ACM Trans. Program. Lang. Syst., Vol. 41, No. 4, Article 22, Publication date: October 2019.
DOI: https://doi.org/10.1145/3350618
Environmental bisimulations for probabilistic higher-order languages are studied. In contrast with applicative bisimulations, environmental bisimulations are known to be more robust and do not require sophisticated techniques such as Howe's in the proofs of congruence.
As representative calculi, call-by-name and call-by-value $\lambda$-calculus, and a (call-by-value) $\lambda$-calculus extended with references (i.e., a store) are considered. In each case, full abstraction results are derived for probabilistic environmental similarity and bisimilarity with respect to contextual preorder and contextual equivalence, respectively. Some possible enhancements of the (bi)simulations, as “up-to techniques,” are also presented.
Probabilities force a number of modifications to the definition of environmental bisimulations in non-probabilistic languages. Some of these modifications are specific to probabilities, others may be seen as general refinements of environmental bisimulations, applicable also to non-probabilistic languages. Several examples are presented, to illustrate the modifications and the differences.
ACM Reference format:
Davide Sangiorgi and Valeria Vignudelli. 2019. Environmental Bisimulations for Probabilistic Higher-order Languages. ACM Trans. Program. Lang. Syst. 41, 4, Article 22 (October 2019), 64 pages. https://doi.org/10.1145/3350618
The article investigates techniques for proving behavioural equivalence in higher-order probabilistic languages. Checking computer programs for equivalence is a crucial, but challenging, problem. Equivalence between two programs generally means that the programs should behave “in the same manner” under any context. Specifically, two $\lambda$-terms are contextually equivalent if they have the same convergence behaviour (i.e., they do or do not terminate) in any possible context [32].
Due to the universal quantification on the contexts of the language, it is generally hard to prove that two terms are contextually equivalent. Such proofs are particularly hard to carry out if the language under consideration has higher-order features, which allow contexts to copy and pass around terms.
Bisimulation [34, 43] offers a powerful operational method for proving equivalence of programs in various kinds of languages, relying on the coinduction proof principle. To qualify as a proof method, bisimulation relations should be sound with respect to contextual equivalence, i.e., they should induce an equivalence relation—bisimilarity—that implies contextual equivalence. Ideally, bisimilarity should be fully abstract with respect to contextual equivalence, i.e., coincide with it.
Bisimulation has been studied in depth in deterministic $\lambda$-calculi, e.g., [2, 17, 27, 38, 41]. In contrast, so far, it has been little explored in probabilistic $\lambda$-calculi, mainly in the form of applicative bisimilarity [8, 11] for the pure call-by-name and call-by-value languages.
Applicative bisimulations are known, however, to have some significant limitations. First, they do not scale very well to languages richer than the pure $\lambda$-calculus. For instance, they are unsound under the presence of references, or even just generative names, or data abstraction; see [24] for an enlightening discussion. Second, congruence proofs of applicative bisimulations are notoriously hard. Such proofs usually rely on Howe's method [19], which is, however, fragile outside the pure $\lambda$-calculus. Related to the problems with congruence are also the difficulties of applicative bisimulations with “up-to context” techniques (the usefulness of these techniques in higher-order languages and its problems with applicative bisimulations have been studied by Lassen [27]; see also [26, 39, 41]).
To relieve this burden, environmental bisimulations have been proposed [45], refining earlier proposals in [1, 7, 23, 26, 48]. The distinguishing feature of these bisimulations is that the pairs of tested terms are enriched with environments, that intuitively collect the observer's knowledge about values computed during the bisimulation game. The elements of the environment can be used to construct terms to be supplied as inputs during the bisimulation game. The notion has been applied to a variety of languages, including pure $\lambda$-calculi [45, 49], extensions of $\lambda$-calculi [3, 4, 25, 26, 48], or languages for concurrency or distribution [35, 36, 46]. In environmental bisimulations the proof of congruence goes by induction over the structure of contexts, as in proofs for first-order languages. For this, a “small-step” reduction relation is more handy than a “big-step” reduction: the former allows one a tight control over the syntax of the contexts, which is harder with the latter, because in a higher-order language contexts may arbitrarily grow during reduction; moreveor, the former is better suited to bisimulation enhancements of the “up-to techniques” (earlier forms of environmental bisimulation, e.g., References [48, 49], place a mild emphasis on up-to techniques and follow the big-step tradition of the $\lambda$-calculus).
With probabilities, the drawbacks of applicative bisimilarity are magnified: full abstraction with respect to contextual equivalence may fail also in a pure $\lambda$-calculus, and Howe's technique has to be enriched with non-trivial “disentangling” properties for sets of real numbers, these properties themselves proved by modeling the problem as a flow network and then applying the Max-flow Min-cut Theorem.
In this article, our goal is understanding environmental bisimulations in probabilistic higher-order languages. As representative calculi, we consider call-by-name and call-by-value $\lambda$-calculus, and a (call-by-value) $\lambda$-calculus extended with higher-order references. The computation is made probabilistic by endowing these calculi with a primitive for binary, fair, probabilistic choice. In each case, we derive full abstraction results for probabilistic environmental similarity and bisimilarity with respect to the contextual preorder and contextual equivalence, respectively. Below, we discuss the main differences of our proposals in comparison with ordinary (i.e., non probabilistic) environmental (bi)simulations.
Static and dynamic environments. In ordinary environmental bisimulation the values produced during the bisimulation game are placed into the environment, so that the observer can later play them at will during the bisimulation game. This schema is irrespective of the evaluation strategy (call-by-name or call-by-value), and is the distinguishing feature of environmental bisimulations over the applicative ones. “Playing a term” means copying it. However, in the $\lambda$-calculus the copying possibilities for call-by-name and call-by-value are quite different. In call-by-name, evaluation only occurs in functional position and therefore the term resulting from the evaluation may not be copied. In call-by-value, in contrast, a term may be evaluated also in argument position, and then given as input to a function; thus copying is possible also after evaluation. The different copying behaviour is well visible, for instance, in linear logic interpretations of call-by-name and call-by-value [29].
Now, the semantics of probabilistic languages is sensitive to the copying operation; for instance the probability of success of an experiment, if non-trivial, may be lowered by playing the experiment several times. This has a strong impact on behavioural equivalences for call-by-name and call-by-value in probabilistic $\lambda$-calculi. As an example, using $\Omega$ for a purely divergent term and $\oplus$ for the binary, fair, probabilistic choice operator,
To be able to express such behavioural differences, in our environmental bisimulations the values produced during the bisimulation game are placed into the environment only in the call-by-value case. We call such a value environment a dynamic environment, because it may grow during the bisimulation game. It is precisely the use of the dynamic environment that allows us to separate the two terms $A$ and $B$ above. In probabilistic call-by-name, dynamic environments would break full abstraction for contextual equivalence. The only environment for call-by-name is static. The static environment for two compared objects $F,G$ is a pair of $\lambda$-terms $M,N$, which are, intuitively, the initial $\lambda$-terms from which, using evaluation and interaction according to the bisimulation game, the objects $F,G$ have been derived. This (small) static environment is sufficient to ensure that the congruence proof of the bisimilarity remains in the style of ordinary environmental bisimulation (i.e., it does not require sophisticated techniques such as Howe's). In short, the static environment reflects the copying possibility for terms before evaluation, whereas the dynamic environment reflects the copying possibility for values resulting from evaluation.
Formal sums. In our probabilistic relations the objects compared are not plain $\lambda$-terms but formal sums, that are the objects produced by the semantics of a term. These are, intuitively, syntactic representations of probability distributions. As a consequence, environments are not just tuples of values, but formal sums of tuples of values. To see why related objects must be formal sums, consider again the terms $A$ and $B$ in (1): our environmental bisimulation for call-by-name equates $A$ and $B$ by relating $A$ and the formal sum resulting from the evaluation of $B$. None of the components of the formal sum, $\lambda x. x$ and $ \lambda x. \Omega$, could separately be related with $A$. (A form of bisimulation on formal sums, namely, a probabilistic version of logical bisimulation, is already defined in Reference [11] for call-by-name; its drawbacks are discussed in Section 6.)
In pure call-by-value $\lambda$-calculus, full abstraction for contextual equivalence would also hold without formal sums (i.e., relating plain $\lambda$-terms), for the same reason why, in the same language, applicative bisimilarity on plain terms is fully abstract [8]. We do not pursue this simplification of environmental bisimulations, because it would be unsound in extensions of the calculus. For instance, consider the following terms of a probabilistic $\lambda$-calculus with store (again, an instance of distributivity):
To place $H$ and $K$ in a bisimulation, $H$ has to be related with the formal sum obtained from the evaluation of $K$; again, the single components alone would be distinguished. Once more, this is a copying issue, due to the possibility of copying terms but not stores.
Big-step reduction, term closure, and congruence proof. To achieve full abstraction, in the probabilistic case the bisimulation clauses have to use a big-step, rather than a small-step, reduction relation. Precisely, we give finitary big-step approximants from which the semantics of a term is obtained via a least-fixed point construction (a similar semantics is in Reference [12]). The reason, intuitively, is that while in pure $\lambda$-calculi a term converges (i.e., it terminates its computation) in a finite number of reductions, in the probabilistic calculi there may be several terminating computation paths, in which the total number of reductions need not be finitary. An example is given by the terms
When the reduction relation is small-step (as in the ordinary environmental bisimulations in [45]) the related terms need not be values, because a normalizing term need not produce a value in a single step and bisimulations must be closed under the reduction adopted. In contrast, as our environmental bisimulations are big-steps, the bisimulation game may be confined to values.
A more significant consequence of the adoption of big-step reductions is that the induction over contexts in the proofs of congruence for ordinary environmental bisimulations is replaced by an induction on the number of small-step reductions with which a big-step approximant is derived (possibly coupled with an induction on the size of a context), combined with two levels of continuity arguments. One level stems from the least fixed point construction employed in the definition of the infinitary big-step semantics on terms. The second level stems from a characterization of bisimilarity as the kernel of the similarity preorder and, in turn, as the kernel of a finitary similarity in which (on the challenger side) the big-step reduction relation employed is finite. The proof of the characterization with the finitary similarity makes use of least fixed-points via a saturation construction on formal sums where, intuitively, a formal sum is better than another formal sum if the former conveys more accurate probabilistic information than the latter.
Up-to techniques. Our proofs and examples rely on a few enhancements of the bisimulation proof method (“bisimulations up-to”), some of which are extensions of common (bi)simulation enhancements, others are specific to probabilistic calculi. An example of the latter is “simulation up-to lifting,” whereby it is sufficient, in the coinductive game, that two derivative formal sums are in the probabilistic lifting of the candidate relation, rather than in the candidate relation itself.
While the bisimulations act on formal sums and use infinitary big-step reductions to values, we also explore coinductive games played on plain $\lambda$-terms and on finitary multi-step reductions to terms (not necessarily values) as sound proof techniques. In particular, we combine these with up-to context, so to be able to compare terms in the middle of their evaluation when a common context can be isolated and removed.
Structure of the article. Section 2 introduces some general definitions and notations for the article. Section 3 presents environmental bisimulations for pure call-by-name, establishes basic properties, including full abstraction for bisimilarity and similarity, and develops various up-to techniques. Section 4 considers pure call-by-value, and Section 5 an extension with ML-like references. Section 6 discusses additional related work, and Section 7 concludes, also mentioning possible future work.
We introduce general notations and terminologies for the article. Familiarity with standard terminologies (such as free/bound variables and $\alpha$-conversion) is assumed.
We use meta-variables $M,N,P,Q,\ldots$ for terms, and $V,W,\ldots$ for values. We identify $\alpha$-convertible terms. We write for the capture-avoiding substitution of $N$ for $x$ in $M$. A term is closed if it contains no free variables. The set of free variables of a term $M$ is ${{\rm \sf {fv}}}(M)$. A context $ C$ is an expression obtained from a term by replacing some subterms with holes of the form $[\cdot ]_{i}$, where for every $i$ there can be multiple occurrences of hole $[\cdot ]_{i}$. We write $ C [M_1,\ldots ,M_n] $ for the term obtained by replacing each occurrence of $[\cdot ]_{i}$ in $ C$ with $M_i$.
We use a tilde to denote a tuple; for instance $\widetilde{M}$ is a tuple of terms, and $(\widetilde{M})_{i}$ is its $i$th element. We write tuples as $\lbrace M_i \rbrace _{i \in I}$ when we want to emphasize the indexing set, and we sometimes abbreviate this as $\lbrace M_i \rbrace _{i}$, implicitly assuming that $i$ ranges over an index set $I$. All notations are extended to tuples componentwise. Hence, we often write $ C [\widetilde{M}] $ for $ C [M_1,\ldots ,M_n] $ and $\widetilde{M}{\mathcal {R}}\widetilde{N}$ for $(M_1{\mathcal {R}}N_1)\wedge \cdots \wedge (M_n{\mathcal {R}}N_n)$.
