# Bisimulation as path type for guarded recursive types

In type theory, coinductive types are used to represent processes, and are thus crucial for the formal verification of non-terminating reactive programs in proof assistants based on type theory, such as Coq and Agda. Currently, programming and reasoning about coinductive types is difficult for two reasons: The need for recursive definitions to be productive, and the lack of coincidence of the built-in identity types and the important notion of bisimilarity. Guarded recursion in the sense of Nakano has recently been suggested as a possible approach to dealing with the problem of productivity, allowing this to be encoded in types. Indeed, coinductive types can be encoded using a combination of guarded recursion and universal quantification over clocks. This paper studies the notion of bisimilarity for guarded recursive types in Ticked Cubical Type Theory, an extension of Cubical Type Theory with guarded recursion. We prove that, for any functor, an abstract, category theoretic notion of bisimilarity for the final guarded coalgebra is equivalent (in the sense of homotopy type theory) to path equality (the primitive notion of equality in cubical type theory). As a worked example we study a guarded notion of labelled transition systems, and show that, as a special case of the general theorem, path equality coincides with an adaptation of the usual notion of bisimulation for processes. In particular, this implies that guarded recursion can be used to give simple equational reasoning proofs of bisimilarity. This work should be seen as a step towards obtaining bisimilarity as path equality for coinductive types using the encodings mentioned above.

## Authors

• 7 publications
• 6 publications
02/03/2021

### A model of Clocked Cubical Type Theory

Guarded recursion is a powerful modal approach to recursion that can be ...
02/28/2019

### Infinite Types, Infinite Data, Infinite Interaction

We describe a way to represent computable functions between coinductive ...
12/15/2021

### Simulating Large Eliminations in Cedille

Large eliminations provide an expressive mechanism for arity- and type-g...
12/28/2021

### Two Guarded Recursive Powerdomains for Applicative Simulation

Clocked Cubical Type Theory is a new type theory combining the power of ...
02/27/2019

### From Cubes to Twisted Cubes via Graph Morphisms in Type Theory

Cube categories are used to encode higher-dimensional structures. They h...
09/11/2019

### The Marriage of Univalence and Parametricity

Reasoning modulo equivalences is natural for everyone, including mathema...
04/18/2018

### The clocks they are adjunctions:Denotational semantics for Clocked Type Theory

Clocked Type Theory (CloTT) is a type theory for guarded recursion usefu...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1. Introduction

Programming languages with dependent types such as Coq, Agda, F and Idris are attracting increasing attention these years. The main use of dependency is for expressing predicates on types as used in formal verification. Large scale projects in this area include the CompCert C compiler, fully verified in Coq (Leroy, 2006), and the ongoing Everest project (The Project Everest Team, 2018) constructing a fully verified HTTPS stack using F. Even when full formal verification is not the goal, dependent types can be used for software development (Brady, 2016), pushing the known advantages of types in programming further.

For these applications, coinductive types are of particular importance, because they describe processes, i.e., non-terminating and reactive programs. However, programming and reasoning about coinductive types is difficult in existing systems with dependent types for two reasons. The first is the need for totality in type theory, as required for soundness of the logical interpretation of types. To ensure this, recursively defined data of coinductive type must be productive (Coquand, 1993) in the sense that all finite unfoldings can be computed in finite time.

Most proof assistants in use today use syntactic checks to ensure productivity of recursive definitions of coinductive data, but these checks are not modular, and therefore a certain overhead is associated with convincing the productivity checker. Guarded recursion in the style of Nakano (2000) has been suggested as a solution to this problem, encoding productivity in types. The idea is to use a modal type operator to encode a time delay in types. This allows productive recursive definitions to be encoded as maps of type , and thus a fixed point operator taking input of that type allows for productive recursive programming. These fixed points can be used for programming with guarded recursive types, i.e., recursive types where the recursion variable only occurs guarded by modalities. Consider for example, the type of guarded streams satisfying the type equivalence , expressing that the head of the stream is immediately available, but the tail takes one time step to compute. In this type, the stream of s can be defined using the productive recursive definition . Guarded recursive types can be used to encode coinductive types (Atkey and McBride, 2013), if one allows for the delay modality to be indexed by a notion of clocks which can be universally quantified. If, e.g., is a clock variable and is a guarded recursive type, then is the coinductive type of streams.

