Corinne François

Benoit, Laurent Claude Fabien

Flo- Rian Nelson

Vivien Dounia

Arnaud, Imré Emilio Karel

Ali Raphaël

Pierre H Gilles

Vir- Ginie Kailiang

Vaston, David Jean-Pierre Robert

Cecilia Gaétan

Hugo Hermann

Introduction

(English version follows.) L'histoire commence par le développement d'un programme informatique nommé DEDUKTI. DEDUKTI est un vérificateur de preuves, c'est-à-dire un outil capable de vérifier automatiquement la validité d'une preuve mathématique.

Qu'est ce qu'une preuve ? Une preuve est une justification de la vérité d'une proposition. La preuve de la mortalité de Socrate en est un exemple classique : Socrate est un homme ; tout homme est mortel ; donc, Socrate est mortel.

Dans cette preuve, on trouve les énoncés de deux hypothèses (Socrate est un homme et tout homme est mortel) et de la conclusion (Socrate est mortel). Le mot donc précise que la conclusion se déduit logiquement des hypothèses. Cependant, la nature de cette étape déductive reste implicite.

Les mathématiciens s'intéressent depuis longtemps à la notion de preuve et de raisonnement logique. La théorie de la preuve est la branche des mathématiques qui s'intéresse aux preuves en tant qu'objets mathématiques. Ce domaine a été particulièrement actif depuis le début du 19e siècle, et en particulier depuis la publication par Gottlob Frege de son Begriffsschrift (1879). Giuseppe Peano, Bertrand Russell, Richard Dedekind, David Hilbert, Kurt Gödel et Gerhard Gentzen, pour n'en citer que quelques uns, ont chacun apporté une importante contribution au domaine pendant la première moitié du 20e siècle. Ces travaux ont donné naissance à de nombreuses notions formelles de preuve. On peut, par exemple, voir une preuve comme un arbre étiqueté par des propositions. ∀x, Homme(x) =⇒ Mortel(x) (Inst.) Homme(Socrate) =⇒ Mortel(Socrate) Homme(Socrate) (M-P) Mortel(Socrate) Cet arbre est une représentation formelle de la preuve de la mortalité de Socrate donnée plus haut. Comme le langage naturel est souvent ambigu, on écrit les propositions dans un langage plus précis et proche du vernaculaire mathématique. En haut, aux feuilles de l'arbre, ∀x, Homme(x) =⇒ Mortel(x) et Homme(Socrate) sont les hypothèses (ou axiomes) de la preuve ; la première signifie, pour tout x, si x est un homme, alors x est mortel, ou, plus simplement, tout homme est mortel ; la seconde signifie Socrate est un homme. En bas, la racine de l'arbre, Mortel(Socrate), est la conclusion de la preuve ; elle signifie que Socrate est mortel.

L'arbre contient aussi deux noeuds internes, (Inst.) et (M-P), qui correspondent à des étapes du raisonnement logique. Le premier noeud, (Inst.), est une instance de la règle d'instanciation. Cette règle dit que, pour tout objet o, il est logiquement valide de déduire P (o) à partir de la proposition ∀x.P (x), où P (x) est une proposition dépendant d'une variable x, et P (o) est la proposition P (x) où l'on a remplacé les occurrences de la variable x par o. Ici la proposition P (x) est Homme(x) =⇒ Mortel(x) et l'objet o est Socrate. Le second noeud, (M-P), est une instance de la règle du Modus Ponens. Cette règle dit que, pour toutes propositions P et Q, on peut déduire Q des deux propositions P et P =⇒ Q. Ici, on déduit Mortel(Socrate) à partir de Homme(Socrate) et Homme(Socrate) =⇒ Mortel(Socrate).

Il est évident que cette preuve formelle de la mortalité de Socrate est beaucoup plus détaillée et précise que la preuve informelle avec laquelle on a commencé. Une preuve formelle permet donc d'avoir un plus grand degré de confiance que n'importe quelle autre notion de preuve puisqu'elle réduit tout à la validité d'un (petit) ensemble d'axiomes et de règles de déduction. Bien sur, en contrepartie, une preuve formelle est aussi plus fastidieuse à écrire puisque chaque étape du raisonnement logique doit être explicitée.

En choisissant le langage des propositions, les règles de déduction ainsi que les axiomes, on peut définir plusieurs types de logiques : classique, constructive, minimale, linéaire, modale, temporelle, etc.

Un vérificateur de preuves, c'est quoi ? Si on fixe l'ensemble des axiomes et des règles de déduction que l'on a le droit d'utiliser dans une preuve, la vérification de la validité d'une preuve formelle peut être automatisée. En effet, une preuve est valide si c'est un arbre dont les feuilles sont des axiomes, dont la racine est la conclusion et dont chaque noeud interne est une instance d'une règle de déduction. Ceci nous ouvre donc la voie à la vérification automatique de preuves par des programmes. On appelle ces programmes des vérificateurs de preuve.

Le premier vérificateur de preuve, Automath [START_REF] Nederpelt | Selected Papers on Automath[END_REF], a été conçu par Nicolaas Govert de Bruijn à la fin des années 60. Depuis, de nombreux vérificateurs ont été développés. Parmi les plus connus on peut citer Agda [START_REF] Bove | A Brief Overview of Agda -A Functional Language with Dependent Types[END_REF], Coq [CDT], Isabelle [START_REF] Nipkow | Isabelle/HOL: A Proof Assistant for Higher-order Logic[END_REF], PVS [START_REF] Owre | PVS: A Prototype Verification System[END_REF], Nuprl [Kre], Twelf [START_REF] Pfenning | System Description: Twelf -a Metalogical Framework for Deductive Systems[END_REF] ou encore Beluga [START_REF] Pientka | Beluga: Programming with Dependent Types, Contextual Data, and Contexts[END_REF].

La preuve de programmes Parce que les preuves formelles sont très détaillées et peuvent être automatiquement vérifiées, elles permettent un haut niveau de confiance. La preuve de programmes est un important domaine d'application pour les preuves formelles. Le but est de prouver qu'un programme informatique correspond bien à sa spécification, autrement dit, qu'il ne contient pas de bogues. Ces méthodes formelles sont déjà utilisées dans l'industrie, pour prouver que des systèmes critiques ne contiennent pas d'erreurs, par exemple dans les domaines du transport (avion, train, métro) ou de la sécurité informatique (cryptographie, protocoles).

Comment fonctionne un vérificateur de preuves ? La majorité des vérificateurs de preuves s'appuient sur une correspondance forte entre preuves formelles et programmes fonctionnels que l'on appelle la correspondance de Curry-Howard ou interprétation formule/type.

Cette correspondance permet de remplacer la vérification qu'une preuve correspond à une proposition par la vérification qu'un programme fonctionnel a un type donné, l'intuition étant que les règles de déduction peuvent être vues comme des règles de typage pour programmes fonctionnels.

Par exemple, la règle du Modus Ponens, que l'on a déjà évoquée, P =⇒ Q P Q correspond à la règle de typage de l'application d'une fonction f à un argument a en programmation fonctionnelle, un style de programmation inspiré du λ-calcul développé par Alonzo Church.

f : A -→ B a : A f a : B Cette règle permet, à partir d'une fonction de type A -→ B (c'est-à-dire une fonction qui prend un argument de type A et produit un élément de type B ) et d'un argument de type A, de construire l'application ( f a) de type B . Par exemple, si 42 est de type Entier (le type des entiers naturels) et EstPair est une fonction de type Entier -→ Booleen, c'est-à-dire une fonction des entiers vers les booléens (le type de vrai et faux), alors l'expression (EstPair 42) est de type Booleen.

On peut remarquer qu'il y a une correspondance (à un renommage près : P en A, Q en B et =⇒ en -→) entre les propositions de la règle de Modus Ponens et les types de la règle de typage de l'application. Cette correspondance peut être étendue à d'autres règles de déduction et de typage, construisant ainsi une connexion très forte entre les systèmes logiques et les systèmes de types. De plus, grâce à cette connexion, on peut voir un programme de type A comme une preuve de la proposition correspondant à A. À partir de cette idée, les vérificateurs de preuves modernes, implémentent généralement à la fois un système logique et un langage de programmation.

DEDUKTI implémente une variante de la correspondance formule/type, la correspondance jugement/type [START_REF] Harper | A Framework for Defining Logics[END_REF]. L'idée de base est la même : on réduit un problème de vérification de preuve à un problème de vérification de type. Par contre on abandonne la correspondance entre les propositions et les types. Les propositions ainsi que les règles de déduction et axiomes sont traduits en programmes en utilisant des encodages spécifiques. Choisir un encodage permet de choisir une logique. Ainsi, DEDUKTI est un vérificateur de preuves universel car il est indépendant de la logique considérée. On appelle un tel vérificateur un logical framework (cadre logique).

DEDUKTI est utilisé comme back-end par de nombreuses implémentations d'encodages.

• CoqInE [START_REF] Boespflug | CoqInE : Translating the calculus of inductive constructions into the λΠ-calculus modulo[END_REF] (Coq In dEdukti) produit des preuves DEDUKTI à partir de preuves Coq [CDT].

• Holide [START_REF] Assaf | Translating HOL to Dedukti[END_REF] (HOL In DEdukti) produit des preuves DEDUKTI à partir de preuves HOL [START_REF] Harrison | HOL Light: An Overview[END_REF] au format Open Theory [START_REF] Hurd | The OpenTheory Standard Theory Library[END_REF].

• Focalide [Cau] (FoCaLize In DEdukti) produit des fichiers DEDUKTI à partir des développements FoCaLize [HPWD].

• Krajono [Ass] (Pencil en espéranto) produit des preuves DEDUKTI à partir de preuves Matita [START_REF] Asperti | The Matita Interactive Theorem Prover[END_REF].

• iProver Modulo [START_REF] Burel | A Shallow Embedding of Resolution and Superposition Proofs into the λΠ-Calculus Modulo[END_REF] est une extension de iProver [START_REF] Korovin | iProver -An Instantiation-Based Theorem Prover for First-Order Logic (System Description)[END_REF], un prouveur automatique de théorèmes fondé sur la méthode de résolution, permettant le support de la déduction modulo et produisant des preuves DEDUKTI.

• Zenon Modulo [DDG + 13] est une extension de Zenon [START_REF] Bonichon | Zenon : An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF], un prouveur automatique de théorèmes fondé sur la méthode des tableaux, avec du typage et de la déduction modulo, produisant des preuves DEDUKTI.

Quelle est la particularité de DEDUKTI ? Les vérificateurs de preuves fondés sur la correspondance de Curry-Howard implémentent en même temps un système logique et un langage de programmation. Cela signifie que l'on peut calculer avec les preuves (puisque ce sont aussi des programmes), mais cela permet aussi de calculer dans les preuves. En effet, les vérificateurs de preuves identifient généralement les propositions qui sont identiques à un calcul près. Par exemple, la proposition 2+2 = 4 est identifiée à la proposition 4=4, puisque le résultat du calcul 2+2 est 4. Cela veut dire que prouver que 2+2 est égal à 4 se réduit à un simple calcul et à l'utilisation du principe de réflexivité de l'égalité :

∀x.x = x (Inst.) 4 = 4 (Calcul) 2 + 2 = 4
La particularité de DEDUKTI est de permettre de facilement étendre cette notion de calcul grâce à l'ajout de règles de réécriture. Par exemple, l'addition d'entiers de Peano peut être calculée grâce aux règles suivantes :

n + 0 → n n + (S m) → S (n + m)
Un entier de Peano est un entier représenté par un mot de la forme S (. . . (S 0)). Le symbole 0 signifie zéro et le symbole S (successeur) incrémente un entier de un. L'entier 2 est donc représenté par S (S 0) et 4 par S (S (S (S 0))). La première règle de réécriture dit que, pour tout n, n + 0 vaut n. La seconde règle dit que, pour tout n et m, n + (m + 1) vaut (n + m) + 1.

Les règles de réécriture de DEDUKTI permettent donc d'avoir un contrôle précis sur la notion de calcul.

Une brève histoire de DEDUKTI Le projet DEDUKTI a été initié par Dowek comme un vérificateur de preuves/types fondé sur le λΠ-Calcul Modulo [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF], un formalisme à base de types dépendants (c'est-à-dire des types dépendant de valeurs) et de règles de réécriture. Une première version a été développée par Boespflug [START_REF] Boespflug | Conception d'un noyau de vérification de preuves pour le lambda-Pi-calcul modulo[END_REF], puis par Carbonneaux [START_REF] Boespflug | The lambda-Picalculus Modulo as a Universal Proof Language[END_REF]. Cette première version implémentait une architecture logicielle originale. La vérification de type se passait en deux étapes : d'abord le problème était lu par le programme qui générait un vérificateur dédié ; dans un second temps, le code généré était compilé et exécuté pour obtenir le résultat. Cette architecture permettait d'implémenter les lieurs en utilisant la syntaxe abstraite d'ordre supérieure [START_REF] Pfenning | Higher-order abstract syntax[END_REF] et la réduction en utilisant la normalisation par évaluation [START_REF] Berger | An Inverse of the Evaluation Functional for Typed lambda-Calculus[END_REF]. De plus, le calcul implémenté était sans contexte [START_REF] Boespflug | Conception d'un noyau de vérification de preuves pour le lambda-Pi-calcul modulo[END_REF]. Plusieurs variantes de cette première version ont existé mettant en oeuvre différents langages de programmation : d'abord une version Haskell générant du code Haskell, ensuite une version Haskell générant du code Lua, et enfin, une version C générant du code Lua.

Pour pallier des problèmes de performance et de passage à l'échelle, nous avons développé une nouvelle version en OCaml implémentant une architecture plus standard (une seule étape). Cette thèse a pour but de décrire les fondations théoriques de cette nouvelle version, étendue, de DEDUKTI.

De quoi parle cette thèse ? Au fil du temps, l'implémentation de DEDUKTI a évolué : des fonctionnalités ont été ajoutées ; plus de systèmes de réécriture ont été supportés, etc. D'un autre côté, la définition du λΠ-Calcul Modulo a peu évolué depuis l'article original de Cousineau et Dowek [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF]. De plus, ce premier papier ne se concentre pas sur l'étude du λΠ-Calcul Modulo, mais cherche plutôt à motiver son utilisation à travers un exemple détaillé, l'encodage des Systèmes de Types Purs Fonctionnels. Par conséquent, il y avait un décalage entre le λΠ-Calcul Modulo de Cousineau et Dowek et le calcul implémenté dans DEDUKTI. En particulier :

• la façon de vérifier le bon typage des règles de réécriture dans DEDUKTI etait plus générale que la définition initiale du λΠ-Calcul Modulo, notamment parce que DEDUKTI procède itérativement : les règles préalablement ajoutées au système sont utilisées pour typer les nouvelles ;

• les conditions nécessaires à la décidabilité de la vérification de type et nécessaires à la correction de l'algorithme de vérification de type étaient mal connues ;

• peu d'outils théoriques permettaient de vérifier que ces conditions étaient vérifiées pour un système de réécriture donné.

Cette thèse répond à ces problèmes spécifiques de trois façons :

• en proposant une nouvelle version du λΠ-Calcul Modulo facilement comparable avec son implémentation dans DEDUKTI ;

• en effectuant une étude théorique détaillée de ce nouveau calcul, en se concentrant en particulier sur les conditions nécessaires au système de réécriture rendant la vérification de type décidable et plus généralement permettant au système de type de bien se comporter ;

• et en donnant des critères effectifs permettant de garantir ces conditions.

Résumé et contributions de la thèse

• Le chapitre 1 rappelle certaines notions classiques de théorie de la réécriture concernant les systèmes de réduction abstraits, la réécriture du premier ordre, le λ-calcul et leur combinaison qui seront utilisées dans les chapitres suivants. On s'intéresse en particulier aux résultats de confluence.

• Le chapitre 2 donne une nouvelle présentation du λΠ-Calcul Modulo correspondant au calcul implémenté par DEDUKTI. Cette nouvelle version améliore celle de Cousineau et Dowek de deux manières. D'abord on définit une notion de réécriture sur les termes sans aucune notion de typage. Ceci permet de rendre sa comparaison avec son implémentation plus directe. Ensuite, on explicite et on clarifie le typage des règles de réécriture.

On procède à une étude théorique précise du λΠ-Calcul Modulo. En particulier, on met en exergue les conditions qui assurent que le système de types vérifie des propriétés élémentaires telles que la préservation du typage par réduction ou l'unicité des types. Ces conditions sont la compatibilité du produit et le bon typage des règles de réécriture. Pour finir, on considère une extension du λΠ-Calcul Modulo avec du polymorphisme et des opérateurs de type que l'on appelle le Calcul des Constructions Modulo.

• Le chapitre 3 étudie la propriété de bon typage des règles de réécriture. Une règle de réécriture est bien typée si elle préserve le typage. Partant d'un critère simple, à savoir que le membre gauche de la règle doit être algébrique et les membres gauche et droit doivent avoir le même type, on généralise progressivement le résultat pour considérer des membres gauches non algébriques et mal typés. Cette généralisation est particulièrement importante en présence de types dépendants, pour permettre de conserver des règles de réécriture linéaires à gauche et préserver la confluence du système de réécriture. On donne aussi une caractérisation exacte de la notion de bon typage pour les règles de réécriture sous forme d'un problème d'unification et on prouve son indécidabilité.

• Le chapitre 4 définit une notion de réécriture modulo β pour le λΠ-Calcul Modulo. En partant des observations que (1) la confluence du système de réécriture est une propriété vivement souhaitée car elle a pour conséquence la propriété de la compatibilité du produit ainsi que, avec la terminaison, la décidabilité de la congruence et que (2) la confluence est facilement perdue lorsque les règles de réécriture filtrent sous les abstractions, on propose une nouvelle notion de réécriture qui réconcilie confluence et filtrage sous les abstractions. Cette nouvelle notion est définie à travers un encodage des termes vers un système de réécriture d'ordre supérieur. Ceci permet d'importer dans λΠ-Calcul Modulo les résultats de confluence existants pour les systèmes d'ordre supérieur. On détaille aussi comment la réécriture modulo β peut être efficacement implémentée par la compilation des règles de réécriture en arbres de décision.

• Le chapitre 5 considère les règles de réécriture non linéaires à gauche. Combinées avec la β-réduction, ces règles génèrent généralement un système de réécriture non confluent. Ceci est un problème car la confluence est notre outil principal pour prouver la compatibilité du produit. On prouve que la propriété de compatibilité du produit est toujours vérifiée (même sans la confluence) lorsque les règles de réécriture sont toutes au niveau objet. Ensuite on étudie cette propriété en présence de règles non linéaires à gauche et de règles au niveau type. Pour cela, on introduit une variante du λΠ-Calcul Modulo où la conversion est contrainte par une notion de typage faible.

• Le chapitre 6 décrit les algorithmes de vérification de type pour les différents éléments du λΠ-Calcul Modulo : termes, contextes locaux et contextes globaux. On montre aussi que ces algorithmes sont corrects et complets en utilisant les résultats des chapitres précédents.

Introduction

The story begins with the development of a piece of software called DEDUKTI. DE-DUKTI is a proof checker, that is a tool able to automatically check the validity of mathematical proofs.

What is a proof? A proof is a justification of the truth of a proposition. An early example is the proof of the proposition Socrate is mortal:

Socrate is a man; men are mortal; therefore, Socrate is mortal.

In this proof we can find the statement of two hypotheses (Socrate is a man and Men are mortal) and the conclusion Socrate is mortal. The word therefore suggests that the conclusion can be logically deduced from the hypotheses. The nature of this deductive step is, however, left implicit. Mathematicians have been interested for a long time in the notion of proof and in the rules of logical reasoning. Proof Theory is the branch of mathematics that studies proofs as mathematical objects. This domain has been particularly active since the end of the 19th century, starting with the work of Gottlob Frege in his Begriffsschrift (1879). Giuseppe Peano, Bertrand Russell, Richard Dedekind, David Hilbert, Kurt Gödel and Gerhard Gentzen, to cite only a few, brought important contributions to the field during the first half of the 20th century. These works gave rise to many formal notions of proof. A particularly convenient one is the presentation of proofs as trees labeled by propositions. ∀x, IsAMan(x) =⇒ IsMortal(x) (Inst.) IsAMan(Socrate) =⇒ IsMortal(Socrate) IsAMan(Socrate) (M-P)

IsMortal(Socrate)
This tree is a formal representation of the proof that Socrate is mortal given above. Natural language being often ambiguous, we write the propositions in a more precise language, close to the mathematical vernacular. At the top, the leaves of the tree ∀x, IsAMan(x) =⇒ IsMortal(x) and IsAMan(Socrate) are the hypotheses (or axioms) of the proof; the first one stands for, for all x, if x is a man, then x is mortal, or, in short, men are mortal; the second one stands for Socrate is a man. At the bottom, the root of the tree IsMortal(Socrate) is the conclusion of the proof; it stands for Socrate is mortal.

The tree contains also two internal nodes, (Inst.) and (M-P); they correspond to the deductive steps of the logical reasoning. The first one (Inst.) is an instance of the Instantiation rule. This rule states that, for any object o, it is logically valid to deduce P (o) from a proposition ∀x.P (x), where P (x) is a proposition depending on the variable x and P (o) is the proposition P (x) where we replaced every occurrence of x by o. Here the proposition P (x) is IsAMan(x) =⇒ IsMortal(x) and the object o is Socrate. The second one (M-P) is an instance of the Modus Ponens rule. This rule says that, for any propositions P and Q, we can deduce Q from the two propositions P and P =⇒ Q. Here, we deduce IsMortal(Socrate) from IsAMan(Socrate) and IsAMan(Socrate) =⇒ IsMortal(Socrate).

As we can see, the formal proof that Socrate is mortal is much more detailed and precise than the informal proof we began with. This allows having a much higher degree of confidence in formal proofs than in any other notion of proof as everything is reduced to the validity of a (small) set of axioms and a (small) set of deductive rules. Of course, it is also more tedious to write since every logical step is made explicit.

By choosing the language of propositions, the deductive rules and the axioms, we can define several kinds of logics: classical, constructive, minimal, linear, modal, temporal, etc.

What is a proof checker? If we fix the set of axioms and the set of deductive rules that can be used in a proof, the verification of the validity of a formal proof can be mechanized. Indeed, a proof is valid if it is a tree where the leaves are axioms, the root is the conclusion and each internal node is an instance of a deductive rule. This opens the possibility of automatic proof verification by programs. We call these programs proof checkers.

The first proof checker, Automath [START_REF] Nederpelt | Selected Papers on Automath[END_REF], has been designed by Nicolaas Govert de Bruijn in the late sixties. Since then, many other proof checkers have been developed. Among the better known are Agda [START_REF] Bove | A Brief Overview of Agda -A Functional Language with Dependent Types[END_REF], Coq [CDT], Isabelle [START_REF] Nipkow | Isabelle/HOL: A Proof Assistant for Higher-order Logic[END_REF], PVS [START_REF] Owre | PVS: A Prototype Verification System[END_REF], Nuprl [Kre], Twelf [START_REF] Pfenning | System Description: Twelf -a Metalogical Framework for Deductive Systems[END_REF] and Beluga [START_REF] Pientka | Beluga: Programming with Dependent Types, Contextual Data, and Contexts[END_REF].

Proof of programs

Because formal proofs are very detailed and can be automatically verified, they offer a strong degree of confidence. An important application domain for formal proofs is the proofs of programs. The goal is to prove that a computer program correspond to its specification. In other words, we prove that a program has no bugs. This has already been used in the industry to prove that critical systems were bug-free, for instance in the transport (airplane, railways, subway) or security (cryptography, protocols).

How do proof checkers work?

Most existing proof checkers are based on a strong correspondence between formal proofs and functional programs known as the Curry-Howard correspondence, or the formulas-as-types interpretation.

Roughly speaking, the correspondence states that it is the same thing to check that a proof justifies a given proposition, or to check that a functional program has a given type. The intuition is that deduction rules can be seen as rules for typing functional programs.

For instance the Modus Ponens rule, that we have already mentioned,

P =⇒ Q P Q
corresponds to the rule for typing the application of a function f to an argument a in functional programming, a programming style inspired by the λ-calculus developed by Church.

f : A -→ B a : A f a : B
This rule says that, if f is a function of type A -→ B , meaning that it takes an argument of type A and produces an element of type B , and a is an argument of type A, then the application ( f a) of f to a is an expression of type B . For instance, if 42 has type Integer (the type of integers) and isEven is a function of type Integer -→ Boolean, that is to say a function from integers to booleans (the type of true and false), then the expression (isEven 42) has type Boolean.

We can see that there is a correspondence (up to some renaming: P to A, Q to B and =⇒ to -→) between the propositions occurring in the Modus Ponens rule and the types occurring in the typing rule for the application. The correspondence can be extended to other logical and typing rules, building a strong connection between logical systems and type systems. Moreover, following this connection, a program of type A can be seen as a proof of the proposition corresponding to A. Based on this idea, modern proof checkers usually implement a calculus that is at the same time a logical system and a programming language.

DEDUKTI implements a variant of the formulas-as-types correspondence known as the judgment-as-type correspondence [START_REF] Harper | A Framework for Defining Logics[END_REF]. The basic idea is the same: we reduce the problem of proof checking to the problem of type checking. However, we give up the correspondence between propositions and types. The propositions as well as the deductive steps and the axioms are translated to programs using specific encodings. Choosing an encoding allows choosing a logic. By this means, DEDUKTI is a universal proof checker, as it is logic-agnostic. Such a proof checker is called a logical framework.

DEDUKTI has been used as a backend by many implementations of encodings.

• CoqInE [START_REF] Boespflug | CoqInE : Translating the calculus of inductive constructions into the λΠ-calculus modulo[END_REF] (Coq In dEdukti) produces DEDUKTI proofs from Coq [CDT] proofs.

• Holide [START_REF] Assaf | Translating HOL to Dedukti[END_REF] (HOL In DEdukti) produces DEDUKTI proofs from HOL [START_REF] Harrison | HOL Light: An Overview[END_REF] proofs, using the Open Theory [START_REF] Hurd | The OpenTheory Standard Theory Library[END_REF] standard.

• Focalide [Cau] (FoCaLize In DEdukti) produces DEDUKTI files from FoCaLize [HPWD] developments.

• Krajono [Ass] (Pencil in Esperanto) produces DEDUKTI files from Matita [START_REF] Asperti | The Matita Interactive Theorem Prover[END_REF] proofs.

• iProver Modulo [START_REF] Burel | A Shallow Embedding of Resolution and Superposition Proofs into the λΠ-Calculus Modulo[END_REF] is an extension of the resolution automated theorem prover iProver [START_REF] Korovin | iProver -An Instantiation-Based Theorem Prover for First-Order Logic (System Description)[END_REF] with deduction modulo, producing DEDUKTI files.

• Zenon Modulo [DDG + 13] is an extension of the tableaux-based automated theorem prover Zenon [START_REF] Bonichon | Zenon : An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF] with typing and deduction modulo, producing DEDUKTI files.

What is so special about DEDUKTI? Proof-checkers based on the Curry-Howard correspondence implement at the same time a logical system and a programming language. This means that we can compute with proofs (proofs are programs) but they also allow computing in proofs. Indeed, proof checkers usually identify propositions that are the same up to some computation. For instance, the proposition 2+2 = 4 is identified with the proposition 4 = 4 because 2+2 computes to 4. This means that proving that 2+2 is equal to 4 is just a matter of performing a simple computation and using the reflexivity of the equality:

∀x.x = x (Inst.) 4 = 4 (Computation) 2 + 2 = 4
The distinctive feature of DEDUKTI is to provide a simple means to extend this notion of computation through rewrite rules. For instance, typical rewrite rules for the addition on Peano integers are:

n + 0 → n n + (S m) → S (n + m)
Peano integers is a simple representation of integers as words of the form S (. . . (S 0)). The symbol 0 is the zero and the symbol S (successor) adds one to an integer. This means that 2 is represented by S (S 0) and 4 by S (S (S (S 0))). The first rewrite rule says that, for all n, n + 0 computes to n. The second one says that, for all n and m, n + (m + 1) computes to (n + m) + 1.

Rewrite rules allow DEDUKTI users to have a precise control over the notion of computation.

A short history of DEDUKTI DEDUKTI has been initiated by Dowek as a proof checker/type checker based on the λΠ-Calculus Modulo [CD07], a formalism featuring dependent types (i.e., types depending on values) and rewrite rules (the reason for the Modulo qualifier). A first version has been developed by Boespflug [Boe11] and then by Carbonneaux [START_REF] Boespflug | The lambda-Picalculus Modulo as a Universal Proof Language[END_REF]. This first version featured an original architecture. The type-checking process was performed in two steps: first the input problem was parsed and a dedicated type-checker was generated; second the generated code was compiled and run to obtain the result. This architecture allowed implementing binders using Higher-Order Abstract Syntax [START_REF] Pfenning | Higher-order abstract syntax[END_REF] and reduction using Normalization by Evaluation [START_REF] Berger | An Inverse of the Evaluation Functional for Typed lambda-Calculus[END_REF]. Moreover, the calculus implemented was contextfree [START_REF] Boespflug | Conception d'un noyau de vérification de preuves pour le lambda-Pi-calcul modulo[END_REF]. Several variants of this first version have been implemented using different programming languages: first a Haskell version generating Haskell code, then a Haskell version generating Lua code and finally a C version generating Lua code.

Because all these variants suffered from performance and scaling issues, we have developed a new version in OCaml implementing a more standard (one step) architecture. This thesis describes the theoretical underpinnings of this prototype.

What is addressed in this thesis? Through time, the implementation of DEDUKTI has evolved: features were added; more rewrite systems were supported, etc. On the other hand, the definition of the λΠ-Calculus Modulo did not evolve since the seminal paper of Cousineau and Dowek [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF]. Moreover, this first paper did not focus on the theoretical side of the λΠ-Calculus Modulo but rather motivated its use as a logical framework. As a result, there was a gap between Cousineau and Dowek's λΠ-Calculus Modulo and the calculus implemented in DEDUKTI. In particular:

• the way rewrites rules are typed in DEDUKTI goes beyond the initial definition of the λΠ-Calculus Modulo as it is iterative; rewrite rules previously added can be used to type new ones;

• the conditions under which type-checking in the λΠ-Calculus Modulo is decidable and the conditions under which DEDUKTI is sound had not been studied in detail;

• there were few theoretical tools allowing verifying that these conditions hold for a given set of rewrite rules.

This thesis gives answers to these specific problems in three ways:

• by proposing a new version of the λΠ-Calculus Modulo that is easy to compare with the calculus implemented by DEDUKTI;

• by performing a detailed theoretical study of this new calculus, focused in particular on making explicit the conditions under which type-checking is decidable and, more generally, the conditions under which the type-system is wellbehaved;

• and by designing effective criteria on the rewrite system to ensure that these conditions hold.

Outline and contributions of the thesis

• Chapter 1 reviews some basic notions and results in rewriting theory about abstract reduction systems, term rewriting systems, the λ-calculus and their combination. In particular, we are interested in confluence results.

• Chapter 2 introduces a new presentation of the λΠ-Calculus Modulo, the calculus implemented in DEDUKTI. This new version aims at improving Cousineau and Dowek's λΠ-Calculus Modulo by two modifications. First we define the notion of rewriting on untyped terms. This makes the calculus easier to compare with its implementation in DEDUKTI. Second, we make explicit and we clarify the typing of the rewrite rules.

We undertake a precise theoretical study of the λΠ-Calculus Modulo. In particular, we put forward two conditions ensuring that the typing system verifies basic properties such as subject reduction and uniqueness of types. These conditions are product compatibility and well-typedness of rewrite rules. Finally, we consider an extension of the λΠ-Calculus Modulo with polymorphism and type operators that we call the Calculus of Constructions Modulo.

• Chapter 3 investigates the property of well-typedness for rewrite rules. A rewrite rule is well-typed if it preserves typing. Starting from the simple criterion that the rewrite rules should be left-algebraic and both sides of the rule should have the same type, we progressively generalize the result to allow non-algebraic and ill-typed left-hand sides. This latter generalization is particularly important to keep rewrite rules left-linear in presence of dependent typing and to preserve the confluence of the rewriting system. We also give an exact characterisation of well-typedness for rewrite rules as a unification problem and we prove the undecidability of the problem.

• Chapter 4 introduces a notion of rewriting modulo β for the λΠ-Calculus Modulo. Starting from the observations that (1) the confluence of the rewriting system is a very desirable property as it implies product compatibility and, together with termination, the decidability of the congruence and (2) confluence is easily lost when we allow matching under binders, we introduce the notion of rewriting modulo β to reconcile confluence and matching under binders. This new notion of rewriting is defined through an encoding in Higher-Order Rewrite Systems. This allows bringing to the λΠ-Calculus Modulo the confluence criteria designed for Higher-Order Rewrite Systems. We also detail how rewriting modulo β can be efficiently implemented by compiling the rewrite rules to decision trees.

• Chapter 5 considers non left-linear rewrite rules. Non-left linear rewrite rules usually generate non-confluent rewriting systems when combined with βreduction. This is an issue because confluence is our main tool to prove product compatibility. Adapting previous works, we prove that product compatibility holds when the rewrite rules are at object-level only, even if confluence does not hold. Then we study the problem of proving product compatibility in presence of non left-linear and type-level rewrite rules. For this we introduce a variant of the λΠ-Calculus Modulo where the conversion is constrained to verify a weak notion of typing.

• Chapter 6 gives algorithms to type-check the different elements of the λΠ-Calculus Modulo: terms, local contexts, rewrite rules and global contexts. These algorithms are shown to be sound and complete using the results of the previous chapters.

Chapter 1

Preliminaries

Résumé Ce chapitre rappelle certaines notions classiques de théorie de la réécriture concernant les systèmes de réduction abstraits, la réécriture du premier ordre, le λ-calcul et leur combinaison qui seront utilisées dans les chapitres suivants. On s'intéresse en particulier aux résultats de confluence.

This short chapter reviews some basic notions and results about abstract reduction systems, term rewriting systems, λ-calculus and their combination that we will use in the next chapters. In particular, we are interested in confluence results.

Abstract Reduction Systems

The notion of abstract reduction system is, as its name suggests, the most abstract definition of rewriting that exists. In particular, it makes no assumptions on the nature of the objects being reduced (or rewritten). Though very simple, this notion allows us to formally define basic properties of rewriting such as confluence or termination.

Definition 1.1.1 (Abstract Reduction System). An abstract reduction system (ARS) is a pair made of a set A and a binary relation → on A (i.e., →⊂ A × A ).

Notation 1.1.2.

• We use the infix notation x → y to denote (x, y) ∈→.

• We write → * for the reflexive and transitive closure of →.

• We write ≡ for the reflexive, symmetric and transitive closure of →.

Definition 1.1.3. Two objects x, y ∈ A are joinable (written x ↓ y), if there exists z such that x → * z and y → * z.

Definition 1.1.4. An element x ∈ A is normal if there is no y such that x → y.

Definition 1.1.5. An abstract reduction system is said to be:

• locally confluent (or weakly confluent) when, for all x, y, z, if x → y and x → z, then y ↓ z;

• confluent when, for all x, y, z if x → * y and x → * z, then y ↓ z;

• normalizing (or weakly normalizing) when, for all x, there exists y normal such that x → * y.

• terminating (or strongly normalizing) when there is no infinite reduction chain a 1 → a 2 → . . . a n → . . ..

Term Rewriting Systems

A (first-order) term rewriting system is an abstract rewriting system where the objects are first-order terms, and where the reduction relation is given by a set of rewrite rules.

Definition

Definition 1.2.1 (Signature). A signature is a set Σ of constant symbols together with an arity function from Σ to positive integers.

Definition 1.2.2 (Term). If Σ is a signature and V a set of variables (disjoint from Σ and infinite), then the set T (Σ, V ) of (first-order) terms over Σ is defined inductively as follows:

• a variable v ∈ V is a term; • if f ∈ Σ is a constant
{ x ∈ V | σ(x) = x }.
If σ is a substitution and t is a term, we write σ(t ) the term t where we replaced the variables by their image by σ. Definition 1.2.4 (Rewrite Rule). A rewrite rule is a pair (l , r ) of terms such that l is not a variable and Var(r ) ⊂ Var(l ).

We write (l → r ) for the rewrite rule (l , r ).

Definition 1.2.5 (Term Rewriting System). A Term Rewriting System (TRS) for a signature Σ and a set of variables V is a set of rewrite rules R over the signature Σ.

When it is convenient, we identify a TRS with its underlying ARS (T (Σ, V ), → R ) where → R is the relation on T (Σ, V ) defined inductively as follows:

• σ(l ) → R σ(r ) if (l → r ) ∈ R and σ is a substitution; • f (t 1 , . . . , t n ) → R f (s 1 , . . . , s n ) if,
for some i , t i → R s i and, for all j = i , t j = s j .

Critical Pairs

Definition 1.2.6 (Position and Subterm). Let t be a term. The set of positions in t , Pos(t ), of sequences of integers and the subterm t |p of t at position p ∈ Pos(t ) are defined inductively as follows:

• if t is a variable, then Pos(t ) = {ǫ} and t |ǫ = t ;

• if t = f (t 1 , . . . , t n ), then Pos(t ) = {ǫ} ∪ {1.q|q ∈ Pos(t 1 )} ∪ . . . ∪ {n.q|q ∈ Pos(t n )}, t |ǫ = t and t |i .q = t i |q .
Definition 1.2.7 (Most General Substitution). Let u, v be two terms.

A substitution σ is a most general substitution for u and v if:

• σ(u) = σ(v);
• for all σ 0 such that σ 0 (u) = σ 0 (v), there exists a substitution δ such that, for all x, σ 0 (x) = δ(σ(x)).

Notation 1.2.8. Let t and u be two terms and p be a position in t . We write t [u] p for the term t where we replaced the subterm at position p by u.

Definition 1.2.9 (Critical Pair). Let l i → r i for (i = 1, 2) be two rewrite rules. Suppose that they do not share any variable (variables can be renamed if needed). If there exists p ∈ Pos(l 1 ) such that l 1|p is not a variable and σ is a most general unifier of (l 1|p , l 2 ) then we have the following reductions σ(l 1 ) → σ(r 1 ) and σ(l 1 ) → (σ(l 1 ))[σ(r 2 )] p .

We say that the pair ((σ(l 1 ))[σ(r 2 )] p , σ(r 1 )) is a critical pair and that the two rewrite rules overlap.

We write (a ⋉ b) when (a, b) is a critical pair.

Theorem 1.2.10 (Critical Pair Theorem [KB83]). A TRS is locally confluent if and only if its critical pairs are joinable.

Combined with Newman's Lemma (Theorem 1.1.6), we get the following result.

Corollary 1.2.11. A terminating TRS is confluent if and only if its critical pairs are joinable.

Confluence

A TRS which is orthogonal, meaning that it is left-linear and does not have critical pairs, is confluent. Definition 1.2.12 (Linearity).

• A term is linear if no variable occurs twice in it.

• A rewrite rule (l → r ) is left-linear if l is linear.

• A TRS is left-linear if all its rewrite rules are left-linear. Definition 1.2.13 (Orthogonality). A rewrite system is orthogonal if it is left-linear and includes no critical pairs. Theorem 1.2.14 (Confluence by Orthogonality [START_REF] Rosen | Tree-Manipulating Systems and Church-Rosser Theorems[END_REF][START_REF] Huet | Confluent Reductions: Abstract Properties and Applications to Term Rewriting Systems: Abstract Properties and Applications to Term Rewriting Systems[END_REF]). Orthogonal systems are confluent.

The criterion of orthogonality can be generalized to TRSs whose critical pairs are parallel closed. Definition 1.2.15 (⇒). Let R be a TRS. The relation ⇒ R of parallel reduction is defined inductively as follows:

• x ⇒ R x; • f (t 1 , . . . , t n ) ⇒ R f (s 1 , . . . , s n ) if, for all i , t i ⇒ R s i ; • t ⇒ R s if t → R s. Definition 1.2.16 (Parallel Closed TRS). A TRS R is parallel closed if t 1 ⇒ R t 2 for every critical pair t 1 ⋉ t 2 .
Theorem 1.2.17 (Parallel Closure Theorem [START_REF] Huet | Confluent Reductions: Abstract Properties and Applications to Term Rewriting Systems: Abstract Properties and Applications to Term Rewriting Systems[END_REF]). Left-linear and parallel closed systems are confluent.

Another way to get confluence is by combining confluent TRSs provided that their signatures are disjoint.

Theorem 1.2.18 (Modularity of Confluence [START_REF] Toyama | On the Church-Rosser Property for the Direct Sum of Term Rewriting Systems[END_REF]). Let R 1 , R 2 be two TRSs on T (Σ 1 , V ) and T (Σ 2 , V ) respectively.

If Σ 1 and Σ 2 are disjoint signatures and both R 1 and R 2 are confluent, then the

TRS R 1 ∪ R 2 on T (Σ 1 ∪ Σ 2 , V ) is confluent.

The λ-Calculus

The λ-calculus is a formalism invented by Alonzo Church in the 1930s. It has been designed to capture the most basic aspects of the ways that functions can be combined to form other functions. As it makes use of bound variables, it is an abstract reduction system but not a term rewriting system. Definition 1.3.1 (λ-Terms). We assume given an infinite set of variables. The set of λ-terms built from the set of constants C is defined as follows:

• any variable is a term;

• any constant in C is a term;

• if u and v are terms, then the application uv is a term;

• if A and t are terms and x is a variable, then the abstraction λx : A.t is a term. Definition 1.3.2 (Free and Bound Variables). The set of free variables of a term t , written FV (t ), is defined as follows:

• FV (x) = {x}; • FV (uv) = FV (u) ∪ FV (v); • FV (λx : A.u) = FV (A) ∪ (FV (u) \ {x}).
Variables occurring in t that are not free are called bound.