By default, the results and definitions in the article are (implicitly) stated for closed terms. They can be generalized to open terms in a standard way for bisimulations in $\lambda$-calculi [26, 45, 48]. Thus, the properties between open terms $M$ and $N$ are derived from the corresponding properties between the closed terms $\lambda \widetilde{x}.M$ and $\lambda \widetilde{x}.N$, for $\lbrace \widetilde{x}\rbrace \supseteq {{\rm \sf {fv}}}(M) \cup {{\rm \sf {fv}}}(N)$. The caveat is proving that any term $M$ with $\lbrace \widetilde{x}\rbrace = {{\rm \sf {fv}}}(M)$ is contextually equivalent to its $\beta$-expansion $(\lambda \widetilde{x}.M) \widetilde{x}$. This is done by defining the least congruence relating $N$ and $(\lambda y. N)y$, for any $N$, and then showing that such a relation is preserved by reduction. Adapting the technique, detailed in, e.g., References [26, 45, 48], to probabilistic $\lambda$-calculi is straightforward, also because both in References [26, 45, 48] and in the current article the reduction relation is “big-step” (the main difference is that the auxiliary congruence relation has to be extended to formal sums).
The pure $\lambda$-calculi will be untyped, whereas we will find types convenient to treat the extension with store.
The terms of the probabilistic $\lambda$-calculus are generated by the following grammar:
Value formal sums, ranged over by $Y,Z$ are formal sums in which the term of each summand is a value.
There is an obvious mapping from formal sums to distributions, whereby a formal sum $F$ yields the distribution in which the probability of a term $M$ is the sum of the weights with which $M$ appears in summands of $F$. The mapping is not injective: in general, infinitely many formal sums yield the same distribution (because of possible duplicates in the terms of the summands of a formal sum). For instance, ${ \frac{1}{2}};{M} + {\frac{1}{4}};{M}$ and ${\frac{3}{4}};{M}$ are two different formal sums that correspond to the same distribution assigning probability $\frac{3}{4}$ to term $M$ and probability 0 to any $N$ such that $N \ne M$.
We sometimes decompose formal sums using a lifting construction. If $F_{i}= \sum _{j \in J_{i}}{p_{i,j}};{M_{i,j}}$, for $i \in I$, then
If $ M \Longrightarrow \sum _{i \in I}{p_i};{M_i}$, then $I$ is finite, and each $i$ represents a “possible world” of the probabilistic run of $M$, with probability $p_i$ and outcome $M_i$. The subset of possible worlds in which $M_i$ is a value makes for an approximant of $M$, and from such approximants the semantics of $M$ is obtained. The definition of the semantics of a term as a supremum requires formal sums with infinitely many summands. As an example, consider the term $P$ defined in Equation (2) in the Introduction, whose semantics is $ \sum _{n \ge 1}{\frac{1}{2^{n}}};{Q}$.
Since value formal sums form an $\omega$-complete partial order with respect to the $\le _{{\rm {\tt apx}}}$ preorder, and for every $M$ the set of those value formal sums $Y$ such that is a countable directed set, the semantics of a term $M$ exists and is unique.
Relations $\Longrightarrow$ and are finitary in the sense that a derivation proof where one of such relations appears in the conclusion only contains a finite number of “small steps” (relation $\longrightarrow$). When reasoning by induction, sometimes we will need to make such number explicit, therefore writing $\Longrightarrow _n$ and , respectively.
Rule MulT, in contrast with MulFS, does not need a finitary condition on the indexing set, because a formal sum obtained in a small step from a term may have at most two summands.
If we define a semantics based on probability distributions, rather than on formal sums, then the definition of the multi-step reduction relation $F\Longrightarrow F$ from distributions to distributions becomes more subtle. In the corresponding rule in Figure 1,
Additional notation. We introduce here some additional notation, allowing us to easily manipulate terms and formal sums. This simplified notation is only used in the proofs of our results; in the rest of the article, we use the extended notation defined above. For $Y= \sum _{i}{p_{i}};{\lambda x. M_{i}}$ and $F= \sum _{i}{p_{i}};{M_{i}}$, we define:
In call-by-name, a probabilistic environmental relation is a set of elements each of which is of the form $ (M,N)$ or $((M,N),Y,Z)$, where $M,N,Y,Z$ are all closed, $M,N$ are $\Lambda _{\oplus }$-terms and $Y,Z$ value formal sums. Intuitively, in the former elements $M$ and $N$ are terms that we wish to prove equal, and in the latter elements $Y$ and $Z$ are value formal sums obtained from $M$ and $N$ via evaluations and interactions with the environment. We use ${\mathcal {R}},{\mathcal {S}}$ to range over probabilistic environmental relations. In a triple $((M,N),Y,Z)$ the pair component $(M,N)$ is the static environment, and $Y,Z$ are the tested formal sums. We write $\mathrel {{{\mathcal {R}}_{(M,N)}}}$ for the relation $\lbrace (Y,Z) \,\mid \,((M,N),Y,Z)\in {\mathcal {R}}\rbrace$; we accordingly use the infix notation $Y\mathrel {{{\mathcal {R}}_{(M,N)}}}Z$, and similarly for $M \mathrel {\mathcal {R}}N$. In the remainder of the article, when discussing probabilistic environmental relations, bisimulations, simulations, or similar, we abbreviate “probabilistic environmental” as “PE,” or even omit it when non-ambiguous. Static environments (that is, pairs of $\Lambda _{\oplus }$-terms) are ranged over by ${\mathcal {E}}$. If ${\mathcal {E}}= (M,N),$ then its context closure, written $\mathrel {{\mathcal {E}}^\star }$, is the set of all pairs of the form $(C [ M] , C [ N])$. We use a similar notation for the context closure of relations on $\lambda$-terms.
Our results would also hold admitting arbitrary sets of pairs of $\Lambda _{\oplus }$-terms as static environments, rather then single pairs. We have chosen single pairs so to bring up the minimal requirement on static environments for our proofs to hold (notably the congruence for bisimilarity).
A PE relation ${\mathcal {R}}$ is a (PE) bisimulation if
We write $\approx$ for (PE) bisimilarity, the union of all PE bisimulations.
While $\approx$ is a PE relation, we are ultimately interested in comparing $\lambda$-terms ($M\approx N$ if $M\, \mathcal {R}\,N$ for some bisimulation ${\mathcal {R}}$).
Using the additional notation defined in Section 3, we can write the bisimulation clauses for formal sums as follows:
We have
In Definition 3, and in the remainder of the article for other definitions of probabilistic bisimulation, the corresponding simulation is obtained by replacing the equality “$=$” on the weights with “$ \le$”; thus, in Definition 3, clause (2a) becomes $\sum _{i} p_{i} \le \sum _{j} q_{j}$.
The union of all simulations, similarity, is written .
The bisimilarity, or similarity, is directly defined using the semantics of terms, which is a least-fixed point on top of big-step approximants. When proving properties about bisimilarity and similarity, therefore, we need to reason about such approximants. For this, we introduce a finite-step simulation in which the challenge reductions of the simulation game employ the big-step approximants (the relation of Figure 1). We cannot have characterizations of bisimilarity in terms of a finite-step bisimilarity, because, in general, the weights of the approximants of two bisimilar terms are different, as shown in Example 8, and so we should allow related formal sums to have different weights. Hence, to reason about bisimilarity, we go through its characterization via similarity (Theorem 7), and then the characterization of similarity via the finite-step similarity (Corollary 12). In this case, since we are defining a preorder rather than an equivalence, we can allow related formal sums to have different weights.
Let $P$ and $Q$ be the terms discussed in Equation (2) in Section 1:
A PE relation $\, \mathcal {R}\,$ is a finite-step simulation if
We write for finite-step similarity. In finite-step simulations, the challenges are expressed by finitary reductions, since only a finite number of small-steps reductions $\longrightarrow$ can occur in the derivation of . Moreover, any result about finite-step similarity on $\Lambda _{\oplus }$-terms can be established using a finite-step simulation with only finite formal sums (i.e., formal sums with a finite number of summands) on the challenger side, though this constraint is not required in the definition. Indeed, finite formal sums can only reach finite formal sums via the finitary, multi-step relation.
We do not define clause (2b) of Definition 9 as follows:
since we would not know how to prove congruence, and thus soundness, for such proof technique. This is because, as the index set $I$, ranged over by $i$, can be infinite, the challenge in the simulation game might not be finitary, i.e., it could allow infinitely many summands to perform a small-step reduction at the same time. By contrast, reduction on formal sums (from Figure 1) is finitary. This allows us to perform proofs by induction on the number of small-steps in a reduction, which is the strategy we use for proving congruence (Lemma 18).
We denote by ${\tt Pairs}({\mathcal {R}})$ the set of pairs of terms in a PE relation $\, \mathcal {R}\,$. We use two saturation constructions to turn a simulation into a finite-step simulation and conversely. Given a PE relation ${\mathcal {R}}$, its saturation by approximants is
The saturation by suprema $\bigcup _{n} {\mathcal {R}}^{n}$ of a relation ${\mathcal {R}}$ is saturated with respect to triples $({\mathcal {E}},Y, Z)$ where $Y$ is the supremum of an $\omega$-chain $\lbrace Y_{i}\rbrace _{i \ge 0}$ with respect to $\le _{{\rm {\tt apx}}}$ such that there exists an $n$ such that for all $i$ it holds $Y_{i} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} Z$. However, the relation $ \bigcup _{n} {\mathcal {R}}^{n}$ is not itself saturated by suprema in the following sense. There might exist an $\omega$-chain $\lbrace Y_{i}\rbrace _{i \ge 0}$ with respect to $\le _{{\rm {\tt apx}}}$ such that for all $i$ it holds $Y_{i} (\,\bigcup _{n} {\mathcal {R}}^{n}_{{\mathcal {E}}}\,) Z$ (i.e., such that for all $i$ there exists an $n$ such that it holds $Y_{i} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} Z$), and yet it does not hold that $\sup \lbrace Y_{i}\rbrace _{i} (\,\bigcup _{n} {\mathcal {R}}^{n}_{{\mathcal {E}}}\,) Z$.
The proof of (1) follows from the definition of as the supremum of the set . For (2), the crux is proving by induction on $n$ that if $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$ then:
The details of the proof can be found in Appendix A.
The similarity and finite-step similarity preorders, and , coincide.
The result follows from Lemma 11 and from the fact that a simulation (respectively, a finite-step simulation) is included in its saturation by approximants (respectively, by suprema).
The following example highlights the differences between simulations and finite-step simulations, by proving the equality in Example 8 using finite-step simulations.
Terms $P$ and $Q$ of Example 8 can be proved equivalent by exhibiting the following finite-step simulations, where $Y_{0}\stackrel{{{{\rm {\tt def}}}}}{=}\emptyset$ and $Y_{m}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{1 \le n \le m}{\frac{1}{2^{n}}};{Q}$ for $m \ge 1$:
$\begin{array}{ll}\mathrel {\mathcal {R}}&\stackrel{{{{\rm {\tt def}}}}}{=}\lbrace (P,Q), ((P,Q), \emptyset , \emptyset)\rbrace \cup \lbrace ((P,Q), Y_{m}, {1};{Q})\,\mid \,m\ge 0\rbrace ,\\ \mathrel {\mathcal {S}}&\stackrel{{{{\rm {\tt def}}}}}{=}\lbrace (Q,P), ((Q,P), \emptyset , \emptyset), ((Q,P), {1};{Q}, \sum _{n \ge 1}{\frac{1}{2^{n}}};{Q}) \rbrace . \end{array}$
By ${\mathcal {R}}$, we have , and by ${\mathcal {S}}$, we have . Since the saturation constructions used in Lemma 11 allow us to freely move from simulations to finite-step simulations and vice versa, this is equivalent to showing that and , which in turn coincides with proving bisimilarity. Relation $\, \mathcal {R}\,$ can be turned into a simulation by saturating it by suprema, i.e., by adding the triple $((P,Q), \sup _{m}Y_{m}, {1};{Q})$. Indeed, we have . Conversely, we can obtain the finite-step simulation $\, \mathcal {R}\,$ out of the simulation
Given a relation $\, \mathcal {R}\,$, we say that $\, \mathcal {R}\,$ is saturated by approximants if for every pair $((M,N),Y,Z)$ in $\, \mathcal {R}\,$, if $Y^{\prime } \le _{{\rm {\tt apx}}}Y^{\prime }$ then $((M,N),Y^{\prime },Z) \in \, \mathcal {R}\,$. Example 13 also shows that finite-step simulations do not have to be saturated by approximants: relation $\mathrel {\mathcal {S}}$ is a finite-step simulation but it does not contain, e.g., the triple $((P,Q), {\frac{1}{4}};{Q}, {1};{Q})$. However, given a finite-step step simulation, we can always build a finite-step simulation saturated by approximants that contains it, by taking its saturation by approximants.