The second problem for coinductive types in dependent type theory is the notion of equality. The natural notion of equality for coinductive types is bisimilarity, but this is not known to coincide with the build in notion of identity types, and indeed, many authors define bisimilarity as a separate notion when working with coinductive types (Coquand, 1993; Abel et al., 2017). For simple programming with coinductive types it should be the case that these notions coincide, indeed, it should be the case that the identity type is equivalent to the bisimilarity type. Such a result would be in the spirit of homotopy type theory, providing an extensionality principle to coinductive types, similar to function extensionality and univalence, which can be viewed as an extensionality principle for universes.

In this paper we take a step towards such an extensionality principle for coinductive types, by proving a similar statement for guarded recursive types. Rather than working with identity types in the traditional form, we work with path types as used in cubical type theory (Cohen et al., 2018), a recent type theory based on the cubical model of univalence (Bezem et al., 2013). Precisely, we present Ticked Cubical Type Theory (TCTT), an extension of cubical type theory with guarded recursion and ticks, a tool deriving from Clocked Type Theory (Bahr et al., 2017) to be used for reasoning about guarded recursive types. The guarded fixed point operator satisfies the fixed point unfolding equality up to path equality, and using this, one can encode guarded recursive types up to type equivalence, as fixed points of endomaps on the universe.

We study a notion of guarded coalgebra, i.e., coalgebra for a functor of the form , and prove that for the final coalgebra the path equality type is equivalent to a general category theoretic notion of coalgebraic bisimulation for . This notion of bisimulation is an adaptation to type theory of a notion defined by Hermida and Jacobs (1998). As a running example, we study guarded labelled transition systems (GLTSs), i.e., coalgebras for the functor . Here is the finite powerset functor, which can be defined (Frumin et al., 2018) as a higher inductive type (HIT) (Univalent Foundations Program, 2013), i.e., an inductive type with constructors for elements as well as for equalities. We show that path equality in the final coalgebra for coincides with a natural adaptation of bisimilarity for finitely branching labelled transition systems to their guarded variant. This can be proved either directly using guarded recursion, or as a consequence of the general theorem mentioned above. However, there is a small difference between the abstract category theoretic notion of bisimulation used in the proof of the general theorem and the concrete one for GLTSs: The concrete formulation is a propositionally truncated (Univalent Foundations Program, 2013) version of the abstract one. The truncated version is more convenient to work with in the special case, due to the set-truncation used in the finite powerset functor. On the other hand, using truncation in the general case would break equivalence of bisimilarity and path types.

As a consequence of the coincidence of bisimilarity and path equality, bisimilarity of processes can be proved using simple equational reasoning and guarded recursion. We give a few examples of that. Moreover, we show how to represent Milner’s Calculus of Communicating Systems (Milner, 1980) as well as Hennesy-Milner logic in our type theory.

The use of the finite powerset functor is motivated by the desire to extend this work from guarded recursive types to coinductive types in future work. It is well known from the set theoretic setting, that the unrestricted powerset functor does not have a final coalgebra, but restrictions to subsets of bounded cardinality do (Schwencke, 2010; Adámek et al., 2015). It is therefore to be expected that a similar restriction is needed in type theory to model processes with non-determinism as a coinductive type. We believe that the results presented here can be proved also for other cardinalities than finite, such as the countable powerset functor. This allows more general notions of processes to be modelled. See Section 9 for a discussion of this point.

We prove consistency of TCTT by constructing a denotational model using the category of presheaves over . The model combines the constructions of the cubical model (presheaves over the category of cubes ) and the topos of trees model of guarded recursion (presheaves over ), and builds on a similar construction used to model Guarded Cubical Type Theory (Birkedal et al., 2016), but extends this to ticks using techniques of Mannaa and Møgelberg (2018). Higher inductive types, such as the finite powerset type used in the running example, can be modelled using the techniques of Coquand et al. (2018), which adapt easily to the model used here.

### 1.1. Related work

Guarded recursion in the form used here originates with Nakano (2000). Aside from the applications to coinduction mentioned above, guarded recursion has also been used to model advanced features of programming languages (Birkedal et al., 2012; Bizjak et al., 2014), using an abstract form of step-indexing (Appel and McAllester, 2001). For this reason, type theory with guarded recursion has been proposed as a metalanguage for reasoning about programming languages, and indeed guarded recursion is one of the features of IRIS (Jung et al., 2018), a framework for higher-order separation logic implemented in Coq.

