-
Notifications
You must be signed in to change notification settings - Fork 1
/
Norm.html
1497 lines (1251 loc) · 197 KB
/
Norm.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<link href="coqdoc.css" rel="stylesheet" type="text/css"/>
<title>Norm: Normalization of STLC</title>
<script type="text/javascript" src="jquery-1.8.3.js"></script>
<script type="text/javascript" src="main.js"></script>
</head>
<body>
<div id="page">
<div id="header">
</div>
<div id="main">
<h1 class="libtitle">Norm<span class="subtitle">Normalization of STLC</span></h1>
<div class="code code-tight">
</div>
<div class="doc">
</div>
<div class="code code-tight">
<br/>
<span class="comment">(* $Date: 2014-04-23 07:36:43 -0400 (Wed, 23 Apr 2014) $ *)</span><br/>
<span class="comment">(* Chapter maintained by Andrew Tolmach *)</span><br/>
<br/>
<span class="comment">(* (Based on TAPL Ch. 12.) *)</span><br/>
<br/>
<span class="id" type="keyword">Require</span> <span class="id" type="keyword">Export</span> <span class="id" type="var">Smallstep</span>.<br/>
<span class="id" type="keyword">Hint</span> <span class="id" type="var">Constructors</span> <span class="id" type="var">multi</span>.<br/>
<br/>
</div>
<div class="doc">
<div class="paragraph"> </div>
(This chapter is optional.)
<div class="paragraph"> </div>
In this chapter, we consider another fundamental theoretical property
of the simply typed lambda-calculus: the fact that the evaluation of a
well-typed program is guaranteed to halt in a finite number of
steps—-i.e., every well-typed term is <i>normalizable</i>.
<div class="paragraph"> </div>
Unlike the type-safety properties we have considered so far, the
normalization property does not extend to full-blown programming
languages, because these languages nearly always extend the simply
typed lambda-calculus with constructs, such as general recursion
(as we discussed in the MoreStlc chapter) or recursive types, that can
be used to write nonterminating programs. However, the issue of
normalization reappears at the level of <i>types</i> when we consider the
metatheory of polymorphic versions of the lambda calculus such as
F_omega: in this system, the language of types effectively contains a
copy of the simply typed lambda-calculus, and the termination of the
typechecking algorithm will hinge on the fact that a ``normalization''
operation on type expressions is guaranteed to terminate.
<div class="paragraph"> </div>
Another reason for studying normalization proofs is that they are some
of the most beautiful—-and mind-blowing—-mathematics to be found in
the type theory literature, often (as here) involving the fundamental
proof technique of <i>logical relations</i>.
<div class="paragraph"> </div>
The calculus we shall consider here is the simply typed
lambda-calculus over a single base type <span class="inlinecode"><span class="id" type="var">bool</span></span> and with pairs. We'll
give full details of the development for the basic lambda-calculus
terms treating <span class="inlinecode"><span class="id" type="var">bool</span></span> as an uninterpreted base type, and leave the
extension to the boolean operators and pairs to the reader. Even for
the base calculus, normalization is not entirely trivial to prove,
since each reduction of a term can duplicate redexes in subterms.
<div class="paragraph"> </div>
<a name="lab886"></a><h4 class="section">Exercise: 1 star</h4>
Where do we fail if we attempt to prove normalization by a
straightforward induction on the size of a well-typed term?
</div>
<div class="code code-tight">
<br/>
<span class="comment">(* FILL IN HERE *)</span><br/>
</div>
<div class="doc">
<font size=-2>☐</font>
</div>
<div class="code code-tight">
<br/>
</div>
<div class="doc">
<a name="lab887"></a><h1 class="section">Language</h1>
<div class="paragraph"> </div>
We begin by repeating the relevant language definition, which is
similar to those in the MoreStlc chapter, and supporting results
including type preservation and step determinism. (We won't need
progress.) You may just wish to skip down to the Normalization
section...
</div>
<div class="code code-tight">
<br/>
</div>
<div class="doc">
<a name="lab888"></a><h3 class="section">Syntax and Operational Semantics</h3>
</div>
<div class="code code-space">
<br/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">ty</span> : <span class="id" type="keyword">Type</span> :=<br/>
| <span class="id" type="var">TBool</span> : <span class="id" type="var">ty</span><br/>
| <span class="id" type="var">TArrow</span> : <span class="id" type="var">ty</span> <span style="font-family: arial;">→</span> <span class="id" type="var">ty</span> <span style="font-family: arial;">→</span> <span class="id" type="var">ty</span><br/>
| <span class="id" type="var">TProd</span> : <span class="id" type="var">ty</span> <span style="font-family: arial;">→</span> <span class="id" type="var">ty</span> <span style="font-family: arial;">→</span> <span class="id" type="var">ty</span><br/>
.<br/>
<br/>
<span class="id" type="keyword">Tactic Notation</span> "T_cases" <span class="id" type="var">tactic</span>(<span class="id" type="var">first</span>) <span class="id" type="var">ident</span>(<span class="id" type="var">c</span>) :=<br/>
<span class="id" type="var">first</span>;<br/>
[ <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "TBool" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "TArrow" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "TProd" ].<br/>
<br/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">tm</span> : <span class="id" type="keyword">Type</span> :=<br/>
<span class="comment">(* pure STLC *)</span><br/>
| <span class="id" type="var">tvar</span> : <span class="id" type="var">id</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span><br/>
| <span class="id" type="var">tapp</span> : <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span><br/>
| <span class="id" type="var">tabs</span> : <span class="id" type="var">id</span> <span style="font-family: arial;">→</span> <span class="id" type="var">ty</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span><br/>
<span class="comment">(* pairs *)</span><br/>
| <span class="id" type="var">tpair</span> : <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span><br/>
| <span class="id" type="var">tfst</span> : <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span><br/>
| <span class="id" type="var">tsnd</span> : <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span><br/>
<span class="comment">(* booleans *)</span><br/>
| <span class="id" type="var">ttrue</span> : <span class="id" type="var">tm</span><br/>
| <span class="id" type="var">tfalse</span> : <span class="id" type="var">tm</span><br/>
| <span class="id" type="var">tif</span> : <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span>.<br/>
<span class="comment">(* i.e., <span class="inlinecode"><span class="id" type="keyword">if</span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode"><span class="id" type="keyword">then</span></span> <span class="inlinecode"><span class="id" type="var">t<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="keyword">else</span></span> <span class="inlinecode"><span class="id" type="var">t<sub>2</sub></span></span> *)</span><br/>
<br/>
<span class="id" type="keyword">Tactic Notation</span> "t_cases" <span class="id" type="var">tactic</span>(<span class="id" type="var">first</span>) <span class="id" type="var">ident</span>(<span class="id" type="var">c</span>) :=<br/>
<span class="id" type="var">first</span>;<br/>
[ <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tvar" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tapp" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tabs"<br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tpair" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tfst" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tsnd"<br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ttrue" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tfalse" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "tif" ].<br/>
<br/>
</div>
<div class="doc">
<a name="lab889"></a><h3 class="section">Substitution</h3>
</div>
<div class="code code-space">
<br/>
<span class="id" type="keyword">Fixpoint</span> <span class="id" type="tactic">subst</span> (<span class="id" type="var">x</span>:<span class="id" type="var">id</span>) (<span class="id" type="var">s</span>:<span class="id" type="var">tm</span>) (<span class="id" type="var">t</span>:<span class="id" type="var">tm</span>) : <span class="id" type="var">tm</span> :=<br/>
<span class="id" type="keyword">match</span> <span class="id" type="var">t</span> <span class="id" type="keyword">with</span><br/>
| <span class="id" type="var">tvar</span> <span class="id" type="var">y</span> ⇒ <span class="id" type="keyword">if</span> <span class="id" type="var">eq_id_dec</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span> <span class="id" type="keyword">then</span> <span class="id" type="var">s</span> <span class="id" type="keyword">else</span> <span class="id" type="var">t</span><br/>
| <span class="id" type="var">tabs</span> <span class="id" type="var">y</span> <span class="id" type="var">T</span> <span class="id" type="var">t<sub>1</sub></span> ⇒ <span class="id" type="var">tabs</span> <span class="id" type="var">y</span> <span class="id" type="var">T</span> (<span class="id" type="keyword">if</span> <span class="id" type="var">eq_id_dec</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span> <span class="id" type="keyword">then</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="keyword">else</span> (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>1</sub></span>))<br/>
| <span class="id" type="var">tapp</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span> ⇒ <span class="id" type="var">tapp</span> (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>1</sub></span>) (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">tpair</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span> ⇒ <span class="id" type="var">tpair</span> (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>1</sub></span>) (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">tfst</span> <span class="id" type="var">t<sub>1</sub></span> ⇒ <span class="id" type="var">tfst</span> (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>1</sub></span>)<br/>
| <span class="id" type="var">tsnd</span> <span class="id" type="var">t<sub>1</sub></span> ⇒ <span class="id" type="var">tsnd</span> (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>1</sub></span>)<br/>
| <span class="id" type="var">ttrue</span> ⇒ <span class="id" type="var">ttrue</span><br/>
| <span class="id" type="var">tfalse</span> ⇒ <span class="id" type="var">tfalse</span><br/>
| <span class="id" type="var">tif</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span> ⇒ <span class="id" type="var">tif</span> (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t0</span>) (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>1</sub></span>) (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t<sub>2</sub></span>) <br/>
<span class="id" type="keyword">end</span>.<br/>
<br/>
<span class="id" type="keyword">Notation</span> "'[' x ':=' s ']' t" := (<span class="id" type="tactic">subst</span> <span class="id" type="var">x</span> <span class="id" type="var">s</span> <span class="id" type="var">t</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 20).<br/>
<br/>
</div>
<div class="doc">
<a name="lab890"></a><h3 class="section">Reduction</h3>
</div>
<div class="code code-space">
