Environmental Bisimulations for Probabilistic Higher-order Languages Environmental Bisimulations for Probabilistic Higher-order Languages

DAVIDE SANGIORGI,
University of Bologna and Inria
University of Lyon, CNRS, ENS de Lyon, UCB Lyon 1, LIP

ACM Trans. Program. Lang. Syst., Vol. 41, No. 4, Article 22, Publication date: October 2019.
DOI: https://doi.org/10.1145/3350618

Environmental bisimulations for probabilistic higher-order languages are studied. In contrast with applicative bisimulations, environmental bisimulations are known to be more robust and do not require sophisticated techniques such as Howe's in the proofs of congruence.

As representative calculi, call-by-name and call-by-value $\lambda$-calculus, and a (call-by-value) $\lambda$-calculus extended with references (i.e., a store) are considered. In each case, full abstraction results are derived for probabilistic environmental similarity and bisimilarity with respect to contextual preorder and contextual equivalence, respectively. Some possible enhancements of the (bi)simulations, as “up-to techniques,” are also presented.

Probabilities force a number of modifications to the definition of environmental bisimulations in non-probabilistic languages. Some of these modifications are specific to probabilities, others may be seen as general refinements of environmental bisimulations, applicable also to non-probabilistic languages. Several examples are presented, to illustrate the modifications and the differences.

CCS Concepts: • Theory of computation → Program verification; Operational semantics; Probabilistic computation;

Additional Key Words and Phrases: Environmental bisimulation, probabilistic lambda calculus, contextual equivalence, imperative languages

ACM Reference format:
Davide Sangiorgi and Valeria Vignudelli. 2019. Environmental Bisimulations for Probabilistic Higher-order Languages. ACM Trans. Program. Lang. Syst. 41, 4, Article 22 (October 2019), 64 pages. https://doi.org/10.1145/3350618

1 INTRODUCTION

The article investigates techniques for proving behavioural equivalence in higher-order probabilistic languages. Checking computer programs for equivalence is a crucial, but challenging, problem. Equivalence between two programs generally means that the programs should behave “in the same manner” under any context. Specifically, two $\lambda$-terms are contextually equivalent if they have the same convergence behaviour (i.e., they do or do not terminate) in any possible context [32].

Due to the universal quantification on the contexts of the language, it is generally hard to prove that two terms are contextually equivalent. Such proofs are particularly hard to carry out if the language under consideration has higher-order features, which allow contexts to copy and pass around terms.

Bisimulation [34, 43] offers a powerful operational method for proving equivalence of programs in various kinds of languages, relying on the coinduction proof principle. To qualify as a proof method, bisimulation relations should be sound with respect to contextual equivalence, i.e., they should induce an equivalence relation—bisimilarity—that implies contextual equivalence. Ideally, bisimilarity should be fully abstract with respect to contextual equivalence, i.e., coincide with it.

Bisimulation has been studied in depth in deterministic $\lambda$-calculi, e.g., [2, 17, 27, 38, 41]. In contrast, so far, it has been little explored in probabilistic $\lambda$-calculi, mainly in the form of applicative bisimilarity [8, 11] for the pure call-by-name and call-by-value languages.

Applicative bisimulations are known, however, to have some significant limitations. First, they do not scale very well to languages richer than the pure $\lambda$-calculus. For instance, they are unsound under the presence of references, or even just generative names, or data abstraction; see [24] for an enlightening discussion. Second, congruence proofs of applicative bisimulations are notoriously hard. Such proofs usually rely on Howe's method [19], which is, however, fragile outside the pure $\lambda$-calculus. Related to the problems with congruence are also the difficulties of applicative bisimulations with “up-to context” techniques (the usefulness of these techniques in higher-order languages and its problems with applicative bisimulations have been studied by Lassen [27]; see also [26, 39, 41]).

To relieve this burden, environmental bisimulations have been proposed [45], refining earlier proposals in [1, 7, 23, 26, 48]. The distinguishing feature of these bisimulations is that the pairs of tested terms are enriched with environments, that intuitively collect the observer's knowledge about values computed during the bisimulation game. The elements of the environment can be used to construct terms to be supplied as inputs during the bisimulation game. The notion has been applied to a variety of languages, including pure $\lambda$-calculi [45, 49], extensions of $\lambda$-calculi [3, 4, 25, 26, 48], or languages for concurrency or distribution [35, 36, 46]. In environmental bisimulations the proof of congruence goes by induction over the structure of contexts, as in proofs for first-order languages. For this, a “small-step” reduction relation is more handy than a “big-step” reduction: the former allows one a tight control over the syntax of the contexts, which is harder with the latter, because in a higher-order language contexts may arbitrarily grow during reduction; moreveor, the former is better suited to bisimulation enhancements of the “up-to techniques” (earlier forms of environmental bisimulation, e.g., References [48, 49], place a mild emphasis on up-to techniques and follow the big-step tradition of the $\lambda$-calculus).

