based on an
over-approximation of the height of the fully unfolded tree. We repeat it again for convenience.
In brief, we de�ne a height function, whose variable, function and universal cases are:heightY (>)
heightY (a)==heightY ( A ! B) =heightY (µa. A)=

0
Y(a) if a 2 Y else 0

1 + max(heightY ( A), heightY ( B))

1 + let i = heightY,a7!0 ( A) in heightY,a7!i+1 ( A)

The size measure of a type A is de�ned as height( A) where the context is empty. In contrast to
kernel F , the context here is used to store the size of the corresponding recursive variables. We
proved that such height measure will precisely decrease by one for every nominal unfolding.
µDecidability of F

Now consider how to combine these two approaches together. We wish

to extend the measure of nominal unfoldings with the measure of kernel F non-invasively.

The easiest thing to do is to switch the maximum function to addition for the function case in
the measure of nominal unfoldings, which simply widens the over-approximation. Then we
consider the major di�erences between the two approaches. There are three main challenges:• The measures for variables are inconsistent in the two approaches: In the height function, the type variable case is a base case, while in the weight function we will continue the

121

µ

8.3. Metatheory of F

computation for a variable by getting its bound from the contexts. In F , a recursive variableµis regarded as a universal variable, so the new formulation should re�ect those two distinct
situations.
• The purposes of contexts are inconsistent in two approaches: The context of the heightfunction is used to store the pre-computed size of the recursive type body so that measuresof recursive variables are counted in their nominal unfolded form. The context of the weightfunction is a straightforward bookkeeping of universal bounds. In later computation, thesebounds will be retrieved and their measure will be computed to serve as the measure of auniversal variable. This is to ensure that the premises in rule S��������� have a smaller

measure of types than the conclusion does. We need to treat both designs carefully if wewant a uni�ed context.
• The measure information is lost in the bounded quanti�cation case: Recall that we
employ the rule S�������� instead of the standard rule S���������� for F . Since we impose equivalent bounds for kernel F , for the subtyping relation G ` 8(a  A1 ). B1 

8(a  A2 ). B2 , the measure would consist of the measures of type A1 , A2 , B1 and B2 .
However, the measure for the premise G, a  A2 ` B1  B2 will lose the measure of typeA1 because we do not store it.
We �rst show the measure used for the decidability of F , and then discuss how it adµ

dresses the concerns above. The measure is relatively simple and based on the approach from
Chapter 4.6. Similarly, we de�ne a context Y := · | a 7! i which is used to store the measuresof (both universal and recursive) variables during the measure computation, where i represents
a natural number. Then, a measure function sizeY ( A), de�ned on types, is:sizeY (nat)1sizeY ( Aa )

=
=
=
=

sizeY (a)=sizeY (8(a  A). B)= let i := sizeY ( A) in 1 + i + sizeY,a7!i ( B)
= let i := sizeY,a7!1 ( A) in 1 + sizeY,a7!i ( A)sizeY (>)
sizeY ( A ! B)

sizeY (µa. A)

1
1 + sizeY ( A) + sizeY ( B)
1 + size
8 Y ( A)
<Y(a)
1+
:0

a2Y

a 62 YThe formulation of the size function is very similar to the height function. We have an extra
rule for universal types, and slightly adjust the variable and recursive cases. The measure ofuniversal types is the sum of the measure of the bound and the measure of the body. For
variables, one is added when they are retrieved. Accordingly, we do not need to add one whenstoring the size of recursive variables into the context. For atomic constructs, we follow theweight function and measure them as 1.
We solve the �rst challenge in a straightforward way: there is no need to distinguishbetween recursive and universal variables. The fact that all recursive variables in the context
are bounded by a top type whose measure is simply one �ts our needs naturally.

122

Chapter 8. Calculus with Bounded Quanti�cation
As for the second concern, despite the di�erent purposes of contexts, the key ideas of mea-suring types in kernel F and nominal unfoldings are the same: they both relate the measure ofa variable to its true meaning, either its unfolded form or its bound size. A slight modi�cation
is made based on the de�nition of weight. In the weight function, for a universal variable, its
bound is �rst retrieved and then the measure is computed. To align with the “pre-computation”
mechanism of measuring nominal unfoldings (i := sizeY,a7!1 ( A)), we also pre-compute themeasure of the bound (i := sizeY ( A)) in the size function, so that we retrieve the measure

instead of the type bound from the context. In a well-formed type, variables are guaranteed to
be unique, so we can use a single context Y to store the measures for both recursive variables
and universal variables.
A subtler issue lies for variables in the initial subtyping context. When measuring nominal
unfoldings, the context in a subtyping relation is simply a list of variables, without any boundinformation, so variables that occur freely can be counted as 0. In contrast, now the subtyping
context stores the bound information, and the measures of bounds play a role in deciding thesubtyping relation. To address this issue, we need to make sure that the bound information is
pre-computed in the measure function. We transform a subtyping context into an environment
containing measures Y, which tracks universal variables. In our decidability proof statement(Lemma 111), Y is computed from the subtyping context G by an evaluation function eval :G ,! Y, de�ned as:eval (·)= ·= eval (G0 )eval (G0 , a  A) = let Y0 = eval (G0 ) in Y0 , a 7! sizeY0 ( A)eval (G0 , x : A)

With both eval and size we can then state the decidability theorem:
Lemma 111. If sizeeval (G) ( A) + sizeeval (G) ( B)  k then G ` A  B is either true or not.
Theorem 112 (Decidability). G ` A  B is decidable.

As for the third concern, note that in F , the subtyping relation is antisymmetric [13].

Adding recursive types does not change the property of antisymmetry. However, the additionof records makes the subtyping relation not antisymmetric: two record types may be syntactically di�erent. The lack of antisymmetry poses a challenge for our decidability proof, inparticular for rule S��������. However, the �elds of two equivalent records must be a permutation of each other. Therefore, the measures of two equivalent record types are the same. As
a result, the measure of two equivalent bounds A1 and A2 is equal, as Lemma 113 describes.

The measure information of type A1 can therefore be reconstructed from type A2 , addressing
the �nal concern with decidability.

Lemma 113. If G ` A  B and G ` B  A then sizeeval (G) ( A) = sizeeval (G) ( B).

123

µ

8.3. Metatheory of F

8.3.3

Conservativity

One important feature of F is that it is conservative over kernel F . Conservativity meansµthat equivalent F judgements in F should behave in the same way as in F . For instance, ifµ

a subtyping statement is valid in F , then it should also be valid in F . Dually, if a subtypingµ

statement over F -types is invalid in F , then it should also be invalid in F . In some calµculi, including extensions of F with equi-recursive types [65], conservativity is lost after the
addition of new features.

For avoiding ambiguity, let ` F G, G ` F A, G ` F A  B, ` F e and G ` F e : A represent

the well-formedness of environment, well-formedness of types, subtyping, well-formedness ofexpressions and the typing relation, respectively, in kernel F . Note that all these judgements

are essentially subsets of the judgements introduced in Chapter 8.2, except that the rules involving records and recursive types are removed, and that the rule S�������� is replaced withthe rule S����������.
Conservativity of subtyping

Our conservativity result for subtyping is relatively easy toestablish:
Lemma 114 (Conservativity for subtyping). If ` F G, G ` F A, and G ` F B then G ` F A  B
if and only if G ` A  B.

Here the well-formedness conditions ensure that G, A and B must be respectively a validF environment, and valid F types. That is they cannot contain recursive types (or record

types). Therefore the lemma states that for environments and types without recursive types,
the two subtyping relations (for F and F ) are equivalent, accepting the same statements. Theµonly hurdle is that to establish the correspondence between rule S�������� and the rule S���������� in kernel F , we need the antisymmetry property for kernel F [13].
Conservativity of typing It is straightforward to obtain part of the conservativity result
from a typing relation in F to a typing relation in F . As for the reverse direction, the situationµ

is more complicated. If we want to derive G ` F e : A from G ` e : A, when doing induction,

for the subsumption case (rule ����������), we need to guess an intermediate type. However,
we do not know if it involves recursive types or not. Consider the following example:����������

` lx. x : > ! >` > ! >  (µa. >) ! >` lx. x : (µa.>) ! >����������
` lx. x : >` (µa. >) ! >  >Although ` lx. x : > do not involve recursive types, the typing subderivations can containrecursive types. As a result, the induction hypothesis cannot be applied.

This problem can be addressed by employing the algorithmic formulation of F , shownµin Chapter 8.2.4. With algorithmic typing, we can have more precise information about thetypes of an expression, since algorithmic typing always gives the minimum type. Therefore,
it can be proved that for expressions that do not use fold/unfold constructors, their minimum

124

Chapter 8. Calculus with Bounded Quanti�cation

types do not contain recursive types as well. Conservativity for algorithmic typing is proved
as follows:
Lemma 115. If ` F G, G ` F A and ` F e then G ` a e : A implies G ` F e : A.

Now, given a typing relation G ` e : A in F , we �rst use the minimum typing property (Theoµrem 103) to obtain its minimum type B such that G ` a e : B and G ` B  A. Applying Lemma
115 and Lemma 114, we complete the the conservativity proof for the declarative version ofF .
µTheorem 116 (Conservativity). If ` F G, G ` F A and ` F e then G ` F e : A if and only if
G ` e : A.

8.4

Lower and Upper Bounded Quanti�cation

In this section we introduce an extension of F , called F , with lower bounded quanti�cationµµand a bottom type. While upper bounded quanti�cation has received a lot of attention inprevious research, lower bounded quanti�cation for an F -like language is much less explored,

though it appears on a few works [91, 8]. We follow the same approach as Oliveira et al.
[91], where their F extension allows type variables to have either a lower bound or an upperbound, but not both bounds at once. As discussed in Chapter 8.1, this extension enables further
applications, such as a form of extensible encodings of datatypes. We have proved all the same
results for F

that were proved for F , including type soundness, decidability, transitivity

8.4.1

µ

µ

µ

and conservativity over F .

The F Calculus

The syntax of types, expressions, values and contexts for the extended F calculus is shownµ

below. The main novelties are that bottom types and lower bounded quanti�cation are introduced. The syntactic additions are highlighted in gray .
Types
Expressions
ValuesContexts

A, B, . . .
e
v
G

::=
::=
::=
::=

nat | > | ? | A1 ! A2 | a | µa. A | Aa

| 8(a  A). B | 8(aA). B | {li : Ai i21···n }x | i | e1 e2 | lx : A. e | e A | L(a  A). e | L(a| unfold [ A] e | fold [ A] e | {li = eii 21···n } | e.l

i | lx : A. e | fold [ A] v | L(a  A). e | L(ai 21···n }| { li = v i· | G, a  A | G, a

A ). eA ). eA | G, x : A

Subtyping, typing and reduction. Similarly to Chapter 8.2, the well-formedness for the
additional bottom types and universal types with lower bounds are standard. The well-formed
types, subtyping, typing and reduction rules for F are shown in Figure 8.5, Figure 8.6, Figµure 8.7 and Figure 8.8, respectively. Compared with F , we add rule S����, S����������� andµS����������, which are the dual forms of rule S����, S��������� and S��������, respec-tively. The rule ������������� and ������������� are the dual forms of rule ����������� and125

8.4. Lower and Upper Bounded Quanti�cation
G`A(Well-formed Type)�������

����T��

����B��

G ` natG`>G`?