Convention

We identify λ-terms that can be obtained from each other by a renaming of bound variables in a way such that free variables do not become bound.

Definition 1.3.3 (Substitution). Let x be a variable and t , u be two terms. The substitution of x by u in t , written t [x/u] is defined as follows: The β-reduction relation → β on λ-terms is defined as follows:

• x[x/u] = u; • y[x/u] = y, if y = x; • (t 1 t 2 )[x/u] = t 1 [x/u]t 2 [x/u]; • (λy : A.t )[x/u] = λy : A[x/u].t [x/u], if x =
• t 1 → β h t 2 ; • if t 1 → β t 2 , then t 1 u → β t 2 u and ut 1 → β ut 2 ; • if t 1 → β t 2 , then λx : A.t 1 → β λx : A.t 2 and λx : t 1 .u → β λx : t 2 .u.
We write

→ β i for → β \ → β h . Theorem 1.3.5 (Confluence [CR36]). The relation → β is confluent.
The following theorem is an easy consequence of the so-called standardization theorem [START_REF] Curry | Combinatory Logic[END_REF].

Combining Term Rewriting Systems and the λ-Calculus

We now study some extensions of the λ-calculus with rewrite rules from TRSs.

Applicative Term Rewriting Systems

The λ-calculus has no notion of arity; therefore to see first-order terms as λ-terms, we need to currify them.

cur(x) = x cur( f (t 1 , . . . , t n )) = •(. . . (•( f , cur(t 1 )), . . . , )cur(t n ))
Let R be a TRS over the signature Σ. The applicative TRS R cur over the signature

Σ cur is { (cur(l ), cur(r )) | (l → r ) ∈ R }.
Theorem 1.4.3 (Preservation of Confluence by Curryfication [START_REF]Term Rewriting Systems[END_REF]). Let R be a TRS. If R is confluent, then R cur is confluent.

Combining Term Rewriting Systems and the λ-Calculus

Definition 1.4.4 (From TRS Terms to λ-terms). Let {•} ∪ C be a signature where • is a symbol of arity 2 and the symbols in C have arity 0.

The function |.| λ from first-order terms over {•}∪C to λ-terms over C is defined as follows:

|x| λ = x if x is a variable |c| λ = c if c ∈ C | • (t 1 , t 2 )| λ = |t 1 | λ |t 2 | λ
Definition 1.4.5 (λR-Calculus). Let R be an applicative TRS for the signature {•}∪C . The relation → βR on λ-terms is defined as follows:

• if t → β s, then t → βR s; • if (l → r ) ∈ R and σ is a substitution, then σ(|l | λ ) → βR σ(|r | λ ); • if t 1 → βR t 2 ,

Confluence

When the TRS is left-linear, the confluence is preserved when combined with βreduction, provided that it is non variable-applying. Definition 1.4.6 (Variable-Applying TRS). An applicative TRS R is variable-applying if, for some (l , r ) ∈ R, there is a subterm of l of the form •(x, t ) where x is a variable. Theorem 1.4.7 (Confluence for Left-Linear Systems [START_REF] Müller | Confluence of the Lambda Calculus with Left-Linear Algebraic Rewriting[END_REF]). Let R be a left-linear and non-variable-applying TRS.

If R is confluent, then → βR is confluent.

However, when the TRS is not left-linear, adding the β-reduction breaks the confluence in most cases.

Lemma 1.4.8 (Turing's Ω Combinator). Let A be an arbitrary type and let Z = λz : A.λx : A.x (z z x). The term Ω = Z Z is a fix-point combinator, i.e., for any term t ,

Ω t → * β t (Ω t ). Proof. Z Z t = (λz : A.λx : A.x (z z x)) Z t → 2 β t (Z Z t ).
In the following theorems, we write t u instead of •(t , u).

Theorem 1.4.9. Let R = {(minus n n → 0), (minus (S n) n → S 0)} where minus,S and 0 are constants. The relation → βR is not confluent.

Proof. We have the following reductions: Therefore, c a → * βR true and c a → * βR c true. If the relation → βR is confluent, then we have c true → βR true. We now prove that it is impossible (hence, that → βR is not confluent).

Suppose that c true → * βR true. Take the shortest reduction sequence c true → * β t → * R true such that the sequence c true → * β t is standard (i.e., the β-reduction are made from left to right). Such a sequence exists, by the standardization theorem [START_REF]Term Rewriting Systems[END_REF] and because the rule of R cannot create β-redexes.

This sequence has the following shape: c true = Ω (λx : A.λy : A.eq y (x y)) true → * β (λx : A.λy : A.eq y (x y)) c true → * β eq true (c true) → * βR true. Therefore, this sequence must contain a standard sub-sequence c true → * β t → * R true to perform the last reductions. This is impossible by assumption.

Chapter 2

The λΠ-Calculus Modulo Résumé Ce chapitre donne une nouvelle présentation du λΠ-Calcul Modulo correspondant au calcul implémenté par DEDUKTI. Cette nouvelle version améliore celle de Cousineau et Dowek de deux manières. D'abord on définit une notion de réécriture sur les termes sans aucune notion de typage. Ceci permet de rendre sa comparaison avec son implémentation plus directe. Ensuite, on explicite et on clarifie le typage des règles de réécriture.

On procède à une étude théorique précise du λΠ-Calcul Modulo. En particulier, on met en exergue les conditions qui assurent que le système de types vérifie des propriétés élémentaires telles que la préservation du typage par réduction ou l'unicité des types. Ces conditions sont la compatibilité du produit et le bon typage des règles de réécriture. Pour finir, on considère une extension du λΠ-Calcul Modulo avec du polymorphisme et des opérateurs de type que l'on appelle le Calcul des Constructions Modulo.

Introduction

The λΠ-Calculus Modulo has been introduced by Cousineau and Dowek [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF] as an extension of the λΠ-Calculus (the dependently typed λ-calculus) meant to express the proofs of Deduction Modulo [START_REF] Dowek | Theorem Proving Modulo[END_REF]. This extension features a generalized conversion rule where the congruence is extended to take into account userdefined rewrite rules. Types are not identified modulo β-conversion but modulo βR-conversion where R is a set of rewrite rules. They show that the resulting calculus, although very simple, is a very expressive logical framework [START_REF] Harper | A Framework for Defining Logics[END_REF]. It can embed, in a shallow way, that is in a way that preserves their computational content, many logics and calculus such as: functional Pure Type Systems [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF], First-Order Logic [START_REF] Dorra | Equivalence de Curry-Howard entre le lambda-Pi calcul et la logique intuitionniste[END_REF], Higher-Order Logic [START_REF] Assaf | Translating HOL to Dedukti[END_REF], the Calculus of Inductive Constructions [START_REF] Boespflug | CoqInE : Translating the calculus of inductive constructions into the λΠ-calculus modulo[END_REF], resolution and superposition proofs [START_REF] Burel | A Shallow Embedding of Resolution and Superposition Proofs into the λΠ-Calculus Modulo[END_REF], or the ς-calculus [START_REF] Cauderlier | Objects and Subtyping in the λΠ-Calculus Modulo[END_REF].

The original presentation of the λΠ-Calculus Modulo did not include any theoretical study of the calculus and gave a restricted version of it, the article being concerned on how to encode functional pure type systems in it.

In this chapter we give a new presentation of the λΠ-Calculus Modulo and we study its properties in details. This presentation differs from the original one by several aspects. Firstly, it is build upon a completely untyped notion of rewriting. Secondly, we make explicit the typing of rewrite rules and we make it iterative: rewrite x, y, z

∈ V O (Object Variable) c, f ∈ C O (Object Constant) C , F ∈ C T (Type Constant) t , u, v ::= x | c | u v | λx : U .t (Object) T ,U ,V ::= C | U v | λx : U .T | Πx : U .T (Type) K ::= Type | Πx : U .K (Kind) t , u, v ::= u | U | K | Kind (Term)
Figure 2.1: Terms of the λΠ-Calculus Modulo rules previously added are taken in account when typing new ones. All these modifications make our presentation closer to its implementation in DEDUKTI.

Terms, Contexts and Rewrite Rules

We start by defining the basic elements of our calculus and giving their syntax.

Terms

The terms of the λΠ-Calculus Modulo are the same as for the λΠ-Calculus.

Definition 2.2.1 (Terms). An object is either a variable in the set V O , or an object constant in the set C O , or an application u v where u and v are objects, or an abstraction λx : U .t where t is an object and U is a type. A type is either a type constant in the set C T , or an application U v where U is a type and v is an object, or an abstraction λx : U .V where U and V are types, or a product Πx : U .V where U and V are types.

A kind is either a product Πx : U .K where U is a type and K is a kind or the symbol Type.

A term is either an object, a type, a kind or the symbol Kind.

We write Λ for the set of terms. The sets V O , C O and C T are assumed to be infinite and pairwise disjoint. The grammars for objects, types, kinds and terms are given Figure 2.1.

We have chosen a syntactic presentation of terms that enforces the distinction between objects, types and kinds. Another approach would be to define these categories by typing: kinds are terms whose type is Kind; types have type Type and objects are terms whose type is a type. The benefit of the syntactic approach over the typed approach is that it will allow us to ensure syntactically that rewriting preserves this stratification. This will later simplify the theory of the λΠ-Calculus Modulo, in particular when confluence is not known.

Notation 2.2.2. In addition with the naming convention of

::= (u → v) | (U → V ) (Rewrite Rule) Ξ ::= R | ΞR (Batch of Rewrite Rules) Γ ::= | Γ(c : T ) | Γ(C : K ) | ΓΞ (Global

Local Contexts

As in the λΠ-Calculus, local contexts consist of typing declarations for variables.

Rewrite Rules and Global Contexts

We now define rewrite rules and global contexts, two distinctive features of the λΠ-Calculus Modulo with respect to the λΠ-Calculus.

Definition 2.2.5 (Rewrite Rules). An object-level rewrite rule is a pair of objects. A type-level rewrite rule is a pair of types. A rewrite rule is either an object-level rewrite rule or a type-level rewrite rule.

This definition is different from the one in [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF]. There, a rewrite rule is a quadruple made of two terms, a typing context and a type. The reason is that we do not use exactly the same notion of rewriting (see Definition 2.3.3).

A global context contains typing declaration for constants. They can also contain rewrite rules.

Definition 2.2.6 (Global Contexts). A global context is a list of pairs formed by an object constant with a type, pairs formed by a type constant with a kind and lists of rewrite rules. The grammar for global contexts is given Figure 2.3.

Remark that the rewrite rules are not added one by one in the context but by groups. This will have its importance for the type system (see Remark 2.4.11). Notation 2.2.7. As for local contexts, we write Γ 1 ⊂ Γ 2 if Γ 1 is a prefix of Γ 2 . We write dom(Γ) for the set {c ∈ Γ|(c : A) ∈ Γ}. If (c, A) ∈ Γ, we sometimes write Γ(c) for A.

The distinction between local and global contexts, as well as the presence of rewrite rules in the global context, are distinctive features of our presentation of the λΠ-Calculus Modulo with respect to the original one. First, Cousineau and Dowek do not distinguish between variables and constants (there are only variables). Second, we want to make explicit the role of the rewrite rules to be able to dynamically add them in a type-safe manner.

Rewriting

In the λΠ-Calculus Modulo we distinguish two kinds of rewriting.

β-Reduction

The first kind of rewriting is β-reduction, which is defined as usual.

Γ-Reduction

The second kind of rewriting is Γ-reduction, the relation generated by the rewrite rules of a global context Γ. As already mentioned, our notion of rewriting is different from the one in [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF]. In the original presentation a rewrite rule is a quadruple (∆, l , r, T ) where ∆ is a context, l and r are, respectively, the left-hand side and the right-hand side and T is their common type within the context ∆. Rewriting is defined as follows: if σ is a well-typed substitution (Definition 2.4.12) from ∆ to ∆ 2 , then σ(l ) rewrites to σ(r ) in the context ∆ 2 . Anticipating a bit, this means that rewriting and typing are two mutually defined notions. Indeed, typing depends on rewriting through the conversion rule which says that we can change the type of terms if the two types are convertible.

On the contrary, our notion of rewriting does not depend on typing. Therefore, our definition is simpler. Moreover, untyped rewriting is what is usually implemented in type checkers such as DEDUKTI. It would be completely inefficient to check the well-typedness of the substitution at each reduction step. Therefore proving the correspondence between the λΠ-Calculus Modulo and DEDUKTI will be easier. The original presentation of λΠ-Calculus Modulo is, in this respect, closely related to Martin Löf Logical Framework [START_REF] Nordström | Martin-Löf 's Type Theory[END_REF].

Of course, untyped reduction brings its own difficulties; in particular the proof of subject reduction (Theorem 2.6.22) will require additional hypotheses.

We can now prove our first lemma about rewriting, which states that rewriting respects syntactical categories.

Lemma 2.3.5 (Stratification of the Conversion). Let Γ be a global context.

• If Kind ≡ βΓ t , then t = Kind.

• If Type ≡ βΓ t , then t = Type.

• If Πx : T 1 .K 1 ≡ βΓ t , then t = Πx : T 2 .K 2 , T 1 ≡ βΓ T 2 and K 1 ≡ βΓ K 2 .
• If u ≡ βΓ v and u is an object (respectively a type), then v is an object (respectively a type).

Proof.

• By definition of rewriting, no term reduces to Kind or Type.

• Note that since Πx :

T 1 .K 1 is a kind, if t → βΓ Πx : T 1 .K 1 , then t = Πx : T 2 .K 1 or t = Πx : T 1 .K 2 with T 1 → βΓ T 2 or K 1 → βΓ K 2 respectively.
• β-reduction and Γ-reduction preserve objects, types and kinds.

Type System

We now give the typing rules of the λΠ-Calculus Modulo. We start by the typing rules for terms; then we proceed with the typing rules for local contexts. Finally, we discuss well-typedness for global contexts.

Terms

Γ; ∆ ⊢ Type : Kind (Variable) (x : A) ∈ ∆ Γ; ∆ ⊢ x : A (Constant) (c : A) ∈ Γ Γ; ∆ ⊢ c : A (Application) Γ; ∆ ⊢ t : Πx : A.B Γ; ∆ ⊢ u : A Γ; ∆ ⊢ t u : B [x/u] (Abstraction) Γ; ∆(x : A) ⊢ t : B Γ; ∆ ⊢ Πx : A.B : s Γ; ∆ ⊢ λx : A.t : Πx : A.B (Product) Γ; ∆ ⊢ A : Type Γ; ∆(x : A) ⊢ B : s Γ; ∆ ⊢ Πx : A.B : s (Conversion) Γ; ∆ ⊢ t : A Γ; ∆ ⊢ B : s A ≡ βΓ B Γ; ∆ ⊢ t : B
(Empty Local Context) Γ ⊢ ctx (Variable Declaration) Γ ⊢ ctx ∆ Γ; ∆ ⊢ U : Type x ∉ dom(∆) Γ ⊢ ctx ∆(x : U )

Local Contexts

For local contexts, the typing rules basically ensure that type declarations are welltyped. The rules are the same as for the λΠ-Calculus.

Global Contexts

Besides the new conversion relation, the main difference between the λΠ-calculus and the λΠ-Calculus Modulo is the presence of rewrite rules in global contexts. We need to take this into account when typing global contexts.

A key feature of any type system is the preservation of typing by reduction: the subject reduction property. Definition 2.4.4 (Subject Reduction). Let → r be a relation on terms. We say that a global context Γ satisfies the subject reduction property for → r if the following proposition is verified.

For any local context ∆ well-formed for Γ, terms t 1 and t 2 such that t 1 → r t 2 and term T , if Γ; ∆ ⊢ t 1 : T then Γ; ∆ ⊢ t 2 : T .

We write SR r (Γ) if Γ satisfies the subject reduction property for → r .

In the λΠ-Calculus Modulo, we cannot allow adding arbitrary rewrite rules in the context if we want to preserve subject reduction for → βΓ .

In particular, as we will see, subject reduction for the β-reduction requires the following property to hold: Definition 2.4.5 (Product Compatibility). We say that a global context Γ satisfies the product compatibility property if the following proposition is verified for any A 1 , A 2 , B 1 , B 2 and ∆:

If Γ ⊢ ctx ∆ and Γ; ∆ ⊢ Πx : A 1 .B 1 : s and Γ; ∆ ⊢ Πx : A 2 .B 2 : s and Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 , then we have A 1 ≡ βΓ A 2 and B 1 ≡ βΓ B 2 .

We write PC(Γ) when product compatibility holds for Γ.

On the other hand, subject reduction for Γ-reduction requires rewrite rules to be well-typed in the following sense: Definition 2.4.6 (Well Typed Rewrite Rules). A rewrite rule (u → v) is well-typed for a global context Γ if, for any substitution σ, any well-formed local context ∆ and any term T , if Γ; ∆ ⊢ σ(u) : T , then Γ; ∆ ⊢ σ(v) : T .

We write

Γ ⊢ u → v if (u → v) is well-typed in Γ.
The simplest way to show that a rewrite rule is well-typed is to show that it is strongly well-formed. Definition 2.4.7 (Algebraic Term). A term is algebraic if it is built from constants, variables and applications, variables do not have arguments and it is not a variable. Definition 2.4.8 (Strongly Well-Formed Rewrite Rule). Let Γ be a global context such that → βΓ is confluent. A rewrite rule (u → v) is strongly-well-formed in Γ if u is algebraic and, for some local context ∆ and term T , we have:

• dom(∆) = FV (u), • Γ ⊢ ctx ∆, • Γ; ∆ ⊢ u : T and • Γ; ∆ ⊢ v : T We write Γ ⊢ str u → v if (u → v) is strongly well-formed in Γ.
We can now define the notion of well-typed global context. Contrary to terms and local contexts, we give an axiomatic definition and not an inductive definition based on inference rules. The reason is that there is not one obvious set of inference rules for this notion. In fact, in this thesis, we define different notions of well-formed global contexts based on different sets of inference rules. Each time, we prove that well-formed global contexts are well-typed.

Definition 2.4.9 (Well-Typed Global Contexts). A global context Γ is well-typed if:

• (Well-Typed Declarations) for all (c : T ) ∈ Γ, we have Γ; ⊢ T : s, for some sort s;

• (Product Compatibility) Γ satisfies the product compatibility property;

• (Well-Typed Rewrite Rules) for all (u → v) ∈ Γ, we have Γ ⊢ u → v.
It is not obvious how to check that product compatibility and well-typedness of rewrite rules hold. In fact they are undecidable properties (Section 2.6.6 and Section 3.7.5) and an important part of this thesis is dedicated to finding sufficient criteria for them to hold. For instance criteria for typing of rewrite rules are given in Chapter 3 and criteria for product compatibility are given in Chapter 4 and Chapter 5.

We now give a first notion of well-formed global context using inference rules: strongly well-formed global contexts.

Definition 2.4.10 (Strongly Well-Formed Global Context). A global context is strongly well-formed if the judgment Γ swf is derivable by the inference rules of Figure 2.6.

In Section 2.6.3, we will prove that strongly well-formed global contexts are welltyped.

Remark 2.4.11. The rule (Rewrite Rules) allows adding several rewrite rules at once. On the one hand, only the confluence of the whole system is required (and not the confluence after adding each rewrite rule). On the other hand, the rewrite rules must be shown strongly well-typed independently from the other rules added at the same time ( i.e. in Γ and not in ΓΞ).

Substitutions

Definition 2.4.12 (Well-typed substitution).

A substitution σ is well-typed from ∆ 1 to ∆ 2 in Γ, written σ : ∆ 1 Γ ∆ 2 if, for all x ∈ dom(∆ 1 ), we have Γ; ∆ 2 ⊢ σ(x) : σ(∆ 1 (x)).

Examples

We give simple examples of strongly well-formed global contexts.

(Empty Global Context) swf (Object Declaration) Γ swf Γ; ⊢ U : Type c ∉ dom(Γ) Γ(c : U ) swf (Type Declaration) Γ swf Γ; ⊢ K : Kind C ∉ dom(Γ) Γ(C : K ) swf (Rewrite Rules) Γ swf → βΓΞ is confluent (∀i )Γ ⊢ str u i → v i Ξ = (u 1 → v 1 ) . . . (u n → v n ) ΓΞ swf

Arithmetic Operations on Peano Integers

Addition and multiplication on Peano integers are easily expressed in the λΠ-Calculus Modulo. We use parentheses in terms in the usual way. We begin by the definition of Peano integers using three declarations of constants.

nat : Type. 0 : nat. S : nat -→ nat.

For readability, we will write k instead k times S (S . . . (S 0)).

We now declare a constant for the addition and we add rewrite rules related to it. We use italics to distinguish variables.

plus : nat -→ nat -→ nat. plus 0 n → n. plus (S n 1 ) n 2 → S (plus n 1 n 2 ).
We do the same thing for the multiplication.

mult : nat -→ nat -→ nat. mult 0 n → 0. mult (S n 1 ) n 2 → plus n 2 (mult n 1 n 2 ).
Then we add a weak form of equality (only convertible terms are equal).

eq : nat -→ nat -→ Type. refl : Πn : nat.eq n n.

The term refl 4 has type eq (plus 2 2) 4. We have just proved that 2 + 2 = 4!

The rewrite system we have defined so far is orthogonal (it is left-linear and there are no critical pairs between the rewrite rules); this is not mandatory. For instance, it is possible to complete the definition of plus with the following rewrite rules that are symmetric to the previous ones:

plus n 0 → n. plus n 1 (S n 2 ) → S (plus n 1 n 2 ).
Other rewrite rules we might want to consider are rules for associativity and commutativity of the addition:

plus n 1 (plus n 2 n 3 ) → plus (plus n 1 n 2 ) n 3 . plus n 1 n 2 → plus n 2 n 1 .
By 1.4.7, the rewrite system, although not orthogonal, is still confluent; therefore the context is still strongly well-formed. However, the last rewrite rule is obviously not terminating. We usually do not consider non-terminating rewrite rules as they make type checking undecidable.

The Map Function on Lists

Let us define the type of lists of integers.

list : Type. nil : list. cons : nat -→ list -→ list.
The function map allows applying a function to every element of a list.

map : (nat -→ nat) -→ list -→ list. map f nil → nil. map f (cons hd tl) → cons ( f hd) (map f tl).
For instance, we can use this function to increment the elements of a list by a constant.

map (plus 3) (cons 1 (cons 2 (cons 3 nil))) → * βΓ cons 4 (cons 5 (cons 6 nil))

Addition on Brouwer's Ordinals

We now define addition on Brouwer's ordinals:

ord : Type. o_0 : ord. o_S : ord -→ ord. lim : (nat -→ ord) -→ ord. o_plus : ord -→ ord -→ ord. o_plus o_0 x → x. o_plus (o_S x) y → o_S (o_plus x y). o_plus (lim f ) y → lim (λx : nat.o_plus ( f x) y).

Properties

In this section we give some meta-theoretical results about the λΠ-Calculus Modulo. We start by basic lemmas, and then we prove more interesting properties about well-typed and strongly well-formed contexts, subject reduction and uniqueness of types. Then, we show the undecidability of subject reduction and uniqueness of types.

Basic Properties

This subsection gathers technical lemmas about the λΠ-Calculus Modulo.

Lemma 2.6.1 (Inversion). If Γ; ∆ ⊢ t : T then

• either t = Type and T = Kind;

• or t = x and there exists A such that (x : A) ∈ ∆ and T ≡ βΓ A;

• or t = c and there exists A such that (c : A) ∈ Γ and T ≡ βΓ A;

• or t = f u and there exist A and B such that Γ; ∆ ⊢ f : Πx : A.B and Γ; ∆ ⊢ u : A and T ≡ βΓ B [x/u];

• or t = λx : A.t and there exist B and a sort s such that Γ; ∆ ⊢ Πx : A.B : s and Γ; ∆(x : A) ⊢ t : B and T ≡ βΓ Πx : A.B ;

• or t = Πx : A.B and there exists a sort s such that Γ; ∆ ⊢ A : Type and Γ; ∆(x : A) ⊢ B : s and T = s.

Proof. By induction on the typing derivation and Lemma 2.3.5.

Lemma 2.6.2. No term containing Kind is typable.

Proof. By induction on the typing derivation, we have that, if t typable, then Kind ∉ t .

Lemma 2.6.3. Every sub-term of a well-typed term is well-typed.

Proof. By induction on the typing derivation.

Lemma 2.6.4 (Local Weakening). Let ∆ 1 and ∆ 2 be two local contexts. Assume that

∆ 1 is a subset of ∆ 2 . If Γ; ∆ 1 ⊢ t : T , then Γ; ∆ 2 ⊢ t : T .
Proof. By induction on the typing derivation.

Lemma 2.6.5 (Global Weakening). If Γ; ∆ ⊢ t : T and Γ 2 ⊃ Γ, then Γ 2 ; ∆ ⊢ t : T .

Proof. By induction on the typing derivation.

Lemma 2.6.6 (Inversion for

⊢ ctx ). If Γ ⊢ ctx ∆(x : A), then Γ ⊢ ctx ∆ and Γ; ∆ ⊢ A : Type.
Proof. By induction on the typing derivation.

Lemma 2.6.7 (Well-Typed Local Declaration). If Γ ⊢ ctx ∆ and (x : A) ∈ ∆, then Γ; ∆ ⊢ A : Type.

Proof. By induction on the typing derivation and local weakening (Lemma 2.6.4).

Lemma 2.6.8. Let Γ a global context. Suppose that ∆ 1 and ∆ 2 are two local contexts such that

∆ 1 ≡ βΓ ∆ 2 and Γ ⊢ ctx ∆ 1 . If Γ; ∆ 1 ⊢ t : T , then Γ; ∆ 2 ⊢ t : T .
Proof. We prove that, for all local context Σ, if Γ; ∆ 1 Σ ⊢ t : T , then Γ; ∆ 2 Σ ⊢ t : T . We proceed by induction on the pair ( ∆ 1 , derivation of Γ; ∆ 1 Σ ⊢ t : T ) ordered lexicographically.

• Cases (Sort) and (Constant). Trivial.

• Case (Variable):

-if t = x ∈ dom(Σ) then Γ; ∆ 2 Σ ⊢ t : T ; -if t = x ∈ dom(∆ 1 ) then (x : T ) ∈ ∆ 1 and, therefore T ≡ βΓ T 2 , for some T 2 such that (x : T 2 ) ∈ ∆ 2 . Since ∆ 1 is well-formed, there is a well-formed (strict) prefix Ξ 1 of ∆ 1 such that Γ; Ξ 1 ⊢ T : Type. By induction hypothesis on Ξ 1 , we have Γ; Ξ 2 ⊢ T : Type, where Ξ 2 is the prefix of ∆ 2 such that Ξ 1 ≡ βΓ Ξ 2 .
By local weakening (Lemma 2.6.4), Γ; ∆ 2 ⊢ T : Type. It follows, by the conversion rule, that Γ; ∆ 2 ⊢ x : T .

• Cases (Application), (Abstraction), (Product), (Conversion). By induction hypothesis.

Lemma 2.6.9. Let Γ be a global context whose declarations are closed.

If σ : ∆ 1 Γ ∆ 2 and Γ; ∆ 1 ⊢ t : T , then Γ; ∆ 2 ⊢ σ(t ) : σ(T ).
Proof. By induction on the typing derivation.

• (Sort) Trivial.

• (Variable) By hypothesis.

• (Constant) Trivial, since global declarations are closed.

• (Application), (Abstraction), (Product), (Conversion) By induction hypothesis.

Lemma 2.6.10 (Stratification). Let Γ be a global context whose declarations are welltyped.

If Γ ⊢ ctx ∆ and Γ; ∆ ⊢ t : T , then

• either t is an object, T is a type and Γ; ∆ ⊢ T : Type

• or t is a type, T is a kind and Γ; ∆ ⊢ T : Kind

• or t is a kind and T = Kind.

Proof. By induction on the typing derivation.

• (Sort) Trivial.

• (Variable) By well-typedness of local declarations (Lemma 2.6.7).

• (Constant) By hypothesis.

• (Application) If t = uv, then T = B [x\v], Γ; ∆ ⊢ u : Πx : A.B and Γ; ∆ ⊢ v : A.
If t is an object, then u is an object and, by induction hypothesis, Πx : A.B is a type and Γ; ∆ ⊢ Πx : A.B : Type. It follows that B and B [x/u] are also types. By inversion (Lemma 2.6.1), Γ; ∆(x : A) ⊢ B : Type and Γ; ∆ ⊢ A : Type. Finally, by the property of well-typed substitutions (Lemma 2.6.9), Γ; ∆ ⊢ B [x/v] : Type.

If t is a type, then u is a type and a similar reasoning applies.

• (Abstraction) If t = λx : A.u, then T = Πx : A.B , Γ; ∆(x : A) ⊢ u : B and Γ; ∆ ⊢ Πx : A.B : s.
If t is an object, then u is an object and, by induction hypothesis, B is a type. It follows that Πx : A.B is a type and, by induction hypothesis, Γ; ∆ ⊢ s : Kind. Thus, s = Type.

If t is a type, then u is a type and, by induction hypothesis, B is a kind. It follows that Πx : A.B is a kind and, by induction hypothesis, s = Kind.

• (Product) If t = Πx : A.B , then T = s, Γ; ∆ ⊢ A : Type and Γ; ∆(x : A) ⊢ B : s.
If B is a type (respectively kind), then Πx : A.B is a type (respectively kind) and, by induction hypothesis, s = Type (respectively s = Kind).

• (Conversion) If Γ; ∆ ⊢ t : A, then Γ; ∆ ⊢ T : s and A ≡ βΓ T .
If t is an object, then by induction hypothesis, A is a type and Γ; ∆ ⊢ A : Type.

Since A ≡ βΓ T , by Lemma 2.3.5, T is also a type. Therefore, by induction hypothesis, s is a kind. Hence, s = Type.

If t is a type, then by induction hypothesis, A is a kind and Γ; ∆ ⊢ A : Kind.

Since A ≡ βΓ T , by Lemma 2.3.5, T is also a kind. Therefore, by induction hypothesis, s = Kind.

If t is a kind, then by induction hypothesis, A = Kind. Since A ≡ βΓ T , by Lemma 2.3.5, T = Kind.

Product Compatibility

The usual way to prove product compatibility is by showing the confluence of the rewrite system.

Theorem 2.6.11 (Product Compatibility from Confluence). Let Γ be a global context. If → βΓ is confluent, then product compatibility holds for Γ.

Proof. Assume that

Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 then, by confluence, there exist A 0 and B 0 such that A 1 → * βΓ A 0 , A 2 → * βΓ A 0 , B 1 → * βΓ B 0 and B 2 → * βΓ B 0 . It follows that A 1 ≡ βΓ A 2 and B 1 ≡ βΓ B 2 .
Section 1.4 provides several criteria for proving confluence of → βΓ . Moreover, product compatibility cannot be lost by adding object constants in the global context. Lemma 2.6.12. Let Γ be a well-typed global context. If Γ; ⊢ U : Type, then product compatibility holds for Γ(c : U ).

Proof. Suppose that

Πx : A 1 .B 1 ≡ β(Γ(c:U )) Πx : A 2 .B 2 , Γ(c : U ); ∆ ⊢ Πx : A 1 .B 1 : s 1 and Γ(c : U ); ∆ ⊢ Πx : A 2 .B 2 : s 2 .
Then we have, for a fresh variable z, (Πx :

A 1 .B 1 )[c/z] ≡ βΓ (Πx : A 2 .B 2 )[c/z], Γ; (z : U )∆[c/z] ⊢ (Πx : A 1 .B 1 )[c/z] : s 1 and Γ; (z : U )∆[c/z] ⊢ (Πx : A 2 .B 2 )[c/z] : s 2 .
By product compatibility for Γ, we have

A 1 [c/z] ≡ βΓ A 2 [c/z] and B 1 [c/z] ≡ βΓ B 2 [c/z]. It follows that A 1 ≡ β(Γ(c:U )) A 2 and B 1 ≡ β(Γ(c:U )) B 2 .
Because type variables do not exist in the λΠ-Calculus Modulo, the proof of the lemma above does not work for type declarations.

However, we conjecture that the result holds nonetheless for type declarations.

Conjecture 2.6.13. Let Γ be a well-typed global context. If Γ; ⊢ C : Kind, then product compatibility holds for Γ(C : K ).

Strongly Well-Formed Global Contexts

In this section, we prove that strongly well-formed global contexts are well-typed, opening the road to an iterative way to check well-typedness of global contexts.

Lemma 2.6.14 (Well-typed Global Declarations). If Γ is a strongly well-formed global context, then, for all (c : A) ∈ Γ, we have Γ; ⊢ A : s, for some sort s.

Proof. By induction on the derivation of Γ swf and global weakening (Lemma 2.6.5).

Lemma 2.6.15 (Product Compatibility). Product compatibility holds for strongly wellformed global contexts.

Proof. By induction on the derivation of Γ swf, we have that → βΓ is confluent. Therefore, Theorem 2.6.11 applies.

A rewrite rule that remains well-typed in all possible extensions of the global context Γ is called permanently well-typed in Γ.

Definition 2.6.16 (Permanently Well-Typed Rewrite Rules). A rewrite rule is permanently well-typed in Γ if it is well-typed for any well-typed extension Γ 0 ⊃ Γ.

The notion of permanently well-typed rewrite rule makes possible to type-check rewrite rules once and for all and not each time we make new declarations or add other rewrite rules in the context.

We will see in Chapter 3 that not all well-typed rewrite rules are permanently well-typed.

Remark 2.6.17. If a rewrite rule is permanently well-typed in Γ, then it is also permanently well-typed in any extension of Γ.

Strongly well-formed rewrite rules are permanently well-typed.

Lemma 2.6.18. Let Γ be a well-typed global context and (u → v) be a rewrite rule. If (u → v) is strongly well-formed in Γ, then it is permanently well-typed in Γ.

Proof. See Theorem 3.2.1.

We are now able to prove that strongly well-formed global contexts are welltyped.

Theorem 2.6.19. If Γ is a strongly well-formed global context, then it is well-typed.

Proof. We already know that global declarations are well-typed (Lemma 2.6.14) and that product compatibility holds (Lemma 2.6.15).

We prove, by induction on the derivation of Γ swf, that the rewrite rules in Γ are permanently well-typed.

• (Empty Global Context) Trivial.

• (Object Declaration), (Type Declaration) By Remark 2.6.17.

• (Rewrite Rules) By Remark 2.6.17, Lemma 2.6.18 and induction hypothesis.

Subject Reduction

The subject reduction property (also called type preservation property) is a key property of a type system. It basically says that reduction preserves typing and it implies that the set of well-typed terms is closed by reduction. It is the very purpose of a type system to capture an information (the type) that is invariant by computation (reduction). Therefore, a type system that does not satisfy such property is not interesting. In particular, one cannot hope to use it to prove dynamic properties such as termination.

We claimed in the previous sections that subject reduction for → β follows from product compatibility. We now prove it.

Lemma 2.6.20 (Subject Reduction for → β ). Let Γ be a global context satisfying welltypedness of rewrite rules and product compatibility and let ∆ be a local context wellformed for Γ.

If Γ; ∆ ⊢ t 1 : T and t 1 → β t 2 , then Γ; ∆ ⊢ t 2 : T .

Proof. We proceed by induction on Γ; ∆ ⊢ t 1 : T .

• (Sort), (Constant), (Variable). Impossible.

• (Application). t 1 = u 1 v 1 and there exist A and B such that Γ; ∆ ⊢ u 1 : Πx :

A 1 .B 1 , Γ; ∆ ⊢ v 1 : A 1 and T = B 1 [x/v 1 ]. -If u 1 = (λx : A 2 .u 0 ) and t 2 = u 0 [x/v 1 ] then, by inversion (Lemma 2.6.1), Γ; ∆ ⊢ A 2 : Type, Γ; ∆(x : A 2 ) ⊢ u 0 : B 2 and Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 .
By product compatibility, A 1 ≡ βΓ A 2 and B 1 ≡ βΓ B 2 . Therefore, we have Γ; ∆ ⊢ v 1 : A 2 and, by the property of well-typed substitutions (Lemma 2.6.9), we have

Γ; ∆ ⊢ u 0 [x/v 1 ] : B 2 [x/v 1 ]
. Finally, since, by stratification (Lemma 2.6.10), T is well-typed and

T ≡ βΓ B 2 [x/v 1 ], we have Γ; ∆ ⊢ u 0 [x/v 1 ] : T . -If t 2 = u 2 v 1 with u 1 → β u 2 ,
then the induction hypothesis applies.

-If t 2 = u 1 v 2 with v 1 → β v 2 then, using the induction hypothesis, we get Γ; ∆ ⊢ t 2 : B 1 [x/v 2 ]
. By Lemma 2.6.10, Γ; ∆ ⊢ T : s. Therefore, using the conversion rule, we have Γ; ∆ ⊢ t 2 : T .

• (Abstraction). t 1 = λx : A 1 .u 1 and there is B such that Γ; ∆ ⊢ A 1 : Type, Γ; ∆(x : A 1 ) ⊢ u 1 : B , and • (Product). t 1 = Πx : A 1 .B 1 and we have Γ; ∆ ⊢ A 1 : Type and Γ; ∆(x : A 1 ) ⊢ B 1 : s, for some sort s.

T = Πx : A.B . -If t 2 = λx : A 1 .u 2 with u 1 → β u 2 , then, by induction hypothesis, Γ; ∆(x : A 1 ) ⊢ u 2 : B and therefore Γ; ∆ ⊢ λx : A 1 .u 2 : Πx : A 1 .B . -If t 2 = λx : A 2 .u 1 with A 1 → β A 2 ,
-If t 2 = Πx : A 1 .B 2 with B 1 → β B 2
, then, by induction hypothesis, we have Γ; ∆(x : A 1 ) ⊢ B 2 : s and therefore Γ; ∆ ⊢ t 2 : s.

-If t 2 = Πx : A 2 .B 1 with A 1 → β A 2 ,

• (Conversion). By induction hypothesis.

Subject reduction for → Γ directly follows from well-typedness of rewrite rules.

Lemma 2.6.21 (Subject Reduction for → Γ ). Let Γ be a global context satisfying welltypedness of declarations and well-typedness of rewrite rules and let ∆ be a local context well-formed for Γ.

If Γ; ∆ ⊢ t 1 : T and t 1 → Γ t 2 , then Γ; ∆ ⊢ t 2 : T .

Proof. Same proof as for Lemma 2.6.20. Remark that product compatibility is not needed, since we do not need to consider β-redexes. However, well-typedness of rewrite rules is needed to deal with Γ-redexes.

From the lemma above, one can deduce that product compatibility is not necessary to prove subject reduction for → Γ . This is not quite true since one cannot expect to prove that a (dependently typed) rewrite rule is well-typed without product compatibility (see the proof of Lemma 2.6.18).

Theorem 2.6.22 (Subject Reduction). Let Γ be a well-typed global context and ∆ a local context well-formed for Γ.

If Γ; ∆ ⊢ t 1 : T and t 1 → βΓ t 2 , then Γ; ∆ ⊢ t 2 : T .

Proof. It follows from Lemma 2.6.20 and Lemma 2.6.21.

Corollary 2.6.23. Subject reduction holds for strongly well-formed global contexts.

Proof. By Theorem 2.6.22, since strongly well-formed global contexts are well-typed (Theorem 2.6.19).

Uniqueness of Types

Uniqueness of types is another key property of the λΠ-Calculus Modulo. It states that all the types of a given term are convertible. An important application of this is that type checking can be reduced to type inference and a convertibility check.

Definition 2.6.24 (Uniqueness of Types). The property of uniqueness of types for a global context Γ, written UT(Γ), is the following proposition.

For any terms t , T 1 ,

T 2 and local context ∆, if Γ ⊢ ctx ∆ and Γ; ∆ ⊢ t : T 1 and Γ; ∆ ⊢ t : T 2 , then T 1 ≡ βΓ T 2 .
Theorem 2.6.25. If Γ is a well-typed global context, then it satisfies the uniqueness of types property.

Proof. By induction on the first typing derivation.

• (Sort), (Variable), (Constant) By inversion on the second typing derivation.

• (Application) Suppose that t = uv, Γ; ∆ ⊢ u : Πx : A 1 .B 1 , Γ; ∆ ⊢ v : A 1 and T 1 = B 1 [x/v]
. By inversion on the second typing derivation, Γ; ∆ ⊢ u : Πx :

A 2 .B 2 , Γ; ∆ ⊢ v : A 2 and T 2 ≡ βΓ B 2 [x/v].

By induction hypothesis, we have

Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 . By product compatibility, B 1 ≡ βΓ B 2 . Therefore, T 1 = B 1 [x/v] ≡ βΓ B 2 [x/v] ≡ βΓ T 2 .
• (Abstraction) By inversion on the second typing derivation and induction hypothesis.

• (Product) By inversion on the second typing derivation, induction hypothesis and Lemma 2.3.5.

• (Conversion) By induction hypothesis.

Remark 2.6.26. We have also shown that the (Conversion) rule commutes with the other inference rules.

Corollary 2.6.27. Uniqueness of types holds for strongly well-formed global contexts.

Proof. By Theorem 2.6.25, since strongly well-formed global contexts are well-typed (Theorem 2.6.19).

Undecidability Results

We have seen that subject reduction (for → β ) and uniqueness of types are key properties of the λΠ-Calculus Modulo and that they follow from product compatibility. We study in this section the exact relation between these properties and show that one cannot decide in general if they hold for a particular global context.

Product Compatibility from Subject Reduction for → β

Lemma 2.6.20 shows that product compatibility implies subject reduction for → β .