<br/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">value</span> : <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="keyword">Prop</span> :=<br/>
| <span class="id" type="var">v_abs</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">t<sub>12</sub></span>,<br/>
<span class="id" type="var">value</span> (<span class="id" type="var">tabs</span> <span class="id" type="var">x</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">t<sub>12</sub></span>)<br/>
| <span class="id" type="var">v_pair</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">v<sub>2</sub></span>,<br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>2</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">value</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">v<sub>2</sub></span>)<br/>
| <span class="id" type="var">v_true</span> : <span class="id" type="var">value</span> <span class="id" type="var">ttrue</span><br/>
| <span class="id" type="var">v_false</span> : <span class="id" type="var">value</span> <span class="id" type="var">tfalse</span><br/>
.<br/>
<br/>
<span class="id" type="keyword">Hint</span> <span class="id" type="var">Constructors</span> <span class="id" type="var">value</span>.<br/>
<br/>
<span class="id" type="keyword">Reserved Notation</span> "t<sub>1</sub> '<span style="font-family: arial;">⇒</span>' t<sub>2</sub>" (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 40).<br/>
<br/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">step</span> : <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="keyword">Prop</span> :=<br/>
| <span class="id" type="var">ST_AppAbs</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">t<sub>12</sub></span> <span class="id" type="var">v<sub>2</sub></span>,<br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>2</sub></span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tapp</span> (<span class="id" type="var">tabs</span> <span class="id" type="var">x</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">t<sub>12</sub></span>) <span class="id" type="var">v<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> [<span class="id" type="var">x</span>:=<span class="id" type="var">v<sub>2</sub></span>]<span class="id" type="var">t<sub>12</sub></span><br/>
| <span class="id" type="var">ST_App1</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>1</sub>'</span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">t<sub>1</sub></span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>1</sub>'</span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tapp</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> (<span class="id" type="var">tapp</span> <span class="id" type="var">t<sub>1</sub>'</span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">ST_App2</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span> <span class="id" type="var">t<sub>2</sub>'</span>,<br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">t<sub>2</sub></span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>2</sub>'</span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tapp</span> <span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> (<span class="id" type="var">tapp</span> <span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub>'</span>)<br/>
<span class="comment">(* pairs *)</span><br/>
| <span class="id" type="var">ST_Pair1</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>1</sub>'</span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">t<sub>1</sub></span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>1</sub>'</span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tpair</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">t<sub>1</sub>'</span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">ST_Pair2</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span> <span class="id" type="var">t<sub>2</sub>'</span>,<br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">t<sub>2</sub></span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>2</sub>'</span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tpair</span> <span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub>'</span>)<br/>
| <span class="id" type="var">ST_Fst</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>1</sub>'</span>,<br/>
<span class="id" type="var">t<sub>1</sub></span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>1</sub>'</span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tfst</span> <span class="id" type="var">t<sub>1</sub></span>) <span style="font-family: arial;">⇒</span> (<span class="id" type="var">tfst</span> <span class="id" type="var">t<sub>1</sub>'</span>)<br/>
| <span class="id" type="var">ST_FstPair</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">v<sub>2</sub></span>,<br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>2</sub></span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tfst</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">v<sub>2</sub></span>)) <span style="font-family: arial;">⇒</span> <span class="id" type="var">v<sub>1</sub></span><br/>
| <span class="id" type="var">ST_Snd</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>1</sub>'</span>,<br/>
<span class="id" type="var">t<sub>1</sub></span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>1</sub>'</span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tsnd</span> <span class="id" type="var">t<sub>1</sub></span>) <span style="font-family: arial;">⇒</span> (<span class="id" type="var">tsnd</span> <span class="id" type="var">t<sub>1</sub>'</span>)<br/>
| <span class="id" type="var">ST_SndPair</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">v<sub>2</sub></span>,<br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">value</span> <span class="id" type="var">v<sub>2</sub></span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tsnd</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">v<sub>1</sub></span> <span class="id" type="var">v<sub>2</sub></span>)) <span style="font-family: arial;">⇒</span> <span class="id" type="var">v<sub>2</sub></span><br/>
<span class="comment">(* booleans *)</span><br/>
| <span class="id" type="var">ST_IfTrue</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
(<span class="id" type="var">tif</span> <span class="id" type="var">ttrue</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>1</sub></span><br/>
| <span class="id" type="var">ST_IfFalse</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
(<span class="id" type="var">tif</span> <span class="id" type="var">tfalse</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> <span class="id" type="var">t<sub>2</sub></span><br/>
| <span class="id" type="var">ST_If</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t0</span> <span class="id" type="var">t0'</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">t0</span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t0'</span> <span style="font-family: arial;">→</span><br/>
(<span class="id" type="var">tif</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span style="font-family: arial;">⇒</span> (<span class="id" type="var">tif</span> <span class="id" type="var">t0'</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
<br/>
<span class="id" type="keyword">where</span> "t<sub>1</sub> '<span style="font-family: arial;">⇒</span>' t<sub>2</sub>" := (<span class="id" type="var">step</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>).<br/>
<br/>
<span class="id" type="keyword">Tactic Notation</span> "step_cases" <span class="id" type="var">tactic</span>(<span class="id" type="var">first</span>) <span class="id" type="var">ident</span>(<span class="id" type="var">c</span>) :=<br/>
<span class="id" type="var">first</span>;<br/>
[ <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_AppAbs" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_App1" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_App2"<br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_Pair1" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_Pair2"<br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_Fst" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_FstPair"<br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_Snd" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_SndPair"<br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_IfTrue" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_IfFalse" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "ST_If" ].<br/>
<br/>
<span class="id" type="keyword">Notation</span> <span class="id" type="var">multistep</span> := (<span class="id" type="var">multi</span> <span class="id" type="var">step</span>).<br/>
<span class="id" type="keyword">Notation</span> "t<sub>1</sub> '<span style="font-family: arial;">⇒*</span>' t<sub>2</sub>" := (<span class="id" type="var">multistep</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 40).<br/>
<br/>
<span class="id" type="keyword">Hint</span> <span class="id" type="var">Constructors</span> <span class="id" type="var">step</span>.<br/>
<br/>
<span class="id" type="keyword">Notation</span> <span class="id" type="var">step_normal_form</span> := (<span class="id" type="var">normal_form</span> <span class="id" type="var">step</span>).<br/>
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">value__normal</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t</span>, <span class="id" type="var">value</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <span class="id" type="var">step_normal_form</span> <span class="id" type="var">t</span>.<br/>
<span class="id" type="keyword">Proof</span> <span class="id" type="keyword">with</span> <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">t</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">induction</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">intros</span> [<span class="id" type="var">t'</span> <span class="id" type="var">ST</span>]; <span class="id" type="tactic">inversion</span> <span class="id" type="var">ST</span>...<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
</div>
<div class="doc">
<a name="lab891"></a><h3 class="section">Typing</h3>
</div>
<div class="code code-space">
<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">context</span> := <span class="id" type="var">partial_map</span> <span class="id" type="var">ty</span>.<br/>
<br/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">has_type</span> : <span class="id" type="var">context</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="var">ty</span> <span style="font-family: arial;">→</span> <span class="id" type="keyword">Prop</span> :=<br/>
<span class="comment">(* Typing rules for proper terms *)</span><br/>
| <span class="id" type="var">T_Var</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> <span class="id" type="var">T</span>,<br/>
<span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> = <span class="id" type="var">Some</span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> (<span class="id" type="var">tvar</span> <span class="id" type="var">x</span>) <span class="id" type="var">T</span><br/>
| <span class="id" type="var">T_Abs</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">T<sub>12</sub></span> <span class="id" type="var">t<sub>12</sub></span>,<br/>
<span class="id" type="var">has_type</span> (<span class="id" type="var">extend</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> <span class="id" type="var">T<sub>11</sub></span>) <span class="id" type="var">t<sub>12</sub></span> <span class="id" type="var">T<sub>12</sub></span> <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> (<span class="id" type="var">tabs</span> <span class="id" type="var">x</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">t<sub>12</sub></span>) (<span class="id" type="var">TArrow</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">T<sub>12</sub></span>)<br/>
