Types ouverts de fermetures, et une application au typage des flots de données

Transcription

1 Types ouverts de fermetures, et une appliation au typage des flots de données Gabriel Sherer, Jan Hoffmann RESEARCH REPORT N 8345 August 2013 Projet-Team Gallium ISSN ISRN INRIA/RR FR+ENG

2

3 Types ouverts de fermetures, et une appliation au typage des flots de données Gabriel Sherer, Jan Hoffmann * Équipe-Projet Gallium Rapport de reherhe n 8345 August pages Résumé : Les systèmes de types ahent les variables apturées par une fermeture, et e dès sa réation. À un point donné du programme, il serait en fait possible de mentionner ertaines de es variables, elles qui sont toujours présentes dans l environnement lexial de typage. Ce raffinement des types de fermetures, plus ouverts ar mentionnant le ontexte qui les entoure, est désirable pour ertaines appliations des systèmes de types à l analyse de programmes. Cet artile introduit formellement de tels types ouverts de fermetures, pour mettre à plat leur traitement théorique reélant quelques diffiultés tehniques : le type d une fermeture mentionne ses dépendanes sur le ontexte, et varie don selon les différents point du programme. En guise d exemple, ils sont utilisés pour garder trae des informations de typage de flots de données induits par la apture des valeurs de l environnement dans les fermetures. Un prototype d implémentation de e système de types est publiquement disponible. Mots-lés : typage, fermetures, types ouverts * Yale University RESEARCH CENTRE PARIS ROCQUENCOURT Domaine de Volueau, - Roquenourt B.P Le Chesnay Cedex

4 Traking Data-Flow with Open Closure Types Abstrat : Type systems hide data that is aptured by funtion losures in funtion types. In most ases this is a benefiial design that enables simpliity and ompositionality. However, some appliations require expliit information about the data that is aptured in losures. This paper introdues open losure types, that is, funtion types that are deorated with type ontexts. They are used to trak data-flow from the environment into the funtion losure. A simply-typed lambda alulus is used to study the properties of the type theory of open losure types. A distintive feature of this type theory is that an open losure type of a funtion an vary in different type ontexts. To present an appliation of the type theory, it is shown that a type derivation establishes a simple non-interferene property in the sense of information-flow theory. A publily available prototype implementation of the system an be used to experiment with type derivations for example programs. Key-words : type systems, losures, open types

5 Types ouverts de fermetures, et une appliation au typage des flots de données 3 Contents 1 Introdution Related Work A Type System for Open Closures A Term Language, and a Naive Attempt at a Type System Maintaining Closure Contexts On open losure types on the left of funtion types A Big-Step Operational Semantis Values and Value Substitution Substituting Values The Big-Step Redution Relation Dependeny information as non-interferene 19 5 Prototype implementation 22 6 Conlusion 23 1 Introdution Funtion types in traditional type systems only provide information about the arguments and return values of the funtions but not about the data that is aptured in funtion losures. Suh funtion types naturally lead to simple and ompositional type systems. Reently, syntax-direted type systems have been inreasingly used to statially verify strong program properties suh as resoure usage [LP13, JHLH10, HAH12], information flow [HR98, SM03], and termination [Abe08, CK01, BGR08]. In suh type systems, it is sometimes neessary and natural to inlude information in the funtion types about the data that is aptured by losures. To see why, assume that we want to design a type system to verify resoure usage. Now onsider for example the urried append funtion for integer lists whih has the following type in OCaml. append : int list int list int list At first glane, we might say that the time omplexity of append is O(n) if n is the length of the first argument. But a loser inspetion of the definition of append reveals that this is a gross simplifiation. In fat, the omplexity of the partial funtion all app_par = append l is onstant. Moreover, the omplexity of the funtion app_par is linear not in the length of the argument but in the length of the list l that is aptured in the funtion losure. In general, we have to desribe the resoure onsumption of a urried funtion f : A 1 A n A with n expressions i (a 1,..., a i ) suh that i desribes the omplexity of the omputation that takes plae after f is applied to i arguments a 1,..., a i. We are not aware of any existing type system that an verify a statement of this form. To express the aforementioned statement in a type system, we have to deorate the funtion types with additional information about the data that is aptured in a funtion losure. It is however not suffiient to diretly desribe the omplexity of a losure in terms of its arguments and the data aptured in the losure. Admittedly, this would work to aurately desribe the resoure usage in our example funtion append beause the first argument is diretly aptured in the losure. But in general, the data aptured in a losure fa 1 a i an be any data that is omputed from the

6 Types ouverts de fermetures, et une appliation au typage des flots de données 4 arguments a 1,..., a i (and from the data in the environment). To referene this data in the types would not only be meaningless for a user, it would also hamper the ompositionality of the type system. It is for instane unlear how to define subtyping for losures that apture different data (whih is, e.g., needed in the two branhes of a onditional.) To preserve the ompositionality of traditional type systems, we propose to desribe the resoure usage of a losure as a funtion of its argument and the data that is visible in the urrent environment. To this end we introdue open losure types, funtion types that refer to their arguments and to the data in the urrent environment. More formally, onsider a typing judgment of the form Γ e : σ, in a type system that traks fine-grained intensional properties haraterizing not only the shape of values, but the behavior of the redution of e into a value (e.g., resoure usage). A typing rule for open losure types, Γ, e : [Γ ](x:σ) τ, aptures the idea that, under a weak redution semantis, the omputation of the losure itself, and later the omputation of the losure appliation, will have very different behaviors, aptured by two different typing environments Γ and Γ of the same domain, the free variables of e. To desribe the omplexity of append, we might for instane have a statement l:int list append l : [l:int list](y:int list) int list. This puts us in a position to use type annotations to desribe the resoure usage of append l as a funtion of l and the future argument y. For example, using type-based amortized analysis [HAH12], we an express a bound on the number of reated list notes in append with the following open losure type. append : [](x:int list 0 ) [x:int list 1 ](y:int list 0 ) int list 0. The intuitive meaning of this type for append is as follows. To pay for the ons operations in the evaluation of append l 1 we need 0 l 1 resoure units and to pay for the ons operations in the evaluation of append l 1 l 2 we need 0 l 1 +1 l 2 resoure units. The development of a type system for open losure types entails some interesting tehnial hallenges: term variables now appear in types, whih requires mehanisms for sope management not unlike dependent type theories. If x appears in σ, the ontext Γ, x:τ, y:σ is not exhangeable with Γ, y:σ, x:τ. Similarly, the judgment Γ, x:τ e 2 : σ will not entail Γ let x = e 1 in e 2 : σ, as the return type σ may ontain open losures soping over x, so we need to substitute variables in types. The main ontribution of this paper is a type theory of open losure types and the proof of its main properties. We start from the simply-typed lambda alulus, and onsider the simple intensional property of data-flow traking, annotating eah simply-typed lambda-alulus type with a single boolean variable. This allows us to study the metatheory of open losure types in lean and straightforward way. This is the first important step for using suh types in more sophistiated type systems for resoure usage and termination. Our type system for data-flow traking aptures higher-order data-flow information. As a byprodut, we get our seondary ontribution, a non-interferene property in the sense of information flow theory: high-level inputs do not influene the (low-level) results of omputations. To experiment with of our type system, we implemented a software prototype in OCaml (see Setion 5).

