Blame, coercion, and threesomes: Together again for the first time

Transcription

1 Blame, coercion, and threesomes: Together again for the first time Draft, 19 October 2014 Jeremy Siek Indiana University Peter Thiemann Universität Freiburg Phili Wadler University of Edinburgh Abstract We resent four calculi for gradual tying: λb, based on the blame calculus of Wadler and Findler (2009); λc, based on the coercion calculus of Henglein (1994); and λt and λw, based on the threesome calculi with and without blame of Siek and Wadler (2010). We define translations from λb to λc, from λc to λt, and from λt to λw. We show each of the translations is fully abstract far stronger correctness results than have reviously aeared. 1. Introduction C#, Dart, Pyret, Racket, TyeScrit, VB: many recent languages integrate dynamic and static tyes. Blame, coercions, and threesomes rovide a foundation for such integration. The blame calculus models the interaction of dynamic and static tyes; it comiles into a coercion calculus, which models how to imlement casts; it in turn comiles into the threesome calculus, which models a sace-efficient imlementation. Henglein (1994) introduced a coercion calculus to study comilation of dynamically tyed languages into statically tyed ones. Findler and Felleisen (2002) introduced the notion of higher-order contracts and blame labels to inoint the location of contract failures. Siek and Taha (2006) introduced gradual tying as a way to integrate static and dynamic tying via imlicit casts. Wadler and Findler (2009) introduced the blame calculus and the use of rogress and reservation to rove blame safety. Herman et al. (2007, 2010) exloited the coercion calculus to rovide a version of gradual tying that is sace-efficient. Siek et al. (2009) roved that the coercion calculus simulates the blame calculus. Siek and Wadler (2010) introduced threesomes, a variant of the blame calculus that is sace-efficient, and connected threesomes with the coercion calculus. Garcia (2013) observes that coercions are easier to understand while threesomes are easier to imlement, and ameliorates this tension by showing how to derive threesomes from coercions. Greenberg (2013) relates casts to sace-efficient coercions through a sequence of three calculi, CAST, NAIVE, and EFFICIENT. This aer makes the following contributions. We resent four calculi for gradual tying: The blame calculus, λb, based on Wadler and Findler (2009). A novel coercion calculus, λc, insired by Henglein (1994), Herman et al. (2007, 2010), and Greenberg (2013). Whereas revious work uses a reduction rule that combines smaller coercions into larger ones, we use a rule that decomoses larger coercions into smaller ones. Two novel threesome calculi with and without blame, λt and λw, insired by Siek and Wadler (2010) and Garcia (2013). Whereas revious work introduces threesomes as triles of tyes and later relate them to coercions, we introduce threesomes as coercions and later relate them to triles of tyes. And whereas revious work begins with threesomes without blame and later add blame, we begin with threesomes with blame and later remove blame. We resent translations from λb to λc, from λc to λt, and from λt to λw. Each translation is shown to be a bisimulation and fully abstract. The bisimulations from λb to λc and from λt to λw are lockste, in that a single ste in one calculus corresonds to a single ste in the other. The bisimulation from λc to λt is not lockste, in that a single ste in one calculus corresonds to zero or more in the other. The lockste bisimulations are novel. The bisimulation from λc to λt is similar to one relating blame and threesomes in Siek and Wadler (2010), though still the hardest roof in the aer. (The roof is resented in full in the sulementary material.) The roofs of full abstraction are novel. Previous work establishes weaker results, such as that a closed term converges iff its translation converges (that is, a contextual equivalence result restricted to the emty context). We introduce a novel translation from λc to λb, needed to show that the translation from λb to λc is fully abstract. Since a coercion may contain many blame labels but a cast has a single blame label, our translation breaks a single coercion into many casts. Justification of the translation requires a roof of several contextual equivalences in λc. We resent formulations of blame safety for λb, λc, and λt, and a roof that the translations from λb to λc and from λc to λt reserve and reflect blame safety. As a leasant consequence, the somewhat subtle definition of blame safety and subtying for λb is justified by the straightforward definition of blame safety for λc. (The roof is resented in full in the sulementary material.) Our formulation of blame safety for λb is standard, but the formulation for λc and λt is novel. Remarkably, reservation of blame safety has not reviously been considered. We introduce a novel roof technique. Often, distinct terms in λb or λc translate into the same term of λt; this rovides an easy way to establish equivalences via full abstraction. We aly the technique to validate the equations needed to justify the translation from λc to λb, and to rovide a simler roof of the Fundamental Proerty of Casts than that given in Siek and Wadler (2010).

