Convertibility Soundness Theorem

• Convertibility Soundness Theorem is a formal framework that rigorously defines reliable type conversions across languages using well-defined conversion rules.
• It specifies declarative convertibility judgments and target-level glue code to mediate cross-language type conversions, handling dynamic conversion errors.
• The theorem is validated with a step-indexed logical relation, establishing foundational semantic soundness for interoperable multi-language systems.

The Convertibility Soundness Theorem provides a rigorous basis for reasoning about type soundness when multiple programming languages interoperate after compilation to a shared, untyped target. The theorem formalizes the reliability of type conversions across language boundaries, ensuring that target-level glue code correctly mediates types as specified by an interoperability relation, and that any dynamic errors are well-defined. Originally introduced in the context of the semantic framework for language interoperability, the theorem establishes that for any pair of source types declared convertible, the realized conversions preserve intended behaviors and invariants up to dynamically signaled conversion errors, providing the foundation for semantic type soundness of multi-language systems (Patterson et al., 2022).

1. Declarative Convertibility Judgment

Type conversions across language boundaries are formalized by a declarative convertibility judgment. Given two types, $\tau_A$ and $\tau_B$, the relation $\tau_A \sim \tau_B$ specifies they are mutually convertible, possibly with certain well-defined dynamic failures. Typing rules for conversion are:

• If $\Gamma \vdash e : \tau_A$ and $\tau_A \sim \tau_B$, then $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$.
• The symmetric rule holds for conversion from $\tau_B$ to $\tau_A$.

The specific convertibility rules are defined by the interoperator and depend on the types and languages. In the shared-memory case study—using RefHL and RefLL, both compiling to StackLang—examples include:

Convertibility Rule	Description	Special Notes
Bool $\sim$ Int	Boolean $\leftrightarrow$ Integer	Same representation
Ref Bool $\tau_B$0 Ref Int	Reference to Bool $\tau_B$1 Reference to Int	Identical pointers
$\tau_B$2	Sums $\tau_B$3 2-tagged Int arrays	Requires payload conversion

All such rules are made explicit in the system [(Patterson et al., 2022), Fig. 4].

2. Target-Level Glue Code

For every declarative convertibility rule $\tau_B$4, a pair of target-level glue-code sequences $\tau_B$5 and $\tau_B$6 implement the actual conversions in the compiled, untyped target language. Representative glue-code implementations in the shared-memory case study include:

• $\tau_B$7 (no-op, as Bool and Int are identical),
• $\tau_B$8 (identical pointers),
• $\tau_B$9 involves tagging arrays and recursively converting payloads,
• $\tau_A \sim \tau_B$0 performs tag inspection, array length checks, payload conversion, or issues a dynamic error fail Conv on out-of-range cases.

These glue-code mappings constitute the operational mechanism for cross-language type conversions at the target level (Patterson et al., 2022).

3. Semantic/Realizability Model

Type soundness is justified by interpreting source types and terms semantically over target terms using a step-indexed logical relation.

• Worlds $\tau_A \sim \tau_B$1 pair a step-budget $\tau_A \sim \tau_B$2 with a heap typing $\tau_A \sim \tau_B$3, allowing for resource-aware semantics.
• Value interpretation $\tau_A \sim \tau_B$4 defines the set of target representations of source type $\tau_A \sim \tau_B$5 in world $\tau_A \sim \tau_B$6. For example:
  • $\tau_A \sim \tau_B$7,
  • $\tau_A \sim \tau_B$8,
  • $\tau_A \sim \tau_B$9.
• Expression interpretation $\Gamma \vdash e : \tau_A$0 comprises pairs $\Gamma \vdash e : \tau_A$1 such that running program $\Gamma \vdash e : \tau_A$2 in any heap $\Gamma \vdash e : \tau_A$3 either diverges safely or terminates within $\Gamma \vdash e : \tau_A$4 steps, carrying a value in $\Gamma \vdash e : \tau_A$5 or a conversion error.

The Fundamental Property states that any well-typed source-term $\Gamma \vdash e : \tau_A$6 compiles to $\Gamma \vdash e : \tau_A$7 with $\Gamma \vdash e : \tau_A$8.

4. Statement and Proof of Convertibility Soundness Theorem

The Convertibility Soundness Theorem asserts the semantic validity of all specified conversions:

Theorem (Convertibility Soundness):

If $\Gamma \vdash e : \tau_A$9 then:

• For all $\tau_A \sim \tau_B$0, $\tau_A \sim \tau_B$1;
• For all $\tau_A \sim \tau_B$2, $\tau_A \sim \tau_B$3.

Formally,

$\tau_A \sim \tau_B$4

Proof is by induction on the derivation of $\tau_A \sim \tau_B$5, proceeding case-by-case over the conversion rules. Each case uses the correctness of glue-code, the realizability model, and often the monotonicity of interpretations under world extension. A critical case is $\tau_A \sim \tau_B$6, justifying the correctness of the no-op glue-code for references since $\tau_A \sim \tau_B$7.

5. Illustrative Examples

The Shared-Memory case study concretely demonstrates the theorem's operation:

• Sums and Arrays: For $\tau_A \sim \tau_B$8, execution yields either $\tau_A \sim \tau_B$9 with $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$0 or $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$1 with $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$2. The glue-code $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$3 ensures correct tagging and recursive payload conversion, so the final result is a valid $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$4 in $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$5.
• References: If $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$6, the pointer $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$7 satisfies $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$8; since $$\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$$9, the same pointer is valid for $\tau_B$0. No-op glue-code suffices for correctness.
• Dynamic Failures: If a value is not convertible (e.g., out-of-range array), the glue-code triggers the dynamic error fail Conv. The model explicitly allows for such failures, maintaining the soundness property.

6. Corollary: Full Semantic Soundness of the Multi-Language

Upon establishing Convertibility Soundness, compatibility lemmas for all typing rules—especially boundaries and conversions—yield full semantic soundness for AB-programs: every well-typed program $\tau_B$1 compiles to $\tau_B$2. Consequently, execution of multi-language systems cannot “go wrong” except through conversion errors that are precisely specified by the declared convertibility relation. This constraint provides robust guarantees about the safe composition of multi-language systems, as validated semantically via the logical relation (Patterson et al., 2022).