2.1 Structural induction

To reason about functions like plus that take Nats as arguments, programmers can also reason by induction that follows the structure of Nat in the same way the code is written. For example, the very definition of plus is first built on the identity of addition, that $plus~\mathrm{zero}~y = y$ for any number y, so it holds by just calculation with no further verification required. However, addition’s second identity law, $plus~x~\mathrm{zero} = x$ for any number x, cannot be directly calculated in the same way. Instead, matching the inductive structure of plus itself, we have to prove this property by cases on what that first argument x might be.

Example Theorem 2.1. For all x of type Nat, $plus~x~\mathrm{zero} = x$ .

Why is the proof of Example Theorem 2.1 well-founded—meaning it does not contain any vicious circle in its reasoning? In the inductive hypothesis, we assume that Example Theorem 2.1 is true for the specific x’ that is the predecessor of the x we started with. As such, the cyclic reasoning always applies to a strictly smaller x, and the inductive hypothesis can never lead to a vicious cycle no matter how we use it, so no further checks are necessary to validate this proof. More formally, this inductive argument is justified because the set of natural numbers of type Nat is a least fixed point (Pierce, Reference Pierce2002): it is the smallest set containing zero and closed under succ.

2.2 Coinductive programs and proofs

The correspondence between inductive type, inductive program, and inductive proof, all line up quite neatly in the functional paradigm, with each of them following exactly the same structure. Since coinduction is the logical dual of induction, should not this correspondence naturally extend to coinductive structures like infinite streams? One can define the type of streams coinductively as the largest data type (i.e., greatest fixed point, or final coalgebra)

built from the Cons constructor—appending an element to the front of another stream—without any base case for the empty stream. From there, coinductive functions—like $always : a \to \mathrm{Stream} \, a$ which returns the stream that always contains the same value of type a, or $iterate : (a \to a) \to a \to \mathrm{Stream} \, a$ that builds an infinite stream from some original a by repeatedly applying a given function to it—can be defined cyclically like so:

\begin{align*} always~x &= \mathrm{Cons} \, x ~ (always~x) & iterate~f~x &= \mathrm{Cons} \, x ~ (iterate~f~(f~x))\end{align*}

Why are always and iterate well-founded? The answer here is not so clear; at first glance, they look like infinite loops that never return a definite answer. However, one justification is that both definitions are productive: they always return a Cons before recursing. In other words, the self-references of always and iterate are both found inside a Cons (that is, in the context $\mathrm{Cons}~first~\dots$ ). If we assume lazy evaluation of Cons this can be enough to prevent infinite loops for well-behaved observers of the stream; trying to access the “last” element of an infinite stream is not a well-behaved observer. While this justification may not be as self-evident as the structural induction of functions like plus, at least it is a property that can be syntactically checked in the specific definitions of always and iterate.

Example Theorem 2.2. For all values x, $iterate~(\lambda y.y)~x = always~x$ .

Proof. Assume the coinductive hypothesis

$$iterate~(\lambda y.y)~x = always~x ~. $$

From there,

Why is the proof of Example Theorem 2.2 well-founded? Compared to the inductive proof, skepticism of this form of coinduction is more warranted. After all, the proof begins by immediately assuming the very fact it is trying to prove, with no stipulation! What’s to stop us from this much simpler, but hopelessly vicious, “coinductive” proof of Example Theorem 2.2?

Bad Proof Assume the coinductive hypothesis $iterate~(\lambda y.y)~x = always~x$ . From the coinductive hypothesis, it follows that $iterate~(\lambda y.y)~x = always~x$ , as required.

This bad proof is obviously invalid, even though it “proved” the goal through a trivial sequence of apparently valid steps (introducing a hypothesis and using it). What is the difference between the bad proof above and the good proof of Example Theorem 2.2? The good proof only tried to use the coinductive hypothesis “inside” a Cons, whereas the bad proof just nakedly used the coinductive hypothesis outside of any Cons. Thus, somehow a coinductive proof of this form must be very careful that certain hypotheses can only be used in certain contexts, whatever that means, even if they are a perfect match for the current goal.

The concern over even a trivial theorem like Example Theorem 2.2 shows the potential breakdown of the correspondence of coinductive types, coinductive programs, and coinductive proofs; at each step, our certainty in the basic structures wanes. Even if the intuition for distinguishing “good” from “bad” programs may be fraught, a formal system like a proof assistant might be up to the task of regulating context-sensitive uses of the coinductive hypothesis to verify a proof. But a human that needs to understand a proof with informal reasoning, which has no perfect overseer like a mental proof assistant, can quickly become overwhelmed as the theorems and proofs grow ever larger. No wonder why coinduction fills us with such trepidation.

Instead, what is needed is a style of coinductive reasoning which is not burdened by precariously implicit context-sensitive rules of validity. Or put another way, the context-sensitivity imposed by coinduction should be made an explicit part of the coinductive hypothesis, so that it may be used freely, and fearlessly, in any place that it fits.

The first step is to shift our view away from coinductively-defined data types, to coinductively-defined codata types (Hagino, Reference Hagino1987). Rather than constructors, codata types define the basic observations, or projections, allowed on values of the type. For infinite streams, these are the head and tail projections that access the first element and the remainder of the stream, respectively, as described in the following declaration:

While abstractly these may be two views of the same isomorphic structure, they give us a different way to understand coinduction and the operational meaning of programs. With codata types, we define programs by matching on the structure of their projections, dual to the way function programmers define functions like plus by matching on the structure of constructors of data types. For example, the always and iterate functions can be rewritten in terms of copatterns (Abel et al., Reference Abel, Pientka, Thibodeau and Setzer2013) like so:

\begin{align*}\begin{aligned} \mathrm{head}(always~x) &= x \\ \mathrm{tail}(always~x) &= always~x\end{aligned}&&\begin{aligned} \mathrm{head}(iterate~f~x) &= x \\ \mathrm{tail}(iterate~f~x) &= iterate~f~(f~x)\end{aligned}\end{align*}

Here, head and tail are seen as projection functions, and the streams returned by $always~x$ and $iterate~f~x$ are defined by the two lines, describing what their head and tail is.

But copatterns alone are not enough. We also need to label our context, so that the language itself is expressive enough to regulate how to control the use of coinduction to certain contexts. To do so, we have to move outside of pure functional programming, based on intuitionistic logic, to a more language based on classical logic with labels and jumps. One such language (Downen et al., Reference Downen, Johnson-Freyd and Ariola2015) is modeled on the sequent calculus (Curien & Herbelin, Reference Curien and Herbelin2000), which provides a syntax for writing contextual observations as first-class objects. In this sequent style, a Greek letter $\alpha$ , $\beta$ ,, stands for an observer of values, and the command $\langle {x} |\!| {\alpha} \rangle$ says that the observer $\alpha$ is applied to x, or symmetrically, that the value x is returned to $\alpha$ .

Rather than viewing the Stream operations head and tail as functions, as we did above, we could instead view them as primitive ways to build new observations. So if $\alpha$ is expecting to observe a value of type a, then the composition $\mathrm{head} \, \, \alpha$ observes a value of type $\mathrm{Stream} \, a$ by taking its first element and passing it to $\alpha$ . Similarly, if $\beta$ is expecting to observe a value of type $\mathrm{Stream} \, a$ , then $\mathrm{tail} \, \beta$ observes a value of type $\mathrm{Stream} \, a$ by discarding its first element and passing the rest to $\beta$ . Putting them together, the observation $\mathrm{tail} \, (\mathrm{head} \, \, \beta)$ should be read as first observing the tail of a stream and then applying the head to that result so that $\beta$ receives the second element of the stream. The two different views—head and tail as functions versus observations—are always equal to one another:

(2.1) \begin{align} \langle {\mathrm{head} \, s} |\!| {\alpha} \rangle &= \langle {s} |\!| {\mathrm{head} \, \alpha} \rangle & \langle {\mathrm{tail} \, s} |\!| {\beta} \rangle &= \langle {s} |\!| {\mathrm{tail} \, \beta} \rangle \end{align}

In this observer-centric style, we can further refine always and iterate by labeling the full context in which they are observed in a command, $\langle {always~x} |\!| {\alpha} \rangle$ and $\langle {iterate~f~x} |\!| {\alpha} \rangle$ . The two definitions then follow by matching on the structure of the observer $\alpha$ , which must be built by either a head or tail projection.

\begin{align*}\begin{alignedat}{2} & \langle {always~x} |\!| {\mathrm{head} \, \beta} \rangle &&= \langle {x} |\!| {\beta} \rangle \\ & \langle {always~x} |\!| {\mathrm{tail} \, \, \alpha'} \rangle &&= \langle {always~x} |\!| {\alpha'} \rangle\end{alignedat}&&\begin{alignedat}{2} & \langle {iterate~f~x} |\!| {\mathrm{head} \, \beta} \rangle &&= \langle {x} |\!| {\beta} \rangle \\ & \langle {iterate~f~x} |\!| {\mathrm{tail} \, \, \alpha'} \rangle &&= \langle {iterate~f~(f~x)} |\!| {\alpha'} \rangle\end{alignedat}\end{align*}

Now, the fact that these corecursive functions are well-founded follows the same basic reasoning as the recursive function plus: all instances of self-reference are invoked with a strictly smaller observer. In particular, the observer $\alpha'$ in the corecursive call $\langle {always~x} |\!| {\alpha'} \rangle$ is a piece of the original observer $\mathrm{tail} \, \, \alpha'$ from the command $\langle {always~x} |\!| {\mathrm{tail} \, \, \alpha'} \rangle$ . Similarly, the observer of the corecursive call $\langle {iterate~f~(f~x)} |\!| {\alpha'} \rangle$ came from a piece of the observer in the proceeding command $\langle {iterate~f~x} |\!| {\mathrm{tail} \, \, \alpha'} \rangle$ . So copattern-matching over observers restores the symmetry between recursive functions (which consume inductively defined arguments) and corecursive functions (which produce coinductively-defined results).

2.3 Structural coinduction

What about proofs involving these programs? Let’s try to prove the analogous version of Example Theorem 2.2 but in the context of an observer labeled $\alpha$ .

Example Theorem 2.3. For all values x of type a and all observers $\alpha$ of type $\mathrm{Stream} \, a$ , $\langle {iterate~(\lambda y.y)~x} |\!| {\alpha} \rangle = \langle {always~x} |\!| {\alpha} \rangle$ .