Previous work on applications of guarded recursion to programming and reasoning with coinductive types has mainly studied the examples of streams (Bizjak et al., 2016) and the lifting monad (Møgelberg and Paviotti, 2016). To our knowledge, bisimulation and examples involving higher inductive types have not previously been studied. The type theory closest to TCTT studied previously is Guarded Cubical Type Theory (GCTT(Birkedal et al., 2016) which introduced the idea of fixed point unfoldings as paths. The only difference between the two languages is that GCTT uses delayed substitutions for reasoning about guarded recursive types, and TCTT replaces these by ticks. Ticks can be used to encode delayed substitutions, but have better operational behaviour (Bahr et al., 2017). Birkedal et al. (2016) also proved that bisimilarity for guarded streams coincides with path equality.

Sized types (Hughes et al., 1996) is a different approach to the problem of encoding productivity in types. The idea is to associate abstract ordinals to types indicating the number of possible unfoldings of data of the type. The coinductive type is the sized type associated with the size . Unlike guarded recursion, sized types have been implemented in the proof assistant Agda (The Agda Team, 2018), and this has been used, e.g., for object oriented GUI programming (Abel et al., 2017). On the other hand, the denotational semantics of guarded recursion is better understood than that of sized types, and this has the benefit of making it easier to combine with cubical type theory, and in particular to prove soundness of this combination.

Danielsson (2018) studies bisimulation for coinductive types using sized types in Agda, proving soundness of up-to-techniques (Milner, 1983). Danielsson studies a wider range of systems and also weak bisimilarity. In all these cases bisimulation is a separate type, and does not imply equality as in this work.

Ahrens et al. (2015) encode M-types (types of coinductive trees) in homotopy type theory and prove that for these bisimilarity logically implies equality. Our result is stronger in two ways: We consider more general coinductive types (although guarded versions of these), and we prove equivalence of types. Vezzosi (2017) proves that bisimilarity for streams implies path equality in Cubical Type Theory extended with streams. The proof can most likely be generalised to M-types.

### 1.2. Overview

Section 2 gives a brief introduction to Cubical Type Theory and the notion of higher inductive types. Cubical type theory is extended to Ticked Cubical Type Theory (TCTT) in Section 3. Section 4 introduces the finite powerset functor, which is used to define the notion of guarded labelled transition systems studied in Section 5. Among the results proved there are the fact that bisimilarity and path equality coincide in the final coalgebra, and examples of bisimilarity of processes. Section 6 presents the general theory of guarded coalgebras, proving the general statement of equivalence of path equality and bisimilarity, and Section 7 relates the abstract notion of bisimilarity of Section 6 to the concrete one for guarded labelled transition systems of Section 5. Finally, Section 8 constructs the denotational semantics of TCTT, and Section 9 concludes and discusses future work.

## 2. Cubical type theory

Cubical type theory (CTT(Cohen et al., 2018) is an extension of Martin-Löf type theory with concepts spawning from the cubical interpretation of homotopy type theory (HoTT) (Bezem et al., 2013; Cohen et al., 2018). CTT is a dependent type theory with types, types, sum types, natural numbers and a universe . We write and for non-dependent and types respectively. We also write for judgemental equality of terms.

In CTT, the identity types of Martin-Löf type theory are replaced by a notion of path types. They correspond to an internalization of the homotopical interpretation of equalities as paths. Given , we write for the type of paths between and in , i.e., functions from an interval to with endpoints and . The interval is not a type, but still name assumptions of the form can appear in contexts, and there is a judgement which means that is formed using the grammar

 r,s::=0|1|i|1−r|r∧s|r∨s

using the names appearing in . Two such dimensions or names are considered equal, if they can be proved equal using the laws of De Morgan algebra. Formally, the interval is thus the free De Morgan algebra and it can be thought of as the real interval with and as the minimum and maximum operations.