In this section we show that these properties are in fact equivalent. First we prove that product compatibility always holds for non-dependent products.

Lemma 2.6.28 (Non-Dependent Product Compatibility). Let Γ be a global context whose declarations are well-typed and satisfying the subject reduction property for β.

If Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 , Γ ⊢ ctx ∆, Γ; ∆ ⊢ Πx : A 1 .B 1 : s 1 , Γ; ∆ ⊢ Πx : A 2 .

PC(Γ) ⇐⇒ SR β (Γ)

Proof. We already know that product compatibility implies subject reduction for β (Lemma 2.6.20). We now prove the converse. Assume that Γ ⊢ ctx ∆, Γ; ∆ ⊢ Πx : A 1 .B 1 : s 1 , Γ; ∆ ⊢ Πx : A 2 .B 2 : s 2 and Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 . By stratification (Lemma 2.3.5 and Lemma 2.6.10), s 1 = s 2 . If s 1 = s 2 = Kind then Lemma 2.3.5 applies. Otherwise, s 1 = s 2 = Type.

• From Γ; ∆(a : A 2 )( f : Πx : A 1 .B 1 ) ⊢ (λx : A 1 . f ((λy : A 1 .y)x))a : B 2 [x/a]
A 1 ≡ βΓ A 2 . • From Γ; ∆(x : A 2 )( f : Πx : A 1 .B 1 ) ⊢ (λy : A 1 .((λz : B 1 [x/y].z)( f y)))x : B 2 , we deduce, by subject reduction, Γ; ∆(x : A 2 )( f : Πx : A 1 .B 1 ) ⊢ (λz : B 1 .z)( f x) : B 2 .
By Corollary 2.6.29, we have

B 1 ≡ βΓ B 2 .
As a corollary, we get that subject reduction implies uniqueness of types.

Corollary 2.6.31. Let Γ a global context whose declarations are well-typed.

SR β (Γ) =⇒ UT(Γ)
Proof. Remark that, in the proof of Theorem 2.6.25, we only need product compatibility. Therefore, since subject reduction for β implies product compatibility (Lemma 2.6.30), it also implies uniqueness of types.

Right Product Compatibility from Uniqueness of Type

Product compatibility implies uniqueness of types (Theorem 2.6.25). The converse is not true. In fact, uniqueness of types is equivalent to a restricted notion of product compatibility that we call right product compatibility.

R-PC(Γ) ⇐⇒ UT(Γ)

Proof.

• To prove that right product compatibility implies uniqueness of types, it suffices to adapt Theorem 2.6.25. Remark that, in the proof, we do not need full product compatibility. Indeed, from A 1 ≡ βΓ A 2 (induction hypothesis) and Πx :

A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 , we can deduce that Πx : A 1 .B 1 ≡ βΓ Πx : A 1 .B 2 .
Then, by right product compatibility, we have B 1 ≡ βΓ B 2 .

• We now prove that uniqueness of types implies right product compatibility. Assume that Γ; ∆ ⊢ Πx : A.B 1 : s 1 , Γ; ∆ ⊢ Πx : A.B 2 : s 2 and Πx : A.B 1 ≡ βΓ Πx : A.B 2 . By Lemma 2.3.5 and Lemma 2.6.10, s 1 = s 2 .

-If s 1 = s 2 = Kind, then Lemma 2.3.5 applies.

-If s 1 = s 2 = Type, then we have Γ; ∆( f :

Πx : A.B 1 )(x : A) ⊢ f x : B 1 , Γ; ∆( f : Πx : A.B 1 )(x : A) ⊢ f : Πx : A.B 2 and therefore Γ; ∆( f : Πx : A.B 1 )(x : A) ⊢ f x : B 2 .
By uniqueness of types, we deduce B 1 ≡ βΓ B 2 .

Undecidability of (Right) Product Compatibility

In this section we prove that product compatibility and right product compatibility are undecidable properties. Therefore, subject reduction and uniqueness of types are also undecidable. This is not really surprising; product compatibility has a lot to do with confluence and confluence is already undecidable for (first-order) term rewriting systems. Indeed, we adapt the proof of undecidability for confluence found in [START_REF]Term Rewriting Systems[END_REF] to product compatibility. We will reduce the following word problem to both product compatibility and right product compatibility.

Theorem 2.6.35 (Matijasevitch [START_REF] Matijasevich | Simple Examples of Undecidable Associative Calculi[END_REF]). The equality relation on words over the alphabet {a, b} generated from the set of equations E of Figure 2 Finally, to get Γ p for a given pair p = (w 1 , w 2 ), we add two type declarations and two rewrite rules:

B : Word -→ Type. T : Type. T → Word -→ B |w 1 |. T → Word -→ B |w 2 |.
First we prove that, if w 1 = E w 2 , then (right) product compatibility holds for Γ (write Γ for Γ p ). By Theorem 2.6.11, it suffices to prove that the reduction is confluent, and since → Γ is orthogonal to → β , by Theorem 1.4.7, it suffices to prove that → Γ is confluent. Suppose that t 0 → * Γ t 1 and t 0 → * Γ t 2 . Then t 0 = C [T, . . . , T ] where C is a multi context that does not contain T ,

t 1 = C 1 [U 1 , . . . ,U n ] with C → * Γ C 1 (without using a T -rule) and T → * βΓ U i and t 2 = C 2 [V 1 , . . . ,V n ] with C → * Γ C 2 (without using a T -rule) and T → * βΓ V i .
Since all rewrite rules except the rules on T are reversible, we have

C 1 → * βΓ C , C 2 → * βΓ C , |w 1 | → * βΓ |w 2 | and, for all i , U i → * βΓ Word -→ B |w 2 | and V i → * βΓ Word -→ B |w 2 |. It follows that both t 1 and t 2 reduce to C [Word -→ B |w 2 |, . . . , Word -→ B |w 2 |].
Now, we prove that, if (right) product compatibility holds for Γ, then

w 1 = E w 2 . Since Word -→ B |w 1 | ← T → Word -→ B |w 2 |,

Applications

As already said, the main purpose of the λΠ-Calculus Modulo is to serve as a logical framework, that is, a framework in which we express other logics or calculus by encoding them. The λΠ-Calculus has also been used with success for the same purpose [HHP93, CHJ + 12]. The advantage of the λΠ-Calculus Modulo is that, thanks to its extended notion of rewriting, it allows designing shallow encodings. The term shallow has been used in the literature as an informal term meaning that an encoding reuses the target language features to encode the corresponding features in the source language. In particular, if there exists a notion of computation in the encoded language, we want to preserve it by the translation. More concretely, a reduction step in the source language should correspond to one or more β (Γ)-reduction steps in the λΠ-Calculus (Modulo). Another example: if there is a notion of judgment in the source language, as in typed λ-calculi or in natural deduction, then we want to link this notion to the typing judgments of the λΠ-Calculus (Modulo). An encoding that is not shallow is deep.

In this section, we illustrate the use of the λΠ-Calculus Modulo by giving shallow encodings for various logics and calculus. We proceed in the same way for each example; first we define a global context declaring the constants and rewrite rules used by the encoding; then we explain how we encode the elements of the source language (depending on the encoded system these are terms, propositions and/or proofs); finally we prove theorems formalizing the correspondence between the initial system and the encoding.

(True) Ξ ⊢ Σ ⊤ P ∈ Ξ (Axiom) Ξ ⊢ Σ P Ξ, P ⊢ Σ Q ( =⇒ -intro) Ξ ⊢ Σ P =⇒ Q Ξ ⊢ Σ P =⇒ Q Ξ ⊢ Σ P ( =⇒ -elim) Ξ ⊢ Σ Q Ξ ⊢ Σ P Ξ ⊢ Σ Q (∧-intro) Ξ ⊢ Σ P ∧Q Ξ ⊢ Σ P ∧Q (Left-∧-elim) Ξ ⊢ Σ P Ξ ⊢ Σ P ∧Q (Right-∧-elim) Ξ ⊢ Σ Q Ξ ⊢ Σ P (Left-∨-intro) Ξ ⊢ Σ P ∨Q Ξ ⊢ Σ Q (Right-∨-intro) Ξ ⊢ Σ P ∨Q Ξ ⊢ Σ P ∨Q Ξ ⊢ Σ P =⇒ R Ξ ⊢ Σ Q =⇒ R (∨-elim) Ξ ⊢ Σ R Ξ ⊢ Σ P x ∉ Ξ (∀-intro) Ξ ⊢ Σ ∀x.P Ξ ⊢ Σ ∀x.P (∀-elim) Ξ ⊢ Σ P [x/t ] Ξ ⊢ Σ P [x/t ] (∃-intro) Ξ ⊢ Σ ∃x.P Ξ ⊢ Σ ∃x.P Ξ ⊢ Σ P =⇒ Q x ∉ Ξ,Q (∃-elim) Ξ ⊢ Σ Q Figure 2.

8: Inference rules of Constructive Predicate Logic

A proof of the implication imp P Q is a function from the proofs of P to the proofs of Q:

prf (imp P Q) → prf P -→ prf Q.
A proof of a universally quantified formula forall P is a function mapping an x of type term to a proof of P (x):

prf (forall P ) → Πx : term.prf (P x).

A proof of the universally valid proposition is the identity function:

prf true → ΠP : prop.prf P -→ prf P.
A proof of the absurd proposition is a function giving a proof for any proposition:

prf false → ΠP : prop.(prf P ).
A proof of the conjunction and P 1 P 2 is a function from the proofs that P 1 implies P 2 implies Q to the proofs of Q: prf (and

P 1 P 2 ) → ΠQ : prop.prf (imp P 1 (imp P 2 Q)) -→ prf Q.
A proof of the disjunction or P 1 P 2 is a function building a proof of Q from a proof that P 1 implies Q and a proof that P 2 implies Q:

prf (or P 1 P 2 ) → ΠQ : prop.prf (imp P 1 Q) -→ prf (imp P 2 Q) -→ prf Q.
A proof of the existentially quantified formula exists P is a function building a proof of Q from a proof that P x implies Q for some x: prf (exists P ) → ΠQ : prop.(Πx : term.prf (imp (P x) Q)) -→ prf Q.

Embedding

Let Γ F O be the global context defined in the previous section. Definition 2.7.4 (Embedding of Signatures). If Σ is a signature, then the global context Γ(Σ) is obtained from Γ F O by adding the following declarations:

• for each function symbol f of arity n, we declare a variable ḟ of type term n -→ term;

• for each predicate symbol P of arity n, we declare a variable Ṗ of type term n -→ prop.

We write Γ instead of Γ(Σ) when no confusion is possible.

Lemma 2.7.5. Γ(Σ) is a strongly well-formed global context.

Proof. Trivial.

The propositions of the constructive predicate logic are translated into λΠ-terms using the following function. Remark 2.7.9. Let Ξ be a set of proposition and x 1 , . . . , x n be the variables occurring free in Ξ. The local context (x 1 : term)...(x n : term) |Ξ| is well-formed in Γ(Σ).

Soundness and Conservativity

We have the following correspondences between the proofs in constructive predicate logic and the typing judgments for the context Γ in the λΠ-Calculus Modulo. Proof. We proceed by induction on the proof of the sequent Ξ ⊢ Σ |P |. We write Γ for Γ(Σ) and V P for (x 1 : term)...(x n : term), where x 1 , . . . , x n are the variables free in P but not occurring in Ξ. Proof. We write Γ for Γ(Σ). By Lemma 2.7.11 and subject reduction Theorem 2.6.22, we can assume that π is normal.

We proceed by induction on π. Remark that π is an object.

• π cannot be a constant or an application headed by a constant, since objectlevel constant have type prop or T -→ prop, for some T .

• Suppose that π = λx : U .u. By inversion, Γ; ∆(x : U ) ⊢ u : V and |P | ≡ βΓ Πx : U .V .

-If P = ⊤, then P is provable.

- By induction hypothesis, Ξ, A ⊢ Σ B is provable.

If P = ⊥,
Therefore, Ξ ⊢ Σ A =⇒ B is provable.

-

If P = A ∧ B ,

By induction hypothesis, Ξ ⊢

Σ∪{x} (A =⇒ B =⇒ x) =⇒ x. Substituting x by A ∧ B , we get Ξ ⊢ Σ (A =⇒ B =⇒ (A ∧ B )) =⇒ (A ∧ B ). Since Ξ ⊢ Σ A =⇒ B =⇒ (A ∧ B ) is provable, Ξ ⊢ Σ A ∧ B is also provable. -If P = A ∨ B , then |P | ≡ βΓ Πx : prop.|(A =⇒ x) =⇒ (B =⇒ x) =⇒ x|.
By product compatibility, we have U ≡ βΓ prop and

V ≡ βΓ |(A =⇒ x) =⇒ (B =⇒ x) =⇒ x|.
Therefore, we have Γ; ∆(x : prop) ⊢ u :

|(A =⇒ x) =⇒ (B =⇒ x) =⇒ x|.
By Lemma 2.7.13, we have

Γ(Σ ∪ {x}); ∆ ⊢ u : |(A =⇒ x) =⇒ (B =⇒ x) =⇒ x|. By induction hypothesis, Ξ ⊢ Σ∪{x} (A =⇒ x) =⇒ (B =⇒ x) =⇒ x. Substituting x by A ∨ B , we get Ξ ⊢ Σ (A =⇒ (A ∨ B )) =⇒ (B =⇒ (A ∨ B )) =⇒ (A ∨ B ). Since (A =⇒ (A ∨B )) and (B =⇒ (A ∨B )) are provable, Ξ ⊢ Σ A ∨B is also provable.
- We prove, by induction on q, that, if q ≤ p, then there exists A q such that Γ; ∆ ⊢ h u 1 . . . u q : |A q | and Ξ ⊢ Σ A q .

If q = 0, we take A 0 = H .

If q = r + 1, by induction hypothesis, Γ; ∆ ⊢ h u 1 . . . u r : |A r | and Ξ ⊢ Σ A r .
We proceed by case analysis on A r .

-If A r = ⊤, ⊥, ∧, ∨ or ∃, then u q has type prop and there exists a proposi-

tion U such that U = u q . If A r = ⊤, we take A q = U =⇒ U . If A r = ⊥, we take A q = U . If A r = P 1 ∧ P 2 , we take A q = (P 1 =⇒ P 2 =⇒ U ) =⇒ U . If A r = P 1 ∨ P 2 , we take A q = (P 1 =⇒ U ) =⇒ (P 2 =⇒ U ) =⇒ U . If A r = ∃x.P 0 , we take A q = (∃x.P 0 (x) =⇒ U ) =⇒ U .
-If A r = P 1 =⇒ P 2 , then u q has type |P 1 |. We take A q = P 2 .

-If A r = ∀x.P 0 , then u q has type term and there exists a term t such that t = u q . We take A q = P 0 [x/t ].

By Theorem 2.6.25, |P | ≡ βΓ |A p |. Therefore, by Lemma 2.7.12, P = A p is provable.

The Calculus Of Constructions

In this section, we encode the Calculus of Constructions [START_REF] Coquand | The Calculus of Constructions[END_REF], an extension of the λΠ-Calculus introducing polymorphism and type operators. This is (a particular case of ) the original motivational example for the λΠ-Calculus Modulo [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF].

Definition

⊢ CoC ⊢ CoC ∆ Γ; ∆ ⊢ U : s x ∉ dom(∆) Γ ⊢ ctx ∆(x : U ) ⊢ CoC ∆ ∆ ⊢ CoC Type : Kind ⊢ CoC ∆ (x : A) ∈ ∆ ∆ ⊢ CoC x : A ∆ ⊢ CoC t : Πx : A.B ∆ ⊢ CoC u : A ∆ ⊢ CoC t u : B [x/u] ∆(x : A) ⊢ CoC t : B ∆ ⊢ CoC Πx : A.B : s ∆ ⊢ CoC λx : A.t : Πx : A.B ∆ ⊢ CoC A : s 1 ∆(x : A) ⊢ CoC B : s 2 ∆ ⊢ CoC Πx : A.B : s 2 ∆ ⊢ CoC t : A ∆ ⊢ CoC B : s A ≡ β B ∆ ⊢ CoC t : B Figure 2
.9: Typing rules for the Calculus of Constructions.

Global Context

For each sort s ∈ {Type, Kind}, we declare a type constant U s (the universe associated with s) and a decoding function ǫ s to see the elements of U s as types:

U Type : Type. (written U T for short) U Kind : Type. (written U K for short) ǫ Type : U T -→ Type. (written ǫ T for short) ǫ Kind : U K -→ Type. (written ǫ K for short)

We add the constant type of type U K as the representative of Type in the universe U K :

type : U K .

We add representatives for the different product types in the universe U T and U K :

Π(T,T ) : Πx : U T .(((ǫ T x) -→ U T ) -→ U T ). Π(T,K ) : Πx : U T .(((ǫ T x) -→ U K ) -→ U K ). Π(K ,T ) : Πx : U K .(((ǫ K x) -→ U T ) -→ U T ). Π(K ,K ) : Πx : U K .(((ǫ K x) -→ U K ) -→ U K ).
Finally, we add rewrite rules to relate sorts and product seen as objects (whose type is a universe) and seen as types (universes):

ǫ K (type) → U T . ǫ T ( Π(T,T ) x y) → Πz : (ǫ T x).ǫ T (y z). ǫ K ( Π(T,K ) x y) → Πz : (ǫ T x).ǫ K (y z). ǫ T ( Π(K ,T ) x y) → Πz : (ǫ K x).ǫ T (y z). ǫ K ( Π(K ,K ) x y) → Πz : (ǫ K x).ǫ K (y z).
Let Γ be this global context.

Lemma 2.7.17. Γ is a strongly well-formed.

Proof. Trivial.

Embedding

We now give two encodings for the terms of the Calculus of Construction. The first one is an encoding as objects.

Definition 2.7.18 (Translation as Object).

|x| = x |Type| = type |Πx : A.B | = Π(T,T ) |A| (λx : (ǫ T |A|).|B |) if A and B are types |Πx : A.B | = Π(T,K ) |A| (λx : (ǫ T |A|).|B |) if A is a type and B is a kind |Πx : A.B | = Π(K ,T ) |A| (λx : (ǫ K |A|).|B |) if A is a kind and B is a type |Πx : A.B | = Π(K ,K ) |A| (λx : (ǫ K |A|).|B |) if A and B are kinds |λx : A.t | = λx : (ǫ T |A|).|t | if A is a type |λx : A.t | = λx : (ǫ K |A|).|t | if A is a kind |t u| = |t | |u|
The second one is an encoding as types.

Soundness and Conservativity

Let Γ be the global context defined in the previous section. We have the following correspondences between terms of the Calculus of Constructions and their encoding.

Theorem 2.7.21 (β-reduction [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF]).

If t 1 → β t 2 then |t 1 | → β |t 2 |.

Heyting Arithmetic

In this section we embed Heyting Arithmetic, following Dowek and Werner [START_REF] Dowek | Arithmetic as a Theory Modulo[END_REF].

Definition

Definition 2.7.25 (Signature of Heyting Arithmetic). The signature Σ H A of Heyting arithmetic contains the following symbols:

• the predicate symbol = of arity 2;

• the function symbol O of arity 0;

• the function symbol S of arity 1;

• and the function symbols + and * of arity 2.

Definition 2.7.26 (Heyting Arithmetic). A proposition P built from the signature Σ H A is provable under the hypotheses Ξ in Heyting arithmetic if P is provable in constructive predicate logic under the assumptions Ξ and the following propositions (axioms):

• for all proposition P with free variable x: We write Ξ ⊢ H A P if P is provable under the hypotheses Ξ in Heyting arithmetic.

∀n.∀m.n = m =⇒ P [x/n] =⇒ P [x/m]; • ∀n.¬(S(n) = 0); • ∀n.∀m.S(n) = S(

Global Context

Since Heyting Arithmetic is a theory of constructive predicate logic, we extend the context Γ defined in Section 2.7.1. We add Peano integers.

nat : Type. 0 : nat. S : nat -→ nat.

We identify the terms and the naturals.

term → nat.
We add a notion of equality.

eq : nat -→ nat -→ prop. eq 0 0 → true. eq (S n 1 ) (S n 2 ) → eq n 1 n 2 . eq (S n) 0 → false. eq 0 (S n) → false.

We define addition.

plus : nat -→ nat -→ nat. plus 0 n → n. plus (S n 1 ) n 2 → S (plus n 1 n 2 ).
We define multiplication.

mult : nat -→ nat -→ nat. mult 0 n → 0. mult (S n 1 ) n 2 → plus n 2 (mult n 1 n 2 ).
Finally, we add an induction principle.

rec : Π p : (nat -→ prop).prf (p 0) -→ (Πn : nat.prf (p n) -→ prf (p (S n))) -→ Πn : nat.prf (p n).
Let Γ H A be this global context. We abbreviate it by Γ when no confusion is possible.

Embedding

The encoding of terms and proposition of Heyting Arithmetic is the same as for any theory of constructive predicate logic (see Section 2.7.1).

Lemma 2.7.27. Γ H A is a strongly well-formed global context.

Proof. Trivial.

Soundness and Conservativity

Theorem 2.7.28 (Soundness). If Ξ ⊢ H A P and x 1 , . . . , x n are the variables occurring free in Ξ and P , then there exists π such that, Γ; ∆ ⊢ π : |P |, where ∆ = (x 1 : term)...(x n : term) |Ξ|.

Proof. Since we already have Theorem 2.7.10, it suffices to consider the cases where P is an axiom.

• |x|.y. x, y, z

• If P = Q[x/0] =⇒ (∀n.Q[x/n] =⇒ Q[x/S(n)]) =⇒ (∀n.Q[x/n]),
∈ V O (Object Variable) X , Y , Z ∈ V T (Type Variable) c, f ∈ C O (Object Constant) C , F ∈ C T (Type Constant) t , u, v ::= x | c | u v | u V | λx : U .t (Object) | λX : K .t T ,U ,V ::= X | C | U v | U V | λx : U .T (Type) | λX : K .T | Πx : U .T | ΠX : K .T K ::= Type | Πx : U .K | ΠX : K .K (Kind) t , u, v ::= u | U | K | Kind (Term)
Figure 2.10: Syntax for the terms of the Calculus of Constructions Modulo

Proof. We proceed as in Theorem 2.7.14. The case where π is a constant or an application headed by a constant is now possible if the constant is rec. In this case we proceed as for the variable case.

The Calculus Of Constructions Modulo

The λΠ-calculus is one vertex of the λ-cube

Terms and Contexts

To be able to have polymorphic terms (objects depending on types) and type operators (types depending on types), we need to extend our definition of terms allowing types applied to types, types applied to objects, as well as abstractions over types.

Definition 2.8.1 (Term). An object is either an object variable in the set V O , or an object constant in the set C O , or an application u v where u is an objects and v is an object or a type, or an abstraction over a type λx : U .t where t is an object and U is a type or an abstraction over a kind λX : K .t where t is an object and K is a kind. A type is either a type variable in the set V T , or a type constant in the set C T , or an application U v where U is a type and v is a type or an object, or an abstraction over a type λx : U .V where U and V are types or an abstraction over a kind λX : K .U where U is a type and K is a kind or a product over a type Πx : U .V where U and V are types or a product over a kind ΠX : K .U where K is a kind and U is a type.

A kind is either a product over a type Πx : U .K where U is a type and K is a kind A kind is either a product over a kind ΠX : K 1 .K 2 where K 1 and K 2 are kind or the symbol Type.

A term is either an object, a type, a kind or the symbol Kind.

∆ ::= | ∆(x : T ) | ∆(X : K ) (Local Context)

Type System

The only thing we need to modify to allow polymorphism and type operators is to generalize the (Product) rule for typing terms. (Empty)

Γ ⊢ ctx (Type Declaration) Γ ⊢ ctx ∆ Γ; ∆ ⊢ K : Kind X ∉ dom(∆) Γ ⊢ ctx ∆(X : K ) (Object Declaration) Γ ⊢ ctx ∆ Γ; ∆ ⊢ U : Type x ∉ dom(∆) Γ ⊢ ctx ∆(x : U )
Figure 2.13: Typing rules for local contexts

Example

Polymorphism and type operators allow us defining polymorphic lists, that is lists parametrized by the type of their elements:

PList : Type -→ Type.

PNil : ΠX : Type.PList X . PCons : ΠX : Type.X -→ PList X -→ PList X .

Remark that none of the three declarations above are allowed in the λΠ-Calculus

Modulo, since they all quantify over Type. We can now define a function Plength computing the size of a polymorphic list:

Plength : ΠX : Type.PList X -→ nat. Plength X (PNil X ) → 0. Plength X (PCons X x l ) → S (Plength X l ).

Properties

Most of the properties we have proved so far for the λΠ-Calculus Modulo continue to hold for the Calculus of Constructions Modulo (sometimes with minor modifications).

The inversion lemma (Lemma 2.6.1) has to be updated for the case where t is a product. Proof. By induction on the typing derivation.

The following properties stated for the λΠ-Calculus Modulo still hold without a change and with the same proof for the Calculus of Constructions Modulo:

• Kind is not typable (Lemma 2.6.2);

• subterms of well-typed terms are well-typed (Lemma 2.6.3);

• local weakening (Lemma 2.6.4);

• the property of convertible local contexts (Lemma 2.6.8);

• the property of well-typed substitutions (Lemma 2.6.9);

• stratification (Lemma 2.6.10) (a few more cases have to be considered in the proof );

• product compatibility by confluence (Theorem 2.6.11);

• global weakening (Lemma 2.6.5);

• well-typed global declarations (Lemma 2.6.14);

• product compatibility preserved by object declarations (Lemma 2.6.12);

• product compatibility for strongly well-formed global contexts (Lemma 2.6.15);

• well-typedness of rules for strongly well-formed rewrite rules (Lemma 2.6.18);

• subject reduction (Theorem 2.6.22);

• uniqueness of typed (Theorem 2.6.25)

• and undecidablity of product compatibility (Lemma 2.6.36).

Inversion of local contexts has a slightly different statement:

Lemma 2.8.6 (Inversion for ⊢ ctx ). If Γ ⊢ ctx ∆(x : A), then Γ ⊢ ctx ∆ and Γ; ∆ ⊢ A : s for some s ∈ {Type, Kind}.

Proof. By induction on the typing derivation. Proof. By induction on the typing derivation.

Finally Conjecture 2.6.13 can be proved for the Calculus of Constructions Modulo.

Lemma 2.8.8. If product compatibility holds for Γ, then it also holds for Γ(C : K ).

Proof. Since we now have type variables we can adapt the proof of Lemma 2.6.12.

Toward Pure Type Systems Modulo

A natural extension from there would be to consider an arbitrary pure type system and extend it with rewrite rules. We conjecture that most of the results of this chapter still hold for an arbitrary functional pure type system. However, in the λΠ-Calculus Modulo and the Calculus of Constructions Modulo, we use the syntactic classification of terms into objects, types and kinds to ensure that rewriting respects the stratification of terms. Such a classification does not exist a priori in pure type systems. Thus, extra assumptions may be needed.

Related Work

The first work on the combination of typed λ-calculus and Term Rewriting Systems is due to Breazu-Tannen [START_REF] Tannen | Combining Algebra and Higher-Order Types[END_REF]. He showed that confluence is preserved when we combine the simply typed lambda-calculus with a confluent TRS. This work was soon extended to system F and to strong normalization by Breazu-Tannen and Gallier [START_REF] Tannen | Polymorphic Rewriting Conserves Algebraic Strong Normalization and Confluence[END_REF] and, independently, by Okada [START_REF] Okada | Strong Normalizability for the Combined System of the Typed lambda Calculus and an Arbitrary Convergent Term Rewrite System[END_REF]. Barbanera [Bar90] extended the result of strong normalization to the Calculus of Constructions (with β-conversion only) and Dougherty [START_REF] Dougherty | Adding Algebraic Rewriting to the Untyped Lambda Calculus[END_REF] proved the preservation of confluence and strong normalization for any stable set of λ-terms.

An important step was reached by Jouannaud and Okada [START_REF] Jouannaud | A Computation Model for Executable Higher-Order Algebraic Specification Languages[END_REF] with the introduction of the General Schemata, a criterion for strong normalization able to deal with higher-order rewrite rules, that is rewrite rules where the variables can have functional types. The General Schemata was successively adapted to deal with F ω [BF93b], intersection types [START_REF] Barbanera | Combining First and Higher Order Rewrite Systems with Type Assignment Systems[END_REF], the systems of the λ-cube [START_REF] Barbanera | Modularity of Strong Normalization and Confluence in the Algebraic-lambda-Cube[END_REF] and Pure Type Systems [START_REF] Barthe | Modular properties of algebraic type systems[END_REF].

A different and more powerful criterion called Higher-Order Recursive Path Ordering (HORPO) was then introduced by Jouannaud and A. Rubio [START_REF] Jouannaud | The Higher-Order Recursive Path Ordering[END_REF] for simply typed lambda calculus with higher-order rewrite rules.

In 1999, Jouannaud, Okada and Blanqui [START_REF] Blanqui | The Calculus of Algebraic Constructions[END_REF] extended the General Schema, keeping simply typed symbols, in order to deal with strictly positive types.

For formalizing the metatheory of the Calculus of Inductive Constructions in Coq, Barras [Bar99] defined a notion of pure type systems with operators.

In 2000, Walukiewicz [START_REF] Walukiewicz-Chrzaszcz | Termination of rewriting in the Calculus of Constructions[END_REF] extended HORPO to the Calculus of Constructions. But these works have in common that rewriting is always confined to the object level. Blanqui [START_REF] Blanqui | Definitions by rewriting in the Calculus of Constructions[END_REF][START_REF] Blanqui | A Type-Based Termination Criterion for Dependently-Typed Higher-Order Rewrite Systems[END_REF] worked on the termination in the Calculus of Algebraic Constructions, an extension of the Calculus of Constructions with object-level and type-level rewrite rules.

Conclusion

We have presented a new version of the λΠ-Calculus Modulo. It differs from the original presentation [START_REF] Cousineau | Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo[END_REF] by two aspects: it uses an untyped notion of reduction and it explicits the typing of the rewrite rules and makes it iterative. These two modifications clarify the relation between rewriting and typing and make the framework closer to its implementation in DEDUKTI.

We have provided a complete meta-theoretical study of the λΠ-Calculus Modulo which was lacking in its original presentation. In particular, we have emphasized the role played by two properties, product compatibility and well-typedness of rewrite rules, in the proofs of many basic results such as subject reduction and uniqueness of types. These properties will be studied further in the next chapters. We have also given several examples of encodings in the λΠ-Calculus Modulo. Finally, we have studied an extension of the λΠ-Calculus Modulo with polymorphism and type operators.

Chapter 3

Typing Rewrite Rules

Résumé Ce chapitre étudie la propriété de bon typage des règles de réécriture. Une règle de réécriture est bien typée si elle préserve le typage. Partant d'un critère simple, à savoir que le membre gauche de la règle doit être algébrique et les membres gauche et droit doivent avoir le même type, on généralise progressivement le résultat pour considérer des membres gauches non algébriques et mal typés. Cette généralisation est particulièrement importante en présence de types dépendants, pour permettre de conserver des règles de réécriture linéaires à gauche et préserver la confluence du système de réécriture. On donne aussi une caractérisation exacte de la notion de bon typage pour les règles de réécriture sous forme d'un problème d'unification et on prouve son indécidabilité.

Introduction

We have seen in the previous chapter that most properties of the λΠ-Calculus Modulo depend on two of them: product compatibility and well-typedness of rewrite rules. In this chapter we are interested in finding sufficient conditions to ensure the second property. The criterion that we have used so far is the following (for the proof see Section 3.2): Definition 3.1.1 (Strongly Well-Formed Rewrite Rule). Let Γ be a global context such that → βΓ is confluent. A rewrite rule (u → v) is strongly-well-formed in Γ if, for some local context ∆ and term T ,

• u is algebraic, • dom(∆) = FV (u), • Γ ⊢ ctx ∆,
• Γ; ∆ ⊢ u : T and • Γ; ∆ ⊢ v : T Theorem (Strongly Well-Formed Rewrite Rules are Permanently Well-Typed). Let Γ be a well-typed global context. If (u → v) is strongly well-formed in Γ, then it is permanently well-typed. This criterion is not entirely satisfactory for two reasons. First, the restriction to algebraic left-hand side is too strong. We would like to be able to type-check rewrite rules such as this one:

getCst : (nat -→ nat) -→ nat. getCst (λx : nat.n) → n.
This rewrite rule extracts the value of a constant function. While it is well-typed (as we will see), it is not strongly well-formed because of the abstraction on the lefthand side.

Second, the restriction to well-typed left-hand sides is also too strong. This may be more surprising. This restriction often makes the criterion incompatible with another important property of the system: the confluence of the rewriting system (recall that confluence is our main tool to prove product compatibility). The reason is that, in presence of dependent types, strongly well-formed rewrite rules tend to be non left-linear. And β-reduction do not behave nicely with non left-linear rewrite rules (see Section 1.4.3).

Consider the following example. We want to define basic functions to manipulate vectors. We first define the type Vector of lists parametrized by their length.

term : Type.

Vector : nat -→ Type. vnil : Vector 0. vcons :

Πn : nat.term -→ Vector n -→ Vector (S n).
vnil is the empty vector. vcons builds a vector of size (S n) from an element of type term and a vector of size n. Let us define the function head to extract the first element of a non-empty vector.

head : Πn : nat.Vector (S n) -→ term. head n (vcons n e l ) → e.

This last rewrite rule is strongly well-formed. However, it is not left-linear since the variable n occurs twice in the left-hand side. In fact, we can show that the resulting rewrite system is not confluent (Section 1.4.3).

We can wonder what happens if we replace the last rewrite rule by its linearized version where we use two different variables instead of two occurrences of the same variable:

head n 1 (vcons n 2 e l ) → e.
The first consequence is that we immediately get back the confluence of the rewriting system since Theorem 1.4.7 applies. But is it still the rewrite rule we wanted to add? The short answer is yes. Indeed, both rewrite rules (the non left-linear rule and its linearized version) match the same redexes as soon as the redexes are well-typed. In other words, both rewrite rules have the same computational behaviour on welltyped terms. If the redex r = σ(head n 1 (vcons n 2 e l )) is well-typed (and normal) then it necessarily verifies σ(n 1 ) = σ(n 2 ). Therefore, r is also a redex of the nonlinear rule since r = σ 2 (head n (vcons n e l )) for σ 2 = σ ∪ {n → σ(n 1 )}. By replacing the non-left-linear rule by its linearized version, we are able to recover confluence of the rewriting system without modifying the behaviour of the rule on well-typed terms. Moreover, we will see that this linearization is type-safe.

In this chapter, we build on these ideas to iteratively generalize the criterion for well-typedness of rewrite rules given above in order to allow non-algebraic and ill-typed left-hand sides. In particular we justify the linearization of rewrite rules presented above. We conclude by a characterization of well-typedness for rewrite rules as a problem of inclusion between two sets of solutions of unifications problems and a proof of its undecidability.

Strongly Well-Formed Rewrite Rules

We begin by proving that strongly well-formed rewrite rules are permanently welltyped.

Theorem 3.2.1 (Strongly Well-Formed Rewrite Rules are Permanently Well-typed). Let Γ be a global context such that → βΓ is confluent. If (u → v) is strongly well-formed in Γ, then it is permanently well-typed.

Most of the proofs in this chapter will follow the same scheme. The idea is to prove that, if a redex σ(u) is well-typed and u is algebraic then, first, the substitution σ is well-typed and, second, the redex has type σ(T 0 ) where T 0 is the type of u. More precisely, from Γ 0 ; ∆ 0 ⊢ u : T 0 and Γ; ∆ ⊢ σ(u) : T , we prove σ : ∆ 0 Γ ∆ and T ≡ βΓ σ(T 0 ). Subsequently, by the property of well-typed substitutions (Lemma 2.6.9) and by conversion, we can conclude from Γ 0 ; ∆ 0 ⊢ v : T 0 that Γ; ∆ ⊢ σ(v) : T .

For each theorem in the chapter, we prove a main lemma corresponding to the first part of the proof. Lemma 3.2.2 (Main Lemma for Theorem 3.2.1). Let Γ 0 be a global context such that → βΓ 0 is confluent and let Γ be a well-typed extension of Γ 0 . Assume that:

• t is algebraic, • Γ ⊢ ctx ∆, • Γ; ∆ ⊢ σ(t ) : T • and Γ 0 ; ∆ 0 ⊢ t : T 0 .
Then, we have:

• T ≡ βΓ σ(T 0 ),
• Γ; ∆ ⊢ σ(R) : s for some reduct R of T 0

• and, for all x ∈ FV (t ), Γ; ∆ ⊢ σ(x) : T x with T x ≡ βΓ σ(∆ 0 (x)).

Proof. We proceed by induction on t .

• If t = f is a constant, then FV (t ) = and, by inversion, on the one hand, T 0 ≡ βΓ 0 Γ 0 ( f ) and, on the other hand, T ≡ βΓ Γ( f ). Since σ(Γ 0 ( f )) = Γ( f ), we have σ(T 0 ) ≡ βΓ T . By confluence of → βΓ 0 , T 0 and Γ 0 ( f ) have a common reduct R. Since σ(Γ 0 ( f )) → βΓ σ(R) and σ(Γ 0 ( f )) = Γ( f ) is well-typed, by subject reduction (Theorem 2.6.22), R is well-typed.

• If t = uv with u and v algebraic, then, by inversion, on the one hand, Γ 0 ;

∆ 0 ⊢ u : Πx : A 0 .B 0 , Γ 0 ; ∆ 0 ⊢ v : A 0 and T 0 ≡ βΓ 0 B 0 [x/v].
≡ βΓ B . It follows that σ(T 0 ) ≡ βΓ σ(B 0 [x/v]) ≡ βΓ σ(B 2 [x/v]) ≡ βΓ B [x/σ(v)] ≡ βΓ T . Moreover, we have B 2 [x/v] is a reduct of T 0 and Γ; ∆ ⊢ σ(B 2 [x/v]) : s.
By induction hypothesis on v, for all x ∈ FV (v), Γ; ∆ ⊢ σ(x) : T x with T x ≡ βΓ σ(∆ 0 (x)).

• If t = ux with u algebraic and x a variable, then, by inversion, on the one hand,

Γ 0 ; ∆ 0 ⊢ u : Πy : A 0 .B 0 , Γ 0 ; ∆ 0 ⊢ x : A 0 , A 0 ≡ βΓ 0 ∆ 0 (x),
≡ βΓ B . It follows that T ≡ βΓ B [y/σ(x)] ≡ βΓ σ(B 2 )[y/σ(x)] = σ(B 2 [y/x]) ≡ βΓ σ(B 0 [y/x]) ≡ βΓ σ(T 0 ).
To type σ(x), we can take

T x = A, since Γ; ∆ ⊢ σ(x) : A with A ≡ βΓ σ(A 0 ) ≡ βΓ σ(∆ 0 (x)).
B 2 is a reduct of B 0 and, by inversion, σ(B 2 ) is well-typed.

It follows that the substitution σ is well-typed.

Lemma 3.2.3. Let Γ be a global context and ∆ 0 be a local context well-formed in Γ.

If, for all x ∈ dom(∆ 0 ), Γ; ∆ ⊢ σ(x) : T x with T x ≡ βΓ σ(∆ 0 (x)), then σ : ∆ 0 Γ ∆.

Proof. By induction on Γ ⊢ ctx ∆ 0 .

• (Empty Local Context) Trivial.

• (Variable Declaration) Suppose that, ∆ 0 = ∆ 2 (x : A), Γ ⊢ ctx ∆ 2 and Γ; ∆ 2 ⊢ A : Type.

By induction hypothesis, σ : ∆ 2 Γ ∆, that is to say, for all x ∈ dom(∆ 2 ), Γ; ∆ ⊢ σ(x) : σ(∆ 0 (x)).

We have Γ; ∆ ⊢ σ(x) : T x with T x ≡ βΓ σ(A). Moreover, by Lemma 2.6.9, we have Γ; ∆ ⊢ σ(A) : Type. It follows, by conversion, that Γ; ∆ ⊢ σ(x) : σ(A).

Thus, σ : ∆ 0 Γ ∆.

We can now prove the theorem:

Proof of Theorem 3.2.1. Let (u → v) be a strongly-well-formed rewrite rule for Γ 0 and let Γ be a well-typed extension of Γ 0 . Assume that, for some ∆, σ and T , we have Γ ⊢ ctx ∆ and Γ; ∆ ⊢ σ(u) : T . By hypothesis, for some ∆ 0 and T 0 , Γ 0 ; ∆ 0 ⊢ u : T 0 and Γ 0 ; ∆ 0 ⊢ v : T 0 . By the main lemma (Lemma 3.2.2), T ≡ βΓ σ(T 0 ) and, for all x ∈ FV (u) = dom(∆ 0 ), Γ; ∆ ⊢ σ(x) : T x with T x ≡ βΓ σ(∆ 0 (x)). By Lemma 3.2.3, σ : ∆ 0 Γ ∆.

Finally, by the property of well-typed substitutions (Lemma 2.6.9), we have Γ; ∆ ⊢ σ(v) : σ(T 0 ). It follows, by conversion, that Γ; ∆ ⊢ σ(v) : T .

Left-Hand Sides Need not be Algebraic

We now try to weaken the assumption of algebraicity for left-hand side in Theorem 3.2.1. First, remark that this assumption cannot be dropped completely. We have Γ; (x : nat -→ nat)(y : nat) ⊢ S(x y) : nat and Γ; (x : nat -→ nat)(y : nat) ⊢ x (S y) : nat.

However, the following rewrite rule is not well-typed.

S (x y) → x (S y).