Notice how the proof of Example Theorem 2.3 above follows much closer the overall shape of the inductive proof of Example Theorem 2.1. First, the coinductive hypothesis is only introduced in the step for $\alpha = \mathrm{tail} \, \, \alpha'$ ; as with induction, the coinductive hypothesis is not available to show the base case of $\alpha = \mathrm{head} \, \beta$ . Furthermore, the coinductive hypothesis $ \langle {iterate~(\lambda y.y)~x} |\!| {\alpha'} \rangle = \langle {always~x} |\!| {\alpha'} \rangle$ carries enough information to fully dictate the valid contexts in which it can be used. In particular, we can only assume the goal (that $iterate~(\lambda y.y)~x$ is equal to $always~x$ ) when observed by $\alpha'$ , the specific ancestor to the original observer $\alpha = \mathrm{tail} \, \, \alpha'$ . There is no way to use the coinductive hypothesis to equate these two streams when seen by any other observer. In particular, the coinductive hypothesis doesn’t even apply to the original goal $ \langle {iterate~(\lambda y.y)~x} |\!| {\alpha} \rangle = \langle {always~x} |\!| {\alpha} \rangle$ , like we did in the bad coinductive proof, because $\alpha \neq \alpha'$ . As such, even though the proof above is informal, there is no longer any ambiguity about its validity, so no further checks are necessary to avoid vicious cycles. Since it follows the structure of the context, we call it structural coinduction.

But have we proved the same result; are Example Theorems 2.2 and 2.3 logically the same? In order to compare the two, we can employ the notion of observational equivalence, which says that two terms are equal exactly when no observer can tell them apart. Spelled out in terms of labeled contexts, observational equivalence is the principle that, for any terms M and N (without a free reference to $\alpha$ ):

\begin{align*} M = N \text{ if and only if, for all } \alpha, \langle {M} |\!| {\alpha} \rangle = \langle {N} |\!| {\alpha} \rangle\end{align*}

Applying this principle to Example Theorems 2.2 and 2.3, we know for all values x,

\begin{alignat*}{2} iterate~(\lambda y.y)~x = always~x \text{ if and only if, for all } \alpha, \langle {iterate~(\lambda y.y)~x} |\!| {\alpha} \rangle = \langle {always~x} |\!| {\alpha} \rangle\end{alignat*}

So the two theorems state the same equality, up to observational equivalence.

Note that we can derive the result of applying head and tail as functions to iterate via observational equivalence. Starting with a generic $\alpha$ , we can convert these function applications to observations on top of $\alpha$ to match the definition of iterate as follows:

and thus by observational equivalence, we have

(2.2) \begin{align} \mathrm{head}(iterate~f~x) &= x \end{align}

(2.3) \begin{align} \\ \mathrm{tail}(iterate~f~x) &= iterate~f~(f~x) \end{align}

Notice that these equations derived by observational equivalence are exactly the same as the purely functional, copattern-matching definition of iterate that we gave above. In other words, the two copattern-based definitions—one in a functional style, and the other matching on the structure of a labeled observer—are equivalent.

Let’s continue with one more example of structural coinduction. Here is a definition for mapping a function over all elements in an infinite stream, where we use head and tail as both part of the main coinductive observer on the left-hand side of the equations, as well as a function to be applied to the given stream we are mapping over on the right-hand sides.

\begin{alignat*}{2} & \langle {map~f~s} |\!| {\mathrm{head} \, \beta} \rangle &&= \langle {f ~ (\mathrm{head} \, s)} |\!| {\beta} \rangle \\ & \langle {map~f~s} |\!| {\mathrm{tail} \, \, \alpha'} \rangle &&= \langle {map~f~(\mathrm{tail} \, s)} |\!| {\alpha'} \rangle\end{alignat*}

Notice how, in the following proof, we can make use of observational equivalence in order to reason about head and tail applied as a function to iterate.

Example Theorem 2.4. For all functions f of type $A \to B$ , values x of type A, and observers $\alpha$ of type $\mathrm{Stream} \, A$ , $ \langle {map~f~(iterate~f~x)} |\!| {\alpha} \rangle = \langle {iterate~f~(f~x)} |\!| {\alpha} \rangle .$

2.4 Mutual coinduction

Given a stream s, we can define mutually corecursive functions taking the elements of s at even and odd positions as so:

\begin{align*}\begin{aligned} \langle {evens~s} |\!| {\mathrm{head} \, \beta} \rangle &= \langle {s} |\!| {\mathrm{head} \, \beta} \rangle \\ \langle {evens~s} |\!| {\mathrm{tail} \, \, \alpha'} \rangle &= \langle {odds~(\mathrm{tail} \, s)} |\!| {\alpha'} \rangle\end{aligned}&&\begin{aligned} \langle {odds~s} |\!| {\mathrm{head} \, \beta} \rangle &= \langle {s} |\!| {\mathrm{tail} \, (\mathrm{head} \, \beta)} \rangle \\ \langle {odds~s} |\!| {\mathrm{tail} \, \, \alpha'} \rangle &= \langle {evens~(\mathrm{tail} \, s)} |\!| {\mathrm{tail} \, \, \alpha'} \rangle\end{aligned}\end{align*}

By observational equivalence and the definitions of odds and evens, we have:

(2.4) \begin{align} odds~s & = evens~ (\mathrm{tail}~ s)\end{align}

(2.5) \begin{align}\\ \mathrm{tail}(evens~s)) & = odds~(\mathrm{tail} \, ~ s) \end{align}

Merging two streams is defined as

\begin{align*} \langle {merge~s_1~s_2} |\!| {\mathrm{head} \, \beta} \rangle &= \langle {s_1} |\!| {\mathrm{head} \, \beta} \rangle \\ \langle {merge~s_1~s_2} |\!| {\mathrm{tail} \, (\mathrm{head} \, \beta)} \rangle &= \langle {s_2} |\!| {\mathrm{head} \, \beta} \rangle \\ \langle {merge~s_1~s_2} |\!| {\mathrm{tail} \, (\mathrm{tail} \, \, \alpha')} \rangle &= \langle {merge~(\mathrm{tail} \, s_1)~(\mathrm{tail} \, s_2)} |\!| {\alpha'} \rangle\end{align*}

As an application of observational equivalence, we have

(2.6) \begin{align}\mathrm{tail} \, (\mathrm{tail} (merge~s_1~s_2)) = merge (\mathrm{tail} \, s_1)(\mathrm{tail} \, s_2) \end{align}

Example Theorem 2.5. For all values $s_1$ and $s_2$ and observers $\alpha$ of type $\mathrm{Stream} \, A$ , $ \langle {evens~(merge~s_1~s_2)} |\!| {\alpha} \rangle = \langle {s_1} |\!| {\alpha} \rangle $ and $ \langle {odds~(merge~s_1~s_2)} |\!| {\alpha} \rangle = \langle {s_2} |\!| {\alpha} \rangle . $

2.5 Strong coinduction

Let us try to prove that the property $ \langle {merge~(evens~s)~(odds~s)} |\!| {\alpha} \rangle = \langle {s} |\!| {\alpha} \rangle $ holds for all values s and observers $\alpha$ of type $\mathrm{Stream} \, A$ . We will show the complete proof shortly. For now, we will focus on the problematic step. We do a proof by conduction on $\alpha$ . We can easily prove the property if $\alpha = \mathrm{head}(\beta)$ . If $\alpha = \mathrm{tail}(\beta)$ , then we proceed by case analysis on $\beta$ . If $\beta = \mathrm{head} \, (\beta')$ the proof goes through without any issues. If $\beta = \mathrm{tail} \, (\beta')$ , we need to prove $ \langle {merge~(evens~s)~(odds~s)} |\!| {\mathrm{tail} \, (\mathrm{tail} \, (\beta'))} \rangle = \langle {s} |\!| {\mathrm{tail} \, (\mathrm{tail}( \beta'))} \rangle$ and note that the coinductive hypothesis is

(2.9) \begin{align} \langle {merge~(evens~s)~(odds~s)} |\!| {\beta} \rangle = \langle {s} |\!| {\beta} \rangle \end{align}

for a generic s. We then have

At this point, we would like to apply the coinductive hypothesis 2.9, but it is fixed to $\beta$ and does not hold on $\beta'$ . What we need instead is a strong version of coinduction. This is not surprising since the same issue comes up with induction. If $\alpha = \mathrm{tail} \, (\mathrm{tail} \, \beta')$ , we assume the property holds not just for the immediate subcontext $\mathrm{tail} \, \, \beta'$ , but also for $\beta'$ , too. We use this strengthened reasoning principle to break the following coinductive proof into more specific sub-cases.

Example Theorem 2.6. For all values s and observers $\alpha$ of type $\mathrm{Stream} \, A$ , $ \langle {merge~(evens~s)~(odds~s)} |\!| {\alpha} \rangle = \langle {s} |\!| {\alpha} \rangle $

3.1 Intensional equational theory

The machine’s operational semantics in Figure 1 only allows us to apply the reduction steps ( $c \mapsto c'$ ) to the top-level of the given command, and only ever forward: the multi-step reduction $c_1 \mathrel{\mapsto\!\!\!\!\to} c_n$ combines several individual steps together, $c_1 \mapsto c_2 \mapsto c_3 \mapsto \dots \mapsto c_n$ , but requires that all the arrows are pointed in the same direction. These two restrictions make the operational semantics deterministic: it always marches forward in one path because there is never more than one choice of step to take.

In contrast, an equational theory—for reasoning about when two programs, or fragments of programs, have the same observable result—gives us more freedom to relate programs that appear to have the same behavior. One of the key allowances is that the reduction steps can be applied both forwards and backwards; i.e., equality is symmetric. The other is that we can apply the reduction steps in any context (no matter how deep within the given expression); i.e., equality is congruent. Such an equational theory for the (co)recursive abstract machine is given in in Figure 4.Footnote ¹ All judgments have the form $\Gamma \mid \Delta \vdash \Phi$ , where $\Gamma$ contains the (unordered) type assignments to free (co)variables, $\Delta$ contains the (unordered) hypothesized properties involving those free (co)variables, and $\Phi$ is the property being proved. The main properties are the base equalities for commands ( $c = c' $ ) and (co)terms of some type A ( $v = v' : A$ and $e = e' \div A$ ). For now, the hypotheses $\Delta$ do not yet interact with the inference rules—they will soon play a crucial role in Section 3.2 —so as shorthand, we will write $\Gamma \vdash \Phi$ instead of $\Gamma \mid \bullet \vdash \Phi$ in examples.

Fig. 4. Intensional equational theory of computation.

This equational theory is the smallest equivalence relation that includes the operational semantics, letting us reason about which programs are equal up to execution. As a result, it is more discriminating than a purely external observer, and can distinguish between two definitions with the same input–output behavior depending on the way they are defined. For this reason, this kind of equational theory is sometimes called intensional (because it lacks extensionality or any nontrivial mathematical reasoning) or definitional (because it is based on the definition of code).