2 The aer is organised as follows. Section 2 rovides an overview. Sections 3 6 describe the four calculi; each section resents tye safety and blame safety for its calculus, and translations to and from calculi of the receding sections. Section 7 describes and alies our novel roof technique. Section 8 surveys related work. 2. Overview This section demonstrates key features of the three calculi through a series of examles. 2.1 Blame calculus, λb The blame calculus suorts integration of dynamically and statically tyed code. Dynamically tyed code has the tye, where = K + ( ) meaning every value of dynamic tye is either of base tye K or function tye. Base tyes include integers I and Booleans B. Let f : I I be the statically-tyed increment function, (λx:i. x + 1). Here we use dynamically-tyed code in a staticallytyed context: (( λg. g 3 : = (I I) I) f) B 4 We write B to indicate the first term reduces to the second. Here embeds a dynamically-tyed term in the blame calculus, and A = B is a cast from a source tye A to a target tye B toed by a blame label. We let, q range over blame labels. Each blame label has a comlement. Comlement is involutive, =. Our notation is chosen for clarity, not comactness: a ractical language might infer the source or target tye of a cast, or even an entire cast. Blame labels are used to reort the location of a cast failure. Here is our code with integer 3 relaced by Boolean t: (( λg. g t : = (I I) I) f) B blame It returns blame, indicating that the cast labeled failed, and, further, that blame is allocated to the term contained in the cast we call this ositive blame. We may also use statically-tyed code in a dynamically-tyed context: (let g = (f : I I = ) in g 3 ) B 4 Here is our code with integer 3 relaced by Boolean t: (let g = (f : I I = ) in g t ) B blame It returns blame (note the comlement!), indicating that the cast labeled failed, and, further, that blame is allocated to the context containing the cast we call this negative blame. Dynamically tyed rograms can themselves be described as terms in the blame calculus. For instance λg. g 3 abbreviates (λg:. (g : 1 = ) (3 : I 2 = )) : 3 = A fresh blame label is introduced for each cast. Blame safety lets us characterise under what circumstances a cast may roduce ositive or negative blame. In articular, we show that a cast from dynamic tye only allocates ositive blame; and that a cast to dynamic tye only allocates negative blame. Hence, if a cast fails, it allocates blame to the dynamically tyed side Well-tyed rograms can t be blamed. Details of the blame calculus λb aear in Section Coercion calculus, λc The blame calculus comiles into a coercion calculus based on Henglein (1994). For examle, the cast comiles to the coercion while the cast = (I I) I ( )? ; (((I? I!) ; ( )!) I? ) comiles to the coercion I I = (I? I!) ; ( )!. Here coercions I! and ( )! are injections into the dynamic tye; coercions I? and ( )? are rojections from the dynamic tye; arrow ( ) coerces functions; and semicolon (;) comoses coercions we discuss the details later. For now, observe that our first cast, which can be allocated ositive blame but not negative, comiles to a coercion that contains but not, while our second cast, which can be allocated negative blame but not ositive, comiles to a coercion that contains but not. Safety for λb deends on a somewhat subtle definition of ositive and negative subtying, <: + and <:. In contrast, safety for λc has a leasingly simle definition: a coercion is safe for if it does not contain label. Consider a cast from A to B with label ; then A <: + B if and only if the cast comiles to a coercion not containing ; and A <: B if and only if the cast comiles to a coercion not containing. The forward direction of this imlication is only to be exected, but the backward direction is a surrise, and a leasant one: the somewhat subtle definition of <: + and <: in λb is justified by the corresondence to λc. The key to sace efficiency is to consolidate coercions. Hence, Herman et al. (2007, 2010) and Greenberg (2013) use the reduction rule M c d M c ; d (COMPOSE) where M c alies to term M the coercion c, and c ; d comoses coercion c followed by coercion d. Henglein (1994) only states (COMPOSE) as an equation and does not orient it as a reduction at all. In contrast, our calculus uses the reduction rule M c ; d M c d (DECOMPOSE) Remarkably, our coercion calculus is the first to orient the reduction in this direction. The benefit is a tight connection between λb and λc: the translation between the two is a lockste bisimulation, and many roofs are simlified. Details of the coercion calculus λc aear in Section Threesome calculus, λt and λw A naive imlementation of the blame or coercion calculus suffers sace leaks. For instance, two mutually recursive rocedures where the recursive calls are in tail osition should run in constant sace; but if one of them is statically tyed and the other is dynamically tyed, the mediating casts break the tail call roerty, and the rogram requires sace roortional to the number of calls. This roblem was observed by Herman et al. (2007, 2010), who roose a solution based on the coercion calculus. If two coercions are alied in sequence then they are comosed and normalised. Normalising a comosition of two coercions yields a coercion whose height is the maximum of the heights of the two original coercions, ensuring that comutation can roceed in bounded sace. However, normalising coercions requires that sequences of comositions are treated as equal u to associativity. While this is not a difficult roblem in symbol maniulation, it does ose a challenge in the context of imlementing an efficient evaluator.