���������

���������G`A
G, a A ` B
G ` 8(a A). B

��������

aA2G
G`a

G ` A1G ` A2G ` A1 ! A2�������G ` Ai�������G`A
G, a  A ` B
G ` 8(a  A). B

�������

G, a ` A
G ` µa. A����������G`A
G ` Aafor each i

G ` {li : Ai i21···n }Figure 8.5: The well-formed types for F .
µ����������� for typing, respectively. The rule ����������� rule is the dual form of rule �����
���� for reduction.
The new subtyping relation is re�exive and transitive:
Theorem 117 (Re�exivity for F ). If ` G and G ` A then G ` A  A.
µ

Theorem 118 (Transitivity for F ). If G ` A  B and G ` B  C then G ` A  C.
µStructural folding and lower bounded quanti�cation.

The structural folding rule �������

µ����� on recursive types has already been shown for F . Note that this rule is not strictly necµessary for F , because a recursive type can only be a subtype of another recursive type or theµ> type. Thus the e�ect of structural folding in F , can be subsumed by other subtyping/typing

rules. Perhaps for this reason, Abadi et al. [3] have only considered a structural unfolding rule.
However, in F , a recursive type can also be a subtype of a type variable. In this case,µthe structural folding rule can give the desired typings to the Add8 constructors of the Exp1

and Exp2 datatypes that we have presented in Chapter 8.1.5, while the standard folding rulecannot. The rule ������������ has the same form in Fµas in F . Therefore we believeµthat the structural folding rule that we have proposed, together with the structural unfolding
lemma in the metatheory, is general.
Type soundness. Our type soundness proof for F is standard, thus we have:µ

Theorem 119 (Preservation for F ). If ` e : A and e ,! e0 then ` e0 : A.
µ

Theorem 120 (Progress for F ). If ` e : A then e is a value or exists e0 , e ,! e0 .
µ

8.4.2

µ

Metatheory of F

The addition of lower bounded quanti�cation and the bottom type create some di�cultiesµ
in the metatheory of F . The proof strategies for the unfolding lemma, decidability andconservativity, as we showed in the Chapter 8.3 for F , require some adjustments. In theµfollowing, we describe how to overcome the di�culties.

126

Chapter 8. Calculus with Bounded Quanti�cation

G`AB(Subtyping)

S����

S����

`G
G ` nat  nat

`G
G`A
G`A>

S����

S������

`G
G`a
G`aa

G ` B1  A1
G ` A2  B2
G ` A1 ! A2  B1 ! B2

S�����

S�������

G, a  > ` [a 7! Aa ] A  [a 7! Ba ] BG ` µa. A  µa. B

G`AB
G ` Aa  Ba

S��������

S���������G ` A1  A2
G ` A2  A1
G, a  A2 ` B  C
G ` 8(a  A1 ). B  8(a  A2 ). C
S����

`G

G ` {k j : A j j21···m }

G`BA
aB2G
G`aA

{li i21···n } ✓ {k j j21···m }G ` {k j : A j

j21···m}  { l i : Bii 21···nk j = li implies G ` A j  Bi}

S�����������

S����

`G
G`A
G`?A

G`AB
a B2G
G`Aa

S����������G ` A1  A2
G ` A2  A1
G, a A2 ` B  C
G ` 8(a A1 ). B  8(a A2 ). C
Figure 8.6: The subtyping rules for F .
µUnfolding Lemma A type system that simultaneously allows introducing lower and upperbounded type variables will break the proof of the unfolding lemma shown in Chapter 8.3.1.
The interaction of lower bounds and upper bounds invalidates the inversion lemma for rule S��������� (Lemma 109). The inversion lemma holds when the bounds in the context can only
have one direction. However, when we have both kinds of bounds in the context, a counterexample can be found as follows:x  >, y

x`xy

=)
\

x  >, yx`>yThe existing generalized unfolding lemma for F relied on the inversion properties forµevery subtyping rule. It is because in the generalized unfolding lemma, we have 2 subtyping

statements related to type A and B. However, when a type system involves subtyping rules
where the inversion properties do not hold, such as intersection types or bounded quanti�cation with both upper bounds and lower bounds (as F ), the current generalized unfoldingµlemma cannot be applied.

By observing the form of the generalized unfolding lemma (Lemma 108), we can see that,when we apply the nominal unfolding rules for iso-recursive types, the conditions (1) and (2)raised by the goals implicitly subsume the premise (1). That is because 1-time unfoldings canbe derivable from general nominal unfoldings.

1278.4. Lower and Upper Bounded Quanti�cation
G`e:A(Typing)����������`GG ` i : nat����������

`G����������

����������

x:A2G
G`x:A

G`e:A
G`AB
G`e:B

������������

G, x : A1 ` e : A2
G ` lx : A1 . e : A1 ! A2

G ` e : [ a 7 ! B] A
G ` µa. A  B
G ` fold [B] e : B��������������

����������G`e:A
G ` A  µa. BG ` unfold [A] e : [a 7! A] B

G ` e1 : A1 ! A2
G ` e2 : A1
G ` e1 e2 : A2

�����������

�����������

G ` e : {li : Ai i21···n }G ` e.li : Ai

G, a  A ` e : B
G ` L(a  A). e : 8(a  A). B
����������

�����������

for each i

G ` e : 8(a  B1 ). B2
G ` A  B1
G ` e A : [a 7! A] B2

G ` { l i = ei�������������

i 21···n�������������

G ` e : 8(a B1 ). B2
G ` B1  A
G ` e A : [a 7! A] B2

G ` ei : Ai

} : {li : Ai i21···n }G, a A ` e : B
G ` L(a A). e : 8(aA). B

Figure 8.7: The typing rules for F .
µWith such an important observation, we merge two subtyping statements related to type
A and B into one. To accommodate this change, the context is also needed to re�ne. Formally,
the generalized unfolding lemma for F is:µLemma 121 (Generalized unfolding lemma for F ). Ifµ

1. G1 , a  >, G2 ` A and G1 , a  >, G2 ` B;
2. G ` [a 7! C a ] A  [a 7! D a ] B

3. G di�ers from G1 , a  >, G2 [a 7! Sa ] only in the components labeled by a, where Sa
can be replaced by T a that satis�es G2 ` µa. S  µa. T and G2 ` µa. T  µa. S

then

1. G1 ` µa. C  µa. S and G1 ` µa. S  µa. D implies G1 , G2 [a 7! µa. S] ` [a 7!
µa. C ] A  [a 7! µa. D ] B;

2. G1 ` µa. D  µa. S and G1 ` µa. S  µa. C implies G1 , G2 [a 7! µa. S] ` [a 7!
µa. C ] A  [a 7! µa. D ] B;

Proof. Do induction on premise (2) and then premise (1), respectively.
Lemma 122 (Unfolding lemma for F ). If G ` µa. A  µa. B then G ` [a 7! µa. A] A µ[a 7! µa. B] B.

128

Chapter 8. Calculus with Bounded Quanti�cation

e1 ,! e2

(Reduction)���������

���������

(lx : A. e1 ) v2 ,! [ x 7! v2 ] e1���������

e1 ,! e10e1 e2 ,! e10 e2

e2 ,! e20v1 e2 ,! v1 e20

�����������

��������

unfold [A] (fold [B] v) ,! v
���������

e ,! e0fold [A] e ,! fold [A] e0���������

���������

e1 ,! e2
e1 A ,! e2 A

e ,! e0
e.l j ,! e0 .l j

(L(a  A). e) B ,! [a 7! B] e������������

{ l i = vi���������

e ,! e0
unfold [A] e ,! unfold [A] e0�����������

i 21···n}.l j ,! v j��������

(L(aA). e) B ,! [a 7! B] ee j ,! e0j{li = vi i21··· j 1 , l j = e j , lk = ek k2 j+1···n } ,! {li = vi i21··· j 1 , l j = e0j , lk = ek k2 j+1···n }Figure 8.8: The reduction rules for F .
µDecidability

The interaction between bottom types and rule S�������� breaks the measure-based decidability proof in Chapter 8.3.2. The bottom type in F brings a new form of equivµalent types: when a  ? 2 G, one can derive that G ` a  ? and G ` ?  a, as has been

observed by Pierce [96]. Simply extending the measure function with sizeY (?) = 1 will notwork. For type variables, the measure function will recursively look up its bound in the context, and add one to the measure of its bound, making a variable equivalent to ? to have a larger

measure than ?. Therefore, replacing two equivalent types into the abstracted type body may
not produce the same measures. We can construct derivations of rule S�������� that have alarger measure in the premise than that of the conclusion, which makes the decidability proof
fail with the current measure.
A counter-example is:a  ?, b  a ` a  b
a  ?, b  a ` b  aa  ?, b  a, g  b ` A  B
a  ?, b  a ` 8(g  a). A  8(g  b). B

The measure for premise (3) is:sizea7!1, b7!2, g7!3 ( A) + sizea7!1, b7!2, g7!3 ( B)
while the measure for the goal is:sizea7!1, b7!2 (8(g  a). A) + sizea7!1, b7!2 (8(g  b). B),! sizea7!1, b7!2, g7!2 ( A) + sizea7!1, b7!2, g7!3 ( B)

129

8.4. Lower and Upper Bounded Quanti�cation
which is less than the measure of premise (3).

We solve this issue by replacing all the type variables who are a subtype of bottom bybottom. By such way, the subtyping relation a  ?, b  a ` 8(g  a). A  8(g  b). B
becomesa  ?, b  ? ` 8(g  ?). A  8(g  ?). B
and the measure works again.
This idea can be implemented by modifying the measure function to identify upper/lower
bounded variables that are equivalent to bottom/top types. Every time that we compute thesize for a variable bounded by an upper bound, we �rstly recursively check whether it is asynonym for bottom, and return the size of bottom if it is. This can be implemented by anextension to the measure context Y. Dually, when we compute the size for a variable bounded
by a lower bound, we recursively check if it is the supertype of top. With this change themeasures work, and we can prove decidability.
Therefore, the context is rede�ned as Y := · | Y, a 7! i | Y, a 7! ? | Y, a 7! >, which

is used to store the measure of variables or indicate them as upper bounded by ? or lower
bounded by >. Then, a measure function sizeY ( A) is rede�ned as:
sizeY (nat)sizeY ( Aa )

=
=
=
=
=

sizeY (a)=sizeY (8(a  A). B)=

A ). B )=sizeY (>)
sizeY (?)
sizeY ( A ! B)

sizeY (8(asizeY (µa. A)

isBotY (?)

11
1
1 + sizeY ( A) + sizeY ( B)
1 + size
8 Y ( A)<ia 7! i 2 Y
1+:0otherwise8<1 + size
Y,a7!? ( B )1+:size ( A) + sizeY
Y,a7!sizeY ( A) ( B )8<1 + size
Y,a7!> ( B )1+:size ( A) + sizeY
Y,a7!sizeY ( A) ( B )isBotY ( A)otherwise
isTopY ( A)otherwise= let i := sizeY,a7!1 ( A) in 1 + sizeY,a7!i ( A)= trueisBotY,a7!? (a)= trueisBotY,b7!_ (a)= isBotY (a) if a 6= botherwise isBotY ( A) = false

isTopY (>)= trueisTopY,a7!> (a)= trueisTopY,b7!_ (a)= isTopY (a) if a 6= botherwise isTopY ( A) = false

The isTop and isBot functions basically use the information in the measure context Y tocheck whether the bound type A is equivalent to > or ?. If so, when the variable bounded by

A is looked up in the context, it will have a measure of 1. In this way, we retain the important

property that equivalent types have the same measure.