Indeed, using this rewrite rule, we have S ((λx : prop.0) true) → (λx : prop.0) (S true).

While S ((λx : prop.0) true) has type nat, (λx : prop.0) (S true) is obviously illtyped.

The assumption of algebraicity is used to ensure that we cannot substitute the variables with terms of the wrong type without losing well-typedness. In fact, the types of the free variables of a well-typed algebraic term are uniquely defined. Moreover, the type of an algebraic term as well as the types of its free variables can be inferred. This is basically what is used in the proof of Lemma 3.2.2. This property is not specific to algebraic terms and it is closely related to type inference.

Algorithms able to reconstruct the type of a term with only partial information about the type of the free variables exist. They are usually based on bidirectional type systems. In these systems, the typing rules are split in two groups: typing rules to synthesize (infer) the type of a term and typing rules to check that a term has a given type.

Instead of requiring that the left-hand side of a rewrite rule is algebraic, we can require that its type as well as the types of its free variables can be inferred by some bidirectional typing system defined below.

Definition 3.3.1. The relations i and c are defined inductively from the inference rules of Figure 3.1.

The judgment Γ; ∆ 1 ; Σ i t ⇒ T, ∆ 2 is an inference judgment. It means: knowing the types of the variables in ∆ 1 and Σ, we can synthesize the type T for t as well as the types of the variables in ∆ 2 . The variables in ∆ 1 and ∆ 2 are variables that are globally free in the term being explored (that is, the variables that will be matched) and the variables in Σ are variables that are bound.

The judgment Γ; ∆ 1 ; Σ c t ⇐ T | ∆ 2 is a checking judgment. It means: knowing the types of the variables in ∆ 1 and Σ, we can check that t has type T and synthesize (Sort) By induction hypothesis on v, σ : ∆ 0 Γ ∆.

Γ; ∆; Σ i Type ⇒ Kind, ∆ (Constant) ( f : A) ∈ Γ Γ; ∆; Σ i f ⇒ A, ∆ (Σ-Variable) (x : A) ∈ Σ Γ; ∆; Σ i x ⇒ A, ∆ (∆-Variable) (x : A) ∈ ∆ Γ; ∆; Σ i x ⇒ A, ∆ (S-Application) Γ; ∆ 1 ; Σ i u ⇒ T, ∆ 2 T → * βΓ Πx : A.B Γ; ∆ 2 ; Σ c v ⇐ A | ∆ 3 Γ; ∆ 1 ; Σ i uv ⇒ B [x/u], ∆ 3 (S-Abstraction) Γ; ∆ 1 ; Σ c A ⇐ Type | ∆ 2 Γ; ∆ 2 ; Σ(x : A) i u ⇒ B, ∆ 3 Γ; ∆ 1 ; Σ i λx : A.u ⇒ Πx : A.B, ∆ 3 (Product) Γ; ∆ 1 ; Σ c A ⇐ Type | ∆ 2 Γ; ∆ 2 ; Σ(x : A) c B ⇐ s | ∆ 3 Γ; ∆ 1 ; Σ i Πx : A.B ⇒ s, ∆ 3 (Free Variable) x ∉ dom(∆Σ) FV (A) ∩ dom(Σ) = Γ; ∆; Σ c x ⇐ A | ∆(x : A) (Inversion) Γ; ∆ 1 ; Σ i u ⇒ A 2 , ∆ 2 A 1 ≡ βΓ A 2 Γ; ∆ 1 ; Σ c u ⇐ A 1 | ∆ 2 (C-Abstraction) T → * βΓ Πx : A 2 .B A 1 ≡ βΓ A 2 Γ; ∆ 1 ; Σ c A 1 ⇐ Type | ∆ 2 Γ; ∆ 2 ; Σ(x : A 1 ) c u ⇐ B | ∆ 3 Γ; ∆ 1 ; Σ c λx : A 1 .u ⇐ T | ∆ 3 (C-Application) (x : A) ∈ Σ Γ; ∆ 1 ; Σ c u ⇐ Πx : A.B | ∆ 2 Γ; ∆ 1 ; Σ c u x ⇐ B | ∆ 2

Moreover, σ(T

0 ) = σ(B 0 [x/v]) ≡ βΓ B [x/σ(v)] ≡ βΓ T . -(S-Abstraction) Suppose that t = λx : A 0 .u, T 0 = Πx : A 0 .B 0 , Γ 0 ; ∆ 1 ; Σ c A 0 ⇐ Type | ∆ 2 and Γ 0 ; ∆ 2 ; Σ(x : A 0 ) i u ⇒ B 0 , ∆ 0 .
By inversion, we have Γ; ∆σ(Σ) ⊢ σ(A 0 ) : Type, Γ; ∆σ(Σ(x : A 0 )) ⊢ σ(u) : B and T ≡ βΓ Πx : σ(A 0 ).B .

By induction hypothesis on

A 0 , σ : ∆ 2 Γ ∆.
By induction hypothesis on u, σ(B 0 ) ≡ βΓ B and σ : ∆ 0 Γ ∆.

Thus, σ(T 0 ) = σ(Πx : A 0 .B 0 ) ≡ βΓ Πx : σ(A 0 ).B ≡ βΓ T . -(Product) Suppose that t = Πx : A.B , T 0 = s, Γ 0 ; ∆ 1 ; Σ c A ⇐ Type | ∆ 2 and Γ 0 ; ∆ 2 ; Σ(x : A) c B ⇐ s | ∆ 0 .
By inversion, T = s, Γ; ∆σ(Σ) ⊢ σ(A) : Type and Γ; ∆σ(Σ(x : A)) ⊢ σ(B ) : s.

By induction hypothesis on A, σ : ∆ 2 Γ ∆.

By induction hypothesis on B , σ : ∆ 0 Γ ∆.

• Case Γ 0 ; ∆ 1 ; Σ 0 c t ⇐ T 0 | ∆ 0 ,T ≡ βΓ σ(T 0 ) and Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s.

-(C-Abstraction) Suppose that t = λx : A 1 .u, σ(T 0 ) ≡ βΓ T , Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, T 0 → * βΓ Πx : A 2 .B 0 , A 1 ≡ βΓ A 2 , Γ 0 ; ∆ 1 ; Σ c A 1 ⇐ Type | ∆ 2 and Γ 0 ; ∆ 2 ; Σ(x : A 1 ) c u ⇐ B 0 | ∆ 0 .
By inversion, T ≡ βΓ Πx : σ(A 1 ).B , Γ; ∆σ(Σ) ⊢ σ(A 1 ) : Type and Γ; ∆σ(Σ(x :

A 1 )) ⊢ σ(u) : B . Since σ(Πx : A 2 .B 0 ) ≡ βΓ σ(T 0 ) ≡ βΓ T ≡ βΓ Πx : σ(A 1 ).B , we have, by product- compatibility, σ(B 0 ) ≡ βΓ B .

By induction hypothesis on

A 1 , σ : ∆ 2 Γ ∆.
By induction hypothesis on u, σ : ∆ 0 Γ ∆.

-(C-Application) Suppose that t = ux, (x : A 0 ) ∈ Σ and Γ 0 ;

∆ 1 ; Σ c u ⇐ Πx : A 0 .T 0 | ∆ 0 . By inversion, Γ; ∆σ(Σ) ⊢ σ(u) : Πx : A.B , Γ; ∆σ(Σ) ⊢ x : A, A ≡ βΓ σ(Σ(x)) = σ(A 0 ) and T ≡ βΓ B .
We have σ(Πx : A 0 .T 0 ) = Πx.σ(A 0 ).σ(T 0 ) ≡ βΓ Πx : A.B and, by induction hypothesis, σ : ∆ 0 Γ ∆.

-(Free Variable) Suppose that t = x and x ∉ dom(∆ 1 Σ) and ∆ 0 = ∆ 1 (x : T 0 ). Since we have σ : ∆ 1 Γ ∆, to prove σ : ∆ 0 Γ ∆, it suffices to show that Γ; ∆ ⊢ σ(x) : σ(T 0 ). We have Γ; ∆σ(Σ) ⊢ σ(x) : T . Since σ(T 0 ) is well-typed, by conversion, we have Γ; ∆σ(Σ) ⊢ σ(x) : σ(T 0 ).

Since dom(Σ) ∩ codom(σ) = and FV (T 0 ) ∩ dom(Σ) = , we have Γ; ∆ ⊢ σ(x) : σ(T 0 ).

-(Inversion) By induction hypothesis.

Using the main lemma, we can prove Theorem 3.3.3.

Proof of Theorem 3.3.3. Let Γ be a well-typed extension of Γ 0 and let (u → v) be a rewrite rule such that Γ 0 ; ; i u ⇒ T 0 , ∆ 0 and Γ 0 ; ∆ 0 ⊢ v : T 0 . Assume that, for some ∆, σ and T , we have Γ ⊢ ctx ∆ and Γ; ∆ ⊢ σ(u) : T . By global weakening, we have Γ; ∆ 0 ⊢ v : T 0 .

By the main lemma (Lemma 3.3.4), T ≡ βΓ σ(T 0 ) and σ : ∆ 0 Γ ∆. Finally, by Lemma 2.6.9, we have Γ; ∆ ⊢ σ(v) : σ(T 0 ). It follows, by conversion, that Γ; ∆ ⊢ σ(v) : T .

As a corollary, we get that the first rewrite rule from the beginning of this chapter is well-typed.

T → * βΓ Πx : A 2 .B Γ; ∆ 1 ; Σ 2 c A 1 ⇐ Type | ∆ 2 Γ; ∆ 2 ; Σ(x : A 1 ) 2 c u ⇐ B | ∆ 3 Γ; ∆ 1 ; Σ 2 c λx : A 1 .u ⇐ T | ∆ 3 (Inv-No-Check) Γ; ∆ 1 ; Σ 2 i u ⇒ A 2 , ∆ 2 Γ; ∆ 1 ; Σ 2 c u ⇐ A 1 | ∆ 2 (App-No-Check) Γ; ∆ 1 ; Σ 2 i v ⇒ A, ∆ 2 Γ; ∆ 1 ; Σ 2 c u v ⇐ B | ∆ 2 (No-Check) Γ; ∆ 1 ; Σ 2 c u ⇐ B | ∆ 1

Left-Hand Sides Need not be Well-Typed

The bidirectional type system of Figure 3.1 is sound with respect to ⊢.

Theorem 3.4.1. Let Γ be a well-typed global context.

If Γ ⊢ ctx ∆ 1 Σ and Γ; ∆ 1 ; Σ i t ⇒ T, ∆ 2 , then Γ ⊢ ctx ∆ 2 Σ and Γ; ∆ 2 Σ ⊢ t : T . Proof. By induction on Γ; ∆ 1 ; Σ i t ⇒ T, ∆ 2 .
Surprisingly, Theorem 3.4.1 is not used in the proof of Theorem 3.3.3. The assumption that the redex is well-typed is sufficient. Looking closely at the proof of Lemma 3.3.4, we remark that some premises of the rules of i and c are never used. In particular, in the rules (Inversion) and (C-Abstraction), the hypothesis A 1 ≡ βΓ A 2 is not used.

Since we are not interested in being sound with respect to ⊢, they can be removed. Moreover, we can make additional improvements. For instance, if some variable is not used in the right-hand side of a rewrite rule, it is not necessary to be able to infer its type since it will not be used. More generally, all the parts of the left-hand side that do not give any new information about the type of the term or the types of the free variables occurring in the right-hand side do not need to be inspected.

These considerations lead us to some improvements of the relations i and c . As usual, we first prove the corresponding main lemma. We will use the following notation.

Proof. Using the rules (Constant), (S-Application) and (Free Variable), we have, on the one hand, Γ; ; 2 i head n 1 ⇒ Vector (S n 1 ) -→ term,∆ 1 for ∆ 1 = (n 1 : nat) and, on the other hand, Γ; ∆ 1 ; 2 i vcons n 2 e l ⇒ Vector (S n 2 ), ∆ 2 for ∆ 2 = (n 1 : nat)(n 2 : nat)(e : term)(l : Vector n 2 ).

By the (Inv-No-Check) rule, we have

Γ; ∆ 1 ; 2 c vcons n 2 e l ⇐ Vector (S n 1 ) | ∆ 2 .
Remark that this rule permits changing the type of vcons n 2 e l from Vector (S n 2 ) to Vector (S n 1 ).

Finally, by the rule (S-Application), we have

Γ; ; 2 i head n 1 (vcons n 2 e l ) ⇒ term,∆ 2 .
On the other hand, we have Γ; ∆ 2 ⊢ e : term. Therefore, by Theorem 3.4.3, the rewrite rule (head n 1 (vcons n 2 e l ) → e) is permanently well-typed.

Taking Advantage of Typing Constraints

We have justified the linearization of the rewrite rule for the function head, which extracts the first element of a vector. Let us see if we can do the same for the function tail, which removes the first element of a vector. tail : Πn : nat.Vector (S n) -→ Vector n. tail n (vcons n e l ) → l .

The linearized version would be:

tail n 1 (vcons n 2 e l ) → l . We have Γ; ; 2 i tail n 1 (vcons n 2 e l ) ⇒ Vector n 1 , ∆ and Γ; ∆ ⊢ l : Vector n 2 for ∆ = (n 1 : nat)(n 2 : nat)(e : term)(l : Vector n 2 ).

But we cannot use Theorem 3.4.3, since Vector n 1 is not convertible with Vector n 2 . However, we can see that any substitution σ such that the redex σ(tail n 1 (vcons n 2 e l )) is well-typed will verify the constraint σ(Vector (S n 1 )) ≡ βΓ σ(Vector (S n 2 )) and, therefore, will verify σ(n 1 ) ≡ βΓ σ(n 2 ) and σ(Vector n 1 ) ≡ βΓ σ(Vector n 2 ). It follows that the rewrite rule is in fact well-typed.

In the previous section, we basically ignored the typing constraints (conversion tests) arising during the typechecking of the left-hand side of the rewrite rules. The example above shows that we need to extract information from them. This leads us to a new generalisation of Theorem 3.4.3.

We adapt the typing rules of Figure 3.2 to take into account the conversion tests and record them. The new inference relation, not only synthesizes the type of the left-hand side together with the types of its free variables, but also records the typing constraints that a well-typed redex will satisfy.

(Sort) Γ; ∆; Σ; C i Type ⇒ (∆, Kind, C ) (Constant) ( f : A) ∈ Γ Γ; ∆; Σ; C i f ⇒ (∆, A, C ) (Σ-Variable) (x : A) ∈ Σ Γ; ∆; Σ; C i x ⇒ (∆, A, C ) (∆-Variable) (x : A) ∈ ∆ Γ; ∆; Σ; C i x ⇒ (∆, A, C ) (S-Application) Γ; ∆ 1 ; Σ; C 1 i u ⇒ (∆ 2 , T 2 , C 2 ) Γ; ∆ 2 ; Σ; C 2 c v ⇐ A | (∆ 3 , C 3 ) T 2 → * βΓ Πx : A.B Γ; ∆ 1 ; Σ; C 1 i u v ⇒ (∆ 3 , B [x/v], C 3 ) (S-Abstraction) Γ; ∆ 1 ; Σ; C 1 c A ⇐ Type | (∆ 2 , C 2 ) Γ; ∆ 2 ; Σ(x : A); C 2 i u ⇒ (∆ 3 , B, C 3 ) Γ; ∆ 1 ; Σ; C 1 i λx : A.u ⇒ (∆ 3 , Πx : A.B, C 3 ) (Product) Γ; ∆ 1 ; Σ; C 1 c A ⇐ Type | (∆ 2 , C 2 ) Γ; ∆ 2 ; Σ(x : A); C 2 c B ⇐ s | (∆ 3 , C 3 ) Γ; ∆ 1 ; Σ; C 1 i Πx : A.B ⇒ (∆ 3 , s, C 3 )

Typing Constraints Definition (Constraints). A set of constraints is a set of pairs of terms.

A set of constraints is also a unification problem modulo the relation ≡ βΓ .

Definition 3.5.2 (Solutions of Constraints). Let Γ be a global context, V , a set of (implicitly bound) variables, and C , a set of constraints.

The set Sol Γ (V, C ) of solutions of C in Γ is the set of substitutions σ such that:

• dom(σ) ⊂ V • and, for all (A, B ) ∈ C , σ(A) ≡ βΓ σ(B ).
The most general solution (MGS) (or most general unifier) is a classical notion of unification theory. A solution τ is most general when it subsumes all other solutions in the following sense: if σ is another solution, then σ ≡ σ 0 τ for some σ 0 . For our purpose, we also require a MGS to be idempotent and not to introduce new variables, which is equivalent to the following definition.

(Free Variable)

FV (A) ∩ dom(Σ) = x ∉ dom(∆ 1 ) ∪ dom(Σ) Γ; ∆ 1 ; Σ; C 1 c x ⇐ A | (∆ 1 (x : A), C 1 ) (C-Abstraction) T → * βΓ Πx : A 2 .B Γ; ∆ 1 ; Σ; C 1 c A 1 ⇐ Type | (∆ 2 , C 2 ) Γ; ∆ 2 ; Σ(x : A 1 ); C 2 c u ⇐ B | (∆ 3 , C 3 ) Γ; ∆ 1 ; Σ; C 1 c λx : A 1 .u ⇐ T | (∆ 3 , C 3 ∪ {(λΣ.A 1 , λΣ.A 2 )}) (C-Application) (x : A) ∈ Σ Γ; ∆ 1 ; Σ; C 1 c u ⇐ Πx : A.B | (∆ 2 , C 2 ) Γ; ∆ 1 ; Σ; C 1 c u x ⇐ B | (∆ 2 , C 2 ) (Inversion) Γ; ∆ 1 ; Σ; C 1 i u ⇒ (∆ 2 , A 2 , C 2 ) Γ; ∆ 1 ; Σ; C 1 c u ⇐ A 1 | (∆ 2 , C 2 ∪ {(λΣ.A 1 , λΣ.A 2 )}) (App-No-Check) Γ; ∆ 1 ; Σ; C 1 i v ⇒ (∆ 2 , A, C 2 ) Γ; ∆ 1 ; Σ; C 1 c u v ⇐ B | (∆ 2 , C 2 ) (No-Check) Γ; ∆ 1 ; Σ; C 1 c u ⇐ T | (∆ 1 , C 1 )
Figure 3.4: Bidirectional typing rules for pseudo-well-formed rewrite rules (Part 2: Checking) Definition 3.5.3 (Most General Solution (MGS)). Let Γ be a global context, V be a set of variables and C be a set of constraints.

A substitution τ ∈ Sol Γ (V, C ) is a most general solution (MGS) for C in Γ if, for any σ ∈ Sol Γ (V, C ), σ ≡ βΓ στ on V .

Since we are doing unification modulo ≡ βΓ , MGSs do not always exist. For instance, the equation λx : A.y x ≡ βΓ λx : A.c x has two incomparable solutions {y → c} and {y → λx : A.c x}. Therefore, we introduce the weaker notion of pre-solution. A pre-solution is more general than any solution but need not be a solution itself. Definition 3.5.4 (Pre-Solution). Let Γ be a global context, V be a set of variables and C be a set of constraints.

A pre-solution for C is a substitution τ such that, for any σ ∈ Sol Γ (V, C ), σ ≡ βΓ στ on V .

We write PreSol Γ (V, C ) the set of pre-solutions for C in Γ.

Remark 3.5.5. The identity substitution is a pre-solution, for any set of constraints. Therefore, contrarily to the set of MGSs, the set of pre-solutions is never empty.

If we take the set of constraints C = {(Vector (S n 1 ), Vector (S n 2 ))} and the set of variables V = {n 1 , n 2 }, then, by confluence of the reduction → βΓ , we know that, if σ ∈ Sol Γ (V, C ), then σ n 1 ≡ βΓ σ n 2 . As a consequence, we have that the following substitutions are pre-solutions:

• {n 1 → n 2 },
• {n 2 → n 1 }.

Since they are in Sol Γ (V, C ), they are also MGSs.

Fine-Grained Typing of Rewrite Rules

We now generalize Theorem 3.4.3. We use the notion of pre-solution to take advantage of the information extracted from typing constraints obtained by typing the left-hand side of the rewrite rule, when typing the right-hand side. The inference rules for i and c , are the same as for 2 i and 2 c except that, instead of ignoring the typing constraints, we record them. Theorem 3.5.8. Let Γ be a well-formed global context.

If there exist ∆, T and τ such that By induction hypothesis on v, σ ∈ Sol(dom(∆ 3 ), C 3 ) and σ : ∆ 3 Γ ∆.

• Γ; ; ; i u ⇒ (∆, T, C ), • τ ∈ PreSol Γ (dom(∆), C ), • Γ ⊢ ctx τ(∆) • and Γ; τ(∆) ⊢ v : τ(T ), • (S-Application) Suppose that t = uv, T 0 = B 2 [x/v], Γ; ∆ 1 ; Σ; C 1 i u ⇒ (∆ 2 , P, C 2 ), Γ; ∆ 2 ; Σ; C 2 c v ⇐ A 2 | (∆ 3 ,
Moreover, T ≡ βΓ B [x/σ(v)] ≡ βΓ σ(B 2 )[x/σ(v)] = σ(T 0 ).
Finally, since, by inversion, Γ; ∆σ(Σ)(x : σ(A 2 )) ⊢ σ(B 2 ) : s and Γ; ∆σ(Σ) ⊢ σ(v) : σ(A 2 ), we have, by substitution, Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s.

• (S-Abstraction) Suppose that t = λx : A 0 .u, T 0 = Πx : A 0 .B 0 , Γ; ∆ 1 ; Σ; C 1 c A 0 ⇐ Type | (∆ 2 , C 2 ) and Γ; ∆ 2 ; Σ(x : A 0 ); C 2 i u ⇒ (∆ 3 , B 0 , C 3 ).
By inversion, we have Γ; ∆σ(Σ) ⊢ σ(A 0 ) : Type, Γ; ∆σ(Σ(x

: A 0 )) ⊢ σ(u) : B , B = Kind and T ≡ βΓ Πx : σ(A 0 ).B .
By induction hypothesis on A 0 , we have, σ ∈ Sol(dom(∆ 2 ), C 2 ) and σ : ∆ 2 Γ ∆.

By induction hypothesis on u, σ(B

0 ) ≡ βΓ B , Γ; ∆σ(Σ)(x : σ(A 0 )) ⊢ σ(B 0 ) : s, σ ∈ Sol(dom(∆ 3 ), C 3 ) and σ : ∆ 3 Γ ∆.
Finally, T ≡ βΓ Πx : σ(A 0 ).B ≡ βΓ Πx : σ(A 0 ).σ(B 0 ) = σ(T 0 ) and Γ; ∆σ(Σ) ⊢ σ(Πx : A 0 .B 0 ) : s.

• (Product) Suppose that t = Πx : A 0 .B 0 ,

T 0 = s, Γ; ∆ 1 ; Σ; C 1 c A 0 ⇐ Type | (∆ 2 , C 2 )
and Γ; ∆ 2 ; Σ(x

: A 0 ); C 2 c B 0 ⇐ s | (∆ 3 , C 3 ).
By inversion, we have Γ; ∆σ(Σ) ⊢ σ(A 0 ) : Type, Γ; ∆σ(Σ(x : A 0 )) ⊢ σ(B 0 ) : s and T = s.

By induction hypothesis on A 0 , we have σ ∈ Sol(dom(∆ 2 ), C 2 ) and σ : ∆ 2 Γ ∆.

By induction hypothesis on u, σ ∈ Sol(dom(∆ 3 ), C 3 ) and σ : ∆ 3 Γ ∆.

Finally, T = s = σ(T 0 ).

• (Free Variable) Suppose that t = x, σ(T 0 ) ≡ βΓ T , Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, x ∉ dom(∆ 1 ) ∪ dom(Σ) and ∆ 0 = ∆ 1 (x : T 0 ).
We have Γ; ∆σ(Σ) ⊢ σ(x) : T and, by conversion, Γ; ∆σ(Σ) ⊢ σ(x) : σ(T 0 ).

Since dom(Σ) ∩ codom(σ) = and FV (T 0 ) ∩ dom(Σ) = , we also have Γ; ∆ ⊢ σ(x) : σ(T 0 ).

Therefore, since σ : ∆ 1 Γ ∆, we also have σ : ∆ 0 Γ ∆.

• (C-Abstraction) Suppose that t = λx : A 1 .u, σ(T 0 ) ≡ βΓ T , Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, T 0 → * βΓ Πx : A 0 .B 0 , Γ; ∆ 1 ; Σ; C 1 c A 1 ⇐ Type | (∆ 2 , C 2 ) and Γ; ∆ 2 ; Σ(x : A 1 ); C 2 c u ⇐ B 0 | (∆ 3 , C 3 ).
From Γ; ∆σ(Σ) ⊢ σ(λx : A 1 .u) : T , by inversion, we have Γ; ∆σ(Σ) ⊢ σ(A 1 ) : Type, Γ; ∆σ(Σ(x : A 1 )) ⊢ σ(u) : B , B = Kind and T ≡ βΓ Πx : σ(A 1 ).B . Therefore, we have Πx : σ(A 1 ).B ≡ βΓ σ(Πx : A 0 .B 0 ). Since Γ; ∆σ(Σ) ⊢ Πx : σ(A 1 ).B : s and, by subject reduction, Γ; ∆σ(Σ) ⊢ σ(Πx : A 0 .B 0 ) : s, we have, by product compatibility, σ(A 1 ) ≡ βΓ σ(A 0 ) and B ≡ βΓ σ(B 0 ).

By induction hypothesis on

A 1 , σ ∈ Sol(dom(∆ 2 ), C 2 ) and σ : ∆ 2 Γ ∆.
By induction hypothesis on u, σ ∈ Sol(dom(∆ 3 ), C 3 ) and σ : ∆ 3 Γ ∆. By induction hypothesis, we have, σ ∈ Sol(dom(∆ 2 ), C 2 ) and σ : ∆ 2 Γ ∆.

Moreover, since C 0 = C 3 ∪ {(λΣ.A 1 , λΣ.A 0 )}, we have σ ∈ Sol(∆ 3 , C 0 ). • (C-Application) Suppose that t = u x, σ(T 0 ) ≡ βΓ T , Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, (x : A 0 ) ∈ Σ and Γ; ∆ 1 ; Σ; C 1 c u ⇐ Πx : A 0 .T 0 | (∆ 2 , C 2 ).
• (Inversion) Suppose that we have

T ≡ βΓ σ(T 0 ), Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, C 0 = C 2 ∪ {(λΣ.T 0 , λΣ.T 2 )} and Γ; ∆ 1 ; Σ; C 1 i t ⇒ (∆ 2 , T 2 , C 2 ).
By induction hypothesis, σ ∈ Sol(dom(∆ 2 ), C 2 ), and σ : ∆ 2 Γ ∆, T ≡ βΓ σ(T 2 ) and Γ; ∆σ(Σ) ⊢ σ(T 2 ) : s.

Since σ(T 0 ) ≡ βΓ T ≡ βΓ σ(T 2 ), we have σ ∈ Sol(dom(∆ 2 ), C 0 ).

• (App-No-Check) By induction hypothesis.

• (No-Check) Trivial.

We can now prove Theorem 3.5.8.

Proof of Theorem 3.5.8. Let Γ be a well-formed global context. Suppose that Γ; ; ,

i u ⇒ (∆ 0 , T 0 , C ), τ ∈ PreSol Γ (dom(∆ 0 ), C ), Γ ⊢ ctx ∆ 0 and Γ; τ(∆ 0 ) ⊢ v : τ(T 0 ).
Suppose that, for some ∆, σ and T , we have Γ; ∆ ⊢ σ(u) : T and Γ ⊢ ctx ∆. Since FV (u) ∪ FV (v) ⊂ dom(∆), we can assume wlog that dom(σ) ⊂ dom(∆).

By Lemma 3.5.10, σ ∈ Sol Γ (dom(∆ 0 ), C ) and σ : ∆ 0 Γ ∆. Therefore, we have, for all x ∈ dom(τ(∆ 0 )), Γ; ∆ ⊢ σ(x) : T x with T x = σ(∆ 0 (x)) ≡ βΓ στ(∆ 0 (x)). By Lemma 3.2.3, we have then σ : τ(∆ 0 ) Γ ∆.

By Lemma 2.6.9, we have Γ; ∆ ⊢ σ(v) : στ(T 0 ). Finally, since στ(T 0 ) ≡ βΓ σ(T 0 ) ≡ βΓ T , then we have, by conversion, Γ; ∆ ⊢ σ(v) : T .

It is now possible to show that the rewrite rule for tail is well-typed.

Γ wwf Γ; ⊢ K : Kind C ∉ dom(Γ) Γ(C : K ) wwf (Rewrite Rules) Γ wwf → βΓΞ is confluent (∀i )Γ ⊢ w u i → v i (∀i ) f i is a definable symbol Ξ = ( f 1 u 1 → v 1 ) . . . ( f n u n → v n ) ΓΞ wwf

Weakly Well-Formed Global Contexts

We now define a variant of the notion of strongly well-formed global context based on the notion of weakly well-formed rewrite rule instead of that of strongly wellformed rewrite rule. Definition 3.6.8 (Weakly Well-Formed Global Contexts). A global context Γ is weakly well-formed if the judgment Γ wwf is derivable from the inference rules of Figure 3.5. Theorem 3.6.9. Weakly well-formed global contexts are safe.

Proof. By induction on the derivation of wwf, we prove that:

• the declarations are well-typed;

• → βΓ is confluent;

• for all (u → v) ∈ Γ, u = c w where c is a definable symbol;

• and the rewrite rules are weakly well-typed in some prefix of Γ.

By Theorem 2.6.11, product compatibility holds. By Theorem 3.6.6, the rewrite rules are well-typed. Therefore Γ is safe.

Corollary 3.6.10. Weakly well-formed global contexts are well-typed.

Examples

We now look at some examples of weakly well-formed global contexts.

Functions on Vectors Suppose that Vector and S are static symbols. Using Theorem 3.6.6, we can show that the following context is weakly well-formed.

The rewrite rule for tail:

tail n 1 (vcons n 2 e l ) → l .

The rewrite rules for vmap, the function that applies a function to any element of a vector, are:

vmap : Πx : nat.(term -→ term) -→ Vector n -→ Vector n. vmap 0 f vnil → vnil. vmap (S n 1 ) f (vcons n 2 e l ) → vcons n 2 ( f e) (vmap n 2 f l ).
The rewrite rules for vappend, the function that concatenates two vectors, are:

vappend : Πn 1 : nat.Πn 2 : nat.Vector n 1 -→ Vector n 2 -→ Vector (plus n 1 n 2 ). vappend 0 n vnil l → l . vappend (S n 1 ) m (vcons n 2 e l 1 ) l 2 → vcons (plus n 2 m) e (vappend n 2 m l 1 l 2 ).
Remark 3.6.11. We could write the second rewrite rule on vappend differently:

vappend (S n 1 ) m (vcons n 2 e l 1 ) l 2 → vcons (plus n 1 m) e (vappend n 1 m l 1 l 2 ).
These two rules should be equivalent since, morally, n 1 and n 2 are convertible. However, consider the following rewrite rule:

vappend n 0 l vnil → l .

In both cases we have a new critical peak. With the first version of the rule on vappend,

the critical peak is joinable and the confluence is preserved (Theorem 1.4.7). β-reduction in the simply typed λ-calculus is simulated using the following rewrite rule:

lapp a 1 b 1 (labs a 2 b 2 t 1 ) t 2 → t 1 t 2 .
Assuming that lterm and arrow are static symbols, by Theorem 3.6.6, this rewrite rule is weakly well-typed.

Optimizing Pattern Matching

So far, we have motivated the use of ill-typed left-hand side of rewrite rules to turn non-left-linear rewrite rules into left-linear rewrite rules to recover the confluence of the rewriting relation. Very similar ideas have been used [START_REF] Brady | Inductive Families Need Not Store Their Indices[END_REF] to optimize dependent pattern matching and the representation of terms in memory in the context of dependent type theory with inductive types and elimination operators. One of the ideas is that the rule:

vmap (S n) f (vcons n e l ) → vcons n ( f e) (vmap n f l ).
can be replaced by:

vmap n 1 f (vcons n 2 e l ) → vcons n 2 ( f e) (vmap n 2 f l ).
since, at runtime, because of typing constraints, n 1 can only be convertible with S n 2 . Here we have done more than just linearizing the rule since we have also deleted the constant S, resulting in an optimization of the pattern matching. This last rewrite rule is weakly well-formed; therefore this notion can also be used to justify the type-safety of such optimizations. These ideas have been implemented in Agda using an algorithm similar to ours [START_REF] Norell | Towards a practical programming language based on dependent type theory[END_REF].

Characterisation of Well-Typedness of Rewrite Rules

Even if the notion of weakly well-formed rewrite rule is much more general than the notion of strongly well-formed rewrite rule we started with, it does not coincide with the notion of well-typed rewrite rule. Consider the following rewrite rules.

(Trivial β-redex)

The three rewrite rules are well-typed, but none of them is weakly well-formed. The reason is that, in each case, it is not possible to infer the type of y because it is not uniquely defined. For instance, λx : nat.S x and λ : x : nat.isZero x are two instances of the η-reduction rule. In the first case, y is substituted by the term S of type nat -→ nat and, in the second case, by the term isZero of type nat -→ prop.

(Free Variable) x ∉ dom(Σ) Γ; Σ e x : ({x}, , X x ) (O-Application) Γ; Σ e u : (V 1 , C 1 , T ) Γ; Σ e v : (V 2 , C 2 , A) { x} = dom(Σ)
X is a fresh type variable In this section, we give an exact characterization of well-typed rewrite rules as a problem of inclusion between sets of solutions to unification constraints.

C 3 = C 1 ∪ C 2 ∪ {(λΣ.T = λΣ.Πy : A.X x y)} Γ; Σ e u v : (V 1 ∪ V 2 , C 3 , X x v) (T-Application) Γ; Σ e U : (V 1 , C 1 , Πx : A 1 .B ) Γ; Σ e v : (V 2 , C 2 , A 2 ) C 3 = C 1 ∪ C 2 ∪ {(λΣ.A 1 = λΣ.A 2 )} Γ; Σ e U v : (V 1 ∪ V 2 , C 3 , B [x/v]) (Abstraction) Γ; Σ e A : (V 1 , C 1 , Type) B = Kind Γ; Σ(x : A) e u : (V 2 , C 2 , B ) Γ; Σ e λx : A.u : (V 1 ∪ V 2 , C 1 ∪ C 2 , Πx : A.B ) (T-Product) Γ; Σ e A : (V 1 , C 1 , Type) Γ; Σ(x : A) e B : (V 2 , C 2 , s) Γ; Σ e Πx : A.B : (V 1 ∪ V 2 , C 1 ∪ C 2 , s)

Typing All Terms

We give the definition of a type system similar to Definition 3.5.7 but that is able to type more terms. Remark that in the rule (Free Variable) and (O-Application), we make use of type-level variables. Moreover, we assume that every (object-level) variable x is associated to a type-level variable X x .

As for , the type system e records the typing constraints of the term. But, to be able to synthesize a type in any case, it may introduce fresh type variables when the type cannot be inferred.

The judgment Γ; Σ e A : (V , C , T ) means that we are exploring the term A in the local context Σ. V is the set of variables free in A that are not in dom(Σ) and C is the set of typing constraints that should be verified for A to be well-typed of type T .

Remark 3.7.2. The case of type-level application (T-Application) is different from that of object-level application (O-Application). Indeed, since kind-level product types are only convertible to other product types, we may assume that the type of the term in function position is already a product-type. The only constraint we need to add then is that the expected type and inferred type of the argument match.

Remark 3.7.3. For any Γ, Σ and t , there exists at most one tuple (V , C , T ) (up to fresh variable renaming) such that Γ; Σ e t : (V , C , T ). We say that the pair (V , C ) is a unification problem. Notation 3.7.4. When C is a set of constraints, we write F T V (C ) for the set of free type variables occurring in C .

Solutions of a Set of Typing Constraints

In the previous sections, a solution of a set of constraints was a substitution σ equating all the constraints. Here we also consider a substitution τ substituting the type variables introduced by the rules (Free Variable) and (O-Application). To type these substitutions we also need to consider a local context ∆. Definition 3.7.5. Let Γ be a well-typed global context, V be a set of variables and C be a set of constraints.

The triple (∆, σ, τ) is a solution of (V , C ) if

• Γ ⊢ ctx ∆; • V = dom(σ);
• τ is a type-level substitution such that

-dom(τ) = {X x |x ∈ dom(σ)} ∪ F T V (C ), -for all x ∈ dom(σ), Γ; ∆ ⊢ σ(x) : τ(X x ), -στ(X x ) = τ(X x )
and, for all (T 1 , T 2 ) ∈ C , στ(T 1 ) ≡ βΓ στ(T 2 ).

We write Sol(V , C ) the set of solutions of (V , C ).

Remark 3.7.6.

If (∆, σ, τ) ∈ Sol(V , C ), then codom(σ) ∪ codom(τ) ⊂ dom(∆)
. This follows from the fact that, for all x ∈ dom(σ), Γ; ∆ ⊢ σ(x) : τ(X x ), Lemma 3.7.7. Let Γ be a well-typed global context.

If (∆, σ |V 1 , τ 1 ) ∈ Sol(V 1 , C 1 ), (∆, σ |V 2 , τ 2 ) ∈ Sol(V 2 , C 2 ) and F T V (C 1 ) ∩ F T V (C 2 ) ⊂ { X x | x ∈ dom(σ) }, then there exists τ 3 such that (∆, σ |V 1 ∪V 2 , τ 3 ) ∈ Sol(V 1 ∪V 2 , C 1 ∪C 2 ).
Moreover, for all X ∈ dom(τ 1 ), we have τ 3 (X ) ≡ βΓ τ 1 (X ) and, for all X ∈ dom(τ 2 ), we have τ 3 (X ) ≡ βΓ τ 2 (X ).

Proof. Since, for all x ∈ dom(σ), Γ; ∆ ⊢ σ(x) : τ 1 (X x ) and Γ; ∆ ⊢ σ(x) : τ 2 (X x ), by uniqueness of types, we have τ 1 (X ) ≡ βΓ τ 2 (X ) for all X ∈ dom(τ 1 ) ∩ dom(τ 2 ). Therefore, we can take

τ 3 (X ) = τ 1 (X ) if X ∈ dom(τ 1 ), τ 2 (X ) if X ∈ dom(τ 2 ) \ dom(τ 1 )

A Characterisation of Well-Typed Rewrite Rules

The following theorem says that the well-typedness problem for rewrite rules corresponds to an inclusion problem between sets of solutions of unification constraints.

Theorem 3.7.8. Let Γ be a well-typed global context such that → βΓ is confluent. Suppose that Γ; e u : (V u , C u , T u ) and Γ;

e v : (V v , C v , T v ).
The two following propositions are equivalent:

• the rewrite rule (u → v) is well-typed for Γ;

• for all (∆, σ, τ 1 ) ∈ Sol(V u , C u ), there exists τ 2 such that (∆, σ, τ 2 ) ∈ Sol(V u ∪V v , C u ∪ C v ∪ {(T u = T v )}).
Before proving the theorem, we need to prove several lemmas. First, as in the previous sections, we prove the main lemma.

Lemma 3.7.9. Let Γ be a well-typed global context such that → βΓ is confluent. Suppose that:

• Γ; Σ e t : (V , C , T 0 ),

• Γ ⊢ ctx ∆, • dom(Σ) ∩ dom(σ) = , • codom(σ) ∩ dom(Σ) =
• and Γ; ∆σ(Σ) ⊢ σ(t ) : T .

Then, there exists τ such that:

• (∆, σ |V , τ) ∈ Sol(V , C )
• and στ(T 0 ) ≡ βΓ T .

Proof. By induction on Γ; Σ e t : (V , C , T 0 ).

• (Sort) Trivial.

• (Constant) Trivial.

• (Σ-Variable) Trivial.

• (Free Variable) Suppose t = x ∉ d om(Σ) and T 0 = X x . We have Γ; ∆σ(Σ) ⊢ σ(x) : T . Since codom(σ) ∩ dom(Σ) = (and dom(Σ) = dom(σ(Σ))), we have FV (σ(x)) ∩ dom(σ(Σ)) = ; therefore, there exists a reduct T 2 of T such that Γ; ∆σ(Σ) ⊢ σ(x) : T 2 and FV (T 2 ) ∩ dom(σ(Σ)) = . It follows that we also have

Γ; ∆ ⊢ σ(x) : T 2 .
We can take τ = {X x → T 2 }.

Lemma 3.7.10. Let Γ be a well-typed global context such that → βΓ is confluent. Suppose that:

• Γ; Σ e t : (V , C , T 0 ),

• dom(σ) ∩ dom(Σ) = , • codom(σ) ∩ dom(Σ) = , • (∆, σ, τ) ∈ Sol(V , C )
• and no type variable occurs in t or Σ.

Then, we have Γ; ∆σ(Σ) ⊢ σ(t ) : T for T ≡ βΓ στ(T 0 ).

Proof. By induction on Γ; Σ e t : (V , C , T ).

• (Sort) Suppose that t = Type and T 0 = Kind. We have Γ; ∆σ(Σ) ⊢ Type : Kind, σ(Type) = Type and στ(Kind) = Kind.

• (Constant) Suppose that t = c and T 0 = Γ(c). We have

σ(c) = c, στ(Γ(c)) = Γ(c) (since Γ(c) is closed) and Γ; ∆σ(Σ) ⊢ c : Γ(c).
• (Σ-Variable) Suppose that t = x ∈ dom(Σ) and T 0 = Σ(x). Since dom(Σ) ∩ dom(σ) = , we have σ(t ) = x. Moreover, since there are no type variables in T 0 , we have τ(T 0 ) = T 0 therefore, Γ; ∆σ(Σ) ⊢ x : στ(Σ(x)).

