---
title: Convertibility Soundness Theorem
url: https://www.emergentmind.com/topics/convertibility-soundness-theorem
type: topic
---

# Convertibility Soundness Theorem

The Convertibility Soundness Theorem provides a rigorous basis for reasoning about type soundness when multiple programming languages interoperate after compilation to a shared, untyped target. The theorem formalizes the reliability of type conversions across language boundaries, ensuring that target-level glue code correctly mediates types as specified by an interoperability relation, and that any dynamic errors are well-defined. Originally introduced in the context of the semantic framework for language interoperability, the theorem establishes that for any pair of source types declared convertible, the realized conversions preserve intended behaviors and invariants up to dynamically signaled conversion errors, providing the foundation for semantic type soundness of multi-language systems [2202.13158].

## 1. Declarative Convertibility Judgment

Type conversions across language boundaries are formalized by a declarative convertibility judgment. Given two types, $\tau_A$ and $\tau_B$, the relation $\tau_A \sim \tau_B$ specifies they are mutually convertible, possibly with certain well-defined dynamic failures. Typing rules for conversion are:

- If $\Gamma \vdash e : \tau_A$ and $\tau_A \sim \tau_B$, then $\Gamma \vdash \llbracket \tau_B \leftarrow \tau_A \rrbracket(e) : \tau_B$.
- The symmetric rule holds for conversion from $\tau_B$ to $\tau_A$.

The specific convertibility rules are defined by the interoperator and depend on the types and languages. In the shared-memory case study—using RefHL and RefLL, both compiling to StackLang—examples include:

| Convertibility Rule          | Description               | Special Notes        |
|-----------------------------|--------------------------|---------------------|
| Bool $\sim$ Int             | Boolean $\leftrightarrow$ Integer | Same representation |
| Ref Bool $\sim$ Ref Int     | Reference to Bool $\leftrightarrow$ Reference to Int | Identical pointers   |
| $\tau_1 + \tau_2 \sim [\mathrm{Int}]$ | Sums $\leftrightarrow$ 2-tagged Int arrays | Requires payload conversion |

All such rules are made explicit in the system [2202.13158, Fig. 4].

## 2. Target-Level Glue Code

For every declarative convertibility rule $\tau_A \sim \tau_B$, a pair of target-level glue-code sequences $C_{\tau_A \to \tau_B}$ and $C_{\tau_B \to \tau_A}$ implement the actual conversions in the compiled, untyped target language. Representative glue-code implementations in the shared-memory case study include:

- $C_{\mathrm{Bool} \to \mathrm{Int}} \equiv~\cdot$ (no-op, as Bool and Int are identical),
- $C_{\mathrm{Ref~Bool} \to \mathrm{Ref~Int}} \equiv~\cdot$ (identical pointers),
- $C_{\tau_1+\tau_2 \to [\mathrm{Int}]}$ involves tagging arrays and recursively converting payloads,
- $C_{[\mathrm{Int}] \to \tau_1+\tau_2}$ performs tag inspection, array length checks, payload conversion, or issues a dynamic error `fail Conv` on out-of-range cases.

These glue-code mappings constitute the operational mechanism for cross-language type conversions at the target level [2202.13158].

## 3. Semantic/Realizability Model

Type soundness is justified by interpreting source types and terms semantically over target terms using a step-indexed logical relation.

- **Worlds** $W = (k, \Theta)$ pair a step-budget $k < \omega$ with a heap typing $\Theta:\mathrm{Loc}\to\mathrm{TypeInterp}$, allowing for resource-aware semantics.
- **Value interpretation** $V[\tau]$ defines the set of target representations of source type $\tau$ in world $W$. For example:
  - $V[\mathrm{Bool}] = \{(W, n) \mid n \in \mathbb{N} \}$,
  - $V[\tau_1+\tau_2] = \{(W, [0, v]) \mid (W, v) \in V[\tau_1] \} \cup \{(W, [1, v]) \mid (W, v) \in V[\tau_2] \}$,
  - $V[\mathrm{Ref}~\tau] = \{(W, \ell) \mid \Theta(\ell) = V[\tau]\}$.
- **Expression interpretation** $E[\tau]$ comprises pairs $(W, P)$ such that running program $P$ in any heap $H \vDash W$ either diverges safely or terminates within $k$ steps, carrying a value in $V[\tau]$ or a conversion error.

The Fundamental Property states that any well-typed source-term $e$ compiles to $P = e^+$ with $(W, P) \in E[\tau]$.

## 4. Statement and Proof of Convertibility Soundness Theorem

The Convertibility Soundness Theorem asserts the semantic validity of all specified conversions:

**Theorem (Convertibility Soundness):**  
If $\tau_A \sim \tau_B$ then:
- For all $(W, P) \in E[\tau_A]$, $(W, (P;C_{\tau_A\to\tau_B})) \in E[\tau_B]$;
- For all $(W, P) \in E[\tau_B]$, $(W, (P;C_{\tau_B\to\tau_A})) \in E[\tau_A]$.

Formally,
\[
\tau_A \sim \tau_B
\;\Longrightarrow\;
\forall\,P,\,W.\;
  (W,P)\in E[\tau_A]
  \;\Longrightarrow\;
  (W,P;C_{\tau_A\mapsto\tau_B})\in E[\tau_B]
\quad\wedge\quad
  (W,P)\in E[\tau_B]
  \;\Longrightarrow\;
  (W,P;C_{\tau_B\mapsto\tau_A})\in E[\tau_A].
\]

Proof is by induction on the derivation of $\tau_A \sim \tau_B$, proceeding case-by-case over the conversion rules. Each case uses the correctness of glue-code, the realizability model, and often the monotonicity of interpretations under world extension. A critical case is $V[\mathrm{Ref~Bool}] = V[\mathrm{Ref~Int}]$, justifying the correctness of the no-op glue-code for references since $V[\mathrm{Bool}] = V[\mathrm{Int}]$.

## 5. Illustrative Examples

The Shared-Memory case study concretely demonstrates the theorem's operation:

- **Sums and Arrays:** For $P \in E[\tau_1+\tau_2]$, execution yields either $[0,v]$ with $(W,v)\in V[\tau_1]$ or $[1,v]$ with $(W,v)\in V[\tau_2]$. The glue-code $C_{\tau_1+\tau_2 \to [\mathrm{Int}]}$ ensures correct tagging and recursive payload conversion, so the final result is a valid $[\mathrm{Int}]$ in $V[[\mathrm{Int}]]$.
- **References:** If $P \in E[\mathrm{Ref~Bool}]$, the pointer $\ell$ satisfies $\Theta(\ell) = V[\mathrm{Bool}]$; since $V[\mathrm{Bool}] = V[\mathrm{Int}]$, the same pointer is valid for $\mathrm{Ref~Int}$. No-op glue-code suffices for correctness.
- **Dynamic Failures:** If a value is not convertible (e.g., out-of-range array), the glue-code triggers the dynamic error `fail Conv`. The model explicitly allows for such failures, maintaining the soundness property.

## 6. Corollary: Full Semantic Soundness of the Multi-Language

Upon establishing Convertibility Soundness, compatibility lemmas for all typing rules—especially boundaries and conversions—yield full semantic soundness for AB-programs: every well-typed program $e$ compiles to $e^+ \in E[\tau]$. Consequently, execution of multi-language systems cannot “go wrong” except through conversion errors that are precisely specified by the declared convertibility relation. This constraint provides robust guarantees about the safe composition of multi-language systems, as validated semantically via the logical relation [2202.13158].

Source: https://www.emergentmind.com/topics/convertibility-soundness-theorem