130

Chapter 8. Calculus with Bounded Quanti�cation

G`A*B(Upper Exposure)

XA��������

XA������aA2GG`A * BG`a * BXA���A is not type variableG`A * Aa A2G
G`a * aG`A+B

(Lower Exposure)

XA������������

XA��������A2G
G`A + BG`a + Ba

G `a e : A

A is not type variable
G`A + A
(Algorithmic Typing)�����������

G `a e1 : A

G`A * ?
G `a e1 e2 : ?

������������

G `a e2 : A2

���������������

G `a e : A

XA���������

aA2G
G`a + aG `a e : B

G`B * ?
G `a e A : ?

G`A

G `a e : A
G`C + >
G `a fold [C] e : >G`C�������������

G`B * ?
G`AB
G `a unfold [B] e : ?

Figure 8.9: The new exposure function and additional algorithmic typing rules for F .
µTheorem 123 (Decidability for F ). F is decidable.
µ

Conservativityµ

The proof of conservativity for F follows the same pattern as the proofµfor F . To prove conservativity of typing, we need the help of the algorithmic typing rules toµobtain the minimum type of an F term. However, the introduction of bottom types requires

us to add several new algorithmic typing rules, since in the declarative system, one can always
use the subsumption rule to transform a term with type ? to any function type or universal

type, and apply it to any argument, as has been observed by Pierce [96]. We also develop asimilar treatment for recursive types. Moreover, the meanings of the two exposure functions
also need to be re�ned. For example, the upper exposure function (*) is now used to �nd theleast non-upper-bounded-variable upper bound in the context, so it will return the variable
itself if the variable is lower bounded. The complete set of F algorithmic typing rules canµbe found at Figure 8.9.

Theorem 124 (Conservativity for F ). If ` F G, G ` F A and ` F e then G ` F e : A if andµonly if G ` e : A.

8.5

Mechanized Proofs

The folder coq_fsub includes all the Coq proofs about F and F in this chapter. The folderµµcoq_fsub/coq_fsub_main contains all the de�nitions and proofs about F and the folder coq_fsub/coq_fsub_allµ

contains all the de�nitions and proofs about F .
µ

1318.5. Mechanized Proofs
Table 8.1: Paper-to-proofs correspondence guide in Chapter 8.
De�nition

File

Name in Coqµ
F , in folder coq_fsub/coq_fsub_main

Well-formed Type (Figure 8.1)
Rules.v
WF E A
Subtyping (Figure 8.1)
Rules.v
sub E A B
Typing (Figure 8.2)
Rules.v
typing E e A
Reduction (Figure 8.3)
Rules.v
step e1 e2Upper Exposure (Figure 8.4)
AlgoTyping.v exposure E A B
Lower Exposure (Figure 8.4)
AlgoTyping.v exposure2 E A B
Algorithmic Typing (Figure 8.4)
AlgoTyping.v algo_typing E e Aµ
F , in folder coq_fsub/coq_fsub_all
Well-formed Type (Figure 8.5)
Rules.v
WF E A
Subtyping (Figure 8.6)
Rules.v
sub E A B
Typing (Figure 8.7)
Rules.v
typing E e A
Reduction (Figure 8.8)
Rules.v
step e1 e2Upper Exposure (Figure 8.9)
AlgoTyping.v exposure E A B
Lower Exposure (Figure 8.9)
AlgoTyping.v exposure2 E A B
Algorithmic Typing (Figure 8.9)
AlgoTyping.v algo_typing E e A

8.5.1

Notation`G`G`AB`G`e:Ae1 ,! e2
G`A*B
G`A+B
G `a e : A`G`G`AB`G`e:Ae1 ,! e2
G`A*B
G`A+B
G `a e : A

De�nitions

All the de�nitions of F can be found in �les coq_fsub_main/Rules.v, and all the de�nitionsµof F showed in Chapter 8.4 can be found in �les coq_fsub_all/Rules.v. Table 8.1 shows theµcorrespondence of de�nitions between the paper and the Coq artifacts.

8.5.2

Lemmas and theorems

Table 8.2 shows the descriptions for all the proof scripts in Chapter 9. It contains some important lemmas and theorems for F . The lemmas and theorems for F , with the same name andµµµstructure as those for F in the folder coq_fsub_main, can be found at the folder coq_fsub_dual.

132

Chapter 8. Calculus with Bounded Quanti�cation

Table 8.2: Descriptions for the proof scripts in Chapter 8.
Theorems
Theorem 96
Theorem 97
Lemma 98
Theorem 100
Theorem 101
Theorem 102
Theorem 103
Theorem 111
Theorem 114
Theorem 116
Theorem 117
Theorem 118
Theorem 119
Theorem 120
Lemma 122
Theorem 123
Theorem 124

Description

Files

µ
F , in folder coq_fsub/coq_fsub_mainRe�exivity
Re�exivity.v
Transitivity
Transitivity.v
Unfolding Lemma
Unfolding.v
Preservation
Preservation.v
Progress
Progress.v
Soundness of algorithmic rules
AlgoTyping.v
Completeness of algorithmic AlgoTyping.v
rules
Decidability
Decidability.v
Conservativity for Subtyping
Conservativity.v
Conservativity
Conservativity.vµ
F , in folder coq_fsub/coq_fsub_allRe�exivity
Re�exivity.v
Transitivity
Transitivity.v
Preservation
Preservation.v
Progress
Progress.v
Unfolding Lemma
Unfolding.v
Decidability
Decidability.v
Conservativity
Conservativity.v

Name in Coq
Re�exivity
sub_transitivity
unfolding_lemmapreservation
progress
typing_algo_soundminimum_typing
decidability
sub_conserv
typing_conserv
Re�exivity
sub_transitivity
preservation
progress
unfolding_lemma
decidability
typing_conserv

133Part IV

Epilogue

135

Chapter 9

Related Work
Throughout the thesis, we have already reviewed some of the closest related work in detail. In
this chapter, we will discuss other related work.

9.1

Subtyping Recursive Types

9.1.1

Iso-recursive Amber rules

In Chapter 2.1.3, we discussed Amadio and Cardelli [5]’s work on recursive types. Their work
is about equi-recursive types, which is enabled by a very expressive equivalence relation usedin their re�exivity rule. Much of the follow-up work has employed a much weaker alphaequivalence relation in the Amber rules, leading to an iso-recursive formulation of subtyping.
With respect to the metatheory of iso-recursive subtyping with the Amber rules, Bengtson
et al. [18]’s work is the closest to ours. They manually proved a full set of type safety properties,
including the transitivity lemma for subtyping and the unfolding lemma (as a part of theirinversion lemma). The transitivity lemma, “perhaps the most di�cult” statement in their work,
is proven with a complex inductive argument. For example, a subtyping chain of type variables,
a1  a2  a3 , is accepted by their transitivity statement, by means of adapting variablebindings in the contexts accordingly:

G [ a1  a2 ] ` a1  a2

G [ a2  a3 ] ` a2  a3

G [ a1  a3 ] ` a1  a3

In other words, the subtyping judgments of their transitivity statement (used for their proof)
do not share the same context, which subtly captures the nature of context elements (a  b)in the Amber rules. Such technique involving inconsistent contexts is an uncommon practice,and it complicates the proof. Backes et al. [12] attempted to formalize this transitivity proof
in Coq, but they failed, stating that: "The soundness of the Amber rule (Sub Rec) is hard to provesyntactically – in particular proving the transitivity of subtyping in the presence of the Amber rule
requires a very complicated inductive argument, which only works for “executable” environments”.
Many other works avoid some of the complexity in the metatheory of the Amber rules
by employing a declarative subtyping relation with transitivity built-in [83, 38, 56, 103, 1].

136

Chapter 9. Related Work

However, this leaves open the question of how to obtain a sound and complete algorithmic
formulation, which as discussed in Chapter 2.1.3 and 5.2, is non-trivial. Chugh [44] observes
the lack of some desirable properties (such as decidability) and di�culties of implementing
languages modelling foundational aspects of Object-Oriented Programming when employing
calculi with equi-recursive types. To address those di�culties he proposes a source calculus with iso-recursive types using the Amber rules, which enables decidability. He does notdiscuss transitivity of subtyping for the source calculus. Type-safety of the source calculus
is shown via an elaboration into a target calculus with equi-recursive types and f-boundedpolymorphism [29]. In general, those works employ elaboration and/or coercive subtyping,which leads to an alternative way to prove type-safety, and transitivity is either built-in or
not discussed. In contrast, our metatheory comes with transitivity proofs, as well as a direct
operational semantics for a calculus with iso-recursive types.

9.1.2

Complete iso-recursive subtyping

Ligatti et al. [84] propose an improvement to the Amber rules for iso-recursive subtyping. Theyobserve that the Amber rules are sound, but incomplete with respect to type-safety. Besides thecomplications due to the presence of a re�exivity rule, they �nd that a source of incompletenessof the Amber rules comes from complications with recursive type unrolling. The two rules forsubtyping recursive types employed by Ligatti et al. [84] are:S, µa. A  µb. B ` [a 7! µa. A] A  [ b 7! µb. B] B
L17����1S ` µa. A  µb. B(µa. A  µb. B) 2 S
L17����2S ` µa. A  µb. B

The basic idea is that subtyping environments S track all subtyping relations between recursive types that have already been observed. Rule L17����1 is the rule that is triggered
if µa. A  µb. B has not been observed yet. In that case µa. A  µb. B is simply added tothe environment and the recursive type variables are directly replaced by the recursive types
in the bodies. In rule L17����2, if µa. A  µb. B is already in the environment, then we knowthat the two recursive types are in a subtyping relation and we can terminate. One similarity

to the double unfolding and the nominal unfolding rules is that both Ligatti et al. [84]’s rules
and our rules employ one substitution for each type. However, in Ligatti et al. [84]’s rules wesubstitute the recursive type variable with the recursive type directly, whereas in our rules we
use a �nite unfolding: that is we use the body of the recursive type instead. Ligatti et al. [84]’s
rules are more powerful than both the Amber rules and all the rules presented in this thesis,
including our declarative formulation with �nite unfoldings, as well as the double and nominal
unfolding rules. The simplest example that illustrates the di�erent expressive power between
our rules and the rules by Ligatti et al. [84] is perhaps µa. a  µa. (µb. a). With Ligatti et al.
[84]’s rules this is a valid subtyping statement, as illustrated by the following derivation:

9.1. Subtyping Recursive Types137µa. a  µa. (µb. a) 2 {µa. a  µa. (µb. a), µa. a  µb. (µa. (µb. a))}L17����2µa. a  µa. (µb. a), µa. a  µb. (µa. (µb. a)) ` µa. a  µa. (µb. a)
L17����1µa. a  µa. (µb. a) ` µa. a  µb. (µa. (µb. a))
L17����1` µa. a  µa. (µb. a)

In contrast, the rules based on �nite unfoldings reject such subtyping statement. For instance,
here is the failed derivation with the double unfolding rules:
Derivation fails here
Derivation fails herea ` a  µb. aa ` a  µb. (µb. a)SA����
` µa. a  µa. (µb. a)

The source of the di�erence in terms of expressive power between our rules (as well as theAmber rules) and Ligatti et al. [84]’s rules is related to the treatment of subtyping between
type variables and recursive types. In the failed derivation with the double unfolding rule
we can see that the derivation fails when we encounter a subtyping statement of the forma  µb. A. That is when we try to compare a recursive type variable with a recursive type. In

both our rules and the Amber rules, such statements are always rejected, since the recursivetype variables are opaque and the structure of the recursive type denoted by the type variable
is not known. In some sense with the Amber rules and our rules recursive type variables act
similarly to nominal types, and comparing them with a recursive type that happens to havea structurally compatible shape will fail. In Ligatti et al. [84]’s rules, because type variables
are always replaced by the recursive type, the structure of the recursive type is known (ortransparent) and then the subtyping rules for recursive types can be used instead. In addition
to the simple example that we describe above, Ligatti et al. [84] have identi�ed two larger
examples that demonstrate that their rules can derive subtyping statements that the Amber
rules cannot:• µn.{sub : (µi0 .{sub : i0 ! unit}) ! unit, min : unit ! int}  µi.{sub : i ! unit};• µa.(((µb.((b + nat) + a)) + nat) + a)  µc.((c + real) + c).