With probabilities, the drawbacks of applicative bisimilarity are magnified: full abstraction with respect to contextual equivalence may fail also in a pure $\lambda$-calculus, and Howe's technique has to be enriched with non-trivial “disentangling” properties for sets of real numbers, these properties themselves proved by modeling the problem as a flow network and then applying the Max-flow Min-cut Theorem.

In this article, our goal is understanding environmental bisimulations in probabilistic higher-order languages. As representative calculi, we consider call-by-name and call-by-value $\lambda$-calculus, and a (call-by-value) $\lambda$-calculus extended with higher-order references. The computation is made probabilistic by endowing these calculi with a primitive for binary, fair, probabilistic choice. In each case, we derive full abstraction results for probabilistic environmental similarity and bisimilarity with respect to the contextual preorder and contextual equivalence, respectively. Below, we discuss the main differences of our proposals in comparison with ordinary (i.e., non probabilistic) environmental (bi)simulations.

Static and dynamic environments. In ordinary environmental bisimulation the values produced during the bisimulation game are placed into the environment, so that the observer can later play them at will during the bisimulation game. This schema is irrespective of the evaluation strategy (call-by-name or call-by-value), and is the distinguishing feature of environmental bisimulations over the applicative ones. “Playing a term” means copying it. However, in the $\lambda$-calculus the copying possibilities for call-by-name and call-by-value are quite different. In call-by-name, evaluation only occurs in functional position and therefore the term resulting from the evaluation may not be copied. In call-by-value, in contrast, a term may be evaluated also in argument position, and then given as input to a function; thus copying is possible also after evaluation. The different copying behaviour is well visible, for instance, in linear logic interpretations of call-by-name and call-by-value [29].

Now, the semantics of probabilistic languages is sensitive to the copying operation; for instance the probability of success of an experiment, if non-trivial, may be lowered by playing the experiment several times. This has a strong impact on behavioural equivalences for call-by-name and call-by-value in probabilistic $\lambda$-calculi. As an example, using $\Omega$ for a purely divergent term and $\oplus$ for the binary, fair, probabilistic choice operator,

\begin{equation} A\stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. (x \oplus \Omega) \quad \mbox{and} \quad B \stackrel{{{{\rm {\tt def}}}}}{=}(\lambda x. x) \oplus (\lambda x. \Omega), \end{equation}
are contextually equivalent in call-by-name: if evaluated alone, then they always terminate; if evaluated with an argument, then they return the argument with the same probability. More generally, in call-by-name abstraction distributes over probabilistic choice. In contrast, distributivity fails in call-by-value, exploiting the possibility of copying evaluated terms; e.g., the probabilities of termination for $A$ and $B$ are different in the context $(\lambda x. x \,(x \,\lambda y.y)) [ \cdot ]$. In a call-by-value strategy, the term in the hole is first evaluated in argument position, then the result of the evaluation is copied and executed twice. When put in the context, term $A$ terminates with probability $\frac{1}{4}$, whereas $B$ terminates with probability $\frac{1}{2}$.

To be able to express such behavioural differences, in our environmental bisimulations the values produced during the bisimulation game are placed into the environment only in the call-by-value case. We call such a value environment a dynamic environment, because it may grow during the bisimulation game. It is precisely the use of the dynamic environment that allows us to separate the two terms $A$ and $B$ above. In probabilistic call-by-name, dynamic environments would break full abstraction for contextual equivalence. The only environment for call-by-name is static. The static environment for two compared objects $F,G$ is a pair of $\lambda$-terms $M,N$, which are, intuitively, the initial $\lambda$-terms from which, using evaluation and interaction according to the bisimulation game, the objects $F,G$ have been derived. This (small) static environment is sufficient to ensure that the congruence proof of the bisimilarity remains in the style of ordinary environmental bisimulation (i.e., it does not require sophisticated techniques such as Howe's). In short, the static environment reflects the copying possibility for terms before evaluation, whereas the dynamic environment reflects the copying possibility for values resulting from evaluation.

Formal sums. In our probabilistic relations the objects compared are not plain $\lambda$-terms but formal sums, that are the objects produced by the semantics of a term. These are, intuitively, syntactic representations of probability distributions. As a consequence, environments are not just tuples of values, but formal sums of tuples of values. To see why related objects must be formal sums, consider again the terms $A$ and $B$ in (1): our environmental bisimulation for call-by-name equates $A$ and $B$ by relating $A$ and the formal sum resulting from the evaluation of $B$. None of the components of the formal sum, $\lambda x. x$ and $ \lambda x. \Omega$, could separately be related with $A$. (A form of bisimulation on formal sums, namely, a probabilistic version of logical bisimulation, is already defined in Reference [11] for call-by-name; its drawbacks are discussed in Section 6.)