To derive the substitutivity properties of the similarity, and hence of the bisimilarity, we also need an up-to technique for the finite-step similarity. Specifically, we need an up-to lifting technique whereby, in the simulation game, two derivative formal sums can be decomposed into “smaller” formal sums and it is then sufficient that these are pairwise related. We write $\,{{\tt lift}}{({\mathcal {S}})}\,$ for the probabilistic lifting of a relation ${\mathcal {S}}$ to another relation on formal sums:
A PE relation $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting if
If $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting, then .
Let $\, \mathcal {R}\,$ be a finite-step simulation up-to lifting. Then $\mathrel {\mathcal {S}}$ is finite-step simulation:
If $M \mathrel {\mathcal {S}}N$ then $M \, \mathcal {R}\,N$, which implies that if then . Hence, .
Let $Y\mathrel {\mathcal {S}}_{(M,N)} Z$, i.e., $Y= \sum _{i}{p_{i}}{\cdot }{Y_{i}}$, $Z= \sum _{i}{p_{i}}{\cdot }{Z_{i}}$ and $Y_{i} \, \mathcal {R}\,_{(M,N)} Z_{i}$. For every $i$, ${{\tt weight}} (Y_{i}) \le {{\tt weight}} (Z_{i})$, hence ${{\tt weight}} (Y) \le {{\tt weight}} (Z)$.
For every $i$, we have implies by the definition of ${\mathcal {R}}$. Since implies that $Y^{\prime }= \sum _{i}{p_{i}}{\cdot }{Y^{\prime }_{i}}$, for some $Y^{\prime }_{i}$ such that , and , then . The result follows from $\,{{\tt lift}}{(\,{{\tt lift}}{(\, \mathcal {R}\,_{(M,N)})}\,)}\,=\,{{\tt lift}}{(\, \mathcal {R}\,_{(M,N)})}\,$.
Let $P\stackrel{{{{\rm {\tt def}}}}}{=}\lambda .Q$, $Q\stackrel{{{{\rm {\tt def}}}}}{=}\lambda .\Omega$, and
We have seen in Example 8 that the terms $P$ and $Q$ defined as
However, such a bisimulation would not be complete, since the same reasoning would not apply to the terms $M$ and $N$ defined below, where $R_{1} \stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. ((xx) \oplus \lambda . Q)$ and $R_{2} \stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. ((xx) \oplus Q)$:
We can now prove that is a precongruence on terms.
If then , for any context $C$.
Given a a finite-step simulation ${\mathcal {R}}$ saturated by approximants, we prove that the PE relation
Hence, (pre)congruence results for bisimilarity and similarity follow from Lemma 18, Corollary 12 and the fact that (Theorem 7).
On $\Lambda _{\oplus }$-terms, $\approx$ is a congruence, and a precongruence.
Let be the probability of termination of $M$.
$M$ and $N$ are in the contextual preorder, written $M\le _{{\rm {\tt ctx}}}N$, (respectively, in contextual equivalence, written $M =_{{\rm {\tt ctx}}}N$), if ${ C [M] \Downarrow } \le { C [N] \Downarrow }$ (respectively, ${ C [M] \Downarrow } = { C [N] \Downarrow }$), for every context $ C$.
We pointed out in Section 2 that all our definitions and results are for closed terms. The definitions above of contextual preorder and equivalence could actually be used also for open terms. In contrast, the definitions of simulations and bisimulations (and alike relations) are on closed terms only (they are extended to open terms by considering closing $\lambda$-abstractions, see the discussion in Section 2).
On $\Lambda _{\oplus }$-terms, .
We prove that the following is a simulation:
If $Y\mathrel {{\mathcal {R}}_{(M,N)}} Z,$ then and for some context $C$. Hence, for any $C^{\prime }$, we have and (we refer the reader to Appendix A for a proof of these properties) and by the definition of $\, \mathcal {R}\,$, we have .
On $\Lambda _{\oplus }$-terms:
Completeness of the simulation preorder holds by Lemma 22. The converse, i.e., soundness, follows from the fact that is a precongruence (Corollary 19) and that implies (by clause (2a) of simulation). Hence, implies implies .
Completeness and soundness for $\approx$ follow from (1) and the fact that $\approx$ (respectively, $=_{{\rm {\tt ctx}}}$) is the kernel of (respectively, $\le _{{\rm {\tt ctx}}}$), by item (3) of Theorem 7.
We have pointed out (Examples 5 and 8) that our simulations (and bisimulations) have to be based on formal sums and cannot employ finitary reductions, as in ordinary environmental bisimulations, to faithfully represent contextual equivalence. However, every one of these features is sound and can therefore be used in proof techniques. In this section, we show examples of such techniques. These techniques are very limited, and we leave for future work the development of more conclusive ones.
Finitary reductions—the possibility of stopping the evaluation of a term after a few $\beta$-reductions—are interesting in enhancements with up-to context (the ability of isolating and removing common contexts in derivative terms), because sometimes such common contexts appear in the middle of a reduction. For applicability, up-to context is usually combined with further up-to techniques that allow us to bring up the common contexts. In the first up-to technique, where the coinduction game still uses formal sums, we combine up-to context with up-to lifting, so to be able to decompose related formal sums into pieces with different common contexts. In the technique, the context closure of the up-to context is only applied onto $\lambda$-terms. The closure could probably be made more powerful by applying it also on formal sums, at the price of a more complex proof, but its usefulness is unclear.
In clause (2b) below, and in the remainder of the article, we use the function ${{\tt dirac}}$ that takes a set of pairs of $\lambda$-terms $(M,N)$ and returns the set of pairs of their (Dirac) formal sums $({1};{M}, {1};{N})$.
A PE relation $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting and context if:
The following lemma proves the soundness of the up-to lifting and context technique.
If $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting and context, then .
Let ${\mathcal {R}}$ be a finite-step simulation up-to lifting and context. We prove that
The up-to lifting and context technique allows us to prove that terms $A,B$ defined in Equation (1) in Section 1 are bisimilar. We prove using the PE relation
In the second up-to technique, the game is entirely played on terms, without appeal to formal sums. We present the technique in combination with forms of up-to context, up-to distribution, up-to reduction, and up-to lifting. This technique will allow us to prove the equivalence of two probabilistic fixed-point combinators in Section 3.4.
A term relation is a relation $\mathrel {{\mathcal {T}}_{(M,N)}}$ on values of $\Lambda _{\oplus }$ and the index $(M,N)$ is a pair of $\Lambda _{\oplus }$-terms. The index corresponds, intuitively, to a static environment of an environmental bisimulation. We use the notation $\mathrel {{\mathcal {T}}_{(M,N)}^{\star -}}$ for $\mathrel {{\mathcal {T}}_{(M,N)}} \, \cup \, \mathrel {\lbrace (M,N)\rbrace ^\star }$.
A term $M$ deterministically reduces to $G$ (notation: $\overset{\rm {d}}{\Longrightarrow }$) if $M \Longrightarrow G$ and only the last reduction in the sequence may be derived using rule Sum . We write if $M$ and $M^{\prime }$ deterministically reduce to the same formal sum, but $M^{\prime }$ takes fewer steps. That is, there are $G,m,m^{\prime }$ with $m \ge m^{\prime }$ and with $M \overset{\rm {d}}{\Longrightarrow }_{m} G$, and $M^{\prime } \overset{\rm {d}}{\Longrightarrow }_{m^{\prime }} G$ (where $\overset{\rm {d}}{\Longrightarrow }_{m}$ denotes as usual that $m$ “small steps” are performed, i.e., that $m$ reductions $\longrightarrow$ occur in the derivation of $\overset{\rm {d}}{\Longrightarrow }$). Thus, in Definition 27, is the set
Let $\mathrel {{\mathcal {T}}_{(M,N)}}$ be a term relation. Then, {(M,N)} is a bisimulation up-to context closure, distribution, reduction, and lifting if
We first establish the soundness of the up-to distribution and lifting technique. For a relation ${\mathcal {R}}$ on formal sums, we write ${{\tt dislift}}({{\mathcal {R}}})$ for the set of pairs $F, G$ such that $F\mathrel {=_{{\rm {\tt dis}}}}\,{{\tt lift}}{({\mathcal {R}})}\, \mathrel {=_{{\rm {\tt dis}}}}G$. The up-to distribution and lifting technique is obtained by substituting $\,{{\tt lift}}{(\cdot)}\,$ with ${{\tt dislift}}({\cdot })$ in definition 14.
If ${\mathcal {R}}$ is a finite-step simulation up-to distribution and lifting, then .
The proof follows as the one for the up-to lifting technique (Lemma 15), and exploits the fact that ${{\tt dislift}}({{{\tt dislift}}({\cdot })})={{\tt dislift}}({\cdot })$. Then, by exploiting this result, we can derive the soundness of the full technique in Definition 27. An environmental relation has two kinds of components, i.e., it contains pairs of terms and it contains triples, each containing a pair of terms and two formal sums. In a bisimulation up-to context closure, distribution, reduction, and lifting we have only allowed the first kind of component, and the soundness proof exhibits the missing triples (the proof can be found in Appendix A).
If there is a term relation $\mathrel {{\mathcal {T}}_{(M,N)}}$ such that $\lbrace (M,N)\rbrace$ is a bisimulation up-to context closure, distribution, reduction, and lifting, then $(M,N) \in {\approx }$.
The restriction to deterministic transitions $\overset{\rm {d}}{\Longrightarrow }$ (i.e., to transitions where only the last reduction in the sequence may be derived using rule Sum) in the definition of the up-to technique is used in the proof of soundness, to carry out an induction over the number of small-steps reductions.
The first clause of the up-to technique in Definition 27 is not sound if $\mathrel {{\mathcal {T}}_{(M,N)}}$ is substituted by $\mathrel {{\mathcal {T}}_{(M,N)}^{\star -}}$: in this case, for any pair of values $V,W$, relation $ \mathrel {{\mathcal {T}}_{(V,W)}} \stackrel{{{{\rm {\tt def}}}}}{=}\emptyset$ would satisfy the definition, since , and ${1};{V} \;{{\tt dirac}}{(\lbrace (V,W)\rbrace ^{{\star }})}\; {1};{W}$.
In the reductions of this example, we write a Dirac formal sum ${1};{M}$ as $M$, so to have reductions between $\lambda$-terms. We exploit the up-to technique of Definition 27 to prove the equivalence between two fixed-point combinators. One of the combinators is $\Upsilon$:
The other combinator at any cycle can probabilistically decide whether to behave differently (i.e., as Turing's fixed-point combinator) or to turn for good into the previous $\Upsilon$ combinator:
The example also shows the usefulness of static environments (whose terms need not be values) for context closures in “up-to context” techniques.
In call-by-value, the static environments are not anymore sufficient. As in ordinary environmental bisimulations, we need a dynamic environment to record the values produced during the bisimulation game. In ordinary environmental bisimulations, we can see such environments as tuples of values. In the probabilistic case formal sums come into the picture. Environment formal sums are terms of the form
More precisely, in the bisimulation game at each possible world $i$ a term $M_i$ (constructed from the $\widetilde{V}_i$’s using a context closure discussed below) is evaluated. The evaluation of $M_i$ yields, probabilistically, a multiset of values (as a formal sum). This multiset is empty when all evaluations from $M_i$ diverge; in this case the whole row $i$ disappears, meaning that in the $i$th possible world the observer never receives an answer. When the multiset is non-empty, the row $i$ is split into as many possible worlds as the values in the multiset. For instance, if the evaluation of $M_i$ produces $V$ with probability $ \frac{1}{2}$ and $V^{\prime }$ with probability $ \frac{1}{3}$, then the row $ {p_i};{\widetilde{V}_i}$ is split into the two rows $ { \frac{1}{2} \cdot p_i};{\widetilde{V}_i, V}$ and ${ \frac{1}{3} \cdot p_i};{\widetilde{V}_i, V^{\prime }}$.
This splitting operation is captured by the following multiplication of an environment formal sum $ \sum _{i\in I}{p_i};{\widetilde{V}_i}$ and a tuple of formal sums $Y_i = \sum _{j\in J_i}{p_{i,j}};{V_{i,j}}$:
The view of environment formal sums as matrices is illustrated in Figure 2, for an environment formal sum $ \mathbf {Y}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{1\le i\le 3}{p_i};{\widetilde{V}_i}$ of length 4. The figure also illustrates the extraction of the column $r$ of the formal sum, written , that yields the tuple of values along the same column, and the multiplication of an environment formal sum with formal sums resulting from the semantics of terms, one per row (where $\,\mathit {I}\,=\lambda x. x$ is the identity function).