| <span class="id" type="var">T_App</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>1</sub></span> (<span class="id" type="var">TArrow</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>) <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>2</sub></span> <span class="id" type="var">T<sub>1</sub></span> <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> (<span class="id" type="var">tapp</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span class="id" type="var">T<sub>2</sub></span><br/>
<span class="comment">(* pairs *)</span><br/>
| <span class="id" type="var">T_Pair</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">T<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>2</sub></span> <span class="id" type="var">T<sub>2</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) (<span class="id" type="var">TProd</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>)<br/>
| <span class="id" type="var">T_Fst</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t</span> (<span class="id" type="var">TProd</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>) <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> (<span class="id" type="var">tfst</span> <span class="id" type="var">t</span>) <span class="id" type="var">T<sub>1</sub></span><br/>
| <span class="id" type="var">T_Snd</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t</span> (<span class="id" type="var">TProd</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>) <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> (<span class="id" type="var">tsnd</span> <span class="id" type="var">t</span>) <span class="id" type="var">T<sub>2</sub></span><br/>
<span class="comment">(* booleans *)</span><br/>
| <span class="id" type="var">T_True</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">ttrue</span> <span class="id" type="var">TBool</span> <br/>
| <span class="id" type="var">T_False</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">tfalse</span> <span class="id" type="var">TBool</span><br/>
| <span class="id" type="var">T_If</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span> <span class="id" type="var">T</span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t0</span> <span class="id" type="var">TBool</span> <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t<sub>2</sub></span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> (<span class="id" type="var">tif</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>) <span class="id" type="var">T</span><br/>
.<br/>
<br/>
<span class="id" type="keyword">Hint</span> <span class="id" type="var">Constructors</span> <span class="id" type="var">has_type</span>.<br/>
<br/>
<span class="id" type="keyword">Tactic Notation</span> "has_type_cases" <span class="id" type="var">tactic</span>(<span class="id" type="var">first</span>) <span class="id" type="var">ident</span>(<span class="id" type="var">c</span>) :=<br/>
<span class="id" type="var">first</span>;<br/>
[ <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_Var" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_Abs" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_App" <br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_Pair" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_Fst" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_Snd" <br/>
| <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_True" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_False" | <span class="id" type="var">Case_aux</span> <span class="id" type="var">c</span> "T_If" ].<br/>
<br/>
<span class="id" type="keyword">Hint</span> <span class="id" type="keyword">Extern</span> 2 (<span class="id" type="var">has_type</span> <span class="id" type="var">_</span> (<span class="id" type="var">tapp</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span>) <span class="id" type="var">_</span>) ⇒ <span class="id" type="tactic">eapply</span> <span class="id" type="var">T_App</span>; <span class="id" type="tactic">auto</span>.<br/>
<span class="id" type="keyword">Hint</span> <span class="id" type="keyword">Extern</span> 2 (<span class="id" type="var">_</span> = <span class="id" type="var">_</span>) ⇒ <span class="id" type="tactic">compute</span>; <span class="id" type="tactic">reflexivity</span>.<br/>
<br/>
</div>
<div class="doc">
<a name="lab892"></a><h3 class="section">Context Invariance</h3>
</div>
<div class="code code-space">
<br/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">appears_free_in</span> : <span class="id" type="var">id</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="keyword">Prop</span> :=<br/>
| <span class="id" type="var">afi_var</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tvar</span> <span class="id" type="var">x</span>)<br/>
| <span class="id" type="var">afi_app1</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t<sub>1</sub></span> <span style="font-family: arial;">→</span> <span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tapp</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">afi_app2</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t<sub>2</sub></span> <span style="font-family: arial;">→</span> <span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tapp</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">afi_abs</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">y</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">t<sub>12</sub></span>,<br/>
<span class="id" type="var">y</span> ≠ <span class="id" type="var">x</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t<sub>12</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tabs</span> <span class="id" type="var">y</span> <span class="id" type="var">T<sub>11</sub></span> <span class="id" type="var">t<sub>12</sub></span>)<br/>
<span class="comment">(* pairs *)</span><br/>
| <span class="id" type="var">afi_pair1</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">afi_pair2</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t<sub>2</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tpair</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">afi_fst</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t</span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tfst</span> <span class="id" type="var">t</span>)<br/>
| <span class="id" type="var">afi_snd</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t</span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tsnd</span> <span class="id" type="var">t</span>)<br/>
<span class="comment">(* booleans *)</span><br/>
| <span class="id" type="var">afi_if0</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t0</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tif</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">afi_if1</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t<sub>1</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tif</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
| <span class="id" type="var">afi_if2</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t<sub>2</sub></span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> (<span class="id" type="var">tif</span> <span class="id" type="var">t0</span> <span class="id" type="var">t<sub>1</sub></span> <span class="id" type="var">t<sub>2</sub></span>)<br/>
.<br/>
<br/>
<span class="id" type="keyword">Hint</span> <span class="id" type="var">Constructors</span> <span class="id" type="var">appears_free_in</span>.<br/>
<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">closed</span> (<span class="id" type="var">t</span>:<span class="id" type="var">tm</span>) :=<br/>
<span style="font-family: arial;">∀</span><span class="id" type="var">x</span>, ¬ <span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t</span>.<br/>
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">context_invariance</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span style="font-family: serif; font-size:85%;">Γ'</span> <span class="id" type="var">t</span> <span class="id" type="var">S</span>,<br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t</span> <span class="id" type="var">S</span> <span style="font-family: arial;">→</span><br/>
(<span style="font-family: arial;">∀</span><span class="id" type="var">x</span>, <span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> = <span style="font-family: serif; font-size:85%;">Γ'</span> <span class="id" type="var">x</span>) <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ'</span> <span class="id" type="var">t</span> <span class="id" type="var">S</span>.<br/>
<span class="id" type="keyword">Proof</span> <span class="id" type="keyword">with</span> <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">intros</span>. <span class="id" type="tactic">generalize</span> <span class="id" type="tactic">dependent</span> <span style="font-family: serif; font-size:85%;">Γ'</span>.<br/>
<span class="id" type="var">has_type_cases</span> (<span class="id" type="tactic">induction</span> <span class="id" type="var">H</span>) <span class="id" type="var">Case</span>; <br/>
<span class="id" type="tactic">intros</span> <span style="font-family: serif; font-size:85%;">Γ'</span> <span class="id" type="var">Heqv</span>...<br/>
<span class="id" type="var">Case</span> "T_Var".<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">T_Var</span>... <span class="id" type="tactic">rewrite</span> <span style="font-family: arial;">←</span> <span class="id" type="var">Heqv</span>...<br/>
<span class="id" type="var">Case</span> "T_Abs".<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">T_Abs</span>... <span class="id" type="tactic">apply</span> <span class="id" type="var">IHhas_type</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">y</span> <span class="id" type="var">Hafi</span>.<br/>
<span class="id" type="tactic">unfold</span> <span class="id" type="var">extend</span>. <span class="id" type="tactic">destruct</span> (<span class="id" type="var">eq_id_dec</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span>)...<br/>
<span class="id" type="var">Case</span> "T_Pair".<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">T_Pair</span>...<br/>
<span class="id" type="var">Case</span> "T_If".<br/>
<span class="id" type="tactic">eapply</span> <span class="id" type="var">T_If</span>...<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">free_in_context</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">x</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: serif; font-size:85%;">Γ</span>,<br/>
<span class="id" type="var">appears_free_in</span> <span class="id" type="var">x</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span><br/>
<span style="font-family: arial;">∃</span><span class="id" type="var">T'</span>, <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> = <span class="id" type="var">Some</span> <span class="id" type="var">T'</span>.<br/>
<span class="id" type="keyword">Proof</span> <span class="id" type="keyword">with</span> <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">x</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">Hafi</span> <span class="id" type="var">Htyp</span>.<br/>
<span class="id" type="var">has_type_cases</span> (<span class="id" type="tactic">induction</span> <span class="id" type="var">Htyp</span>) <span class="id" type="var">Case</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">Hafi</span>; <span class="id" type="tactic">subst</span>...<br/>
<span class="id" type="var">Case</span> "T_Abs".<br/>