For example, it is easy to show by reduction that $ \langle {plus} |\!| {\mathrm{zero} \cdot x \cdot \alpha} \rangle \mathrel{\mapsto\!\!\!\!\to} \langle {x} |\!| {\alpha} \rangle$ because plus was defined by recursion on its first argument (see Section 2), and therefore we have the following equality:

$$ \alpha \div \mathrm{Nat}, x : \mathrm{Nat} \vdash \langle {plus} |\!| {\mathrm{zero} \cdot x \cdot \alpha} \rangle = \langle {x} |\!| {\alpha} \rangle$$

However, $\langle {plus} |\!| {x \cdot \mathrm{zero} \cdot \alpha} \rangle$ does not reduce at all, even though it is nonetheless equivalent to x in any context. Thus,

$$ \alpha \div \mathrm{Nat}, x: \mathrm{Nat} \vdash \langle {plus} |\!| {x \cdot \mathrm{zero} \cdot \alpha} \rangle = \langle {x} |\!| {\alpha} \rangle $$

is not provable. Likewise, $iterate~(\lambda x.x)~x$ is observationally equivalent to the stream $always~x$ , but the intensional theory considers them different because their definitions are too different.

The bulk of the rules are dedicated to congruence: the allowance that equalities may be applied in any context. Though there are many different congruence rules to spell out (accounting for the many different contexts that may appear), they thankfully reflect exactly the same structure as the type system. Each typing rule from Figure 2 for checking a single command, term, or coterm has a corresponding rule of the same name in Figure 4 which just compares two such expressions hereditarily.

Note that reflexivity of well-typed commands, terms, and coterms is not included as an inference rule in Figure 4 because it holds by performing an induction on the typing derivation, and applying the appropriate congruence rules. Still, in the following, we will sometimes refer to these reflexivity rules:

where the vertical dots indicate the rule is derivable.

The Red rule states that any reduction step of the operational semantics can be added onto another equality. Together with reflexivity, we can say that any well-typed command c is equal to its next step, $c \mapsto c'$ :

and we will simply write

Whereas a (unary) type system interprets the free variable $x : A$ (and analogously, $\alpha \div A$ ) as one unknown value of type A, a (binary) equational theory interprets the free $x : A$ as two unknown values which are equal at type A. More concretely, we can understand the meaning of free (co)variables in terms of the following notion that substitution commutes with equality—substitution of equals into equals are equals:

(3.1)

With the rules we already have, we can use reduction to derive substitution of equal values for variables like so:

And the derivation of the dual substitution of covalues for covariables follows analogously to the above, using the dual $\mu$ activation and operational steps.

Example 3.2. Consider this basic application of corec which just (corecursively) forwards all observations onto some underlying stream xs:

\begin{align*} parrot~xs &:= \mathrm{\textbf{corec}} \{ \mathrm{head} \, \alpha \to \mathrm{head} \, \alpha \mid \mathrm{tail} \, \, \alpha \to \gamma.\mathrm{tail} \, \, \gamma \} \mathrm{\textbf{with}} xs\end{align*}

Intuitively, $parrot~xs$ produces a stream that produces exactly the same elements as xs. We can understand parrot at a higher level in terms of these equations that show how it reacts to head and tail observations:

\begin{align*} \langle {parrot~xs} |\!| {\mathrm{head} \, \beta} \rangle &= \langle {xs} |\!| {\mathrm{head} \, \beta} \rangle & \langle {parrot~xs} |\!| {\mathrm{tail} \, \, \alpha} \rangle &= \langle {parrot~(\mathrm{tail} \, xs)} |\!| {\alpha} \rangle\end{align*}

Both of these equalities are derivable from the intensional equational theory by just applying the operational rules (and expanding any syntactic sugar from Figure 3 as necessary). The head case follows directly from the $\beta_{\mathrm{head}}$ step:

\begin{align*} \langle {parrot~xs} |\!| {\mathrm{head} \, \beta} \rangle &\mapsto \langle {xs} |\!| {\mathrm{head} \, \beta} \rangle &(\beta_{\mathrm{head}})\end{align*}

The tail case is slightly more involved because its reduction depends on whether the command is evaluated according to the call-by-name or call-by-value. In the call-by-name operational semantics, we have the forward reduction (where according to Figure 3, $\mathrm{tail} \, xs$ corresponds to $\mu{\gamma}.\langle {xs} |\!| {\mathrm{tail} \, \gamma} \rangle$ ):

In the call-by-value operational semantics, we have this conversion instead:

3.2 Extensional program logic

It’s often unsatisfactory to only consider two expressions equal when they reduce to some common reduct; that misses out on far too many equalities. Instead, we will enhance the intensional equational theory with a program logic that is extensional, in the sense that it considers expressions equal when they appear to be the same from the outside. This means we will have to add additional rules for saying when two terms (or two coterms) are equal because they cannot be distinguished by some observer. But which observer is that? The other side of the command! Terms are observed by coterms, and vice versa. Therefore, the idea of extensionality in the abstract machine comes down to the idea that (co)terms of any type are equal if and only if they always form equal computations when interacting with equal counterparts of that type. The extensional program logic is given in Figure 5. The distinctive feature of this theory is that it is applicable to both call-by-name and call-by-value. That is why some properties needed to be restricted.

Fig. 5. Extensional program logic.

Propositions - $\Phi$ : We enrich the language of properties that we are proving by internalizing the implicit “for all” generalization made by the free $x : A$ and $\alpha \div A$ in the environment in terms of an explicit $\forall$ quantifier in the syntax of propositions. In addition to the same three cases of equality as before, we now have two dual forms of universal quantification as properties: $\forall x{:}A. \Phi$ generalizes the property $\Phi$ over all choices of equal values of type A for x, and $\forall \alpha{\div}A. \Phi$ generalizes $\Phi$ over all choices of equal covalues for $\alpha$ of type A. The rules governing these two $\forall$ properties are given in Figure 5 as well.

Universal quantifiers can be introduced by IntroL and IntroR, which state that $\forall$ internalizes a free (co)variable in the environment, and eliminated by ElimL and ElimR. The notation $\Phi[{{V}/{x} = {V'}/{x}}]$ (and likewise $\Phi[{{E}/{\alpha} = {E'}/{\alpha}}]$ ) means to perform the substitution $[{{V}/{x}}]$ on the left-hand side of the equation in $\Phi$ and $[{{V'}/{x}}]$ on the right-hand side. For example, the base cases of this substitution are when $\Phi$ is just an equality; for a command equality, this looks like:

\begin{align*} (c = c' )[{{V}/{x} = {V'}/{x}}] &:= (c[{{V}/{x}}]) = (c'[{{V'}/{x}}]) \\ (c = c' )[{{E}/{\alpha} = {E'}/{\alpha}}] &:= (c[{{E}/{\alpha}}]) = (c'[{{E'}/{\alpha}}])\end{align*}

ElimL and ElimR generalize the substitution rules previously derived in Equation (3.1) to instantiate the quantified (co)variables by any equal (co)values of the appropriate type:

(3.2)

which are derived from the Intro and Elim rules like so:

A special case of Elim is to reverse the Intro rules:

(3.3)

These can be derived from the Elim and Var rules by weakening the premise (adding additional (co)variable type assignments which are never used).Footnote ² $Elim \,L_x$ is derived like so:

Similar to the quantifiers, we also have plain propositional implication, written $\Phi' \Rightarrow \Phi$ , for stating that the truth of $\Phi'$ implies the truth of $\Phi$ . The rules governing $\Phi' \Rightarrow \Phi$ are IntroH, which introduces an implication that internalizes a hypothesis in the environment, and Lemm, which lets us eliminate an implication by proving its hypothesis in the style of instantiating a lemma. While propositional implication is not strictly necessary for the kinds of simple equalities we have considered thus far, their addition makes it possible for us to explore some more complex forms of reasoning that can all be derived from the same rules of structural (co)induction. For the same reason, we also introduce propositional conjunction, written $\Phi_1 \wedge \Phi_2$ , to describe the compositionality of (co)induction. Propositional conjunction is introduced and eliminated with the familiar ConjI and ConjE rules.

Strict and productive propositions - $\Psi(x)$ and $\Psi(\alpha)$ : In some rules, we need to impose some constraints on the use of (co)variables. This is because we aim for the program logic to be applicable in both the call-by-value and call-by-name setting. This requires careful attention to avoid equating a value with a non-value, as well as ensuring the same distinction for co-values. These restrictions are defined syntactically and approximate the two dual notions of control flow and data flow:

• • A property $\Psi(x)$ is strict on x when it uses x directly with some covalue on both sides of its underlying equality, with the base case of a strict property on x being $\langle {x} |\!| {E} \rangle = \langle {x} |\!| {E'} \rangle $ where x is not free in E or E’. Intuitively, $\Psi(x)$ is some property which observes x exactly once with a covalue, since all covalues are strict, forcing their input to be computed first before they act.

• • Dually, a property $\Psi(\alpha)$ is productive on $\alpha$ when it immediately returns a value to $\alpha$ on both side of its underlying equality, with the base case of a productive property on $\alpha$ being $\langle {V} |\!| {\alpha} \rangle = \langle {V'} |\!| {\alpha} \rangle $ where $\alpha$ is not free in V or V’. Intuitively, $\Psi(\alpha)$ is some property which produces exactly one value to $\alpha$ .

The $\sigma\mu$ and $\sigma\tilde\mu$ rules implement the idea of observational equality, we would like formal inference rules that embody these two relationships between different forms of equality.

• • $\Gamma \mid \Delta \vdash v = v' : A$ if and only if $\Gamma \mid \Delta \vdash \langle {v} |\!| {e} \rangle = \langle {v'} |\!| {e'} \rangle $ for all $\Gamma \mid \Delta \vdash e = e' \div A$ .

• • $\Gamma \mid \Delta \vdash e = e' \div A$ if and only if $\Gamma \mid \Delta \vdash \langle {v} |\!| {e} \rangle = \langle {v'} |\!| {e'} \rangle $ for all $\Gamma \mid \Delta \vdash v = v' : A$ .

Thankfully, the “only if” direction of both of these can be derived by the Cut congruence rule already present in the intensional equational theory (Figure 4):

If we already know two terms $\Gamma \mid \Delta \vdash v = v' : A$ are equal, then for any other equal coterms $\Gamma \mid \Delta \vdash e = e' \div A$ , Cut lets us conclude that their pointwise combination gives equal commands $\Gamma \mid \Delta \vdash \langle {v} |\!| {e} \rangle = \langle {v'} |\!| {e'} \rangle $ . Dually, starting with two equal coterms, Cut lets us combine them with any equal terms to give equal commands. Whereas the “if” direction is implemented by the $\sigma\mu$ and $\sigma\tilde\mu$ rules, which establish a logical equivalence between equality of commands versus equality of (co)terms. These rules say that any two terms (dually coterms) are equal when they form equal commands when interacting with a generic covariable (dually variable). The $\sigma$ rules allow the derivation of the extensional $\eta$ rules for $\mu$ and ${\tilde{\mu}}$ (Herbelin, Reference Herbelin2005):

They can be derived from the $\sigma\mu$ , $\sigma{\tilde{\mu}}$ inference rules and $\mu{\tilde{\mu}}$ reductions. $\eta_\mu$ is derived as

Analogously for $\eta_{\tilde{\mu}}$ :

Note that the $\mu$ and ${\tilde{\mu}}$ reduction apply to both call-by-name and call-by-value since (co)-variables are considered values in these strategies. This means that the $\eta_\mu$ and $\eta_{\tilde{\mu}}$ axioms are sound in both semantics.