3 Siek and Wadler (2010) roosed a variant of this solution, observing that any sequence of casts A = C 1 = = C n = B always comresses to an equivalent sequence of two casts A = C = B called a threesome here we ignore blame labels, so these are threesomes without blame. The mediating tye C is comuted as a greatest lower bound of the tyes A, C 1,..., C n, B. Threesomes, like coercions, enable any sequence of casts to be reresented in bounded sace. Comuting the greatest lower bound of two tyes yields a tye whose height is the maximum of the heights of the two original tyes, again ensuring that comutation can roceed in bounded sace. Blame is restored by decorating the mediating tye with labels that indicate how blame is to be allocated. Siek and Wadler (2010) demonstrate that the decorated tyes are in one-to-one corresondence with normalised coercions. However, the notation for decorated tyes is far from transarent. The simlest way to validate that comosition of threesomes is correctly defined is to convert the threesomes to coercions, normalise the comosition of the coercions, and convert the result back to a threesome. In contrast, the correctness of our comosition oerator can be read off directly from the reduction rules introduced by Henglein (1994). Siek and Wadler (2010) introduce threesomes as a trile of tyes, and later give the corresondence with coercions. They begin with threesomes without blame, and later add labeled tyes to reresent blame. In contrast, here we introduce threesomes as coercions, and later give the corresondence with triles of tyes. We begin with threesomes with blame, and later simlify them to eliminate blame. Details of the threesome calculi λt and λw aear in Sections 5 and Blame calculus Figure 1 defines the blame calculus, λb. Similar results aear in Wadler and Findler (2009), Siek and Wadler (2010), and Ahmed et al. (2011). Let A, B, C range over tyes. A tye is either a base tye K, a function tye A B, or the dynamic tye. Let G, H range over ground tyes. A ground tye is either a base tye K or the function tye. The dynamic tye satisfies the domain equation = K + ( ) so each value of dynamic tye belongs to one ground tye. Tyes A and B are comatible if either is the dynamic tye, if they are both the same base tye, or they are both function tyes with comatible domains and ranges. Every tye is either the dynamic tye or comatible with a unique ground tye. Two ground tyes are comatible if and only if they are equal. Lemma 1 (Grounding). 1. If A, there is a unique G such that A G. 2. G H iff G = H. Incomatibility is the source of all blame: casting a tye into the dynamic tye and then casting out at an incomatible tye allocates blame to the second cast. Let, q range over blame labels. To indicate on which side of a cast blame lays, each blame label has a comlement. Comlement is involutive, =. Let L, M, N range over terms. Terms are those of the simlytyed lambda calculus, lus blame and casts. Tye judgments take the form Γ B M : A, where Γ is a tye environment airing variables with tyes. Each oerator o on base tyes is secified by a total meaning function [[o]] that reserves tyes: if o : K K and k : K, then [[o]]( k) = k with k : K. The tying rules for constants, oerators, variables, abstraction, and alication are standard (and not reeated in subsequent figures). Tying, reduction, and safety judgments are written with subscrits indicating to which calculus they belong, excet we omit subscrits in figures to avoid clutter. The tying rule for casts is straightforward: Γ B M A B Γ B (M : A = B) : B If term M has tye A and tyes A and B are comatible then the cast of M from tye A to tye B is a term of tye B. The cast is decorated with a blame label. If a cast from A to B decorated with allocates blame to we say it has ositive blame, meaning the fault lies with the term contained in the cast; and if it allocates blame to we say it has negative blame, meaning the fault lies with the context containing the cast. We abbreviate a air of casts (M : A = B) : B q = C as M : A = B q = C. Let V, W range over values. A value is a constant, a lambda term, a cast between values of function tye, or a cast of a value from ground tye to dynamic tye. Let E range over evaluation contexts, which are standard, and include casts in the obvious way. We write M B N to indicate that term M stes to term N. We write B for the reflexive and transitive closure of B. Rules (BETA), (DELTA) are standard (and not reeated in subsequent figures). Rule (BASE): a cast from a base tye to itself leaves the value unchanged. Rule (WRAP): a cast of a function alied to a value reduces to a term that casts on the domain, alies the function, and casts on the range; to allocate blame correctly, the blame label on the cast of the domain is comlemented, corresonding to the fact that function tyes are contravariant in the domain and covariant in the range (Findler and Felleisen 2002; Wadler and Findler 2009). Rule (STAR): a cast from tye to itself leaves the value unchanged. Rule (INJECT): If A is not the dynamic tye or a ground tye, a cast from tye A to tye factors into a cast from A to G followed by a cast from G to, where G is the unique ground tye that is comatible with A. Rule (PROJECT): If A is not the dynamic tye or a ground tye, a cast from tye to tye A factors into a cast from to G followed by a cast from G to A, where G is the unique ground tye that is comatible with A. Rule (COLLAPSE): A cast from a ground tye G to tye and back to the same ground tye G leaves the value unchanged. Rule (CONFLICT): a cast from a ground tye G to tye and back to an incomatible ground tye H allocates blame to the label of the outer cast. (Why the outer cast? This choice traces back to Findler and Felleisen (2002), and reflects the idea that we always hold an injection from ground tye to dynamic tye blameless, but may allocate blame to a rojection from dynamic tye to ground tye.) We write rule (INJECT) as follows. E[V : A = ] E[V : A = G = ] if A, A G, A G A base tye never satisfies the condition (there is no A such that A, A K, A K), so in our case G must be the function tye, and the rule is equivalent to the following. E[V : A B = ] E[V : A B = = ] if A B The first rule is more comact, and adats if we ermit other ground tyes, such as roduct. Similarly for rule (PROJECT).

4 Syntax Variables x, y Constants k ::= 0 1 t f Oerators o ::= + Base tyes K ::= I B Blame labels, q Tyes A, B, C ::= K A B Ground tyes G, H ::= K Tye environment Γ ::= Γ, x : A Comatible Term tying Terms L, M, N ::= k o( M) x λx:a. N L M M : A = B blame Values V, W ::= k λx:a. N V : A B = A B V : G = Evaluation context E ::= E[o( V,, M)] E[ M] E[V ] E[ : A = B] K K A A B B A B A B A B A B Γ B M : A k : K Γ k : K Reduction Γ M : K o : K K Γ o( M ) : K x : A Γ Γ x : A Γ, x : A N : B Γ λx:a. N : A B Γ M : A A B Γ (M : A = B) : B Γ blame : A Γ L : A B Γ M : A Γ L M : B M B N E[(V : A B E[o( V )] E[[[o]]( V )] E[(λx:A. N) V ] E[N[x:=V ]] E[K : K (DELTA) (BETA) = K] E[V ] (BASE) = A B ) W ] E[(V (W : A = A)) : B = B ] (WRAP) E[V : G E[V : G E[V : E[V : A E[V : = ] E[V ] (STAR) = ] E[V : A = G = ] if A, A G, A G (INJECT) = A] E[V : = G = A] if A, A G, A G (PROJECT) = = q G] E[V ] (COLLAPSE) = = q H] blame q if G H (CONFLICT) Figure 1. Blame calculus (λb) Every well-tyed term not containing blame has a unique tye: if Γ M : A and Γ M : A and M does not contain a term of the form blame, then A = A. Embedding M takes terms of dynamically-tyed lambda calculus into the blame calculus. The embedding introduces a fresh label for each cast. k = k : K = if k : K o( M ) = o( M : = K) : K = if o : K K x = x λx. M = (λx:. M ) : = M N = ( M : = ) N Tye safety is established via reservation and rogress. Proosition 2 (Tye safety for blame calculus). 