A type in a context containing the names should be thought of as a -dimensional cube. For example, the type corresponds to a square:

Here we have written for the result of substituting for in . Similarly to function spaces, path types have abstraction and application, denoted and respectively, satisfying and equality: and . The typing rules for these two operations are given as follows:

satisfying, for , the judgemental equalities and . These equalities state that is a path with endpoints and . In what follows, we write instead of if the type is clear from context. Sometimes, especially in equational proofs, we also write instead of .

With the rules given so far, it is possible to prove certain fundamental properties of path equality. The identity path on a term is given by: . The inverse of a path is given by: . One can prove that functions respect path equality: Given and a path we have . Moreover, one can prove extensionality principles which are generally not provable in standard Martin-Löf type theory, like function extensionality: Given two functions and a family of paths one can define . But other properties characterizing path equality, such as transitivity or substitutivity, are not provable in the type theory we have described so far. In order to prove these properties, CTT admits a specific operation called composition.

In order to define this operation, we first introduce the face lattice . Formally, is the free distributive lattice generated by the symbols and , and the relation . This means that its elements are generated by the grammar:

 φ,ψ::=0F|1F|(i=0)|(i=1)|φ∧ψ|φ∨ψ

The judgement states that contains only names declared in the context . There is an operation restricting the context , if . Types and terms in context are called partial. Intuitively, a type in a restricted context should be thought of as a collection of faces of a higher dimensional cube. For example, the type corresponds to the left and top faces of a square:

Given a partial term , we write for the conjunction of the two judgements and . In this case we say that the term extends the partial term on the extent . This notation can be extended to judgements of the form , abbreviating one typing and equality judgements.

The composition operation is defined by the following typing rule:

Intuitively, the terms and in the hypothesis specify an open box in the type : corresponds to the base of the box, while corresponds to the sides. The operation constructs a lid for this open box. Composition can be used to construct, e.g., the composition of paths and :

 p;q=λi.compjA[(i=0)↦x,(i=1)↦qj](pi):PathAxz

We also refer to (Cohen et al., 2018) for the remaining constructions of CTT, which include systems and a glueing construction. The latter is a fundamental ingredient in the proof of the univalence axiom and the construction of composition for the universe. We will not be needing gluing and systems directly in this paper, and so omit them from the brief overview.

### 2.1. Higher inductive types

Recently, Coquand et al. (2018) have introduced an extension of CTT with higher inductive types (HITs). HITs are an important concept in HoTT which generalize the notion of inductive type. A HIT can be thought of as an inductive type in which the introduction rules not only specify the generators of , but can also specify the generators of the higher equality types of . Using HITs, one can define topological spaces such as the circle, the torus and suspensions in HoTT and develop homotopy theory in a synthetic way (Univalent Foundations Program, 2013, Ch. 8). HITs are also used for implementing free algebras of signatures specified by operations and equations, for example the free group on a type, or to construct quotients of types by equivalence relations.

We now recall how to extend CTT with HITs by showing how to add propositional truncation. We refer to (Coquand et al., 2018) for the definition of other HITs and the description of a common pattern for introducing HITs in CTT. In Section 4, we will also present the finite powerset construction as a HIT.

Given a type , we write for the propositional truncation of . The type can have at most one inhabitant up to path equality, informally, an “uninformative” proof of . In other words, the existence of a term tells us that the type is inhabited, but it does not provide any explicit inhabitant of . Moreover, any other term is path equal to . The introduction rules of are the following:

with the judgemental equalities and . Notice that the higher constructor , which when applied to terms and specifies an element in , is treated in CTT as a point constructor which depends on a name .

Remember that in CTT every type is endowed with a composition operation. Coquand et al. showed that it is possible to define composition for a HIT by adding a homogeneous composition as an additional constructor for the type. In the case of propositional truncation, the latter is introduced by the following rule:

Notice that differs from , since in the latter the type depends also on the name . We refer to (Coquand et al., 2018) for the details on the derivation of a composition operation for and for other HITs.

We now describe the elimination principle of propositional truncation in CTT. Given , a family of terms and a family of paths

 u,v:∥A∥,x:Pu,y:Pv,i:I⊢squvxyi:P(squvi)[(i=0)↦x,(i=1)↦y],

we can define by cases:

 f|x| =tx f(squvr) =squv(fu)(fv)r

plus a case for the constructor, see  (Coquand et al., 2018).