The $\omega{\to}$ rule expresses a form of extensionality for functions in terms of call stacks. It states that the only canonical covalue of type $A \to B$ has the form $V \cdot E$ , and testing a property on a generic call stack $x \cdot \beta$ is sufficient to generalize that property over all $\alpha$ of type $A \to B$ . The rule allows the derivation of the following $\eta$ axiom for functions (Curien & Herbelin, Reference Curien and Herbelin2000):

which is equivalent to the familiar $\eta$ law of the $\lambda$ -calculus, as it can be seen by macro-expanding the syntactic sugar for application according to Fig. 3: $\lambda{x}. (V~x) = \lambda{x}. \mu{\alpha}.\langle {V} |\!| {x \cdot \alpha} \rangle =_{\eta_\to} V$ . The derivation is as follows:

Second from the bottom, $\omega{\to}$ can be applied to $\gamma \div A \to B$ because the equation $\langle {\lambda{x}. \mu{\alpha}.\langle {V} |\!| {x \cdot \alpha} \rangle} |\!| {\gamma} \rangle = \langle {V} |\!| {\gamma} \rangle$ is productive on $\gamma$ ; both sides of the equation immediately produce a syntactic value to $\gamma$ .

The problem is that $\langle {v} |\!| {\gamma} \rangle$ may not produce a single value to $\gamma$ —v might throw $\gamma$ away, as shown in the example below.

\begin{align*} \beta \div \mathrm{Nat} , \gamma \div A \to B \vdash \langle { \lambda{x}. \mu{\alpha}.\langle {\mu{\delta}.\langle {\mathrm{zero}} |\!| {\beta} \rangle} |\!| {x \cdot \alpha} \rangle} |\!| {\gamma} \rangle &= \langle {\mu{\delta}.\langle {\mathrm{zero}} |\!| {\beta} \rangle} |\!| {\gamma} \rangle : A \to B\end{align*}

This equality is fine under call-by-name evaluation but is inconsistent under call-by-value, wherein not all covalues of function type have the form $\alpha$ or $x \cdot \alpha$ . For example, the coterm ${\tilde{\mu}}{\rule{1ex}{0.5pt}}.\langle {\mathrm{succ}\, \mathrm{zero}} |\!| {\alpha} \rangle$ lets us observe the difference call-by-value evaluation makes between the two sides of the equation. On the left, we have

whereas on the right, we have

Therefore, we would be able to derive $\mathrm{zero} = \mathrm{succ} \, \mathrm{zero} : \mathrm{Nat}$ using call-by-value evaluation, making the theory inconsistent.

This inconsistency in call-by-value should not be surprising. It is well known that unrestricted $\eta$ equivalence is unsound in the call-by-value $\lambda$ -calculus with general recursion or side effects. The usual counter-example is that the term $\Omega = (\lambda{x}. x) ~ (\lambda{x}. x)$ is observationally different from a $\lambda$ -abstraction, but the $\eta$ law requires $\Omega = \lambda{x}. (\Omega ~ x)$ . Instead, the sound version of the call-by-value $\eta$ law only applies to values: $\lambda{x}. (V ~ x) = V$ .

The induction rule $\omega{\mathrm{Nat}}$ summarizes the following deduction for proving a property $\Psi$ over any number x using an infinite number of premises:

This deduction is justified from the reasoning that zero, $\mathrm{succ}\, \mathrm{zero}$ , $\mathrm{succ}(\mathrm{succ}\, \mathrm{zero})$ —are all the canonical values of Nat; testing $\Psi$ on all of them is sufficient to generalize $\Psi$ over any x of type Nat. $\omega{\mathrm{Nat}}$ uses the usual structure of primitive induction on the numbers to summarize this kind of argument in a finite form and can be understood as an inference rule representing the usual axiom of induction:

\begin{align*} & \Psi(\mathrm{zero}) \Rightarrow (\forall x{:}{\mathrm{Nat}}. \Psi(x) {\Rightarrow} \Psi(\mathrm{succ} \, x)) \Rightarrow (\forall x{:}{\mathrm{Nat}}. \Psi(x)) & (\omega{\mathrm{Nat}})\end{align*}

Rather than listing a separate proof for each number, just start with a proof for zero specifically, and give a transformation from a proof of $\Psi$ on an arbitrary number to the next proof of $\Psi$ for the successor of that same number. Because this second step is a transformation, we first assume that the property $\Psi$ is true on a generic $x : \mathrm{Nat}$ by placing $\Psi$ in the environment $\Gamma$ of other assumptions, with the intention that the assumed $\Psi$ in $\Gamma$ can be used to prove $\Psi$ with x replaced by $\mathrm{succ} \, x$ .

As an example of the application of induction, we would like to prove the following deep extensionality axiom for “trivial” uses of recursion (where a $\rule{1ex}{0.5pt}$ stands for an unused variable):

The above is saying that any generic observer $\alpha$ cannot tell the difference if a natural number is first broken down and rebuilt from scratch from the base case (zero) up. Let us use the following shorthand:

and proceed as follows:

We can apply the induction rule $\omega{\mathrm{Nat}}$ here because the property $\langle {x} |\!| { noop~\alpha } \rangle = \langle {x} |\!| {\alpha} \rangle$ is strict on x. This is evident because both sides of the equation observe x with a covalue ( $\mathrm{\textbf{rec}}\dots\mathrm{\textbf{with}} \, \alpha$ on the left and $\alpha$ on the right) in both call-by-name and -value.

We can just evaluate the left-hand-side to prove the base case:

\begin{align*}\langle {\mathrm{zero}} |\!| {noop~\alpha} \rangle = \langle {\mathrm{zero}} |\!| {\alpha} \rangle\end{align*}

What remains is to show $\langle {\mathrm{succ} \, x} |\!| {noop~\alpha} \rangle = \langle {\mathrm{succ} \, x} |\!| {\alpha} \rangle$ from the inductive hypothesis (IH) $\langle {x} |\!| {noop~\alpha} \rangle = \langle {x} |\!| {\alpha} \rangle$ . We would like to put together the following equality:

The problem is that the induction hypothesis holds only for $\alpha$ , but we now need to apply it in a different context. This requires a generalization of the context:

Note that the $\omega\mathrm{Nat}$ rule can still be applied since quantifying over a strict property gives another strict property. Now we can instantiate the inductive hypothesis

$$\forall \alpha \div \mathrm{Nat} . \langle {x} |\!| { noop~\alpha } \rangle = \langle {x} |\!| {\alpha} \rangle$$

to the new context $\beta$ : $ \langle {x} |\!| { noop~\beta } \rangle = \langle {x} |\!| {\beta} \rangle$ .

The need to generalize over the context does not show up when one does inductive proofs in $\lambda$ -calculus since the context is left implicit. In fact, let’s go back to the proof of Example Theorem 2.1. Notice how we applied the inductive hypothesis not at the top level, which we can represent as $\Box$ , but in the bigger context $\mathrm{succ} \, \Box$ . The inductive hypothesis should be better expressed as $\forall C[\Box], C[plus~x'~{\mathrm{zero}}]=C[x']$ .

Analogously, we can also prove the following “shallow” extensionality property $\eta{\mathrm{Nat}}$ that just look at the outermost structure of a numeric value or a stream projection:

Remark 3.4 Note that the property $\forall \alpha. \langle {x} |\!| { noop~\alpha} \rangle = \langle {x} |\!| {\alpha} \rangle$ is strict in x, since the recursor is a co-value in both call-by-value and call-by-name. If we remove that restriction and apply induction on an arbitrary proposition $\Phi$ , we can derive inconsistent equations under call-by-name because it can equate any coterm $e \div \mathrm{Nat}$ with a rec covalue, whether or not e itself is a covalue. For example, we would be able to prove this property:

The call-by-name version of the derived SubstL rule, see Equations (3.1) and (3.2), allows for the call-by-name value $\mu{\rule{1ex}{0.5pt}}.\langle {\mathrm{succ}\, \mathrm{zero}} |\!| {\alpha} \rangle$ to be substituted for x in this equation, leading to the inconsistent equality $ \alpha {\div} \mathrm{Nat} \vdash \langle {\mathrm{succ}\, \mathrm{zero}} |\!| {\alpha} \rangle{=} \langle {\mathrm{zero}} |\!| {\alpha} \rangle ~ .$

The coinduction rule $\omega{\mathrm{Stream}}$ specifies a form of structural coinduction for streams. It works in exactly the same way as structural induction for numbers—just with the roles of values and covalues reversed. The $\omega{\mathrm{Stream}}$ rule summarizes this deduction for proving a property $\Psi$ over any stream projection $\alpha$ using an infinite number of premises:

This deduction is justified by the reasoning that the listed projections— $\mathrm{head} \, \beta$ , $\mathrm{tail}(\mathrm{head} \, \beta)$ , $\mathrm{tail}(\mathrm{tail}(\mathrm{head} \, \beta))$ —cover all the canonical covalues of $\mathrm{Stream} \, A$ ; testing $\Psi$ on all of them is sufficient to generalize $\Psi$ over any generic $\alpha$ of type $\mathrm{Stream} \, A$ . $\omega{\mathrm{Stream}}$ summarizes this kind of argument in a finite form, avoiding the list of separate proofs for each of the infinitely possible projections. Whereas $\omega{\mathrm{Nat}}$ corresponds to the usual induction axiom for the natural numbers, the $\omega{\mathrm{Stream}}$ rule corresponds to the dual form of the coinduction axiom for proving a property holds for all observations of infinite streams in both call-by-name and call-by-value:

Dual to induction on the numbers, we start with a proof for $\mathrm{head} \, \beta$ specifically, and give a transformation from a proof of $\Psi$ on an arbitrary observation on streams to the next proof of $\Psi$ for the same observation on the tail of the stream. As before, this transformation is represented by assuming $\Psi$ holds for a generic $\alpha \div \mathrm{Stream} \, A$ by listing it in the environment $\Gamma$ , which can then be used to derive a proof of $\Psi$ with $\alpha$ replaced by $\mathrm{tail} \, \, \alpha$ .

As an example of application of co-induction, we would like to prove the following deep extensional property of streams, which is the dual of $\delta_{\mathrm{Nat}}$ :

The above is saying that any generic stream xs gives the same response when its projections are broken down and rebuilt from scratch from the base case ( $\mathrm{head} \, \alpha$ ) up. We should be able to apply the rules from Figure 5 to prove it.

