Lectures onType Theory
Chapter 160
Chapter 160Optional

Modal and Multimodal Dependent Type Theory

Prerequisites. Direct starred prerequisites: none. Chapter 54 supplies the CwF interface, chapter 55, chapter 152 the first models, and chapter 56 the strictification used to build them. No later core chapter depends on this route.

Suppose a value is available only later, and that a proof about it must be carried out now. Write A for the type of the value and let A be the type of a value available later. Two operations are wanted: from a proof of A carried out in the later world, a proof of A now; and from A now, access to A in the later world. The difficulty is that “the later world” is not a type, and not a stage of a computation either. It is a change in the mode of the judgment: the context under which one reasons is different, and the variables usable there are not the variables usable here.

It is tempting to reach for the staged calculi of chapter 129, where A is the type of code and quotation crosses a boundary. That is a different mechanism, and the difference is visible in one rule. Cross-stage persistence lets a present value be used inside a quotation; the value is transported and later executed. A judgment-mode change makes no such promise: there is no execution and nothing is transported. A modality may admit no persistence at all, and a mode may have no code to run. What is shared is only the shape of the syntax, and a shared glyph is not a translation.

The construction below therefore starts from the context, not from the type.

Locks in a simply typed calculus

Definition 160.1 — The Fitch-style calculus

Types are A,B::=bABA. Contexts are generated by Γ ::=   Γ,x:A  Γ.L, where Γ.L is Γ locked. Typing is given by the ordinary rules for variables, abstraction and application — with the variable rule requiring that no lock occur to the right of the declaration — together with

Γ.Lt:A
Γboxt:A
Box-I
Γt:A
Γ.Lunboxt:A
Box-E

and the equations unbox(boxt)=t and box(unboxt)=t.

The variable rule is the whole discipline: a lock is a barrier, and a variable declared before a lock is not usable after it. The type A is what the barrier leaves behind.

Lemma 160.2 — Weakening and substitution

Define ΓΔ when Δ is obtained from Γ by inserting declarations, at positions not separated from the end by a lock that Γ does not have. Then Γt:A and ΓΔ imply Δt:A; and if Γ,x:A,Γt:B and Γu:A with Γ lock-free, then Γ,Γt[u/x]:B.

Proof of Lemma 160.2 — Weakening and substitution

Proof. Both by induction on the typing derivation. For weakening the only interesting case is Box-E: the conclusion is at Δ.L and the premise at Δ, and ΓΔ gives the premise by the induction hypothesis. For substitution the hypothesis that Γ is lock-free is used exactly once, in the variable case: if Γ contained a lock, x would not be usable at the leaf and the substitution would be vacuous, but the statement of the lemma would then be about a different context. In the Box-I case the premise is at (Γ,x:A,Γ).L, where x is unusable, so nothing is substituted and the induction hypothesis is applied trivially. ◻

Proposition 160.3 — Normalization by evaluation, one calculation

Interpret a context by a semantic environment indexed by the number of trailing locks, a type A by the semantics of A one lock deeper, and reify at A by box. Then every term has a normal form, and for t:=λx.box(unboxx) at type bb the algorithm returns λx.x.

Proof of Proposition 160.3 — Normalization by evaluation, one calculation

Proof. Evaluation sends x to the semantic value in the environment; the clause for unbox moves one lock inward and the clause for box moves one lock outward, so the composite is the identity on semantic values. Reification at b emits box and recurses; at the base type it emits the accumulated neutral, which for the displayed term is the variable. Hence the normal form is λx.x, which is the η-equation of definition 160.1 read as a computation. Existence of normal forms in general is the usual logical-relations argument for normalization by evaluation, carried out over contexts indexed by lock depth. ◻

Remark 160.4 — What this calculus does not donate

Proposition 160.3 is a theorem about a simply typed calculus with one modality. It introduces the lock mechanism and nothing else: it supplies no dependent judgment, no substitution calculus for dependent contexts, and no normalization statement for any of the systems below. The mechanized development that accompanies the source checks exactly this simply typed statement.