The dynamic environment of two environment formal sums of the same length $ \sum _{i\in I}{p_i};{\widetilde{V}_i}$ and $ \sum _{j\in J}{q_j};{\widetilde{W}_j}$ is the pair of tuples (of tuples of the same length) $(\lbrace \widetilde{V}_{i}\rbrace _{i\in I}, \lbrace \widetilde{W}_{j}\rbrace _{j\in J})$. In environmental bisimulations, the input for two higher-order functions is constructed as the context closure of their environments. In call-by-value, the environments have both a static and a dynamic component and the inputs are constructed accordingly. Given a static environment $(M,N)$ and a dynamic environment $(\lbrace \widetilde{V}_{i}\rbrace _{i}, \lbrace \widetilde{W}_{j}\rbrace _{j})$, their context closure, written
The operational semantics of call-by-value is defined as in call-by-name, provided that the rule for $\beta$-reduction and the evaluation contexts are redefined thus:
In call-by-value, a probabilistic environmental relation (that we still abbreviate as PE relation) is like for call-by-name, except that formal sums are replaced by environment formal sums. That is, each element of the relation is either of the form $ (M,N)$ (a pair of $\Lambda _{\oplus }$-terms) or $\mathbf {Y}\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}\mathbf {Z}$ (two environment formal sums, collecting the dynamic environment, with a static environment).
If ${\mathcal {E}}=(M,N)$ is a static environment, then ${\mathcal {E}}_{1}$ and ${\mathcal {E}}_{2}$ denote the projections, i.e., the terms $M$ and $N$, respectively.
In a PE relation, related environment formal sums are compatible, meaning that they have the same length. In the remainder, compatibility of environment formal sums is tacitly assumed.
In clause (1) below, we see formal sums as special cases of environment formal sums.
A PE relation is a (PE) bisimulation if
(PE) bisimilarity, $\approx$, is the union of all PE bisimulations, and the corresponding similarity is .
The structure of the above definition is similar to that of ordinary environmental bisimulations. There are three main differences: first, the appearance of formal sums and of the probability measures (notably in clause (2a)); second, the use of an (infinitary) big-step semantics, rather than a small-step, which shows up in the function in clauses (1), (2b), and (2c); third, the appearance of a static environment, that is used in the context closure and in clauses (1) and (2c). In clause (2b), the related environment formal sums, viewed as matrices, grow by the addition of a new column resulting, on left-hand side, from the multiplication of each row ${p_i};{\widetilde{V}_i}$ with the formal sum , and similarly on the right-hand side. Thus, the compatibility between related environment formal sums is maintained. Clause (2c) allows to re-evaluate the static environment at any time. This clause and other features are necessary to achieve full abstraction in the imperative case (see Section 5.1); they could be removed in pure call-by-value, following Reference [8].
Clause (1) could be substituted by
where ${1};{\emptyset }$ is the Dirac formal sum with empty environment. Clause (2c) then guarantees that . We did not use this definition for continuity with the call-by-name case, and since it is not needed for pure calculi. By contrast, a modification of clause (1) analogous to ($1^{\prime }$) is used in Definition 42 of bisimulation for imperative calculi (see Example 43).
We have seen in Example 5 that the following terms $M$ and $N$ are equivalent in call-by-name:
We want the bisimulation to distinguish the terms in call-by-value, since $M$ and $N$ are not contextually equivalent in a call-by-value setting, in contrast with call-by-name. In call-by-value, the context $C\stackrel{{{{\rm {\tt def}}}}}{=}(\lambda x. x \,(x \,\lambda y.y)) [ \cdot ]$ separates the two terms. The context first evaluates the given term in argument position, and then copies the value resulting from the evaluation and executes it (i.e., feeds it with an argument) twice. We have that $C[M]$ has probability one half of returning a value, and $C[N]$ has probability a quarter. In the first case, both value $\lambda . \lambda . \Omega$ and value $\lambda . \Omega$ are copied with probability one half, and thus $C[M]$ has probability one half of converging (i.e., one half times the probability that $\lambda .\lambda .\Omega$ converges two times in a row when applied to an argument, which is one) and one half of diverging (i.e., one half times the probability that $\lambda . \Omega$ converges two times in a row when applied to an argument, which is zero). In $C[N]$, the term $N$ itself is copied with probability one, so $C[N]$ converges with probability one quarter (i.e., one times the probability that $N$ converges two times in a row when applied to an argument, which is one half times one half).
The main results for environmental bisimilarity and similarity in call-by-value (congruence and full abstraction with respect to contextual preorder and equivalence) are as for call-by-name, and the structure of the proofs is similar. The details are, however, different due to the presence of dynamic environments. As for call-by-name, so in call-by-value to reason about bisimilarity and similarity, we need a finite-step simulation, with challenges produced by the finitary big-step approximants. To make sure that the challenges are finite-step, we define extended environment formal sums, i.e., terms
Extended environment formal sums allow us to define the multi-step reduction relation from extended environment formal sums to environment formal sums: for $ \mathbf {F}= \sum _{i \in I}{p_{i}};{\widetilde{V}_{i}};{M_{i}} + \mathbf {G}$, where $I$ is a finite set, we set
Additional notation. As we shall now describe, we extend to (extended) environment formal sums the notations for $\beta$-reduction, contexts, and application on formal sums, and introduce a notation for extending the dynamic environments. We use $r$ to range over indexes of columns of environment formal sums, and we let $|\mathbf {Y}|$ denote the length of an environment formal sum $\mathbf {Y}$. Abusing notation, we sometimes write $|\mathbf {Y}|$ also for the index set $\lbrace 1,\ldots,|\mathbf {Y}|\rbrace$. Let $\mathbf {Y}= \sum _{i}{p_{i}};{\widetilde{V}_{i}}$ and $\mathbf {F}= \sum _{i}{p_{i}};{\widetilde{V}_{i}};{M_{i}}$ and $P$ be a term.
Using this notation, the call-by-value bisimulation clauses for environment formal sums become as follows:
As for call-by-name, we will use this additional notation only for proofs.
We first establish the basic properties of similarity and bisimilarity.
The proof follows analogously to call-by-name, except for transitivity (item (2)), which requires some modifications. Clause (2b) of (bi)simulation allows $M,N$ to be given as argument to functions (using context $C=[\cdot ]_{1}$) if and only if they are both values; thus, when one of them is not a value, we cannot use them as arguments. This prevents us from concluding that, given relations $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$ satisfying the simulation clauses, their relational composition is a simulation. Indeed, whenever $M,P$ are values and $N$ is not a value, we want to build a relation $\mathrel {\mathcal {S}}_{M,P}$ on environment formal sums such that the context $C=[\cdot ]_{1}$ can be applied in clause (2b). If $N$ is not a value, however, then the simulations $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$ do not allow us to use this context. The issue can be solved by noticing that whenever $M,P$ are values we can apply clause (2c) to $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$, which adds $M$ and $P$ as a column of the respective dynamic environments, and then allows us to use them as arguments. In other words, we have to work with a relation that allows environments to be extended with new columns. Adding columns is safe, because it means enlarging the dynamic environment: terms that are equal in the larger environment are also so in the smaller environment as the tests that can be built (when playing the bi-simulation game) with the latter environment are a subset of those that are obtained from the former environment. Define the following preorder $\le _{{\rm {\tt env}}}$ on pairs of formal sums (where, for each pair, the formal sums in the pair have the same length): $(\mathbf {Y},\mathbf {Z})$ are below formal sums $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if, in the second pair, the dynamic environment of the first pair is extended and the columns have been possibly permuted. Formally, $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{\widetilde{V}_{i}} , \mathbf {Z}= \sum _{j}{q_{j}};{\widetilde{W}_{j}},\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{\widetilde{W}^{\prime }_{j}}$ and for every index $r$ in $|\mathbf {Y}|$ there is an index $r^{\prime }$ in $|\mathbf {Y}^{\prime }|$ such that and . Let $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$ be relations on environment formal sums satisfying the simulation clauses. We show that relation $\mathrel {\mathcal {S}}_{(M,P)}\stackrel{{{{\rm {\tt def}}}}}{=}\ge _{{\rm {\tt env}}}(\mathrel {\mathcal {R}}_{(M,N)} \circ \mathrel {\mathcal {R}}^{\prime }_{(N,P)})$, that is
A PE relation is a finite-step simulation if
We write for the union of all finite-step simulations. Analogously to call-by-name, we use a saturation by approximants and a saturation by suprema to move from a simulation to a finite-step simulation and conversely, and exploit this to prove that similarity and finite-step similarity coincide.
Relations and coincide.
The proof follows as in call-by-name. We prove that the saturation by approximants of a simulation is a finite-step simulation and that the saturation by suprema of a finite-step simulation is a simulation. Clause (2c) is treated analogously to clause (2b).
As in call-by-name, we derive congruence for bisimilarity and similarity by first proving the property for finite-step similarity. We also exploit a combination of two up-to techniques for finite-step simulation, namely, up-to lifting and up-to environment. Up-to lifting is defined analogously to call-by-name, using the lifting operation on environment formal sums. Up-to environment is based on the preorder $\le _{{\rm {\tt env}}}$ on pairs of formal sums, as defined in the proof of Theorem 34, which allows us to exchange columns of environment formal sums (when these are viewed as matrices as in Figure 2) and to add new columns. In the up-to lifting and environment technique, we combine this preorder with the probabilistic lifting of a relation. Then, $\mathbf {Y}\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}({\mathcal {R}}))}\, \mathbf {Z}$ holds if there are $p_{i}$, $\mathbf {Y}_{i}$ and $\mathbf {Z}_{i}$, for $i$ ranging over some index set, such that $\mathbf {Y}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Y}_{i}}$ and $\mathbf {Z}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Z}_{i}}$, and for every $i$ there are $\mathbf {Y}^{\prime }_{i},\mathbf {Z}^{\prime }_{i}$ such that $\mathbf {Y}^{\prime }_{i} \mathrel {\mathcal {R}}\mathbf {Z}^{\prime }_{i}$ and $(\mathbf {Y}_{i},\mathbf {Z}_{i}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime }_{i},\mathbf {Z}^{\prime }_{i})$.
A PE relation is a probabilistic finite-step simulation up-to lifting and environment if:
We now prove that the up-to lifting and environment technique is sound.
If $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting and environment, then .
Let $\, \mathcal {R}\,$ be a finite-step simulation up-to lifting and environment. Then the following is a finite-step simulation:
Let $\mathbf {Y}\mathrel {\mathcal {S}}_{(M,N)} \mathbf {Z}$, i.e., $\mathbf {Y}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Y}_{i}}$, $\mathbf {Z}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Z}_{i}}$ and for every $i$ there are $\mathbf {Y}^{\prime }_{i} \mathrel {{\mathcal {R}}_{(M,N)}} \mathbf {Z}^{\prime }_{i}$ such that $(\mathbf {Y}_{i}, \mathbf {Z}_{i}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime }_{i}, \mathbf {Z}^{\prime }_{i})$.
Clause (a) holds, since for every $i$, ${{\tt weight}} (\mathbf {Y}_{i}^{\prime }) \le {{\tt weight}} (\mathbf {Z}_{i}^{\prime })$. Therefore, ${{\tt weight}} (\mathbf {Y}) \le {{\tt weight}} (\mathbf {Z})$.
To prove clause (b), suppose that . Then, $\mathbf {W}= \sum _{i}{p_{i}}{\cdot }{\mathbf {W}_{i}}$, for some $\mathbf {W}_{i}$ such that . Analogously, we have
Finally, clause (c) follows analogously to clause (b).
Having these up-to techniques, we derive the result by showing that the context closure (which, differently from call-by-name, is now applied both to terms and to the environments of formal sums) of a finite-step simulation saturated by approximants is a finite-step simulation up-to lifting and environment.
If then for every context $C$, we have .
We first define, for any pairs of terms $(M,N)$, the preorder $\le _{{\rm {\tt cce}}(M,N)}$ (context closure of environments) on pairs of environment formal sums: $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{\widetilde{V}_{i}}$, $\mathbf {Z}= \sum _{j}{q_{j}};{\widetilde{W}_{j}}$ with $|\mathbf {Y}|=|\mathbf {Z}|$, $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{\widetilde{V}^{\prime }_{i}}$, $\mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{\widetilde{W}^{\prime }_{j}}$ with $|\mathbf {Y}^{\prime }|=|\mathbf {Z}^{\prime }|$ and
Intuitively, these requirements corresponds to considering all finite subsets of the context closure of a relation: given formal sums $(\mathbf {Y},\mathbf {Z})$, related elements are columns of their environments that have the same indexes, and $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ expands $(\mathbf {Y},\mathbf {Z})$ (up-to permutation of columns of the pair) with columns that are obtained by filling the same context with related columns and with the static environment. The first requirement ensures that the original relation is included in the context closure, and the second requirement says that new elements are obtained by applying the same context.