By using the shorthand $parrot ~xs := \mathrm{\textbf{corec}} \{ \mathrm{head} \, \alpha \to \mathrm{head} \, \alpha \mid \mathrm{tail} \, \, \alpha \to \gamma. \, \mathrm{tail} \, \, \gamma \} \mathrm{\textbf{with}} \, xs$ as in Example 3.2, the bottom of the derivation starts like this:

We begin by assuming some generic stream value $xs : \mathrm{Stream} \, A$ is in scope. The first step (from the bottom up) applies $\sigma\mu$ to generalize equality of terms to an equality of commands, by introducing a generic continuation $\alpha \div \mathrm{Stream} \, A$ expecting a stream. From here, we can apply the $\omega{\mathrm{Stream}}$ coinductive rule since we invoke $\alpha$ with a value. We continue with two proof obligations:

1. 1. Show $\langle {parrot~xs} |\!| {\mathrm{head} \, \beta} \rangle = \langle {xs} |\!| {\mathrm{head} \, \beta} \rangle $ .

2. 2. Show $\langle {parrot~xs} |\!| {\mathrm{tail} \, \, \alpha} \rangle = \langle {xs} |\!| {\mathrm{tail} \, \, \alpha} \rangle $ follows from the coinductive hypothesis (CIH) $\langle {parrot~xs} |\!| {\alpha} \rangle = \langle {xs} |\!| {\alpha} \rangle $ .

Step 1 follows directly from $\beta_{\mathrm{head}}$ , as shown in Example 3.2. Step 2 proceeds as follows:

\begin{align*} \langle {parrot~xs} |\!| {\mathrm{tail} \, \, \alpha} \rangle &= \langle {parrot~(\mathrm{tail} \, xs)} |\!| {\alpha} \rangle &(\beta_{\mathrm{tail}}\mu{\tilde{\mu}}) \\ &= \langle {\mathrm{tail} \, xs} |\!| {\alpha} \rangle &(CIH?) \\ &= \langle {xs} |\!| {\mathrm{tail} \, \, \alpha} \rangle &(\mu)\end{align*}

The coinductive hypothesis does not apply in the middle step, because it is already fixed for some previously-chosen xs, which is not the same as ( $\mathrm{tail} \, xs$ ) used here. What we need is the ability to generalize the coinductive hypothesis. Rather than introducing a generic stream xs first and then applying coinduction, we should apply coinduction to prove an equality holds for all choices of xs, as shown below:

The base case is as before. For the co-inductive case, we have the following calculation in call-by-value and -name:

Note that the generalization over xs in the coinductive hypothesis is essential for instantiating xs with the bound y newly introduced by $\beta_{\mathrm{tail}}$ reduction.

As we did for Nat, we can also derive the following “shallow” extensionality property that just look at the outermost structure of a stream projection:

Remark 3.5. The coinductive $\omega{\mathrm{Stream}}$ rule is similar in spirit to $\omega{\to}$ : it matches over the possible shapes of a generic covalue $\alpha \div \mathrm{Stream} \, A$ in scope. The problem is that in call-by-value there are more values than the ones we considered. If we relax the restriction of productivity and allow the application of the rule to a generic proposition $\Phi$ , we would then prove:

and yet the call-by-value version of the derived SubstR rule, see Equations (3.1) and (3.2), lets us substitute ${\tilde{\mu}}{\rule{1ex}{0.5pt}}.\langle {\mathrm{succ}\, \mathrm{zero}} |\!| {\alpha} \rangle$ as a covalue for $\beta$ , leading to an inconsistent equality:

3.3 Consistency of the extensional program logic

Ultimately, the program logic is not useful if it derives inconsistent results. One very simplistic version of consistency is that 0 is different from any successor (like 1); and dually, we should also know that a head projection is different from a tail projection.

As with most systems, equating 0 and 1 collapses the notion of equality. Assuming $\mathrm{zero} = \mathrm{succ}\, \mathrm{zero} : \mathrm{Nat}$ lets us prove that any two terms v and w of type A are equal by abstracting over the output $\alpha \div A$ in this derivation with $\sigma\mu$ :

This forces every $v = w : A$ to hold, which we can use to equate any two commands and any two coterms of the same type, as well. Likewise, equating the head and tail projections leads to the same collapse, due to a similar derivation. Assuming $\mathrm{head} \, \alpha = \mathrm{tail}(\mathrm{head} \, \alpha)$ , we can prove any two coterms e and f of type A are equal by abstracting over the input $x : A$ via $\sigma{\tilde{\mu}}$ in this derivation:

By restricting induction to only apply to strict properties, and restricting coinduction to only productive properties, we get a single extensional program logic (parameterized by the definition of values and covalues) that is consistent in both call-by-value and call-by-name evaluation. See Section 5 for the proof of consistency.

3.4 When is unrestricted (co)induction sound?

Common folklore says that induction holds only in call-by-value, and thus dually coinduction should hold only in call-by-name. This is reflected in part through the restrictions defining strict versus productive properties in the “universally” sound extensional program logic given in Figure 5. Call-by-value has a more permissive notion of covalue (any coterm is a call-by-value covalue), so the induction principle $\omega{\mathrm{Nat}}$ applies to more properties in the call-by-value logic than in the call-by-name one. Symmetrically, call-by-name has a more permissive notion of value (any term is a call-by-name value), so the coinduction principle $\omega{\mathrm{Stream}}$ applies to more properties in call-by-name than in call-by-value. In Figure 6, we give the unrestricted reasoning rules.

Fig. 6. Unrestricted coinduction rules $\sigma{\to}$ , $\sigma{\mathrm{Stream}}$ , and unrestricted induction rule $\sigma{\mathrm{Nat}}$ .

For non-recursive types like $A \to B$ the full power of $\sigma{\to}$ can be recovered from the weaker $\omega{\to}$ in the right setting. In call-by-name, the productivity restriction of $\omega{\to}$ is not important since any term can be a value, and we break down any property to apply $\omega{\to}$ at the root. However, this difference in power between (co)induction in the two semantics is not quite enough to account for the true strength of call-by-value induction and call-by-name coinduction because the strategy of breaking down the property in advance weakens the (co)inductive hypothesis. As a consequence, the fact that the sub-syntax of strict and productive properties includes $\forall$ quantifiers but not implications ( $\Phi' \Rightarrow \Phi$ ) of any form means that choosing the “best” semantics still does not fully restore $\omega{\mathrm{Nat}}$ to $\sigma{\mathrm{Nat}}$ or $\omega{\mathrm{Stream}}$ to $\sigma{\mathrm{Stream}}$ .

This essential difference in reasoning power raises the question: are the unrestricted induction and coinduction principles ever safe? Thankfully, it turns out that the full (co)induction rules $\sigma{\mathrm{Nat}}$ and $\sigma{\mathrm{Stream}}$ can be consistently added to the program logic, even in the presence of computational effects like first-class control, under the correct evaluation strategy (see Section 5).

5.1 Orthogonal relations and equality candidates

The safety model of Downen & Ariola (Reference Downen and Ariola2023, Section 6) is a logical relation built around the idea of orthogonality (Girard, Reference Girard1987; Pitts, Reference Pitts2000; Munch-Maccagnoni, Reference Munch-Maccagnoni2009): a safety predicate (written ) classifying when producers (v) and consumers (e) can safely interact with one another in a command (). Here we are interested in equality, in the sense that two commands have equivalent behavior when run. As such, we need to generalize orthogonality beyond the unary safety predicate on one command, and instead consider a binary equivalence relation between two commands.

We can now give our main definition of binary orthogonality serving in terms of the untyped weak equivalence among commands. Orthogonality, in turn, lets us describe a semantics for typed equality as a certain pair of relations between terms and coterms. This forms the potential (i.e., candidate Girard, Reference Girard1972) denotations of types, so each type of our language can be interpreted as a particular candidate of equality.

Definition 5.3 (Orthogonality).

The equivalence pole is the untyped equivalence relation on arbitrary commands ( $c \approx c'$ ) given in terms of weak equivalence of observable commands ( $d \sim d'$ ) from Definition 5.1:

Orthogonality of two binary relations $\mathbb{A}^+ \subseteq Term^2$ and $\mathbb{A}^- \subseteq CoTerm^2$ is defined asFootnote ⁴

We write to denote the largest coterm relation orthogonal to the term relation $\mathbb{A}^+$ , and symmetrically write to denote the largest term relation orthogonal to the coterm relation $\mathbb{A}^-$ , which are respectively defined as

Definition 5.4 (Candidates).

A pre-candidate is any pair $\mathbb{A}=(\mathbb{A}^+,\mathbb{A}^-)$ where $\mathbb{A}^+$ is a binary relation on terms, and $\mathbb{A}^-$ is a binary relation on coterms, i.e.,

A sound (pre-)candidate $\mathbb{A}=(\mathbb{A}^+,\mathbb{A}^-)$ satisfies the following soundness requirement:

• • Soundness: every combination of $\mathbb{A}^+$ -related terms $v ~\mathbb{A}^+~ v'$ and $\mathbb{A}^-$ -related coterms $e ~\mathbb{A}^-~ e'$ forms -equivalent commands .

A complete (pre-)candidate $\mathbb{A}=(\mathbb{A}^+,\mathbb{A}^-)$ satisfies these two completeness requirements:

• • Positive completeness: if for all $\mathbb{A}^-$ -related covalues $E ~\mathbb{A}^-~ E'$ , then $v ~\mathbb{A}^+~ v'$ are related by $\mathbb{A}^+$ .

• • Negative completeness: if for all $\mathbb{A}^+$ -related values $V ~\mathbb{A}^+~ V'$ , then $e ~\mathbb{A}^-~ e'$ are related by $\mathbb{A}^-$ .

An equality candidate is any sound and complete pre-candidate. ${\mathcal{PC}}$ denotes the set of all pre-candidates, ${\mathcal{SC}}$ denotes the set of sound ones, ${\mathcal{CC}}$ the set of complete ones, and ${\mathcal{EC}}$ denotes the set of all equality candidates.

As notation, given any pre-candidate $\mathbb{A}$ , we will always write $\mathbb{A}^+$ to denote the first component of $\mathbb{A}$ and $\mathbb{A}^-$ to denote the second one, so that $\mathbb{A} = (\mathbb{A}^+, \mathbb{A}^-)$ . Given a binary relation on terms $\mathbb{A}^+$ , we will occasionally write the sound candidate $(\mathbb{A}^+,\{\})$ as just $\mathbb{A}^+$ when the difference is clear from the context (notice that $(\mathbb{A}^+,\{\})$ is trivially sound by definition, but is incomplete). Likewise, we will occasionally write the sound candidate $(\{\},\mathbb{A}^-)$ as just the binary coterm relation $\mathbb{A}^-$ when unambiguous. The common case of the empty set $\{\}$ —which could be read as either the empty set of terms or the empty set of coterms—denotes the same sound candidate $(\{\},\{\})$ according to either reading.