The dependent calculus and its models

Definition 160.5 — The dependent lock calculus

Extend the substitution calculus of definition 54.2 by a context former Γ.L, by the rules

Γ.LA type
ΓA type
DBox-F
Γ.Lt:A
Γboxt:A
DBox-I
Γt:A
Γ.Lunboxt:A
DBox-E

and the equations unbox(boxt)=t, box(unboxt)=t, together with the substitution laws (A)[γ]=(A[γ.L]) and (boxt)[γ]=box(t[γ.L]), where γ.L is the action of the lock on substitutions.

Definition 160.6 — CwF with a dependent right adjoint

A CwDRA is a CwF C (definition 54.16) together with

  1. a functor L:CC on the category of contexts;

  2. for each Γ an operation RΓ:Ty(LΓ)Ty(Γ);

  3. for each Γ and ATy(LΓ) a bijection Tm(LΓ,A)  Tm(Γ,RΓA),

all natural in Γ: for γ:ΔΓ, RΔ(A[Lγ])=RΓA[γ] and the bijections commute with reindexing.

Theorem 160.7 — Soundness at the exact signature

Every CwDRA interprets definition 160.5: contexts, types, terms and substitutions as in theorem 54.28, with [[Γ.L]]:=L[[Γ]], [[A]]:=R([[A]]), [[boxt]] the image of [[t]] under the bijection and [[unboxt]] its inverse. Conversely the syntax of definition 160.5, quotiented by judgmental equality, is a CwDRA, and it is initial among them.

Proof of Theorem 160.7 — Soundness at the exact signature

Proof. Soundness. DBox-F is clause (2), DBox-I and DBox-E are the two directions of clause (3), and their two equations are that the bijection is a bijection. The substitution laws of definition 160.5 are exactly the naturality requirements of definition 160.6: without them the interpretation of a substituted modal type would depend on the order of the two operations. The remaining rules are theorem 54.28.

Term model and initiality. The syntactic CwF of theorem 54.27 acquires L from the context former, which is functorial because γ.L is defined by recursion and preserves identities and composites; R from ; and the bijection from box and unbox, which are mutually inverse by the two equations. Naturality is the two substitution laws. Initiality is the argument of theorem 54.27 with two further clauses in the induction, one for each new former, each forced by the requirement that the interpretation be a morphism of CwDRAs. ◻

Example 160.8 — A dependent modal term

Let Γ.LA type and Γ.L.AB type. The derivable dependent distribution law is Γ dist : (a:AB)  u:A (B[id,unboxu]) , dist:=λf.λu.box((unboxf)(unboxu)). It is well typed because both occurrences of unbox sit under the single lock introduced by the outer box, where DBox-E makes them available; and the codomain must substitute unboxu into B because B depends on a variable of A, which exists only under that lock.

The naive variant with codomain u:AB is not even well formed: B is a type over Γ.L.A, so B requires a term of A in the context, and u:A is not one. The substitution is not a convenience; it is what makes the statement a statement.

Exercise 160.1

★☆☆ Show that x:Aboxx:A is not derivable in definition 160.1, and identify the side condition of the variable rule that blocks it. Then exhibit a context in which the analogous judgment is derivable.

Exercise 160.2

★★☆ Show that dropping the naturality requirement from definition 160.6 invalidates theorem 160.7: exhibit two derivations of the same judgment whose interpretations differ.

Two modes are needed

One modality suffices while the ambient judgment never changes. It stops sufficing as soon as two different kinds of judgment must coexist.

Example 160.9 — A situation with two modes

Let mode s be the mode of static data — values that exist now and may be inspected — and mode d the mode of dynamic data. There is an inclusion of static into dynamic, and a modality that records that a dynamic object was produced statically. A type at s is not a type at d; a context at one mode cannot be used at the other. With one modality on one mode this is inexpressible: the calculus of definition 160.5 has a single judgment form, so maps its types to its types and there is no second collection to map into.