1. If B M : A and M B N then B N : A. 2. If B M : A then either (a) there exists a value V such that M = V, or (b) there exists a label such that M = blame, or (c) there exists a term N such that M B N. The same result will aly, mutatis mutandis, for λc, λt, and λw. Preservation and rogress for the blame calculus do not rule out blame as a result. How to guarantee that blame cannot arise in certain circumstances is the subject of the next section. 3.1 Blame safety Figure 2 resents four different subtying relations and defines safety for the blame calculus. Why do we need four different subtying relations? Each has a different urose. Relation A <: B characterizes when a cast A = B never yields blame; relations A <: + B and A <: B characterize when a cast A = B cannot yield ositive or negative blame, resectively; and relation A <: n B characterizes when tye A is more recise than tye B. All four relations are reflexive and transitive, and subtying, ositive subtying, and naive subtying are antisymmetric. The first three subtying rules are characterised by contravariance. A cast from a base tye to itself never yields blame (as er (BASE)). A cast from a function tye to a function tye never yields ositive blame if the cast of the arguments never yields negative blame and if the cast of the results never yields ositive blame; and ditto with ositive and negative reversed; as with casts, each rule is

5 Subtye K <: K Positive subtye K <: + K Negative subtye K <: K Naive subtye K <: n K A <: A B <: B A B <: A B A <: A B <: + B A B <: + A B A <: + A B <: B A B <: A B A <: G A <: A <: n A B <: n B A B <: n A B A <: G A <: A <: B A <: + B A <: + A <: B <: B A <: n B A <: n Safe cast (A = B) safe B q A <: + B (A = B) safe q (A q = B) safe A <: B (A = B) safe q Figure 2. Subtying and blame safety contravariant in the function domain and covariant in the function range (as er (WRAP)). A cast from ground tye to dynamic tye never yields blame (as er (COLLAPSE) and (CONFLICT)). A cast to the dynamic tye never yields ositive blame, while a cast from the dynamic tye never yields negative blame. Naive subtying is characterised by covariance. A base tye is as recise as itself, recision of function tyes is covariant in both the domain and range of functions, and the dynamic tye is the least recise tye. These four relations are closely connected: ordinary subtying decomoses into ositive and negative subtying, which can be reassembled to yield naive subtying, almost like a tangram. Lemma 3 (Tangram). 1. A <: B iff A <: + B and A <: B. 2. A <: n B iff A <: + B and B <: A. A cast from A to B decorated with is safe for blame q, written (A = B) safe B q if evaluation of the cast can never yield blame q. The three rules reflect that if A <: + B the cast never allocates ositive blame, if A <: B the cast never allocates negative blame, and a cast with label never allocates blame other than to or. Safety extends to terms in the obvious way: we write M safe B q if every cast in M is safe for q. Blame safety is established via a variant of reservation and rogress. Proosition 4 (Blame safety for the blame calculus). 1. If M safe B and M B N then N safe B. 2. If M safe B then M B blame. The same result will aly, mutatis mutandis, for λc and λt. 3.2 Failing cast The following lemma about failing casts is useful when considering the relation between casts and coercions. Lemma 5 (Failing cast). If A, A G, and G H, then V : A 1 = G 2 = 3 = H 4 = B blame Contextual equivalence Contextual equivalence is defined as usual. Evaluating a term may have three outcomes: converge, allocate blame to, or diverge. Two terms are contextually equivalent if they have the same outcome in any context. Let C range over contexts, which are exressions with holes in any osition. Write M B if M diverges; coinductively, M B if M B N and N B. Definition 6 (Contextual equivalence). Two terms are contextually equivalent, written M ctx = B N, if for any context C, either 1. both converge to a value, C[M] B V and C[N] B W for some values V and W. 2. both allocate blame to the same label, C[M] B blame and C[N] B blame for some label, or 3. both diverge, C[M] B and C[N] B. The same definition will aly, mutatis mutandis, for λc, λt, and λw. 4. Coercion calculus Figure 3 defines the coercion calculus, λc. The coercions of this calculus corresond to those of Henglein (1994), excet that the coercion from dynamic tye to ground tye is decorated with a blame label, as in Siek and Wadler (2010). Blame labels and tyes are as in λb. Let c, d range over coercions. We write c : A = B to indicate that c coerces values of tye A to tye B. The identity coercion at tye A is written id A. The injection from ground tye G to dynamic tye is written G!, and rojection from dynamic tye to ground tye G is written G?. The latter is decorated with a label, to which blame is allocated if the rojection fails. A function coercion c d coerces a function A B to a function A B, where c coerces A to A, and d coerces B to B. This construct is contravariant in the domain coercion c and covariant in the range coercion d. The comosition c ; d coerces A to C, where c coerces A to B, and d coerces B to C. The fail coercion GH reresents the result of a failed coercion from ground tye G to ground tye H, and is introduced because it is essential to the sace-efficient reresentation described in the following section. Terms of the calculus are as before, excet that we relace casts by alication of a coercion, written M c. The tying rule for coercion alication is straightforward: Γ C M : A c : A = B Γ C M c : B If term M has tye A, and c coerces A to B, then alication to M of c is a term of tye B. Every well-tyed coercion not containing failure has a unique tye: if c : A = B and c : A = B and c does not contain a coercion of the form GH then A = A and B = B. The converse is false: for instance id and G? ; G! both have tye =. Values and evaluation contexts are as in the blame calculus, excet that casts are relaced by corresonding coercions. We write M C N to indicate that term M stes to term N. Rule (ID): the identity coercion leaves a value unchanged. Rule (WRAP): a