As they observe, accepting such subtyping statements does not violate type-safety. The two
examples above are also rejected by our rules, for similar reasons to the simpler example above.
The failure to derive such subtyping statements is expected since we proved that our rules areequivalent in terms of expressive power to the Amber rules, which reject them as well.
In addition to rules L17����1 and L17����2, some non-standard subtyping rules for valueuninhabited types are also needed for achieving the completeness of subtyping with respect
to type safety. If a type is value-uninhabited then every expression of that type diverges. In
other words, value-uninhabited types are treated as bottom types (?). As Ligatti et al. [84]explained, if we do not care about subtyping completeness with respect to type-safety, we canignore the extra subtyping rules for value-uninhabited types, and still get additional expressive
power over the Amber rules. From the point of view of type-safety, the new formulations ofsubtyping proposed by us are also incomplete, since they have the same expressive power as
the Amber rules.

138

Chapter 9. Related Work
Our declarative formulation of subtyping is essentially following a syntactic approach tosubtyping, whereas a formulation based on completeness with respect to type-safety is closer
in spirit to semantic subtyping [40]. While syntactic formulations are generally less expressive,
their metatheory is usually simpler, and such formulations are also generally more extensible. To achieve their goal of a complete formulation of subtyping with respect to type safety,
Ligatti et al. [84] had to develop several new proof techniques to accomplish this goal. For instance one of the techniques developed in their work is induction on failing derivations, which
requires de�ning an explicit relation that captures failed derivations of subtyping. A further
complicating factor is the non-standard form of environments S required by rules L17����1and L17����2, which must contain entries of the form µa. A  µb. B. This is in contrast to
our rules, which all employ standard environments with type variables only. Both of thesemean that the subtyping metatheory is signi�cantly di�erent from conventional formulationsof subtyping. In Ligatti et al. [84]’s work, most important theorems, such as transitivity or re�exivity, are proved by doing induction on failing derivations. For example, their transitivity
theorem is proved via an auxiliary theorem called strong subtyping transitivity of the form:S ` t1  t3 is not derivable` t1  t2` t2  t3 is not derivable

This theorem relies on the failed derivations relation and leads to a transitivity proof that isquite di�erent from conventional transitivity proofs for subtyping. In contrast, our transitivity
theorem (as well as other lemmas such as re�exivity) and proofs are standard. For instance,
as we show in Theorem 6, our transitivity proof is modular in the sense that proofs for thecases of non-recursive type constructs (such as function types) are essentially the same as
for a subtyping relation without recursive types. In other words the addition of recursive
types using our rules has little impact on existing proofs1 . This is not the case in Ligatti etal. [84]’s work since their rules for recursive subtyping as well as their proof techniques forshowing completeness of subtyping with respect to type-safety require new proof techniques
and proofs, and even new theorem statements. In addition, all our proofs have been formalized
in a theorem prover, whereas Ligatti et al. [84]’s proofs have not been mechanically formalized
yet.

9.1.3

Other approaches to iso-recursive subtyping

For solving the con�ict between contravariant types and recursive types, Hofmann and Pierce[72] proposed an approach where only covariant types are allowed. In their subtyping rules,
the inputs of function types must be the same. Later, Hosoya et al. [73] gave an algorithm toprove transitivity and type soundness, but it still relies on a complicated environment where
all of the components are pairs of structural recursive types. Thus, they have extra rules forcontexts to obtain enough information for the subtyping assumptions. Featherweight Java [78],is another calculus that supports a form of iso-recursive types. Although there are no speci�c
1 Our locally nameless [42] based Coq proofs follow a similar style to Chargueraud’s proofs for System F<: in
https://www.chargueraud.org/softs/ln.

9.1. Subtyping Recursive Types

139

recursive type constructs, recursive types appear because class declarations can be recursive.
An advantage of the Featherweight Java design is that recursive types are fairly easy to model,
and modeling mutually recursive types is straightforward. However, structural iso-recursive
types, such as those in the Amber rules, allow for nested recursive types, which are not directly
supported in Featherweight Java. Featherweight Java does support mutually recursive classes,
so perhaps there is some general way to support such nested recursive types via an encoding.

9.1.4

Equi-recursive subtyping

Equi-recursive subtyping has been widely used in various calculi. With equi-recursive subtyping a recursive type is equivalent to its unfoldings. Amadio and Cardelli [5]’s work provided the�rst theoretical foundation for equi-recursive types. Subsequent work by Brandt and Henglein[24] and Gapeyev, Levin, and Pierce [62] improved and simpli�ed the theory of Amadio andCardelli [5]’s study. In particular, they advocated for the use of coinduction for the metatheoryof equi-recursive subtyping. Equi-recursive types play an important role in many areas. They
have been employed for session types [39, 63, 64, 43], and Siek and Tobin-Hochstadt [111]applied equi-recursive types in gradual typing.
Semantic subtyping [61, 40], provides a set-theoretic point of view for type systems. In
that approach, equi-recursive types and intersection types are interpreted as subsets of themodel, the subtyping relation is decidable, and some important properties, such as transitivity,
are derived naturally. Although semantic subtyping approaches have many advantages, they
can be technically more involved, while the metatheory of syntactic formulations is simpler
and generally easier to extend. Damm [54] explored a type system with equi-recursive types
and intersection types. His subtyping relation is quite expressive, as it supports equi-recursive
types and distributivity rules for subtyping. However, he does not follow the conventional
syntactic formulations of subtyping, such as the one in this thesis or those employed in Dependent object types (DOT) [6, 108]. Instead, types are encoded as regular tree expressions/set
constraints. In contrast, our formulation is more conventional and supports iso-recursive types
instead.

9.1.5

Mechanical formalizations with recursive subtyping

While to our knowledge there are no mechanical formalizations with the Amber rules, there
are a few works trying to formalize other variants of recursive subtyping. Closest to our work is
the Coq formalization by Backes et al. [12]. They show a Coq proof for re�nement types with apositive restriction for iso-recursive types. In fact, our positive subtyping formulation (Figure5.1) is close to Backes et al. [12]’s de�nition. However, our de�nition is more general sinceequal types with negative recursive occurrences are considered subtypes, whereas in theirformulation recursive types with negative occurrences of recursive variables are forbidden.
Appel and Felty [10] gave a related Twelf proof of positive subtyping, where function types areinvariant with respect to the input types of functions. Recently, based on big-step semantics,

140

Chapter 9. Related Work

Amin and Rompf [8] gave a formalization of DOT, which employs a special form of equirecursive type. Danielsson and Altenkirch [55], mixes induction and coinduction for proving
properties of equi-recursive subtyping in Agda.

9.2

Object Encodings

9.2.1

Bounded quanti�cation

Bounded quanti�cation was �rstly introduced by Cardelli and Wegner [37] in the language
Fun, where their kernel Fun calculus corresponds to the kernel version of F . The full variantof F was introduced by Curien and Ghelli [53] and Cardelli et al. [35], where the subtyp-

ing for bounds are contravariant. Although full F is powerful, subtyping is proved to be
undecidable [98]. As discussed in Chapter 1.1.4 there are several attempts to add recursive
types to F , such as the work by Ghelli [65], Colazzo and Ghelli [46] and Je�rey [80]. Un-

fortunately, such combinations are not painless, and even the successful combinations require
the signi�cant changes for the subtyping rules. In Colazzo and Ghelli’s work, there is no independent universal type, and the shape of recursive types is either µa. 8( x  A). B or

µa. A ! B. The recursive variables and universal variables are distinct, resulting in changes

in environments and subtyping rules. For example, the subtyping environment is de�ned as
P := · | P, ( x, y)  ( A, B) | P, (a = A, b = B), and the rule S��������� rule of F ischanged to:( x, y)  ( A0 , B0 ) 2 P

8a0 , B 6= a0
B 6= >
P`xB

B 6= yP ` A0  B

The algorithm proposed by Je�rey is also complex, and requires major changes. Both recursive variables and the subtyping algorithm are labelled polarly, and the implementation ofa-conversion is not discussed. In contrast, our subtyping rules do not change the contexts, thetypes are not restricted, and most importantly, we do not have to change the rules in the original F . This has the bene�t that we can largely reuse the existing metatheory of the originalF , and it also enables our conservativity result. While it is plausible that Je�rey [80]’s andColazzo and Ghelli [46]’s work for the kernel F extensions with recursive types are conser-

vative, this has not been proved. Furthermore, such proof is likely to be non-trivial because of
the major changes introduced by equi-recursive subtyping.
Table 9.1 summarizes the results of previous work on extending F with recursive types.

Type System simply means whether the typing relation of the F extension with recursive
types has been studied/presented in the paper. Type soundness means whether, in addition topresenting the type system, the proof of type soundness for the F extension was also done.

Conservativity is just a speci�c proof or property that describes whether the new calculus preserves the behavior of the original calculus, and it is quite di�erent from modularity. Modularity
is simply about whether the original rules and de�nitions of F are the same or they need tobe modi�ed. Modularity is helpful, but not necessary, to prove conservativity. Essentially ifmost rules are just the same in the original system and the extension, then most cases in the141

9.2. Object Encodings
Table 9.1: Comparison among di�erent work on extending F to recursive types.
equi

F
[65]
⇥

equi

Kernel F
[46]
X
X

equi

F
[80]
X
Xr
⇥

equi

Kernel F
[80]
X
X

iso
F
[3]
built-inµF
Chapter 8
Transitivity
X
Decidability
X
Conservativity⇥
X
Type System
X
X
Algorithmic Type System
X
Type Soundness
X
Modularity
⇥
⇥
⇥
⇥
X
Mechanized Proofs
⇥
⇥
⇥
⇥
⇥
X
Note: A ⇥ symbol denotes a negative result (the property or feature does not hold). A X denotes a positive result, while Xrdenotes a partial result (such as semi-decidability). Whitespacedenotes that the property/feature has not been studied or it is unknown.
proof are quite trivial. However, even if the de�nitions are changed, it may still be possible toprove conservativity. It is just that the proof may be signi�cantly harder.
The proofs in all the 4 systems with equi-recursive types are complex because of thestrong recursion. Adding equi-recursive subtyping requires major changes in existing de�nitions and proofs compared to F , making most of the existing metatheory on F not reusable.