7 Types ouverts de fermetures, et une appliation au typage des flots de données Related Work In our type system we maintain the invariant that open losure types only refer to variables that are present in the urrent typing ontext. This is a feature that distinguishes open losure types from existing formalisms for losure types. Contextual types [NPP08, PD08, SS12] also deorate types with ontext information. However, it is not neessary in ontextual modal type theory that the ontext that is aptured in a type is related to the urrent ontext. Furthermore, our goal of desribing properties that may depend on previous funtion arguments and other visible variables is quite different from the main appliations of ontextual types in programming language support for manipulating proof terms and meta-variables. Having losure types arry a set of aptured variables has been done in the literature, as for example in Leroy [Ler92], whih use losure types to keep trak of of dangerous type variables that an not be generalized without breaking type safety, or in the higher-order lifetime analysis of Hannan et al. [HHLN97], where variable sets denote variables that must be kept in memory. However, these works have no need to vary funtion types in different typing ontexts and subtyping an be defined using set inlusion, whih makes the metatheory signifiantly simpler. On the ontrary, our soping mehanism allows to study more omplex properties, suh as value dependenies and non-interferene. The lassial way to understand value apture in losures in a typed way is through the typed losure onversion of Minamide et al. [MMH96]. They use existential types to aount for hidden data in funtion losures without losing ompositionality, by abstrating over the differene between funtions apturing from different environments. Our system retains this ompositionality, albeit in a less apparent way: we get finer-grained information about the dependeny of a losure on the ambient typing environment. Typed losure onversion is still possible, and ould be typed in a more preise way, abstrating only over values that are outside the lexial ontext. Petriek et al. [POM12] study oeffets systems with judgments of the form C r Γ e : τ and funtion types C s σ τ, where r and s are oeffet annotations over a indexed omonad C. Their work is orthogonal to the present one as they over very different topis: on one side, the omonadi semantis struture of oarsegrained effet indexes, and on the other the syntati soping rules that arise from traking eah variable of the ontext separately. We believe that our dependeny of types on term variables would make a semanti study signifiantly more hallenging, and onversely that use ases of open losure types are not in general haraterized by a omonadi struture. The non-interferene property that we prove is different from the usual treatment in type systems for information flow like the SLam Calulus [HR98]. In SLam, the information flow into losure is aounted for at abstration time. In ontrast, we aount for the information flow into the losure at appliation time. 2 A Type System for Open Closures We define a type system for the simplest problem domain that exhibits a need for open losure types. Our goal is to determine statially, for an open term e, on whih variables of the environment the value of e depends. We are interested in weak redution, and assume a all-by-value redution strategy. In this ontext, an abstration λx.e is already a value, so reduing it does not depend on the environment at all. More generally, for a term e evaluating to a funtion (losure), we make a distintion between the part of the environment the

8 Types ouverts de fermetures, et une appliation au typage des flots de données 6 Sope-Atom Γ Γ α Sope-Context-Nil Sope-Produt Γ τ 1 Γ τ 2 Γ τ 1 τ 2 Sope-Context Γ σ Γ, x:σ Sope-Closure Γ 0, Γ 1 Γ 0 σ Γ 0, x:σ τ Γ 0, Γ 1 [Γ Φ 0 ](x:σ ϕ ) τ Figure 1: Well-soping of types and ontexts redution of e depends on, and the part that will be used when the resulting losure will be applied. For example, the term (y, λx.z) depends on the variable y at evaluation time, but will not need the variable z until the losure in the right pair omponent is applied. This is where we need open losure types. Our funtion types are of the form [Γ Φ ](x:σ ϕ ) τ, where the mapping Φ from variables to Booleans indiates on whih variables the evaluation depends at appliation time. The Boolean ϕ indiates whether the argument x is used in the funtion body. We all Φ the dependeny annotation of Γ. Our previous example would for instane be typed as follows. y:σ 1, z:τ 0 (y, λx.z) : σ ([y:σ 0, z:τ 1 ](x:ρ 0 ) τ) The typing expresses that the result of the omputation depends on the variable y but not on the variable z. Moreover, result of the funtion in the seond omponent of the pair depends on z but not on y. In general, types are defined by the following grammar. Types σ, τ, ρ ::= types α atoms τ 1 τ 2 produts [Γ Φ ](x:σ ϕ ) τ losures The losure type [Γ Φ ](x:σ ϕ ) τ binds the new argument variable x, but not the variables ourring in Γ whih are referene variables bound in the urrent typing ontext. Suh a type is well-soped only when all the variables it loses over are atually present in the urrent ontext. In partiular, it has no meaning in an empty ontext, unless Γ is itself empty. We define well-soping judgments on ontexts (Γ ) and types (Γ σ). The judgments are defined simultaneously in Figure 1 and refer to eah another. They use non-annotated ontexts: the dependeny annotations haraterize data-flow information of terms, and are not needed to state the well-formedness of stati types and ontexts. Notie that the losure ontexts appearing in the return type of a losure, τ in our rule Sope-Closure, may apture the variable x orresponding to the funtion argument, whih is why we hose the dependent-arrow like notation (x:σ) τ rather than only σ τ. There is no dependeny of types on terms in this system, this is only used for sope traking. Note that Γ σ implies Γ (as proved by diret indution until an atom or a funtion losure is reahed). Note also that a ontext type [Γ 0 ](x:σ) τ is wellsoped in any larger environment Γ 0, Γ 1 : the ontext information may only mention variables existing in the typing ontext, but it need not mention all of them. As a result, well-soping is preserved by ontext extension: if Γ 0 σ and Γ 0, Γ 1, then Γ 0, Γ 1 σ.