6 Syntax c, d ::= id A G! G? c d c ; d GH L, M, N ::= k o( M) x λx:a. N L M M c blame V, W ::= k λx:a. N V c d V G! E ::= E[o( V,, M)] E[ M] E[V ] E[ c ] Coercion tying Term tying Reduction id A : A = A G! : G = G? : = G c : A = A d : B = B (c d) : A B = A B c : A = B d : B = C (c ; d) : A = C A A G G H GH : A = B Γ M : A c : A = B Γ M c : B E[V id A ] E[V ] E[(V c d ) W ] E[(V (W c )) d ] E[V G! G? ] E[V ] c : A = B Γ blame : A Γ C M : A M C N (ID) (WRAP) (COLLAPSE) E[V G! H? ] blame if G H (CONFLICT) Safe coercion E[V c ; d ] E[V c d ] E[V GH ] blame id A safe q c safe q d safe q c d safe q (DECOMPOSE) (FAIL) c safe C q q G! safe q G? safe q c safe q d safe q q c ; d safe q GH safe q Figure 3. Coercion calculus (λc) coercion of a function alied to a value reduces to a term that coerces on the domain, alies the function, and coerces on the range. Rule (COLLAPSE): if an injection meets a matching rojection, the coercion leaves the value unchanged. Rule (CONFLICT): if an injection meets an incomatible rojection, the coercion fails and allocates blame to the label in the rojection. (Here it is clear why blame falls on the outer coercion: the inner coercion is an injection and has no blame label, while the outer is a rojection with a blame label.) Rule (DECOMPOSE): alication of a comosed coercion alies each of the coercions in turn. A coercion c is safe for blame label q, written c safe C q, if alication of the coercion never allocates blame to q. The definition is leasingly simle: a coercion is safe for q if it does not mention label q. Tye and blame safety and contextual equivalence for λc are as in λb. Proositions 2 and 4 and Definition 6 aly mutatis mutandis. 4.1 Translation from blame to coercions The relation between λb and λc is resented in Figure 4. In this section, we let M, N range over terms of λb and M, N range over terms of λc. We write A = B BC = c to indicate that the cast on the left translates to the coercion on the right. The translation is carefully designed to ensure there is a lockste bisimulation between λb and λc. The translation extends to terms in the obvious way, relacing each cast by the corresonding coercion. We write c CB = Z to indicate that the coercion on the left translates to the sequence of casts on the right. Here Z ranges over sequences of casts. As defined in Figure 4, we write Z B (resectively B Z) to relace in Z each source or target tye A by A B (resectively B A), we write Z to reverse the sequence Z and comlement all the blame labels, and we write Z ++ Z to concatenate the two sequences Z and Z, where the last tye of one sequence must match the first of the other. In the clause for c d, the right-hand side can be taken as either ( c CB B) ++ (A d CB ) or (A d CB ) ++ ( c CB B ), equivalently. We write as a blame label in casts where the label is irrelevant because the cast cannot allocate blame. The translation extends to terms in the obvious way, relacing each coercion by the corresonding sequence of casts. As a first ste justifying this definition, we observe several contextual equivalences for λc. Lemma 7 (Equivalences). The following hold in λc. 1. M id ctx = C M 2. M c ; d ctx = C M c d 3. M c d ctx = C M (c id) ; (id d) 4. M c d ctx = C M (id c) ; (d id) The roof of this lemma is deferred to Section 7.1, where we aly a new technique that makes the roof straightforward. Translating from λc to λb and back again is the identity, u to contextual equivalence. Lemma 8 (Coercions to blame). If M is a term of λc then M CB BC ctx = C M. Proof. By induction on M, using case analysis of the clauses in the definition of CB. In articular, the clause for id is justified by art 1 of Lemma 7, the clause for c ; d is justified by art 2 of the same lemma, the clause for c d is justified by art 3 of the same lemma, and the alternative definition for the clause is justified by art 4. The clause for GH is justified by Lemma Preservation of blame safety The somewhat subtle definition of ositive and negative subtying is justified by the corresondence to the coercion calculus. It is not too surrising that the definition is sound (safety in B imlies safety in C), but it is surrising that the definition is also comlete (safety in C imlies safety in B). Lemma 9 (Positive and negative subtying). 1. A <: + B iff A = B BC safe C. 2. A <: B iff A = B BC safe C.

7 Blame to coercion (λb to λc) A = B BC = c K = K BC = id K A B = A B BC = BC = id G = BC = G! = A = A BC B = B BC A = BC = A = G BC ; G! if A, A G, A G = G BC = G? = A BC = G? ; G = A BC if A, A G, A G Coercion to blame (λc to λb) id A CB = [ ] G! CB = [G G? CB = [ = ] = G] c d CB = ( c CB B) ++ (A d CB ) c ; d CB = c CB ++ d CB c CB = Z where c d : A B = A B GH A= B CB = [A = G, G =, = H, H = B] where if then Z = [A 1 m 1 = A2,, A m = A m+1] Z m+1 m+n = [A m+1 = A m+2,, A m+n = A m+n+1] Z B = [A 1 B 1 = A 2 B,, A m B = m A m+1 B] B Z = [B A 1 m 1 = B A2,, B A m = B A m+1] Z = [A m+1 m = A m,, A 1 2 = A1] Z ++ Z = [A 1 m+n 1 = A2,, A m+n = A m+n+1] Figure 4. Relating blame and coercions (λb and λc) (The full roof is in the sulementary material.) It follows immediately that the translation from λb to λc reserves tye and blame safety. Proosition 10 (Preservation, blame to coercions). 1. If Γ B M : A then Γ C M BC : A. 2. If M safe B then M BC safe C. 4.3 Bisimulation The translation from λb to λc is a bisimulation. Proosition 11 (Bisimulation, blame to coercions). Assume B M : A and C M : A and M BC = M. 1. If M B N then M C N and N BC = N for some N. 2. If M C N then M B N and N BC = N for some N. 3. If M = V then M = V and V BC = V for some V. 4. If M = V then M = V and V BC = V for some V. 5. If M = blame then M = blame. 6. If M = blame then M = blame. The bisimulation is lockste, in that a single ste in λb corresonds to a single ste in λc, and vice versa. 