No prior work has proved the conservativity of F with equi-recursive types. This result islikely to be hard to prove because of the numerous non-modular changes in F induced by the

introduction of equi-recursive subtyping. Furthermore, in those works the full type systems
are not provided. Abadi et al. [3] gave a sketch how to add iso-recursive subtyping to F toencode objects. However, they did not prove any technical results about their extension. Theytranslate the system to object calculi [1], in which the transitivity is built-in. In those papers
on recursive types for F , they mostly focused on studying the subtyping relation of F , andthe proofs were pen-and-paper rather than mechanized in a theorem prover.

There are many other extensions to F . Bounded existentials are also studied by Cardelliand Wegner [37]. Existential types can be encoded by universal types, thus we can obtain aform of bounded existentials for free in F [37]. Another important extension is f-bounded

quanti�cation, �rstly proposed by Canning et al. [29], then studied by Baldan, Ghelli, andRa�aeta [13] in terms of the basic theory. In f-bounded quanti�cation, the bounded variables
are allowed to appear in the bound. For example, a bound of the form 8(a  F [a]). B, where

F is a type-level function applied to a, is allowed in f-bounded quanti�cation. We can encode

polymorphic binary methods [25] and methods that have recursive types in their signatureswith f-bounded quanti�cation. For the example that we have showed in Chapter 8.1.2, thebound in the translate function is not Point but would have a form F [a] = { x : Int, y :Int, move : Int ! Int ! a}. Therefore, with f-bounded quanti�cation the translate function
could have the type:8(a  { x : Int, y : Int, move : Int ! Int ! a}). a ! aThen the a can instantiate to Point or subtypes of Point, because Point  F [Point]. Note that

142

Chapter 9. Related Workfor subtyping statements such as a  { x : Int, y : Int, move : Int ! Int ! a} to hold, theymust be interpreted using equi-recursive subtyping, since the f-bounds are normally records,
and an iso-recursive type cannot be the subtype of a record. This approach is appealing because
it can even deal with binary methods, where recursive types appear in negative positions. For
example, with f-bounded quanti�cation we can model bounds such as a  { x : Int, eq : a !
Bool}, and still have the expected subtyping relations.

Whereas we show that with the structural unfolding rule we can model positive casesof f-bounded quanti�cation (such as translate) in F , we can only model a restrictive form ofµnegative f-bounded quanti�cation. For instance in F we can have the bound a  µ P. { x :µInt, eq : P ! Bool} and we can instantiate a with P (where P = µ P. { x : Int, eq :P ! Bool}). However, we would not be able to instantiate a with some types that have extra
�elds, such as µ P’. { x : Int, y : Int, eq : P’ ! Bool} for example. In contrast, f-bounded

quanti�cation allows such forms of instantiation. Nevertheless, given the overlap between
some of the applications of iso-recursive types in F and f-bounded quanti�cation, we believeµthat it worthwhile to investigate whether f-bounded quanti�cation can be avoided to deal withgeneral binary methods.

9.2.2 Recursive records and existential types
Recursive records can encode objects [28, 49, 29]. Alternatively, existential types can also be
used to encode objects [97], or they can be employed together with recursive types [27]. Pierce
and Turner [97]’s object encoding is notable in that it requires only F , and does not employ
recursive types. The ORBE encoding, presented by Abadi et al. [3] consists of recursive types,bounded existential quanti�cation, records, and the structural unfolding rule. In their work,
an interface is encoded as:
ORBE( I ) , µa. 9( b  a). b ⇥ ( b ! I ( b))As Bruce, Cardelli, and Pierce observe, the ORBE encoding requires full F for the bounded

quanti�cation subtyping rule. When we try to compare two bounds, the type variable will
be substituted with the existential types, which may result in bounds that are not equivalent.
The overview paper by Bruce, Cardelli, and Pierce [28] makes a detailed comparison amongdi�erent object encodings. Except for the ORBE encoding, F could serve as a target for theµexisting object encodings. However, no complete formalization of F with recursive types
with desirable properties (such as type soundness and conservativity) existed at the time. Our
work helps to further validate such encodings by providing a complete formalization of F
with recursive types, together with various desirable properties.

9.2.3

Algebraic datatypes and subtyping

Algebraic datatypes are a fundamental feature in modern functional programming languages,
such as Haskell [71] and Ocaml [79]. However, such languages do not support subtyping

143

9.2. Object Encodings

between datatypes. Hosoya et al. [73] discussed the interaction between mutually recursive datatypes and subtyping. They presented two variants of F extending F with user-de�ned datatype declarations. The �rst variant has user-de�ned subtyping declarations between datatypes, and can be viewed as having a form of nominal subtyping. The second
variant allows structural subtyping among the datatypes. One advantage of employing userde�ned datatypes is that it is simple to deal with formally, and that it allows mutually recursive
datatype de�nitions easily. However, they do not support conventional recursive types of theform µa. A as we do in F . Moreover, they do not consider lower bounded quanti�cationµwhich, as argued in Chapter 8.1.5, is quite useful in a system targeting algebraic datatypes.

There has been some work integrating ML datatypes and OO classes [23, 87]. In theimplementation of hierarchical extensible datatypes, methods are simulated via functions withdynamic dispatch. Those works are focused on the design of intermediate languages that havecomplex constructs such as classes or datatypes. In contrast, we develop foundational calculi,
where more complex constructs can be encoded.
Finally, Poll [101] investigated the categorical semantics of datatypes with subtyping and alimited form of inheritance on datatypes, improving our understanding on the relation between
categorical datatypes and object types.
Oliveira [90] showed encodings of algebraic datatypes with subtyping assuming a variantof F extended with records, recursive types and higher kinds. He showed that adding subtyping to datatypes allows solving the Expression Problem [116]. However, as we mentioned in
Chapter 8.1.3, he did not formalize the F extension, although he showed a translation of theencoding into Scala. Moreover, his encoding is more complex than ours because he employs
upper bounded quanti�cation with higher kinds. In Chapter 8.1.5, we showed that �rst-order
lower bounded quanti�cation in F , together with the structural folding rule enables suchµ

encodings. Like for encodings of objects, our work is helpful to further validate such encodings
formally.

9.2.4

Disjoint intersection types and record calculi

Disjoint intersection types were originally proposed by Oliveira et al. [89]. Such calculi haveintersection types as well as a merge operator [106, 57] with a disjointness restriction to ensure
the determinism of the language. Follow-up work [4, 20, 19] provides more advanced features,such as disjoint polymorphism and distributive subtyping and �rst-class trait, built upon theoriginal work. With all these features together, an alternative paradigm called Compositional
Programming (CP) is proposed [21, 119]. CP allows for a very modular programming stylewhere the Expression Problem [116] can be solved naturally. A limitation of existing calculi
with disjoint intersection types is that they do not support recursive types, which are important
to encode binary methods [25] or, more generally, recursive object types. The li calculusµaddresses this limitation and shows, for the �rst time, a calculus with disjoint intersection
types and recursive types.

144

Chapter 9. Related Work
The merge operator generalizes concatenation by allowing values of any types (not justrecord types) to be merged. As we described in the introduction the interaction between subtyping and record concatenation is quite tricky. Cardelli and Mitchell [36] observed the problem [36], but did not provide a solution. Instead, they decided to use record extension andrestriction operators instead of concatenation. One solution adopted by some calculi [105,102, 92, 69] is to distinguish between records that can be concatenated, and records that havesubtyping. The choice is mutually exclusive: records that can be concatenated cannot havesubtyping and vice-versa. Such an approach would prevent Cardelli and Mitchell’s f2 example
in Chapter 1.1.3 from type-checking. Calculi with disjoint intersection types, including li , ofµfer a di�erent solution by adopting a type-directed semantics, which ensures that �elds hidden

by subtyping are also hidden at runtime. This allows concatenation and subtyping to be used
together.
As far as we know, no full formalization of a calculus supports subtyping, record concatenation and recursive subtyping at the same time. In Cardelli’s F<:r calculus [33] equi-recursive
subtyping is assumed to be an extension to record subtyping and record concatenation but no
proofs were provided. Palsberg and Zhao’s work [92] shows supporting subtyping, record
concatenation and recursive types (but no recursive subtyping) together for type inference is
NP-complete.

9.2.5

Dependent object types

Dependent object types (DOT), the foundation of Scala, also considers intersection types, aspecial form of equi-recursive type, and a generalized form of bounded quanti�cation [6, 108].
The subtyping rules for intersection types are similar to our li . The generalized form ofµbounded quanti�cation subsumes both upper and lower bounded quanti�cation, which arepresent in F and F . With conventional recursive types µa. A, a stands for the recursiveµµtype itself. In DOT, the recursive type is of the form µ this. A, where this is the (run-time) selfreference. This construct, in combination with the form of dependent types supported in DOT
allows for interesting applications that cannot be modelled with conventional recursive types.
However, there are no records and record concatenation, since objects are directly modelledrather than being encoded via records. Moreover, the rules for recursive types employed insome variants of DOT [108, 117, 66] are mostly structural and employ an inductive de�nitionof subtyping.
The key subtyping rules in the DOT variant by Rompf and Amin [108] are shown next:G, z : T1z ` T1z <: T2z

BindX
G ` µz. T1z <: µz. T2z

G ` x : Tx
VarPackG ` x : µz. T z

G, z : T1z ` T1z <: T2
G ` µz. T1z <: T2

BindI

G ` x : µz. T z
VarUnpackG ` x : Tx

145

9.2. Object Encodings

We adapt the notation employed by Rompf and Amin [108] for recursive types to our notation.
In the rules, T z denotes that variable z is free in type T. Rule B���X is in essence a one-step �nite unfolding of the recursive type, leading to an inductive de�nition of subtyping. Thus, suchde�nition is unlike approaches to equi-recursive subtyping, where a non-structural coinductive formulation of subtyping is used instead. The second rule for recursive types (rule B���I)
is a special case where a recursive type µz. T1z is a subtype of another type T2 if T2 does notcontain the recursive variable z. A di�erence between recursive types µz. T z in DOT andthe ones in this thesis is that in DOT z is a term variable instead of a type variable. In DOT,
recursive types can be used in combination with path-dependent types [9], to denote types
such as z.L, where z represents a (possibly recursive) term with a type member L. Becauseof this design, the typing rules that introduce and eliminate recursive types [108], are de�ned
on variables. Unlike our formulation of subtyping, which is algorithmic, DOT’s formulation ofsubtyping is usually presented in a declarative form. Undecidability is an important problem
with DOT’s formulation of subtyping [74], and the existing decidable fragments of DOT lacktransitivity [74, 85]. The research on DOT has been intimately related to F . For instance,
Amin and Rompf [8] explain many of the features of DOT by incrementally extending F . In

addition, there have been various attempts to prove the undecidability of DOT by a reduction
to the undecidability problem in F . Although, as Hu and Lhoták [74] observed, DOT is notconservative over F . Thus an undecidability result for DOT cannot be proved by reduction to
the undecidability of full F . While F does not have all the features of DOT, our results canµ

potentially help in research in that area, where the decidable fragments of DOT lack important
properties such as transitivity. In addition Fµ

DOT does not.