The addition of propositional truncation and other HITs to CTT is justified by the existence of these types in the cubical set model of CTT  (Coquand et al., 2018).

We conclude this section by briefly describing an auxiliary HIT . The type is generated by two points and two paths between and . Similarly to other HITs, we also have to add an constructor. The induction principle of states that to give a map of type is the same as to give, for , a point and a path

 i:I⊢pji:P(pji)[(i=0)↦b0,(i=1)↦b1].

The type is used in the HoTT book for specifying the 0-truncation operation as a HIT (Univalent Foundations Program, 2013, Ch. 6.9). In Section 4, we will employ the type in the constructor of the finite powerset, that will force the finite powerset type to be a set.

### 2.2. Some basic notions and results

This section recalls some basic notions and results from homotopy type theory. All results mentioned are proved in (Univalent Foundations Program, 2013) unless otherwise stated.

We say that a type is contractible if it has exactly one inhabitant. We define a type , which is inhabited if and only if is contractible. The unit type is contractible.

We say that a type is a proposition, or it is ()-truncated, if there exists a path between any two of its inhabitants. We define a type , which is inhabited if and only if is a proposition. We also define a type consisting of all types which are propositions. Every contractible type is a proposition. The empty type is a proposition. The propositional truncation of a type is a proposition by construction. The dependent function type is a proposition if and only if is a proposition for all . Given two types and , we define . Moreover, given a type and a type family on , we define . When the latter type is inhabited, we say that there merely exists a term such that holds.

We say that a type is a set, or it is 0-truncated, if there exists at most one path between any two of its inhabitants. We define a type , which is inhabited if and only if is a set. We also define a type consisting of all types which are sets. Every proposition is a set. The type of natural numbers is a set. Another example of a set is the finite powerset introduced in Section 4.

The fiber of a function over a term is given by the type . We say that a function is an equivalence if all the fibers of are contractible. We define a type , which is inhabited if and only if is an equivalence. We say that two types are equivalent if there exists an equivalence between them. We also define a type consisting of all functions between and which are equivalences. In order to prove that a function is an equivalence, it is enough to construct a function such that is path equal to the identity function on and is path equal to the identity function on .

A characteristic feature of HoTT is the univalence axiom, stating that the canonical map from to is an equivalence, for all types and . The univalence axiom is provable in CTT (Cohen et al., 2018). In the rest of the paper, when we refer to the univalence axiom, we mean direction of the equivalence. In other words, when we need to prove that two types are path equal, we will invoke the univalence axiom and prove that the two types are equivalent instead. When and are propositions, the univalence axiom implies that the type is equivalent to the type of logical equivalences between and , where .

We conclude this section with a couple of lemmata that we will employ later on. These are standard results of HoTT that we state without proofs.

###### Lemma 2.1 ().

Given a type and elements , if there exists a path , then the types and are equivalent.

###### Lemma 2.2 ().

Let and . If there exists an equivalence , then the function given by is also an equivalence.

## 3. Ticked cubical type theory

We now extend CTT with guarded recursion. The resulting type theory, called ticked cubical type theory (TCTT), differs from guarded cubical type theory (GCTT) (Birkedal et al., 2016) only by featuring ticks. Ticks are an invention deriving from Clocked Type Theory (Bahr et al., 2017) and can be used for reasoning about delayed data. In particular, ticks can be used to encode the delayed substitutions of GCTT, which served the same purpose, but are simpler and can be given confluent, strongly normalising reduction semantics satisfying canonicity. Indeed, these results have been proved for Clocked Type Theory which includes guarded fixed points (Bahr et al., 2017).

Formally, TCTT extends CTT with tick assumptions in the context, along with abstraction and application to ticks following these rules.

 \inferΓ,α:T⊢Γ⊢\inferΓ⊢▹(α:T).AΓ,α:T⊢A\inferΓ⊢λ(α:T).t:▹(α:T).AΓ,α:T⊢t:A \inferΓ,β:T,Γ′⊢t[β]:A(α/β)Γ⊢t:▹(α:T).A\inferΓ⊢▹(α:T).A:UΓ,α:T⊢A:U

together with and rules:

 (λ(α:T).t)[β]=t(α/β)λ(α:T).t[α]=t

The sort of ticks enjoys the same status as the interval . In particular it is not a type. The type

should be thought of as classifying data of type

that is only available one time step from now. Similarly, ticks should be thought of as evidence that time has passed. For example, in a context of the form , the assumptions in are available for one more time step than those of . In the application rule, the assumption states that is a promise of data of type available one time-step after the variables in have arrived, and thus the tick , can be used to open to an element of type . We write for where does not occur free in . Note in particular that the rule for tick application prevents terms like being well typed. Such a term in combination with the fixed point operator to be introduced below would make any type of the form inhabited, and logically trivialise a large part of the theory.