4.4 Fully abstract The translation from λb to λc is fully abstract. Proosition 12 (Fully abstract, blame to coercions). If M and N are terms of λb then M ctx = B N iff M BC ctx = C N BC. Proof. In the backward direction, the result follows from Proosition 11, clauses 2, 4, and 6, translating each λb context C to the λc context C BC. In the forward direction, the result follows from Proosition 11, clauses 1, 3, and 5, alying Lemma 8 to ensure that each context C in λc corresonds to a context C in λb. 5. Threesome calculus Figure 5 defines the threesome calculus, λt. Threesomes corresond to coercions in a newly identified canonical form, which we call threesome coercions. Threesomes are introduced by Siek and Wadler (2010), and their relation to coercions is discussed there and by Garcia (2013). In threesomes without blame a threesome consists of three tyes: source tye, mediating tye, and target tye. In threesomes with blame, the mediating tye is decorated with blame labels, and the corresondence with coercions is secified by a translation. Here threesomes are resented as coercions in canonical form, and the corresondence with threesomes without blame is secified by a translation (given in the next section). Blame labels and tyes are as in λb. Threesome coercions follow a secific, three-art grammar to ensure that they are canonical in the sense that there is one threesome coercion for each equivalence class of coercions with resect to the equational theory of Henglein (1994). Threesome coercions can be seen as an adatation of Henglein s canonical coercions to facilitate the definition of a recursive normalization function. Let s, t range over threesome coercions, i range over suffix coercions, and g, h range over ground coercions. Threesome coercions are either the identity coercion at dynamic tye id, a rojection followed by a suffix coercion (G? ; i), or just a suffix coercion i. A suffix coercion is either a ground coercion followed by an injection (g ; G!), just a ground coercion g, or the failure coercion GH. A ground coercion is an identity coercion of base tye id K or a function coercion s t. The source of a suffix coercion is never the dynamic tye. The source and target of a ground coercion are never the dynamic tye, and both are always comatible with the same unique ground tye. Lemma 13 (Source and Target). 1. If i : A = B then A. 2. If g : A = B then A and B and there exists a unique G such that A G and G B. Terms of the calculus are as in λc, excet that we restrict coercions to threesome coercions. The key idea of the dynamics, as in Herman et al. (2007, 2010) and Siek and Wadler (2010), is to combine and normalize adjacent coercions, which ensures sace efficiency. Ensuring adjacent coercions are combined requires we adjust the notion of value and evaluation context. Let U range over uncoerced values and V, W range over values, where an uncoerced value contains no to-level coercion and a value at most one. Let F range over cast-free contexts and E range over contexts, where the innermost term of a cast-free context is not a cast. Reduction of a term that is a cast must occur in a cast-free context. These adjustments ensure that if a term contains two casts in succession in an evaluation context, that those

8 Syntax r, s, t ::= id (G? ; i) i i ::= (g ; G!) g GH g, h ::= id K s t L, M, N ::= k o( M) x λx:a. N L M M t blame U ::= k λx:a. N V, W ::= U U s t U g ; G! F ::= E[o( V,, M)] E[ M] E[V ] E ::= F F[ t ] Threesome comosition Reduction id K id K = id K (s t) (s t ) = (s s) (t t ) id t = t (g ; G!) id = g ; G! (G? ; i) t = G? ; (i t) g (h ; H!) = (g h) ; H! (g ; G!) (G? ; i) = g i (g ; G!) (H? ; i) = GH if G H GH s = GH g GH = GH E[(U s t ) V ] E[(U (V s )) t ] F[U id K ] F[U] F[U id ] F[U] F[M s t ] F[M s t ] F[U GH ] blame Figure 5. Threesome calculus (λt) s t = r M T N (WRAP) (BASE) (STAR) (COMPOSE) (FAIL) casts are reduced by rule (COMPOSE) before other reductions occur. The other reduction rules are straightforward. Comosition and normalization of threesome coercions is comuted by. If threesomes s and t are equivalent to coercions c and d, then the threesome s t is equivalent to the coercion c ; d. The grammar of threesome coercions makes the definition of threesome comosition easy to exress. In fact, it is a structurally recursive function, so termination is immediate. Further the correctness of each equation in the definition is easily justified by the equational theory of Henglein (1994). Tye and blame safety and contextual equivalence for λc are as in λb. The definition of blame safety is as in Figure 3, and Proositions 2 and 4 and Definition 6 aly mutatis mutandis. 5.1 Translation from coercions to threesomes The translation from λc to λt is resented in Figure 6. In this section, we let M, N range over terms of λc and let M, N range over terms of λt. We write c CT = t to indicate that the coercion on the left translates to the threesome coercion on the right. The translation extends to terms in the obvious way, relacing each coercions by the corresonding threesome coercion. The translation from λc to λt reserves tye and blame safety. Proosition 14 (Preservation, coercions to threesomes). 1. If Γ C M : A then Γ T M CT : A. 2. If M safe C then M CT safe T. The dynamics of the threesome calculus differ significantly from that of the other two calculi because λt comresses sequences of casts into a single threesome. We define a bisimulation that relates the coercion calculus and the threesome calculus. The rules relate a sequence of zero or more coercion alications to a single threesome alication. For examle, consider the sequence of (WRAP) reductions in λc. (V c 1 d 1 c 2 d 2 c 3 d 3 ) W (1) C ((V c 1 d 1 c 2 d 2 ) (W c 3 )) d 3 (2) C ((V c 1 d 1 ) (W c 3 c 2 )) d 2 d 3 (3) C (V (W c 3 c 2 c 1 )) d 1 d 2 d 3 (4) If V V, W W, c i CT = s i, and d i CT = t i, this relates to a single (WRAP) reduction in λt. (V (s 3 s 2 s 1) (t 1 t 2 t 3) ) W (1 ) T (V (W s 3 s 2 s 1 ) t 1 t 2 t 3 (2 ) Here (1) (1 ) via one use of rule (ID) and three uses of rule (MANY); and (2) (1 ) via one use of rule (ID), two uses of rule (MANY), and one use of rule (MANYAPP); and (3) (1 ) via one use of rule (ID), one use of rule (MANY), and two uses of rule (MANYAPP); and (4) (2 ) via one use of rule (ID) and three uses of rule (MANY) again, for both the domain and the range. Terms translated from coercions to threesomes are related by. Proosition 15. M M CT. The relation is a bisimulation. Proosition 16 (Bisimulation, coercions to threesomes). Assume C M : A and T M : A and M CT = M. 1. If M C N then M T N and N N for some N. 2. If M T N then M C N and N N for some N. 3. If M = V then M T V and V V for some V. 4. If M = V then M C V and V V for some V. 5. If M = blame then M = blame. 6. If M = blame then M = blame. The bisimulation is not lockste: a single ste in λc corresonds to zero or more stes in λt, and vice versa. (The full roof is in the sulementary material.) 5.2 Fully abstract The translation from λc to λt is fully abstract. Proosition 17 (Fully abstract, coercions to threesomes). If M and N are terms of λc then M ctx = C N iff M CT ctx = T N CT. Proof. In the backward direction, the result follows immediately from Proosition 16, clauses 2, 4, and 6, translating each λc context C to the λt context C CT. In the forward direction, the result follows from Proosition 16, clauses 1, 3, and 5, utilising the fact that each λt context C is also a λc context.