• (Free Variable) Suppose that t = x ∉ dom(Σ) and T 0 = X x . By hypothesis,

Γ; ∆ ⊢ σ(x) : τ(X x ). Since στ(X x ) = τ(X x ), by local weakening, Γ; ∆σ(Σ) ⊢ σ(x) : στ(X x ). • (O-Application) Suppose that t = u v, T 0 = X x v, Γ; Σ e u : (V 1 , C 1 , P ), Γ; Σ e v : (V 2 , C 2 , A), V = V 1 ∪ V 2 and C = C 1 ∪ C 2 ∪ {(λΣ.P = λΣ.Πy : A.X x y)}.
We have (σ, ∆, τ) ∈ Sol(V 1 , C 1 ) and (σ, ∆, τ) ∈ Sol(V 2 , C 2 ); therefore, by induction hypothesis, we get Γ; ∆σ(Σ) ⊢ σ(p) : T 1 and Γ; ∆σ(Σ) ⊢ σ(q) : T 2 with T 1 ≡ βΓ στ(P ) and T 2 ≡ βΓ στ(A).

Moreover, we have στ(P ) ≡ βΓ στ(Πy : A.X x y). It follows that T 1 ≡ βΓ στ(Πy : A.X x y)

By confluence, there exist A 0 and B 0 such that T 2 → βΓ A 0 , T 1 → βΓ Πy : A 0 .B 0 and στ(X x y) → * βΓ B 0 . By conversion, Γ; ∆σ(Σ) ⊢ σ(p) : Πy : A 0 .B 0 and Γ; ∆σ(Σ) ⊢ σ(q) : A 0 .

It follows that

Γ; ∆σ(Σ) ⊢ σ(p q) : B 0 [y/σ(q)] with B 0 [y/σ(q)] ≡ βΓ στ(X x q). • (T-Application) Suppose that t = U v, T 0 = B 1 [x/v], V = V 1 ∪V 2 , C = C 1 ∪C 2 ∪ {(λΣ.A 1 = λΣ.A 2 )}, Γ; Σ e U : (V 1 , C 1 , Πx : A 1 .B 1 ) and Γ; Σ e v : (V 2 , C 2 , A 2 ).
We have (σ, ∆, τ) ∈ Sol(V 1 , C 1 ) and (σ, ∆, τ) ∈ Sol(V 2 , C 2 ), therefore, by induction hypothesis, Γ; ∆σ(Σ) ⊢ σ(U ) : T 1 and Γ; ∆σ(Σ) ⊢ σ(v) : T 2 with T 1 ≡ βΓ στ(Πx : A 1 .B 1 ) and T 2 ≡ βΓ στ(A 2 ).

Moreover, στ(A 1 ) ≡ βΓ στ(A 2 ).

By confluence, there exist A 0 and B 0 such that T 2 → βΓ A 0 , T 1 → βΓ Πx : A 0 .B 0 and στ(B 1 ) → * βΓ B 0 .

By conversion, Γ; ∆σ(Σ) ⊢ σ(U ) : Πx : A 0 .B 0 and Γ; ∆σ(Σ) ⊢ σ(v) : A 0 .

Therefore, we have and

Γ; ∆σ(Σ) ⊢ σ(U v) : B 0 [x/σ(v)] with B 0 [x/σ(v)] ≡ βΓ στ(B 1 [x/v]). • (Abstraction) Suppose that t = λx : A 0 .u, T 0 = Πx : A 0 .B 0 , V = V 1 ∪ V 2 , C = C 1 ∪ C 2 , Γ; Σ e A 0 : (V 1 , C 1 , Type) and Γ; Σ(x : A 0 ) e u : (V 2 , C 2 , B 0 ).
We have (σ, ∆, τ) ∈ Sol(V 1 , C 1 ) and (σ, ∆, τ) ∈ Sol(V 2 , C 2 ), therefore, by induction hypothesis, Γ; ∆σ(Σ) ⊢ σ(A 0 ) : Type and Γ; ∆σ(Σ(x

: A 0 )) ⊢ σ(u) : T 2 with T 2 ≡ βΓ στ(B 0 ).
It follows that Γ; ∆σ(Σ) ⊢ σ(λx : A 0 .u) : Πx : σ(A 0 ).T 2 and Πx : σ(A 0 ).T 2 ≡ βΓ στ(Πx : A 0 .B 0 ).

• (Product) Suppose that t = Πx : A.B , T 0 = s, V = V 1 ∪ V 2 , C = C 1 ∪ C 2 , Γ; Σ e A : (V 1 , C 1 , Type) and Γ; Σ(x : A) e B : (V 2 , C 2 , s).
We have (σ, ∆, τ) ∈ Sol(V 1 , C 1 ) and (σ, ∆, τ) ∈ Sol(V 2 , C 2 ); therefore, by induction hypothesis, Γ; ∆σ(Σ) ⊢ σ(A) : Type and Γ; ∆σ(Σ(x : A)) ⊢ σ(B ) : s.

It follows that Γ; ∆σ(Σ) ⊢ σ(Πx : A.B ) : s.
Finally, we can now prove Theorem 3.7.8.

Proof of Theorem 3.7.8. Let Γ be a well-typed global context such that → βΓ is confluent. Suppose that Γ;

e u : (V u , C u , T u ) and Γ; e v : (V v , C v , T v ). • Assume that (u → v) is well-typed for Γ. Let (∆, σ, τ u ) ∈ Sol(V u , C u ).
By Lemma 3.7.10, we have Γ; ∆ ⊢ σ(u) : στ u (T u ) and, by well-typedness of the rewrite rule, Γ; ∆ ⊢ σ(v) : στ u (T u ).

By Lemma 3.7.9, there exists

τ v such that (∆, σ, τ v ) ∈ Sol(V v , C v ) and στ v (T v ) ≡ βΓ στ u (T u ).
By Lemma 3.7.7, there exists τ such that (∆, σ, τ) ∈ Sol(V , C u ∪ C v ), for all X ∈ dom(τ u ), we have τ(X ) ≡ βΓ τ u (X ) and, for all X ∈ dom(τ v ), we have τ(X ) ≡ βΓ τ v (X ).

It follows that στ(T

v ) ≡ βΓ στ(T u ) and (∆, σ, τ uv ) ∈ Sol(V , C u ∪C v ∪{(T u = T v )}). • Now assume that, if (∆, σ, τ u ) ∈ Sol(V u , C u ), then there exists τ uv such that (∆, σ, τ uv ) ∈ Sol(V u ∪ V v , C u ∪ C v ∪ {(T u = T v )}).
Let (u → v) be a rewrite rule and suppose that Γ; ∆ ⊢ σ(u) : T .

By Lemma 3.7.9, for some τ u , we have (∆, σ, τ u ) ∈ Sol(V u , C u ) and T ≡ βΓ στ u (T u ).

Thus, by hypothesis, there exists

τ uv such that (∆, σ, τ uv ) ∈ Sol(V u ∪ V v , C u ∪ C v ∪ {(T u = T v )}).
Therefore, (∆, σ, τ uv ) ∈ Sol(V v , C v ) and, by Lemma 3.7.10,

Γ; ∆ ⊢ σ(v) : V for V ≡ βΓ στ uv (T v ) ≡ βΓ στ uv (T u ) ≡ βΓ T .
It follows, by the conversion rule, that Γ; ∆ ⊢ σ(v) : T .

Applications

Using Theorem 3.7.8, we are now able to prove that the rewrite rules from the beginning of the section are well-typed.

Corollary 3.7.11. The rewrite rules (Identity), (η-reduction) and (Trivial β-redex) are well-typed.

Proof.

• (Identity) We have: Γ; e y : ({y}, , X y ) and Sol({y}, ) ⊂ Sol({y}, {(X y = X y )}). Therefore, by Theorem 3.7.8, the rewrite rule y → y is well-typed.

• (η-reduction) We have:

Γ;

e λx : nat.y x : ({y}, C , Πx : nat.X x) with C = {(Type = Type), (X y = Πx : nat.X x)} and Γ;

e y : ({y}, , X y ).

Since C ∪ ∪ {(X y = Πx : nat.X x)}) = C , by Theorem 3.7.8, the rewrite rule λx : nat.y x → y is well-typed.

• (Trivial β-redex) We have: Γ;

e (λx : nat.y) 0 : ({y}, C , X 0) with C = {(Type = Type), (Πx : nat.X y x = Πx : nat.X x)} and Γ;

e y : ({y}, , X y ).

By product compatibility, Sol({y}, {(Type = Type), (Πx : nat.X y = Πx : nat.X x)}) ⊂ Sol({y}, {(Type = Type), (Πx : nat.X y x = Πx : nat.B x), (X 0 = X y )}). Therefore, by Theorem 3.7.8, the rewrite rule (λx : nat.y) 0 → y is well-typed.

Undecidability

We now show the undecidability of well-typedness of rewrite rules.

Lemma 3.7.12 (Undecidability of Unification). Let Γ be a global context without rewrite rule and containing the declaration (ι : Type). Unification modulo ≡ βΓ (= ≡ β ) is undecidable.

More precisely, there exists a set Pol of terms of type CN n -→ CN (with CN = ι -→ (ι -→ ι) -→ ι), for some n, such that it is not decidable, given two terms in Pol p and q of type CN n 1 -→ CN and CN n 2 -→ CN respectively, to tell if there exist two vectors u 1 of size n 1 and u 2 of size n 2 such that p u 1 ≡ βΓ q u 2 .

Proof. We can easily reduce Hilbert tenth problem as it is done for proving the undecidability of higher-order unification in [START_REF] Dowek | Higher-Order Unification and Matching[END_REF]. The set Pol corresponds to a set of polynomials represented by Church's numerals.

Theorem 3.7.13 (Undecidablity of Well-Typedness for Rewrite Rules). Well-typedness of a rewrite rule is undecidable.

Proof. We reduce the problem of unification modulo ≡ βΓ of Lemma 3.7.12. Let Γ be the global context containing the following declarations:

ι : Type. E : CN -→ Type. f : Π x : CN.E (p x) -→ ι. g : Π y : CN.E (q y).
where p and q are two arbitrary terms in Pol. Consider the rewrite rule:

f x (g y) → λz : ι.z.
According to Theorem 3.7.8, it is well-typed if and only if for all (σ, ∆, τ 1 )

∈ Sol Γ ({ x, y}, {(E (p x) = E (q y))}), there exists τ 2 such that (σ, ∆, τ 2 ) ∈ Sol Γ ({ x, y}, {(E (p x) = E (q y)), (ι = ι -→ ι)}).
Since the equation ι ≡ βΓ ι -→ ι is not satisfiable, the rewrite rule is well-typed if and only if Sol Γ ({ x, y}, {(E (p x) = E (q y))}) = .

By Lemma 3.7.12, we cannot decide such equality.

Conclusion

We have studied the property of well-typedness of rewrite rules. Starting from the notion of strongly well-formed rewrite rule, we have generalized gradually the criterion of well-typedness to allow non-algebraic and ill-typed left-hand sides. In particular, the new criterion justifies the linearization of left-hand sides of rewrite rules when non-linearity arises from typing constraints. Keeping left-linear rewrite rules is important to preserve confluence of the rewrite system. Indeed, the combination of non left-linear rewrite rules with β-reduction is often non-confluent as the examples of Section 1.4.3 show. Confluence can then be used to prove, among others, product compatibility. Finally, we have given an exact characterisation of the welltypedness property for rewrite rules as a problem of inclusion between solutions of two unification problems and we have used this characterisation to show the undecidability of well-typedness of rewrite rules.

Chapter 4

Rewriting Modulo β

Résumé Ce chapitre définit une notion de réécriture modulo β pour le λΠ-Calcul Modulo. En partant des observations que (1) la confluence du système de réécriture est une propriété vivement souhaitée car elle a pour conséquence la propriété de la compatibilité du produit ainsi que, avec la terminaison, la décidabilité de la congruence et que (2) la confluence est facilement perdue lorsque les règles de réécriture filtrent sous les abstractions, on propose une nouvelle notion de réécriture qui réconcilie confluence et filtrage sous les abstractions. Cette nouvelle notion est définie à travers un encodage des termes vers un système de réécriture d'ordre supérieur. Ceci permet d'importer dans le λΠ-Calcul Modulo les résultats de confluence conçus pour les systèmes d'ordre supérieur. On détaille aussi comment la réécriture modulo β peut être efficacement implémentée par la compilation des règles de réécriture en arbres de décision.

Introduction

In this chapter, we are interested in the confluence of rewriting systems. In particular, we study a problem arising from the combination of rewrite rules with βreduction. Remember that confluence is a highly desirable property of the λΠ-Calculus Modulo for several reasons. First, confluence is the most direct way to prove the product compatibility property (Theorem 2.6.11). Second, as soon as the rewrite relation is also strongly normalizing, confluence entails the decidability of the congruence: two terms are convertible if and only if they have the same normal form. Third, confluence has also been used in the previous chapter for proving that weakly-well-formed rewrite rules are permanently well-typed. More generally, any property based on unification will require confluence. Lastly, confluence is used to prove strong normalization when there are type-level rewrite rules [START_REF] Blanqui | Inductive types in the Calculus of Algebraic Constructions[END_REF].

One case where confluence is easily lost is if one allows rewrite rules with λabstractions on their left-hand side. For instance, consider the following rewrite rule (which reflects the mathematical equality (e f ) ′ = f ′ * e f ): In this chapter, we formalize the notion of rewriting modulo β in the context of the λΠ-Calculus Modulo. We achieve this by encoding the λΠ-Calculus Modulo into Nipkow's Higher-Order Rewrite Systems [START_REF] Nipkow | Higher-Order Critical Pairs[END_REF]. This encoding allows us, first, to properly define matching modulo β using the notion of higher-order rewriting and, secondly, to make the confluence results for higher-order rewriting available for the λΠ-Calculus Modulo.

D (λx : R.Exp ( f x)) → fMult (D (λx : R. f x)) (λx : R.Exp ( f x)).
Then, we prove a version of the subject reduction property for rewriting modulo β and that the confluence of the new rewriting relation implies the product compatibility property, generalizing the results of the previous chapters.

A Naive Definition of Rewriting Modulo β

As already mentioned, our goal is to give a notion of rewriting modulo β in the setting of the λΠ-Calculus Modulo. We first exhibit the issues arising from a naive definition of this notion.

In an untyped setting, we could define rewriting modulo β in this manner: t 1 rewrites to t 2 if, for some rewrite rule (u → v) and substitution σ, σ(u) ≡ β t 1 and σ(v) ≡ β t 2 . This definition is not satisfactory for several reasons.

It breaks subject reduction.

For the rewrite rule of Section 4.1, taking σ = { f → λy : Ω.y} where Ω is some ill-typed term, we have D (λx : R.Exp x) -→ fMult (D (λx : R.(λy : Ω.y) x)) (λx : R.Exp ((λy : Ω.y) x)) and, even if D (λx : R.Exp x) is well-typed, its reduct is ill-typed since it contains an ill-typed subterm.

It may introduce free variables. In the example above, Ω has no reason to be closed.

It does not provide confluence. If we consider the following variant of the rewrite rule

D (λx : R.Exp ( f x)) → fMult (D f ) (λx : R.Exp ( f x))
and take σ 1 = { f → λy : A 1 .y} and σ 2 = { f → λy : A 2 .y} where A 1 and A 2 are two non-convertible types, then we have: D (λx : R.Exp ((λy : R.y) x)) fMult (D (λy : A 1 .y)) (λx : R.(Exp ((λy : A 1 .y) x))) fMult (D (λy : A 2 .y)) (λx : R.(Exp ((λy :

A 2 .y) x))) D σ 1 D σ 2
and the peak is not joinable.

Therefore, we need to find a definition that takes care of these issues. We will achieve this using an embedding of λΠ-Calculus Modulo into Higher-Order Rewrite Systems.

Higher-Order Rewrite Systems

In 1991, Nipkow [START_REF] Nipkow | Higher-Order Critical Pairs[END_REF] introduced Higher-Order Rewrite Systems (HRS) in order to lift termination and confluence results from first-order rewriting to rewriting over λ-terms. More generally, the goal was to study rewriting over terms with bound variables such as programs, theorems and proofs.

Unlike the λΠ-Calculus Modulo, in HRSs β-reduction and rewriting do not operate at the same level. Rewriting is defined as a relation between the βη-equivalence classes of simply typed λ-terms: the λ-calculus is used as a meta-language.

Higher-Order Rewrite Systems are based upon the (pre)terms of the simply-typed λ-calculus built from a signature. A signature is a set of base types B and a set of typed constants. A simple type is either a base type b ∈ B or an arrow A -→ B where A and B are simple types.

Definition 4.3.1 (Preterm). A preterm of type A is • either a variable x of type A (we assume given for each simple type A an infinite number of variables of this type),

• or a constant f of type A,

• or an application t (u) where t is a preterm of type B -→ A and u is a preterm of type B ,

• or, if A = B -→ C , an abstraction λx.t where x is a variable of type B and t is a preterm of type C .

In order to distinguish the abstraction of HRSs from the abstraction of λΠ-Calculus Modulo, we use the underlined symbol λ instead of λ. Similarly, we write the application t (u) for HRSs (instead of t u). We use the abbreviation t (u 1 , . . . , u n ) for t (u 1 ) . . . (u n ). If A is a simple type, we write A 1 for A and A n+1 for A -→ A n .

Notice also that HRSs abstractions do not have type annotations because variables are typed.

β-reduction for preterms is defined as usual.

Definition 4.3.2 (Restricted η-expansion). The relation of restricted η-expansion (written

→ η ) is defined as follows: C [s] → η C [λx.s x]
if the following conditions are satisfied:

• s has type A -→ B , for some types A and B ;

• x is a fresh variable of type A;

• s is not of the form λz.s 0 ;

• in the preterm C [s], s does not occur as the left part of an application (it means that restricted η-expansions do not create β-redexes).

Remark 4.3.3. A preterm t is equivalent to a unique preterm in βη-normal form. We write η β t for the βη-normal form of t .

Definition 4.3.4 (HRS-Term).

A term is a preterm in βη-normal form.

Definition 4.3.5 (Pattern). A term t is a pattern if every free occurrence of a variable F is in a subterm of t of the form F u such that u is η-equivalent to a list of distinct bound variables.

The crucial result about patterns (due to Miller [START_REF] Miller | A Logic Programming Language with Lambda-Abstraction, Function Variables, and Simple Unification[END_REF]) is the decidability of their higher-order unification (unification modulo βη). Moreover, if two patterns are unifiable, then a most general unifier exists and is computable.

The notion of rewrite rule for HRSs is the following: Definition 4.3.6 (Rewrite Rules). A rewrite rule is a pair of terms (l → r ) such that l is a pattern not η-equivalent to a variable, FV (r ) ⊂ FV (l ) and l and r have the same base type.

The restriction to patterns for the left-hand side ensures that matching is decidable but also that, when it exists, the resulting substitution is unique. This way, the situation is very close to first-order (i.e. syntactic) matching. Definition 4.3.7 (Higher-Order Rewriting System (HRS)). A Higher-Order Rewriting System is a set R of rewrite rules.

The rewrite relation → R on terms is inductively defined as follows:

• for any (l → r ) ∈ R and any substitution σ,

η β σ(l ) → R η β σ(r ); • if t 1 → R t 2 and
x is a variable, then x(. . . , t 1 , . . .) → R x(. . . , t 2 , . . .);

• if t 1 → R t 2 and f is a constant, then f (. . . , t 1 , . . .) → R f (. . . , t 2 , . . .);

• if t 1 → R t 2 , then λx.t 1 → R λx.t 2 .
The standard example of an HRS is the untyped λ-calculus. The signature involves a single base type Term and two constants:

Lam : (Term -→ Term) -→ Term App : Term -→ Term -→ Term
and a single rewrite rule for β-reduction:

(beta) App(Lam(λx.X (x)), Y ) → X (Y )
Proof. We have (λx :

A.t )u = App(Lam( A , λx. t ), u ) → (beta) η β ((λx. t )( u )) = t [x/ u ] = t [x/u] . Indeed, t [x/ u ]
is already a normal form since the variable x cannot have arguments in t and therefore the substitution does not introduce β-redexes. Lemma 4.4.7. If t 1 → (beta) t 2 and t 1 , t 2 have type Term, then t 1

-1 → β t 2 -1 . Proof. If t 1 = η β (σ(App(Lam(A, λx.t (x)), u))) → (beta) t 2 = η β (σ(t (u))) and x ∈ dom(σ), then t 1 -1 = (λx : σ(A) -1 . η β (σ(t ) x) -1 ) σ(u) -1 → β η β (σ(t ) x) -1 [x/ σ(u) -1 ] = η β (σ(t (u))) -1 = t 2 -1 .
By encoding rewrite rules in the obvious way (i.e., translating (u → v) by ( u → v )), we would get a similar result for Γ-reduction. But, since we want to incorporate rewriting modulo β, we proceed differently.

First, we introduce the notion of uniform terms. These are terms verifying an arity constraint on their free variables. Definition 4.4.8 (Uniform terms). A term t is uniform for a set V of variables if all occurrences of a variable in V and free in t is applied to the same number of arguments. A uniform term is a term uniform for its free variables. Now, we define an encoding for uniform terms. Definition 4.4.9 (Encoding of uniform terms). Let V be a set of variables and t be a term uniform in V . The HRS-term u V of type Term is defined as follows:

Kind V := Kind Type V := Type x V := x, if x ∉ V (variable of type Term) c V := c λx : A.u V := Lam( A V , λx. u V \{x} ) Πx : A.B V := Pi( A V , λx. B V \{x} ) x v V := x( v V ), if x ∈ V (x of type Term n+1 where n = | v|) uv V := App( u V , v V ), if uv = x w for x ∉ V
Remark 4.4.10. The restriction to uniform terms in the previous definition comes from the fact that we need to type the HRS-variables and make sure that the encoding is a HRS-term of type Term. Now, we define an equivalent of patterns for the λΠ-Calculus Modulo. Definition 4.4.11 (λΠ-patterns). A λΠ-pattern is a uniform term t = f u such that, for any variable x, if x occurs free in t then it occurs in a subterm of the form x y where y is a vector of pairwise distinct variables bound in t .

Remark 4.4.12. λΠ-patterns are defined in such a way that their encodings as uniform terms exactly match the definition of patterns in HRSs. If p is a λΠ-pattern, then p FV (p) is a pattern.

We now define the encoding of rewrite rules.

Properties

Rewriting modulo β preserves typing. Proof. The idea is to lift the β-reductions that occur at the HRS level to the λΠ-Calculus Modulo. Suppose t 1 → Γ b t 2 . For some rewrite rule (u → v) and (HRS) substitution σ, we have η β σ(u) = t 1 and η β σ(v) = t 2 . We define the (λΠ) substitution σ as follows: σ(x) = σ(x) -1 if σ(x) has type Term; σ(x) = λ x : A. u -1 if σ(x) = λ x.u has type Term n -→ Term where the A i are arbitrary types. We have, at the λΠ level, σ(u) → Γ σ(v), σ(u) → * β t 1 and σ(v) → * β t 2 . If t 1 is well-typed, then the A i can be chosen so that σ(u) is also well-typed.

Another consequence of this lemma is that the rewriting modulo β does not modify the congruence. Proof. Same proof as Theorem 3.6.9, but product compatibility is obtained by Theorem 4.5.7.

Γ wf β Γ; ⊢ K : Kind C ∉ dom(Γ) Γ(C : K ) wf β (Rewrite Rules) Γ wf β → β(ΓΞ) b is confluent (∀i )Γ ⊢ w f u → v i (∀i ) f i is a definable symbol Ξ = ( f 1 u 1 → v 1 ) . . . ( f n u n → v n ) ΓΞ wf β

Proving Confluence of Rewriting Modulo β

We have shown that the confluence of the rewriting modulo β relation has nice consequences on the type system. Now, we give a powerful criterion for proving confluence.

For Higher-Order Rewrite Systems, as for (first-order) Term Rewriting Systems, there are two general categories of rewrite systems for which confluence results are known: first, the terminating rewrite systems, for which confluence is decidable; second, the left-linear systems, for which several criteria for confluence exist.

Both results are based on the notion of overlapping patterns and higher-order critical pairs. Notation 4.6.1. We write t |p for the subterm of t at position p and t [u] p for the term t where its subterm at position p is replaced by u. Definition 4.6.2 (Overlapping Patterns). Let u and v be two patterns and p be a position in v. Suppose that:

• x are the free variables of v |p that are bound in v;

• σ is a substitution that maps every free variable z 1 of type A in u to z 2 ( x) where z 2 is a fresh variable of type B -→ A and B are the types of x;

• y are the variables free in η β (σ(u)) and v |p ;

• v |p is not a variable free in v.

If there exists a substitution θ with domain y such that

η β (θ(λ x.σ(u))) = η β (θ(λ x.v |p )
), then we say that u overlaps with v at position p.

Critical pairs arise from overlaps between two rewrite rules. Definition 4.6.3 (Higher-Order Critical Pair). Let (u 1 → v 1 ) and (u 2 → v 2 ) be two HRS rewrite rules such that u 1 overlaps with u 2 at position p. Let θ be a most general unifier of λ x.σ(u 1 ) and λ x.u 2|p (for x and σ as in Definition 4.6.2). The pair

( η β (θ(u 2 [σ(u 1 )] p )), η β (θ(v 2 ))
) is called a critical pair. When the overlap occurs at the root of u 2 ( i.e., p = ǫ), then the pair is a root critical pair. Otherwise, it is an inner critical pair.

We write a ⋉ b when (a, b) is a critical pair. Theorem 4.6.4 (Nipkow [Nip91]). A terminating higher-order rewrite system is confluent if and only if its critical pairs are joinable.

For our purpose, Theorem 4.6.4 is of little use since the (beta) rule is not terminating and there is no modularity result (Theorem 1.2.18) for HRSs.

Our second criteria applies to left-linear rewrite systems whose critical pairs are joinable by simultaneous reduction. Definition 4.6.5 (Simultaneous Reduction). Let R be a HRS. The simultaneous reduction relation • -→ is the relation on terms defined by:

• if s • -→ t and x is a variable, then x( s) • -→ x( t ); • if s • -→ t and f is a constant, then f ( s) • -→ f ( t ); • if s • -→ t , then λx.s • -→ λx.t ; • if u → v ∈ R and, for all x, θ 1 (x) • -→ θ 2 (x), then η β (θ 1 (u)) • -→ η β (θ 2 (v)).
Theorem 4.6.6 (Developpement Closure Theorem (V. van Oostrom [vO95])). Let R be a left-linear HRS such that:

• for every root critical pair t 1 ⋉ t 2 , there exists t 3 such that t 1 • -→ t 3 and t 2 → R t 3

• and, for every inner critical pair t

1 ⋉ t 2 , t 1 • -→ t 2 , then R is confluent.
This criterion can be adapted for our purpose.

Corollary 4.6.7. If Γ is a global context such that H RS(Γ) satisfies the hypothesis of Theorem 4.6.6, then → Γ b is confluent.

Proof. The rule (beta) is left-linear and cannot overlap with a rewrite rule in H RS(Γ).

Applications

Parsing and Solving Equations

The context declarations and rewrite rules of

Negation Normal Form

The example of Figure 4.3 is drawn from [START_REF]Term Rewriting Systems[END_REF]. It defines a rewrite system to normalize the propositions with respect to negations. It pushes negation inside the propositions and eliminates double negations. In order to push negation inside the quantifiers, the last two rewrite rules feature abstraction on their left-hand side. As previously, Theorem 4.6.6 and Theorem 3.2.1 can be used to show that this global context is well-formed.

Universe Reflection

In [START_REF] Assaf | A Calculus of Constructions with Explicit Subtyping[END_REF], Assaf defines a version of the Calculus of Constructions with explicit universe subtyping thanks to an extended notion of conversion generated by a set of rewrite rules. This work can easily be adapted to fit in the framework of the λΠ-Calculus Modulo. Product compatibility holds because the rewriting system is confluent modulo β.

Compiling Rewrite Rules for Rewriting Modulo β

We now address the problem of compiling pattern matching modulo β to decision trees. This problem has been studied by Maranget [Mar08] in the case of syntactic pattern matching. We extend his work to handle pattern matching modulo β. → or (not p 1 ) (not p 2 ) not (or p 1 p 2 ) → and (not p 1 ) (not p 2 ) not (forall (λx : Term.p x)) → exists (λx : Term.not (p x)) not (exists (λx : Term.p x)) → forall (λx : Term.not (p x))

plus 0 n → n. plus n 0 → n. plus (S n 1 ) n 2 → S (plus n 1 n 2 ). plus n 1 (S n 2 ) → S (plus n 1 n 2 ).
the naive approach is to try to successively match the term plus u v against each of the left-hand sides of the four rewrite rules. In the worst case (i.e., if only the last rule is a match), we need to inspect u twice (first to see if it is 0 in the first rule and then to see if it is a successor in the third rule) and v twice as well (for the second and last rules).

Instead, we could inspect only once the shape of each argument u and v, and still be able to say which rewrite rule to apply. This is the idea behind the compilation to decision trees.

The situation is similar if the rewrite rules require matching modulo β:

to_expr (λx : Nat.0) → mk_expr 0 0. to_expr (λx : Nat.S ( f x)) → expr_S (to_expr (λx : Nat. f x)). to_expr (λx : Nat.x) → mk_expr (S 0) 0. to_expr (λx : Nat.plus ( f x) (g x)) → expr_P (to_expr (λx : Nat. f x)) (to_expr (λx : Nat.g x)).

Here, again, if we try to match to_expr u against each rewrite rule, we will test four times that u is an abstraction.

To be able to deal with matching modulo β, the notion of decision tree must be modified for two reasons.

• First, since there may be abstractions occurring in the left-hand sides of the rewrite rules, we need to handle bound variables.

• Second, in decision trees for regular pattern matching, the leaves correspond to unification problems in solved form, that is, of the form {x i = t i } where the x i are distinct (if the rewrite rules are left-linear) and none of the x i occur in any t i . Such problems always have a unique solution. For matching modulo β the situation is different. The leaves correspond to a set of flexible-rigid equations of the form x i y i = t i where y i are bound variables and none of the x i occur in any t i . Such problems have a solution (which is unique) only if the free variables of t i are among y i . The semantics of the decision trees has to be modified in consequence.

Decision Trees

We define the syntax of decision trees and their semantics.

Definition 4.8.1 (Decision Tree). A decision tree is:

• either the tree Leaf(t , ρ, D) where t is a term, ρ is a partial function from variables to pairs ( y, n), where y is a vector of distinct variables and n is an integer, and D is a decision tree,

• or the tree Switch( j , F, D) where j is an integer, F is a partial function from {λ} ∪ ((C O ∪ C T ) × N) to decision trees and D is a decision tree. We now define the semantics of decision trees. We use the following notation to avoid, as much as possible, the reference to the construction of rewriting modulo β through HRS when working with λΠ-terms. Notation 4.8.2. Let V be a set of variables, t be a term uniform in FV (t ) \ V and σ be a HRS substitution such that dom(σ)∩V = and σ( t V ) is a preterm (of type Term).

ρ = {x → ( y x , j x )} σ = {x → λ y x .s j x } ∀x ∈ dom(ρ), FV (s j x ) ∩ V ⊆ y x (Leaf ) ( s, V ) ⊢ Leaf(v, ρ, D) → v σ V ( s, V ) ⊢ D → t (Leaf-Else) ( s, V ) ⊢ Leaf(v, ρ, D) → t F (u, n) = D u s j = u v | v| = n ( s. v, V ) ⊢ D u → t (Switch-C) ( s, V ) ⊢ Switch( j , F, D) → t F (λ) = D λ s j = λx : A.u ( s.A.u, V ∪ {x}) ⊢ D λ → t (Switch-L) ( s, V ) ⊢ Switch( j , F, D) → t ( s, V ) ⊢ D → t s j = λx : A.u s j = u v with n = | v| and (u, n) ∈ dom(F ) (Switch-Else) ( s, V ) ⊢ Switch( j , F, D) → t

We write t σ

V for the term

η β (σ( t V )) -1 .
For example, if t = Exp ( f x), V = {x} and σ = f → λy.y, then we have t σ V = Exp x. 4.4 in the form of a judgment ( s, V ) ⊢ D → t where s is a vector of terms (the stack), V is a set of variables, D is a decision tree and t is a term.

If the judgment ( s, V ) ⊢ D → t is derivable, we say that D reduces to t in the context ( s, V ).

Intuitively, a decision tree is meant to be executed with a stack s (i.e., a vector of terms s j ) and a set of variables V .

The decision tree Leaf(v, {x → ( y x , j x )}, D) corresponds to a potential match. If the unification problem {λ z.x( y x ) ≡ β λ z. s j x } with V = { z} has a solution σ, then the result of the matching is v σ V . This situation corresponds to the rule (Leaf ). If there are no solutions, then we continue, executing the decision tree D (Leaf-Else).

Remark that if there are no bound variables (i.e., V is empty), then a solution always exists.

The decision tree Switch( j , F, D) is a branching node in our search for a match. It tells us to look at the shape of s j . If s j is an abstraction and F (λ) = D λ is defined, then we continue with D λ (Switch-L). If s j = u v is a constant application or a bound variable application, and F (u, n) = D u is defined for n = | v|, then we continue with D u (Switch-C). Otherwise we continue with D (Switch-Else).

The construction Fail corresponds to the situation where the term does not match any rewrite rule.

From Rewrite Rules to Decision Tree

Let Γ be a global context for which → βΓ is well-defined. The goal of this section is to define a function CC Γ from constants to decision trees such that: The line i of (U → V ) is the pair ( u → v) where u = U (i ) and v = V (i ).

( u, ) ⊢ CC Γ ( f ) → t if and only if f u → h Γ b t . We call
The size of the matrix (U → V ) is m * n.

We now give the correspondence between rewrite rules and matrices.

Definition 4.8.8 (Rewrite Rules as a Matrix). A set of rewrite rules ( f u i → v i ) 1≤i ≤m for the same constant f and with the same number n of arguments (for all i , | u i | = n) can be represented by the matrix (U → V ) of size m * n defined as follows:

• U (i , j ) = u i , j , for 1 ≤ i ≤ m and 1 ≤ j ≤ n, • V (i ) = v i , for 1 ≤ i ≤ m.
The rewrite rule ( f u i → v i ) corresponds to the line ( u i → v i ). Remark that the constant f is not stored in the matrix.

Examples

The matrix representing the rewrite rules for plus is

M plus =     0 n n 0 S n 1 n 2 n 1 S n 2     →     n n S (plus n 1 n 2 ) S (plus n 1 n 2 )     .
The matrix representing the rewrite rules for to_expr is

M to_expr =     λx : Nat.0 λx : Nat.S ( f x) λx : Nat.x λx : Nat.plus ( f x) (g x)     →     mk_expr 0 0 expr_S (to_expr (λx : Nat. f x))
mk_expr (S 0) 0 expr_P (to_expr (λx : Nat. f x)) (to_expr (λx :

Nat.g x))     .
We know how to see a set of rewrite rules as a matrix. Now, we explain how to transform a matrix into a decision tree. This compilation process uses two operations on matrices: the extraction of the default matrix and the specialization of a matrix.

Definition 4.8.9 (Default Matrix). Let M = (U → V ) be a matrix of size m * n, 1 ≤ j ≤ n and V a set of variables.

The default matrix for M at Column j with bound variables V (written D(V , j ,U → V )) is the matrix built from the lines i of M where U (i )( j ) is either a joker or a term x y with x a variable not in V .

Examples

D( , 1,     0 n n 0 S n 1 n 2 n 1 S n 2     →     n n S (plus n 1 n 2 ) S (plus n 1 n 2 )     ) = n 0 n 1 S n 2 → n S (plus n 1 n 2 ) D({x}, 3,     * Nat 0 * Nat S ( f x) * Nat x * Nat plus ( f x) (g x)     →     mk_expr 0 0 expr_S (to_expr (λx : Nat. f x)) mk_expr (S 0) 0 expr_P . . .     ) =
Definition 4.8.10 (Specialized Matrix). Let M = (U → V ) be a matrix of size m * n, 1 ≤ j ≤ n, V be a set of variables, u be a constant or a variable in V and k be an integer. The specialized matrix S (u,k) (V , j , M ) is built from M as follows:

• we keep only the lines i of M where U (i , j ) is either a joker, or a term x y with x a variable not in V , or a term u v with | v| = k;

• we add k new columns at the end of U : if U (i , j ) = u v, then we fill the new columns with v; otherwise, we fill the new columns with jokers;

• if U (i , j ) = u v, then we replace it by a joker.

The specialized matrix S λ (V , j , M ) is built from M as follows:

• we keep only the lines i of M where U (i , j ) is either a joker, or a term x y with x a variable not in V , or an abstraction;

• we add 2 new columns at the end of U : if U (i , j ) = λx : A.w, then we fill the two new columns by A and w; otherwise, we fill the new columns with jokers;

• if U (i , j ) is an abstraction, we replace it by a joker.

Remark 4.8.11. Jokers are used to mark positions in the matrix that have already been matched or that should match anything.

Examples

S (S,1) ( , 1,

    0 n n 0 S n 1 n 2 n 1 S n 2     →     n n S (plus n 1 n 2 ) S (plus n 1 n 2 )     ) =   n 0 * * n 2 n 1 n 1 S n 2 *   →   n S (plus n 1 n 2 ) S (plus n 1 n 2 )   S λ ( , 1,     λx : Nat.0 λx : Nat.S ( f x) λx : Nat.x λx : Nat.plus ( f x) (g x)     →     mk_expr . . . expr_S . . . mk_expr . . . expr_P . . .)     ) =     * Nat 0 * Nat S ( f x) * Nat x * Nat plus ( f x) (g x)     →     mk_expr . . . expr_S . . . mk_expr . . . expr_P . . .    
The compilation of matrices to decision trees is defined as follows. Since several decision trees may correspond to one matrix, we define the result of the compilation as a set of decision trees. Definition 4.8.12 (Compilation of Matrices). Let M = (U → V ) be a matrix and V be a set of variables.

The set of decision trees CC(V , M ) is defined as follows:

• Fail ∈ CC(V , ).

• Leaf(v, ρ, D) ∈ CC(V , M ), if,

for some line i of M :

for all j , either U (i )( j ) is a joker, or U (i )( j ) = x j y j where x j is a variable not in V , y j ⊂ V and ρ(x j ) = ( y j , j );

-D ∈ CC(V , M 2 ) where M 2 is M without the line i , -and v = V (i ). • Switch( j , F, D) ∈ CC(V , M ), if -1 ≤ j ≤ n, -F is a function with domain {(u, n) | ∃i .U (i )( j ) = u v, where u is a constant or a variable in V and | v| = n} ∪ {λ | ∃i .U (i )( j ) = λx : A.u} such that * F (u, n) ∈ CC(V , S (u,n) (V , j , M )) * and F (λ) ∈ CC(V ∪ {x}, S λ (V , j , M )), -and D ∈ CC(V , D(V , j , M )).
Two parameters make CC(V , M ) be a set and not a single decision tree. First, if M has several lines containing only jokers and free variables applications, then, depending of the chosen line, several Leaf decision trees are possible. Second, if the width of the matrix is strictly greater than one, then we can choose to switch on different columns. These two parameters may be used to optimize either the size of the decision tree or its depth [START_REF] Maranget | Compiling Pattern Matching to Good Decision Trees[END_REF]. We do not detail this here.

We now give some examples of decision trees.

Symmetric Addition

Soundness and Completeness

Recall that our goal is to define a function CC Γ verifying the following properties:

• (Soundness) If ( u, ) ⊢ CC Γ ( f ) → t , then f u → h Γ b t .
A natural extension of this work would be to consider rewriting modulo βη as in Higher-Order Rewrite Systems. This requires extending the conversion with ηreduction. But, as remarked in [START_REF] Geuvers | The Church-Rosser Property for beta-eta-reduction in Typed lambda-Calculi[END_REF] (attributed to Nederpelt), → βη is not confluent on untyped terms as the following example shows:

λy : B.y ← η λx : A.(λy : B.y)x → β λx : A.x
Therefore properties such as product compatibility need to be proved another way.

For the λΠ-calculus a notion of higher-order pattern matching has been proposed [START_REF] Pientka | A type-theoretic foundation for programming with higherorder abstract syntax and first-class substitutions[END_REF] based on Contextual Type Theory (CTT) [START_REF] Nanevski | Contextual Modal Type Theory[END_REF]. This notion is similar to ours. However, it is defined using the notion of meta-variable (which is native in CTT) instead of a translation into HRSs.

In [START_REF] Blanqui | Termination of rewrite relations on lambda-terms based on Girard's notion of reducibility[END_REF], Blanqui studies the termination of the combination of β-reduction with a set of rewrite rules with matching modulo βη in the polymorphic λ-calculus. His definition of rewriting modulo βη is direct and does not use any encoding. This leads to a slightly different notion a rewriting modulo β. For instance, D(λ : R.Exp x) would reduce to fMult (D (λx : R.(λy : R.y) x)) (λx : R.Exp ((λy : R.y) x)) instead of fMult (D (λx : R.x)) (λx : R.Exp x). It would be interesting to know whether the two definitions are equivalent with respect to confluence, that is to say if, for the same set of rewrite rules, the rewrite relation for his definition of rewriting modulo β is confluent if and only if the rewrite relation for our definition of rewriting modulo β is confluent.