preserves the conservativity over F , while

147

Chapter 10

Conclusion and Future WorkIn this thesis, we revisit the problem of iso-recursive subtyping and come up with novel declarative and algorithmic formulations of subtyping. We pay special attention to the metatheory,
which is fully formalized in the Coq theorem prover. We believe that our work signi�cantly
improves the understanding of iso-recursive subtyping, and provides a platform for further
developments in this area. More practically, the double unfolding rule and nominal unfolding rule are easy to integrate in existing calculi and this work presents the proof techniques
needed to prove standard properties (such as transitivity and type soundness). Moreover, weshow that it is easy to employ our algorithmic subtyping rules to subtyping relations that are
not antisymmetric. For example, we study the combination of iso-recursive subtyping and intersection types, and showed that this combination is well-behaved using the novel nominal
unfolding rules. While both the double unfoldings and the nominal unfoldings are equivalentin simpler settings, they are di�erent in the presence of more advanced type system features.
We have found a counter-example for intersection types, and we suspect that this is also thecase for bounded quanti�cation. Fortunately, the nominal unfolding rules seem to work in all
settings so far. From a practical point of view, we also discussed how to employ iso-recursive
subtyping in object encodings. As a concrete example, our li calculus illustrates that the 3µfeatures, recursive types, extensible record types and intersection types, can be put together
in a single calculus. Object types can be modelled with recursive records and multiple inheritance can be modelled via intersection types and record concatenation. Therefore our liµµcalculus can be used to provide simple encodings for objects. Finally, our F calculus illus-

trates how to integrate iso-recursive types and kernel F . We obtain a transitive and decidable

subtyping relation, while the full calculus is shown to be conservative over F and is provento be type-sound. F and Fµµ

could serve as the theoretic foundation for object encodings

and encodings of algebraic datatypes with subtyping. With the renewed interest on recursive
types and bounded quanti�cation due to the DOT calculus, we believe that our work is also
helpful to �nd calculi with most features in DOT, while retaining desirable properties, such as
decidability and transitivity of subtyping.
There are a few interesting directions for future work.

148

Chapter 10. Conclusion and Future Work

10.1

Recursive Subtyping with One-Step Unfolding

As we describe at Chapter 3, currently, in our subtyping rules for iso-recursive types, the number of times that the left and the right types are unfolded is required to be exactly the same.
The cases where we would unfold the recursive types a di�erent number of types on the left
and on the right, are not allowed. However, as Ligatti et al. [84] point out, allowing subtyping
between an iso-recursive type and its one-step unfolding does not break the type soundness.
The example they gave is:µi.{sub : (µi0 .{sub : i0 ! unit}) ! unit, min : unit ! int}  µi.{sub : i ! unit}
the left type can be regarded as the one-step unfolding of the right type with some extra �elds.
Our subtyping formulation for iso-recursive types is not able to capture this subtyping relationship. However, we can add two extra rules:
S���������

S����������

G ` [ a 7 ! Aa ] A  [ a 7 ! Ba ] B

G ` [ a 7 ! Aa ] A  [ a 7 ! Ba ] B

G ` Aa  µa. BG ` µa. A  Ba

The key point of these two rules rule S��������� and rule S���������� is reusing thelabel/name. Note that in our Coq formalization, the a in µa. A and µa. B is practically abounded variable, and during the derivation it will be converted to a free variable a, which isalready stored in the context. With those two new rules, we can derive the example above. For
saving space, let us denote µi0 .{sub : i0 ! unit} as A and {sub : i ! unit} as B.
i ` {sub : Bi ! unit}  {sub : Bi ! unit}i ` {sub : i ! unit}i  µi0 .{sub : i0 ! unit}i ` Bi  A
i ` unit  uniti ` A ! unit  Bi ! uniti ` {sub : A ! unit, min : unit ! int}  {sub : Bi ! unit}` µi.{sub : A ! unit, min : unit ! int}  µi.{sub : i ! unit}

From the derivation tree, we can see that once we compare a label type to a recursive typein rule S��������� and rule S����������, it actually triggers the unfolded recursive type to
unfold one more time. Therefore, during the derivation, µi.{sub : A ! unit, min : unit !

int} unfolds one time and µi.{sub : i ! unit} unfolds two times, and then they can compare
directly with the same number of unfoldings.

We should note that, although adding two new rules to our formulations presented inthis thesis does make them more powerful, they are not complete. In Chapter 9.1.2, we give a
counter-example that shows that µa. a is subtype of µa.(µb. a) under the rules by Ligatti etal. [84]. However, under our formulation, even when we add two new rules, they are still not
subtype.

149

10.2. Distributive Iso-Recursive Subtyping

10.2

Distributive Iso-Recursive Subtyping

In Chapter 7, our li type system combines the features of recursive types and intersectionµ

types. When a system involves intersection types, it is quite useful to have distributive law for
subtyping [17].
S��������

G ` (A1 ! A2 )&(A1 ! A3 )  A1 ! A2 &A3For example, rule S�������� is the distributive law for subtyping involves intersection
types and function types. By adding this rule, we can claim that ( A1 ! A2 )&( A1 ! A3 )and A1 ! ( A2 &A3 ) are equivalent via:

G ` A1  A1
G ` A2 &A3  A2
G ` A1  A1
G ` A2 &A3  A3
G ` A1 ! A2 &A3  A1 ! A2
G ` A1 ! A2 &A3  A1 ! A3
G ` A1 ! A2 &A3  ( A1 ! A2 )&( A1 ! A3 )It is not hard to support the distributive law for subtyping involving intersection types andrecord types or universal types. However, if we want to support the distributive law for subtyping involving intersection types and recursive types, we will lose the equivalence property.
Concretely, we might want to add the following rule:S��������

G ` (µa. A1 )&(µa. A2 )  µa. A1 &A2When the recursive variable occurs positively, (µa. A1 )&(µa. A2 ) and µa. A1 &A2 areequivalent, while when the recursive variable occurs negatively, the equivalence is not satis�ed. Let A = (a ! nat)&(a ! char), a counter-example is:

Derivation fails herea ` a ! char  a ! nat···a ` a ! char  (a ! nat)&(a ! char)a ` (a ! char)a  Aa···aaa ` A ! char  (a ! char) ! charaa ` ( A ! nat)&( Aa ! char)  (a ! char)a ! char···
` µa. (a ! nat)&(a ! char)  µa. a ! char
` µa. (a ! nat)&(a ! char)  (µa. a ! nat)&(µa. a ! char)

Unfortunately, many approaches [20, 95, 75] somehow rely on the equivalence property,
thus we have no idea about how to add rule S�������� to our li type system yet. If we canµsupport the distributive law for recursive subtyping, we can encode nested composable traits
with binary methods [119].

10.3

Full F with Iso-Recursive Types

Our F calculus is built upon the kernel F via integrating rule S���������� and rule S�����.
µAs we discussed in Chapter 9.2.2, if we want to model the ORBE encoding [3], the combinationof iso-recursive subtyping and kernel F is not enough. For encoding imperative object types,

150

Chapter 10. Conclusion and Future Work

investigating extensions of rule S����� with rule S�������� instead of rule S���������� is aclear avenue for future work.
Unfortunately, we cannot apply the technique we used in Chapter 8.3.1 to full F . In the

proof of generalized unfolding lemma for F , we pick up an intermediate type between theµ

two bounds, and the bounds are required to be equivalent when they are compared, thus theintermediate type is also equivalent to the bounds. However, in full F , in the context, the type

C and D will swap due to the contravariance, thus the intermediate type is not equivalent tothe bounds, and the proof breaks.
We believe that it is feasible to combine iso-recursive subtyping with full F . The cur-rent approach in Chapter 8.3.1 for generalized unfolding lemma does not try to generalize thecontext, in which we think it is the key point for rescue the proof, so that we can process tothe type soundness. Other properties, such as re�exivity and transitivity, like F , are easyµto prove. We note that, since full F is not decidable [98], the combination of iso-recursive
subtyping and full F is obviously not decidable neither.

10.4

Getting F-Bounded Polymorphism for FreeIn Chapter 10.1, we discuss a possible way to enhance the expressive power of our subtyping
rules for iso-recursive types in a simpler type system. If we apply this approach to the more
complete type system, in order words, extending F with those two new rules rule S���������
µand rule S����������, we are able to model f-bounded polymorphism [29].

In Chapter 8.1.2, we showed that the usage of structural unfolding rule enabled us tomodel positive f-bounded polymorphism. However, for the bound where the variable appears
negatively, such as a  µP. {eq : P ! bool}, we can only instantiate a with the recursivetype itself, disallowing having the extra �elds.

The addition of rule S��������� and rule S���������� solves this problem. For example,
we can have the following subtyping statement:µP. {eq : (µP’. {eq : P’ ! bool, x : Int, y : Int}) ! bool, x : Int, y : Int, color : String}µP. {eq : P ! bool, x : Int, y : Int}in which the left type represent an encoding of the colored point, while the right type (denoted
as Point) is the encoding of the base point. Then the base class of point is de�ned as:class Point {eq : function ( p : Point ) : bool = {p . x == this . x && p . y == this . y}
x : Int ;y : Int ;}151

10.5. Higher-Order Type System with Iso-Recursive Types
and the class colored point is de�ned as:class ColoredPoint extends Point {color : String ;}where the common �elds are inherited from the base class, and the polymorphic binary method
distance is de�ned as:function distance ( P <: Point , p1 : P , p2 : P ) : Int = sqrt ( sqr ( p1 . x- p2 . x ) + sqr ( p1 . y - p2 . y ) )10.5

Higher-Order Type System with Iso-Recursive Types

We already discussed the addition of iso-recursive subtyping in both �rst-order type system(simply typed lambda calculus, STLC) in Chapter 3 and 4, and second-order type system (simply
typed lambda calculus with polymorphism, System F) in Chapter 8. It is also interesting tosee how iso-recursive subtyping can be integrated into a higher-order type system. In STLC, avalue is dependent on a type. In System F, a value is dependent on a type and a term. In a higherorder type system, a type can abstract over another type, which enables the type constructors.
Some more complex features, such as abstract data structures and general self types, can bemodeled. The �rst higher-order type system, Fw [68], does not have subtyping. Later, Fw is
extended to Fw  [34, 47, 94], where the subtyping is added. For targeting a higher-order typesystem with recursive types and subtyping, Bruce and Mitchell [26] extended Fw  to Fw  ,µwhich is also used to interpret f-bounded polymorphism [29]. Note that the recursive types in
Bruce and Mitchell [26]’s work are interpreted as equi-recursive types, which is signi�cantly
more complex than what we proposed in Chapter 10.4. A simpler calculus of Fw  , by replacingµthe equi-recursive types with iso-recursive types, is worthy to explore.

153

Bibliography[1]

M. Abadi and L. Cardelli. A theory of objects. Springer Science & Business Media, 2012.

[2]

M. Abadi, L. Cardelli, P.-L. Curien, and J.-J. Lévy. “Explicit Substitutions”. In: J. Funct.

[3]

M. Abadi, L. Cardelli, and R. Viswanathan. “An interpretation of objects and object

Program. 1.4 (1991), pp. 375–416.
types”. In: Proceedings of the 23rd ACM SIGPLAN-SIGACT symposium on Principles ofprogramming languages. 1996, pp. 396–409.
[4]

J. Alpuim, B. C. d. S. Oliveira, and Z. Shi. “Disjoint polymorphism”. In: European Symposium on Programming. Springer. 2017, pp. 1–28.