5.2 Dual lattices and completion

With its two halves—one describing terms the other coterms—candidates provide multiple views on the relationship between types. These appear in the unary case of typed (co)terms, as in Downen & Ariola (Reference Downen and Ariola2023, Definition 6.5), and carry over, essentially unchanged, to binary relationships, too. In particular, the set of candidates supports two separate, but complementary, lattice structures with different orderings; one based on a refinement notion of plain containment and the other based on a notion of subtyping from programming languages.

Definition 5.5 (Refinement and Subtyping).

There are two ways of ordering pre-candidates: refinement (denoted by $\mathbb{A} \sqsubseteq \mathbb{B}$ meaning “ $\mathbb{A}$ refines $\mathbb{B}$ ” and “ $\mathbb{B}$ extends $\mathbb{A}$ ) and subtyping (denoted by $\mathbb{A} \leq \mathbb{B}$ meaning “ $\mathbb{A}$ is a subtype of $\mathbb{B}$ ” and “ $\mathbb{B}$ is a supertype of $\mathbb{A}$ ”), defined as:

Refinement and subtyping both define a complete lattice on pre-candidates with the following unions and intersections for refinement ( $\sqcup, \sqcap$ ) and subtyping ( $\vee, \wedge$ ), defined over any set of pre-candidates $\{\mathbb{A}_i\}_i \subseteq {\mathcal{PC}}$ as:

where $\bigcup$ and $\bigcap$ denote the union and intersection of binary relations, respectively.

There are many other ways in which refinement and subtyping differ from one another, and reveal different structures of equality candidates. Of note, the orthogonality operation distributes over the two orderings in completely opposite directions.

Furthermore, the way the union and intersection operations in the two lattices preserve (or fail to preserve) soundness and completeness conditions also differ.

In order to build the interpretation of (co)inductive types, we need a complete lattice of equality candidates, not just a lattice of pre-candidates, that preserves both soundness and completeness. Since subtyping naturally gives us a complete sub-lattice of sound candidates, we will begin there, with the subgoal of filling in the missing parts of a sound candidate to generate the fully completed equality candidate.

Beginning with some initial starting point, completeness demands that we include all other relationships which are compatible with what is already there. Since completeness only tests potential (co)term relations w.r.t the (co)values already related by a candidate, we will have to isolate these (co)values as part of our testing criteria. For this purpose, the (co)value restriction $\mathbb{A}^v$ of a candidate $\mathbb{A} = (\mathbb{A}^+, \mathbb{A}^-)$ includes only those values and covalues related by $\mathbb{A}$ , defined as

We can use this (co)value restriction to form a complete equality candidate by interleaving it with the orthogonality operation. But there is a dual choice in our starting point: the positive viewpoint uses the values related by $\mathbb{A}$ as the defining axioms to define the equality candidate, and the negative viewpoint uses the covalues related by $\mathbb{A}$ as the defining axioms.

Definition 5.8 (Positive and Negative Candidates).

Given a sound candidate $\mathbb{A}$ , the positive and negative constructions of equality candidates around $\mathbb{A}$ are, respectively, defined as

The positive and negative viewpoints give complementary equality candidates. By starting with the values first, Pos gives a smaller equality candidate (w.r.t subtyping) compared to Neg. In fact, these two are the canonically largest and smallest equality candidates that extend any sound starting point. This fact lets us modify the subtyping lattice to preserve both soundness and completeness in both directions.

Lemma 5.9 (Positive & Negative Completion).

For any sound candidate $\mathbb{A}$ , $\mathrm{Pos}(\mathbb{A})$ is the smallest sound and complete extension of $\mathbb{A}^v$ w.r.t subtyping, and $\mathrm{Neg}(\mathbb{A})$ is the largest sound and complete extension of $\mathbb{A}^v$ w.r.t subtyping. In other words, both $\mathrm{Pos}(\mathbb{A})$ and $\mathrm{Neg}(\mathbb{A})$ are equality candidates such that $\mathrm{Pos}(\mathbb{A}) \sqsupseteq \mathbb{A}^v$ and $\mathrm{Neg}(\mathbb{A}) \sqsupseteq \mathbb{A}^v$ , and given any other equality candidate $\mathbb{C} \sqsupseteq \mathbb{A}^v$ ,

Proof sketch The proof follows the same structure as in Downen & Ariola (Reference Downen and Ariola2023, Lemma 6.7) extended from sets to binary relations, which uses the facts that $\mathrm{Pos}(\mathbb{A})$ and $\mathrm{Neg}(\mathbb{A})$ are fixed points of and, furthermore, that the set of these fixed points is exactly the set of all equality candidates (Downen et al., Reference Downen, Johnson-Freyd and Ariola2020, Property 9).

Definition 5.10 (Equality Candidate Lattice).

Equality candidates form a complete lattice w.r.t subtyping whose unions ( $\curlyvee$ ) and intersections ( $\curlywedge$ ) are (Downen et al., Reference Downen, Ariola and Ghilezan2019):

Notice that the least equality candidate w.r.t subtyping is

and the greatest one is

From this perspective, we can re-describe the positive and negative completions in terms of the subtyping lattice of equality candidates. As per Lemmas 5.9 and 5.9, Pos and Neg are the intersection and union (respectively) of all extensions of a restricted sound candidate $\mathbb{A}^v$ :

As a corollary of Lemmas 5.9 and 5.9 and the definition of Pos and Neg, we get the following facts that let us reason about positively and negatively constructed equality candidates.

5.3 Interpretation of types and properties

We now have enough infrastructure to define the model of observational equivalence—as shown in Figure 7—by interpreting each syntactic entity (types, properties, environments, and judgements) into its semantic counterpart.

Fig. 7. Model of observational equivalence in the abstract machine.

Each syntactic type A is interpreted as an equality candidate, denoted by $[\![{A}]\!]$ , which is defined by induction on the syntax of A. This interpretation has three main cases—one for each type constructor—which are all defined in the style of Knaster-Tarski (Knaster, Reference Knaster1928; Tarski, Reference Tarski1955) fixed points in the subtyping lattice of equality candidates:

• • A function type $A \to B$ is interpreted as the equality candidate relating the fewest covalues possible, while still relating any two call stacks built from $[\![{A}]\!]$ -related arguments and $[\![{B}]\!]$ -related return continuations. Dually, this is the equality candidate relating the most values possible, as long as they have equivalent behavior when observed by those previously described related call stacks.

• • The number type Nat is interpreted as the equality candidate relating the fewest terms possible, while still relating 0 to itself, and ensuring that the successors of any two related values are still related. Dually, this is the equality candidate relating the most covalues possible, as long as they respond the same to any of those related numbers.

• • A stream type $\mathrm{Stream} \, A$ is interpreted as the equality candidate relating the fewest covalues possible, while still relating any two head projections with $[\![{A}]\!]$ -related continuations, and ensuring that the tail of any two related $\mathrm{Stream} \, A$ projection are still related. Dually, this equality candidate relates the most terms possible, as long as they have equivalent behavior when observed by those related stream projections.

Each typing environment $\Gamma$ is interpreted as a binary relation on substitutions, $[\![{\Gamma}]\!]$ , both of which replace some variables with values, and some covariables with covalues. The interpretation of $\Gamma$ (written $\rho ~[\![{\Gamma}]\!]~ \rho'$ ) relates two such substitutions $\rho$ and $\rho'$ that abide by all three of the following criteria:

• • For each variable x of type A in the environment $\Gamma$ , both $\rho$ and $\rho'$ must substitute some value for x (call them $x[{\rho}]=V$ and $x[{\rho'}]=V'$ , respectively), such that V and V’ are related by the interpretation of A.

• • For each covariable x of type A in the environment $\Gamma$ , both $\rho$ and $\rho'$ must substitute some covalue for $\alpha$ (call them $\alpha[{\rho}]=E$ and $\alpha[{\rho'}]=E'$ , respectively) such that E and E’ are related by the interpretation of A.

• • For each property $\Phi$ assumed in the environment $\Gamma$ , the interpretation of $\Phi$ must be true when given both $\rho$ and $\rho'$ . Or in other words, $\Phi$ must relate $\rho$ and $\rho'$ .

Singular syntactic properties $\Phi$ —as well as collections of hypotheses $\Delta$ —are interpreted as a binary predicate deciding whether or not that property holds under a given pair of substitutions. This is equivalent to interpreting $\Phi$ or $\Delta$ as a binary relation on substitutions, just like we did for typing environments, that identifies which substitutions make the property true. The interpretation of these properties as relations comes in three different flavors, which correspond to the three different roles served by each specific $\Phi$ :

• • Equalities: There are three different forms of equalities. Two commands are considered equal under a pair of substitutions when they are -related after applying the left substitution to the left command and the right substitution to the right command. Similarly, two (co)terms are considered equal at a type A under a pair of substitutions when applying those substitutions leads to $[\![{A}]\!]$ -related (co)terms.

• • Quantifiers: Universal quantifiers signify that a property holds under any possible extension allowed by the type of the quantified (co)variable. Universal quantification over a variable, $\forall x{:}A. \Phi$ , relates two substitutions when $\Phi$ does, after extending the substitutions with any pair $[\![{A}]\!]$ -related values for x. Universal quantification over a covariable is defined in the same way.

• • Logical connectives: The logical connectives of implication ( $\Phi \Rightarrow \Phi'$ ) and conjunction ( $\Phi \wedge \Phi'$ ) are interpreted directly for each pair of substitutions. Equivalently, we can say that $[\![{\Phi \wedge \Phi'}]\!]$ means $[\![{\Phi}]\!] \cap [\![{\Phi'}]\!]$ using the intersection of relations ( $\cap$ ) that we’ve used previously, and $[\![{\Phi \Rightarrow \Phi'}]\!]$ means $[\![{\Phi}]\!] \implies [\![{\Phi'}]\!]$ where ( $\implies$ ) denotes the implication of relations.