<span class="id" type="tactic">destruct</span> <span class="id" type="var">IHHtyp</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">T'</span> <span class="id" type="var">Hctx</span>]... <span style="font-family: arial;">∃</span><span class="id" type="var">T'</span>.<br/>
<span class="id" type="tactic">unfold</span> <span class="id" type="var">extend</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Hctx</span>.<br/>
<span class="id" type="tactic">rewrite</span> <span class="id" type="var">neq_id</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Hctx</span>...<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
<span class="id" type="keyword">Corollary</span> <span class="id" type="var">typable_empty__closed</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t</span> <span class="id" type="var">T</span>, <br/>
<span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">closed</span> <span class="id" type="var">t</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">intros</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">closed</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">x</span> <span class="id" type="var">H1</span>.<br/>
<span class="id" type="tactic">destruct</span> (<span class="id" type="var">free_in_context</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">H1</span> <span class="id" type="var">H</span>) <span class="id" type="keyword">as</span> [<span class="id" type="var">T'</span> <span class="id" type="var">C</span>].<br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">C</span>. <span class="id" type="keyword">Qed</span>.<br/>
<br/>
</div>
<div class="doc">
<a name="lab893"></a><h3 class="section">Preservation</h3>
</div>
<div class="code code-space">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">substitution_preserves_typing</span> : <span style="font-family: arial;">∀</span><span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> <span class="id" type="var">U</span> <span class="id" type="var">v</span> <span class="id" type="var">t</span> <span class="id" type="var">S</span>,<br/>
<span class="id" type="var">has_type</span> (<span class="id" type="var">extend</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> <span class="id" type="var">U</span>) <span class="id" type="var">t</span> <span class="id" type="var">S</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">v</span> <span class="id" type="var">U</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span style="font-family: serif; font-size:85%;">Γ</span> ([<span class="id" type="var">x</span>:=<span class="id" type="var">v</span>]<span class="id" type="var">t</span>) <span class="id" type="var">S</span>.<br/>
<span class="id" type="keyword">Proof</span> <span class="id" type="keyword">with</span> <span class="id" type="tactic">eauto</span>.<br/>
<span class="comment">(* Theorem: If Gamma,x:U |- t : S and empty |- v : U, then <br/>
Gamma |- (<span class="inlinecode"><span class="id" type="var">x</span>:=<span class="id" type="var">v</span></span>t) S. *)</span><br/>
<span class="id" type="tactic">intros</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">x</span> <span class="id" type="var">U</span> <span class="id" type="var">v</span> <span class="id" type="var">t</span> <span class="id" type="var">S</span> <span class="id" type="var">Htypt</span> <span class="id" type="var">Htypv</span>.<br/>
<span class="id" type="tactic">generalize</span> <span class="id" type="tactic">dependent</span> <span style="font-family: serif; font-size:85%;">Γ</span>. <span class="id" type="tactic">generalize</span> <span class="id" type="tactic">dependent</span> <span class="id" type="var">S</span>.<br/>
<span class="comment">(* Proof: By induction on the term t. Most cases follow directly<br/>
from the IH, with the exception of tvar and tabs.<br/>
The former aren't automatic because we must reason about how the<br/>
variables interact. *)</span><br/>
<span class="id" type="var">t_cases</span> (<span class="id" type="tactic">induction</span> <span class="id" type="var">t</span>) <span class="id" type="var">Case</span>;<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">S</span> <span style="font-family: serif; font-size:85%;">Γ</span> <span class="id" type="var">Htypt</span>; <span class="id" type="tactic">simpl</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">Htypt</span>; <span class="id" type="tactic">subst</span>...<br/>
<span class="id" type="var">Case</span> "tvar".<br/>
<span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">rename</span> <span class="id" type="var">i</span> <span class="id" type="var">into</span> <span class="id" type="var">y</span>.<br/>
<span class="comment">(* If t = y, we know that<br/>
<span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">v</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">U</span></span> and<br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">x</span>:<span class="id" type="var">U</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">y</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">S</span></span><br/>
and, by inversion, <span class="inlinecode"><span class="id" type="var">extend</span></span> <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span></span> <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode"><span class="id" type="var">U</span></span> <span class="inlinecode"><span class="id" type="var">y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">Some</span></span> <span class="inlinecode"><span class="id" type="var">S</span></span>. We want to<br/>
show that <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode">[<span class="id" type="var">x</span>:=<span class="id" type="var">v</span>]<span class="id" type="var">y</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">S</span></span>.<br/>
<br/>
There are two cases to consider: either <span class="inlinecode"><span class="id" type="var">x</span>=<span class="id" type="var">y</span></span> or <span class="inlinecode"><span class="id" type="var">x</span>≠<span class="id" type="var">y</span></span>. *)</span><br/>
<span class="id" type="tactic">destruct</span> (<span class="id" type="var">eq_id_dec</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span>).<br/>
<span class="id" type="var">SCase</span> "x=y".<br/>
<span class="comment">(* If <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">y</span></span>, then we know that <span class="inlinecode"><span class="id" type="var">U</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">S</span></span>, and that <span class="inlinecode">[<span class="id" type="var">x</span>:=<span class="id" type="var">v</span>]<span class="id" type="var">y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">v</span></span>.<br/>
So what we really must show is that if <span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">v</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">U</span></span> then<br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">v</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">U</span></span>. We have already proven a more general version<br/>
of this theorem, called context invariance. *)</span><br/>
<span class="id" type="tactic">subst</span>.<br/>
<span class="id" type="tactic">unfold</span> <span class="id" type="var">extend</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H1</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">eq_id</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H1</span>.<br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">H1</span>; <span class="id" type="tactic">subst</span>. <span class="id" type="tactic">clear</span> <span class="id" type="var">H1</span>.<br/>
<span class="id" type="tactic">eapply</span> <span class="id" type="var">context_invariance</span>...<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">x</span> <span class="id" type="var">Hcontra</span>.<br/>
<span class="id" type="tactic">destruct</span> (<span class="id" type="var">free_in_context</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">S</span> <span class="id" type="var">empty</span> <span class="id" type="var">Hcontra</span>) <span class="id" type="keyword">as</span> [<span class="id" type="var">T'</span> <span class="id" type="var">HT'</span>]...<br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">HT'</span>.<br/>
<span class="id" type="var">SCase</span> "x≠y".<br/>
<span class="comment">(* If <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode">≠</span> <span class="inlinecode"><span class="id" type="var">y</span></span>, then <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span></span> <span class="inlinecode"><span class="id" type="var">y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">Some</span></span> <span class="inlinecode"><span class="id" type="var">S</span></span> and the substitution has no<br/>
effect. We can show that <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">y</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">S</span></span> by <span class="inlinecode"><span class="id" type="var">T_Var</span></span>. *)</span><br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">T_Var</span>... <span class="id" type="tactic">unfold</span> <span class="id" type="var">extend</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H1</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">neq_id</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H1</span>...<br/>
<span class="id" type="var">Case</span> "tabs".<br/>
<span class="id" type="tactic">rename</span> <span class="id" type="var">i</span> <span class="id" type="var">into</span> <span class="id" type="var">y</span>. <span class="id" type="tactic">rename</span> <span class="id" type="var">t</span> <span class="id" type="var">into</span> <span class="id" type="var">T<sub>11</sub></span>.<br/>
<span class="comment">(* If <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">tabs</span></span> <span class="inlinecode"><span class="id" type="var">y</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span>, then we know that<br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">x</span>:<span class="id" type="var">U</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">tabs</span></span> <span class="inlinecode"><span class="id" type="var">y</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>11</sub></span><span style="font-family: arial;">→</span><span class="id" type="var">T<sub>12</sub></span></span><br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">x</span>:<span class="id" type="var">U</span>,<span class="id" type="var">y</span>:<span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>12</sub></span></span><br/>
<span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">v</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">U</span></span><br/>
As our IH, we know that forall S Gamma, <br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">x</span>:<span class="id" type="var">U</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">S</span></span> <span class="inlinecode"><span style="font-family: arial;">→</span></span> <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode">[<span class="id" type="var">x</span>:=<span class="id" type="var">v</span>]<span class="id" type="var">t0</span></span> <span class="inlinecode"><span class="id" type="var">S</span></span>.<br/>
<br/>
We can calculate that <br/>
<span class="inlinecode"><span class="id" type="var">x</span>:=<span class="id" type="var">v</span></span>t = tabs y T<sub>11</sub> (if beq_id x y then t0 else <span class="inlinecode"><span class="id" type="var">x</span>:=<span class="id" type="var">v</span></span>t0)<br/>