9 Coercions to threesomes (λc to λt) id CT = id id K CT = id K id A B CT = id A CT id B CT G? CT = G? ; id G CT G! CT = id G CT ; G! c d CT = c CT d CT c ; d CT = c CT d CT GH CT = GH c CT = t Bisimulation between λc and λt M CT M k k M M o( M) o( M ) x x M M L L M M λx:a. M λx:a. M L M L M blame blame M M M : A id A CT = s M M s M M s M (L r ) (M s ) c CT = t M c M s t d CT = t M d (L r (s t) ) M (ID) (MANY) (MANYAPP) Figure 6. Relating coercions to threesomes (λc and λt) 6. Threesomes without blame Siek and Wadler (2010) use a different develoment than the one given here. They first introduce threesomes as a air of casts, from a source tye through a mediating tye to a target tye the three tyes exlaining for the name. This form does not account for blame, which they restore by decorating the mediating cast with blame labels. In contrast, here coercions directly insired threesome coercions. We now recover the three tyes, at the exense of no longer accounting for blame. To account for the case where the source and target tye are incomatible, threesomes require introducing a new tye, which is the lowest tye in the naive ordering. Siek and Wadler (2010) ermits every tye to include, where here we offer a more refined develoment where aears only in the mediating tye. We let R, S, T range over threesome tyes, which consist of the usual tye constructors together with. Every ordinary tye is a threesome tye, but not conversely (because of ). A threesome coercions is written M : A = T B where M is a term, A and B are ordinary tyes, and T is a threesome tye that is bounded above by A and B. Threesome tyes S and T are shallowly incomatible, written S # T, if they are different base tyes, if one is a base tye and the other is a function, or if one is the emty tye. The meet of two tye S and T is written S & T and defined in Figure 7. It is the greatest lower bound with regard to naive subtying. Lemma 18 (Meet is greatest lower bound). 1. S & T <: n S and S & T <: n T, and 2. R <: n S and R <: n T iff R <: n S & T. Proof. Induction on the structure of S and T. The reduction rules for threesomes without blame are identical to those for threesomes, save that comosition of threesome coercions (s t) is relaced by meet of threesome tyes (S & T ). Tye safety and contextual equivalence for λw are as in λb. Proosition 2 and Definition 6 aly mutatis mutandis. Blame safety is not relevant for λw, because there are no blame labels. 6.1 Translation from threesomes with blame to those without Ignoring blame labels, a threesome coercion is determined by its source, target, and mediating tyes. The mediating tye of a threesome t is written t, and defined in Figure 7. Write t for the result of relacing each blame label in t by, where is a secial blame label satisfying =. Write BT = BC CT to translate from λb to λt via λc. Lemma 19 (Mediating tye). If t : A = B and t = T then T <: n A and T <: n B and t = A Proof. Induction on t. = T BT T = B BT. The corresondence between comosition of threesome coercions and meet of threesome tyes is straightforward. Lemma 20 (Comosition and meet). If s and t are threesome coercions, then Proof. Induction on s and t. s t = s & t The above results suggest a simle translation. If t is a threesome coercion, t : A = B, and t = T, define t TW = A T = B. The translation extends to terms in the obvious way, relacing each threesome coercion by the corresonding threesome cast, and relacing blame by wrong. Preservation of tye safety for the translation of λt to λw is straightforward, and omitted. Since blame safety is not relevant for λw, neither is reservation of blame safety. 6.2 Bisimulation The translation from λt to λw is a bisimulation. Proosition 21 (Bisimulation, threesomes without blame). Assume T M : A and W M : A and M TW = M. 1. If M T N then M W N and N TW = N for some N. 2. If M W N then M T N and N TW = N for some N. 3. If M = V then M = V and V TW = V for some V. 4. If M = V then M = V and V TW = V for some V. 5. If M = blame then M = wrong. 6. If M = wrong then M = blame for some. The bisimulation is lockste, in that a single ste in λt corresonds to a single ste in λw, and vice versa. Proof. Follows immediately from Lemmas 19 and 20.

10 Syntax R, S, T ::= K S T L, M, N ::= x k o( M) λx:a. N L M M : A T = B wrong V, W ::= U U : A B S T = A B U : A T = Naive subtye E ::= F F[ : A K <: n K Term tying T <: n T = B] S <: n S T <: n T S S <: n T T Γ M : A T <: n A T <: n B Γ M : A Shallow incomatibility T = B S <: n T <: n T Γ W M : A Γ wrong : A S # T K K K # K K # S T S T # K # T T # Meet Reduction K & K = K & T = T T & = T (S T ) & (S T ) = (S & S ) (T & T ) S & T = E[(U : A B S T = A B ) V ] F[M : A E[(U (V : A F[U : K F[U : S & T = R if S # T M W N = S A)) : B = T B ] (WRAP) K = K] F[U] (BASE) = ] F[U] (STAR) = S B = T C] F[M : A S&T = C] (COMPOSE) F[U : A 6.3 Fully abstract = B] wrong (FAIL) Figure 7. Threesomes without blame (λw) The translation from λt to λw is fully abstract. Proosition 22 (Fully abstract, threesomes without blame). If M and N are terms of λt then M ctx = T N iff M TW ctx = W N TW. Proof. In the backward direction, the result follows from Proosition 21, clauses 2, 4, and 6, translating each λt context C to the λw context C TW. In the forward direction, the result follows from Proosition 21, clauses 1, 3, and 5, utilising the fact that TW is a bijection to ensure that each context C in λw corresonds to a context C in λt. The develoment in this section is straightforward. Lemmas 19 and 20 are established by easy inductions, and Proositions 21 and 22 are straightforward. In contrast, the weaker correctness result of Siek and Wadler (2010) deends on the Fundamental Proerty of Casts. Establishing the Fundamental Proerty required a new bisimulation relation and three lemmas, and then establishing the weak correctness result requires a corollary and three further lemmas. The roof techniques we use here are simler and yield stronger results. Although we don t require it here, the Fundamental Proerty of Casts has indeendent interest, and we show in the next section that it follows easily from the results we have already established. 7. Alications The fact that the translations reflect contextual equivalences gives a owerful roof technique. In this section, we demonstrate the ower of this technique by demonstrating two useful results, Lemma 7 from Section 4.1, which justifies the translation CB, and the Fundamental Law of Casts from Siek and Wadler (2010). 