9 Types ouverts de fermetures, et une appliation au typage des flots de données 7 Var Γ, x:σ, Γ 0, x:σ 1, 0 x : σ Lam Γ Φ, x:σ ϕ t : τ Γ 0 λx.t : [Γ Φ ](x:σ ϕ ) τ Produt Γ Φ1 e 1 : τ 1 Γ Φ2 e 2 : τ 2 Γ Φ 1+Φ 2 (e 1, e 2 ) : τ 1 τ 2 Proj Γ Φ e : τ 1 τ 2 Γ Φ π i (e) : τ i Fix Γ Φ, f:([γ Ψ ](x:σ ϕ ) τ) χ, x : σ ϕ e : τ Γ 0 fix f x.e : [Γ Ψ ](x:σ ϕ ) τ App-Tmp (Γ 0, Γ 1 ) Φ fun t : [Γ Φ los 0 ](x:σ ϕ ) τ (Γ 0, Γ 1 ) Φ arg u : σ (Γ 0, Γ 1 ) Φ fun +Φ los +ϕ.φ arg t u : τ Figure 2: Naive rules for the type system Let-Tmp Γ Φ def e 1 : σ A Term Language, and a Naive Attempt at a Type System Γ Φ body, x:σ ϕ e 2 : τ Γ ϕ.φ def +Φ body let x = e 1 in e 2 : τ Our term language, is the lambda alulus with pairs, let bindings and fixpoints. This language is suffiient to disuss the most interesting problems that arise in an appliation of losure types in a more realisti language. Terms t, u, e ::= terms x variables (e 1, e 2 ) pairs π i (e) projetions (i {1, 2}) λx.e lambda abstrations t u appliations let x = e 1 in e 2 let delarations For didati purposes, we start with an intuitive type system presented in Figure 2. The judgment Γ Φ e : σ means that the expression e has type σ, in the ontext Γ arrying the intensional information Φ. Context variable mapped to 0 in Φ are not used during the redution of e to a value. We will show that the rules App-Tmp and Let-Tmp are not orret, and introdue a new judgment to develop orret versions of the rules. In a judgment Γ 0 λx.t : [Γ Φ ](x:σ 0 ) τ, Γ is bound only in one plae (the ontext), and α-renaming any of its variable neessitates a mirroring hange in its right-hand-side ourrenes (Γ Φ but also in σ and τ), while x is independently bound in the term and in the type, so the aforementioned type is equivalent to [Γ Φ ](y:σ) τ[y/x]. In partiular, variables ourring in types do not reveal implementation details of the underlying term. The syntax ϕ.φ used in the App-Tmp and Let-Tmp rules is a produt, or onjuntion, of the single boolean dependeny annotation ϕ, and of the vetor dependeny annotation Φ. The sum Φ 1 + Φ 2 is the disjuntion. In the Let-Tmp rule for example, if the typing of e 2 determines that the evaluation of e 2 does not depend on the definition x = e 1 (ϕ is 0), then ϕ.φ def will mark all the variables used by e 1 as not needed as well (all 0), and only the variables needed by e 2 will be marked in the result annotation ϕ.φ def + Φ body. In the introdution we present losure types of the form [Γ](x:σ) τ, while we here use the apparently different form [Γ Φ ](x:σ ϕ ) τ. This new syntax is atually a simpler speial ase of the previous one: we ould onsider a type grammar of the form σ ϕ, and the type [Γ](x:σ) τ would then apture all the needed information, as eah type in Γ would ome with its own annotation. Instead, we don t embed dependeny information in the types diretly, and use annotated ontext Γ Φ to arry equivalent information. This simplifiation makes it easier to ontrol the soping orretness: it is easier to notie that Γ Φ and Γ Ψ are ontexts ranging over the same

10 Types ouverts de fermetures, et une appliation au typage des flots de données 8 domain than if we wrote Γ and Γ. It is made possible by two speifi aspets of this simple system: Our intensional information has a very simple struture, only a boolean, that does not apply to the types in depth. The simplifiation would not work, for example, in a seurity type system where produts ould have omponents of different seurity levels (τ l σ r ), but the struture of the rules would remain the same. In this example, we are interested mostly in intensional information on the ontexts, rather than the return type of a judgment. The general ase rather suggests a judgment of the form Γ Φ e : σ ϕ, but with only boolean annotations this boils to a judgment Γ Φ e : σ 1, when we are interested in the value being type-heked, and a trivial judgment Γ 0 e : σ 0, used to type-hek terms that will not be used in the rest of the omputation, and whih degenerates to a hek in the simply-typed lambda-alulus. Instead, we define a single judgment Γ Φ e : σ orresponding to the ase where ϕ is 1, and use the notation ϕ.φ to nullify the dependeny information oming of from e when the outer omputation does not atually depend on it (ϕ is 0). While dependeny annotations make the development easier to follow, they do not affet the generality of the type theory, as the ommon denominator of open losure type systems is more onerned with the soping of losure ontexts than the struture of the intensional information itself Maintaining Closure Contexts As pointed out, the rule App-Tmp and Let-Tmp of the system above are wrong (hene the temporary name): the left-hand-side of the rule App-Tmp assumes that the losure aptures the same environment Γ that it is omputed in. This property is initially true in the losure of the rule Lam, but is not preserved by Let-Tmp (for the body type) or App-Tmp (for the return type). This means that the intensional information in a type may beome stale, mentioning variables that have been removed from the ontext. We will now fix the type system to never mention unbound variables. We need a losure substitution mehanism to explain the type τ f = [Γ Φ, y:ρ χ ](x:σ ϕ ) τ ψ of a losure f in the smaller environment Γ, given dependeny information for y in Γ. Assume for example that y was bound in a let binding let y = e... and that the type τ f leaves the sope of y. Then we have to adapt the type rules to express the following. If f depends on y (at appliation time) then f depends on the variables of Γ that e depends on. We define in Figure 3 the judgment Γ, y:ρ, σ Γ, τ. Assuming that the variable y in the ontext Γ, y:ρ, was let-bound to an definition with usage information Γ Ψ, this judgment transforms any type σ in this ontext in a type τ in a ontext Γ, that does not mention y anymore. Note that and have the same domain, only their intensional information hanged: any mention of y in a losure type of was removed in. Also note that Γ, y:ρ, and Γ,, or σ and τ, are not annotated with dependeny annotations themselves: this is only a soping transformation that depends on the dependeny annotations of y in the losures of σ and. As for the sope-heking judgment, we simultaneously define the substitutions on ontexts themselves Γ, y:ρ, Γ,. There are two rules for substituting a losure type. If the variable being substituted is not part of the losure type ontext (rule Subst-Closure-Notin), this losure type is unhanged. Otherwise (rule Subst-Closure) the substitution is performed in the losure type, and the neededness annotation for y is reported to its definition ontext Γ 0.