Let $\, \mathcal {R}\,$ be a finite-step simulation saturated by approximants such that $M \mathrel {\mathcal {R}}N$. We can assume without loss of generality that this is the only pair of terms in ${\mathcal {R}}$ and that for any ${\mathcal {E}}$ such that $\, \mathcal {R}\,_{{\mathcal {E}}} \subseteq {\mathcal {R}}$, we have ${\mathcal {E}}=(M,N)$. We can also assume that $\mathrel {{\mathcal {R}}_{(M,N)}}$ contains all pairs in $\lbrace (\emptyset , \mathbf {Y})\,\mid \,\mathbf {Y}\text{ is an environment formal sum}\rbrace$, and that it contains the pair of Dirac formal sums with empty environment $({1};{\emptyset }, {1};{\emptyset })$, since these pairs trivially satisfy the finite-step simulation clauses.
Let $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\stackrel{{{{\rm {\tt def}}}}}{=}\le _{{\rm {\tt cce}}(M,N)}(\mathrel {{\mathcal {R}}_{(M,N)}})$, which in turn denotes the set
We assume $\emptyset \mathrel {\mathcal {R}}_{(M,N)} \mathbf {Z}$ for any $\mathbf {Z},$ since, for any $C$ that is not a value context, we have , so we want to derive .
Finally, relation $\, \mathcal {R}\,$ must be saturated by approximants, since, as showed in Example 13, a finite-step simulation need not be so, and it might contain, e.g., the triple $((P,Q),{\frac{1}{2}};{Q}+ { \frac{1}{4}};{Q},{1};{Q})$ but not the triple $((P,Q),{\frac{1}{4}};{Q},{1};{Q})$. However, if $C= \,\mathit {I}\,[\cdot ],$ then and it might be the case that there are no $\mathbf {Y},\mathbf {Z}$ such that $\mathbf {Y}\mathrel {{\mathcal {R}}_{(P,Q)}}\mathbf {Z}$ and $({\frac{1}{4}};{Q} , {1};{Q}) \le _{{\rm {\tt cce}}}(\mathbf {Y},\mathbf {Z})$.
The proof follows the same steps as the congruence proof for the imperative $\lambda$-calculus, and we thereby refer the reader to Appendix A, proof of Theorem 52.
The definitions of the contextual preorder and equivalence, $\le _{{\rm {\tt ctx}}}$ and $=_{{\rm {\tt ctx}}}$, are as for call-by-name.
If $M {\le _{{\rm {\tt ctx}}}} N,$ then .
We prove that the relation
To prove that $\, \mathcal {R}\,$ is a simulation, suppose that there are $M,N$ and $C$ such that $M \le _{{\rm {\tt ctx}}}N$, and . Let $\mathbf {Y}= \sum _{i}{p_{i}};{V^{i}_{1},\ldots,V^{i}_{n}}$ and $\mathbf {Z}= \sum _{j}{q_{j}};{W^{j}_{1},\ldots,W^{j}_{n}}$. We want to prove that for any $r \in \lbrace 1,\ldots,n\rbrace$ and for any context $C^{\prime \prime }$,
Then, by the definition of $\, \mathcal {R}\,$, for any context $C^{\prime }$,
This holds in particular for any context of the form $C^{\prime }=[\cdot ]_{r+1} C^{\prime \prime }$, for $r \in \lbrace 1,\ldots,n\rbrace$ and $C^{\prime \prime }$ a value-context, which implies the clause (b) of simulation on formal sums.
Clause (c) is proved using the same result, by taking $C^{\prime }=[\cdot ]_{1}$.
The first clause of simulation on formal sums follows, since $M \le _{{\rm {\tt ctx}}}N$ implies $C[M] \le _{{\rm {\tt ctx}}}C[N]$, which in turn implies .
On $\Lambda _{\oplus }$-terms:
In this section, we add imperative features, namely, higher-order references (locations), to the call-by-value calculus, along the lines of the languages in References [26, 45]. The syntax of terms and values is:
We use $s,t$ to range over stores, i.e., mappings from locations to closed values, and $l,k$ over locations. Then ${s} [ {l} \rightarrow {V}]$ is the update of $s$ (possibly an extension of $s$ if $l$ is not in the domain of $s$). The locations that occur in a term $M$ are ${\tt Loc}(M)$. We assume that the set of primitive operations contains the equality function on constants, and write $\tt unit$ for the unit value (i.e., the nullary tuple).
The language is typed—a simply typed system with recursive types—to make sure that the values in the summands of a formal sum have the same structure (e.g., they are all abstractions). We allow recursive types to maintain the peculiar possibility of probabilistic languages of having infinite but meaningful computation trees. Whenever possible, we omit any mention of the types. For instance, in any store update ${s} [ {l} \rightarrow {V}]$ it is intended that $V$ has the type appropriate for $l$; in this case, we say that the type of $V$ is consistent with that of $l$. We require that in a term $({\boldsymbol \nu } \,x\:{:=}\: M_1) {M_2}$, the variable $x$ cannot occur free in $M_{1}$. For similar reasons, we assume that the type syntax is constrained in some way that ensures that for any location type $\text{Ref} \,T$ there exists a closed location-free term $M$ with type $T$. There are various ways of achieving this—the specific syntax is not relevant for this work.
In examples, $M_{1} \,\underline{{\tt seq}}\; M_{2}$ denotes term $(\lambda . M_{2}) M_{1}$, i.e., the execution of ${M_{1}}$ and $M_{2}$ in sequence. Reduction is defined on terms with a store, i.e., configurations of the form $\langle s \,;\,M\rangle$; hence such configurations appear also in formal sums (where we omit brackets). The small-step reduction and the evaluation contexts are defined in Figure 3, where we assume that the semantics of primitive operations (which take as input $n$ terms of ground type and return a ground type term) is already given by the function ${\tt Prim}$. The rules for the semantic mapping, , and the multistep reductions relations, $\Longrightarrow$ and , remain those of Figure 1, with the addition of a store. In all semantic rules, any configuration $\langle s \,;\,M\rangle$ is well-formed, in that $M$ is closed and all the locations in $M$ and $s$ are in the domain ${{{\rm \sf {dom}}}}(s)$ of $s$. As in the previous calculi, it is easy to check that the semantics of a term exists and is unique.
Notations and terminology for (environment) formal sums are adapted to the extended syntax in the expected manner. We only recall the multiplication of an environment formal sum $\mathbf {Y}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}}$ and formal sums $Y_{i}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{j \in J_{i}}{p _{i,j}};{s_{i,j};V_{i,j}},$ which is defined as
An environment formal sum now has not only a specific length, but it also has an associated sequence of types of that length. These types are the types of the terms in the corresponding columns, i.e., all terms in have the $r$th type in the type sequence associated to $\mathbf {Y}$. In the definition of dynamic environment, we then assume that the pairs of environment formal sums have not only the same length but also the same associated sequence of types. The context closure of an environment, $(\lbrace M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, is defined as in the previous section, but now contexts are location-free, i.e., no locations occur in the contexts. This constraint, standard in environmental bisimulations for imperative languages, ensures well-formedness of the terms, and is not really a limitation, because locations may occur in terms of the environments and may thus end up in the terms of the context closure. Hence, restricting to location-free values in the bisimulation game makes the proof technique simpler while maintaining full abstraction results with respect to contextual equivalence, which allows arbitrary contexts (Section 5.2).
The notion of environmental relation is modified to accommodate stores, which are needed to run terms. The elements of an environmental relation are now well-formed pairs of configurations $(\langle s \,;\,M\rangle , \langle t \,;\,N\rangle)$ or well-formed triples,
Since locations could occur in the terms we want to prove equivalent, we parametrize bisimulations with respect to a set $\lbrace \widetilde{l}\rbrace$ of locations so that the pairs of terms in the relation must have stores with domain $\lbrace \widetilde{l}\rbrace$. This allows us to put these locations in the dynamic environment of the relation (clause (1)), which reflects the fact that the locations occurring in the terms are public (i.e., contexts can access them). In what follows, when we write $\lbrace \widetilde{l}\rbrace$, we assume that no repetitions of the same location occur in the sequence $\widetilde{l}$. For a pair $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$ of (tuples of) stores, we say that locations $(\lbrace l_{i}\rbrace _{i}, \lbrace k_{j}\rbrace _{j})$ are $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$ -fresh if for every $i,j$, we have $l_{i} \not\in {{{\rm \sf {dom}}}}(s_{i})$ and $k_{j} \not\in {{{\rm \sf {dom}}}}(t_{j})$.
A PE relation is a (PE) $\lbrace \widetilde{l}\rbrace$-bisimulation if
We let $\approx ^{\lbrace \widetilde{l}\rbrace }$ denote the union of all $\lbrace \widetilde{l}\rbrace$-bisimulations.
With respect to the definition for pure call-by-value, the definition above has the additional ingredient of the store, and of clauses (2c) and (2d) to deal with the case in which the values are locations: (2c) gives an observer the possibility of reading and writing the store and (2d) the possibility of extending the store with fresh locations. Clause (2f) adds all elements of a tuple to the dynamic environment. These aspects are similar to those in ordinary environmental bisimulations for imperative languages [24, 45].
Three further aspects, however, are new. First, by clause (2e), related environment formal sums should be first-order consistent, meaning that corresponding columns of constants should contain exactly one constant. This constraint is a consequence of the equality test on constants in the language. To ensure that first-order consistency is maintained in the bisimulation game, most of the clauses use a lifting construction. Thus, when the evaluation of first-order terms may probabilistically yield different constants, lifting allows us to separate the final possible worlds according to the specific constants obtained (since the semantics of a term might be a formal sum assigning non-zero probability to infinitely many different constant, the definition of lifting must allow for a possibly infinite index set to ensure first-order consistency). This constraint is further discussed in Examples 46 and 47. A second new aspect is that, since the effect of the evaluation of the terms in the static environment may change depending on the current store, clauses (1) and (2g) allow us to derive a congruence result for arbitrary terms (not necessarily values), as illustrated in the example below. Finally, we parametrize the relation with a set of locations to deal with terms where (public) locations may occur.
If the domains of the stores are empty, then we can consider bisimulations parametrized by the empty set of locations, and in clause (1), we will have empty sequences of values in the dynamic environment. Anyway, clause (2g) can be applied independently of the presence of values in the dynamic environment.
In what follows, we sometimes omit any reference to the set of locations parametrizing the relation, and simply refer to (bi)simulations and (bi)similarity when the parametrizing set is not relevant.
Let $M\stackrel{{{{\rm {\tt def}}}}}{=}l:=1$ and $N\stackrel{{{{\rm {\tt def}}}}}{=}\:{{\rm {\tt if}}}\:\ !l=0\ \:{{\rm {\tt then}}}\:\ l:=1\ \:{{\rm {\tt else}}}\:\ \Omega$. Without the static environment, terms $\langle l=0 \,;\,M\rangle$ and $\langle l=0 \,;\,N\rangle$ are bisimilar. However, they are not contextually equivalent: if $C\stackrel{{{{\rm {\tt def}}}}}{=}[\cdot ] \,\underline{{\tt seq}}\; [\cdot ]$, then $\langle l=0 \,;\, C [M] \rangle$ terminates whereas $\langle l=0 \,;\, C [N] \rangle$ does not. This aspect is determined by the store, probabilities do not really matter. Ordinary environmental bisimulations do not have a static environment, and cannot therefore test repeated runs of given terms that are not values; as a consequence $M$ and $N$ are equated, and bisimulation is not fully substitutive on arbitrary terms (see Reference [45, Section 5.2]).
Clause (1) is also modified with respect to pure call-by-name and call-by-value calculi. Indeed, if we defined the clause as
Even if we make the location $l$ public by starting the bisimulation game from terms $(M,l)$ and $(N,l)$ and by exploiting clause (2f), to allow contexts to use the location (as in Reference [45, Theorem 5.10]), we still have $\langle l=0 \,;\,(M,l)\rangle$ and $\langle l=0 \,;\,(N,l)\rangle$ bisimilar, since .
Hence, clause (1) ensures that location $l$ is actually put in the dynamic environment, so that we can use clause (2c) to change the value of $l$ and then evaluate again $M$ and $N$ using clause (2g).
The following examples are meant to further illustrate and motivate the form and the clauses of our bisimulation. The examples only use boolean and integer locations, and we accordingly assume that all locations in the language are of these types. Higher-order locations would not affect the essence of the examples and would complicate the description of the required bisimulations due to the possibility of extending the store (clause (2d)). (The full abstraction results will not rely on the existence of locations of specific types.) Moreover, since the terms compared always have the same locations, we assume that fresh locations for the extensions of the store are the same on both sides. If not specified otherwise, then we also assume that thunks take arguments of unit type.