And we must show that <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode">[<span class="id" type="var">x</span>:=<span class="id" type="var">v</span>]<span class="id" type="var">t</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>11</sub></span><span style="font-family: arial;">→</span><span class="id" type="var">T<sub>12</sub></span></span>. We know<br/>
we will do so using <span class="inlinecode"><span class="id" type="var">T_Abs</span></span>, so it remains to be shown that:<br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">y</span>:<span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="keyword">if</span></span> <span class="inlinecode"><span class="id" type="var">beq_id</span></span> <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode"><span class="id" type="var">y</span></span> <span class="inlinecode"><span class="id" type="keyword">then</span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode"><span class="id" type="keyword">else</span></span> <span class="inlinecode">[<span class="id" type="var">x</span>:=<span class="id" type="var">v</span>]<span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>12</sub></span></span><br/>
We consider two cases: <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">y</span></span> and <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode">≠</span> <span class="inlinecode"><span class="id" type="var">y</span></span>.<br/>
*)</span><br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">T_Abs</span>...<br/>
<span class="id" type="tactic">destruct</span> (<span class="id" type="var">eq_id_dec</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span>).<br/>
<span class="id" type="var">SCase</span> "x=y".<br/>
<span class="comment">(* If <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">y</span></span>, then the substitution has no effect. Context<br/>
invariance shows that <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">y</span>:<span class="id" type="var">U</span>,<span class="id" type="var">y</span>:<span class="id" type="var">T<sub>11</sub></span></span> and <span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">y</span>:<span class="id" type="var">T<sub>11</sub></span></span> are<br/>
equivalent. Since the former context shows that <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>12</sub></span></span>, so<br/>
does the latter. *)</span><br/>
<span class="id" type="tactic">eapply</span> <span class="id" type="var">context_invariance</span>...<br/>
<span class="id" type="tactic">subst</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">x</span> <span class="id" type="var">Hafi</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">extend</span>.<br/>
<span class="id" type="tactic">destruct</span> (<span class="id" type="var">eq_id_dec</span> <span class="id" type="var">y</span> <span class="id" type="var">x</span>)...<br/>
<span class="id" type="var">SCase</span> "x≠y".<br/>
<span class="comment">(* If <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode">≠</span> <span class="inlinecode"><span class="id" type="var">y</span></span>, then the IH and context invariance allow us to show that<br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">x</span>:<span class="id" type="var">U</span>,<span class="id" type="var">y</span>:<span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>12</sub></span></span> =><br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">y</span>:<span class="id" type="var">T<sub>11</sub></span>,<span class="id" type="var">x</span>:<span class="id" type="var">U</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>12</sub></span></span> =><br/>
<span class="inlinecode"><span style="font-family: serif; font-size:85%;">Γ</span>,<span class="id" type="var">y</span>:<span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode">[<span class="id" type="var">x</span>:=<span class="id" type="var">v</span>]<span class="id" type="var">t0</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>12</sub></span></span> *)</span><br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">IHt</span>. <span class="id" type="tactic">eapply</span> <span class="id" type="var">context_invariance</span>...<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">z</span> <span class="id" type="var">Hafi</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">extend</span>.<br/>
<span class="id" type="tactic">destruct</span> (<span class="id" type="var">eq_id_dec</span> <span class="id" type="var">y</span> <span class="id" type="var">z</span>)...<br/>
<span class="id" type="tactic">subst</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">neq_id</span>...<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">preservation</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t</span> <span class="id" type="var">t'</span> <span class="id" type="var">T</span>,<br/>
<span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">t</span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t'</span> <span style="font-family: arial;">→</span><br/>
<span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t'</span> <span class="id" type="var">T</span>.<br/>
<span class="id" type="keyword">Proof</span> <span class="id" type="keyword">with</span> <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span> <span class="id" type="var">T</span> <span class="id" type="var">HT</span>.<br/>
<span class="comment">(* Theorem: If <span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T</span></span> and <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode"><span style="font-family: arial;">⇒</span></span> <span class="inlinecode"><span class="id" type="var">t'</span></span>, then <span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t'</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T</span></span>. *)</span><br/>
<span class="id" type="var">remember</span> (@<span class="id" type="var">empty</span> <span class="id" type="var">ty</span>) <span class="id" type="keyword">as</span> <span style="font-family: serif; font-size:85%;">Γ</span>. <span class="id" type="tactic">generalize</span> <span class="id" type="tactic">dependent</span> <span class="id" type="var">HeqGamma</span>.<br/>
<span class="id" type="tactic">generalize</span> <span class="id" type="tactic">dependent</span> <span class="id" type="var">t'</span>.<br/>
<span class="comment">(* Proof: By induction on the given typing derivation. Many cases are<br/>
contradictory (<span class="inlinecode"><span class="id" type="var">T_Var</span></span>, <span class="inlinecode"><span class="id" type="var">T_Abs</span></span>). We show just the interesting ones. *)</span><br/>
<span class="id" type="var">has_type_cases</span> (<span class="id" type="tactic">induction</span> <span class="id" type="var">HT</span>) <span class="id" type="var">Case</span>; <br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">t'</span> <span class="id" type="var">HeqGamma</span> <span class="id" type="var">HE</span>; <span class="id" type="tactic">subst</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">HE</span>; <span class="id" type="tactic">subst</span>...<br/>
<span class="id" type="var">Case</span> "T_App".<br/>
<span class="comment">(* If the last rule used was <span class="inlinecode"><span class="id" type="var">T_App</span></span>, then <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">t<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">t<sub>2</sub></span></span>, and three rules<br/>
could have been used to show <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode"><span style="font-family: arial;">⇒</span></span> <span class="inlinecode"><span class="id" type="var">t'</span></span>: <span class="inlinecode"><span class="id" type="var">ST_App1</span></span>, <span class="inlinecode"><span class="id" type="var">ST_App2</span></span>, and <br/>
<span class="inlinecode"><span class="id" type="var">ST_AppAbs</span></span>. In the first two cases, the result follows directly from <br/>
the IH. *)</span><br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">HE</span>; <span class="id" type="tactic">subst</span>...<br/>
<span class="id" type="var">SCase</span> "ST_AppAbs".<br/>
<span class="comment">(* For the third case, suppose <br/>
<span class="inlinecode"><span class="id" type="var">t<sub>1</sub></span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">tabs</span></span> <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span class="id" type="var">t<sub>12</sub></span></span><br/>
and<br/>
<span class="inlinecode"><span class="id" type="var">t<sub>2</sub></span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">v<sub>2</sub></span></span>. <br/>
We must show that <span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode">[<span class="id" type="var">x</span>:=<span class="id" type="var">v<sub>2</sub></span>]<span class="id" type="var">t<sub>12</sub></span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>2</sub></span></span>. <br/>
We know by assumption that<br/>
<span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">tabs</span></span> <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>11</sub></span></span> <span class="inlinecode"><span class="id" type="var">t<sub>12</sub></span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span><span style="font-family: arial;">→</span><span class="id" type="var">T<sub>2</sub></span></span><br/>
and by inversion<br/>
<span class="inlinecode"><span class="id" type="var">x</span>:<span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t<sub>12</sub></span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>2</sub></span></span><br/>
We have already proven that substitution_preserves_typing and <br/>
<span class="inlinecode"><span class="id" type="var">empty</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">v<sub>2</sub></span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span></span><br/>
by assumption, so we are done. *)</span><br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">substitution_preserves_typing</span> <span class="id" type="keyword">with</span> <span class="id" type="var">T<sub>1</sub></span>...<br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">HT1</span>...<br/>
<span class="id" type="var">Case</span> "T_Fst".<br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">HT</span>...<br/>
<span class="id" type="var">Case</span> "T_Snd".<br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">HT</span>...<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>
<div class="doc">
<font size=-2>☐</font>
</div>
<div class="code code-tight">
<br/>
</div>
<div class="doc">
<a name="lab894"></a><h3 class="section">Determinism</h3>
</div>
<div class="code code-space">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">step_deterministic</span> :<br/>
<span class="id" type="var">deterministic</span> <span class="id" type="var">step</span>.<br/>
<span class="id" type="keyword">Proof</span> <span class="id" type="keyword">with</span> <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">unfold</span> <span class="id" type="var">deterministic</span>.<br/>
<span class="comment">(* FILL IN HERE *)</span> <span class="id" type="var">Admitted</span>.<br/>
<br/>
</div>
<div class="doc">
<a name="lab895"></a><h1 class="section">Normalization</h1>
<div class="paragraph"> </div>
Now for the actual normalization proof.
<div class="paragraph"> </div>
Our goal is to prove that every well-typed term evaluates to a
normal form. In fact, it turns out to be convenient to prove
something slightly stronger, namely that every well-typed term
evaluates to a <i>value</i>. This follows from the weaker property
anyway via the Progress lemma (why?) but otherwise we don't need
Progress, and we didn't bother re-proving it above.