Definition 160.10 — Mode theory

A mode theory M is a strict 2-category. Its objects m,n, are modes; its 1-cells μ:nm are modalities, composed by μν with identities 1m; its 2-cells α:μν are the transformations between modalities, with vertical and horizontal composition satisfying the interchange law strictly.

Definition 160.11 — Multimodal syntax

For each mode m there are judgments Γ ctxm, ΓmA type, Γmt:A and the four equalities, all at mode m. Contexts are generated by the empty context, by Γ.A, and, for each modality μ:nm, by the lock Γ ctxmΓ.Lμ ctxn, subject to Γ.L1=Γ and Γ.Lμν=(Γ.Lμ).Lν. A 2-cell α:μν induces a substitution Γ.LνΓ.Lμ, functorially in α. Variables are annotated: a declaration is x:μA, and the variable rule is

α:μlocks(Γ)
Γ.(x:μA),Γxα:A[]
MTT-Var

where locks(Γ) is the composite of the modalities of the locks occurring in Γ and the elided substitution is the induced one. The modal type former is, for μ:nm,

Γ.LμnA type
ΓmμA type
MTT-F
Γ.Lμnt:A
Γmmodμ(t):μA
MTT-I

with elimination by a modal let: from Γ.Lνs:μA and Γ.(x:νμA)u:C conclude Γlet modμ(x)=s in u:C[], with the β-rule substituting t for x.

Lemma 160.12 — Weakening and substitution, multimodally

Weakening is admissible, and if Γu:A and Γ.(x:μA),Γt:B then Γ,Γt[u/x]:B[u/x] provided the composite of the locks in Γ admits a 2-cell from μ.

Proof of Lemma 160.12 — Weakening and substitution, multimodally

Proof. Induction on the derivation of t. The only case that consults the annotation is MTT-Var: there the premise supplies α:μlocks(Γ), and the proviso is exactly that such an α exists, so the substituted term is u transported along the substitution induced by α. In the lock case the context grows by Lν and locks grows by ν, so the proviso is preserved by whiskering α. In MTT-I the premise is one lock deeper and the induction hypothesis applies with the whiskered 2-cell. Functoriality of the induced substitutions in α is what makes the two possible orders of transport agree. ◻

Theorem 160.13 — Canonicity for the frozen mode theory

Fix a mode theory M with a decidable equality on 2-cells, and freeze the signature of definition 160.11 together with Π-, Σ- and 2-types at each mode. Then every closed term of 2 at any mode is judgmentally equal to tt or to ff.

Proof of Theorem 160.13 — Canonicity for the frozen mode theory

Proof. Glue along the global-sections functor, as in construction 151.30, but with the displayed model indexed by modes: a displayed context over Γ at mode m is a predicate on the closing substitutions of Γ, and the clause for a lock is RΓ.Lμ(ρ)iffRΓ(ρ) for the closing substitution ρ determined by ρ, which is well defined because L is functorial in Γ and the lock equations of definition 160.11 are strict. The clause for μA is: SμA(ρ,t) holds iff t is judgmentally equal to modμ(t) for some t with SA holding at the locked context. Closure under MTT-I is immediate; closure under the modal let uses the β-rule together with the induction hypothesis at the locked context; and closure under MTT-Var uses the 2-cell α, whose induced substitution acts on the witnesses — here decidable equality of 2-cells is what makes the predicate a well-defined function of the annotation rather than of a chosen representative. The rest of the displayed model is lemma 151.31. Initiality supplies a section as in theorem 151.32, and instantiating it at a closed term of 2 gives the disjunction. ◻

Remark 160.14 — The normalization boundary

Theorem 160.13 is canonicity, not normalization. The normalization theorem for multimodal type theory — and with it decidability of conversion — is a separate result of the matching source, proved at its own frozen mode theory and conversion rules by a synthetic-Tait argument; it is not implied by anything above and is not restated here. In particular proposition 160.3 is a normalization statement for a simply typed calculus with one modality, and it donates nothing to the dependent or multimodal systems, exactly as remark 160.4 records; and theorem 160.7 is a soundness and initiality statement for a single dependent modality, which donates no multimodal theorem.