11 Types ouverts de fermetures, et une appliation au typage des flots de données 9 The following lemma verifies that this substitution preserves well-soping of ontexts and types. Lemma 1 (Substitution preserves soping) If Γ, y:ρ, and Γ, y:ρ, Γ, hold, then Γ, holds. If Γ, y:ρ, σ and Γ, y:ρ, σ Γ, τ hold, then Γ, τ holds. By mutual indution on the judgments Γ, y:ρ, Γ, and Γ, y:ρ, σ Γ, τ. Subst-Context-Nil: using Sope-Context-Nil, Γ, x:σ implies Γ σ, whih in turn implies Γ. Subst-Context: from our hypothesis Γ, y:ρ,, x:σ we dedue Γ, y:ρ, σ. By indution we an dedue Γ, τ, whih gives ontext well-formedness Γ,. Subst-Atom: diret by Sope-Atom and indution hypothesis. Subst-Produt: by inversion, the last rule of the derivation of Γ, y:ρ (σ 1 σ 2 ) is Sope-Produt, so we an proeed by diret indution on the premises of both judgments. Subst-Closure: Using our indution hypothesis on Γ, y:ρ,, Γ 1 we an dedue that Γ,, Γ 1 and in partiular Γ,. Γ,, Γ 1 By inversion, the last rule of the derivation of Γ, y:ρ,, Γ 1 [Γ Φ 1, y:ρ χ, Φ 2 ](y : σ ϕ 1 1 ) σ 2 is Sope-Closure. Its premises are Γ, y:ρ, σ 1 and Γ, y:ρ,, x:σ 1 σ 2, from whih we dedue by indution hypothesis Γ, τ 1 and Γ,, x:τ 1 τ 2 respetively, allowing to dedue that Γ, [Γ Φ1+χ.Ψ, Φ 2 ](x : τ 1 ) τ 2, whih allows to onlude by weakening with the well-soped Γ 1. Subst-Closure-Notin: diret by indution and inversion. We an now give the orret rules for binders: Let Γ Φ def e 1 : σ Γ Φ body, x:σ ϕ e 2 : τ Γ, x:σ τ x\φ def Γ τ Γ ϕ.φ def +Φ body let x = e 1 in e 2 : τ App (Γ 0, Γ 1 ) Φ fun t : [Γ Φ los 0 ](x:σ ϕ ) τ (Γ 0, Γ 1 ) Φarg u : σ Γ 0, Γ 1, x:σ τ x\φ arg Γ 0, Γ 1 τ (Γ 0, Γ 1 ) Φ fun +Φ los +ϕ.φ arg t u : τ Lemma 2 (Typing respets soping) If Γ t : σ holds, then Γ σ holds. This lemma guarantees that we fixed the problem of stale intensional information: types appearing in the typing judgment are always well-soped. By indution on the derivation of Γ t : σ. Var: from the premise Γ 0, x : σ 1, 0 we have Γ σ. Prod: diret by indution. Proj: the indution hypothesis is Γ τ 1 τ 2, from whih we get Γ τ i (for i {1, 2}) by inversion. Lam: the indution hypothesis is Γ, x:σ τ. From this we get Γ, x:σ and therefore Γ σ, whih allows to onlude with Sope-Closure.

12 Types ouverts de fermetures, et une appliation au typage des flots de données 10 Subst-Closure Subst-Context-Nil Γ, y:ρ, Γ Subst-Atom Γ, y:ρ, Γ, Γ, y:ρ, α Γ, α Subst-Context Γ, y:ρ, σ Γ, τ Γ, y:ρ,, x:σ Γ,, x:τ Subst-Produt Γ, y:ρ, σ 1 Γ, τ 1 Γ, y:ρ, σ 2 Γ, τ 2 Subst-Closure-Notin Γ, y:ρ, σ 1 σ 2 Γ, τ 1 τ 2 Γ 0, Γ 1, y:ρ, [Γ Φ 0 ](x:σ ϕ 1 ) σ 2 Γ 0, Γ 1, y:ρ, Γ 0, Γ 1, Γ0, Γ 1, [Γ Φ 0 ](x:σ ϕ 1 ) σ 2 Γ, y:ρ,, Γ 1 Γ,, Γ 1 Γ, y:ρ, σ 1 Γ, σ 1 Γ, y:ρ,, x:σ 1 σ 2 Γ,, x:σ 1 τ 2 Γ, y:ρ,, Γ 1 [Γ Φ1, y:ρ χ, Φ2 ](x:σ ϕ 1 ) σ 2 Figure 3: Type substitution Γ,, Γ 1 [Γ Φ1+χ.Ψ, Φ 2 ](x:σ ϕ 1 ) τ 2 Fix: the hypothesis implies Γ, f:[γ Ψ ](x:σ ϕ ) τ, whih in turn implies Γ [Γ Ψ ](x:σ ϕ ) τ. App: Using our indution hypothesis on the first premise give us that Γ 0, Γ 1 [Γ Φ los 0 ](x:σ) τ, so by inversion Γ 0, Γ 1 and Γ 0, x:σ τ. The latter fat an be weakened into Γ 0, Γ 1, x:σ τ, and then ombined with the last premise Γ 0, Γ 1, x:σ τ x\φ arg Γ 0, Γ 1 τ and Lemma 1 to get our goal Γ 0, Γ 1 τ. Let: reasoning similar to the App ase. By indution on the middle premise, we have Γ, x:σ τ, ombined with the right premise Γ, x:σ τ x\φ def Γ τ we get Γ τ. It is handy to introdue a onvenient derived notation Γ Φ τ Γ Φ τ that is defined below. This substitution relation does not only remove y from the open losure types in Γ, it also updates the dependeny annotation on Γ to add the dependeny Ψ, orresponding to all the variables that y depended on if it is itself marked as needed. Γ Φ 1, y:ρ χ, Φ 2 Γ, y:ρ, τ Γ, τ τ Γ Φ 1+χ.Ψ, Φ 2 τ It is interesting to see that substituting y away in Γ Φ1, y:ρ, Φ2 hanges the annotation on Γ, but not its types (Γ is unhanged in the output as its types may not depend on y), while it hanges the types in but not its annotation (Φ 2 is unhanged in the output as a value for y may only depend on variables from Γ, not ). The following tehnial results allow us to permute substitutions on unrelated variables. They will be used in the typing soundness proof of the next setion (Theorem 1).