Speaking more broadly, we can generalize the universal quantification and environment extension from Figure 7 to range over pre-candidates that lie outside the syntactic type system. This generality will be needed as we simplify away the extraneous elements of a type that we don’t need to consider while proving a property. For any pre-candidate $\mathbb{A}$ and binary substitution relations $\gamma$ and $\phi$ , the two universal quantifiers and environment extensions are:

Last but not least are judgements of the form $\Gamma \mid \Delta \vdash \Phi$ , which are interpreted as just true or false statements. The syntactic entailment $\vdash$ is interpreted as the boolean test for relational implication $\subseteq$ , so that $[\![{\Gamma \mid \Delta \vdash \Phi}]\!]$ whenever the environment $[\![{\Gamma}]\!]$ combined with the constraints in $[\![{\Delta}]\!]$ implies the property $[\![{\Phi}]\!]$ . In other words, we can understand $[\![{\Gamma \mid \Delta \vdash \Phi}]\!]$ pointwise as the equivalent statement

that $\rho~[\![{\Phi}]\!]~\rho'$ holds for all possible substitutions $\rho~[\![{\Gamma}]\!]~\rho'$ given by the typing environment and satisfying the pre-condition $\rho~[\![{\Delta}]\!]~\rho'$ . This implicational interpretation of entailment gives rise to some useful structure to reason about the semantics of judgements.

Property 5.14. For any pre-candidate $\mathbb{A}$ and binary substitution relations $\gamma$ , $\phi$ , and $\phi'$ :

Furthermore, for any related $\rho ~\gamma~ \rho'$ , we have related extensions $\rho[{{V}/{x}}]~(\gamma,x:\mathbb{A})~\rho[{{V'}/{x}}]$ for all $V ~\mathbb{A}~ V'$ , and $\rho[{{E}/{\alpha}}]~(\gamma,\alpha:\mathbb{A})~\rho[{{E'}/{\alpha}}]$ for all $E ~\mathbb{A}~ E'$ .

5.4 Universal consistency of weak (co)induction

We now turn to justifying inductive and coinductive reasoning in terms of the above model. One key component is that (co)induction seeks to reason about a type by only considering the concrete structures of a type. For an inductive type like Nat, that means we want to consider only the zero and succ cases of values, and ignore the rest. Dually for coinductive types like $\mathrm{Stream} \, A$ and $A \to B$ , we want to consider only the head and tail cases of stream covalues and only the stack $V \cdot E$ cases for function covalues.

The first step in this direction is to notice that certain universal properties need to consider fewer cases for positively and negatively complete equality candidates. A strict property on x holds for all related values of $\mathrm{Pos}(\mathbb{A})$ exactly when it holds on only the values related by $\mathbb{A}$ . Dually, a productive property on $\alpha$ holds for all related covalues of $\mathrm{Neg}(\mathbb{A})$ exactly when it holds on only the covalues related by $\mathbb{A}$ . Note that this fact does not depend on the evaluation strategy of the language, but is instead ensured by the strictness or productivity of the underlying property.

Proof We use Property 5.14 to prove $\gamma, x:\mathbb{A} \subseteq [\![{\Psi(x)}]\!]$ and $\gamma, x:\mathrm{Pos}(\mathbb{A}) \subseteq [\![{\Psi(x)}]\!]$ are equivalent statements generically for all $\gamma$ by induction on the syntax of $\Psi(x)$ :

• • $\langle {x} |\!| {E} \rangle = \langle {x} |\!| {E'} \rangle $ where x is not free in E or E’. First, note that $\mathbb{A} \sqsubseteq \mathrm{Pos}(\mathbb{A})$ , so that $ \forall x{:}{\mathrm{Pos}(\mathbb{A})}. [\![{\langle {x} |\!| {E} \rangle=\langle {x} |\!| {E'} \rangle}]\!] $ implies $ \forall x{:}\mathbb{A}. [\![{\langle {x} |\!| {E} \rangle=\langle {x} |\!| {E'} \rangle}]\!] $ via this inclusion. Furthermore, $ \forall x{:}\mathbb{A}. [\![{\langle {x} |\!| {E} \rangle=\langle {x} |\!| {E'} \rangle}]\!] $ means

  
  for all $V ~\mathbb{A}~ V'$ (since $E[{{V}/{x}}]=E$ and $E'[{{V'}/{x}}]=E'$ ), and thus by the definition of orthogonality. Therefore, $E ~\mathrm{Pos}(\mathbb{A})~ E'$ by Property 5.12, and thus
  
  for any $V ~\mathrm{Pos}(\mathbb{A})~ V'$ , which means $\forall x{:}{\mathrm{Pos}(\mathbb{A})}. [\![{\langle {x} |\!| {E} \rangle=\langle {x} |\!| {E'} \rangle}]\!]$ . In other words,
  
  are equivalent substitution relations, and thus more generally
  

• • $\forall y{:}B. \Psi(x)$ where $y \neq x$ . Applying Property 5.14:

  

• • $\forall \alpha{\div}B. \Psi(x)$ . Follows by permuting the bindings of x and $\alpha$ and applying the inductive hypothesis to $\gamma$ extended with $\alpha \div [\![{B}]\!]$ analogously to the previous case.

• • $\Phi \Rightarrow \Psi(x)$ where x is not free in $\Phi$ . Applying Property 5.14:

  

• • $\Psi_1(x) \wedge \Psi_2(x)$ . Note that $[\![{\Psi_1(x) \wedge \Psi_2(x)}]\!] = [\![{\Psi_1(x)}]\!] \cap [\![{\Psi_2(x)}]\!]$ so

  

The “if” direction for property 2 follows analogously to the above using Property 5.12 for $\mathrm{Neg}(\mathbb{A})$ in the base case of an equality $\langle {V} |\!| {\alpha} \rangle = \langle {V'} |\!| {\alpha} \rangle $ .

Lemma 5.15 is enough to prove the extensional rule $\omega{\to}$ for function types, since the interpretation $[\![{A \to B}]\!]$ corresponds exactly to a negatively-constructed type. As the largest equality candidate which relates call stacks built from related parts, we can isolate these call stacks as a negative type.

Property 5.16 (Negative Functions).

$[\![{A \to B}]\!] = \mathrm{Neg}({[\![{A}]\!]}\odot{[\![{B}]\!]})$ where ${\mathbb{A}}\odot{\mathbb{B}}$ is the least relation on covalues such that:

Given $\alpha, \beta, x \notin FV(\Delta)$ , $[\![{\Gamma, \alpha \div A \to B \mid \Delta \vdash \Psi(\alpha)}]\!]$ if and only if $[\![{\Gamma, x : A, \beta \div B \mid \Delta \vdash \Psi(x \cdot \beta)}]\!]$ .

Proof By viewing $[\![{A \to B}]\!]$ in terms core call-stack relation ${[\![{A}]\!]}\odot{[\![{B}]\!]}$ (Property 5.16), and using the fact that $\alpha \notin FV(\Delta)$ to commute the hypothesis with the binding (Property 5.14),

we learn from Lemma 5.15 that the quantification over $\alpha \div \mathrm{Neg}({[\![{A}]\!]}\odot{[\![{B}]\!]})$ is equivalent to the same quantification over call stacks:

We can perform a similar inversion on the (co)inductive types, although not all at once. Rather, this bottom-up redefinition of natural numbers and streams must work incrementally. Beginning with the most extreme starting point (the least equality candidate $\mathrm{Pos}\{\}$ for inductive numbers and the greatest equality candidate $\mathrm{Neg}\{\}$ for coinductive streams), we iteratively build toward the final answer one step at a time. For the natural numbers, we use these interpretations of the zero and succ constructors as relations between values built by those constructors

\begin{align*} \mathrm{zero} ~[\![{\mathrm{zero}}]\!]~ \mathrm{zero} &:= \text{trivially true} & (\mathrm{succ} \, V) ~[\![{\mathrm{succ}}]\!](\mathbb{A})~ (\mathrm{succ} \, V') &:= V ~\mathbb{A}~ V'\end{align*}

in order to define larger and larger approximations of the $[\![{\mathrm{Nat}}]\!]$ equality candidate:

\begin{align*} [\![{\mathrm{Nat}}]\!]_0 &:= \mathrm{Pos}\{\} & [\![{\mathrm{Nat}}]\!]_{i+1} &:= \mathrm{Pos}([\![{\mathrm{zero}}]\!] \vee [\![{\mathrm{succ}}]\!]([\![{\mathrm{Nat}}]\!]_i))\end{align*}

At the limit, the union of all under-approximations is the Kleene-style fixed point definition (Kleene, Reference Kleene1971) of natural numbers. Thankfully, the dual construction of coinductive streams can be done in exactly the same way, just working from the other direction of the subtyping lattice. With these interpretations of the head and tail projections as relations between covalues built by those destructors

\begin{align*} (\mathrm{head} \, E) ~[\![{\mathrm{head}}]\!](\mathbb{A})~ (\mathrm{head} \, E') &:= E ~\mathbb{A}~ E' & (\mathrm{tail} \, E) ~[\![{\mathrm{tail}}]\!](\mathbb{A})~ (\mathrm{tail} \, E') &:= E ~\mathbb{A}~ E'\end{align*}

we can define smaller and smaller approximations of $[\![{\mathrm{Stream} \, A}]\!]$ :

\begin{align*} [\![{\mathrm{Stream} \, A}]\!]_0 &:= \mathrm{Neg}\{\} & [\![{\mathrm{Stream} \, A}]\!]_{i+1} &:= \mathrm{Neg}([\![{\mathrm{head}}]\!]([\![{A}]\!]) \wedge [\![{\mathrm{tail}}]\!]([\![{\mathrm{Stream} \, A}]\!]_i))\end{align*}

Here, the intersection of over-approximations is the dual Kleene-style fixed point definition of streams. These incremental fixed points define the same equality candidate as the Tarski-style fixed points from Figure 7.

Lemma 5.18 (Positive Numbers & Negative Streams).

Under both call-by-value and call-by-name evaluation,

Proof sketch Generalizing the proof from Downen & Ariola (Reference Downen and Ariola2023, Lemma 6.13) from sets to binary relations requires the analogous facts (Downen & Ariola, Reference Downen and Ariola2023, Lemmas 1.19 and 1.22) that

The key to demonstrating that these two instances of unions of numbers and intersections of streams are equal is in showing that we can fully observe a constructed number or a stream projection of any size.

For numbers, notice relates the following instance of the recursor to itself:

Then, given any , we can use the fact that to trace the reductions of the commands and show that $V ~[\![{\mathrm{Nat}}]\!]_i V'$ for some $i\textrm{th}$ finite approximation.

Streams follow a similar logic. Notice that relates this stream to itself for any $V ~[\![{A}]\!]~ V'$ :

Then, given any $V ~[\![{A}]\!]~ V'$ and , we can use the fact that to trace the reductions of the commands and show that $E ~[\![{\mathrm{Stream} \, A}]\!]_i E'$ for some $i\textrm{th}$ finite approximation.

It follows that these provide another definition of the least equality candidate closed under zero and succ, and the greatest equality candidate closed under head and tail, respectively. Since there can be only one least/greatest equality candidate satisfying the same closure condition, they must be the same as the ones in Figure 7.

The incremental nature of the Kleene-style redefinitions makes it easy to reason (co)inductively over the $i\textrm{th}$ approximation steps. This way, we can show that the premises to the (co)inductive inference rules $\omega{\mathrm{Nat}}$ and $\omega{\mathrm{Stream}}$ are interpreted as equivalent statements to their conclusions.