7.1 Lemma 7 Lemma 7 from Section 4.1 is used to justify the design of CB, the maing from λc back to λb. We reeat the lemma here, with some additional clauses. Lemma 23 (Equivalences). The following hold in λc. 1. M id ctx = C M 2. M c ; d ctx = C M c d 3. M c ; id ctx = C M c ctx = C M id ; c 4. M (c d) ; (c d ) ctx = C M (c ; c) (d ; d ) 5. M c d ctx = C M (c id) ; (id d) 6. M c d ctx = C M (id c) ; (d id) Proof. Part 1 follows from the definition of contextual equivalence: either M C V and M id C V, or M blame and M id C blame, or M C and M id C. Part 2 follows similarly, and art 3 follows from arts 1 and 2. Part 4 is more interesting. Let c CT = s, d CT = t, c CT = s and d CT = t. Alying CT to each side of the equation gives (s t) (s t ) ctx = T (s s) (t t ) which holds immediately from the definition of. Then art 4 follows because CT reflects contextual equivalence, the backward art of Proosition 17. Part 5 follows from c d ctx = C (id ; c) (id ; d) ctx = C (c id) ; (id d) which follows from art 3 and art 4, resectively. Part 6 is shown similarly to art 5. Tyically, one might be temted to rove a result such as Lemma 7 by introducing a custom bisimulation relation for the urose indeed, that is the first way we attemted to demonstrate it. Eventually we realised that this was not required, and that we could exloit the technique of showing terms equivalent in λc by maing them into λt and exloiting the backward half of the full abstraction result, Proosition 17. Instead of introducing a new bisimulation relation, all of the heavy lifting is done by the already defined bisimulation from Figure 6 and by Proosition Fundamental Proerty of Casts As a second alication of this technique, we show how to establish the Fundamental Proerty of Casts, Lemma 2 of (Siek and Wadler 2010), which asserts that a single cast is equivalent to a air of casts through any tye greater than the meet of the source and target.

11 Threesome to mediating tye id K = K id s t = s t id = g ; G! = g G? ; i = i GH = t = C Threesome to threesome without blame M TW = M blame TW = wrong M t TW = M TW : A T = B if t : A = B and t = T Figure 8. Relating threesomes without blame (λt and λw) (Recall that the meet of two tyes is their greatest lower bound, as defined in Figure 7.) Our roof technique is to establish that two terms of λb ma to contextually equivalent terms of λt. We first establish one simle lemma. Lemma 24. If A & B <: n C then A = B BT = A = C BT C = B BT Proof. By induction on A, B, and C. Corollary 25 (Fundamental Proerty of Casts). Let M be a term of λb. If A & B <: n C then M : A = B ctx = B M : A = C = B Proof. Immediate from Lemma 24 and Proositions 12 and 17. In Siek and Wadler (2010) establishing the same result is significantly more difficult: it requires secifying a new form of bisimulation and roving six lemmas. 8. Related Work This section rovides an in-deth comarison to the work of Siek and Wadler (2010), Greenberg (2013), and Garcia (2013), then summarizes other relevant work. 8.1 Relation to Siek and Wadler (2010) Siek and Wadler (2010) use threesomes of the form A P = B where A and B are tyes as here, and P is a labeled tye indicating how blame is allocated if the cast fails. Here is the grammar for labeled tyes: l, m ::= ɛ P, Q ::= K l P l Q Gl (We have renamed some variables to make it easier to comare our work and theirs; in the original they use l, m where we use, q and vice versa, S, T where we use A, B, and B where we use K.) The meaning of a labeled tye is subtle as it deends on whether the label is resent or not. For examle, their Gɛ corresonds to our GH, while their Gq corresonds to our G? q ; GH. Note that our system records that the failure is the result of casting from ground tye G to ground tye H, whereas theirs only records that the cast was from ground tye G. Their aer includes a translation from threesomes to coercions. Here is their comosition function, with notation changed slightly to align with our own. K l K m = K l (P l P ) (Q m Q ) = (Q P ) l (P Q ) P = P P = P P Gm Q H = Gm Gm Q = Gm P Gl Gm = Gl P Gl Hq = qgl if G H if G H Here P Gl means that the labeled tye P is comatible with the ground tye G and the label at the to of P is l. The correctness of these equations is not immediate. For instance, in the last line why do P Gl and Hq on the left combine to form qgl on the right? Perhas the easiest way to validate the equations is to translate to coercions using, then check that the left-hand side normalises to the right-hand side. In contrast, our definition of (Figure 5) is easy to read off as correct, directly from the equations of the coercion calculus. 8.2 Relation to Greenberg (2013) Greenberg (2013) considers calculi CAST, NAIVE, and EFFICIENT, similar to our λb, λc, and λt; unlike our work, he includes refinement tyes, but omits blame. EFFICIENT defines a comosition oerator that serves the same urose as our. The comosition oerator c 1 c 2 c 3 comoses the right-most rimitive coercion of c 1 with the left-most rimitive coercion of c 2, then recursively comoses the result with what is left of c 1 and c 2. For examle, the following is the rule for comosing function coercions. c 21 c 11 c 31 c 12 c 22 c 32 c 1 (c 31 c 32) ; c 2 c c 1 ; (c 11 c 12) (c 21 c 22) ; c 2 c The recursive definition is not a structural recursion, so roving that comosition is total and that it returns a canonical coercion is challenging, requiring four ages. In contrast, because our definition uses structural recursion, validating that it is total requires simly checking that the definition covers all airs of threesomes that may be comosed according to their tye, which is straightforward. 8.3 Relation to Garcia (2013) Garcia (2013) observes that coercions are easier to understand while threesomes are easier to imlement, and shows how to derive threesomes from coercions through a series of correctnessreserving transformations. To accomlish this, Garcia (2013) defines suercoercions and gives their meaning in terms of a translation N to coercions. Here is his translation, with notation changed slightly to align with our own. id SC = id id K SC = id K G SC = GH Gq SC = G? q ; GH G! SC = G! G? SC = G? G?! SC = G? ; G!