13 Types ouverts de fermetures, et une appliation au typage des flots de données 11 x a \Ψ a Lemma 3 (Confluene) If Γ 1 τ 1 then there exists a unique Γ 3 τ 3 suh that x b \Ψ b Γ2a τ 2a and Γ 1 τ 1 Γ2b τ 2b Γ 2a τ 2a x b \(Ψ b +Ψ a.ψ b (x a )) Γ 3 τ 3 and Γ 2b τ 2b x a \(Ψ a +Ψ b.ψ a (x b )) Γ 3 τ 3 Without loss of generality we an assume that x a appears before x b in Γ 1, so in partiular Ψ a (x b ) = 0. For any subontext of the form 1 Ψ 1, x a :σ a ρ a, 2 Ψ 2, x b :σ b ρ b, assume that substituting Ψ a for x a first results in 1 Ψ 1 +ρ a.ψ a, 2a Ψ 2, x b :σ ba ρ b, while substituting Ψ b for x b first results in 1 Ψ 1 +ρ b.ψ b ( 1 ), x a :σ a ρ a +ρ b.ψ b (x a ), 2 Ψ 2 +ρ b.ψ b ( 2 ). Substituting Ψ b + Ψ a.ψ b (x a ) for x b in results in whih simplifies to 1 Ψ 1+ρ a.ψ a, 2a Ψ 2, x b :σ ba ρ b 1 Ψ 1+ρ a.ψ a+ρ b.(ψ b +Ψ a.ψ b (x a))( 1), 2a Ψ 2+ρ b.(ψ b +Ψ a.ψ b (x a))( 2a) 1 Ψ 1 +ρ a.ψ a +ρ b.ψ b ( 1 )+ρ b.ψ b (x a ).Ψ a, 2a Ψ 2 +ρ b.ψ b ( 2a ) Substituting Ψ a + Ψ b.ψ a (x b ) = Ψ a for x a in results in whih simplifies to 1 Ψ 1+ρ b.ψ b ( 1), x a :σ a ρ a +ρ b.ψ b (x a ), 2 Ψ 2+ρ b.ψ b ( 2) 1 Ψ 1 +ρ b.ψ b ( 1 )+(ρ a +ρ b.ψ b (x a )).Ψ a ), 2a Ψ 2 +ρ b.ψ b ( 2 ) 1 Ψ 1 +ρ b.ψ b ( 1 )+ρ a.ψ a +ρ b.ψ b (x a ).Ψ a, 2a Ψ 2 +ρ b.ψ b ( 2 ) Given that 2 and 2a have the same domain (only different types), the restritions Ψ b ( 2 ) and Ψ b ( 2a ) are equal, allowing to onlude that the two substitutions indeed end in the same sequent 1 Ψ 1+(ρ a+ρ b.ψ b (x a)).ψ a+ρ b.ψ b ( 1), 2a Ψ 2+ρ b.ψ b ( 2) Note that we an make sense, informally, of this resulting sequent. The variable used by this final ontexts are the variables used of 1 used in the initial judgment (Ψ 1 ) the variables of 2 (updated in 2a to remove referenes to the substituted variable x a ) used in the initial judgment (Ψ 2 ) the variables used by Ψ b, if it is used (ρ b is 1) the variables used by Ψ a if either x was used (ρ a is 1), or if x b is used (ρ b is 1) and itself uses x a (Ψ b (x a ) is 1). To get this intuition, we onsidered again the annotations as booleans, but note that the equivalene proof was done in a purely algebrai manner. It should therefore be preserved in future work where the intensional information has a riher struture. Corollary 1 (Reordering of substitutions) If Ψ a and Ψ b have domain Γ, and Γ 1 Φ 1 then there exists Γ 2 Φ 2 τ 2 suh that Γ 1 Φ 1 x a \Ψ a τ 1 Φ Γ2 2 x b \(Ψ b +Ψ b (x a ).Ψ a ) Φ τ 2 Γ 3 3 τ 3 x b \Ψ b τ 1 Γ Φ 2 2 τ 2 x a \(Ψ a +Ψ a (x b ).Ψ b ) Φ Γ 3 3 τ 3

14 Types ouverts de fermetures, et une appliation au typage des flots de données On open losure types on the left of funtion types Note that the Subst-Closure handles the funtion type on the left-hand-side of the arrow, σ 1, is a speifi and subtle way: it must be unhanged by the substitution judgment. Under a slightly simplified form, the judgment reads: Γ, y:ρ, σ 1 Γ, σ 1 Γ, y:ρ,, x:σ 1 σ 2 Γ,, x:σ 1 τ 2 Γ, y:ρ, [Γ Φ 1, y:ρ χ, Φ 2 ](x:σ ϕ 1 ) σ 2 Γ, [Γ Φ 1+χ.Ψ, Φ 2 ](x:σ ϕ 1 ) τ 2 This orresponds to the usual hange of diretion on the left of arrow type. A substitution Γ, y:ρ τ Γ τ is a lossy transformation, as we forget how y is used in τ and instead mix its definition information with the rest of the ontext information in τ. Suh a loss makes sense for the return type of a funtion: we forget information about the return value. But by ontravariane of input argument, we should instead refine the argument types. But as the gain or loss or preision orrespond to variables going out of sope, suh a refinement ould only happen in smaller nested sopes. On the ontrary, when going out to a wider sope, the only possibility is that the losure type does not depend on the partiular variable being substituted (so the type σ is preserved, Γ, y:ρ, σ Γ, σ). If the variable was used, a loss of preision would be possible: this substitution must be rejeted. Consider the following example: (* in ontext Γ *) let x : int = e_x in let y : bool = e_y in let f (g : [Γ 0, x:int 1 ](z : unit 0 ) int) : int = g () in f (λz. x); f In the environment Γ, x:int, y:bool, the type of f s funtion argument g desribes a funtion whose result depends on x. We an still express this dependeny when substituting the variable y away, that is when onsidering the type of the expression (let y =... in let f g =... in f) as a whole: the argument type will still have type [Γ 0, x:int 1 ](z : unit) int. However, this dependeny on x annot make sense anymore if we remove x itself from the ontext, the substitution does not preserve this funtion type. This makes the whole expression (let x =... in (let y =... in let f g =... in f)) ill-typed, as x esapes its sope in the argument funtion type. One way to understand this requirement is that there are two parts to having an analysis be fully higher-order. Fist, it handles programs that take funtions as input, and seond, it handles programs that return funtions as result of omputations. Some languages only pass funtions as parameters (this is in partiular the ase of C with pointers to global funtions), some onstrutions suh as urrying fundamentally rely on funtion reation with environment apture. Our system proposes a new way to handle this seond part, and is intensionally simplisti, to the point of being restritive, on the rest. In a non-toy language one would want to add subtyping of ontext information, that would allow ontrolled loss of preision to, for example, reate lists of funtions with slightly different ontext information. Another useful feature would be ontext information polymorphism to express funtions being parametri with respet to the ontext information of their argument. This is intentionally left to future work.

15 Types ouverts de fermetures, et une appliation au typage des flots de données 13 3 A Big-Step Operational Semantis In this setion, we will define an operational semantis for our term language, and use it to prove the soundness of the type system (Theorem 1). Our semantis is equivalent to the usual all-by-value big-step redution semantis for the lambdaalulus in the sense that omputation happens at the same time. There is however a notable differene. Funtion losures are not built in the same way as they are in lassial bigstep semantis. Usually, we have a rule of the form V λx.t (V, λx.t) where the losure for λx.t is a pair of the value environment V (possibly restrited to its subset appearing in t) and the funtion ode. In ontrast, we apture no values at losure reation time in our semantis: V λx.t (, λx.t). The aptured values will be added to the losure inrementally, during the redution of binding forms that introdued them in the ontext. Consider for example the following two derivations; one in the lassi big-step redution, and the other in our alternative system. Classi-Red-Let x:v x v x:v, y:v λz.y ((x v, y v), λz.y) x:v let y = x in λz.y ((x v, y v), λz.y) Our-Red-Let x:v, y:v λz.y ([x, y],, λz.y) x:v x v (, λz.y) y\v ([x], y v, λz.y) x:v let y = x in λz.y ([x], y v, λz.y) Rather than apturing the whole environment in a losure, we store none at all at the beginning (merely reord their names), and add values inrementally, just before they get popped from the environment. This is done by the value substitution judgment w x\v w that we will define in this setion. The reason for this hoie is that this losely orresponds to our typing rules, value substitution being a runtime ounterpart to substitution in types Γ σ x\φ Γ σ ; this ommon struture is essential to prove of the type soundness (Theorem 1). Note that derivations in this modified system and in the original one are in one-to-one mapping. It should not be onsidered a new dynami semantis, rather a reformulation that is onvenient for our proofs as it mirrors our stati judgment struture Values and Value Substitution Values are defined as follows. Val v, w ::= values v α value of atomi type (v, w) value tuples ([x j ] j J, (x i v i ) i I, λx.t) funtion losures ([x j ] j J, (x i v i ) i I, fix f x.t) reursive funtion losures The set of variables bound in a losure is split into an ordered mapping (x i v i ) i I for variables that have been substituted to their value, and a simple list [x j ] j J of variables whose value has not yet been aptured. They are both binding ourrenes of variables bound in t; α-renaming them is orret as long as t is updated as well. To formulate our type soundness result, we define a typing judgment on values Γ v : σ in Figure 4. An intuition for the rule Value-Closure is the following.