The abstraction of the tick in type makes the type behave like a dependent function space between ticks and the type , similarly to the path type. This can be used, e.g., to type the terms of a dependent form of the applicative functor law:

 next =λx.λ(α:T).x:A→▹A (1) ⊙ =λf.λy.λ(α:T).f[α](y[α]):▹(Πx:A.Bx)→Πy:▹A.▹(α:T).B(x/y[α])

As part of their special status, names and faces are independent of time, in the sense that they can always be commuted with ticks as expressed in the invertible rules

 (2) \infer=Γ,i:I,α:T⊢AΓ,α:T,i:I⊢A\infer=Γ,i:I,α:T⊢t:AΓ,α:T,i:I⊢t:A\infer=Γ,φ,α:T⊢AΓ,α:T,φ⊢A\infer=Γ,φ,α:T⊢t:AΓ,α:T,φ⊢t:A

This effect could have similarly been obtained by not erasing names and faces from the assumption of the tick application rule above, in which case the above rules could have been derived. One consequence of these rules is an extensionality principle for stating the equivalence of types

 (3) Path▹(α:T).Axy≃▹(α:T).(PathA(x[α])(y[α]))

as witnessed by the terms

 λp.λα.λi.(pi)[α]:Path▹(α:T).Axy→▹(α:T).(PathA(x[α])(y[α]))

and

 λp.λi.λα.p[α]i:▹(α:T).(PathA(x[α])(y[α]))→Path▹(α:T).Axy

In particular, if then

 (4) Path▹A(nextx)(nexty)≃▹(PathAxy)

Note that as a consequence of this, the type of propositions is closed under :

Let . If also .

###### Proof.

Suppose , we must show that . By extensionality it suffices to show . By assumption there is a and the term inhabits the desired type. ∎

One additional benefit of the ticks is that the composition operator for can be defined in type theory. To see this, assume

 Γ⊢φ:FΓ,i:I⊢▹(α:T).A Γ,φ,i:I⊢u:▹(α:T).AΓ⊢u0:(▹(α:T).A)(i/0)[φ↦u(i/0)].

Since these imply assumptions for the composition operator on :

 Γ,α:T⊢φ:FΓ,α:T,i:I⊢A Γ,α:T,φ,i:I⊢u[α]:AΓ,α:T⊢u0[α]:A(i/0)[φ↦u[α](i/0)].

we can define

 Γ⊢compi▹(α:T).A[φ↦u]u0=λ(α:T).compiA[φ↦u[α]](u0[α]):(▹(α:T).A)(i/1)

Note that this uses the rules in (2) for exchange of ticks and names and faces. It is easy to see that the term extends on .

### 3.1. Fixed points

TCTT comes with a primitive fixed point operator mapping terms of type to fixed points of the composition . As in GCTT, the fixed point equality holds only up to path, not judgemental equality. This is to ensure termination of the reduction semantics, but is not necessary for logical consistency, as verified by the model, in which the fixed point equality holds definitionally. The typing rule gives the path, with the end points definitionally equal to the two sides of the fixed point equality.

 \inferΓ⊢dfixrx.t:▹AΓ,x:▹A⊢t:AΓ⊢r:Idfix1x.t=nextt(x/dfix0x.t)

Note that the above delayed fixed point is of type rather than . This is to maintain canonicity, but one can define a fixed point as , which gives the derived rule

 \inferΓ⊢pfixx.t:PathA(fixx.t)(t(x/next(fixx.t)))Γ,x:▹A⊢t:A

by defining . We write simply for

Fixed points are unique in the following sense. Let and consider a term such that . Then is path equal to as can be proved by guarded recursion: If then

 λi.t(x/λ(α:T).e[α]i):PathA(t(x/nexta))(t(x/next(fixx.t)))

and thus we can prove by composing this with and .