Chapter 5

Non-Left-Linear Systems Résumé Ce chapitre considère les règles de réécriture non linéaires à gauche. Combinées avec la β-réduction, ces règles génèrent généralement un système de réécriture non confluent. Ceci est un problème car la confluence est notre outil principal pour prouver la compatibilité du produit. On prouve que la propriété de compatibilité du produit est toujours vérifiée (même sans la confluence) lorsque les règles de réécriture sont toutes au niveau objet. Ensuite on étudie cette propriété en présence de règles non linéaires à gauche et de règles au niveau type. Pour cela, on introduit une variante du λΠ-Calcul Modulo où la conversion est contrainte par une notion de typage faible.

Introduction

In the previous chapters, we used the confluence of the rewrite relation each time we proved that a global context is well-typed, and, in particular, that it satisfies product compatibility. More precisely, we used either the confluence of → βΓ (Theorem 2.6.11) or the confluence of → βΓ b (Theorem 4.5.7).

Relying on the confluence of the rewriting relation basically prevents us from considering non left-linear rewrite rules. Indeed, all the criteria that we have at hand for proving the confluence of → βΓ (Theorem 1.4.7) or → βΓ b (Theorem 4.6.6) require the rewrite rules to be left-linear. Worse, the rewrite system generated by a non leftlinear rewrite rule together with β-reduction is almost always non-confluent (see Section 1.4.3).

One part of this problem has been solved in Chapter 3, where we have shown how to eliminate non left-linearity of rewrite rules when it is due to typing constraints. For instance, the non left-linear rewrite rule tail n (vcons n e l ) → l . can be replaced by its linearized version tail n 1 (vcons n 2 e l ) → l . because both left-hand sides match the same well-typed terms. However, this technique does not apply if the non left-linearity is intended as in:

eq n n → true.

tion and an untyped conversion in the λΠ-Calculus Modulo.

A radical solution would be to consider a typed conversion. We leave this line of research for future work as we believe it deeply modifies the type system (see Section 5.7). Instead, we consider a variant of the λΠ-Calculus Modulo where the conversion respects a weak form of typing and for which we give a general criterion for product compatibility able to deal with global contexts containing at the same time non left-linear rewrite rules and rewrite rules with product types on their righthand side. This can be thought as a first step toward the study of the subject reduction property in the λΠ-Calculus Modulo with a typed conversion. As we will see in Chapter 6, another interesting consequence of proving product compatibility for this variant is that it can be used to prove the soundness of the inference algorithm with respect to the unmodified λΠ-Calculus Modulo.

Convention In this chapter, we only consider rewrite rules of the form ( f u → v) where f is a constant. We call f the head symbol of the rule. This restriction is needed to prove the Postponement Lemmas and the Commutations Lemma (see below) and to define some of the notions introduced hereafter.

Object-Level Rewrite Systems

To begin with, we prove, by adapting the work of Barbanera, Geuvers and Fernández [START_REF] Barbanera | Modularity of Strong Normalization and Confluence in the Algebraic-lambda-Cube[END_REF] and Blanqui [START_REF] Blanqui | Definitions by rewriting in the Calculus of Constructions[END_REF] to the λΠ-Calculus Modulo, that product compatibility always holds for global context without Π-producing rewrite rules.

Definition 5.2.1 (Π-Producing Rewrite Rules). A rewrite rule

(u → v) is Π-producing if:
• there is a product type in v;

• this product type is not in the type annotation of an abstraction. Remark 5.2.2. Object-level rewrite rules are not Π-producing.

Remark 5.2.3. Right-hand sides of Π-producing rewrite rules are of the form (λ x : T .Πy : A.B ) t where x and t may be empty vectors.

The main results of this section are the following: Theorem 5.2.4. Global contexts without any Π-producing rewrite rules satisfy the product compatibility property.

Corollary 5.2.5. Global contexts containing only object-level rewrite rules satisfy the product compatibility property.

Proof. By Theorem 5.2.4 and Remark 5.2.2. The proof of Theorem 5.2.4 relies on two lemmas: a postponement lemma and a commutation lemma.

The postponement lemma says that Γ-reductions can be postponed after the βsteps occurring in head position (β h -reduction) when we reduce toward a product type.

2. By the postponement lemma (Lemma 5.6.17), there exists U such that T 2 → * out U → * i n Πx : A 0 .B 0 . 3. Finally, by the product types lemma (Lemma 5.6.20), U = Πx : A 2 .B 2 . Moreover, by weak subject reduction (Theorem 5.4.25), we have Γ; ∆ ⊢ w A 1 ≡ A 2 and Γ; ∆(x : A 1 ) ⊢ w B 1 ≡ B 2 .

• Case ↓=↓ i n (see Figure 5.7). Let T 0 be the common reduct of T 1 and T 2 : T 1 → * i n T 0 and T 2 → * i n T 0 . 1. By the commutation lemma (Lemma 5.6.19), there exist A 0 and B 0 such that Πx : A 1 .B 1 → * i n Πx : A 0 .B 0 and T 0 → * out Πx : A 0 .B 0 . 2. By the postponement lemma (Lemma 5.6.17), there exists U such that T 2 → * out U → * i n Πx : A 0 .B 0 . 3. Finally, by the product types lemma (Lemma 5.6.20), U = Πx : A 2 .B 2 .

Moreover, we have Γ; ∆ ⊢ w A 1 ≡ A 2 and Γ; ∆(x : A 1 ) ⊢ w B 1 ≡ B 2 .

Application

We now use Theorem 5.6.5 to prove that the global context from Section 5.3 satisfies product compatibility: Therefore, it is confluent and, by Lemma 5.4.17, weak product compatibility holds. It follows that Γ is weakly well-typed (A1).

The only black rewrite rule is (ǫ ( Π a b) → x : ǫ a -→ ǫ (b x)). It is left-linear (A2) and confluent together with β-reduction (Theorem 1.4.7) (A3).

Finally, all the non-variable subterms of ǫ ( Π a b) are at black positions (A4). Therefore, by Theorem 5.6.5, product compatibility holds for this global context in the Colored λΠ-Calculus Modulo defined in Section 5.5.

Back to the λΠ-Calculus Modulo

We do not know if the global context above verifies the product compatibility property for the unmodified λΠ-Calculus Modulo. However, the criterion is, in general, not applicable if we do not work with the weakly well-typed conversion. Here is a counter example: nat : Type.

A : Type. B : Type. a 1 : A. a 2 : A. T : A -→ Type. T a 1 → A -→ A. T a 2 → B -→ B . choose : nat -→ nat -→ nat -→ nat -→ nat. choose n n x y → x. choose (S n) n x y → y.
The only possible choice for a coloring is the following: Color(nat) = White and Color(A) = Color(B ) = Color(T ) = Black. For this coloring, the first two rules are black and the last two are white. One can check that the assumptions of Theorem 5.6.5 are verified. However, we have:

T (choose (Ω S) (Ω S) a 1 a 2 ) → Γ T a 1 → Γ A -→ A and T (choose (Ω S) (Ω S) a 1 a 2 ) → * β T (choose (S (Ω S)) (Ω S) a 1 a 2 ) → βΓ T a 2 → βΓ B -→ B .
But we do not have nat ≡ βΓ A; hence product compatibility does not hold. Of course, to be able to show that A -→ A ≡ βΓ B -→ B , we need to go through the term T (choose (Ω S) (Ω S) a 1 a 2 ) which is not weakly well-typed. In particular, the terms a 1 and a 2 have a black type but are used at black positions. Therefore, this conversion is not weakly well-typed.

Conclusion

We have studied the problem of proving product compatibility without using the confluence of the rewriting relations → βΓ or → βΓ b . Proving product compatibility without confluence allows us to consider global contexts with non-left-linear rewrite rules. Indeed, non-left-linear rewrite rules often generate non-confluent rewriting relations.

First, we have proven that product compatibility always holds for global contexts without Π-producing rewrite rules and, in particular, if the rewrite rules are at object level only.

Then, we have given a general criterion for product compatibility allowing mixing Π-producing rewrite rules and non-left-linear rewrite rules. To be able to prove this criterion, we modified the definition of the λΠ-Calculus Modulo to constrain conversion to go only through terms respecting a weak notion of typing. This new notion of typing, weak typing, has been defined and studied in detail. Its main feature is that it is an approximation of usual typing for which subject reduction is easy to prove.

Unfortunately, the criterion does not apply for the λΠ-Calculus Modulo. However, product compatibility for its variant can be used to prove other properties of the unmodified λΠ-Calculus Modulo. For instance, in Chapter 6, we will use Theorem 5.6.5 to prove the soundness of the type inference algorithm with respect to the λΠ-Calculus Modulo and the Colored λΠ-Calculus Modulo at the same time.

Confluence by Termination in the Colored λΠ-Calculus Modulo Beside being useful to prove the product compatibility property, confluence is also a key property to prove termination of the relation → βΓ on well-typed terms in presence of type-level rewrite rules [START_REF] Blanqui | Definitions by rewriting in the Calculus of Constructions[END_REF]. We conjecture that, for the Colored λΠ-Calculus Modulo, the assumption of confluence can be weakened to the confluence of (→ β ∪ → Bl ack ) when the assumptions of Theorem 5.6.5 are verified. This way, instead of using the confluence for all (untyped) terms to prove termination of well-typed terms, we use the confluence of (→ β ∪ → Bl ack ) on untyped terms to prove the termination of well-typed terms. Then, using Newman's lemma (Theorem 1.1.6), we can decide the confluence of → βΓ for well-typed terms. If it holds, it means that the congruence is decidable for well-typed terms and, therefore, that type-checking is decidable.

Typed Conversion vs. Untyped Conversion When designing the Colored λΠ-Calculus

Modulo, we have chosen to constrain the conversion to contain only weakly welltyped terms because weak subject reduction makes the set of weakly well-typed terms easy to manipulate. Another approach would be to constrain the conversion to contain only well-typed terms. This approach is the one used by Martin Löf's Type Theory [START_REF] Nordström | Martin-Löf 's Type Theory[END_REF]. In this case, reduction is typed: rewriting and typing are mutually defined. The relation between systems with a typed reduction and systems with an untyped reduction is not easy to make. It has been studied by Adams [START_REF] Adams | Pure Type Systems with Judgemental Equality[END_REF] and Siles and Herbelin [START_REF] Siles | Pure Type System conversion is always typable[END_REF]. They showed that, in the case of pure type systems with β-reduction, the two approaches (typed and untyped) are equivalent: the set of well-typed terms are the same. Their approach relies on a proof of confluence of the β-reduction based on parallel moves. We conjecture that their proof can be adapted for the λΠ-Calculus Modulo when the rewriting relation → βΓ is parallelclosed [START_REF] Huet | Confluent Reductions: Abstract Properties and Applications to Term Rewriting Systems: Abstract Properties and Applications to Term Rewriting Systems[END_REF]. More generally, it would be interesting to develop a version of the λΠ-Calculus Modulo with a typed reduction and study the relation with the original λΠ-Calculus Modulo and with Martin Löf's Type Theory, in particular when the global context contains non-left-linear rewrite rules. However, in practice we prefer to make sure that subject reduction holds and use the function infer instead of safe_infer . Indeed, the extra recursive call may be costly and it is, in most cases, useless.

Using the theorems of Chapter 5, we can also prove that the function infer is sound if the global context verifies the product compatibility property for the variant of the λΠ-Calculus Modulo introduced in Section 5.5. Theorem 6.2.4. Let Γ be a global context well-typed for ⊢ ′ (Definition 5.5.5) and let ∆ be a local context well-formed in Γ for ⊢ ′ .

If infer Γ ∆ t = T , then Γ; ∆ ⊢ t : T .

Proof. Doing the same proof as in Theorem 6.2.2, we get that infer Γ ∆ t = T implies Γ; ∆ ⊢ ′ t : T . But, as remarked in Lemma 5.5.6, we have (⊢ ′ ) ⊂ (⊢). Therefore, infer Γ ∆ t = T implies Γ; ∆ ⊢ t : T as well.

This means that, in the case where we cannot prove that a global context Γ verifies the product compatibility property (hence that it is well-typed) because it contains non-linear rewrite rules and Π-producing rewrite rules, we can still use Theorem 5.6.5 to prove that Γ is well-typed for ⊢ ′ and deduce the soundness of infer with respect to both ⊢ ′ and ⊢.

Regarding termination issues, note that recursive calls of infer are made on strict subterms. Therefore, the only possible source of non-termination is the use of the function normalize. However, if the relation → βΓ is terminating on well-typed terms, then the function normalize always terminates. Theorem 6.2.5 (Termination). Let Γ be a well-typed global context such that → βΓ terminates on well-typed terms and let ∆ be a local context well-formed in Γ.

The call infer Γ ∆ t terminates on all entries t . Proof. Recursive calls are made on strict subterms. The function normalize is used on well-typed terms only.

Without confluence, normal forms may not be unique, convertible terms may have different normal forms and terms convertible with a product type may have a normal form that is not a product type. On the other hand, without strong normalization, the function normalize may not terminate. For all these reasons, the function infer may fail to synthesize a type. However, if the relation → βΓ is confluent and terminating, the algorithm is complete. Theorem 6.2.6 (Completeness of infer). Let Γ be a well-typed global context such that the relation → βΓ is confluent and terminating on well-typed terms and let ∆ be a local context well-formed in Γ.

If Γ; ∆ ⊢ t : T , then there exists T 2 such that infer Γ ∆ t = T 2 . Moreover, we have Γ; ∆ ⊢ t : T 2 and T 2 ≡ βΓ T .

• (Soundness) Suppose that T = Kind. By Theorem 6.2.2 and the fact that sorts are only convertible to themselves (Lemma 2.3.5), we have Γ; ∆ ⊢ t : Kind.

Suppose that T = Kind. If we have check Γ ∆ t T = true, then infer Γ ∆ T = s and infer Γ ∆ t = T 2 with T ≡ βΓ T 2 . Therefore, by Theorem 6.2.2, we have Γ; ∆ ⊢ t : T 2 and Γ; ∆ ⊢ T : s. By conversion, it follows that Γ; ∆ ⊢ t : T .

• (Termination) By Theorem 6.2.5 and the assumption that → βΓ is terminating on well-typed terms.

•

Well-Formedness Checking for Local Contexts

Checking that a local context is well-formed boils down to verifying that the types of its variables are well-typed. • (Termination) By termination of infer (Theorem 6.2.5).

• (Completeness) Suppose that Γ ⊢ ctx ∆. By inversion for ⊢ ctx (Lemma 2.6.6), we have Γ ⊢ ctx ∆ 0 , x ∉ ∆ 0 and Γ; ∆ 0 ⊢ T : Type. By induction hypothesis, we have local_wf Γ ∆ 0 = true. By completeness of infer (Theorem 6.2.6), we have infer Γ ∆ 0 T = Type. It follows that local_wf Γ ∆ 0 = true.

the form ( f u → v) where f is a definable symbol. Moreover, → βΓ b is confluent.

It follows that Γ is β-well-formed.

Since, recursive calls are made on strictly smaller global contexts, termination follows from the termination of infer (Theorem 6.2.5) and rewrite_wf (Lemma 6.5.3).

Conclusion

We have given algorithms to infer and check types for terms, check well-formedness of local contexts and check well-typedness of global contexts in the λΠ-Calculus Modulo and we have proven that they are sound, complete and terminating. These algorithms have been implemented in DEDUKTI [BCHS], our type checker for the λΠ-Calculus Modulo.

Conclusion

(English version follows.)

Dans cette thèse, nous avons développé une nouvelle présentation formelle du λΠ-Calcul Modulo qui sert de fondation théorique au vérificateur de preuve DEDUKTI, que nous avons également implémenté.

Résumé des Contributions

• Dans le chapitre 2, nous avons présenté une nouvelle version du λΠ-Calcul Modulo, un système de types à base de types dépendants et de règles de réécriture, et nous en avons fait une étude détaillée. Nous avons introduit la notion de contexte global bien typé de manière à caractériser les contextes globaux pour lesquels le système de types vérifie certaines propriétés élémentaires telles que la préservation du type par réduction ou encore l'unicité des types. Un contexte global est bien typé si les déclarations de constantes sont bien typées, les règles de réécriture sont bien typées et la propriété de la compatibilité du produit est vérifiée. Nous avons aussi étudié le Calcul des Constructions Modulo, une extension du λΠ-Calcul Modulo avec du polymorphisme et des opérateurs de type.

• Dans le chapitre 3, nous avons étudié la propriété de bon typage des règles de réécriture. En partant de la preuve que les règles de réécriture fortement bien formées sont bien typées, on généralise le résultat en introduisant la notion de règle de réécriture faiblement bien formée. Contrairement aux règles fortement bien formées, les règles faiblement bien formées peuvent avoir un membre gauche non algébrique et mal typé. Ainsi on permet le filtrage sous les lieurs. On permet aussi de se débarrasser d'un certain type de non-linéarité à gauche dû aux contraintes du typage, et de préserver la confluence du système de réécriture. Enfin, nous avons donné une caractérisation exacte de la notion de bon typage pour les règles de réécriture vue comme un problème d'inclusion entre des ensembles de solutions de deux problèmes d'unification et nous en avons déduit l'indécidabilité du problème.

• Dans le chapitre 4, nous avons résolu un problème relatif à la présence de lieurs dans le membre gauche des règles de réécriture : la combinaison de telles règles avec la β-réduction génère un système de réécriture non confluent ; la confluence ne peut donc pas être utilisée pour prouver la propriété de compatibilité du produit ni pour décider le typage. Nous avons défini une notion de réécriture modulo β pour le λΠ-Calcul Modulo qui ne souffre pas du même 152 problème. Nous avons montré que la confluence de cette nouvelle notion de réécriture peut être utilisée pour prouver la propriété de compatibilité du produit et pour décider le typage. La réécriture modulo β est définie grâce à un encodage des termes du λΠ-Calcul Modulo dans un système de réécriture d'ordre supérieur. Ceci permet d'importer dans le λΠ-Calcul Modulo les résultats de confluence prouvés dans le contexte des systèmes de réécriture d'ordre supérieur. Nous avons aussi décrit comment implémenter efficacement la réécriture modulo β grâce à la compilation des règles de réécriture en arbres de décision.

• Dans le chapitre 5, nous avons étudié l'impact de l'ajout de règles de

Perspectives

Terminaison Parmi les conditions qui rendent la vérification de type décidable, nous n'avons pas étudié la terminaison du système de réécriture sur les termes bien typés. La terminaison est donc un prolongement logique à ce travail. La terminaison de calculs incorporant des types dépendants et des règles de réécriture a été étudiée par de nombreux auteurs (cf Section 2.9). Nous pensons que le travail de Blanqui [START_REF] Blanqui | A Type-Based Termination Criterion for Dependently-Typed Higher-Order Rewrite Systems[END_REF] sur la terminaison à base de types dans le Calcul des Constructions Algébriques peut être aisément adapté au cadre du λΠ-Calcul Modulo. Cependant, certaines modifications sont nécessaires pour prendre en compte notre notion de règle de réécriture bien typée ainsi que la réécriture modulo β. L'implémentation d'un critère de terminaison à base de types [START_REF] Abel | MiniAgda: Integrating Sized and Dependent Types[END_REF] dans DEDUKTI serait aussi un défi intéressant. La terminaison de la réécriture modulo βη a été étudiée dans [START_REF] Blanqui | Termination of rewrite relations on lambda-terms based on Girard's notion of reducibility[END_REF], mais dans un cadre simplement typé seulement.

Réécriture modulo une théorie équationnelle La commutativité est une propriété de certains opérateurs algébriques qui ne se comporte pas bien sous forme de règle de réécriture. En arithmétique, par exemple, il est commode de raisonner modulo la commutativité de l'addition et de la multiplication. Cependant, la règle de réécriture

plus n m → plus m n.

génère un système de réécriture qui, de manière évidente, ne termine pas, ce qui nous empêche de l'utiliser dans DEDUKTI. Une approche possible pour résoudre ce problème est de considérer une notion de réécriture plus générale qui filtre modulo une théorie équationnelle donnée, par exemple modulo la commutativité de l'addition et de la multiplication. De la même manière que pour la réécriture modulo β, la confluence de la réécriture modulo théorie permettrait de prouver la compatibilité du produit et de décider le typage.

Conversion typée

Au-delà du Calcul des Constructions Modulo

Comme nous l'avons montré, le λΠ-Calcul Modulo est un cadre logique très puissant lorsque l'on considère l'interprétions jugement/type. D'un autre côté, par la correspondance de Curry-Howard, le système de type correspond à la logique minimale du premier ordre modulo, un système logique proche de la Déduction Modulo [START_REF] Dowek | Theorem Proving Modulo[END_REF]. Si l'on ajoutait du polymorphisme, des opérateurs de type (cf Section 2.8) et des univers, on obtiendrait une logique d'ordre supérieur modulo très puissante. Nous pensons que ce système pourrait servir de fondation pour un nouvel assistant de preuve fondé sur la réécriture. Cette idée est très proche du projet de Chrz ąszcz and Walukiewicz-Chrz ąszcz d'ajouter de la réécriture à l'assistant de preuve Coq [START_REF] Chrz | Towards Rewriting in Coq[END_REF].

described a way to efficiently implement rewriting modulo β by compiling rewrite rules into decision trees.

• In Chapter 5, we have studied the impact of non-left-linear rewrite rules in the λΠ-Calculus Modulo. Non-left-linear rewrite rules almost always generate a non-confluent rewrite system when combined with β-reduction. This makes the proof of product compatibility more difficult. We have shown that product compatibility holds for object-level rewrite systems independently of confluence. We have also given a criterion for proving product compatibility for global contexts containing at the same time non-left-linear rewrite rules and (type-level) Π-producing rewrite rules. This criterion applies to the Colored λΠ-Calculus Modulo where the conversion rule is constrained to be weaklywell-typed.

• In Chapter 6, we have given algorithms to infer or check the type of a term, check that a local context is well-formed, check that a rewrite rule is weakly well-formed and check that a global context is β-well-formed. We have proved that these algorithms are sound and complete using the results of the previous chapters.

Perspectives

Termination Among the conditions making type-checking decidable, we have not studied the termination of rewrite systems on well-typed terms. This makes termination analysis an obvious continuation of this work. Termination in calculus mixing dependent types and rewrite rules has been studied by several authors (see Section 2.9). We believe that the work of Blanqui [START_REF] Blanqui | A Type-Based Termination Criterion for Dependently-Typed Higher-Order Rewrite Systems[END_REF] on the termination in the Calculus of Algebraic Constructions using type-based technics can be adapted to the λΠ-Calculus Modulo. However, Blanqui's criteria might need some modifications to cope with our notion of well-typed rewrite rules and our notion of rewriting modulo β. The implementation of a type-based termination [START_REF] Abel | MiniAgda: Integrating Sized and Dependent Types[END_REF] criterion in DEDUKTI is also an interesting challenge.

Rewriting Modulo an Equational Theory Commutativity is a property of algebraic operators that does not behave well as a rewrite rule. In arithmetics for instance, it can be convenient to reason modulo the commutativity of the addition and the multiplication. However, the rewrite rule plus n m → plus m n.

generates a rewrite relation which is obviously non-terminating, preventing us to use it in DEDUKTI. One possible approach to solve this issue would be to consider a more general notion of rewriting where matching is done modulo some equational theory, for instance modulo the commutativity of addition and multiplication. As for rewriting modulo β, we expect that the confluence of rewriting modulo an equational theory ensures product compatibility and restores the decidability of type checking.

Typed Conversion

When defining the λΠ-Calculus Modulo we chose to rely on an untyped notion of rewriting. The idea was to have a clean separation between rewriting and typing and a system as close as possible to its implementation. In Chapter 5, we have seen that this liberal notion of rewriting is problematic when we consider non-left-linear rewrite rules because confluence is immediately lost. This issue could be solved by considering typed notions of rewriting and conversion. However, we do not know to which extent taking a typed notion of conversion changes the theory of the λΠ-Calculus Modulo and if the results presented in this thesis still hold in this setting. A precise comparison between both systems (with and without typed conversion) would be interesting.

Beyond the Calculus of Construction Modulo

The λΠ-Calculus Modulo has shown to be a powerful logical framework, seeing it through the judgment-as-type interpretation. On the other hand, by the proposition-as-type interpretation, it corresponds to minimal predicate logic modulo, a proof system close to Deduction Modulo [START_REF] Dowek | Theorem Proving Modulo[END_REF]. By adding polymorphism, type operators (as in Section 2.8) and universes we would get a very powerful higher-order logic modulo. We believe that this logic can be used as a foundation for a new proof assistant based on rewriting. This idea is very close to the project of Chrz ąszcz and Walukiewicz-Chrz ąszcz to add rewriting to the Coq proof assistant [START_REF] Chrz | Towards Rewriting in Coq[END_REF]. Vérification de typage pour le λΠ-Calcul Modulo : théorie et pratique Résumé : la vérification automatique de preuves consiste à faire vérifier par un ordinateur la validité de démonstrations d'énoncés mathématiques. Cette vérification étant purement calculatoire, elle offre un haut degré de confiance. Elle est donc particulièrement utile pour vérifier qu'un logiciel critique, c'est-à-dire dont le bon fonctionnement a un impact important sur la sécurité ou la vie des personnes, des entreprises ou des biens, correspond exactement à sa spécification. Dedukti est l'un de ces vérificateurs de preuves. Il implémente un système de types, le λΠ-Calcul Modulo, qui est une extension du λ-calcul avec types dépendants avec des règles de réécriture du premier ordre. Suivant la correspondance de Curry-Howard, Dedukti implémente à la fois un puissant langage de programmation et un système logique très expressif. Par ailleurs ce langage est particulièrement bien adapté à l'encodage d'autres systèmes logiques. On peut, par exemple, importer dans Dedukti des théorèmes prouvés en utilisant d'autres outils tels que Coq, HOL ou encore Zenon, ouvrant ainsi la voie à l'interopérabilité entre tous ces systèmes.

Index

Le λΠ-Calcul Modulo est un langage très expressif. En contrepartie, certaines propriétés fondamentales du système, telles que l'unicité des types ou la stabilité du typage par réduction, ne sont pas garanties dans le cas général et dépendent des règles de réécriture considérées. Or ces propriétés sont nécessaires pour garantir la cohérence des systèmes de preuve utilisés, mais aussi pour prouver la correction et la complétude des algorithmes de vérification de types implémentés par Dedukti. Malheureusement, ces propriétés sont indécidables. Dans cette thèse, nous avons donc cherché à concevoir des critères garantissant la stabilité du typage par réduction et l'unicité des types qui soient décidables, de manière à pouvoir être implémentés par Dedukti.

Pour cela, nous donnons une nouvelle définition du λΠ-Calcul Modulo qui rend compte de l'aspect itératif de l'ajout des règles de réécriture dans le système en les explicitant dans le contexte. Une étude détaillée de ce nouveau calcul permet de comprendre qu'on peut ramener le problème de la stabilité du typage par réduction et de l'unicité des types à deux propriétés plus simples qui sont la compatibilité du produit et le bon typage des règles de réécriture. Nous étudions donc ces deux propriétés séparément et en donnons des conditions suffisantes effectives.

Ces idées ont été implémentées dans Dedukti, permettant d'augmenter grandement sa fiabilité.

Mots clés : théorie de la preuve, théorie des types, méthodes formelles

Typechecking in the λΠ-Calculus Modulo: Theory and Practice Abstract: Automatic proof checking is about using a computer to check the validity of proofs of mathematical statements. Since this verification is purely computational, it offers a high degree of confidence. Therefore, it is particularly useful for checking that a critical software, i.e., a software that when malfunctioning may result in death or serious injury to people, loss or severe damage to equipment or environmental harm, corresponds to its specification. Dedukti is such a proof-checker. It implements a type system, the λΠ-Calculus Modulo, that is an extension of the dependently typed λ-calculus with first-order rewrite rules. Through the Curry-Howard correspondence, Dedukti implements both a powerful programming language and an expressive logical system. Furthermore, this language is particularly well suited for encoding other proof systems. For instance, we can import in Dedukti theorems proved using other tools such as Coq, HOL or Zenon, initiating a form of interoperability between these systems. The λΠ-Calculus Modulo is a very expressive language. On the other hand, some fundamental properties such as subject reduction (that is, stability of typing by reduction) and uniqueness of types are not guaranteed in general and depend on the rewrite rules considered. Yet, these properties are necessary for guarantying the coherence of the proof system, but also for proving the soundness and completeness of the typechecking algorithms implemented in Dedukti. Unfortunately, these properties are undecidable. In this thesis we design new criteria for subject reduction and uniqueness of types that are decidable, in order to be implemented in Dedukti.

For this purpose, we give a new definition of the λΠ-Calculus Modulo that takes into account the iterative aspect of the addition of rewrite rules in the typing context. A detailed study of this new system shows that the problems of subject reduction and uniqueness of types can be reduced to two simpler properties that are called product compatibility and well-typedness of rewrite rules. Hence, we study these two properties separately and we give effective sufficient conditions for them to hold.

These ideas have been implemented in Dedukti increasing its reliability.

Keywords: proof theory, type theory, formal methods

  minus (ΩS) (ΩS) → βR 0. minus (ΩS) (ΩS) → * β minus (S (ΩS)) (ΩS) → βR S 0. However 0 and S 0 are not joinable. Theorem 1.4.10 ([Klo80]). Let R = {(eq n n → true)}. The relation → βR is not confluent. Proof. Let c = Ω (λx : A.λy : A.eq y (x y)) and a = Ω c. We have a = Ω c → * β c a. Moreover, c a = Ω (λx : A.λy : A.eq y (x y)) a → * β (λx : A.λy : A.eq y (x y)) c a → * β eq a (c a) → * β eq (c a) (c a) → βR true. Since c a → * β c (c a), we also have c a → * βR c true.

  Figure 2.2: Local contexts of the λΠ-Calculus Modulo

R

  Definition 2.3.1 (β-reduction). The β-reduction relation → β is the smallest relation on terms containing (λx : A.u)v → β u[x/v] for any A, u and v and closed by subterm reduction. Notation 2.3.2. We write → * β for the reflexive and transitive closure of → β and ≡ β for the congruence generated by → β .

  Definition 2.3.3 (Γ-Reduction). Let Γ be a global context. The Γ-reduction relation → Γ is the smallest relation on terms containing u → Γ v for each rule (u → v) ∈ Γ and closed by substitution and subterm reduction. Notation 2.3.4. We write → * Γ for the reflexive and transitive closure of → Γ , ≡ Γ for the congruence generated by → Γ , → βΓ for → β ∪ → Γ , → * βΓ for the reflexive and transitive closure of → βΓ and ≡ βΓ for the equivalence relation generated by → βΓ .

Figure 2 . 4 :

 24 Figure 2.4: Typing rules for terms in the λΠ-Calculus Modulo.

Figure 2 . 5 :

 25 Figure 2.5: Well-formedness rules for local contexts

Figure 2 . 6 :

 26 Figure 2.6: Strong well-formedness rules for global contexts

  Theorem 2.7.10 (Soundness). If Ξ ⊢ Σ P and x 1 , . . . , x n are the variables occurring free in Ξ and P , then there exists π such that Γ(Σ); ∆ ⊢ π : |P | and ∆ = (x 1 : term)...(x n : term) |Ξ|.

•

  (True) P = ⊤ We have |P | = Πx : prop.Πy : |x|.|x| and Γ; ∆ ⊢ λx : prop.λy : |x|.y : Πx : prop.Πy : |x|.|x|. • (Axiom) P ∈ Ξ. For some h, we have (h : |P |) ∈ |Ξ|. Therefore, Γ; ∆ ⊢ h : |P |. • ( =⇒ -intro) P = A =⇒ B . We have |A =⇒ B | ≡ βΓ |A| -→ |B |. By induction hypothesis, Γ; ∆(h : |A|) ⊢ π B : |B |. By (Abstraction), we have Γ; ∆ ⊢ λh : |A|.π B : |A| -→ |B |. By (Conversion), it follows that Γ; ∆ ⊢ λh : |A|.π B : |P |. • ( =⇒ -elim) P = B . By induction hypothesis, we have Γ; ∆ 1 ⊢ π 1 : |A =⇒ B | and Γ; ∆ 2 ⊢ π 2 : |A|. Since all the variable declarations in ∆ 1 and ∆ 2 are in ∆, by Lemma 2.6.4, we have Γ; ∆ ⊢ π 1 : |A =⇒ B | and Γ; ∆ ⊢ π 2 : |A|. Since |A =⇒ B | ≡ βΓ |A| -→ |B |, by (Conversion), we have Γ; ∆ ⊢ π 1 : |A| -→ |B |. By (Application), Γ; ∆ ⊢ π 1 π 2 : |B |. • (∧-intro) P = A∧B . We have |A∧B | ≡ βΓ Πx : prop.(|A| -→ |B | -→ |x|) -→ |x|. By induction hypothesis, we have Γ; ∆ A ⊢ π A : |A| and Γ; ∆ B ⊢ π B : |B |. Let ∆ 2 = ∆(x : prop)(y : |A| -→ |B | -→ |x|). Since all the variable declarations in ∆ A and ∆ B are in ∆ 2 , by Lemma 2.6.4, we have Γ; ∆ 2 ⊢ π A : |A| and Γ; ∆ 2 ⊢ π B : |B |. By (Application), we have Γ; ∆ 2 ⊢ y π A π B : |x|. By (Abstraction), we have Γ; ∆ ⊢ λx : prop.λy : (|A| -→ |B | -→ |x|).y π A π B : Πx : prop.(|A| -→ |B | -→ |x|) -→ |x|. Finally, by (Conversion), we have Γ; ∆ ⊢ λx : prop.λy : (|A| -→ |B | -→ |x|).y π A π B : |A ∧ B |. • (Left-∧-elim) P = A. By induction hypothesis, we have Γ; ∆ ⊢ π 0 : |A ∧ B |. Since Πx : prop.(|A| -→ |B | -→ |x|) -→ |x| ≡ βΓ |A ∧ B |, by (Conversion), we have Γ; ∆ ⊢ π 0 : Πx : prop.(|A| -→ |B | -→ |x|) -→ |x|. By (Application), we have Γ; ∆ ⊢ π 0 A : (|A| -→ |B | -→ |A|) -→ |A| Moreover, by (Abstraction), we have Γ; ∆ ⊢ λx : |A|.λy : |B |.x : |A| -→ |B | -→ |A|. Therefore, by (Application), we have Γ; ∆ ⊢ π 0 A (λx : |A|.λy : |B |.x) : |A|. • (Right-∧-elim) P = B . As (Left-∧-elim), with π = π 0 B (λx : |A|.λy : |B |.y). • (Left-∨-intro) P = A∨B . We have |A∨B | ≡ βΓ Πx : prop.(|A| -→ |x|) -→ (|B | -→ |x|) -→ |x|, By induction hypothesis, we have Γ; ∆ A ⊢ π A : |A|. Since all the variable declarations in ∆ A are in ∆, by local weakening (Lemma 2.6.4), we have Γ; ∆(x : prop)(a : |A| -→ |x|)(b : |B | -→ |x|) ⊢ π A : |A|. By (Application), we have Γ; ∆(x : prop)(a : |A| -→ |x|)(b : |B | -→ |x|) ⊢ a π A : |x|. By (Abstraction), we have Γ; ∆ ⊢ λx : prop.λa : |A| -→ |x|.λb : |B | -→ |x|.a π A : Πx : prop.(|A| -→ |x|) -→ (|B | -→ |x|) -→ |x|. By (Conversion), we have Γ; ∆ ⊢ λx : prop.λa : |A| -→ |x|.λb : |B | -→ |x|.a π A : |A ∨ B |. • (Right-∨-intro) P = A ∨ B . As (Left-∨-intro), with π = λx : prop.λa : |A| -→ |x|.λb : |B | -→ |x|.b π B . • (∨-elim) By induction hypothesis, we have Γ; ∆ 1 ⊢ π 1 : |A ∨ B |, Γ; ∆ 2 ⊢ π 2 : |A =⇒ P | and Γ; ∆ 3 ⊢ π 3 : |B =⇒ P |. By Lemma 2.6.4, we have Γ; ∆ ⊢ π 1 : |A ∨B |, Γ; ∆ ⊢ π 2 : |A =⇒ P | and Γ; ∆ ⊢ π 3 : |B =⇒ P |. Since |A ∨ B | ≡ βΓ Πx : prop.(|A| -→ |x|) -→ (|B | -→ |x|) -→ |x|, |A =⇒ P | ≡ βΓ |A| -→ |B | and |B =⇒ P | ≡ βΓ |B | -→ |P |, by (Conversion), we have Γ; ∆ ⊢ π 1 : Πx : prop.(|A| -→ |x|) -→ (|B | -→ |x|) -→ |x|, Γ; ∆ ⊢ π 2 : |A| -→ |P | and Γ; ∆ ⊢ π 3 : |B | -→ |P |. By (Application), we have Γ; ∆ ⊢ π 1 P π 2 π 3 : |P |.

  then |P | ≡ βΓ Πx : prop.|(A =⇒ B =⇒ x) =⇒ x|. By product compatibility, we have U ≡ βΓ prop and V ≡ βΓ |(A =⇒ B =⇒ x) =⇒ x|. Therefore, we have Γ; ∆(x : prop) ⊢ u : |(A =⇒ B =⇒ x) =⇒ x|. By Lemma 2.7.13, we have Γ(Σ ∪ {x}); ∆ ⊢ u : |(A =⇒ B =⇒ x) =⇒ x|.

Definition 2.7. 19 (

 19 Translation as Type). A = ǫ s |A| if A has type s. Kind = U K This encoding extends to typing contexts in the obvious way: Definition 2.7.20 (Translation of Contexts). = Σ(x : A) = Σ (x : A )

  m) =⇒ n = m; • ∀n.0 + n = n; • ∀n.∀m.S(n) + m = S(n + m); • ∀n.0 * n = 0; • ∀n.∀m.S(n) * m = n * m + m; • P [x/0] =⇒ (∀n.P [x/n] =⇒ P [x/S(n)]) =⇒ (∀n.P [x/n]).

  If P = ∀n.((S(n) = 0) =⇒ ⊥), then |P | = Πn : nat.|S(n) = 0| -→ |⊥| and, since |S(n) = 0| → Γ |⊥|, we take π = λn.λx : prf (eq (S n) 0).x. • If P = ∀n.∀m.S(n) = S(m) =⇒ n = m, then |P | = Πn : nat.Πm : nat.|S(n) = S(m)| -→ |n = m|. Since |S(n) = S(m)| → Γ |n = m|, we take π = λn : nat.λm : nat.λx : |S(n) = S(m)|.x. • If P = ∀n.0 + n = n or P = ∀n.0 * n = 0, then |P | = Πn : nat.|⊤|. We take π = λn : nat.λx : prop.λy : |x|.y. • If P = ∀n.∀m.S(n) + m = S(n + m) or P = ∀n.∀m.S(n) * m = n * m + m, then |P | = Πn : nat.Πm : nat.|⊤|. We take π = λn : nat.λm : nat.λx : prop.λy :

  then we take π = rec (λx : nat. Q ). Theorem 2.7.29 (Conservativity). If there exist a term π and a local context ∆ such that Γ ⊢ ctx ∆ and Γ; ∆ ⊢ π : |P | with ∆ = (x 1 : term)...(x n : term)|Ξ|, then Ξ ⊢ H A P is provable.

Figure 2 .

 2 Figure 2.11: Syntax for local contexts of the Calculus of Constructions Modulo

  Definition 2.8.3 (Well-Typed Term). We say that a term t has type A in a global context Γ and a local context ∆ if the judgment Γ; ∆ ⊢ t : A is derivable by the inference rules of Figure 2.4 replacing the rule (Product) by the rule (CoC-Product) of Figure 2.12. The typing of local contexts is updated to check type variable declarations. Definition 2.8.4 (Well-Formed Local Context). A local context ∆ is well-formed with respect to a global context Γ if the judgment Γ ⊢ ctx ∆ is derivable by the inference rules of Figure 2.13. The definitions of well-typed global contexts (Definition 2.4.9) and strongly wellformed global context (Definition 2.4.10) do not change.

  Lemma 2.8.5 (Inversion for the Calculus of Constructions Modulo). If Γ; ∆ ⊢ t : T then • either t = Type and T = Kind • or t = x and there exists A such that (x : A) ∈ ∆ and T ≡ βΓ A.• or t = c and T ≡ βΓ Γ(c).• or t = f u and there exist A and B such that Γ; ∆ ⊢ f : Πx : A.B , Γ; ∆ ⊢ u : A and T ≡ βΓ B [x/u].• or t = λx : A.u and there exist B and s such that Γ; ∆ ⊢ Πx : A.B : s, Γ; ∆(x : A) ⊢ u : B , and T ≡ βΓ Πx : A.B .• or t = Πx : A.B and there exist s 1 and s 2 such that Γ; ∆ ⊢ A : s 1 , Γ; ∆(x : A) ⊢ B : s 2 , and T = s 2 .

Lemma 2 .

 2 8.7 (Well-typed Local Declaration). If Γ ⊢ ctx ∆ and (x : A) ∈ ∆, then Γ; ∆ ⊢ A : s.

Figure 3 . 1 :

 31 Figure 3.1: Bidirectional typing rules for rewrite rules

Corollary 3.3. 5 .