16 Types ouverts de fermetures, et une appliation au typage des flots de données 14 Value-Atom Γ Γ v α : α Value-Produt Γ v 1 : τ 1 Γ v 2 : τ 2 Γ (v 1, v 2 ) : τ 1 τ 2 Value-Closure Γ, Γ 1 i I, Γ, (x j :τ j ) j<i v i : τ i Γ Φ, (x i :τ ψi i ) i I, x:σ ϕ t : τ Γ Φ, (x i :τ ψi i ) i I, x:σ ϕ τ (x i)\(ψ i ) Γ Φ, x:σ ϕ τ Γ, Γ 1 (dom(γ), (x i v i ) i I, λx.t) : [Γ Φ ](x:σ ϕ ) τ Value-Closure-Fix Γ, Γ 1 i I, Γ, (x j :τ j ) j<i v i : τ i Γ Φ, (x i :τ ψ i i ) i I, f:([γ, (x i :τ ψ i i )](x:σ ϕ ) τ) χ, x:σ ϕ t : τ Γ Φ, (x i :τ ψ i i ) i I, x:σ ϕ τ (x i)\(ψ i ) Γ Φ, x:σ ϕ τ Γ, Γ 1 (dom(γ), (x i v i ) i I, fix f x.t) : [Γ Φ ](x:σ ϕ ) τ Subst-Value-Atom y\v v α v α Figure 4: Value typing Subst-Value-Produt y\v w 1 w 1 y\v w 2 w 2 (w 1, w 2 ) y\v (w 1, w 2) Subst-Value-Closure ([x j1,..., x jn, y], (x i w i ) i I, t) y\v ([x j1,..., x jn ], (y v)(x i w i ) i, t) Subst-Value-Closure-Notin y / (x j ) j J ([x j ] j J, (x i w i ) i I, t) y\v ([x j ] j J, (x i w i ) i I, t) Figure 5: Value substitution Internally, the term t has a dependeny Γ Φ on the ambient ontext, but also dependenies (τ ψ i i ) on the aptured variables. But externally, the type may not mention the aptured variables, so it reports a different dependeny Γ Φ that orresponds to the internal dependeny Γ Φ, ombined with the dependenies (Ψ i ) of the aptured values. Both families (ψ i ) i I and (Ψ i ) i I are existentially quantified in this rule. In the judgment rule, the notation (x j : τ j ) j<i is meant to define the environment of eah (x i : τ i ) as Γ Φ, plus all the (x j : τ j ) that ome before x i in the typing judgment Γ Φ, (x i : τ i ) i I, x : σ ϕ t. The notation... (xi)\(ψi)... denotes the sequene of substitutions for all (x i, Ψ i ), with the rightmost variable (introdued last) substituted first: in our dynami semantis, values are aptured by the losure in the LIFO order in whih their binding variables enter and leave the lexial sope Substituting Values In the typing rules, we use the substitution relation Γ, y:ρ σ y\φ Γ τ to remove the variable y from the losure types in σ. Correspondingly, in our runtime semantis, we add the variable y to the vetor stored in the losure value, by a value substitution judgment w y\v w (see Figure 5) when the binding of y is removed from the evaluation ontext. In the Subst-Value-Closure, the notation, (y v)(x i w i ) i means that the binding y v is added in first position in the vetor of aptured values. The values w i were omputed in a ontext depending on y, so they need to appear after the binding y v for the value to be type-orret.

17 Types ouverts de fermetures, et une appliation au typage des flots de données 15 Lemma 4 (Value substitution preserves typing) If (Γ v : ρ), (Γ, y:ρ w : σ), (Γ, y:ρ σ Γ τ) and (w y\v w ) hold, then (Γ w : τ) holds. Note that this theorem is restrited to substitutions of the rightmost variable of the ontext. While substitution in types needs to operate under binders (in rule Subst-Closure), value substitution is a runtime operation that will only be used by our (weak) redution relation on the last introdued variable. By indution on the value typing judgment Γ, y:ρ w : σ. Value-Atom: by inversion we know that the last rule of Γ, y:ρ α Γ τ is Subst-Atom. From the premise Γ, y:ρ and Γ, y:ρ Γ we an dedue from Lemma 1 that Γ, whih allows to onlude Γ v α : α. Value-Produt: by inversion, the last rules of Γ, y:ρ (σ 1 σ 2 ) Γ τ and w y\v w are respetively Subst-Produt and Subst-Value-Produt, so by indution hypothesis we have Γ w 1 : τ 1 and Γ w 2 : τ 2, whih allows us to onlude Γ (w 1, w 2) : τ 1 τ 2. Value-Closure. By inversion we know that the last substitution rules applied are either Subst-Closure and Subst-Value-Closure, or Subst-Closure-Notin and Subst-Value-Closure-Notin, depending on whether the substituted variable is part of the losure ontext. In the latter ase, both the types and the judgments are unhanged, so the result is immediate. If the substituted value is part of the losure ontext, the rules of the involved judgments are Γ, y:ρ σ 1 Γ σ1 Γ, y:ρ, x:σ 1 σ 2 Γ, x:σ1 σ 2 Γ, y:ρ [Γ Φ 1, y:ρ χ ](x:σ ϕ 1 ) σ 2 Γ [Γ Φ 1 +χ.ψ ](x:σ ϕ 1 ) σ 2 i I, Γ, y:ρ, (x j :τ j ) j<i w i : τ i Γ Φ 1, y:ρ χ, (x i :τ ψi i ) i I, x:σ ϕ 1 t : σ 2 Γ Φ 1, y:ρ χ, (x i :τ ψi i ) i I, x:σ ϕ 1 σ 2 (x i)\(ψ i) Γ Φ 1, y:ρ χ, x:σ ϕ 1 σ 2 Γ, y:ρ (dom(γ), (x i w i ) i I, λx.t) : [Γ Φ 1, y:ρ χ ](x:σ ϕ 1 ) σ 2 ([dom(γ), y], (x i w i ) i I, t) y\v (dom(γ), (y v)(x i w i ) i, t) We an reah our goal by using the following inferene rule: i I, Γ, y:ρ, (x j :τ j ) j<i w i : τ i Γ Φ 1, y : ρ χ ψ, (x i :τ i i ) i I, x:σ ϕ 1 t : σ 2 Γ Φ 1, y:ρ χ, (x i :τ ψ i i ) i I, x:σ ϕ 1 σ 2,y(x i ) i \,Ψ(Ψ i ) i Γ Φ 1 +χ.ψ, x:σ ϕ 1 σ 2 Γ (dom(γ),, (y v)(x i w i ) i I, λx.t) : [Γ Φ1+χ.Ψ ](x:σ ϕ 1 ) σ 2 The typing assumptions all math those of our premise. The redution assumption is simply the omposition of the redutions of the premises: Γ Φ 1, y:ρ χ, (x i :τ ψi i ) i I, x:σ ϕ 1 σ 2 (x i)\(ψ i) Γ Φ1, y:ρ χ, x:σ ϕ 1 σ 2 Γ Φ 1+χ.Ψ, x:σ ϕ 1 σ 2