Example 44 shows that in imperative call-by-value, in contrast with pure call-by-value, to achieve full abstraction it is necessary to define bisimulation on formal sums rather than on terms.
We have explained in Section 1 why the terms
Finally, we add to the relation the triple $((H,K), {1};{s;\emptyset }, {1};{s;\emptyset })$, where $\emptyset$ denotes the empty dynamic environment, to satisfy clause (1) of Definition 42. Clause (2g) is handled appealing to item (b). The most interesting case is the bisimulation clause (2b) applied to a column $r$ of functions that satisfy item (b). The result of the evaluation of such functions (with $\tt unit$ as argument) is that $l$ is set to 1 and then ${\tt true}$ and ${\tt false}$ are returned, with the same probability. Using the lifting construction, we can now split the possible worlds in which ${\tt true}$ has been produced and those in which ${\tt false}$ has been produced, yielding two pairs of environment formal sums, both of which are in the bisimulation (note that the lifting splits the original column $r$ so that the corresponding column in the two final pairs satisfies item (a) above).
In this work, we sometimes view environment formal sums as matrices (Figure 2). This, however, is only for representation convenience: our environments are tuples of rows (each row representing a possible world originated by the probabilistic evaluation of terms), rather than tuples of columns, that is, tuples of formal sums. The next example shows that if the environments were tuples of formal sums, where formal sums are added to the environment following the evaluation of terms during the bisimulation game, then bisimilarity would not be complete. Intuitively, this happens because the histories of different possible worlds would not be anymore separated and could interfere.
Let
Terms $A$ and $B$ create a new location and allow the reading capability on it in the subterm $L$. The writing capability, in contrast, exists only in the subterm $M$ of $A$. A behaviour from $A$ that could not be mimicked with $B$ is the run of $M$, where 1 is assigned to the location $x$, followed by a run of $L$, where $x$ is read and 1 is emitted (with $B$, any value produced by $L$ would be 0). This behaviour, however, is impossible, because $L$ and $M$ are in a probabilistic choice and are therefore obtained in two distinct possible worlds, in one of which $x$ can only be read, in the other $x$ can only be written. Moreover, the writing capability alone is irrelevant, because the location is private; hence it can be omitted from $M$, resulting in the term $N$ that appears in $B$. Indeed, $A$ and $B$ are contextually equivalent.
However, the “wrong” behaviour above for $A$ could be reproduced in the bisimulation if the environments were tuples of formal sums (that is, all possible worlds have the same environment, made of formal sums). The formal sum obtained by the evaluation of $A$, with summand terms $L$ and $M$, would be stored in the environment and could then be executed several times, with possible interleaving of evaluations of $L$ and $M$. (The example could be made more complex to obtain a ‘wrong’ behaviour from the execution of two different formal sums in the environment, rather than by multiple executions of the same formal sum.)
With our bisimulation, we can prove $A,B$ equal using a relation composed by $(A,B)$ (for simplicity, we leave out the store) and by all triples $((A,B), \mathbf {Y},\mathbf {Z})$ where the environment formal sums $\mathbf {Y}={1};{s;V_{1},\ldots,V_{n}}$ and $ \mathbf {Z}={1};{t;W_{1},\ldots,W_{n}}$ are first-order consistent, and for each column $r$ that does not contain constants one of the following holds:
The proof that this relation is a bisimulation crucially exploits the lifting construction. For instance, using (a) and (b) one shows that the semantics of $A$ and $B$ are in the lifting of the relation, and similarly one proceeds when handling clause (2g) of the bisimulation.
The main purpose of the lifting construct in Definition 42 of environmental bisimulation is to maintain the first-order consistency of related environment formal sums. One may wonder whether something simpler would suffice, namely, avoiding the lifting construct altogether and simply requiring that, whenever two first-order terms are evaluated, the probability of obtaining a given constant is the same on both sides (and thus maintaining first-order consistency by avoiding the addition of such values onto the dynamic environments). The example below shows that this would be unsound.
We compare the terms $A\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) (M,N_1)$ and $B\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) (M,N_2),$ where
We explain why, intuitively, bisimilarity would equate $A$ and $B$ if, on constants, bisimulation simply checked the probabilities of obtaining each constant (rather than employing the lifting construction). The evaluation of (the body of) produces ${\tt true}$ or ${\tt false}$, with the same probability $ \frac{1}{2}$ and with $l,$ respectively, set to 1 and 2. Then the only meaningful observation is the evaluation of the values . This means evaluating the formal sums
The terms $A$ and $B,$ however, are not contextually equivalent, because distinguished by a context $C$ that evaluates and then proceeds with the evaluation only when the outcome from was ${\tt true}$. Now, $ C [A] $ never terminates, whereas $ C [B] $ terminates and produces $n$ with probability $ \frac{1}{4}$.
Our environmental bisimulation distinguishes $A$ from $B$, because we separately analyze the possible worlds in which the evaluation of has produced ${\tt true}$ and the possible worlds in which the evaluation has produced ${\tt false}$, somehow mimicking the effect of the context $C$ above.
Yet another possibility for avoiding the lifting construct of the Definition 42 of bisimulation might have been to drop the requirement of first-order consistency, allowing environment formal sums in which a first-order column may contain different constants. Thus, constants would be added to the dynamic environment as any other type of value, and one would simply check that, at any time, the weights for the occurrences of a given constant in related columns are the same; formally, replacing clause (2e) with
- (2e $^{\prime }$) for every column $r$ and every constant $c$,$$\sum _{\lbrace i \,\mid \,(\widetilde{V}_i)_{r} =c\rbrace } p_{i} = \sum _{\lbrace j \,\mid \,(\widetilde{W}_j)_{r}=c \rbrace } q_{j}$$.
The example below shows that this choice would be unsound too. We write $({\boldsymbol \nu } \,x,\,y\:{:=}\: 0) M$ for the creation of two locations in which the initialization of the first one is irrelevant.
This is a variation of the previous example.
We compare the terms $M_1 \stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x,\,y\:{:=}\: 0) (A,B_1)$ and $M_2 \stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x,\,y\:{:=}\: 0) (A,B_2),$ where
We explain why, intuitively, the variant (2e $^{\prime }$) above of the clause for first-order values would incorrectly equate $M_1$ and $M_2$. The evaluation of adds to the dynamic environment the formal sum
Now, in one case the evaluation of adds to the dynamic environment a column of boolean values identical to the column produced above (because emits the value stored in $l$, which is identical to the value produced by the evaluation of ). This means that we end up with an environment formal sum in which the relevant columns are
However, the terms are not contextual equivalent. They are separated by a context that evaluates only if the outcome of the evaluation of is ${\tt true}$. Thus, the overall probability of obtaining ${\tt true}$ at the end is $ \frac{1}{2}$ in one case, and $ \frac{1}{4}$ in the other. Similarly the terms are distinguished in our bisimulation, reasoning along the lines of Example 46.
The definition of $\lbrace \widetilde{l}\rbrace$-simulation is the same as the definition of $\lbrace \widetilde{l}\rbrace$-bisimulation, but for the first clause on environment formal sums with stores, which becomes: $\sum _{i} p_{i} \le \sum _{j} q_{j}$. We let denote $\lbrace \widetilde{l}\rbrace$-similarity.
The basic properties and definitions for environmental (bi)simulations in pure call-by-value remain valid, with the due adjustments. In some cases, however, some subtleties arise.
It can be easily proved that, for any set $\lbrace \widetilde{l}\rbrace$, $\lbrace \widetilde{l}\rbrace$-bisimilarity and $\lbrace \widetilde{l}\rbrace$-similarity are an equivalence and a preorder relation, respectively. For proving transitivity, in particular, the restriction to parametrized relations, rather than to arbitrary relations, is fundamental. Analogously, we have that $\lbrace \widetilde{l}\rbrace$-(bi)simulations are closed under union, and thus relations $\approx ^{\lbrace \widetilde{l}\rbrace }$ and are, respectively, the largest $\lbrace \widetilde{l}\rbrace$-bisimulation and $\lbrace \widetilde{l}\rbrace$-simulation.
In finite-step simulation, clauses (2b) and (2g) are modified so to make sure that only a finite number of reductions are performed on the challenger side. No modification is made to the clauses (1), (2c), (2d), (2e), and (2f) for locations, constants, and tuples, because there is no evaluation of terms involved.
The definition of extended environment formal sum and of the multi-step reduction from extended environment formal sums to environment formal sums is adapted to the imperative case as expected, by assuming that when there is only a finite number of $\langle s_{i} \,;\,M_{i}\rangle$ that actually perform some reduction steps.
A PE relation is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation if it satisfies the same clauses (1), (2a), (2c), (2d), (2e) and (2f) of (the simulation version of) Definition 42; and, in place of clauses (2b) and (2g), we have
We write for finite-step $\lbrace \widetilde{l}\rbrace$-similarity. We prove that $\lbrace \widetilde{l}\rbrace$-similarity and finite-step $\lbrace \widetilde{l}\rbrace$-similarity coincide by exploiting the saturation by approximants and the saturation by suprema of $\lbrace \widetilde{l}\rbrace$-simulations and finite-step $\lbrace \widetilde{l}\rbrace$-simulations, respectively. Since only clauses (2b) and (2g) are modified, we can proceed as in the proofs for the pure calculi.
.
Precongruence is derived for the finite-step similarity using “up-to lifting and environment” techniques, and then transported to similarity, from which it is transported to bisimilarity using the characterization of bisimilarity as the equivalence induced by the simulation preorder.
The up-to lifting and environment technique is defined analogously to the probabilistic call-by-value case. The environment preorder is as follows: $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} , \mathbf {Z}= \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ with $|\mathbf {Y}|=|\mathbf {Z}|$ and $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ with $|\mathbf {Y}^{\prime }|=|\mathbf {Z}^{\prime }|$ and for every index $r$ in $|\mathbf {Y}|$ there is an index $r^{\prime }$ in $|\mathbf {Y}^{\prime }|$ such that for all $i,j$, $(\widetilde{V}_{i})_{r}=(\widetilde{V}^{\prime }_{i})_{r^{\prime }}$ and $(\widetilde{W}_{j})_{r}=(\widetilde{W}^{\prime }_{j})_{r^{\prime }}$.
A PE relation is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment if:
If $\, \mathcal {R}\,$ is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment, then .
The soundness of the up-to lifting and environment technique follows as in call-by-value (Lemma 38). Given a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment $\, \mathcal {R}\,$, we prove that $\mathrel {\mathcal {S}}={\tt Pairs}(\, \mathcal {R}\,)\cup \bigcup _{{\mathcal {E}}}\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}))}\,$ is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation.
We first prove congruence of finite-step $\lbrace \widetilde{l}\rbrace$-similarity for contexts with locations in $\lbrace \widetilde{l}\rbrace$, and then we show how to derive congruence for general contexts. The proofs of these results are reported in Appendix A. The proof structure for Theorem 52 is as in call-by-value; we define the context closure of a finite-step $\lbrace \widetilde{l}\rbrace$-simulation, and we prove that it is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment.
Finite-step $\lbrace \widetilde{l}\rbrace$-similarity is a precongruence for contexts with locations in $\lbrace \widetilde{l}\rbrace$: if then for every context $C$ with ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace$, we have .
Then, we derive precongruence for general contexts by showing how to move from relations parametrized by a set $\lbrace \widetilde{l}\rbrace$ to relations parametrized by $\lbrace \widetilde{l}^{\prime }\rbrace$, for $\lbrace \widetilde{l}^{\prime }\rbrace$ a set including $\lbrace \widetilde{l}\rbrace$.
Let $\widetilde{l}^{\prime }=\widetilde{l}, \widetilde{l}^{\prime \prime }$ and let $\widetilde{V}^{\prime }=\widetilde{V}, \widetilde{V}^{\prime \prime }$ be a sequence of values whose types are consistent with those of $\,\widetilde{l}^{\prime }$, and with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. Let $C$ be a context with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. If then:
We set . Contextual equivalence and the contextual preorder are defined by quantifying over all stores and contexts.
$M$ and $N$ are in the contextual preorder, written $M\le _{{\rm {\tt ctx}}}N$ (respectively, contextually equivalent, written $M =_{{\rm {\tt ctx}}}N$), if, for any store $s$ and context $ C$ such that $\langle s \,;\, C [M] \rangle$ and $\langle s \,;\, C [N] \rangle$ are well-formed, ${\langle s \,;\, C [M] \rangle {\Downarrow }} \le {\langle s \,;\, C [N] \rangle {\Downarrow }}$ (respectively, ${\langle s \,;\, C [M] \rangle {\Downarrow }} = {\langle s \,;\, C [N] \rangle {\Downarrow }}$).
