Partiality, State and Dependent Types Kasper Svendsen 1 , Lars Birkedal 1 , and Aleksandar Nanevski 2 1 IT University of Copenhagen {kasv,birkedal}@itu.dk 2 IMDEA Software aleks.nanevski@imdea.org Abstract. Partial type theories allow reasoning about recursively-defined computations using fixed- point induction. However, fixed-point induction is only sound for admissible types and not all types are admissible in sufficiently expressive dependent type theories. Previous solutions have either introduced explicit admissibility conditions on the use of fixed points, or limited the underlying type theory. In this paper we propose a third approach, which supports Hoare- style partial correctness reasoning, without admissibility conditions, but at a tradeoff that one cannot reason equationally about effectful computations. The resulting system is still quite expressive and useful in practice, which we confirm by an implementation as an extension of Coq. 1 Introduction Dependent type theories such as the Calculus of Inductive Constructions [2] provide powerful languages for integrated programming, specification, and verification. However, to maintain soundness, they typically require all computations to be pure and terminating, severely limiting their use as general purpose program- ming languages. Constable and Smith [9] proposed adding partiality by introducing a type τ of potentially non- terminating computations of type τ , along with the following fixed point principle for typing recursively defined computations: if M : τ →τ then fix(M ): τ Unfortunately, in sufficiently expressive dependent type theories, there exists types τ for which the above fixed point principle is unsound [10]. For instance, in type theories with subset-types, the fixed point principle allows reasoning by a form of fixed point induction, which is only sound for admissible predicates (a predicate is admissible if it holds for the limit whenever it holds for all finite approximations). Previous type theories based on the idea of partial types which admit fixed points have approached the admissibility issue in roughly two different ways: 1. The notion of admissibility is axiomatized in the type theory and explicit admissibility conditions are required in order to use fix. This approach has, e.g., been investigated by Crary in the context of Nuprl [10]. The resulting type theory is expressive, but admissibility conditions lead to significant proof obligations, in particular, when using Σ types. 2. The underlying dependent type theory is restricted in such a way that one can only form types that are trivially admissible. This approach has, e.g., been explored in recent work on Hoare Type Theory (HTT) [21]. The restrictions exclude usage of subset types and Σ types, which are often used for expressing properties of computations and for modularity. Another problem with this approach is that since it limits the underlying dependent type theory one cannot easily implement it as a simple extension of existing implementations. In this paper we explore a third approach, which ensures that all types are admissible, not by limiting the underlying standard dependent type theory, but by limiting only the partial types. The limitation on partial types consists of equating all effectful computations at a given type: if M and N are both of type τ , then they are propositionally equal. Thus, with this approach, the only way to reason about effectful computations is through their type, rather than via equality or predicates. With sufficiently expressive types, the type of an effectful computation can serve as a partial correctness specification of the computation. Our hypothesis is that this approach allows us to restrict attention to a subset of admissible types, which is closed under the standard dependent type formers and which suffices for reasoning about partial correctness.