18 Types ouverts de fermetures, et une appliation au typage des flots de données 16 Red-App Red-Var V x V (x) Red-Lam-Fix V fix f x.t (dom(v ),, fix f x.t) Red-Pair V e 1 v 1 V e 2 v 2 V (e 1, e 2 ) (v 1, v 2 ) Red-Let Red-Lam V λx.t (dom(v ),, λx.t) Red-Proj V e (v 1, v 2 ) V π i (e) v i V e 1 v 1 V, (x v 1 ) e 2 v 2 x\v 1 v 2 v 2 V let x = e 1 in e 2 v 2 V, V 1 t (dom(v ), V 2, λy.t ) V, V 1 u v arg V, V 1, V 2, y v arg t w w y\v arg w V 2 w V, V 1 t u w Red-App-Fix V, V 1 t (dom(v ), (x i v i ) i I, fix f y.t ) V, V 1 u v arg V, (x i v i ) i, (f fix f y.t ), (y v arg ) t w V, V 1 t u w Figure 6: Big-step redution rules The Big-Step Redution Relation We are now equipped to define in Figure 6 the big-step redution relation on well-typed terms V e v, where V is a mapping from the variables to values that is assumed to ontain at least all the free variables of e. The notation w V 2 w denotes the sequene of substitutions for eah (variable, value) pair in V 2, from the last one introdued in the ontext to the first; the intermediate values are unnamed and existentially quantified. We write V : Γ if the ontext valuation V, mapping free variables to values, is well-typed aording to the ontext Γ. Value-Env-Empty : Value-Env V : Γ Γ v : σ V, x v : Γ, x:σ Theorem 1 (Type soundness) If Γ Φ t : σ, V : Γ and V t v then Γ v : σ. By indution on the redution derivation V t v. Red-Var: From V : Γ we have Γ V (x) : σ. Red-Lam, Red-Lam-Fix: in the degenerate ase where there are no aptured values, the value typing rule Value-Closure for [Γ Φ ](x:σ ϕ ) τ has as only premise Γ Φ, x:σ ϕ τ, whih is preisely our typing assumption. Red-Pair, Red-Proj: diret by indution.

19 Types ouverts de fermetures, et une appliation au typage des flots de données 17 Red-Let: The involved derivations are the following: x\v 1 V e 1 v 1 V, x v 1 e 2 v 2 v 2 v 2 V let x = e 1 in e 2 v 2 Γ Φ def e 1 : σ Γ Φ body, x:σ ϕ e 2 : τ Γ, x:σ τ x\φ def Γ τ Γ ϕ.φ def +Φ body let x = e 1 in e 2 : τ By indution hypothesis we have Γ v 1 : σ, from whih we dedue that V, x v 1 : Γ, x:σ. This allows us to use indution again to dedue that Γ, x:σ v 2 : τ. Finally, preservation of value typing by value substitution (Lemma 4) allows to onlude that the remaining goal Γ v 2 : τ holds. Red-App: the involved derivations are the following. V, V 1 t (dom(v ), (x i v i ) i I, λy.t ) V, V 1 u v arg V, V 1, (x i v i ) i, y v arg t w w y\v arg w (xi)\(vi) w V, V 1 t u w (Γ, Γ 1 ) Φ fun t : [Γ Φ los](y:σ ϕ ) τ (Γ, Γ 1 ) Φ arg u : σ Γ, y:σ τ y\φ arg Γ τ (Γ, Γ 1 ) Φ fun +Φ los +ϕ.φ arg t u : τ By indution we have that Γ, Γ 1 v arg : σ and Γ ((x i v i ) i, λy.t ) : [Γ Φ los](y:σ ϕ ) τ. By inversion, we know that the derivation for this value typing judgment is of the form Γ, Γ 1 i I, Γ, (x j :τ j ) j<i v i : τ i Γ Φ, (x i :τ ψ i i ) i I, y:σ ϕ t : τ Γ Φ, (x i :τ ψ i i ) i I, y:σ ϕ τ (x i)\(ψ i ) Γ Φ los, y:σ ϕ τ Γ, Γ 1 (dom(γ), (x i v i ) i I, λy.t ) : [Γ Φ los](y:σ ϕ ) τ From our result Γ, Γ 1 v arg and the premises Γ, (x j :τ j ) j<i v i : τ i we dedue that the appliation valuation is well-typed with respet to the appliation environment: V, V 1, (x i v i ) i, y v arg : Γ, Γ 1, (x i :τ i ), σ. It is used in the premise of the body omputation judgment, so by indution we get that Γ, Γ 1, (x i :τ i ), y:σ w : τ. From there, we wish to use preservation of value typing on the hain of value substitutions w y\v arg w (x i)\(v i ) w to onlude that Γ w : τ. However, the type substitutions of our premises are in the reverse order: Γ Φ, (x i :τ ψ i i ) i I, y:σ ϕ τ (x i)\(ψ i ) Γ Φ los, y:σ ϕ τ y\φ arg Γ Φ los +ϕ.φarg τ we therefore need to use our Reordering Lemma (1) to get them in the right order note that the annotations (Ψ i ) i I and Φ arg are not hanged as they are independent from eah other: for any i, we have Ψ i (y) = Φ arg (x i ) = 0. Γ Φ, (x i :τ ψi i ) i I, y:σ ϕ τ y\φ arg Γ Φ los, (x i :τ ψi i ) i I τ (x i)\(ψ i ) Γ Φ los +ϕ.φarg τ Finally, we reall the usual big-step semantis for the all-by-value alulus with environments, in figure 7, and state its equivalene with our utilitarian semantis.

20 Types ouverts de fermetures, et une appliation au typage des flots de données 18 Classi-Red-Var W x W (x) Classi-Red-Lam-Fix W fix f x.t (W, fix f x.t) Classi-Red-Pair W e 1 w 1 W e 2 w 2 W (e 1, e 2 ) (w 1, w 2 ) Classi-Red-Let W e 1 w 1 W, x w 1 e 2 w 2 W let x = e 1 in e 2 w 2 Classi-Red-Lam W λx.t (W, λx.t) Classi-Red-Proj W e (w 1, w 2 ) W π i (e) w i Classi-Red-App W t (W, λy.t ) W u w arg W, y w arg t w W t u w Classi-Red-App-Fix W t (W, fix f y.t ) W u w arg W, f (W, fix f y.t ), y w arg t w W t u w Figure 7: Classi big-step redution rules Due to spae restrition we will only mention the rules that differ, and elide the equivalene proof, but the long version ontains all the details. There is a lose orrespondene between judgments of both semantis, but as the value differ slightly, in the general ases the value bindings of the environment will also differ. We state the theorem only for losed terms, but the proof will proeed by indution on a stronger indution hypothesis using an equivalene between nonempty ontexts. Theorem 2 (Semanti equivalene) Our redution relation is equivalent with the lassi one on losed terms: t v holds if and only if t v also holds. To formulate our indution hypothesis, we define the equivalene judgment V v = W w; on eah side of the equal sign there is a ontext and a value, the right-hand side being onsidered in the lassial semantis. = V = W V v α = W v α V = W V = W V v = W w V, x v = W, x w V v 1 = W w 1 V v 2 = W w 2 V (v 1, v 2 ) = W (w 1, w 2 ) V, x i v i = W V ((x i v i ) i I, λx.t) = W (W, λx.t) The stronger version of the theorem beomes the following: if V = W and V t v and W t w, then V v = W w.