[5]

R. M. Amadio and L. Cardelli. “Subtyping recursive types”. In: ACM Transactions on[6]

N. Amin, S. Grütter, M. Odersky, T. Rompf, and S. Stucki. “The essence of dependent

Programming Languages and Systems (TOPLAS) 15.4 (1993), pp. 575–631.
object types”. In: A List of Successes That Can Change the World. Springer, 2016, pp. 249–
272.
[7]

N. Amin, A. Moors, and M. Odersky. “Dependent object types”. In: 19th International
Workshop on Foundations of Object-Oriented Languages. CONF. 2012.

[8]

N. Amin and T. Rompf. “Type soundness proofs with de�nitional interpreters”. In: Proceedings of the 44th ACM SIGPLAN Symposium on Principles of Programming Languages.
2017, pp. 666–679.

[9]

N. Amin, T. Rompf, and M. Odersky. “Foundations of Path-Dependent Types”. In: Proceedings of the 2014 ACM International Conference on Object Oriented Programming, Systems, Languages, and Applications. OOPSLA ’14. Association for Computing Machinery,
2014.

[10]

A. W. Appel and A. P. Felty. “A semantic model of types and machine instructions for
proof-carrying code”. In: Proceedings of the 27th ACM SIGPLAN-SIGACT symposium on
Principles of programming languages. 2000, pp. 243–253.

[11]

B. Aydemir, A. Charguéraud, B. C. Pierce, R. Pollack, and S. Weirich. “Engineering formal metatheory”. In: Acm sigplan notices 43.1 (2008), pp. 3–15.

[12]

M. Backes, C. Hriţcu, and M. Ma�ei. “Union, intersection and re�nement types andreasoning about type disjointness for secure protocol implementations”. In: Journal ofComputer Security 22.2 (2014), pp. 301–353.

[13]

P. Baldan, G. Ghelli, and A. Ra�aeta. “Basic theory of F-bounded quanti�cation”. In:
Information and Computation 153.2 (1999), pp. 173–237.

[14]

F. Barbanera and M. Dezani-Ciancaglini. “Intersection and union types”. In: International Symposium on Theoretical Aspects of Computer Software. Springer. 1991, pp. 651–
674.

154
[15]

Bibliography
F. Barbanera, M. Dezani-Ciancaglini, and U. de’Liguoro. “Intersection and Union Types:
Syntax and Semantics”. In: Information and Computation 119.2 (June 1995), pp. 202–230.

[16]

F. Barbanera, M. Dezaniciancaglini, and U. Deliguoro. “Intersection and union types:
syntax and semantics”. In: Information and Computation 119.2 (1995), pp. 202–230.

[17]

H. Barendregt, M. Coppo, and M. Dezani-Ciancaglini. “A �lter lambda model and thecompleteness of type assignment”. In: The journal of symbolic logic 48.4 (1983), pp. 931–

940.
[18] J. Bengtson, K. Bhargavan, C. Fournet, A. D. Gordon, and S. Ma�eis. “Re�nement types
for secure implementations”. In: ACM Transactions on Programming Languages and Systems (TOPLAS) 33.2 (2011), pp. 1–45.
[19]

X. Bi and B. C. d. S. Oliveira. “Typed �rst-class traits”. In: 32nd European Conference on
Object-Oriented Programming (ECOOP 2018). 2018.

[20]

X. Bi, B. C. d. S. Oliveira, and T. Schrijvers. “The essence of nested composition”. In:
32nd European Conference on Object-Oriented Programming (ECOOP 2018). 2018.

[21]

X. Bi, N. Xie, B. C. d. S. Oliveira, and T. Schrijvers. “Distributive disjoint polymorphism
for compositional programming”. In: European Symposium on Programming. Springer,
Cham. 2019, pp. 381–409.

[22]

C. Böhm and A. Berarducci. “Automatic synthesis of typed Lambda-programs on term
algebras”. In: Theoretical Computer Science 39.2-3 (1985).

[23]

F. Bourdoncle and S. Merz. “Type checking higher-order polymorphic multi-methods”.
In: Proceedings of the 24th ACM SIGPLAN-SIGACT symposium on Principles of programming languages. 1997, pp. 302–315.

[24]

M. Brandt and F. Henglein. “Coinductive axiomatization of recursive type equality andsubtyping”. In: vol. 1210. Full version in Fundamenta Informaticae, 33:309–338, 1998.
Apr. 1997, pp. 63–81.

[25]

K. Bruce, L. Cardeli, G. Castagna, T. H. O. Group, G. T. Leavens, and B. Pierce. “Onbinary methods”. In: Theory and Practice of Object Systems 1.3 (1996).

[26]

K. Bruce and J. C. Mitchell. “PER models of subtyping, recursive types and higherorder polymorphism”. In: Proceedings of the 19th ACM SIGPLAN-SIGACT symposiumon Principles of programming languages. 1992, pp. 316–327.

[27]

K. B. Bruce. “A paradigmatic object-oriented programming language: Design, static
typing and semantics”. In: Journal of Functional Programming 4.2 (1994), pp. 127–206.

[28]

K. B. Bruce, L. Cardelli, and B. C. Pierce. “Comparing Object Encodings”. In: vol. 155. 1.
1999.

[29]

P. Canning, W. Cook, W. Hill, W. Oltho�, and J. C. Mitchell. “F-Bounded Polymorphism
for Object-Oriented Programming”. In: Proceedings of the Fourth International Conference on Functional Programming Languages and Computer Architecture. FPCA 1989. Imperial College, London, United Kingdom, 1989.

[30]

L. Cardelli. “A Language with Distributed Scope”. In: Proceedings of the 22nd ACM
SIGPLAN-SIGACT Symposium on Principles of Programming Languages. POPL ’95. 1995,
pp. 286–297.

[31]

L. Cardelli. “A semantics of multiple inheritance”. In: Semantics of Data Types. 1984.

Bibliography
[32]

155

L. Cardelli. “Amber”. In: LITP Spring School on Theoretical Computer Science. Springer.
1985, pp. 21–47.

[33]

L. Cardelli. Extensible records in a pure calculus of subtyping. Digital. Systems Research[34]

L. Cardelli. “Structural subtyping and the notion of power type”. In: Proceedings of theCenter, 1992.
15th ACM SIGPLAN-SIGACT symposium on Principles of programming languages. 1988,[35]

pp. 70–79.
L. Cardelli, S. Martini, J. C. Mitchell, and A. Scedrov. “An extension of system F with
subtyping”. In: Information and computation 109.1-2 (1994), pp. 4–56.

[36]

L. Cardelli and J. C. Mitchell. “Operations on records”. In: Mathematical Structures in
Computer Science 1.1 (1991), pp. 3–48.

[37]

L. Cardelli and P. Wegner. “On understanding types, data abstraction, and polymorphism”. In: ACM Computing Surveys (CSUR) 17.4 (1985), pp. 471–523.

[38]

F. Cardone. “Recursive types for Fun”. In: Theoretical Computer Science 83.1 (1991),
pp. 39–56.

[39]

G. Castagna, M. Dezani-Ciancaglini, E. Giachino, and L. Padovani. “Foundations of session types”. In: Proceedings of the 11th ACM SIGPLAN conference on Principles and practice of declarative programming. 2009, pp. 219–230.

[40]

G. Castagna and A. Frisch. “A Gentle Introduction to Semantic Subtyping”. In: Proceedings of the 7th ACM SIGPLAN International Conference on Principles and Practice ofDeclarative Programming. PPDP ’05. 2005.

[41]

G. Castagna and B. C. Pierce. “Decidable Bounded Quanti�cation”. In: Proceedings of the
21st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. POPL
’94. Portland, Oregon, USA: Association for Computing Machinery, 1994, pp. 151–162.
����: 0897916360.

[42]

A. Charguéraud. “The Locally Nameless Representation”. In: Journal of Automated Reasoning (2011). 10.1007/s10817-011-9225-2, pp. 1–46. ����: 0168-7433.

[43]

T.-C. Chen, M. Dezani-Ciancaglini, and N. Yoshida. “On the preciseness of subtyping
in session types”. In: Proceedings of the 16th International Symposium on Principles andPractice of Declarative Programming. 2014, pp. 135–146.

[44]

R. Chugh. “IsoLATE: A type system for self-recursion”. In: European Symposium on
Programming. Springer. 2015, pp. 257–282.

[45]

A. Church. “A set of postulates for the foundation of logic”. In: Annals of Mathematics
33.2 (1932), pp. 346–366.

[46]

D. Colazzo and G. Ghelli. “Subtyping recursion and parametric polymorphism in kernelfun”. In: Information and Computation 198.2 (2005), pp. 71–147.

[47]

A. B. Compagnoni. Higher-order subtyping with intersection types. [Sl: sn], 1995.

[48]

A. B. Compagnoni and B. C. Pierce. “Higher-order intersection types and multiple inheritance”. In: Mathematical Structures in Computer Science 6.5 (1996), pp. 469–501.

[49]

W. R. Cook, W. Hill, and P. S. Canning. “Inheritance is Not Subtyping”. In: Proceedingsof the 17th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages.
POPL ’90. 1989, pp. 125–135.

156
[50]

Bibliography
W. R. Cook and J. Palsberg. “A denotational semantics of inheritance and its correctness”. In: Object-Oriented Programming: Systems, Languages and Applications (OOPSLA). 1989.

[51]

M. Coppo, M. Dezani-Ciancaglini, and B. Venneri. “Functional Characters of Solvable
Terms”. In: Mathematical Logic Quarterly 27.2-6 (1981), pp. 45–58.

[52]

K. Crary, R. Harper, and S. Puri. “What is a Recursive Module?” In: Proceedings of the
ACM SIGPLAN 1999 Conference on Programming Language Design and Implementation.
PLDI ’99. 1999.

[53]
[54]

P.-L. Curien and G. Ghelli. “Coherence of subsumption, minimum typing and typechecking in F ”. In: Mathematical structures in computer science 2.1 (1992), pp. 55–91.

F. M. Damm. “Subtyping with union types, intersection types and recursive types”. In:

International Symposium on Theoretical Aspects of Computer Software. Springer. 1994,
pp. 687–706.
[55]

N. A. Danielsson and T. Altenkirch. “Subtyping, declaratively”. In: International Conference on Mathematics of Program Construction. Springer. 2010, pp. 100–118.

[56]

D. Duggan. “Type-safe linking with recursive DLLs and shared libraries”. In: ACM
Transactions on Programming Languages and Systems (TOPLAS) 24.6 (2002), pp. 711–
804.

[57]

J. Dun�eld. “Elaborating intersection and union types”. In: Journal of Functional Programming 24.2-3 (2014), pp. 133–165.

[58]

Eclipse Foundation. Ceylon. Version 1.3.3. 2017. ���: https://ceylon-lang.org/.

[59]

EPFL. Scala 3. 2021. ���: https://www.scala-lang.org/.

[60]

Facebook. Flow. Version 0.154.0. 2021. ���: https://flow.org/.

[61]

A. Frisch, G. Castagna, and V. Benzaken. “Semantic subtyping”. In: Proceedings 17th
Annual IEEE Symposium on Logic in Computer Science. IEEE. 2002, pp. 137–146.

[62]

V. Gapeyev, M. Levin, and B. Pierce. “Recursive Subtyping Revealed”. In: Journal of
Functional Programming 12.6 (2003). Preliminary version in International Conference on
Functional Programming (ICFP), 2000. Also appears as Chapter 21 of Types and Programming Languages by Benjamin C. Pierce (MIT Press, 2002)., pp. 511–548.