 5 The rewrite rule (getCst (λx : nat.n) → n) is permanently welltyped. Proof. Using the rules (Constant), (Inversion), (C-Abstraction) and (Free Variable) we have: (nat : Type) ∈ Γ Γ; ; i nat ⇒ Type, Γ; ; c nat ⇐ Type | n = x Γ; ; (x : nat) c n ⇐ nat | (n : nat) Γ; ; c (λx : nat.n) ⇐ nat -→ nat | (n : nat) It follows, by the rule (S-Application) Γ; ; i getCst ⇒ (Πx : nat.nat) -→ nat, Γ; ; c (λx : nat.n) ⇐ nat -→ nat | (n : nat) Γ; ; i getCst (λx : nat.n) ⇒ nat,(n : nat) Moreover, we have Γ; (n : nat) ⊢ n : nat. Therefore, by Theorem 3.3.3, the rewrite rule (getCst (λx : nat.n) → n) is permanently well-typed. Chapter 4 also contains many examples of rewrite rules with non-algebraic lefthand sides that can be shown well-typed using Theorem 3.3.3. (Abs-No-Check)

Figure 3 . 2 :

 32 Figure 3.2: Additional typing rules for rewrite rules

Definition 3.4. 2 .

 2 The relations 2 i and 2 c are defined inductively from the typing rules of Figure 3.1 and Figure 3.2. 2 c features two new rules (Inv-No-Check) and (Abs-No-Check) similar to (Inversion) and (C-Abstraction) but without the unnecessary conversion test. We also add the rules (No-Check) and (App-No-Check) allowing to skip inspecting some subterm when its type (or the type of a superterm) is already known. Using this new type system, Theorem 3.3.3 can be generalized one step further. Theorem 3.4.3. Let Γ be a global context. If Γ; ; 2 i u ⇒ T, ∆ and Γ; ∆ ⊢ v : T , then (u → v) is permanently well-typed.

Figure 3 . 3 :

 33 Figure 3.3: Bidirectional typing rules for pseudo-well-formed rewrite rules (Part 1: Synthesis)

Notation 3.5. 6 .

 6 If t a term and Σ is a local context, then we write λΣ.t for the term λ x : A.t where x = dom(Σ) and A i = Σ(x i ). Definition 3.5.7. The relations i and c are defined inductively from the typing rules of Figure 3.3, and Figure 3.4.

  C 3 ) and P → * βΓ Πx : A 2 .B 2 . By inversion, we deduce Γ; ∆σ(Σ) ⊢ σ(u) :Πx : A.B , Γ; ∆σ(Σ) ⊢ σ(v) : A and T ≡ βΓ B [x/σ(v)].By induction hypothesis on u, we have, σ(P ) ≡ βΓ Πx : A.B , Γ; ∆σ(Σ) ⊢ σ(P ) : s, σ ∈ Sol(dom(∆ 2 ), C 2 ) and σ : ∆ 2 Γ ∆.By stratification, Γ; ∆σ(Σ) ⊢ Πx : A.B : s. By subject reduction, Γ; ∆σ(Σ) ⊢ σ(Πx : A 2 .B 2 ) : s. Thus, from σ(Πx : A 2 .B 2 ) ≡ βΓ Πx : A.B , by product compatibility, we deduce σ(A 2 ) ≡ βΓ A and σ(B 2 ) ≡ βΓ B .

From

  Γ; ∆σ(Σ) ⊢ σ(u x) : T , by inversion, we deduce Γ; ∆σ(Σ) ⊢ σ(u) : Πx : A.B Γ; ∆σ(Σ) ⊢ σ(x) : A and T ≡ βΓ B . Moreover, since x ∉ dom(σ), we have σ(x) = x and A ≡ βΓ σ(Σ(x)) = σ(A 0 ). Therefore, we have Πx : A.B ≡ βΓ σ(Πx : A 0 .T 0 ).

Corollary 3.5. 11 .

 11 The rewrite rule (tail n 1 (vcons n 2 e l ) → l ) is well-typed.Proof. Using the rules (Constant), (S-Application) and (Free Variable), we have, on the one hand, Γ; ; ; i tail n 1 ⇒ (∆ 1 , Vector (S n 1 ) -→ Vector n 1 , ) for ∆ 1 = (n 1 : nat) and, on the other hand,

Figure 3

 3 Figure 3.5: Weakly well-formedness rules for global contexts

  vappend (S n 1 ) 0 (vcons n 2 e l ) vnil vcons (plus n 2 0) e (vappend n 2 0 l vnil) vcons n 2 e l With the second version of the rule, the peak is not joinable; confluence is lost. vappend (S n 1 ) 0 (vcons n 2 e l ) vnil vcons (plus n 1 0) e (vappend n 1 0 l vnil) vcons n 2 e l Therefore, the way we linearize a rewrite rule matters for proving confluence. The Simply Typed λ-Calculus Let us define an encoding of the simply typed λcalculus. Simple types are the terms of type stype built from the base type ι and the constructor arrow. λ-terms of simple type A are encoded by the terms of type lterm A. The symbols lapp and labs correspond, respectively, to application and abstraction in the simply typed λ-calculus. stype : Type. ι : stype. arrow : stype -→ stype -→ stype. lterm : stype -→ Type. lapp : Πx : stype.Πy : stype.lterm (arrow x y) -→ lterm x -→ lterm y. labs : Πx : stype.Πy : stype.(lterm x -→ lterm y) -→ lterm (arrow x y).

  nat.y x) → y. (η-reduction on nat) (λx : nat.y) 0 → y.

  e Type : ( , , Kind) (Constant) (c : A) ∈ Γ Γ; Σ e c : ( , , A) (Σ-Variable) (x : A) ∈ Σ Γ; Σ e x : ( , , A)

Figure 3 . 6 :

 36 Figure 3.6: Typing constraints for terms

Definition 3.7. 1 .

 1 The relation e is defined by induction from the inference rules of Figure3.6.

  This rule introduces a non-joinable critical peak when combined with β-reduction: D (λx : R.Exp ((λy : R.y) x)) fMult (D (λx : R.(λy : R.y) x)) (λx : R.(Exp ((λy : R.y) x))) D (λx : R.Exp x) D β A way to recover confluence is to consider a generalized rewriting relation where matching is done modulo β-reduction. In this setting, D (λx : R.Exp x) is reducible because it is β-equivalent to the redex D (λx : R.Exp((λy : R.y) x)) and, as we will see, this allows closing the critical peak.

  Definition 4.4.13 (Encoding of Rewrite Rules). Let (u → v) be a rewrite rule such that • u is a λΠ-pattern; Therefore, the peak is now joinable and, anticipating a bit, the rewrite system is confluent.D(λx : R.Exp ((λy : R.y) x)) fMult (D (λx : R.(λy : R.y) x)) (λx : R.(Exp ((λy : R.y) x))) D (λx : R.Exp x) fMult (D (λx : R.x)) (λx : R.Exp x)

Theorem 4.5. 6 .

 6 The congruence ≡ βΓ b generated by → βΓ b is equal to ≡ βΓ . Proof. Follows from Lemma 4.5.3 and Lemma 4.5.5. Theorem 4.5.7. Let Γ be a global context. If HRS(βΓ) is confluent, then product compatibility holds for Γ.Proof. Assume that Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 . Then, by Theorem 4.5.6, Πx : A 1 .B 1 ≡ βΓ b Πx : A 2 .B 2 . By confluence, there exist A 0 and B 0 such thatA 1 → * βΓ b A 0 , A 2 → * βΓ b A 0 , B 1 → * βΓ b B0 and B 2 → * βΓ b B 0 . It follows, by Theorem 4.5.6, that A 1 ≡ βΓ A 2 and B 1 ≡ βΓ B 2 Γ; ⊢ U : Type c ∉ dom(Γ) Γ(c : U ) wf β (Type Declaration)

Figure 4 . 1 :

 41 Figure 4.1: Weakly well-formedness rules for global contexts

  Figure 4.2 define a function to_expr that parses a function of type Nat to Nat into an expression of the form a * x + b (represented by the term mk_expr a b) where a and b are constants. The left-hand sides of the rewrite rules for to_expr are λΠ-patterns. This allows defining to_expr by inspecting under the binders.The function solve can then be used to solve the linear equation a * x + b = 0. The answer is either None, if there is no solution, All, if any x is a solution, or One m n, if -m/(n + 1) is the only solution.For instance, we have (writing -1 3 for One 1 2): solve (to_expr(λx : Nat.plus x (plus x (S x)))) → * βΓ -6.6 and Theorem 3.2.1, the global context of Figure4.2 is β-wellformed.

:

  Nat -→ Nat -→ expr. expr_S : expr -→ expr. expr_S (mk_expr a b) → mk_expr a (S b). expr_P : expr -→ expr -→ expr. expr_P (mk_expr a 1 b 1 ) (mk_expr a 2 b 2 ) → mk_expr (plus a 1 a 2 ) (plus b 1 b 2 ). to_expr : (Nat -→ Nat) -→ expr. to_expr (λx : Nat.0) → mk_expr 0 0. to_expr (λx : Nat.S ( f x))→ expr_S (to_expr (λx : Nat. f x)). to_expr (λx : Nat.x)→ mk_expr (S 0) 0. to_expr (λx : Nat.plus ( f x) (g x)) → expr_P (to_expr (λx : Nat. f x)) (to_expr (λx : Nat.g x)). Solution. solve (mk_expr 0 0) → All. solve (mk_expr 0 (S n))→ None. solve (mk_expr (S n) m) → One m n.

Figure

  Figure 4.2: Parsing and solving linear equations

Figure 4 . 3 :

 43 Figure 4.3: Negation normal form

Figure 4 . 4 :

 44 Figure 4.4: Operational semantics for decision trees

  the function CC Γ the compilation function. It will use matrices. Here, (pairs of ) matrices are concise representations of sets of rewrite rules for the same constant and with the same number of arguments. Definition 4.8.6 (Matrix Patterns). A matrix pattern is either a λΠ-pattern or the symbol ' * ' which we call joker. Definition 4.8.7 (Matrix). A matrix is a pair M = (U → V ) where U is an array of matrix patterns of size m * n (m lines, n columns) and V is a vector of terms of size m.

  A decision tree in CC( , M plus ):Switch(1, {(0, 0) → D 0 , (S, 1) → D S }, D d ) Leaf(n, {n → ( , 2)}, D d ) Leaf(S (plus n 1 n 2 ), {n 1 → ( , 3), n 2 → ( , 2)}, D d ) Switch(2, {(0, 0) → D 0 , (S, 1) → D S }, Fail) Leaf(n, {n → ( , 1)}, Fail) Leaf(S (plus n 1 n 2 ), {n 1 → ( , 1), n 2 → ( , 3)}, Fail) Switch(2, {(0, 0) → D 0 , (S, 1) → D S }, Fail) Leaf(S (plus n 1 n 2 ), {n 1 → ( , 1), n 2 → ( , 4)}, Fail)Parsing of Expressions A decision tree in CC( , M to_expr ):Switch(1, {λ → D λ },Fail) Switch(2, {(Nat, 0) → D Nat }, Fail) Switch(3, {(0, 0) → D 0 , (S, 1) → D S , (x, 0) → D x , (plus, 2) → D plus }, Fail) Leaf(mk_expr 0 0, , Fail) Leaf(expr_S . . . , { f → ({x}, 4)}, Fail) Leaf(expr_P . . . , { f → ({x}, 4), g → ({x}, 5)}, Fail) Leaf(mk_expr (S 0) 0, , Fail)

U

  T : Type. ǫ : U T -→ Type. Π : Πa : U T .Πx : (ǫa -→ U T ).U T . ǫ ( Π a b) → Πx : ǫ a.ǫ (b x). Pair : U T -→ U T -→ Type. π 1 : Πa : U T .Πb : U T .Pair a b -→ ǫ a. π 2 : Πa : U T .Πb : U T .Pair a b -→ ǫ b. mk_pair : Π.a : U T .Π.b : U T .ǫ a -→ ǫ b -→ Pair a b.π 1 a 1 b 1 (mk_pair a 2 b 2 x y) → x. π 2 a 2 b 2 (mk_pair a 2 b 2 x y) → y. mk_pair a b (π 1 a b p) (π 2 a b p) → p.We take:Color(U T ) = Color(ǫ) =Black and Color(Pair) = White. The (only) type-level rewrite rule is non-confusing since Color( ǫ ( Π a b) ) = Color( ǫ ) = Color(ǫ) = Black and Color( Πx : ǫ a.ǫ (b x) ) = Color( ǫ (b x) ) = Color(ǫ) = Black. By Theorem 5.4.27, the rewrite rules are weakly well-typed. The weak rewrite relation → w Γ is the relation generated by ǫ ( Π a b) → Πx : ǫ a.ǫ (b x) = Black → Black -→ Black.

  Since term_eq A (normalize Γ T v ), we have A ≡ βΓ T v . Therefore, by (Conversion), we have Γ; ∆ ⊢ u : Πx : A.B and Γ; ∆ ⊢ v : A. It follows, by (Application), that Γ; ∆ ⊢ u v : B [x/v].

  let local_wf Γ ∆ = match ∆ with | → true | ∆ 0 (x:T ) → if (local_wf Γ ∆ 0 ) ∧ (x ∉ dom(∆ 0 )) then ( term_eq (infer Γ ∆ 0 T ) Type ) else falseTheorem 6.4.1. Let Γ be a well-typed global context.• (Soundness) If local_wf Γ ∆ = true, then Γ ⊢ ctx ∆.• (Termination) If the relation → βΓ is terminating on well-typed terms, thenlocal_wf terminates on all entries ∆.• (Completeness) Assuming that the relation → βΓ is confluent and terminating on well-typed terms, if Γ ⊢ ctx ∆, then local_wf Γ ∆ = true.Proof. By induction on the local context ∆. The case ∆ = is trivial. Suppose ∆ = ∆ 0 (x : T ).• (Soundness) Suppose that local_wf ∆ = true. It means that local_wf Γ ∆ 0 = true, x ∉ ∆ 0 and infer Γ ∆ 0 T = Type. By induction hypothesis, we have Γ ⊢ ctx ∆ 0 and, by soundness of infer (Theorem 6.2.2), we have Γ; ∆ 0 ⊢ T : Type. It follows that Γ ⊢ ctx ∆.

  y and y ∉ FV (u). Remark that we can always rename the bound variables so that these conditions are verified.

	Definition 1.3.4 (β-Reduction). The head β-reduction → β h on λ-terms is defined as
	follows:
	• (λx : A.t )u → β h t [x/u] for all λ-terms A, t and u;

Theorem 1.3.6. If

	t 1 → * β t 2 , then there exists t 3 such that t 1 → * β h t 3 → * β i t 2 .

  then t 1 u → βR t 2 u and ut 1 → βR ut 2 ; • if t 1 → βR t 2 , then λx : A.t 1 → βR λx : A.t 2 u and λx : t 1 .u → βR λx : t 2 .u.

  We write ∆ 1 ≡ βΓ ∆ 2 if ∆ 1 and ∆ 2 are convertible in Γ.

	Definition 2.3.6 (Convertible Local Contexts). Let Γ be a global context. Two local
	contexts ∆ 1 and ∆ 2 are convertible in Γ if they declare the same variables in the same
	order and, for all x ∈ dom(∆ 1 ) = dom(∆ 2 ), ∆ 1 (x) ≡ βΓ ∆ 2 (x).

  B 2 : s 2 and B 1 does not depend on x, then, for all a such that Γ; ∆ ⊢ a : A 2 , we haveB 1 ≡ βΓ B 2 [x/a].Proof. By Lemma 2.3.5 and stratification (Lemma 2.6.10), s 1 = s 2 . If s 1 = s 2 = Kind, then Lemma 2.3.5 applies. Otherwise, s 1 = s 2 = Type. From Πx : A 1 .B 1 ≡ βΓ Πx : A 2 .B 2 and Γ; ∆ ⊢ a : A 2 we can derive Γ; ∆(y : B 1 ) ⊢ (λx : A 1 .y)a : B 2 [x/a] for some fresh variable y. By subject reduction, Γ; ∆(y : B 1 ) ⊢ y : B 2 [x/a]. Finally, by inversion (Lemma 2.6.1), we have B 1 ≡ βΓ B 2 [x/a]. Let Γ be a global context whose declarations are well-typed and satisfying the subject reduction property for β.

	Corollary 2.6.29.

If Γ ⊢ ctx ∆ and Γ; ∆ ⊢ (λx : A.x)a : T then A ≡ βΓ T . Proof. By inversion (Lemma 2.6.1), we have Γ; ∆ ⊢ λx : A.x : Πx : A 2 .B 2 , Γ; ∆ ⊢ a : A 2 and T ≡ βΓ B 2 [x/a]. Also, by inversion, we have Γ; ∆(x : A) ⊢ x : B 1 (with A ≡ βΓ B 1 ), for some B 1 and Πx : A 2 .B 2 ≡ βΓ Πx : A.B 1 ≡ βΓ Πx : A.A. Finally, by Lemma 2.6.28, we have A ≡ βΓ B 2 [x/a] ≡ βΓ T . Lemma 2.6.30. Let Γ a global context whose declarations are well-typed.

  Definition 2.6.32 (Right Product Compatibility). A global context Γ satisfies the right product compatibility property if, for all A, B 1 , B 2 , s 1 , s 2 and ∆, ifΓ ⊢ ctx ∆, Γ; ∆ ⊢ Πx : A.B 1 : s 1 , Γ; ∆ ⊢ Πx : A.B 2 : s 2 and Πx : A.B 1 ≡ βΓ Πx : A.B 2 , then B 1 ≡ βΓ B 2 .We write R-PC(Γ) if Γ satisfies right product compatibility.

	Remark 2.6.33. Product compatibility implies right product compatibility.
	Lemma 2.6.34. Let Γ be a global context whose declarations are well-typed.

  .7 is undecidable. We reduce the word problem for E (Figure2.7) to (right) product-compatibility. To each pair of words p = (w 1 , w 2 ) on the alphabet {a, b}, we associate a global context Γ p . Then we prove that w 1 = E w 2 if and only if (right) product compatibility holds for Γ p .Γ p is built from a prefix common for every pair.

	x(y z)	= (x y)z
	abaabb	= bbaaba
	aababba	= bbaaaba
	abaaabb	= abbabaa
	bbbaabbaaba = bbbaabbaaaa
	aaaabbaaba	= bbaaaa
	Figure 2.7: Equational theory with an undecidable word problem.
	Proof. |abaabb|	→ |bbaaba|.
	|aababba|	→ |bbaaaba|.
	|abaaabb|	→ |abbabaa|.
	|bbbaabbaaba| → |bbbaabbaaaa|.
	|aaaabbaaba|	→ |bbaaaa|.
	|bbaaba|	→ |abaabb|.
	|bbaaaba|	→ |aababba|.
	|abbabaa|	→ |abaaabb|.
	|bbbaabbaaaa| → |bbbaabbaaba|.
	|bbaaaa|	→ |aaaabbaaba|.
	Lemma 2.6.36 (Undecidability of (Right) Product Compatibility). Let Γ be a global
	context. Product compatibility in Γ is undecidable. Right product compatibility in Γ
	is undecidable.

Word : Type. ǫ : Word. ȧ : Word -→ Word. ḃ : Word -→ Word. Word corresponds to the type of words. ǫ corresponds to the empty word. ȧ and ḃ are word constructors, appending the letter a or b to a word. This allows us to define an encoding |w| of a word w. |ǫ| → ǫ, |aw 0 | → ȧ|w 0 |, |bw 0 | → ḃ|w 0 |, Since we want to work modulo the equalities in E , we add them as rewrite rules in both directions:

  we have, by right product compatibility, B |w 1 | ≡ βΓ B |w 2 |. In fact we have also B |w 1 | ≡ βΓ B |w 2 | without T -rule (replace any T and reduct of T by, say, Word). And, since the rewrite system without the T rules is confluent and there are no possible β-redexes, we have B |w 1 | ↓ Γ B |w 2 |. It follows that |w 1 | ↓ |w 2 | and w 1 = E w 2 . It follows from Lemma 2.6.30 and Lemma 2.6.36. It follows from Lemma 2.6.34 and Lemma 2.6.36.

	Corollary 2.6.37 (Undecidability of Subject Reduction). Subject reduction of β-reduction
	in a global context is undecidable.
	Proof. Corollary 2.6.38 (Undecidability of Uniqueness of Type). Uniqueness of types in a
	global context is undecidable.
	Proof.

  When P is a proposition, we write |P | for prf P . (Embedding of Hypothesis). Let Ξ = H 1 , . . . , H n be a set of propositions. We write |Ξ| for the local context (h 1 : |H 1 |) . . . (h n : |H n |).

	Definition 2.7.6 (Embedding of Propositions).
	x f (t 1 , . . . , t n ) P (t 1 , . . . , t n )	= x = ḟ t 1 . . . t n = Ṗ t 1 . . . t n	where x is a variable
	⊤	= true
	⊥	= false
	P ⇒ Q	= imp P Q
	P ∧Q	= and P Q
	P ∨Q	= or P Q
	∀x.P	= forall (λx : term. P )
	∃x.P	= exists (λx : term. P )
	Notation 2.7.7. Definition 2.7.8

  then |P | ≡ βΓ Πx : prop.|x|. By product compatibility, we have U ≡ βΓ prop and V ≡ βΓ |x|.

Therefore, we have Γ; ∆(x : prop) ⊢ u : |x|. By Lemma 2.7.13, we have Γ(Σ ∪ {x}); ∆ ⊢ u : |x|. By induction hypothesis, Ξ ⊢ Σ∪{x} x. Substituting x by ⊥, we have Ξ ⊢ Σ ⊥. -If P = A =⇒ B , then |P | ≡ βΓ |A| -→ |B |. By product compatibility, we have U ≡ βΓ |A| and V ≡ βΓ |B |. Therefore, we have Γ; ∆(x : |A|) ⊢ u : |B |.

  If P = ∀x.A, then |P | ≡ βΓ Πx : term.|A|. By product compatibility, we have U ≡ βΓ term and V ≡ βΓ |A|. If P = ∃z.A, then |P | ≡ βΓ Πx : prop.|(∀z.A =⇒ x) =⇒ x|. By product compatibility, we have U ≡ βΓ prop and V ≡ βΓ |(∀z.A =⇒ Substituting x by ∃z.A, we get Ξ ⊢ Σ (∀z.A =⇒ (∃z.A)) =⇒ (∃z.A).Since Ξ ⊢ Σ ∀z.A =⇒ (∃z.A) is provable, Ξ ⊢ Σ ∃z.A is also provable.• Suppose that π = h u 1 . . . u p . We have Γ; ∆ ⊢ h : |H | for H ∈ Ξ and Ξ ⊢ Σ H .

Therefore, we have Γ; ∆(x : term) ⊢ u : |A|. By Lemma 2.6.4, we have Γ; (x : term)∆ ⊢ u : |A|.

By induction hypothesis, Ξ ⊢

Σ A is provable and, since x ∉ Ξ, Ξ ⊢ Σ ∀x.A is also provable. x) =⇒ x|.

Therefore, we have Γ; ∆(x : prop) ⊢ u : |(∀z.A =⇒ x) =⇒ x|. By Lemma 2.7.13, we have Γ(Σ ∪ {x}); ∆ ⊢ u : |(∀z.A =⇒ x) =⇒ x|. By induction hypothesis, Ξ ⊢ Σ∪{x} (∀z.A =⇒ x) =⇒ x.

  Theorem 4.5.4 (Subject Reduction for → Γ b ). Let Γ be a well-formed global context and ∆ a local context well-formed for Γ. If Γ; ∆ ⊢ t 1 : T and t 1 → Γ b t 2 , then Γ; ∆ ⊢ t 2 : T .

	It directly follows from the following lemma:
	Lemma 4.5.5. If t 1 → Γ b t 2 , then for some t ′ 1 and t ′ 2 , we have t 1 ← * β t ′ 1 → Γ t ′ 2 → * β t 2 . Moreover, if t 1 is well-typed, then we can choose t ′ 1 such that it is well-typed in the
	same context.

Notation 4.8.3 (

  Head Reduction). We write t 1 → h Γ b t 2 if t 1 → Γ b t 2 and the reduction occurs at the root of t 1 and not in a subterm. → h Γ b t 2 for the rewrite rule u → v if and only if there is a HRSsubstitution σ such that t 1 = u σ and t 2 = v σ . The operational semantics for decision trees is given Figure

	Remark 4.8.4. t 1 Definition 4.8.5.

  Completeness) Suppose that T = Kind. By Theorem 6.2.6 and Lemma 2.3.5, we have infer Γ ∆ t = Kind.Suppose that T = Kind. If we have Γ; ∆ ⊢ t : T , then, by stratification (Lemma 2.6.10), Γ; ∆ ⊢ T : s. By Theorem 6.2.6 and Lemma 2.3.5, infer Γ ∆ T = s and infer Γ ∆ t = T 2 with T ≡ βΓ T 2 . Therefore, check Γ ∆ t T = true.

  réécriture non linéaires à gauche dans le λΠ-Calcul Modulo. Les règles non linéaires à gauche génèrent la plupart du temps un système de réécriture non confluent lorsqu'on les associe à la β-réduction. Ceci rend la preuve de la propriété de la compatibilité du produit plus difficile. Nous montrons que cette propriété est vérifiée, indépendamment de la confluence, lorsqu'on ne considère que des régles de réécriture au niveau objet. Nous donnons aussi un critère pour prouver la propriété de la compatibilité du produit dans le cas où le contexte global contient des règles non linéaires à gauche et des règles produisant des types produits. Ce critère est applicable dans le λΠ-Calcul Modulo coloré dans lequel la relation de conversion est faiblement typée. • Dans le chapitre 6, nous avons donné des algorithmes pour inférer et vérifier le type d'un terme, pour vérifier qu'un contexte local est bien formé, pour vérifier qu'une règle de réécriture est faiblement bien formée et pour vérifier qu'un contexte global est β-bien-formé. Nous prouvons aussi que ces algorithmes sont corrects et complets en utilisant les résultats des chapitres précédents.

  Quand nous avons défini le λΠ-Calcul Modulo, nous sommes parti d'un notion de réécriture non typée. L'idée était, d'une part, d'avoir une séparation nette entre les notions de réécriture et de typage et, d'autre part, d'avoir une définition du calcul aussi proche que possible de son implémentation. Dans le chapitre 5, nous avons vu que cette notion libérale de la réécriture était problématique lorsque l'on considère des règles non linéaires à gauche, car la confluence est immédiatement perdue. Ce problème pourrait être résolu en considérant des notions de réécriture et de conversion typées. Cependant, nous ne savons pas dans quelle mesure cette restriction modifie la théorie du λΠ-Calcul Modulo et si les résultats présentés dans cette thèse restent valides. Une comparaison précise entre les approches typée et non typée de la réécriture nous en apprendrait davantage.

Not to be confused with weakly well-formed rewrite rules (Definition 3.6.5). We never use the latter notion in this chapter.

w Γ ∆ 2 , if, for all x ∈ dom(∆ 1 ), we have Γ; ∆ 2 ⊢ w σ(x) : ∆ 1 (x) .

Γ Γ( f ) ≡ w Γ T . • Suppose that t = uv with u and v algebraic terms. By inversion (Lemma 5.4.20), on the one hand, Γ; ∆ 0 ⊢ w u : A 0 -→ B 0 , Γ; ∆ 0 ⊢ w v : A 0 and T 0 ≡ w Γ B 0 . On the other hand, Γ; ∆ ⊢ w σ(u) : A -→ B , Γ; ∆ ⊢ w σ(v) : A, and T ≡ w Γ B . By induction hypothesis, A -→ B ≡ w Γ A 0 -→ B 0 , A ≡ w Γ A 0 and, for all x ∈ FV (t ), Γ; ∆ ⊢ w σ(x) : ∆ 0 (x) . By weak product compatibility, B ≡ w Γ B 0 . It follows that T ≡ w Γ T 0 . • Suppose that t = ux with u algebraic and x a variable in ∆ 0 . By inversion (Lemma 5.4.20), on the one hand, Γ; ∆ 0 ⊢ w u : A 0 -→ B 0 , Γ; ∆ 0 ⊢ w x : A 0 with A 0 ≡ w Γ ∆ 0 (x) and T 0 ≡ w Γ B 0 . On the other hand, Γ; ∆ ⊢ w σ(u) : A -→ B , Γ; ∆ ⊢ w σ(x) : A and T ≡ w Γ B . By induction hypothesis, A -→ B ≡ w Γ A 0 -→ B 0 and, for all x ∈ FV (u), Γ; ∆ ⊢ w σ(x) : ∆ 0 (x) . By weak product compatibility, A ≡ w Γ A 0 and B ≡ w Γ B 0 . It follows that T ≡ w Γ B ≡ w Γ B 0 ≡ w

Acknowledgements

Constructive Predicate Logic

In this section, we encode the constructive predicate logic [START_REF] Gentzen | Untersuchungen über das logische schließen[END_REF] (also called firstorder intuitionistic logic) following Dorra [START_REF] Dorra | Equivalence de Curry-Howard entre le lambda-Pi calcul et la logique intuitionniste[END_REF].

Definition

Definition 2.7.1 (Terms). Let Σ be a signature, that is a set of function symbols and predicate symbols with their arity, and let V be a set of variables.

Let set of first-order terms is defined as follows:

• if x is a variable, then x is a term;

• if c is a function symbol of arity n and t 1 , . . . t n are n terms, then c(t 1 , . . . , t n ) is a term.

Definition 2.7.2 (Propositions). The set of first order propositions is defined as follows:

• if P is a predicate symbol of arity n and t 1 , . . . t n are n terms, then P (t 1 , . . . , t n ) is a proposition;

• ⊤ and ⊥ are propositions;

• if P and Q are propositions, then P ∧Q, P ∨Q and P =⇒ Q are propositions;

• if P is a proposition, then ∀x.P and ∃x.P are propositions.

Definition 2.7.3 (Constructive Predicate Logic). Let Σ be a signature and Ξ be a set of proposition. The proposition P is provable in the context Ξ in constructive predicate logic if the judgment Ξ ⊢ Σ P is derivable from the inference rules of Figure 2.8.

Global Context

We introduce two types for the propositions and the terms of the logic: prop : Type. term : Type.

We also introduce constants for the logical connectors: true : prop. false : prop. imp : prop -→ prop -→ prop. and : prop -→ prop -→ prop. or : prop -→ prop -→ prop. forall : (term -→ prop) -→ prop. exists : (term -→ prop) -→ prop.

We add a constant to represent the proofs of a given proposition as a type: prf : prop -→ Type. Now we add rewrite rules to describe what the proofs of a proposition are. We mimic the elimination rules of natural deduction. a type for the variables in ∆ 2 .

Remark 3.3.2. The typing system of Figure 3.1 is very close to an algorithm able to infer the type of a term together with the types of its free variables. Indeed, for each term, at most one inference rule of c or i can be applied. Moreover, we can see c and i as two mutually recursively defined functions. i is a function taking two local contexts ∆ 1 and Σ as well as a term t as arguments and producing a term T and a local context ∆ 2 such that the judgment Γ; ∆ 1 ; Σ i t ⇒ T, ∆ 2 is derivable. c is a function taking two local contexts ∆ 1 and Σ and two terms t and T as arguments and produces a local context ∆ 2 such that the judgment Γ; ∆ 1 ; Σ c t ⇐ T | ∆ 2 is derivable. Assuming that the side conditions (for instance the congruence) are decidable, this gives us an algorithm to infer the type of a term when the type of some free variables is missing.

Theorem 3.3.3. Let Γ be a global context. If, for some ∆ and T , we have:

• and Γ; ∆ ⊢ v : T , then (u → v) is permanently well-typed in Γ.

As previously, we first prove a main lemma.

Lemma 3.3.4 (Main Lemma for Theorem 3.3.3). Let Γ 0 be a global context and Γ be a well-formed extension of Γ 0 . Assume that:

• Γ ⊢ ctx ∆σ(Σ),

• Γ; ∆σ(Σ) ⊢ σ(t ) : T ,

• dom(Σ) ∩ dom(σ) = ,

• dom(Σ) ∩ codom(σ) =

• and σ : ∆ 1 Γ ∆.

We have

-Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s or T 0 = Kind and σ : ∆ 0 Γ ∆;

• if Γ 0 ; ∆ 1 ; Σ c t ⇐ T 0 | ∆ 0 , T ≡ βΓ σ(T 0 ) and Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, then σ : ∆ 0 Γ ∆.

Proof. We proceed by induction on Γ 0 ; ∆ 1 ; Σ i t ⇒ T 0 , ∆ 0 and Γ 0 ; ∆ 1 ; Σ c t ⇐ T 0 | ∆ 0 .

• Case Γ 0 ; ∆ 1 ; Σ i t ⇒ T 0 , ∆ 0 .

-(Sort) By inversion on Γ; ∆σ(Σ) ⊢ σ(t ) : T , we have T = Kind = σ(T 0 ).

-(Constant) By inversion, T ≡

-(Σ-Variable) By inversion, T ≡ βΓ σ(Σ(x)) = σ(T 0 ). Since ∆σ(Σ) is wellformed, Γ; ∆σ(Σ) ⊢ σ(Σ(x)) : Type. Notation 3.4.4. Let ∆ be a local context and σ be a substitution. We write σ(∆) for the context defined as follows:

Lemma 3.4.5. Let Γ 0 be a global context and Γ be a well-typed extension of Γ 0 . Assume that:

• Γ ⊢ ctx ∆σ(Σ),

• Γ; ∆σ(Σ) ⊢ σ(t ) : T ,

• dom(Σ) ∩ dom(σ) =

• and dom(Σ) ∩ codom(σ) = .

We have

• if Γ 0 ; ∆ 1 ; Σ 1 2 c t ⇐ T 0 | ∆ 0 , T ≡ βΓ σ(T 0 ) and Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, then σ : ∆ 0 Γ ∆, Proof. As in the proof of Lemma 3.3.4, we proceed by induction on Γ 0 ; ∆ 1 ; Σ 1 i t ⇒ T 0 , ∆ 0 and Γ 0 ; ∆ 1 ; Σ 1 c t ⇐ T 0 | ∆ 0 . We only consider the new cases.

• (Abs-No-Check) Same as (C-Abstraction).

• (Inv-No-Check) Same as (Inversion).

• (App-No-Check) By induction hypothesis.

• (No-Check) Trivial.

Proof of Theorem 3.4.3. Same as Theorem 3.3.3 but using Lemma 3.4.5 instead of Lemma 3.3.4.

We are now able to prove that the second example from the beginning of this chapter is well-typed.

Corollary 3.4.6. The rewrite rule (head n 1 (vcons n 2 e l ) → e) is permanently welltyped. then (u → v) is well-typed in Γ.

Remark 3.5.9. If we take the identity substitution, τ = i d , for the pre-solution, then we get back exactly the assumptions of Theorem 3.4.3.

As usual, we first prove the corresponding main lemma. Lemma 3.5.10 (Main Lemma for Theorem 3.5.8). Let Γ a well-typed global context.

Suppose that:

• Γ ⊢ ctx ∆σ(Σ),

• Γ; ∆σ(Σ) ⊢ σ(t ) : T ,

• σ ∈ Sol Γ (dom(∆ 1 ), C 1 ),

• dom(Σ) ∩ dom(σ) = ,

• dom(Σ) ∩ codom(σ) =

• and σ : ∆ 1 Γ ∆.

Then, we have:

and σ : ∆ 0 Γ ∆;

• if Γ; ∆ 1 ; Σ; C 1 c t ⇐ T 0 | (∆ 0 , C 0 ) and T ≡ βΓ σ(T 0 ) with Γ; ∆σ(Σ) ⊢ σ(T 0 ) : s, then

and σ : ∆ 0 Γ ∆.

Proof. We prove both properties at the same time by induction on Γ; ∆ 1 ; Σ; C 1 i t ⇒ (∆ 0 , T 0 , C 0 ) and Γ; ∆ 1 ; Σ; C 1 c t ⇐ T 0 | (∆ 0 , C 0 ).

• (Sort) t = Type. By inversion, T = Kind = σ(Kind) = σ(T 0 ).

• (Constant) t = f is a constant. By inversion, T ≡ βΓ Γ( f ) = σ(Γ( f )) = σ(T 0 ).

• (Σ-Variable) t = x ∈ dom(Σ) is a variable and T 0 = Σ(x). By inversion, T ≡ βΓ σ(Σ(x)) = σ(T 0 ).

By uniqueness of types, T ≡ βΓ σ(∆ 1 (x)) = σ(T 0 ).

Γ; ∆ 1 ; , i vcons n 2 e l ⇒ (∆ 2 , Vector (S n 2 ), ) for ∆ 2 = (n 1 : nat)(n 2 : nat)(e : term)(l : Vector n 2 ).

By the (Inversion) rule, we have

Finally, by the rule (S-Application), we have Γ; ; ;

As we have already seen, τ = {n 1 → n 2 } ∈ PreSol Γ (dom(∆ 2 ), C ) and we have

Therefore, by Theorem 3.5.8, the rewrite rule (tail n 1 (vcons n 2 e l ) → l ) is welltyped in Γ.

Weakly Well-Formed Global Contexts

So far, we have proved that the rewrite rules satisfying the assumptions of Theorem 3.5.8 are well-typed but not that they are permanently well-typed. In fact, these rewrite rules are not permanently well-typed in general.

Consider the rewrite rule on tail:

tail n 1 (vcons n 2 e l ) → l .

We know that it satisfies the assumptions of Theorem 3.5.8 for Γ. Now, consider the following extension Γ 2 :

In the local context ∆ = (n 1 : nat)(n 2 : nat)(e : term)(l : Vector n 2 ), since Vector (S n 1 ) ≡ βΓ 2 NonEmptyVector ≡ βΓ 2 Vector (S n 2 ), we have:

and the following reduction:

tail n 1 (vcons n 2 e l ) → Γ 2 l . However, we do not have Γ 2 ; ∆ ⊢ l : Vector n 1 since Vector n 1 and Vector n 2 are not convertible. Subject reduction is broken and the rewrite rule is not permanently well-typed.

The problem is that the pre-solution

). Theorem 3.5.8 do not apply anymore.

Therefore, to prove that a rewrite rule is permanently well-typed we need a stronger notion of pre-solution. We need to characterize the substitutions that remain presolutions in any extension of the global context. Definition 3.6.1 (Permanent Pre-Solution (First Attempt)). Let Γ be a global context, V be a set of variables and C be a set of constraints.

A permanent pre-solution for C is a substitution τ such that, for any well-typed extension Γ 2 of Γ and any σ ∈ Sol Γ 2 (V, C ), σ ≡ βΓ 2 στ on V .

Unfortunately, this new definition is useless. When C is a set of constraints originating from a typing problem in the λΠ-Calculus Modulo, then the only permanent pre-solution in the sense of Definition 3.6.1 is the identity substitution.

Indeed, the (satisfiable) typing constraints arising when typing a term in the λΠ-Calculus Modulo can be decomposed into constraints of the form (C v,C u) where C is a constant. The problem is that, for permanent pre-solutions, we need to consider every possible extensions of the global context, in particular the extension where the constraint is trivially verified, for example if we have the rewrite rule (C v → C u). It follows that the identity is the only permanent pre-solution. Therefore, we are back to Section 3.4...

A simple solution to this problem is to restrict the possible extensions of the global context to contexts verifying some properties that we can use to find nontrivial permanent pre-solutions.

Let us look back at our example where C = {(Vector (S n 1 ), Vector (S n 2 ))}. To prove that τ = {n 1 → n 2 } is a pre-solution, we need, first, to remark that there are no rewrite rules whose head symbol is Vector or S and, second, that we use the confluence of → βΓ . We call safe the global contexts verifying these conditions.

Safe Global Context

We consider that we have a partition of the set of constants in two (infinite) sets:

Definition 3.6.2 (Static and Definable Symbols). Constants in C S are called static symbols. Constants in C D are called definable symbols.

Static symbols are meant to be not rewritten; we will forbid the rewrite rules whose head constant is a static symbol. On the contrary, there are no restrictions for definable symbols.

For our examples on vectors, the type constant Vector and the object constants 0 and S are not meant to be rewritten: they should be static symbols. On the other hand, there are rewrite rules defining the constants head and tail; therefore, they should be declared as definable symbols.

Definition 3.6.3 (Safe Global Context

Weakly Well-Formed Rewrite Rules

Now we can give a revised definition of permanent pre-solutions. Definition 3.6.4 (Permanent Pre-Solution). Let Γ be a global context, V be a set of variables and C be a set of constraints.

A permanent pre-solution for C in Γ is a substitution τ such that, for any safe extension Γ 2 of Γ and any σ ∈ Sol Γ 2 (V, C ), we have σ ≡ βΓ 2 στ.

We write PreSol per Γ (V, C ) the set of permanent pre-solutions for C in Γ.

We now use the notion of permanent pre-solution to define weakly well-formed rewrite rules. Definition 3.6.5 (Weakly Well-Formed Rewrite Rule). A rewrite rule (u → v) is weaklywell-formed in Γ if there exist ∆, T and τ such that

As expected, weakly well-formed rewrite rules remain well-typed as long as confluence is preserved and no rewrite rule is associated to a static symbol. Theorem 3.6.6. Let Γ be a global context and Γ 2 be a safe extension of Γ.

If a rewrite rule is weakly-well-formed in Γ, then it is well-typed in Γ 2 .

The proof follows the lines of the proof of Theorem 3.5.8. We only state the corresponding main lemma. Lemma 3.6.7 (Main Lemma for Theorem 3.6.6). Let Γ be a global context and Γ 2 be a safe extension of Γ. Suppose that:

We have

By inversion, we have Γ; ∆σ(Σ) ⊢ σ(u) : Πy : A.B and Γ; ∆σ(Σ) ⊢ σ(v) : A and

By induction hypothesis, (∆,

A.B ≡ βΓ στ 1 (P ) and A ≡ βΓ στ 2 (A 0 ).

By Lemma 3.7.7, there exists

We take τ = τ 3 ⊎ {X → λ x : Σ( x).λy : A.B }.

We have

By inversion, we have Γ; ∆σ(Σ) ⊢ σ(U ) : Πx : A.B and Γ; ∆σ(Σ) ⊢ σ(v) : A and

By induction hypothesis, (∆,

By confluence, A ≡ βΓ στ 1 (A 1 ) and B ≡ βΓ στ 1 (B 1 ).