For the “if” direction, assume $[\![{\Gamma \mid \Delta \vdash \Psi(\mathrm{zero})}]\!]$ and $[\![{\Gamma, x : \mathrm{Nat} \mid \Delta, \Psi(x) \vdash \Psi(\mathrm{succ} \, x)}]\!]$ hold, and we will show that $[\![{\Gamma, x : \mathrm{Nat} \mid \Delta \vdash \Psi(x)}]\!]$ holds, too. From Property 5.14 and Lemmas 5.15 and 5.18, it suffices to show that the following equivalent proposition holds:

Let $\gamma = [\![{\Gamma}]\!] \cap [\![{\Delta}]\!]$ , and we can now proceed by proving each individual approximation $ \gamma, x : [\![{\mathrm{Nat}}]\!]_i \subseteq [\![{\Psi(x)}]\!] $ by induction on i.

• • (Base case: 0) $[\![{\mathrm{Nat}}]\!]_0=\mathrm{Pos}\{\}$ , so we must show $\gamma, x : \mathrm{Pos}\{\} \subseteq [\![{\Psi(x)}]\!]$ . By Lemma 5.15, this statement is equivalent to $\gamma, x : \{\} \subseteq [\![{\Psi(x)}]\!]$ , which is vacuously true since there are no possible choices for x in the empty pre-candidate $\{\}$ .

• • (Inductive case: $i+1$ ) $[\![{\mathrm{Nat}}]\!]_i=\mathrm{Pos}([\![{\mathrm{zero}}]\!]\vee[\![{\mathrm{succ}}]\!]([\![{\mathrm{Nat}}]\!]_i))$ . By Lemma 5.15, these statements

  \begin{align*} & \gamma, x : [\![{\mathrm{Nat}}]\!]_{i+1} \subseteq [\![{\Psi(x)}]\!] \\ &= \gamma, x : \mathrm{Pos}([\![{\mathrm{zero}}]\!]\vee[\![{\mathrm{succ}}]\!]([\![{\mathrm{Nat}}]\!]_i)) \subseteq [\![{\Psi(x)}]\!] \\ &= \gamma, x : [\![{\mathrm{zero}}]\!]\vee[\![{\mathrm{succ}}]\!]([\![{\mathrm{Nat}}]\!]_i) \subseteq [\![{\Psi(x)}]\!] \\ &= (\gamma, x : [\![{\mathrm{zero}}]\!] \subseteq [\![{\Psi(x)}]\!]) \mathbin{\mathrm{and}} (\gamma, x : \mathrm{succ}([\![{\mathrm{Nat}}]\!]_i) \subseteq [\![{\Psi(x)}]\!]) \end{align*}
  are equivalent, and we must show that they hold. Since $\mathrm{zero}~[\![{\mathrm{zero}}]\!]~\mathrm{zero}$ is the only related values of $[\![{\mathrm{zero}}]\!]$ , the assumption $[\![{\Gamma \mid \Delta \vdash \Psi(\mathrm{zero})}]\!]$ is equivalent to $\gamma, x : [\![{\mathrm{zero}}]\!] \subseteq [\![{\Psi(x)}]\!]$ . Similarly, $(\mathrm{succ} \, V)~[\![{\mathrm{succ}}]\!]([\![{\mathrm{Nat}}]\!]_i)~(\mathrm{succ} \, V')$ are the only related values of $[\![{\mathrm{succ}}]\!]([\![{\mathrm{Nat}}]\!]_i)$ for any $V~[\![{\mathrm{Nat}}]\!]_i~V'$ . By the inductive hypothesis, we know $\gamma, x : [\![{\mathrm{Nat}}]\!]_i \subseteq [\![{\Phi(x)}]\!]$ . Because $[\![{\mathrm{Nat}}]\!]_i \leq [\![{\mathrm{Nat}}]\!]$ , the assumption $[\![{\Gamma, x:\mathrm{Nat} \mid \Delta, \Phi(x) \vdash \Phi(\mathrm{succ} \, x)}]\!]$ implies $ ([\![{\Gamma}]\!], x : [\![{\mathrm{Nat}}]\!]_i) \cap \Delta \subseteq [\![{\Phi(\mathrm{succ} \, x)}]\!] $ which is equivalent to $ \gamma, x : [\![{\mathrm{succ}}]\!]([\![{\mathrm{Nat}}]\!]_i) \subseteq [\![{\Phi(x)}]\!] . $ Therefore, the equivalent statements
  \begin{align*} & (\gamma, x : [\![{\mathrm{zero}}]\!] \subseteq [\![{\Psi(x)}]\!]) \mathbin{\mathrm{and}} (\gamma, x : \mathrm{succ}([\![{\mathrm{Nat}}]\!]_i) \subseteq [\![{\Psi(x)}]\!]) \\ &= \gamma, x : [\![{\mathrm{Nat}}]\!]_{i+1} \subseteq [\![{\Psi(x)}]\!] \end{align*}
  hold.

So since $\gamma, x : [\![{\mathrm{Nat}}]\!]_i \subseteq [\![{\Psi(x)}]\!]$ holds for every i, so too does

\begin{align*} \gamma, x : \bigvee_{i=0}^\infty [\![{\mathrm{Nat}_i}]\!] \subseteq [\![{\Psi(x)}]\!] &= [\![{\Gamma, x : \mathrm{Nat} \mid \Delta \vdash \Psi (x)}]\!] \end{align*}

From this semantics of the main (co)inductive principles, we can prove soundness with respect to the model, analogous to Downen & Ariola (Reference Downen and Ariola2023), which in turn lets us derive the fact that the universal program logic is a consistent approximation of observational equivalence in both call-by-name and call-by-value evaluation.

Dually, both and by definition of . As a result, we have $\alpha ~[\![{\mathrm{Nat}}]\!]_i~ \alpha$ for all i: the case for $[\![{\mathrm{Nat}}]\!]_0 = \mathrm{Pos}\{\}$ is trivial since all covalues are related by $\mathrm{Pos}\{\}$ , and the case for $[\![{\mathrm{Nat}}]\!]_{i+1} = \mathrm{Pos}([\![{\mathrm{zero}}]\!]\vee[\![{\mathrm{succ}}]\!][\![{\mathrm{Nat}}]\!]_i)$ follows from the previously mentioned fact about and Property 5.12. Finally, by Property 5.13, and thus $\alpha ~[\![{\mathrm{Nat}}]\!]~ \alpha$ by Lemma 5.18.

The fact that $x ~[\![{\mathrm{Stream} \, A}]\!]~ x$ follows from Properties 5.12 and 5.13 and Lemma 5.18 similarly to the above, using the fact that and by definition of .

5.5 Strong call-by-value induction and call-by-name coinduction

In the general case, we need to interleave a (positive or negative) completion while building up a (co)inductive equality candidate like $[\![{\mathrm{Nat}}]\!]_i$ or $[\![{\mathrm{Stream} \, A}]\!]_i$ . But in the specific case where the evaluation strategy lines up nicely, we get a much simpler definition for call-by-value inductive types and call-by-name coinductive types.

To see that $n = n'$ , consider what happens if $n \neq n'$ , and suppose (without loss of generality) that $n < n'$ . Here is a family of well-typed covalues that peel off n successors:

So that, for any $m \leq m'$ , $\langle {\mathrm{succ}^{m'}\mathrm{zero}} |\!| {minus_{m}} \rangle \mathrel{\mapsto\!\!\!\!\to} \langle {\mathrm{succ}^{m'-m}\mathrm{zero}} |\!| {\alpha} \rangle$ . Note again that $\alpha\div\mathrm{Nat} \vdash minus_n \div \mathrm{Nat}$ is a well-typed covalue, so that it is equal to itself by reflexivity, and thus by adequacy (Theorem 5.21) and Lemma 5.22, $minus_n ~[\![{\mathrm{Nat}}]\!]~ minus_n$ . From soundness of $[\![{\mathrm{Nat}}]\!]$ , it follows that the following inconsistent equivalence holds

which contradicts the definition of $\sim$ . Therefore, $n = n'$ , and thus $V ~[\![{\mathrm{Nat}}]\!]~ V'$ if and only if $V = V' = \mathrm{succ}^n \mathrm{zero}$ exactly.

In other words, $\mathbb{N} = [\![{\mathrm{Nat}}]\!]^{v+}$ , and so $ \mathrm{Pos}(\mathbb{N}) = \mathrm{Pos}([\![{\mathrm{Nat}}]\!]^{v+}) = \mathrm{Pos}([\![{\mathrm{Nat}}]\!]) $ by Property 5.11, and $\mathrm{Pos}([\![{\mathrm{Nat}}]\!]) = [\![{\mathrm{Nat}}]\!]$ , because $[\![{\mathrm{Nat}}]\!]$ is already a complete equality candidate.

which derives an inconsistent equivalence $\langle {x} |\!| {\mathrm{head} \, \, E_0} \rangle \sim \langle {x} |\!| {\mathrm{tail} \, (\mathrm{tail}^{n'-n-1}(\mathrm{head} \, \, E_0'))} \rangle$ that contradicts the definition of . Therefore, $[\![{\mathrm{Stream} \, A}]\!] = \mathrm{Neg}(\mathbb{S}([\![{A}]\!]))$ .

These simpler definitions for $[\![{\mathrm{Nat}}]\!]$ and $[\![{\mathrm{Stream} \, A}]\!]$ make it possible to verify the stronger (co)inductive rules $\sigma{\mathrm{Nat}}$ and $\sigma{\mathrm{Stream}}$ , which do not place any restrictions on the kinds of properties they may prove.

Proof By Lemmas 5.15 and 5.24, the meaning of $[\![{\Gamma, x : \mathrm{Nat} \vdash \Phi}]\!]$ is equivalent to:

\begin{align*} [\![{\Gamma, x : \mathrm{Nat} \vdash \Phi}]\!] &= [\![{\Gamma}]\!], x : [\![{\mathrm{Nat}}]\!] \subseteq [\![{\Phi}]\!] \\ &= [\![{\Gamma}]\!], x : \mathrm{Pos}(\mathbb{N}) \subseteq [\![{\Phi}]\!] \\ &= [\![{\Gamma}]\!], x : \mathbb{N} \subseteq [\![{\Phi}]\!] \end{align*}

Which can be proved equivalent to $[\![{\Gamma}]\!] \subseteq [\![{\Phi[{{\mathrm{zero}}/{x}}]}]\!]$ and $[\![{\Gamma}]\!], x : \mathbb{N} \subseteq [\![{\Phi[{{\mathrm{succ} \, x}/{x}}]}]\!]$ by an ordinary induction on the numeric constructions in $\mathbb{N}$ .