<div class="paragraph"> </div>
Here's the key definition:
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">halts</span> (<span class="id" type="var">t</span>:<span class="id" type="var">tm</span>) : <span class="id" type="keyword">Prop</span> := <span style="font-family: arial;">∃</span><span class="id" type="var">t'</span>, <span class="id" type="var">t</span> <span style="font-family: arial;">⇒*</span> <span class="id" type="var">t'</span> <span style="font-family: arial;">∧</span> <span class="id" type="var">value</span> <span class="id" type="var">t'</span>.<br/>
<br/>
</div>
<div class="doc">
A trivial fact:
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">value_halts</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">v</span>, <span class="id" type="var">value</span> <span class="id" type="var">v</span> <span style="font-family: arial;">→</span> <span class="id" type="var">halts</span> <span class="id" type="var">v</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">v</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">halts</span>.<br/>
<span style="font-family: arial;">∃</span><span class="id" type="var">v</span>. <span class="id" type="tactic">split</span>.<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">multi_refl</span>.<br/>
<span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
</div>
<div class="doc">
The key issue in the normalization proof (as in many proofs by
induction) is finding a strong enough induction hypothesis. To this
end, we begin by defining, for each type <span class="inlinecode"><span class="id" type="var">T</span></span>, a set <span class="inlinecode"><span class="id" type="var">R_T</span></span> of closed
terms of type <span class="inlinecode"><span class="id" type="var">T</span></span>. We will specify these sets using a relation <span class="inlinecode"><span class="id" type="var">R</span></span>
and write <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">T</span></span> <span class="inlinecode"><span class="id" type="var">t</span></span> when <span class="inlinecode"><span class="id" type="var">t</span></span> is in <span class="inlinecode"><span class="id" type="var">R_T</span></span>. (The sets <span class="inlinecode"><span class="id" type="var">R_T</span></span> are sometimes
called <i>saturated sets</i> or <i>reducibility candidates</i>.)
<div class="paragraph"> </div>
Here is the definition of <span class="inlinecode"><span class="id" type="var">R</span></span> for the base language:
<div class="paragraph"> </div>
<ul class="doclist">
<li> <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">bool</span></span> <span class="inlinecode"><span class="id" type="var">t</span></span> iff <span class="inlinecode"><span class="id" type="var">t</span></span> is a closed term of type <span class="inlinecode"><span class="id" type="var">bool</span></span> and <span class="inlinecode"><span class="id" type="var">t</span></span> halts in a value
<div class="paragraph"> </div>
</li>
<li> <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode">(<span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span style="font-family: arial;">→</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>2</sub></span>)</span> <span class="inlinecode"><span class="id" type="var">t</span></span> iff <span class="inlinecode"><span class="id" type="var">t</span></span> is a closed term of type <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span style="font-family: arial;">→</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>2</sub></span></span> and <span class="inlinecode"><span class="id" type="var">t</span></span> halts
in a value <i>and</i> for any term <span class="inlinecode"><span class="id" type="var">s</span></span> such that <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">s</span></span>, we have <span class="inlinecode"><span class="id" type="var">R</span></span>
<span class="inlinecode"><span class="id" type="var">T<sub>2</sub></span></span> <span class="inlinecode">(<span class="id" type="var">t</span></span> <span class="inlinecode"><span class="id" type="var">s</span>)</span>.
</li>
</ul>
<div class="paragraph"> </div>
This definition gives us the strengthened induction hypothesis that we
need. Our primary goal is to show that all <i>programs</i> —-i.e., all
closed terms of base type—-halt. But closed terms of base type can
contain subterms of functional type, so we need to know something
about these as well. Moreover, it is not enough to know that these
subterms halt, because the application of a normalized function to a
normalized argument involves a substitution, which may enable more
evaluation steps. So we need a stronger condition for terms of
functional type: not only should they halt themselves, but, when
applied to halting arguments, they should yield halting results.
<div class="paragraph"> </div>
The form of <span class="inlinecode"><span class="id" type="var">R</span></span> is characteristic of the <i>logical relations</i> proof
technique. (Since we are just dealing with unary relations here, we
could perhaps more properly say <i>logical predicates</i>.) If we want to
prove some property <span class="inlinecode"><span class="id" type="var">P</span></span> of all closed terms of type <span class="inlinecode"><span class="id" type="var">A</span></span>, we proceed by
proving, by induction on types, that all terms of type <span class="inlinecode"><span class="id" type="var">A</span></span> <i>possess</i>
property <span class="inlinecode"><span class="id" type="var">P</span></span>, all terms of type <span class="inlinecode"><span class="id" type="var">A</span><span style="font-family: arial;">→</span><span class="id" type="var">A</span></span> <i>preserve</i> property <span class="inlinecode"><span class="id" type="var">P</span></span>, all
terms of type <span class="inlinecode">(<span class="id" type="var">A</span><span style="font-family: arial;">→</span><span class="id" type="var">A</span>)->(<span class="id" type="var">A</span><span style="font-family: arial;">→</span><span class="id" type="var">A</span>)</span> <i>preserve the property of preserving</i>
property <span class="inlinecode"><span class="id" type="var">P</span></span>, and so on. We do this by defining a family of
predicates, indexed by types. For the base type <span class="inlinecode"><span class="id" type="var">A</span></span>, the predicate is
just <span class="inlinecode"><span class="id" type="var">P</span></span>. For functional types, it says that the function should map
values satisfying the predicate at the input type to values satisfying
the predicate at the output type.
<div class="paragraph"> </div>
When we come to formalize the definition of <span class="inlinecode"><span class="id" type="var">R</span></span> in Coq, we hit a
problem. The most obvious formulation would be as a parameterized
Inductive proposition like this:
<div class="paragraph"> </div>
<div class="paragraph"> </div>
<div class="code code-tight">
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">R</span> : <span class="id" type="var">ty</span> <span style="font-family: arial;">→</span> <span class="id" type="var">tm</span> <span style="font-family: arial;">→</span> <span class="id" type="keyword">Prop</span> :=<br/>
| <span class="id" type="var">R_bool</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">b</span> <span class="id" type="var">t</span>, <span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> <span class="id" type="var">TBool</span> <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">halts</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">R</span> <span class="id" type="var">TBool</span> <span class="id" type="var">t</span><br/>
| <span class="id" type="var">R_arrow</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span> <span class="id" type="var">t</span>, <span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> (<span class="id" type="var">TArrow</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>) <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">halts</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <br/>
(<span style="font-family: arial;">∀</span><span class="id" type="var">s</span>, <span class="id" type="var">R</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">s</span> <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T<sub>2</sub></span> (<span class="id" type="var">tapp</span> <span class="id" type="var">t</span> <span class="id" type="var">s</span>)) <span style="font-family: arial;">→</span> <br/>
<span class="id" type="var">R</span> (<span class="id" type="var">TArrow</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span>) <span class="id" type="var">t</span>.
<div class="paragraph"> </div>
</div>
<div class="paragraph"> </div>
Unfortunately, Coq rejects this definition because it violates the
<i>strict positivity requirement</i> for inductive definitions, which says
that the type being defined must not occur to the left of an arrow in
the type of a constructor argument. Here, it is the third argument to
<span class="inlinecode"><span class="id" type="var">R_arrow</span></span>, namely <span class="inlinecode">(<span style="font-family: arial;">∀</span></span> <span class="inlinecode"><span class="id" type="var">s</span>,</span> <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">s</span></span> <span class="inlinecode"><span style="font-family: arial;">→</span></span> <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">TS</span></span> <span class="inlinecode">(<span class="id" type="var">tapp</span></span> <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode"><span class="id" type="var">s</span>))</span>, and
specifically the <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">s</span></span> part, that violates this rule. (The
outermost arrows separating the constructor arguments don't count when
applying this rule; otherwise we could never have genuinely inductive
predicates at all!) The reason for the rule is that types defined
with non-positive recursion can be used to build non-terminating
functions, which as we know would be a disaster for Coq's logical
soundness. Even though the relation we want in this case might be
perfectly innocent, Coq still rejects it because it fails the
positivity test.