Let ${\tt Loc}(M) \cup {\tt Loc}(N)= \lbrace \widetilde{l}\rbrace $. If $M\le _{{\rm {\tt ctx}}}N,$ then , for any $\widetilde{V}$ whose types and locations are consistent with $\widetilde{l}$.
We prove that the relation
We can now derive full abstraction for the simulation preorder and bisimilarity. Contextual equivalence and preorder are defined on terms, while bisimilarity and the simulation preorder are defined over configurations of a term and a store. In the full abstraction result, we show that congruence on terms corresponds to bisimilarity when an arbitrary store is considered.
Let ${\tt Loc}(M) \cup {\tt Loc}(N)= \lbrace \widetilde{l}\rbrace $. We have, for any $\widetilde{V}$ whose types and locations are consistent with $\widetilde{l}$:
Theorem 55 proves completeness. For soundness, suppose for some $\widetilde{V}$ consistent with $\widetilde{l}$. Let $s$ be a store and $C$ a context such that $\langle s \,;\,C[M]\rangle$ and $\langle s \,;\,C[N]\rangle$ are well-formed. We want to prove that $\langle s \,;\,C[M]\rangle \Downarrow \le \langle s \,;\,C[N]\rangle \Downarrow$.
By well-formedness, we know that $s=\emptyset [ \widetilde{l}^{\prime } \rightarrow \widetilde{V}^{\prime }]$, for some $\widetilde{l}^{\prime }$ such that $\widetilde{l}^{\prime }=\widetilde{l},\widetilde{l}^{\prime \prime }$ and for some consistent $\widetilde{V}^{\prime }$, and that $C$ has locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. By , we have and by Theorem 53, we derive . Then $\langle \widetilde{l}^{\prime } = \widetilde{V}^{\prime } \,;\,C[M]\rangle \Downarrow \le \langle \widetilde{l}^{\prime } = \widetilde{V}^{\prime } \,;\,C[N]\rangle \Downarrow$.
The universal quantification over stores in the full abstraction is outside, and not inside, the double implication, i.e., we do not prove
We discuss here some additional works on probabilistic calculi based on different notions of bisimulations (with respect to applicative or environmental) or different techniques for proving contextual equivalence.
The probabilistic $\lambda$-calculus, i.e., a $\lambda$-calculus endowed with binary, fair, probabilistic choice, was first presented in Reference [12]. In References [11] and [8], probabilistic applicative bisimulations for pure call-by-name and call-by-value $\lambda$-calculi are shown to be congruences, using Howe's method coupled with a disentangling technique. Completeness, however, only holds in call-by-value, while it fails in call-by-name. The reason for this is that distributivity of lambda-abstraction over probabilistic choice holds for contextual equivalence in call-by-name but does not hold in call-by-value, and to prove such distributivity laws the bisimulation has to be defined over probability distributions or formal sums, rather than being defined over terms (see Examples 5 and 33). In call-by-name, completeness is obtained using coupled logical bisimulation [11], a probabilistic version of the logical bisimilarity for deterministic languages [44]. While applicative bisimulation requires two functions to be related whenever they take as input the same argument, logical bisimulation requires two functions to be related whenever they take as input terms in the contextual closure of the relation itself. Since the contextual closure of a relation includes identity, the set of terms with which related functions are tested is enlarged with respect to applicative bisimilarity. This makes the congruence proof easier by allowing a direct use of the inductive hypothesis, thereby removing the need for Howe's technique. Drawbacks of all forms of logical bisimilarity are a non-monotone functional (which makes it harder to prove that bisimilarity is the largest bisimulation) and a confinement to pure $\lambda$-calculi. Further, up-to techniques may be difficult in logical bisimilarity. For instance, Example 26 cannot be proved with the techniques in [11]: the equality fails for applicative bisimilarity, and the up-to context technique provided for logical bisimilarity is not powerful enough (the article shows a similar example, akin to Example 5, where, however, the functions employed immediately throw away their input, and this is essential for the proof).
A further difference between applicative bisimulations and environmental bisimulations shows up when one considers the corresponding simulations. Even in cases where applicative bisimilarity is fully abstract for contextual equivalence, the corresponding simulation may not be fully abstract for the contextual preorder. Pure call-by-value is such an example [8, 10]. In contrast, in all calculi in the article, full abstraction for environmental bisimilarity carries over to the corresponding simulation, with a similar proof.
An alternative bisimulation for enriched calculi is normal form (or open) bisimulation [22, 28, 42, 47]. This is complete (with respect to contextual equivalence) only in certain extensions of the $\lambda$-calculus (e.g., call-by-value with both state and callcc), and would be incomplete in other languages (such as $\lambda$-calculus without state or/and callcc).
Another approach to contextual equivalence in higher-order languages is via logical relations (see, e.g., Reference [31, Chapter 8] and Reference [37]). This technique has been applied to probabilistic typed higher-order languages by Bizjak and Birkedal [6]. Their probabilistic logical relation uses biorthogonality, and is defined on terms, rather than on distributions. These features introduce some universal quantification (e.g., on evaluation contexts), which makes it difficult to prove examples such as 44, as discussed in Reference [5, Section 1.5]. Proof techniques combining features of bisimulations and logical relations in the non-probabilistic case are studied in References [20, 21, 33].
In denotational semantics, fully abstract models for probabilistic PCF have been studied in Reference [18] using domain theory and adding statistical termination testers, and in Reference [16] using probabilistic coherence spaces. Reference [13] provides a fully abstract game semantics for probabilistic Algol, using a quotienting step.
Finally, in this work, we have only considered exact behavioral equivalences, as opposed to approximate behavioral equivalences (allowing the programs to differ up to a certain probability value $\epsilon$) or metrics (measuring the distance between the behaviors of probabilistic programs) [14, 15]. Bisimulation metrics for an affine probabilistic pure $\lambda$-calculus have been recently proposed in Reference [9]. Applicative bisimulation metric is proved to be sound with respect to the contextual distance, and a metric for an extensions of the language with tuples is defined. To be sound with respect to the contextual metric, the tuple distance is endowed with a notion of environment.
We have investigated environmental bisimulations in sequential higher-order languages, considering pure $\lambda$-calculi, both call-by-name and call-by-value, and an extension with higher-order references.
While we have tried to respect the general schema of environmental bisimulations, our definitions and results present noticeable technical differences. Some differences, such as the appeal to formal sums, are specific to probabilities. Other differences, however, may be seen as insights into environmental bisimulations that were suggested by the study of probabilities. An example is the distinction between a static and a dynamic environment, which reflects the copying facilities of the language on the terms of the environment. This distinction yields sharper congruence results, which show up well in the imperative $\lambda$-calculus: with ordinary environmental bisimulations, bisimilarity is fully substitutive only for values, since for general terms substitutivity holds only for evaluation contexts (see Example 43). The example in Section 3.4 shows that static environments can also be useful in context closures of “up-to context” techniques.
To understand environmental bisimulations for call-by-value calculi, we have found important the study of the imperative extension. Only in the richer language do various aspects of our definitions find a justification: the use of formal sums (Example 44); dynamic environments as formal sums of tuples of values, as opposite to, e.g., tuples of formal sums (Example 45); the lifting construct to handle first-order values (Example 46). The pure call-by-value calculus has allowed us to present the concepts in a simpler setting, as a stepping stone toward the imperative extension, but seems a rather peculiar language, one in which a number of variations of the definitions collapse.
The dynamic environments are used only for the call-by-value calculi. In general, the form of the bisimulation clauses depends on the features of the calculus. It would be interesting to investigate an abstract formulation of bisimulation, of which the concrete definitions presented in this article would be instances. Possible bases for such a framework could be coalgebras [40] or bigraphs [30].
Related to the problems with congruence of applicative bisimulations are also the difficulties with “up-to context” techniques (the usefulness of these techniques in higher-order languages and its problems with applicative bisimulations have been studied by Lassen [27]; see also References [26, 39, 41]). Enhancements of the bisimulation proof method, as up-to techniques, are particularly useful for environmental bisimulations [45] because of the quantification over contexts that appear in the definition and that can make bisimulation proofs tedious. We have explored some basic enhancements, mainly in call-by-name, including new forms of up-to techniques specific to probabilities such as “up-to lifting.” The study of powerful enhancements goes beyond the scopes of this work; we regard it as an important and challenging line for future work. The study could be pursued in a number of directions, for instance investigating other forms of up-to and strengthening the “up-to context” enhancements.
Another interesting direction for future work is the addition of concurrency. A major consequence of this could be the move to semantics that combine probabilities with non-determinism.
If $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$, then:
The proof is by induction on $n$.
For the case $n=0$, the two properties above are immediate consequences of the definition of $\, \mathcal {R}\,$.
For the inductive case, if $Y\, \mathcal {R}\,^{n+1}_{(M,N)} Z$ then either $Y\, \mathcal {R}\,^{n}_{(M,N)} Z$, and the result follows by the inductive hypothesis, or $Y= \sup S$ for $S=\lbrace Y_{k}\rbrace _{k \ge 0}$ a set of formal sums such that $Y_{k} \, \mathcal {R}\,^{n}_{(M,N)}Z$ for all $k$ and $Y_{k}\le _{{\rm {\tt apx}}}Y_{k+1}$. As a consequence, there is a sequence $Y^{\prime }_{k}$ such that $Y_{0}=Y^{\prime }_{0}$ and $Y_{k+1}=Y_{k}+Y^{\prime }_{k+1}$, i.e., $Y_{k}=\sum _{0 \le h \le k}Y^{\prime }_{h}$. Hence, it follows from $Y= \sup S$ that $Y= \sum _{k\ge 0} Y^{\prime }_{k}$.
The first item follows by the inductive hypothesis, since $Y$ is the supremum of $S$ and $Y_{k} \in S$ implies ${{\tt weight}} (Y_{k}) \le {{\tt weight}} (Z)$. As to the second item, we have $Y\bullet C[M]=\sup \lbrace Y_{k}\bullet C[M]\rbrace =\sum _{k \ge 0} Y^{\prime }_{k}\bullet C[M]$. We want to prove that if for some formal sum $X$ then .
If then, by the definition of the multi-step reduction relation (which guarantees that only a finite number of terms are evaluated in the formal sum), there is an $m\ge 0$ such that and $X=X^{\prime }+\,{{\tt val}}{(\sum _{k\gt m} Y^{\prime }_{k}\bullet C[M])}$.
For any $m^{\prime }\ge 0$, we have
Then the result follows, since $Y= \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {\mathcal {S}}_{{\mathcal {E}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}=Z$ implies $Y\mathrel {\mathcal {R}}^{n}_{{\mathcal {E}}} Z$ for some $n$, and we have $\sum _{i} p_{i} \le \sum _{j} q_{j}$ (by the first item of lemma 57), and
Let ${\mathcal {R}}$ be a finite-step simulation saturated by approximants and let
For any context $C$, if $M \mathrel {\mathcal {R}}N$ and , then we have .
We prove by induction on the length $n$ of the reduction that $M \, \mathcal {R}\,N$ and imply . If $Y= \emptyset ,$ then the result follows by the third set of ${\mathcal {S}}^{\prime }$. Suppose that $Y\ne \emptyset$. If $n=0,$ then we have two cases:
Suppose now that .
We derive from Lemma 58 that ${\mathcal {S}}$ is a finite-step simulation up-to lifting as follows:
To complete the proof, it remains to prove that for any $C^{\prime }$, we have . This result can be derived by Lemma 59 below, since
For any $M,N, Y$ it holds:
Let ${\mathcal {R}}$ be a finite-step simulation up-to lifting and context. We prove that
Note that the relation $\,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\,$ is saturated by approximants, i.e., the following property holds: if $Y\le _{{\rm {\tt apx}}}Y^{\prime } \,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\, Z$ then $Y\,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\, Z$. We first prove the following result:
For any context $C$, if $M \mathrel {\mathcal {R}}N$ and , then we have .
We prove that $M \mathrel {\mathcal {R}}N$ and imply , by induction on $n$. If $Y= \emptyset ,$ then the result holds by the last set of ${\mathcal {R}}^{\prime }$. Suppose that $Y\ne \emptyset$. If $n=0,$ then we have two cases:
Suppose now that .