One application, developed

Definition 160.15 — The guarded mode theory

Let Mg have one mode g, one generating modality :gg, no relations on 1-cells, and one generating 2-cell next:1, subject to no equations beyond those of a strict 2-category.

Proposition 160.16 — Guarded recursion is typable

In the instance of definition 160.11 over Mg, write A:=A. Then:

  1. there is a term nextA:AA, namely λa.mod(anext), where anext is the variable rule at the 2-cell next;

  2. there is a term :(AB)AB;

  3. the type Str of guarded streams over 2 satisfies Str2×Str whenever the mode carries a solution of that equation;

  4. there is no term of type AA for arbitrary A.

Proof of Proposition 160.16 — Guarded recursion is typable

Proof. (1) Under the lock L the declaration a:1A is usable exactly when a 2-cell 1 exists, which is next; MTT-Var then applies.

(2) Take λf.λu.let mod(g)=f in let mod(a)=u in mod(ga). Both eliminations introduce a declaration at modality , and inside the final mod the composite of locks is , so both variables are usable by MTT-Var at the identity 2-cell.

(3) The isomorphism is the pair of the two projections and the pairing; it is an isomorphism because × is the product and is applied only to the second component, so no lock separates the two directions.

(4) A term of that type would, by MTT-Var applied under no lock, require a 2-cell 1 in Mg. By definition 160.15 the 2-cells are generated by next in the direction 1 and closed under the two compositions, so every 2-cell out of has target a composite containing ; none has target 1. Hence no such term exists. ◻

Remark 160.17 — Not a staging theorem

Proposition 160.16 is a statement about Mg and its 2-cells. It resembles the staging discipline of chapter 129 in shape — a boundary, an introduction that crosses it, and a variable rule that does not — and differs from it in content. There is no code, no splice and no run: clause (4) is proved by inspecting 2-cells, and the corresponding staging fact is proved by inspecting an operational semantics. Neither proof transfers, and neither system’s theorem may be cited for the other.

Remark 160.18 — Judgment modalities are not subuniverse modalities

A reflective subuniverse modality is an operation on the types of a single judgment, with a unit AA and an induction principle making A the reflection of A; its rules quantify over types at one mode and mention no context former. The modalities of definition 160.11 have the opposite signature: they act on judgments, they introduce a context former, and their introduction rule has a premise in a different context. A subuniverse modality therefore has a unit at every type, while μ has one only when a 2-cell 1μ exists, as proposition 160.16(1) shows. Nothing here assumes a reflective subuniverse, and no rule above may be read as providing one.

Cohesive and synthetic-differential programs instantiate definition 160.10 with mode theories whose modalities form an adjoint string, and they are developed in the literature with substantial further structure. They are named here and not developed: each requires a complete public proof at its own frozen mode theory, and a later mathematical use to justify the machinery. Nothing in this chapter’s statements depends on them.

Exercise 160.3

★★☆ Add to Mg a generating 2-cell 1 and show that proposition 160.16(4) then fails by exhibiting the term. What does the resulting calculus lose, and which clause of lemma 160.12 still holds?

Exercise 160.4

★★☆ Show that the annotation μ on a declaration x:μA cannot be omitted: give two derivations that differ only in the annotation and whose conclusions are different judgments, and locate the step of lemma 160.12 that consults it.

Exercise 160.5

★★☆ Show that the single-modality calculus of definition 160.5 is the instance of definition 160.11 over the mode theory with one mode, one generating modality and no 2-cells, by matching the rules one by one. Which rule of definition 160.11 has no counterpart, and why does its absence not matter here?