One application of fixed points is to define guarded recursive types as fixed points of endomaps on the universe. For example, one can define a type of guarded streams of natural numbers as . Since path equality at the universe is equivalence of types, we obtain an equivalence

 Strg≃N×▹Strg

witnessed by terms and . One can then use the fixed point operator for programming with streams and, e.g., define a constant stream of zeros as . We refer to (Bizjak et al., 2016) for more examples of programming with guarded recursive types.

Guarded recursive types are simultaneously initial algebras and final coalgebras. This is a standard result (Birkedal et al., 2012), but formulated here in terms of path equality, so we repeat it. Recall that a small functor is a term together with another term (also called ) of type satisfying the functor laws up to path equality, i.e., with witnesses of types

 ΠX:U.PathFX→FX(λx:FX.x)(F(λx:X.x)) ΠX,Y,Z:U,f:X→Y,g:Y→Z.PathFX→FZ(Fg∘Ff)(F(g∘f)).

For example, is a functor, with functorial action given by for .

###### Proposition 3.2 ().

Let be a small functor. The fixed point is an initial algebra and a final coalgebra for the functor . We spell out the final coalgebra statement: For any and , there exists a unique (up to path equality) term such that

 unfold∘h≡F(▹h)∘f
###### Proof.

The equality to be satisfied by is equivalent to

 h≡fold∘F(▹h)∘f

and this is satisfied by defining to be using the applicative action (1) to apply to . Uniqueness follows from uniqueness of fixed points. The initial algebra property can be proved similarly. ∎

## 4. The finite powerset functor

In order to define finitely branching labelled transition systems, we need to represent finite subsets of a given type. There are several different ways to describe finite sets and finite subsets in type theory (Spiwack and Coquand, 2010). Recently, Frumin et al. (2018) have presented an implementation of the finite powerset functor in HoTT as a higher inductive type. Given a type , they construct the type of finite subsets of as the free join semilattice over . We define the type in CTT following the pattern for HITs given by Coquand et al. (2018) that we summarized in Section 2.1. Notice that the same definition can be read in the extended type theory TCTT. Given a type , the type is introduced by the following constructors:

 \infer∅:PfinA\infer{a}:PfinAa:A\inferx∪y:PfinAx,y:PfinA

with the judgemental equalities:

 nlx0 =∅∪x nlx1 =x assocxyz0 =(x∪y)∪z assocxyz1 =x∪(y∪z) idema0 ={a}∪{a} idema1 ={a} comxy0 =x∪y comxy1 =y∪x truncf0j =f(p0j) truncf1j =f(p1j) truncfi0 =f(b0) truncfi1 =f(b1)

As for the higher constructor of propositional truncation given in Section 2.1, the higher constructors of are introduced as point constructors depending on names in . For example, the constructor states that the empty set is a left unit for the union operation . Given , we have that is a path between and .

The constructor refers to the HIT introduced in the end of Section 2.1, and forces to be a set. To see this, suppose and . To show , define by recursion on :

 fb0=xfb1=yj:I⊢f(p0j)=pjj:I⊢f(p1j)=qj.

Then .

Following the pattern for higher inductive types in CTT, we also introduce a constructor which imposes a homogenous composition structure on and allows us to define composition for . Assuming , the operation is given as:

Finally, we will assume that the universe is closed under higher inductive type formers such as finite powersets in the sense that if also . Consistency of the extension of TCTT with the HITs used in this paper is justified by the denotational model presented in Section 8.

The type comes with a rather complex induction principle, which is similar to the one described by Frumin et al. (2018). We spell it out for the case in which the type we are eliminating into is a proposition. Let . Given , and , then there exists a term such that:

 g∅ =e g{a} =sa g(x∪y) =uxy(gx)(gy)

The assumption that is a proposition means that we do not have to specify where the higher constructors should be mapped.

Using this induction principle of , one can define a membership predicate :

 a∈∅=⊥a∈{b}=∥a≡b∥a∈x∪y=a∈x∨a∈y.

The cases for the other constructors are dealt with in a straightforward way using the univalence axiom.

Given , we write for . Using the induction principle of the finite powerset construction, it is also possible to prove an extensionality principle for finite subsets: two subsets are path equal if and only if they contain the same elements, i.e. if the type is inhabited (Frumin et al., 2018).