From Lemma 60, we can now derive that ${\mathcal {R}}^{\prime }$ is a finite-step simulation up-to lifting:
Let denote the transitive closure of , i.e., if there are $P=P_{1}, P_{2},\ldots,P_{k}=P^{\prime }$ such that for every $1 \le i \lt k$ there are a context $C_{i}$ and tuples $\widetilde{P_{i}}, \widetilde{P^{\prime }_{i}}$ with $P_{i}= C_{i}[\widetilde{P_{i}}]$ and $P_{i+1}=C_{i}[\widetilde{P^{\prime }_{i}}]=C_{i+1}[\widetilde{P}_{i+1}]$ and . Define the following term relation:
Let $\,{{\tt liftd}}{(\cdot)}\,$ denote $\,{{\tt lift}}{({{\tt dirac}}{(\cdot)})}$.
It holds that
We first prove (*). Let $P=P_{1}, P_{2},\ldots,P_{k}=P^{\prime }$ be such that for every $i$, for $1 \le i \lt k$, there are a context $C_{i}$ and tuples $\widetilde{P_{i}}, \widetilde{P^{\prime }_{i}}$ with $P_{i}= C_{i}[\widetilde{P_{i}}]$ and $P_{i+1}=C_{i}[\widetilde{P^{\prime }_{i}}]=C_{i+1}[\widetilde{P}_{i+1}]$ and . Suppose that . We prove by induction on $k$ that for every $i$ such that $1 \le i \lt k$, we have and $m_{i} \ge m_{i+1}$ and .
The result is trivial for $k=1$. Suppose that $k=k^{\prime }+1$. The result follows from the inductive hypothesis and from
We can now prove (**) by showing by induction on $n$ that and imply .
Let , $P^{\prime }=C[M]$ and $Q=C[N]$. If $n=0$ and $Y\ne \emptyset ,$ then $P$ is a value, $Y={1};{P}$ and by (*) $P^{\prime }$ is a value too, with . We have two cases:
If then by (*), we have with $m \le n+1$ and . Suppose that $Y^{\prime } \ne \emptyset$. We have three cases:
We can now show that the relation
Hence, we have .
It remains to prove that (then it follows from Corollary 12 and Theorem 7(3) that $M \approx N$). To do so, we first prove the following lemma.
It holds that
The results in Lemma 62 are symmetric to the results in Lemma 61 and are proved analogously. For item (*), we proceed first by induction on the length $k$ of the sequence , and then, for the inductive step, we show by induction on the length of $m$ that and imply with . Item (**) is proved by induction on the length of the reduction .
There are two main differences with respect to Lemma 61. In item (*), since the direction of is now reversed, the length of the reduction is not greater than or equal to the length of the reduction from $P$. Second, in item (**), instead of considering the semantics of terms (on one side), we only relate formal sums reached via the multi-step reduction relation. This is a stronger condition, that is needed in the remainder of the proof.
Finally, we prove that relation
Let $\, \mathcal {R}\,$ be a finite-step $\lbrace \widetilde{l}\rbrace$-simulation saturated by approximants. We first define, for any pair of terms $(M,N)$, the preorder $\le _{{\rm {\tt cce}}(M,N)}$ (context closure of environments) on pairs of environment formal sums with store: $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} , \mathbf {Z}= \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ with ${|\mathbf {Y}|}={|\mathbf {Z}|}$ and $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ with ${|\mathbf {Y}^{\prime }|}={|\mathbf {Z}^{\prime }|}$ and
For any indexed relation $\mathrel {{\mathcal {R}}_{(M,N)}}$ on environment formal sums, we write $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$ for relation $\le _{{\rm {\tt cce}}(M,N)}(\mathrel {{\mathcal {R}}_{M,N}})$, i.e.,
Note that we can add to a finite-step $\lbrace \widetilde{l}\rbrace$-simulation ${\mathcal {R}}$ saturated by approximants the set
The following result is used in the proof of Lemma 64 (in Lemma 63 and 64, the set of locations parametrizing the relations is not relevant; hence, we omit it).
Let ${\mathcal {R}}$ be a finite-step simulation and let
We have the three cases below:
In what follows, we sometimes use relations $\le _{{\tt lift}}$ and $\le _{{\tt lift}}\le _{{\rm {\tt env}}}$, defined as follows:
The notation, as for relations $\le _{{\rm {\tt env}}}$ and $\le _{{\rm {\tt cce}}(M,N)}$, is extended to environment formal sums with running terms by requiring the running term to be the same everywhere.
Suppose that $\mathrel {{\mathcal {R}}_{(M,N)}}$ is a finite-step simulation saturated by approximants (only defined on formal sums). For any location-free context $C$ if $\mathbf {Y}\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\mathbf {Z}$ and then .
Suppose that $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}=\mathbf {Z}$, with $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}}$ and $ \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ related by $\mathrel {{\mathcal {R}}_{(M,N)}}$ and such that $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime }) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z})$.
We prove by induction on $n$ and then by induction on the structure of $C$ that
implies .
(In the proof, we sometimes assume that $\widetilde{V}_{i}=\widetilde{V}^{\prime }_{i},\widetilde{V}^{\prime \prime }_{i}$ and $\widetilde{W}_{j}=\widetilde{W}^{\prime }_{j},\widetilde{W}^{\prime \prime }_{j}$. This does not affect the results, since the context closure of environments allows us to permute the columns in the formal sums.)
If $\mathbf {W}= \emptyset ,$ then the result follows by the fact that ${\mathcal {R}}$ is saturated by $\emptyset$. Suppose that $\mathbf {W}\ne \emptyset$ and $n=0$. We have one of the following cases:
Suppose now that , with $\mathbf {W}\ne \emptyset$. We have the following cases:
Suppose that $\mathrel {{\mathcal {R}}_{(M,N)}}$ is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation saturated by approximants (only defined on formal sums), and that $C$ is a context with locations in $\lbrace \widetilde{l}\rbrace$. The following relation satisfies the clauses on formal sums for finite-step simulations up-to lifting and environment:
We can assume that the relation $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed by $\lbrace \widetilde{l}\rbrace$ , i.e., each location $l \in \lbrace \widetilde{l}\rbrace$ occurs in corresponding columns in the dynamic environment of the formal sums (formally: for any $\mathbf {Y},\mathbf {Z}$ in the relation and for every $l \in \lbrace \widetilde{l}\rbrace$ there is an index $r$, for $ 1\le r \le |\mathbf {Y}|$, such that both and are tuples composed by location $l$). This assumption simplifies our proof, while not affecting the results. Indeed, we can eliminate all the pairs that do not satisfy the requirement of $\lbrace \widetilde{l}\rbrace$-closure, and we still have a finite-step $\lbrace \widetilde{l}\rbrace$-simulation saturated by approximants.
The proof exploits the fact that if $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed by $\lbrace \widetilde{l}\rbrace ,$ then $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$ is closed by $\lbrace \widetilde{l}\rbrace$ and, for any $C$ such that ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace$, if it holds that $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ and $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $ (\lbrace C[M],\widetilde{V}_{i}\rbrace _{i}, \lbrace C[N],\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, then $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $ (\lbrace M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, since the locations in $\lbrace \widetilde{l}\rbrace$ are guaranteed to occur at corresponding columns in $\lbrace \widetilde{V}_{i}\rbrace _{i}$ and $\lbrace \widetilde{W}_{j}\rbrace _{j}$ and then $C$ can be turned into a location-free context.
The condition (2a) on the weights is immediately satisfied by the definition of $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$, since ${\mathcal {R}}$ is a simulation.
Then, we prove that the conditions from (2b) to (2g) of finite-step simulation up-to lifting and environment are satisfied by ${\mathcal {S}}$. Suppose that $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {{\mathcal {S}}_{(C[M],C[N])}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}=\mathbf {Z}$ with $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ related by $\mathrel {{\mathcal {R}}_{(M,N)}}$ and such that $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime }) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z})$.
We have three cases:
Since contexts used in $\le _{{\rm {\tt cce}}(M,N)}$ are location-free and $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed with respect to the locations in $\widetilde{l}$ (and thereby the locations in $C[M],C[N]$ are in the dynamic environment of the formal sums in $\mathrel {{\mathcal {R}}_{(M,N)}}$ in corresponding columns), there is $r^{\prime }$ such that $(\widetilde{V}^{\prime }_{i})_{r^{\prime }}=l_{i}$ and $(\widetilde{W}^{\prime }_{j})_{r^{\prime }}=k_{j}$, then:
The result follows from $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $(\lbrace M,\widetilde{V}^{\prime }_{i}\rbrace _{i}, \lbrace N,\widetilde{W}^{\prime }_{j}\rbrace _{j})^{\widehat{\star }}$ as in the previous clause, by exploiting clause () on ${\mathcal {R}}$.
For every $r$, there are three cases: either and for some $r^{\prime }$, in which case both columns are composed by the same constant, since ${\mathcal {R}}$ is a finite-step simulation; or the value-context is a constant and ; or the constants are, respectively, $M$ and $N$, in which case
If and for some $r^{\prime },$ then it follows from the definition of ${\mathcal {R}}$ that
Finally, if $(\widetilde{V}_{i})_{r}=M$ and $(\widetilde{W}_{j})_{r}=N,$ then the clause follows as in the previous cases from $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}},{M}\,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}},{N}$, by clause ().
Since $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed with respect to $\widetilde{l}$, there is a location-free context $C^{\prime }$ such that
We can now derive from Lemma 65 the congruence result. Let $C$ be a context such that ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace$. Let ${\mathcal {R}}$ be a finite-step $\lbrace \widetilde{l}\rbrace$-simulation such that $\langle s \,;\,M\rangle \mathrel {\mathcal {R}}\langle t \,;\,N\rangle$. Then the relation
Let $\widetilde{l}^{\prime }=\widetilde{l}, \widetilde{l}^{\prime \prime }$ and let $\widetilde{V}^{\prime }=\widetilde{V}, \widetilde{V}^{\prime \prime }$ be a sequence of values whose types are consistent with those of $\widetilde{l}^{\prime }$ and with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. Let $C$ be a context with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$ and let ${\mathcal {R}}$ be a finite-step $\lbrace \widetilde{l}\rbrace$-simulation (saturated by approximants) relating $\langle s \,;\,M\rangle$ and $\langle t \,;\,N\rangle$. Then ${1};{s;\widetilde{l}} \mathrel {{\mathcal {R}}_{(M,N)}} {1};{t;\widetilde{l}}$ and by repeatedly applying clause (2d), we derive
Finally, by repeatedly applying clause (2c) to locations $\widetilde{l}$ in the pair
We prove that the relation
To prove that ${\mathcal {R}}$ satisfies the clauses of simulation for formal sums, we first show the following lemma.
If $\mathbf {Y}\mathrel {{\mathcal {R}}_{(M,N)}}\mathbf {Z},$ then for any $C$ with ${\tt Loc}(C) \subseteq {\tt Loc}(M) \cup {\tt Loc}(N)$:
If $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};V^{i}_{1},\ldots,V^{i}_{n}}\mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};W^{j}_{1},\ldots,W^{j}_{n}}=\mathbf {Z},$ then they are first-order consistent environment formal sums and there are $C,s$ such that and and ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace = {\tt Loc}(M) \cup {\tt Loc}(N)$.
Let $C^{\prime }$ be any context with $ {\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace ={\tt Loc}(M) \cup {\tt Loc}(N)$ and let
We have
If and are first-order consistent, then we can conclude, by the definition of $\, \mathcal {R}$, that
Let $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};V^{i}_{1},\ldots,V^{i}_{n}}\mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};W^{j}_{1},\ldots,W^{j}_{n}}=\mathbf {Z}$ be first-order consistent environment formal sums and let $C,s$ be such that and . We can now prove that ${\mathcal {R}}$ satisfies the simulation clauses on formal sums.
We have benefited from discussions with Raphaëlle Crubillé and Ugo Dal Lago. We are deeply grateful to the reviewers for their detailed reading of the article and their many useful comments and remarks.
This work has been supported by the ERC H2020 project “CoVeCe” (Grant Agreement No. 678157), by the LABEX MILYON (ANR-10-LABX-0070) of Université de Lyon, within the program “Investissements d'Avenir” (ANR-11-IDEX-0007), by the project ANR-16-CE25-0011 “REPAS,” by the project ANR 12IS02001 “PACE,” and by H2020-MSCA-RISE project “Behapi” (ID 778233).
Authors’ addresses: D. Sangiorgi, Dipartimento di Informatica - Scienza e Ingegneria (DISI), Università di Bologna, Mura Anteo Zamboni, 7, 40126 Bologna, Italy; email: davide.sangiorgi@unibo.it; V. Vignudelli, ENS de Lyon, site Monod - LIP, 46 Allée d'Italie, 69007 Lyon, France; email: valeria.vignudelli@ens-lyon.fr.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org.
©2019 Copyright held by the owner/author(s). Publication rights licensed to ACM.
0164-0925/2019/10-ART22 $15.00
DOI: https://doi.org/10.1145/3350618
Publication History: Received July 2017; revised May 2019; accepted June 2019