By Lemma 3.7.7, there exists τ such that (∆, σ |V , τ) ∈ Sol(V , C 1 ∪C 2 ); for all X ∈ dom(τ 1 ), we have τ(X ) ≡ βΓ τ 1 (X ) and, for all X ∈ dom(τ 2 ), we have τ(X ) ≡ βΓ τ 2 (X ).

We have:

• (Abstraction) Suppose that t = λx : A 0 .u,

By inversion, we have Γ; ∆σ(Σ) ⊢ σ(A 0 ) : Type, Γ; ∆σ(Σ(x : A 0 )) ⊢ u : B and T ≡ βΓ Πx : σ(A 0 ).B .

By induction hypothesis, (∆,

By Lemma 3.7.7, there exists τ such that (∆, σ |V , τ) ∈ Sol(V , C ); for all X ∈ dom(τ 1 ), we have τ(X ) ≡ βΓ τ 1 (X ) and, for all X ∈ dom(τ 2 ), we have τ(X ) ≡ βΓ τ 2 (X ).

Moreover, T ≡ βΓ Πx : σ(A 0 ).B ≡ βΓ στ(Πx : A 0 .B 0 ) with στ(A 0 ) = σ(A 0 ).

By inversion, we have Γ; ∆σ(Σ) ⊢ σ(A) : Type and Γ; ∆σ(Σ(x : A)) ⊢ B : s.

By induction hypothesis, (∆,

By Lemma 3.7.7, there exists τ 3 such that (∆, σ |V , τ 3 ) ∈ Sol(V , C ).

We now prove the converse.

An Encoding of the λΠ-Calculus Modulo into Higher

Order Rewrite Systems

Encoding of Terms

We now mimic the encoding of the untyped λ-calculus as an HRS and encode the terms of the λΠ-Calculus Modulo. First we specify the signature.

Higher-Order Rewrite Rules

We have faithfully encoded the terms. The next step is to encode the rewrite rules.

First, we introduce a rule (beta) for β-reduction in the HRS.

(beta) App(Lam(w,λx.y(x)), z) → y(z)

We have the following correspondence:

Lemma 4.4.6. If t 1 → β t 2 , then t 1 → (bet a) t 2 .

• FV (v) ⊂ FV (u);

• all free occurrences of a variable in u or v are applied to the same number of arguments.

The encoding of (u

The first and second assumptions ensure that u → v is indeed a rewrite rule for Definition 4.3.6. The third assumption says that u and v are uniform terms and that, moreover, the arity constraint is the same for u and v. This ensures that the encoding of a variable has a unique simple type. Definition 4.4.14 (HRS(Γ)). Let Γ be a global context whose rewrite rules satisfy the conditions of Definition 4.4.13. We write HRS(Γ) for the HRS { u → v | (u → v) ∈ Γ} and HRS(βΓ) for H RS(Γ) ∪ {(beta)}.

Rewriting Modulo β

Definition

We are now able to properly define rewriting modulo β. As for usual rewriting, rewriting modulo β is defined on all (untyped) terms of the λΠ-Calculus Modulo. Definition 4.5.1 (Rewriting Modulo β). Let Γ be a global context whose rewrite rules satisfy the condition of Definition 4.4.13. We say that t 1 rewrites to t 2 modulo β (written t 1 → Γ b t 2 ) if t 1 rewrites to t 2 in HRS(Γ). Similarly, we write t 1 → βΓ b t 2 if t 1 rewrites to t 2 in HRS(βΓ).

Example

Let us look at the example from the introduction. Now we have :

Let Γ be a global context such that:

• → Γ b is well-defined (i.e., the rewrite rules satisfy the assumptions of Definition 4.4.13);

• the rewrite rules are left-linear;

• all the rewrite rules for a single symbol have the same number of arguments.

We can take CC Γ = f → D ∈ CC( , M f ) for M f the matrix representing the rewrite rules whose head symbol is f .

We now prove the soundness and completeness properties for CC Γ , using a notion a matching for vectors of terms. Definition 4.8.13 (Match). Let s be a vector of terms, V be a set of variables and M = (U → V ) be a matrix.

Match( s, V , M ) is the set of terms t such that, for some integer i and HRS-substitution σ:

Remark 4.8.14. Let Γ be a global context and M be the matrix corresponding to the rules

(by a toplevel reduction) if and only if t ∈ Match( s, , M ).

Notation 4.8.15. We write M 1 ⊂ M 2 if M 2 contains at least all the lines of M 1 .

Remark 4.8.16.

Soundness for Matrix Specialization and Default Matrix

Lemma 4.8.17

Proof. By definition of S λ (V , j , M ).

Lemma 4.8.19 (Soundness of D). Suppose that:

• if s j = λx : A.u, then, for all i ,U (i , j ) is not an abstraction;

• if s j = u v with u a constant or a variable in V , then, for all i ,U (i , j ) = u w with

Proof. By definition of D(V , j , M ).

Soundness of the Compilation to Decision Trees

Theorem 4.8.20 (Soundness of CC). Let s be a vector of terms, V be a set of variables, D be a decision tree, M = U → V be a matrix and t be a term.

Proof. By induction on ⊢.

Since D ∈ CC(V , M ), there exists i such that, for all j , U (i , j ) is either a joker or z y z , for variables z and y z , and v = V (i ).

It follows that, for all j , u = U (i , j ) is either a joker or

By induction hypothesis, we have

By Lemma 4.8.17, we have t ∈ Match( s, V , M ).

By induction hypothesis, t ∈ Match( s.A.u, V ∪ {x}, S λ (V, j , M )).

By Lemma 4.8.18, t ∈ Match( s, V , M ).

• (Switch-Else) Suppose that D = Switch( j , F, D 0 ) and ( s,

By Remark 4.8.14 and Theorem 4.8.20.

Completeness of the Compilation to Decision Trees

Proof. We proceed by induction on CC(V , M ). Let D ∈ CC(V , M ).

• Since Match( s, V , M ) = , then M = and D = Fail.

• Suppose that D = Leaf(v, ρ, D 0 ); then, there exists i such that, for all j ,U (i , j ) is either a joker or is equal to x j y j with x j ∉ V and y j ⊂ V , ρ(x j ) = ( y j , j ), and

Otherwise, s does not match the line i and t ∈ Match( s, V , M 0 ). By induction hypothesis, ( s, V ) ⊢ D 0 → t and, by (Leaf-Else), ( s,

-

By induction hypothesis, we have ( s,

It follows, by (Switch-L), that ( s,V ) ⊢ D → t .

-

Conclusion

We have defined a notion of rewriting modulo β for the λΠ-Calculus Modulo. We achieved this by encoding the λΠ-Calculus Modulo into the framework of Higher-Order Rewrite Systems. As a consequence, we also make the confluence results for HRSs available for the λΠ-Calculus Modulo. We proved that rewriting modulo β preserves typing and that confluence of rewriting modulo β implies productcompatibility, allowing us to generalize the notion of weakly well-formed global context to β-well-formed global contexts.

We have also studied an efficient implementation of rewriting modulo β through the compilation of rewrite rules to decision trees, extending the work of Maranget [START_REF] Maranget | Compiling Pattern Matching to Good Decision Trees[END_REF].

Obviously, this rewrite rule cannot be replaced by:

since both rewrite rules do not have the same behavior.

Therefore, the question remains: can we prove product compatibility in presence of non left-linear rewrite rules or, more generally, when the rewrite system is not confluent? And, if so, how to proceed? Barbanera, Geuvers and Fernández [START_REF] Barbanera | Modularity of Strong Normalization and Confluence in the Algebraic-lambda-Cube[END_REF] already addressed this question by proving, without any assumption on confluence, that when the rewrite rules are only at object level, product compatibility always holds. They proved this theorem for the Algebraic λ-Cube, but, as we will see, it can be adapted for the λΠ-Calculus Modulo. For instance, the following global context Γ satisfies product compatibility because all the rewrite rules are at object level:

However, the relation → βΓ is non-confluent. Indeed, let Ω be the fix-point combinator introduced in Lemma 1.4.8. We have:

β minus (S (Ω S)) (Ω S) → Γ S 0. However 0 and S 0 are not joinable.

But, what about global contexts containing at the same time non left-linear rewrite rules and type-level rewrite rules? Barbanera's result has been extended by Blanqui [START_REF] Blanqui | Definitions by rewriting in the Calculus of Constructions[END_REF] to rewrite systems without product types in the right-hand side of rewrite rules. Still, the question remains for global contexts with non left-linear rewrite rules and rewrite rules with product types on the right-hand side.

In general, product compatibility does not hold if the reduction → βΓ is not confluent. Consider the following extension of the global context above:

Since, as we have seen above, 0 ≡ βΓ S 0, we have:

But, we do not have A ≡ βΓ nat. Hence, product compatibility does not hold.

The problem here is that the non-confluence occurring at object level on terms of type nat is propagated at type level through the rewrite rules on the symbol T whose behaviour depends on its argument of type nat.

To avoid such a situation, we would like to use a criterion based on typing to separate the type-level part of the rewrite system from the non left-linear part. However, this is not possible because conversions between two well-typed terms may contain ill-typed terms and, therefore, no argument based on typing can be applied. This problem is strongly connected to our choice of using an untyped reduc-Lemma 5.2.6 (Postponement). Let Γ be a global context without any Π-producing rewrite rules.

If

Proof. Since there are no Π-producing rules, it is sufficient to show that if T 1 → * Γ T 2 → * β h P and P contains a product type (but not inside the type annotation of an abstraction), then, for some T 3 , we have T 1 → * β h T 3 → * Γ P . We proceed by induction on the number of β h steps. The base case is trivial.

and V 2 contains a product type. By induction hypothesis, we have

The commutation lemma says that → Γ and → β h commute.

) w 1 and we can take

Using these two lemmas, we can prove Theorem 5.2.4.

Proof of Theorem 5.2.4. Suppose that

We prove, by induction on n, that, if Πx :

It suffices to prove, for ↓=↓ β and ↓=↓ Γ , that, if 5.1), then it follows from 1. confluence of → β (Theorem 1.3.5) and 2. standardization (Theorem 1.3.6).

If ↓=↓ Γ (see Figure 5.1), then it follows from 1. the commutation lemma (Lemma 5.2.7) and 2. the postponement lemma (Lemma 5.2.6).

.1: Proof of product compatibility 123

Towards a New Criterion For Product Compatibility

As already mentioned, our goal is to design a new criterion for product compatibility able to deal with global contexts containing Π-producing rewrite rules and non leftlinear rewrite rules. Suppose that we want to define polymorphic pairs. Following the encoding of polymorphism of Section 2.7.2, we can proceed as follows 2 :

If we want the pairs to be surjective, we need to add this non left-linear rewrite rule:

We get a global context mixing Π-producing rewrite rules and non left-linear rewrite rules. However, the types involved in the Π-producing rewrite rule (U T and Type) are different from the type involved in the non left-linear rewrite rule (Pair). Therefore, these rewrite rules should not interact. We will show that, in this case, product compatibility holds.

We will proceed as follows.

• First, in Section 5.4, we define a weak notion of typing, for which subject reduction is easy to prove.

• Then, in Section 5.5, we define a variant of the λΠ-Calculus Modulo, in which the conversion rule is assumed to be weakly well-typed.

• Finally, in Section 5.6, we prove a general criterion for product compatibility for this variant of the λΠ-Calculus Modulo. We introduce two rewriting relation → out and → i n for which we prove a postponement lemma and a commutation lemma. This allows us to prove a theorem similar to Theorem 5.2.4, but allowing, under some assumptions, Π-producing rewrite rules.

Weak Typing

We now define formally the notions of weak types and weak typing. Recall that the goal is to have an alternative notion of typing for which subject reduction is easy to prove. We obtain the new notion of typing by dropping dependent types for simple types.

A Assuming that we have a function Color(.) giving a color (black or white) to any type constant, we can associate to any type or kind of the λΠ-Calculus Modulo a weak type. We simply ignore type dependencies.

Definition 5.4.2 (Stripping Function). The stripping function . , from types and kinds to weak types, is defined as follows:

Remark that the type constants in the λΠ-Calculus Modulo are collapsed, when translated into weak types, into only two constants: Black and White. The reason for this collapse (we could have kept all the type constants in weak types) is that it maximizes our chances to subsequently use weak subject reduction (Theorem 5.4.25). On the other side, we need at least two constants because, in Section 5.6, we will use weak typing to discriminate between two kinds of terms: roughly speaking, terms allowed to be non confluent and terms that are not.

The stripping function is invariant by substitutions since substitutions only concern objects. Proof. By induction on → βΓ , using Lemma 5.4.3.

As a corollary, we get that the stripping function commutes with the congruence.

2 Remark the last two rewrite rules have been linearized as explained in Chapter 3.

125

Lemma 5.4.6.

Proof. By induction on ≡ βΓ , using Lemma 5.4.5.

The color of weak types is defined as follows:

Definition 5.4.7 (Black and White Weak Types). The color of a weak type (Black or White) is defined as follows:

A type-level rewrite rule that preserves the color of weak types is called nonconfusing. Proof. By induction on the definition of ≡ w Γ and on A.

Definition 5.4.8 (Non-Confusing Rewrite Rules). A type-level rewrite rule

Weak Typing

We now show how to associate weak types to the terms of the λΠ-Calculus Modulo using a typing discipline close to the simply typed λ-calculus. The notion of weak typing is an approximation of usual typing in the following sense:

Lemma 5.4.11. If Γ; ∆ ⊢ t : T , then Γ; ∆ ⊢ w t : T .

Proof. By induction on the typing derivation.

• (Type, Variable, Constant) Trivial.

• (Application) By induction hypothesis and Lemma 5.4.3.

• (Abstraction) By induction hypothesis.

• (Product) By induction hypothesis.

• (Conversion) By induction hypothesis and Lemma 5.4.6.

The converse is not true. For instance plus 0 true is obviously ill-typed; however it is weakly well-typed if we take Color(nat) = Color(prop). Remark 5.4.15. Well-typed rewrite rules are not necessarily weakly well-typed. For instance the rule (plus 0 true → λx : nat.x) is well-typed because it is not possible to use it on a well-typed term. However, if we take Color(nat) = Color(prop) = Black, then the rule is not weakly well-typed because the weak-types of its left-hand side (Black) and right-hand side (Black -→ Black) are different.

In Section 5.4.3, we give a simple criterion for showing that a rewrite rule is weakly well-typed.

To prove weak subject reduction, we need a weak notion of product compatibility.

Definition 5.4.16 (Weak Product Compatibility). A global context Γ satisfies the weak product compatibility if, for any

Lemma 5.4.17. Let Γ be a global context. If → w Γ is confluent, then weak product compatibility holds for Γ.

Proof. If Πx : A 1 .B 1 ≡ w Γ Πx : A 2 .B 2 , then, for some A 0 and B 0 , we have

Remark 5.4.18. It is much easier to prove weak product compatibility than to prove product compatibility. As we have seen, it follows from the confluence of the rewrite system obtained by stripping the type-level rewrite rules. It means that there is no need to consider object-level rewrite rules nor β-reduction. Therefore, the difficulty associated with non left-linear rewrite rules vanishes. Moreover, such a system is ground (no variable in the rewrite rules); therefore its confluence is decidable [START_REF] Comon | The Confluence of Ground Term Rewrite Systems is Decidable in Polynomial Time[END_REF] in polynomial time.

Definition 5.4.19 (Weakly Well-Typed Global Context). A global context Γ is weakly well-typed if

• for all (c : A) ∈ Γ, Γ; ⊢ w A : s;

• all rewrite rules in Γ are weakly-well typed;

• all type-level rewrite rules are non-confusing;

• Γ satisfies the weak product compatibility property.

Properties

Many typing properties of the λΠ-Calculus Modulo have a weak counterpart. We begin by proving some simple lemmas.

Lemma 5.4.20 (Inversion). If Γ; ∆ ⊢ w t : T then

• either t = Type and T = Kind;

• or t = x and there exists A such that (x : A) ∈ ∆ and T ≡ w Γ A ;

• or t = c and there exists A such that (c : A) ∈ Γ and T ≡ w Γ A ;

• or t = f u and there exist A and B such that Proof. We proceed by induction on t 1 and follow the proof of usual subject reduction for → β (Lemma 2.6.20). As previously, Lemma 5.4.22 and Lemma 5.4.21 are needed. We detail the redex case. Suppose that t 1 = (λx : A 0 .u)v and t 2 = u[x/v]. By inversion, on the one hand, Γ; ∆ ⊢ w λx : A 0 .u : A -→ B , Γ; ∆ ⊢ w v : A and T ≡ w Γ B and, on the other hand, Γ; ∆ ⊢ w A 0 : Type, Γ; ∆(x : A 0 ) ⊢ w u : B 0 and A 0 -→ B 0 ≡ w Γ A -→ B . By weak product compatibility, A 0 ≡ w Γ A and B 0 ≡ w Γ B . By Lemma 5.4.22, from Γ; ∆(x : A 0 ) ⊢ w u : T and Γ; ∆ ⊢ w v : A 0 , we deduce Γ; ∆ ⊢ w u[x/v] : T .

From these two lemmas, we get weak subject reduction.

Theorem 5.4.25 (Weak Subject Reduction). Let Γ be a global context that satisfies the weak product compatibility property and whose rewrite rules are weakly well-typed.

If Γ; ∆ ⊢ w t 1 : T and t 1 → βΓ t 2 , then Γ; ∆ ⊢ w t 2 : T .

Proof. Follows from Lemma 5.4.24 and Lemma 5.4.23.

From weak product compatibility, we can also prove the uniqueness of weak types.

Theorem 5.4.26 (Uniqueness of Weak Types). Let Γ be a global context satisfying the weak product compatibility property and let ∆ be a weakly well-formed local context.

If Γ; ∆ ⊢ w t : T 1 and Γ; ∆ ⊢ w t : T 2 , then T 1 ≡ w Γ T 2 .

Proof. By induction on the first typing derivation.

• (Sort), (Variable), (Constant) By inversion on the second typing derivation.

• (Application) Suppose that t = uv, Γ; ∆ ⊢ w u :

By inversion on the second typing derivation, Γ; ∆ ⊢ w u :

• (Abstraction) and (Product) By inversion on the second typing derivation and induction hypothesis.

• (Conversion) By induction hypothesis.

In the following, we focus on weakly well-typed rewrite rules and we give a simple criterion for showing that a rewrite rule is weakly well-typed.

Theorem 5.4.27. Let Γ be a global context satisfying the weak product compatibility property. Suppose that:

This theorem is a weak version of Theorem 3.3.3. The proofs are similar. First, we need to introduce the notion of weakly well-typed substitution. Proof. By induction on the typing derivation.

Then, we prove a main lemma.

Lemma 5.4.30. Let Γ be a global context satisfying the weak product compatibility property. Assume that:

• t is algebraic;

We have

Proof. We proceed by induction on t .

• Suppose that t = f is a constant. By inversion (Lemma 5.4.20), we have T 0 ≡ w Γ T 0 .

Moreover, we have Γ; ∆ ⊢ w σ(x) :

Finally, we can prove the theorem.

Proof of Theorem 5.4.27. Suppose that we have Γ; ∆ ⊢ w σ( f u) : T , Γ; ∆ 0 ⊢ w f u : T 0 and Γ; ∆ 0 ⊢ w v : T 0 . By Lemma 5.4.30, we have T ≡ w Γ T 0 and, for all x ∈ FV (t ), Γ; ∆ ⊢ w σ(x) : ∆ 0 (x) . By induction on Γ ⊢ ctx w ∆ 0 , we can conclude that σ : ∆ 0 w Γ ∆. By Lemma 5.4.29, we have Γ; ∆ ⊢ w σ(v) : T 0 and, by conversion, Γ; ∆ ⊢ w σ(v) : T .

In fact, the other criteria of Chapter 3 could also be adapted to prove the weak well-typedness of rewrite rules.

The Colored λΠ-Calculus Modulo

In this section, we define a variant of the λΠ-Calculus Modulo, where the conversion is assumed to be weakly well-typed.

Weakly Well-Typed Conversion

Definition 5.5.1 (Weakly Well-Typed Conversion). Let Γ be a global context and ∆ be a local context. We write Γ; ∆ ⊢ w t 1 ≡ t 2 if the pair (t 1 , t 2 ) is in the reflexive, symmetric and transitive closure of the relation

The converse is not true in general. However, it holds in the particular case where the rewriting relation is confluent.

Lemma 5.5.3. Let Γ be a global context satisfying the weak product compatibility property, whose rewrite rules are weakly well-typed and such that → βΓ is confluent.

If t 1 ≡ βΓ t 2 and t 1 and t 2 are weakly well-typed in ∆, then Γ; ∆ ⊢ w t 1 ≡ t 2 .

Proof. By confluence, we have t 1 ↓ βΓ t 2 . By weak subject reduction (Theorem 5.4.25), all the reducts of t 1 and t 2 are weakly well-typed.

The weakly well-typed conversion ensures that every term in the conversion has the same weak type. Lemma 5.5.4. Let Γ be a global context satisfying the weak product compatibility property and whose rewrite rules are weakly well-typed.

If Γ; ∆ ⊢ w t 1 : T and Γ; ∆ ⊢ w t 1 ≡ t 2 , then, for every term t in the βΓ-path between t 1 and t 2 , we have Γ; ∆ ⊢ w t : T . Proof. By weak subject reduction (Theorem 5.4.25). Moreover, if the relation → βΓ is confluent, then the typing relations ⊢ ′ and ⊢ are equal.

The Colored λΠ-Calculus Modulo

Lemma 5.5.7. Let Γ be a global context satisfying the weak product compatibility property, whose rewrite rules are weakly well-typed and such that → βΓ is confluent.

We have Γ; ∆ ⊢ t : T if and only if Γ; ∆ ⊢ ′ t : T .

Proof. By Lemma 5.5.6 and Lemma 5.5.3.

A General Criterion for Product Compatibility for the Colored λΠ-Calculus Modulo

In this section we prove a general criterion for product compatibility (Theorem 5.6.5) in the Colored λΠ-Calculus Modulo defined in Section 5.5. We begin by some definitions.

The color of a rewrite rule is the color of its head symbol.

Definition 5.6.1 (Black and White Rewite Rules). Let Γ be a global context. The color of a rewrite rule ( f u → v) is the color of Γ( f ) .

Remark 5.6.2. The distinction between black and white rewrite rules formalizes the distinction safe and unsafe rewrite rules that we introduced in Section 5.1.

Notation 5.6.3. We write t 1 → Bl ack t 2 if t 1 → Γ t 2 using a black rewrite rule.

Definition 5.6.4 (Black and White Positions). Let Γ be a global context. A position p in a term t is black (respectively white) if:

• either t |p = f u and Color( Γ( f ) ) = Black (respectively White);

Theorem 5.6.5 (Product Compatibility). Let Γ be a global context. Suppose that:

• (A1) Γ is weakly well-typed;

• (A2) black rewrite rules are left-linear;

• (A3) the relation generated by the black rewrite rules together with β-reduction is confluent;

• (A4) for any black rewrite rule (u → v) ∈ Γ, all the non-variable subterms of u are at black positions; then, Γ satisfies the product compatibility in the Colored λΠ-Calculus Modulo.

The Rewriting Relations → i n and → out

To prove Theorem 5.6.5, we will mimic the proof of Theorem 5.2.4. However, the roles of → β h and → Γ will be played by two new relations, → i n and → out that we define in this section. First, we need to introduce the notion of black and white terms.

Definition 5.6.6 (Black and White Terms). Let Γ be a global context. We say that a term t is black (respectively white) in a local context ∆ if, for some T , we have Γ; ∆ ⊢ w t : T with Color( T ) = Black (respectively Color( T ) = White).

The sets of black and white terms are disjoint. They form a partition of the weakly well-typed terms.

Lemma 5.6.7. Let Γ be a weakly well-typed global context and ∆ be a weakly wellformed local context for Γ.

If we have Γ; ∆ ⊢ w t : T 1 and Γ; ∆ ⊢ w t : T 2 , then Color( T 1 ) = Color( T 2 ).

Proof. By uniqueness of weak types (Theorem 5.4.26) and Lemma 5.4.9.

The sets of black and white terms are stable by reduction.

Lemma 5.6.8. Let Γ be a weakly well-typed global context and ∆ be a weakly wellformed local context for Γ.

If t 1 is black (respectively white) in ∆ and t 1 → βΓ t 2 , then t 2 is black (respectively white) in ∆.

Proof. It follows from weak subject reduction (Theorem 5.4.25).

Applying a term preserves its color.

Lemma 5.6.9. Let Γ be a weakly well-typed global context and ∆ be a weakly wellformed local context for Γ. If Γ; ∆ ⊢ w u : T 1 and Γ; ∆ ⊢ w u v : T 2 , then Color(T 1 ) = Color(T 2 ). Redexes of black (respectively white) rewrite rules are black (respectively white).

Lemma 5.6.10. Let Γ be a weakly well-typed global context and ∆ be a weakly wellformed local context for Γ.

If t 1 is weakly well-typed in ∆ and is a redex of a black (respectively white) rewrite rule in Γ, then it is black (respectively white).

Proof. By definition of black and white rewrite rules and Lemma 5.6.9.

The subterms at a black (respectively white) position are black (respectively white).

Lemma 5.6.11. Let Γ be a weakly well-typed global context and ∆ be a weakly wellformed local context for Γ.

If u is weakly well-typed in ∆ and p is a black (respectively white) position in u, then u |p is black (respectively white) in ∆.

Proof. By definition of black and white positions.

Using the notions of black and white terms, we can define the relations of internal reduction → i n and of external reduction → out . Definition 5.6.12 (The Relation → i n ). Let Γ be a weakly well-typed global context, ∆ be a weakly well-formed local context for Γ and t 1 a term weakly well-typed in ∆.

We write t 1 → i n t 2 if t 1 → βΓ t 2 and the reduction occurs inside a white subterm (no matter the position white or black).

The relation → out is the complement of → i n with respect to → βΓ . Definition 5.6.13 (The Relation → out ). We write → out for → βΓ \ → i n .

Lemma 5.6.14.

Proof. White rewrite rules rewrite white terms (Lemma 5.6.10). By definition → outsteps cannot involve white subterms.

Lemma 5.6.15. Under the hypotheses of Theorem 5.6.5, the relation → out is leftlinear.

Proof. Follows from Lemma 5.6.14 and Assumption (A2).

Proof of Product Compatibility

We now prove Theorem 5.6.5. We follow the proof of Theorem 5.2.4 and we first prove three lemmas: a postponement lemma, a commutation lemma and a product types lemma.

In the remaining of the section we work under the hypotheses of Theorem 5.6.5.

Postponement

Lemma 5.6.16. Let t 1 be a weakly well-typed term.

If t 1 → i n u 1 → out t 2 , then there exists u 2 such that t 1 → out u 2 → * i n t 2 . Proof. By definition, the → out -redex cannot be inside the → i n -contractum.

Moreover, the → i n -contractum does not overlap with the → out -redex. Indeed, by (A4), black rewrite rules do not filter on white subterms and the → i n -contractum is white.

Thus, there are only two possible situations:

• either the two reductions are parallel, and then they can occur in any order;

• or the → i n -contractum is inside the → out -redex and, since → out is left-linear (Lemma 5.6.15), there exists u 2 such that t 1 → out u 2 → * i n t 2 .

Lemma 5.6.17 (Postponement). Let t 1 be a weakly well-typed term. If t 1 → * βΓ t 2 , then there exists u such that t 1 → * out u → * i n t 2 . Proof. We proceed by induction on the n-tuple (m 1 , . . . , m n ) ordered lexicographically, where n is the number of (→ out )-steps and m i is the number of (→ i n )-steps on the left of the i -th → out .

• If (m 1 , . . . , m n ) = (0, . . . , 0), then the reduction has the form t 1 → * out u → * i n t 2 . • Otherwise, using Lemma 5.6.16 makes the tuple decrease. If t 1 → out t 2 and t 1 → i n t 3 , then there exists t 4 such that t 3 → out t 4 and t 2 → * i n t 4 . Proof. By definition, the → out -redex cannot be inside the → i n -redex (with or without overlap).

Moreover, the → i n -redexes do not overlap inside the → out -redex, since → out does not filter on white subterms (A4) Therefore, either the redexes are independent or the → i n -redex is inside the → out -redex. Since → out is left-linear (Lemma 5.6.15), in both cases, the reductions commute.

Lemma 5.6.19 (Commutation). Let t 1 be a black term.

If t 1 → * out t 2 and t 1 → * i n t 3 , then there exists t 4 such that t 3 → * out t 4 and t 2 → * i n t 4 . Proof. We prove that, if t 1 → n out t 2 and t 1 → m i n t 3 , then there exists t 4 such that t 3 → n out t 4 and t 2 → * i n t 4 . We proceed by induction on the pair (n, m) ordered lexicographically. We use Lemma 5.6.18 (Lem.) and the induction hypothesis (IH), as illustrated in Figure 5.6.

Product Types

Beside the postponement lemma and the commutation lemma, we will need the following lemma, which says that internal reductions cannot introduce product types at the root of a term.

Lemma 5.6.20.

Proof. By weak subject reduction, t 1 has the same type as the product type, that is to say Type or Kind. Therefore, t 1 is black. A → i n -redex is either white or occurs inside a white term; therefore the reductions cannot occur at the root of t 1 . Thus, t 1 is a product type. We now have the tools to prove Theorem 5.6.5.

Proof of Theorem 5.6.5. Assume that we have Γ; ∆ ⊢ w Πx :

We have, for some n, Πx :

Moreover, all the terms in the conversion are weakly well-typed.

We prove, by induction on n, that if

It boils down to proving, for ↓=↓ out and ↓=↓ i n , that, if

• Case ↓=↓ out (see Figure 5.7). Let T 0 be the common reduct of T 1 and T 2 :

T 1 → * out T 0 and T 2 → * out T 0 .

1. By Lemma 5.6.14 and confluence of → β ∪ → Bl ack (A3), there exist A 0 and B 0 such that Πx : A 1 .B 1 (→ β ∪ → Bl ack ) * Πx : A 0 .B 0 and T 0 (→ β ∪ → Bl ack ) * Πx : A 0 .B 0 .

Chapter 6

Type Inference

Résumé Ce chapitre décrit les algorithmes de vérification de type pour les différents éléments du λΠ-Calcul Modulo : termes, contextes locaux et contextes globaux. On montre aussi que ces algorithmes sont corrects et complets en utilisant les résultats des chapitres précédents.

Introduction

In this chapter, we give algorithms to infer and check types for terms, check wellformedness of local contexts and check well-typedness of global contexts in the λΠ-Calculus Modulo. Using the theorems proved in the previous chapters, we study the conditions under which these algorithms are sound, complete and terminating. We write the programs using pseudo code whose syntax is close to the OCaml programming language.

Since, we often need to reduce terms in the algorithms presented below, we assume given a function normalize that, given a global context Γ and a term t , computes a normal form for t with respect to the rewriting relation → βΓ .

val normalize : global_context → term → term Of course, this function need not terminate if the term is not strongly normalizing. Therefore we will use it with global contexts Γ and terms t such that t is welltyped in Γ and → βΓ is strongly normalizing on well-typed terms. However, in some cases we need to reduce potentially ill-typed terms. In these cases, to preserve termination, we will use a function bounded_normalize that computes a normal form but fails if no normal form is reached after a fixed number of steps. This function always terminates but may fail to compute a normal form for some entries.

We also assume a function term_eq to compare terms up to α-equivalence (i.e., up to renaming of bound variables).

val term_eq : term → term → boolean

Type Inference

We give below an algorithm for inferring a type for a given term. This algorithm recursively inspects the shape of a term and applies the corresponding inference rules for the typing relation ⊢. The rule (Conversion) (Figure 2.4) is never used directly. However, in the case of an application, the inferred type of the function is reduced to ensure that it is a product type as in the premise of the (Application) rule. Remark 6.2.1. We do not need to fully normalize the term T u on line 11. It suffices to reduce it until a product type is reached. However, in this case we need to normalize A before comparing it with the normal form of T v . Theorem 6.2.2 (Soundness of infer). Let Γ be a well-typed global context and let ∆ be a local context well-formed in Γ.

If infer Γ ∆ t = T , then Γ; ∆ ⊢ t : T . Proof. We proceed by induction on t .

We only detail the case where t is an application.

• Suppose that t = u v. We have infer

By induction hypothesis, we have Γ; ∆ ⊢ u : T u and Γ; ∆ ⊢ v : T v .

By subject reduction (Theorem 2.6.22) and conversion, we have Γ; ∆ ⊢ u : Πx : A.B and, by inversion, we get Γ; ∆ ⊢ A : Type.

Therefore, by (Conversion), we have Γ; ∆ ⊢ v : A.

Finally, using the (Application) rule, we get

Since we use the subject reduction property in the proof, we need Γ to be welltyped and ∆ to be well-formed. To avoid the need for subject reduction, we can modify the algorithm to check that the result of the normalize function is well-typed.

This allows us to drop the assumptions on Γ and ∆. Theorem 6.2.3 (Soundness of safe_infer). If safe_infer Γ ∆ t = T , then Γ; ∆ ⊢ t : T .

Proof. We proceed by induction on t .

We only detail the case where t is an application.

• Suppose that t = u v. We have safe_infer

By induction hypothesis, we have Γ; ∆ ⊢ u : T u , Γ; ∆ ⊢ v : T v and Γ; ∆ ⊢ Πx : A.B : s.

By inversion, we get Γ; ∆ ⊢ A : Type.

Proof. First remark that, if Γ; ∆ ⊢ t : T and infer Γ ∆ t = T 2 , then, by soundness of infer (Theorem 6.2.2) and uniqueness of types (Theorem 2.6.25), we have Γ; ∆ ⊢ t :

T 2 and T 2 ≡ βΓ T . We proceed by induction on the typing derivation Γ; ∆ ⊢ t : T .

• (Sort) Take T 2 = Kind.

• (Variable) Take T 2 = ∆(x).

• (Constant) Take T 2 = Γ(c)

• (Application) Suppose that t = u v.

By inversion, we have Γ; ∆ ⊢ u :

By induction hypothesis, there exist T u and T v such that infer Γ ∆ u = T u and infer Γ ∆ v = T v .

Moreover, since T u ≡ βΓ Πx : U .V and → βΓ is confluent and terminating, we have normalize Γ T u = Π x:A.B , for some A and B such that T v → * βΓ A.

Therefore, we have infer

• (Abstraction) By inversion and induction hypothesis (used twice).

• (Product) By inversion and induction hypothesis (used twice).

• (Conversion) By induction hypothesis.

Type Checking

By uniqueness of types, typechecking can be decomposed into inferring a type and then performing a convertibility test between the expected type and the inferred type. Proof.

Well-Typedness Checking for Rewrite Rules

In Chapter 3, we have given several methods to prove that a rewrite rule is welltyped. We now implement the check based on weakly well-formed rewrite rules (Theorem 3.6.6).

Solving Unification Constraints

This criterion is based on the computation of a permanent presolution (Definition 3.6.1).

The function find_presolution takes as arguments a global context Γ, a set of variables V and a set of constraints C to solve. It computes a presolution for C whose domain is in V .

To compute a permanent presolution for a set of equations, we adapt Herbrand's unification algorithm [START_REF]Term Rewriting Systems[END_REF]. We recursively unify syntactically the normalized equations, but we drop them when we do not know how to solve them. This is possible because we do not need to compute a solution of the unification problem but only a prefix to all solutions. Remark that we need to use bounded_normalize instead of normalize because we do not know if the constraints are well-typed. Let Γ 2 a safe extension of Γ and σ such that σ(A) ≡ βΓ 2 σ(B ), for all (A, B ) ∈ C .

We only detail the case where C = C 0 (t 1 , t 2 ) with bounded_normalize Γ t 1 = c u 1 , bounded_normalize Γ t 2 = c u 2 and c is a static symbol.

• We have σ(c u 1 ) ≡ βΓ 2 σ(c u 2 ). Moreover → βΓ 2 is confluent by hypothesis of safeness for Γ 2 . Since c is static, by confluence of → βΓ 2 , we have σ( u 1 ) ≡ βΓ 2 σ( u 2 ). Therefore any solution of C 0 ( u 1 , u 2 ) is a solution of C and any permanent presolution of C 0 ( u 1 , u 2 ) is a permanent presolution of C .

It follows, by induction hypothesis, that σ is a permanent presolution of C .

Checking Weak Well-Formedness of Rewrite Rules

We now (partially) implement the relations Γ

, necessary to type the left-hand side of weakly well-formed rewrite rules.

We chose to implement only some inference rules of Figure 3.3 and Figure 3.4. In particular, we do not check type annotations on abstraction and do not infer the type of abstractions. Since abstractions always occur as arguments in left-hand sides of rewrite rules, their types is always known in advance, and therefore the information given by the type annotation is redundant. Lemma 6.5.2 (Soundness of lhs_infer and lhs_check).

• If infer_lhs Γ ∆ 1 Σ C 1 t = (∆ 2 ,T ,C 2 ), then Γ; ∆ 1 , Σ, C 1 i t ⇒ (∆ 2 , T, C 2 ).

Proof. By induction on t .

Finally, we can implement the weak well-formedness check for rewrite rules. Proof.

• (Soundness) Follows from the soundness of infer_lhs and check_lhs (Lemma 6.5.2), soundness of find_presolution (Lemma 6.5.1), soundness of local_wf (Theorem 6.4.1) and soundness of check (Theorem 6.3.1).

• (Termination) The termination of rewrite_wf follows from the termination of infer_lhs and check_lhs (recursive calls are made on strict subterms), of find_presolution (Lemma 6.5.1), of local_wf (Theorem 6.4.1) and check (Theorem 6.3.1).

Checking Well-Typedness for Global Contexts

We have shown in Chapter 3, that β-well-formed global contexts (Definition 4.5.8) are well-typed. We now have most of the tools to check that a global context is βwell-formed.

The only missing element is confluence checking for → βΓ . We consider that we have a function is_confluent that, given a global context Γ, tries to decide if → βΓ b is confluent. This property is undecidable but we may assume that this function implements a simplification of Van Oostrom's development closed theorem (Theorem 4.6.6) such as the one in [START_REF] Aoto | Proving Confluence of Term Rewriting Systems Automatically[END_REF]. Proof. We prove by induction on Γ that it is β-well-formed. Hence, by Theorem 4.5.10, it is well-typed.

• Suppose that Γ = . Trivial.

• Suppose that Γ = Γ 0 (c : T ). We have global_wf Γ 0 = true, infer Γ 0 T = Type and c ∉ d om(Γ 0 ). By induction hypothesis, Γ 0 is β-well-formed (and well-typed). By soundness of infer (Theorem 6.2.2), we have Γ; ⊢ T : Type.

It follows that Γ is β-well-formed.

• Suppose that Γ = Γ 0 (C : K ). We have global_wf Γ 0 = true, infer Γ 0 K = Kind and C ∉ d om(Γ 0 ). By induction hypothesis, Γ 0 is β-well-formed (and well-typed). By soundness of infer (Theorem 6.2.2), we have Γ; ⊢ K : Kind.

It follows that Γ is β-well-formed.

• Suppose that Γ = Γ 0 Ξ. We have global_wf Γ 0 = true, for all (u → v) ∈ Ξ, rewrite_wf Γ 0 (u → v) and is_confluent Γ = ext_true. By induction hypothesis, Γ 0 is β-well-formed. By soundness of rewrite_wf (Lemma 6.5.3), the rewrite rules in Ξ are weakly well-formed for Γ 0 and are of

Conclusion

In this thesis, we have developed a new formal presentation of the λΠ-Calculus Modulo to serve as a theoretical foundation its the proof checker, DEDUKTI, which we implemented.

Summary of Contributions

• In Chapter 2, we have given a new presentation of the λΠ-Calculus Modulo, a type system featuring dependent types and rewrite rules, together with a detailed theoretical study of the system. We have introduced the notion of welltyped global contexts to characterize global contexts for which basic properties such as subject reduction and uniqueness of types hold. A global context is well-typed if constant declarations are well-typed, rewrite rules are welltyped and product compatibility holds. We have also studied the Calculus of Constructions Modulo, an extension of the λΠ-Calculus Modulo with polymorphism and type operators.

• In Chapter 3, we have investigated the property of well-typedness of rewrite rules. Starting from the proof that strongly well-formed rewrite rules are welltyped, we have generalized the result through the notion of weakly well-formed rewrite rules. Unlike strongly well-formed rewrite rules, weakly well-formed rewrite rules can have a left-hand side that is neither algebraic nor well-typed. This allows matching under binders. It also permits getting rid of the non-leftlinearities due to typing constraints, in order to preserve a confluent rewrite system. Finally, we have given an exact characterization of the well-typedness property for rewrite rules as a problem of inclusion between solutions of two unification problems and we have used this characterization to show the undecidability of well-typedness of rewrite rules.

• In Chapter 4, we have solved a problem arising from the presence of binders on the left-hand side of rewrite rules: confluence is lost for the combination of β-reduction with these rewrite rules; therefore, confluence cannot be used to prove product compatibility or decidability of type-checking. We have introduced a notion of rewriting modulo β for the λΠ-Calculus Modulo that does not suffer this problem. We have shown that the confluence of this new rewriting relation can be used to prove product compatibility and decidability of type-checking. Rewriting modulo β is defined through an encoding of the terms of the λΠ-Calculus Modulo into Higher-Order Rewrite Systems. As a result, it allows using confluence criteria designed for HRSs to prove the confluence of rewriting modulo β in the λΠ-Calculus Modulo. We have also