Using the non-dependent version of the induction principle, it is possible to prove that is a functor. Given , we write for the action of on the function . We have:

 Pfinf∅=∅Pfinf{a}={fa}Pfinf(x∪y)=Pfinfx∪Pfinfy

The cases for the higher constructors are straightforward. For example, .

We conclude this section by mentioning an auxiliary result describing the image of .

###### Lemma 4.1 ().

Let and . If then also . If is in , then there merely exists an such that and .

###### Proof.

The first statement can be proved by induction on , and we omit the simple verification, focusing on the second statement, which is also proved by induction on .

The case of implies and so the assumption implies absurdity. If , then and so the assumption implies . Since we are proving a proposition, we can apply induction to the latter and obtain a proof . Then proves the case.

If , then and so . By induction we may thus assume that either or , the proof of two cases are symmetric. In the first case, by induction, there merely exists an such that and . Since the former of these implies , this implies the proof of the case. ∎

## 5. Guarded Labelled transition systems

In this section, we show how to represent a guarded version of finitely branching labelled transition systems in TCTT. From now on, we omit the attribute “finitely branching” since this will be the only kind of system we will consider in this paper. As we will see in Section 6, bisimulation for final guarded coalgebras coincides with path equality, and labelled transition systems provide an interesting test case of this. In particular, we shall see that proving bisimilarity of processes can be done using simple equational reasoning in combination with guarded recursion.

A guarded labelled transition system, or GLTS for short, consists of a type of states, a type of actions (which we will assume small in the sense that ) and a function . Given a state , a later state and an action , we write for .

###### Example 5.1 (label=ex:lts).

Consider the GLTS described pictorially as the following labelled directed graph:

This can be implemented as the GLTS with being the inductive type with six constructors , with being the inductive type with constructors , and

 f:X→Pfin(A×▹X)fx0={(ff,nextx1)}∪{(ff,nextx2)}fx1={(tt,nextx0)}∪{(ff,nextx2)}fx2={(tt,nextx0)}∪{(ff,nextx2)}fy0={(ff,nexty1)}fy1={(ff,nexty1)}∪{(tt,nexty2)}fy2={(ff,nexty1)}

One is typically interested in final semantics, i.e. all possible runs, or processes, of a certain GLTS. These are obtained by unwinding a GLTS starting from a particular state. In categorical terms, the type of processes is given by the final coalgebra of the functor , which can be defined in TCTT as a guarded recursive type using the fixpoint operation:

 Proc=fixX.Pfin(A×▹(α:T).X[α]).

Note that the mapping of to has type because the universe is closed under and finite powersets as assumed above. As was the case for the guarded streams example of Section 3, the fixed point path induces an equivalence of types witnessed in one direction by , and thus is a GLTS.

Given a GLTS , the process associated to a state is defined as the map defined using the final coalgebra property of Proposition 3.2. In the case of Example 5.1 it is also possible to define the processes associated to the GLTS  directly via mutual guarded recursion, without using the evaluation function . We can do this since the type is inductively defined.

###### Example 5.2 (continues=ex:lts).

Let and be the elements of type given as follows:

 \omit\span\omitps=fixzs.(fold({(ff,▹π1zs)}∪{(ff,▹π2zs)}),fold({(tt,▹π0zs)}∪{(ff,▹π2zs)}),fold({(tt,▹π0zs)}∪{(ff,▹π2zs)}))\omit\span\omitqs=fixzs.(fold{(ff,▹π1zs)},fold({(ff,▹π1zs)}∪{(tt,▹π2zs)}),fold{(ff,▹π1zs)})

We define and , for . Using the fixed point operator, one can prove that the processes and are path equal, and similarly the process and are path equal. For this, let , and assume . Then

 p0≡fold({(ff,nextp1)}∪{(ff,nextp2)})≡fold({(ff,next⟦x1⟧)}∪{(ff,next⟦x2⟧)})≡⟦x0⟧

where the middle path is obtained by first applying to to produce a term in , then using the extensionality principle (4) for to give an element in . Analogously, one constructs a path between and .

Similarly, one shows that and are path equal to and . Piecing these proofs together we get an inhabitant of , and thus