[63]

S. Gay and M. Hole. “Subtyping for session types in the pi calculus”. In: Acta Informatica
42.2-3 (2005), pp. 191–225.

[64]

S. J. Gay and V. T. Vasconcelos. “Linear type theory for asynchronous session types”.
In: Journal of Functional Programming 20.1 (2010), pp. 19–50.

[65]
[66]

G. Ghelli. “Recursive types are not conservative over F ”. In: International Conference

on Typed Lambda calculi and Applications. Springer. 1993, pp. 146–162.
P. G. Giarrusso, L. Stefanesco, A. Timany, L. Birkedal, and R. Krebbers. “Scala Step-byStep: Soundness for DOT with Step-Indexed Logical Relations in Iris”. In: Proc. ACM
Program. Lang. 4.ICFP (Aug. 2020).

[67]

J.-Y. Girard. “Interprétation fonctionnelle et elimination des coupures de l’arithmétiqued’ordre supérieur”. Thèse d’état. Université de Paris 7, 1972.

[68]

J.-Y. Girard. “Une extension de L’interpretation de gödel a L’analyse, et son applicationa L’elimination des coupures dans L’analyse et la theorie des types”. In: Studies in Logic
and the Foundations of Mathematics. Vol. 63. Elsevier, 1971, pp. 63–92.

Bibliography
[69]

157

N. Glew. “An E�cient Class and Object Encoding”. In: Proceedings of the 15th ACM
SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications. OOPSLA ’00. Association for Computing Machinery, 2000, pp. 311–324.

[70]

B. Greenman, F. Muehlboeck, and R. Tate. “Getting F-bounded polymorphism into
shape”. In: ACM SIGPLAN Notices 49.6 (2014), pp. 89–99.

[71]

Haskell Development Team. Haskell. 1990. ���: https://www.haskell.org/.

[72]

M. Hofmann and B. C. Pierce. “Positive subtyping”. In: Information and Computation
126.1 (1996), pp. 11–33.

[73]

H. Hosoya, B. C. Pierce, D. N. Turner, et al. “Datatypes and subtyping”. In: Unpublishedmanuscript. Available http://www. cis. upenn. edu/˜ bcpierce/papers/index. html (1998).

[74]

J. Z. Hu and O. Lhoták. “Undecidability of dsub and its decidable fragments”. In: Pro-

[75]

X. Huang and B. C. d. S. Oliveira. “Distributing intersection and union types with splits

ceedings of the ACM on Programming Languages 4.POPL (2019), pp. 1–30.
and duality (functional pearl)”. In: Proceedings of the ACM on Programming Languages
5.ICFP (2021), pp. 1–24.
[76]

X. Huang and B. C. d. S. Oliveira. “A Type-Directed Operational Semantics For a Calculus with a Merge Operator”. In: 34th European Conference on Object-Oriented Programming (ECOOP 2020). Vol. 166. 2020.

[77]

X. Huang, J. Zhao, and B. C. d. S. Oliveira. “Taming the merge operator: a type-directed
operational semantics approach”. In: Journal of Functional Programming (2021).

[78]

A. Igarashi, B. C. Pierce, and P. Wadler. “Featherweight Java: a minimal core calculus forJava and GJ”. In: ACM Transactions on Programming Languages and Systems (TOPLAS)
23.3 (2001), pp. 396–450.

[79]

INRIA. OCaml. 1987. ���: https://ocaml.org/.

[80]

A. Je�rey. “A symbolic labelled transition system for coinductive subtyping of Fˆ<types”. In: 2001 IEEE Conference on Logic and Computer Science (LICS 2001). 2001, p. 323.

[81]

A. J. Kennedy and B. C. Pierce. “On decidability of nominal subtyping with variance”.
In: (2006).

[82]

L. Zhou, Y. Zhou, and B. C. d. S. Oliveira. “Recursive Subtyping for All”. In: 57th Symposium on Principles of Programming Languages (POPL 2023) (Conditional accepted). 2023.

[83]

J. Lee, J. Aldrich, T. Shaw, and A. Potanin. “A Theory of Tagged Objects”. In: European
Conference on Object-Oriented Programming (ECOOP). 2015.

[84]

J. Ligatti, J. Blackburn, and M. Nachtigal. “On subtyping-relation completeness, with anapplication to iso-recursive types”. In: ACM Transactions on Programming Languages[85]

and Systems (TOPLAS) 39.1 (2017), pp. 1–36.
J. Mackay, A. Potanin, J. Aldrich, and L. Groves. “Decidable subtyping for path dependent types”. In: Proceedings of the ACM on Programming Languages 4.POPL (2019),
pp. 1–27.

[86]

Microsoft. TypeScript. Version 4.3. 2021. ���: https://www.typescriptlang.org/.

[87]

T. Millstein, C. Bleckner, and C. Chambers. “Modular typechecking for hierarchicallyextensible datatypes and functions”. In: ACM Transactions on Programming Languages
and Systems (TOPLAS) 26.5 (2004), pp. 836–889.

158
[88]

Bibliography
J. H. J. Morris. “Lambda-calculus models of programming languages.” PhD thesis. Massachusetts Institute of Technology, 1969.

[89]

B. C. d. S. Oliveira, Z. Shi, and J. Alpuim. “Disjoint intersection types”. In: Proceedingsof the 21st ACM SIGPLAN International Conference on Functional Programming. 2016,
pp. 364–377.

[90]

B. C. d. S. Oliveira. “Modular visitor components”. In: European Conference on Object-

Oriented Programming. Springer. 2009, pp. 269–293.
[91] B. C. d. S. Oliveira, S. Cui, and B. Rehman. “The Duality of Subtyping”. In: 34th European
Conference on Object-Oriented Programming, ECOOP 2020, November 15-17, 2020, Berlin,
Germany (Virtual Conference). Ed. by R. Hirschfeld and T. Pape. LIPIcs. 2020.
[92]

J. Palsberg and T. Zhao. “Type Inference for Record Concatenation and Subtyping”. In:
Inf. Comput. 189.1 (Feb. 2004).

[93]

M. Parigot. “Recursive programming with proofs”. In: Theoretical Computer Science 94.2
(1992), pp. 335–356.

[94]

B. Pierce and M. Ste�en. “Higher-order subtyping”. In: Theoretical computer science
176.1-2 (1997), pp. 235–282.

[95]

B. C. Pierce. A decision procedure for the subtype relation on intersection types withbounded variables. Carnegie-Mellon University. Department of Computer Science, 1989.

[96]

B. C. Pierce. Bounded quanti�cation with bottom. Tech. rep. Citeseer, 1997.

[97]

B. C. Pierce and D. N. Turner. “Simple type-theoretic foundations for object-oriented
programming”. In: Journal of functional programming 4.2 (1994), pp. 207–247.

[98]

B. C. Pierce. “Bounded quanti�cation is undecidable”. In: Information and Computation
112.1 (1994), pp. 131–165.

[99]

B. C. Pierce. “Intersection types and bounded polymorphism”. In: Mathematical Structures in Computer Science 7.2 (1997), pp. 129–193.

[100]

B. C. Pierce. Types and programming languages. MIT press, 2002.

[101]

E. Poll. “Subtyping and Inheritance for Categorical Datatypes: Preliminary Report (TypeTheory and its Applications to Computer Systems)”. In: Kyoto University Research Information Repository 1023 (1998), pp. 112–125.

[102]

F. Pottier. “A 3-part type inference engine”. In: European Symposium on Programming.

[103]

F. Pottier. “Syntactic soundness proof of a type-and-capability system with hidden

Springer. 2000, pp. 320–335.
state”. In: Journal of functional programming 23.1 (2013), pp. 38–144.
[104]

G. Pottinger. “A type assignment for the strongly normalizable l-terms”. In: To HB[105]

Curry: essays on combinatory logic, lambda calculus and formalism (1980), pp. 561–577.
D. Rémy. “A case study of typechecking with constrained types: Typing record concatenation”. Presented at the workshop on Advances in types for computer science at
the Newton Institute, Cambridge, UK. 1995.

[106]

J. C. Reynolds. “Preliminary design of the programming language Forsythe”. In: (1988).

[107]

J. C. Reynolds. “Towards a theory of type structure”. In: Colloque sur la Programmation.
Springer. 1974, pp. 408–425.

Bibliography
[108]

159

T. Rompf and N. Amin. “Type soundness for dependent object types (DOT)”. In: Proceedings of the 2016 ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications. 2016, pp. 624–641.

[109]

D. Sangiorgi and R. Milner. “The Problem of “Weak Bisimulation up to””. In: CONCUR.
Vol. 630. 1992, pp. 32–46.

[110]

D. Scott. “A system of functional abstraction”. Lectures delivered at University of Cal-[111]

ifornia, Berkeley, California, USA, 1962/63. 1962.
J. G. Siek and S. Tobin-Hochstadt. “The recursive union of some gradual types”. In: A
List of Successes That Can Change the World. Springer, 2016, pp. 388–410.

[112]

M. Solomon. “Type de�nitions with parameters”. In: Proceedings of the 5th ACM SIGACTSIGPLAN symposium on Principles of programming languages. 1978, pp. 31–38.

[113]

C. Stone and R. Harper. A Type-Theoretic Account of Standard ML 1996. Tech. rep. CMUCS-96-136. School of Computer Science, Carnegie Mellon University, May 1996.

[114]

N. Swamy, J. Chen, C. Fournet, P.-Y. Strub, K. Bhargavan, and J. Yang. “Secure Distributed Programming with Value-Dependent Types”. In: Proceedings of the 16th ACM
SIGPLAN International Conference on Functional Programming. ICFP 2011. 2011.

[115]

J. C. Vanderwaart, D. Dreyer, L. Petersen, K. Crary, R. Harper, and P. Cheng. “Typed
Compilation of Recursive Datatypes”. In: Proceedings of the 2003 ACM SIGPLAN International Workshop on Types in Languages Design and Implementation. 2003, pp. 98–108.

[116]

P. Wadler. “The Expression Problem”. discussion on the Java Genericity mailing list.
1998.

[117]

F. Wang and T. Rompf. “Towards strong normalization for dependent object types(DOT)”. In: 31st European Conference on Object-Oriented Programming (ECOOP 2017).
Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik. 2017.

[118]

Y. Yang and B. C. d. S. Oliveira. “Pure iso-type systems”. In: Journal of Functional Programming 29 (2019).

[119]

W. Zhang, Y. Sun, and B. C. d. S. Oliveira. “Compositional Programming”. In: ACM
Transactions on Programming Languages and Systems (TOPLAS) (2021), pp. 1–60.

[120]

Y. Zhou, B. C. d. S. Oliveira, and A. Fan. “A Calculus with Recursive Types, Record
Concatenation and Subtyping”. In: Asian Symposium on Programming Languages andSystems (APLAS 2022). 2022.

[121]

Y. Zhou, B. C. d. S. Oliveira, and J. Zhao. “Revisiting iso-recursive subtyping”. In: Proceedings of the ACM on Programming Languages 4.OOPSLA (2020), pp. 1–28.

[122]

Y. Zhou, J. Zhao, and B. C. d. S. Oliveira. “Revisiting Iso-Recursive Subtyping”. In: ACM
Trans. Program. Lang. Syst. 44.4 (Sept. 2022). ����: 0164-0925.