<div class="paragraph"> </div>
Fortunately, it turns out that we <i>can</i> define <span class="inlinecode"><span class="id" type="var">R</span></span> using a
<span class="inlinecode"><span class="id" type="keyword">Fixpoint</span></span>:
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">R</span> (<span class="id" type="var">T</span>:<span class="id" type="var">ty</span>) (<span class="id" type="var">t</span>:<span class="id" type="var">tm</span>) {<span class="id" type="keyword">struct</span> <span class="id" type="var">T</span>} : <span class="id" type="keyword">Prop</span> :=<br/>
<span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: arial;">∧</span> <span class="id" type="var">halts</span> <span class="id" type="var">t</span> <span style="font-family: arial;">∧</span><br/>
(<span class="id" type="keyword">match</span> <span class="id" type="var">T</span> <span class="id" type="keyword">with</span><br/>
| <span class="id" type="var">TBool</span> ⇒ <span class="id" type="var">True</span><br/>
| <span class="id" type="var">TArrow</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span> ⇒ (<span style="font-family: arial;">∀</span><span class="id" type="var">s</span>, <span class="id" type="var">R</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">s</span> <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T<sub>2</sub></span> (<span class="id" type="var">tapp</span> <span class="id" type="var">t</span> <span class="id" type="var">s</span>))<br/>
<span class="comment">(* FILL IN HERE *)</span><br/>
| <span class="id" type="var">TProd</span> <span class="id" type="var">T<sub>1</sub></span> <span class="id" type="var">T<sub>2</sub></span> ⇒ <span class="id" type="var">False</span> <span class="comment">(* ... and delete this line *)</span><br/>
<span class="id" type="keyword">end</span>).<br/>
<br/>
</div>
<div class="doc">
As immediate consequences of this definition, we have that every
element of every set <span class="inlinecode"><span class="id" type="var">R_T</span></span> halts in a value and is closed with type
<span class="inlinecode"><span class="id" type="var">t</span></span> :
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">R_halts</span> : <span style="font-family: arial;">∀</span>{<span class="id" type="var">T</span>} {<span class="id" type="var">t</span>}, <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <span class="id" type="var">halts</span> <span class="id" type="var">t</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">intros</span>. <span class="id" type="tactic">destruct</span> <span class="id" type="var">T</span>; <span class="id" type="tactic">unfold</span> <span class="id" type="var">R</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">H1</span>; <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">R_typable_empty</span> : <span style="font-family: arial;">∀</span>{<span class="id" type="var">T</span>} {<span class="id" type="var">t</span>}, <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">intros</span>. <span class="id" type="tactic">destruct</span> <span class="id" type="var">T</span>; <span class="id" type="tactic">unfold</span> <span class="id" type="var">R</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">H1</span>; <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
</div>
<div class="doc">
Now we proceed to show the main result, which is that every
well-typed term of type <span class="inlinecode"><span class="id" type="var">T</span></span> is an element of <span class="inlinecode"><span class="id" type="var">R_T</span></span>. Together with
<span class="inlinecode"><span class="id" type="var">R_halts</span></span>, that will show that every well-typed term halts in a
value.
</div>
<div class="code code-tight">
<br/>
</div>
<div class="doc">
<a name="lab896"></a><h2 class="section">Membership in <span class="inlinecode"><span class="id" type="var">R_T</span></span> is invariant under evaluation</h2>
<div class="paragraph"> </div>
We start with a preliminary lemma that shows a kind of strong
preservation property, namely that membership in <span class="inlinecode"><span class="id" type="var">R_T</span></span> is <i>invariant</i>
under evaluation. We will need this property in both directions,
i.e. both to show that a term in <span class="inlinecode"><span class="id" type="var">R_T</span></span> stays in <span class="inlinecode"><span class="id" type="var">R_T</span></span> when it takes a
forward step, and to show that any term that ends up in <span class="inlinecode"><span class="id" type="var">R_T</span></span> after a
step must have been in <span class="inlinecode"><span class="id" type="var">R_T</span></span> to begin with.
<div class="paragraph"> </div>
First of all, an easy preliminary lemma. Note that in the forward
direction the proof depends on the fact that our language is
determinstic. This lemma might still be true for non-deterministic
languages, but the proof would be harder!
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">step_preserves_halting</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">t</span> <span class="id" type="var">t'</span>, (<span class="id" type="var">t</span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t'</span>) <span style="font-family: arial;">→</span> (<span class="id" type="var">halts</span> <span class="id" type="var">t</span> <span style="font-family: arial;">↔</span> <span class="id" type="var">halts</span> <span class="id" type="var">t'</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span> <span class="id" type="var">ST</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">halts</span>.<br/>
<span class="id" type="tactic">split</span>.<br/>
<span class="id" type="var">Case</span> "<span style="font-family: arial;">→</span>".<br/>
<span class="id" type="tactic">intros</span> [<span class="id" type="var">t''</span> [<span class="id" type="var">STM</span> <span class="id" type="var">V</span>]].<br/>
<span class="id" type="tactic">inversion</span> <span class="id" type="var">STM</span>; <span class="id" type="tactic">subst</span>.<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">ex_falso_quodlibet</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">value__normal</span> <span class="id" type="keyword">in</span> <span class="id" type="var">V</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">normal_form</span> <span class="id" type="keyword">in</span> <span class="id" type="var">V</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">V</span>. <span style="font-family: arial;">∃</span><span class="id" type="var">t'</span>. <span class="id" type="tactic">auto</span>.<br/>
<span class="id" type="tactic">rewrite</span> (<span class="id" type="var">step_deterministic</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">ST</span> <span class="id" type="var">H</span>). <span style="font-family: arial;">∃</span><span class="id" type="var">t''</span>. <span class="id" type="tactic">split</span>; <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="var">Case</span> "<span style="font-family: arial;">←</span>".<br/>
<span class="id" type="tactic">intros</span> [<span class="id" type="var">t'0</span> [<span class="id" type="var">STM</span> <span class="id" type="var">V</span>]].<br/>
<span style="font-family: arial;">∃</span><span class="id" type="var">t'0</span>. <span class="id" type="tactic">split</span>; <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
</div>
<div class="doc">
Now the main lemma, which comes in two parts, one for each
direction. Each proceeds by induction on the structure of the type
<span class="inlinecode"><span class="id" type="var">T</span></span>. In fact, this is where we make fundamental use of the
structure of types.
<div class="paragraph"> </div>
One requirement for staying in <span class="inlinecode"><span class="id" type="var">R_T</span></span> is to stay in type <span class="inlinecode"><span class="id" type="var">T</span></span>. In the
forward direction, we get this from ordinary type Preservation.
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">step_preserves_R</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">T</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span>, (<span class="id" type="var">t</span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t'</span>) <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t'</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">induction</span> <span class="id" type="var">T</span>; <span class="id" type="tactic">intros</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span> <span class="id" type="var">E</span> <span class="id" type="var">Rt</span>; <span class="id" type="tactic">unfold</span> <span class="id" type="var">R</span>; <span class="id" type="var">fold</span> <span class="id" type="var">R</span>; <span class="id" type="tactic">unfold</span> <span class="id" type="var">R</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Rt</span>; <span class="id" type="var">fold</span> <span class="id" type="var">R</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Rt</span>; <br/>
<span class="id" type="tactic">destruct</span> <span class="id" type="var">Rt</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">typable_empty_t</span> [<span class="id" type="var">halts_t</span> <span class="id" type="var">RRt</span>]].<br/>
<span class="comment">(* TBool *)</span><br/>
<span class="id" type="tactic">split</span>. <span class="id" type="tactic">eapply</span> <span class="id" type="var">preservation</span>; <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">split</span>. <span class="id" type="tactic">apply</span> (<span class="id" type="var">step_preserves_halting</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">E</span>); <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">auto</span>.<br/>
<span class="comment">(* TArrow *)</span><br/>
<span class="id" type="tactic">split</span>. <span class="id" type="tactic">eapply</span> <span class="id" type="var">preservation</span>; <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">split</span>. <span class="id" type="tactic">apply</span> (<span class="id" type="var">step_preserves_halting</span> <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">E</span>); <span class="id" type="tactic">eauto</span>.<br/>
<span class="id" type="tactic">intros</span>.<br/>
<span class="id" type="tactic">eapply</span> <span class="id" type="var">IHT2</span>.<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">ST_App1</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">E</span>.<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">RRt</span>; <span class="id" type="tactic">auto</span>.<br/>
<span class="comment">(* FILL IN HERE *)</span> <span class="id" type="var">Admitted</span>.<br/>
<br/>
</div>
<div class="doc">
The generalization to multiple steps is trivial:
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">multistep_preserves_R</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">T</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span>, <br/>
(<span class="id" type="var">t</span> <span style="font-family: arial;">⇒*</span> <span class="id" type="var">t'</span>) <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span> <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t'</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span> <span class="id" type="var">STM</span>; <span class="id" type="tactic">induction</span> <span class="id" type="var">STM</span>; <span class="id" type="tactic">intros</span>.<br/>
<span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="tactic">apply</span> <span class="id" type="var">IHSTM</span>. <span class="id" type="tactic">eapply</span> <span class="id" type="var">step_preserves_R</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
</div>
<div class="doc">
In the reverse direction, we must add the fact that <span class="inlinecode"><span class="id" type="var">t</span></span> has type
<span class="inlinecode"><span class="id" type="var">T</span></span> before stepping as an additional hypothesis.