Boundary and seminar

The results are lemma 160.2 and proposition 160.3 for the simply typed lock calculus; theorem 160.7 for the single dependent modality and its CwDRA models; lemma 160.12 and theorem 160.13 for the multimodal calculus over a frozen mode theory; and proposition 160.16 for one application. Their separation is not editorial, and remark 160.14 states it: the simply typed normalization result donates no dependent theorem, the dependent right-adjoint calculus donates no multimodal theorem, and the multimodal normalization and decidability result is not proved here and is not implied by canonicity.

Three further boundaries. Theorem 160.13 requires decidable equality of 2-cells and the frozen signature named in its statement; a mode theory without that property is outside it. Proposition 160.16(4) is a statement about Mg and, by remark 160.17, is neither implied by nor an implication of the operational results of chapter 129. And by remark 160.18 nothing above provides a reflective subuniverse; the two kinds of modality are distinguished by their rule signatures and are not interchangeable.

The consistency of the systems above rests on the model sequence built earlier: the CwF interface and initiality of chapter 54, the set and groupoid models of chapter 55, chapter 152 as sources of CwDRAs, and the strictification of chapter 56 for turning a categorical model with weakly stable structure into one satisfying the substitution equations of definition 160.6 on the nose. The optional model chapters are comparisons and are not premises of any statement above.

The proof base divides exactly. The simply typed Fitch calculus, its substitution lemma and its normalization by evaluation are [Clo18, VRC22a], with the accompanying mechanization [VRC22b] checking that simply typed statement only. The dependent lock calculus, the CwDRA interface of definition 160.6 and the term-model soundness of theorem 160.7 are [BCM^+20]. The mode theories, locks, annotated variables and modal types of definition 160.11, together with the multimodal metatheory, are treated at monograph length in [Gra23]; the judgmental and semantic prerequisites are [AG26].

[4]

Suggested first pass.

Begin with exercise 160.6, then exercise 160.7, and finish with exercise 160.9.

Exercise 160.6

★★★ Construct a CwDRA on the set model of definition 151.3: take LΓ:=Γ×X for a fixed set X and find the corresponding R and bijection. Verify all the naturality conditions of definition 160.6, and determine which modal axioms the resulting validates.

Exercise 160.7

★★★ In the calculus of proposition 160.16, define the guarded stream of alternating booleans using and a fixed point, state precisely which additional rule the fixed point requires, and prove that the definition is well typed once that rule is added. Then show that removing the rule leaves the stream undefinable.

Exercise 160.8

★★★ Write out the lock clause in the proof of theorem 160.13 in full, including the verification that the displayed predicate is preserved by the substitution induced by a 2-cell. Identify exactly where decidable equality of 2-cells is used.

Exercise 160.9 — Practical: a multimodal type checker

★★★ Practical project.multimodal-lock-checker Implement a bidirectional type checker for the fragment of definition 160.11 with Π-types, 2 and modal types, parameterized by a finite mode theory given as a table of modes, generating modalities and generating 2-cells with their composites. The invariant the checker must maintain is that a variable is accepted only when the recorded 2-cell witnesses μlocks(Γ) in the given mode theory, and that every lock operation respects the two strict equations of definition 160.11. The program must print, for each named input, the computed lock composite at each variable occurrence, the accepted or rejected verdict with the missing 2-cell named on failure, and the normal form of a closed 2 term. The acceptance test is: over Mg of definition 160.15 the term nextA of proposition 160.16(1) is accepted and of clause (2) is accepted; the term of type AA is rejected with the missing 2-cell 1 named, matching clause (4); adding that generating 2-cell to the table makes the same term accepted, matching exercise 160.3; and every closed 2 term in the test suite normalizes to tt or ff, illustrating theorem 160.13 on those inputs. A checker over a finite mode theory is evidence on named inputs: it proves neither theorem 160.13 nor any normalization statement, and by remark 160.14 it must not be described as deciding conversion in general.

Search the book

Type to search the local edition.