21 Types ouverts de fermetures, et une appliation au typage des flots de données 19 As for subjet redution, we first need to prove that value substitution preserves value equivalene. Lemma 5 (Value substitution preserves value equivalene) If V, y v 0 v = W w, V v 0 = W w 0, and v y\v 0 v then V v = W w. Subst-Value-Atom: diret. Subst-Value-Produt: diret indution. Subst-Value-Closure: We have ((x i v i ) i I, λx.t) y\v 0 (, y v 0 (x i v i ) i I, λx.t) and V, y v 0 ((x i v i ) i I, λx.t) = W (W, λx.t). The latter implies V, y v 0, x i v i = W whih whih in turn implies our goal V (, y v 0 ) with the additional premise V = W from our hypothesis V v 0 = W w 0. We an now prove the theorem proper: Red-Var, Classi-Red-Var: we hek by diret indution on the ontexts that if V = W holds, then V V (x) = W W (x). Red-Lam, Classi-Red-Lam: The orrespondene between V (, λx.t) and W (W, λx.t) under assumption V = W is diret from the inferene rule V, = W V (, λx.t) = W (W, λx.t) Red-Pair, Classi-Red-Pair and Red-Proj, Classi-Red-Proj: diret by indution. Red-Let, Classi-Red-Let: By indution hypothesis on the e 1 premise, we dedue that V v 1 = W w 1, hene V, x v 1 = W, x w 1. This lets us dedue, again by indution hypothesis, that V, x v 1 v 2 = W, x w2. As value substitution preserves value equivalene, we an dedue w 1 x\v 1 from v 2 v 2 that our goal V v 2 = W w 2 holds. Red-App, Classi-Red-App: By indution hypothesis we have that V v arg = W w arg and V ((x i v i ) i I, λy.t ) = W (W, λy.t ). By inversion on the value equivalene judgment of the latter we know that V, x i v i = W. Combined with the former value equivalene, this gives us V, x i v i, y v arg = W, y w arg, so by indution hypothesis and preservation of value equivalene by redution we an dedue our goal. 4 Dependeny information as non-interferene We an formulate our dependeny information as a non-interferene property. Two valuations V and V are Φ-equivalent, noted V = Φ V, if they agree on all variables on whih they depend aording to Φ. We say that e respets non-interferene for Φ when, whenever V e v holds, then for any V suh that V = Φ V we have that V e v also holds. This orresponds to the information-flow seurity idea that variables marked 1 are low-seurity, while variables marked 0 are high-seurity and should not influene the output result.

22 Types ouverts de fermetures, et une appliation au typage des flots de données 20 Equiv-Atom Γ v α = Φ0 v α : α Equiv-Closure i I, Γ, (x j :τ j ) j<i v i : τ i Equiv-Pair Γ v 1 = Φ0 v 1 : σ 1 Γ v 2 = Φ0 v 2 : σ 2 Γ (v 1, v 2 ) = Φ0 (v 1, v 2) : σ 1 σ 2 Γ Φ, (x i :τ ψ i i ) i I, x:σ ϕ t : τ Γ Φ, (x i :τ ψ i i ) i I, x:σ ϕ τ (x i)\(ψ i ) Γ Φ, x:σ ϕ τ i I, Ψ i Φ 0 v i = Φ0 v i Γ ((x i v i ) i I, λy.t) = Φ0 ((x i v i) i I, λy.t) : [Γ Φ ](x:σ) τ Figure 8: Value equivalene This non-interferene statement requires that the two evaluations of e return the same value v. This raises the question of what is the right notion of equality on values. Values of atomi types have a well-defined equality, but piking the right notion of equality for funtion types is more diffiult. While we an state a non-interferene result on atomi values only, the indutive subases would need to handle higher-order ases as well. Syntati equality (even modulo α-equivalene) is not the right notion of equality for losure values. Consider the following example: x:τ 0 let y = x in λz.z : [x:τ 0 ](z : σ 1 ) σ. This term ontains an ourrene of the variable x, but its result does not depend on it. However, evaluating it under two different ontexts x:v and x:v, with v v, returns distint losures: (x v, λz.z) on one hand, and (x v, λz.z) on the other. These losures are not struturally equal, but their differene is not essential sine they are indistinguishable in any ontext. Logial relations are the ommon tehnique to ignore those internal differenes and get a more observational equality on funtional values. They involve, however, a fair amount of metatheoretial effort (in partiular in presene of non-terminating fixpoints) that we would like to avoid. Consider a different example: x:τ 0 λy.x : [x:τ 1 ](y:σ 0 ) τ. Again, we ould use two ontexts x:v and x:v with v v, and we would get as a result two losures: x:v λy.x (x v, λy.x) and x:v λy.x (x v, λy.x). Interestingly, these two losures are not equivalent under all ontexts: any ontext applying the funtion will be able to observe the different results. However, our notion of interferene requires that they an be onsidered equal. This is motivated by realworld programming languages that only output a pointer to a losure in a program that returns a funtion. While the aforementioned losures are not equal in any ontext, they are in fat equivalent from the point of view of the partiular dependeny annotation for whih we study non-interferene, namely x:τ 0. To observe the differene between those losures, we would need to apply the losure of type [x:τ 1 ](y : σ) τ, so would be in the different ontext x:τ 1. This insight leads us to our formulation of value equivalene in Figure 8. Instead of being as modular and general as a logial-relation definition, we fix a global dependeny Φ 0 that restrits whih terms an be used to differentiate values. Our notion of value equivalene, Γ v = Φ0 v : σ is typed and inludes strutural equality. In the rule Equiv-Closure, we hek that the two losures values are welltyped, and only ompare aptured values whose dependenies are inluded in those of the global ontext Φ 0, as we know that the others will not be used. This equality is tailored to the need of the non-interferene result, whih only ompares values resulting from the evaluation of the same subterm in distint ontexts. Theorem 3 (Non-interferene) If Γ Φ0 e : σ holds, then for any ontexts V, V suh that V = Φ0 V and values v, v suh that V e v and V e v, we have Γ v = Φ0 v : σ. In partiular, if σ is an atomi type, then v = v holds.