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">step_preserves_R'</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">T</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span>, <br/>
<span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span> (<span class="id" type="var">t</span> <span style="font-family: arial;">⇒</span> <span class="id" type="var">t'</span>) <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t'</span> <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="comment">(* FILL IN HERE *)</span> <span class="id" type="var">Admitted</span>.<br/>
<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">multistep_preserves_R'</span> : <span style="font-family: arial;">∀</span><span class="id" type="var">T</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span>, <br/>
<span class="id" type="var">has_type</span> <span class="id" type="var">empty</span> <span class="id" type="var">t</span> <span class="id" type="var">T</span> <span style="font-family: arial;">→</span> (<span class="id" type="var">t</span> <span style="font-family: arial;">⇒*</span> <span class="id" type="var">t'</span>) <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t'</span> <span style="font-family: arial;">→</span> <span class="id" type="var">R</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="id" type="tactic">intros</span> <span class="id" type="var">T</span> <span class="id" type="var">t</span> <span class="id" type="var">t'</span> <span class="id" type="var">HT</span> <span class="id" type="var">STM</span>.<br/>
<span class="id" type="tactic">induction</span> <span class="id" type="var">STM</span>; <span class="id" type="tactic">intros</span>.<br/>
<span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="tactic">eapply</span> <span class="id" type="var">step_preserves_R'</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">IHSTM</span>.<br/>
<span class="id" type="tactic">eapply</span> <span class="id" type="var">preservation</span>; <span class="id" type="tactic">eauto</span>. <span class="id" type="tactic">auto</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
<br/>
</div>
<div class="doc">
<a name="lab897"></a><h2 class="section">Closed instances of terms of type <span class="inlinecode"><span class="id" type="var">T</span></span> belong to <span class="inlinecode"><span class="id" type="var">R_T</span></span></h2>
<div class="paragraph"> </div>
Now we proceed to show that every term of type <span class="inlinecode"><span class="id" type="var">T</span></span> belongs to
<span class="inlinecode"><span class="id" type="var">R_T</span></span>. Here, the induction will be on typing derivations (it would be
surprising to see a proof about well-typed terms that did not
somewhere involve induction on typing derivations!). The only
technical difficulty here is in dealing with the abstraction case.
Since we are arguing by induction, the demonstration that a term
<span class="inlinecode"><span class="id" type="var">tabs</span></span> <span class="inlinecode"><span class="id" type="var">x</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">t<sub>2</sub></span></span> belongs to <span class="inlinecode"><span class="id" type="var">R_</span>(<span class="id" type="var">T<sub>1</sub></span><span style="font-family: arial;">→</span><span class="id" type="var">T<sub>2</sub></span>)</span> should involve applying the
induction hypothesis to show that <span class="inlinecode"><span class="id" type="var">t<sub>2</sub></span></span> belongs to <span class="inlinecode"><span class="id" type="var">R_</span>(<span class="id" type="var">T<sub>2</sub></span>)</span>. But
<span class="inlinecode"><span class="id" type="var">R_</span>(<span class="id" type="var">T<sub>2</sub></span>)</span> is defined to be a set of <i>closed</i> terms, while <span class="inlinecode"><span class="id" type="var">t<sub>2</sub></span></span> may
contain <span class="inlinecode"><span class="id" type="var">x</span></span> free, so this does not make sense.
<div class="paragraph"> </div>
This problem is resolved by using a standard trick to suitably
generalize the induction hypothesis: instead of proving a statement
involving a closed term, we generalize it to cover all closed
<i>instances</i> of an open term <span class="inlinecode"><span class="id" type="var">t</span></span>. Informally, the statement of the
lemma will look like this:
<div class="paragraph"> </div>
If <span class="inlinecode"><span class="id" type="var">x1</span>:<span class="id" type="var">T<sub>1</sub></span>,..<span class="id" type="var">xn</span>:<span class="id" type="var">Tn</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T</span></span> and <span class="inlinecode"><span class="id" type="var">v<sub>1</sub></span>,...,<span class="id" type="var">vn</span></span> are values such that
<span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">v<sub>1</sub></span></span>, <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">T<sub>2</sub></span></span> <span class="inlinecode"><span class="id" type="var">v<sub>2</sub></span></span>, ..., <span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">Tn</span></span> <span class="inlinecode"><span class="id" type="var">vn</span></span>, then
<span class="inlinecode"><span class="id" type="var">R</span></span> <span class="inlinecode"><span class="id" type="var">T</span></span> <span class="inlinecode">([<span class="id" type="var">x1</span>:=<span class="id" type="var">v<sub>1</sub></span>][<span class="id" type="var">x2</span>:=<span class="id" type="var">v<sub>2</sub></span>]...[<span class="id" type="var">xn</span>:=<span class="id" type="var">vn</span>]<span class="id" type="var">t</span>)</span>.
<div class="paragraph"> </div>
The proof will proceed by induction on the typing derivation
<span class="inlinecode"><span class="id" type="var">x1</span>:<span class="id" type="var">T<sub>1</sub></span>,..<span class="id" type="var">xn</span>:<span class="id" type="var">Tn</span></span> <span class="inlinecode"><span style="font-family: arial;">⊢</span></span> <span class="inlinecode"><span class="id" type="var">t</span></span> <span class="inlinecode">:</span> <span class="inlinecode"><span class="id" type="var">T</span></span>; the most interesting case will be the one
for abstraction.
</div>
<div class="code code-tight">
<br/>
</div>
<div class="doc">
<a name="lab898"></a><h3 class="section">Multisubstitutions, multi-extensions, and instantiations</h3>
<div class="paragraph"> </div>
However, before we can proceed to formalize the statement and
proof of the lemma, we'll need to build some (rather tedious)
machinery to deal with the fact that we are performing <i>multiple</i>
substitutions on term <span class="inlinecode"><span class="id" type="var">t</span></span> and <i>multiple</i> extensions of the typing
context. In particular, we must be precise about the order in which
the substitutions occur and how they act on each other. Often these
details are simply elided in informal paper proofs, but of course Coq
won't let us do that. Since here we are substituting closed terms, we
don't need to worry about how one substitution might affect the term
put in place by another. But we still do need to worry about the
<i>order</i> of substitutions, because it is quite possible for the same
identifier to appear multiple times among the <span class="inlinecode"><span class="id" type="var">x1</span>,...<span class="id" type="var">xn</span></span> with
different associated <span class="inlinecode"><span class="id" type="var">vi</span></span> and <span class="inlinecode"><span class="id" type="var">Ti</span></span>.
<div class="paragraph"> </div>
To make everything precise, we will assume that environments are
extended from left to right, and multiple substitutions are performed
from right to left. To see that this is consistent, suppose we have
an environment written as <span class="inlinecode">...,<span class="id" type="var">y</span>:<span class="id" type="var">bool</span>,...,<span class="id" type="var">y</span>:<span class="id" type="var">nat</span>,...</span> and a
corresponding term substitution written as <span class="inlinecode">...[<span class="id" type="var">y</span>:=(<span class="id" type="var">tbool</span></span>
<span class="inlinecode"><span class="id" type="var">true</span>)]...[<span class="id" type="var">y</span>:=(<span class="id" type="var">tnat</span></span> <span class="inlinecode">3)]...<span class="id" type="var">t</span></span>. Since environments are extended from
left to right, the binding <span class="inlinecode"><span class="id" type="var">y</span>:<span class="id" type="var">nat</span></span> hides the binding <span class="inlinecode"><span class="id" type="var">y</span>:<span class="id" type="var">bool</span></span>; since
substitutions are performed right to left, we do the substitution
<span class="inlinecode"><span class="id" type="var">y</span>:=(<span class="id" type="var">tnat</span></span> <span class="inlinecode">3)</span> first, so that the substitution <span class="inlinecode"><span class="id" type="var">y</span>:=(<span class="id" type="var">tbool</span></span> <span class="inlinecode"><span class="id" type="var">true</span>)</span> has
no effect. Substitution thus correctly preserves the type of the term.
<div class="paragraph"> </div>
With these points in mind, the following definitions should make sense.
<div class="paragraph"> </div>
A <i>multisubstitution</i> is the result of applying a list of
substitutions, which we call an <i>environment</i>.
</div>
<div class="code code-tight">
<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">env</span> := <span class="id" type="var">list</span> (<span class="id" type="var">id</span> × <span class="id" type="var">tm</span>).<br/>
<br/>
<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">msubst</span> (<span class="id" type="var">ss</span>:<span class="id" type="var">env</span>) (<span class="id" type="var">t</span>:<span class="id" type="var">tm</span>) {<span class="id" type="keyword">struct</span> <span class="id" type="var">ss</span>} : <span class="id" type="var">tm</span> :=<br/>