In pure call-by-value $\lambda$-calculus, full abstraction for contextual equivalence would also hold without formal sums (i.e., relating plain $\lambda$-terms), for the same reason why, in the same language, applicative bisimilarity on plain terms is fully abstract [8]. We do not pursue this simplification of environmental bisimulations, because it would be unsound in extensions of the calculus. For instance, consider the following terms of a probabilistic $\lambda$-calculus with store (again, an instance of distributivity):

\[ \begin{array}{cc}H\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) (\lambda . (M \oplus N)) \quad &\quad K \stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) ((\lambda . M) \oplus (\lambda . N)), \end{array} \]
where $({\boldsymbol \nu } \,x\:{:=} 0)$ indicates the creation of a new reference $l$, initialized with 0 and substituted to $x$, $\lambda . L$ is a thunk (i.e., $\lambda z. L$ for $z$ not free in $L$), and where, using $L_1 \,\underline{{\tt seq}}\; L_2$ for the sequential evaluation of $L_1$ followed by $L_2$,
\[ \begin{array}{rcl}M&\stackrel{{{{\rm {\tt def}}}}}{=}&\:{{\rm {\tt if}}}\:\ !x=0\ \:{{\rm {\tt then}}}\:\ (x:=1 \,\underline{{\tt seq}}\; {\tt true})\ \:{{\rm {\tt else}}}\:\ \Omega \\ N&\stackrel{{{{\rm {\tt def}}}}}{=}&\:{{\rm {\tt if}}}\:\ !x=0\ \:{{\rm {\tt then}}}\:\ (x:=1 \,\underline{{\tt seq}}\; {\tt false})\ \:{{\rm {\tt else}}}\:\ \Omega . \end{array} \]
The terms $M$ and $N$ only differ at their first evaluation, when the new reference $l$ that was substituted to $x$ is set to 1 and $M$ produces ${\tt true}$ whereas $N$ produces ${\tt false}$; thereafter, $l$ is 1 and both terms diverge. As a consequence, $H$ and $K$ are contextually equivalent: at their first evaluation they always terminate, each returning ${\tt true}$ and ${\tt false}$ with the same probability, and at later evaluations they always diverge.

To place $H$ and $K$ in a bisimulation, $H$ has to be related with the formal sum obtained from the evaluation of $K$; again, the single components alone would be distinguished. Once more, this is a copying issue, due to the possibility of copying terms but not stores.

Big-step reduction, term closure, and congruence proof. To achieve full abstraction, in the probabilistic case the bisimulation clauses have to use a big-step, rather than a small-step, reduction relation. Precisely, we give finitary big-step approximants from which the semantics of a term is obtained via a least-fixed point construction (a similar semantics is in Reference [12]). The reason, intuitively, is that while in pure $\lambda$-calculi a term converges (i.e., it terminates its computation) in a finite number of reductions, in the probabilistic calculi there may be several terminating computation paths, in which the total number of reductions need not be finitary. An example is given by the terms

\begin{equation} P \stackrel{{{{\rm {\tt def}}}}}{=}{RR} \;\; \mbox{ and }\;\; Q\stackrel{{{{\rm {\tt def}}}}}{=}\lambda . \Omega \: , \;\; \mbox{ for }\;\; R \stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. ((x x) \oplus Q). \end{equation}
The terms $P$ and $Q$ are contextually equivalent, intuitively because they both have probability 1 of becoming term $Q$: after some reductions, $P$ may become $Q$ or may become $P$ again, with equal probability. Only by exploring the whole computation tree produced by $P$ does one find out that the infinite number of leaves in the tree makes a probability 1 of obtaining $Q$. None of the finite approximants of the infinite tree gives the same information (a formal sum made of a finite subset of the leaves would not be equivalent to $Q$).

When the reduction relation is small-step (as in the ordinary environmental bisimulations in [45]) the related terms need not be values, because a normalizing term need not produce a value in a single step and bisimulations must be closed under the reduction adopted. In contrast, as our environmental bisimulations are big-steps, the bisimulation game may be confined to values.

A more significant consequence of the adoption of big-step reductions is that the induction over contexts in the proofs of congruence for ordinary environmental bisimulations is replaced by an induction on the number of small-step reductions with which a big-step approximant is derived (possibly coupled with an induction on the size of a context), combined with two levels of continuity arguments. One level stems from the least fixed point construction employed in the definition of the infinitary big-step semantics on terms. The second level stems from a characterization of bisimilarity as the kernel of the similarity preorder and, in turn, as the kernel of a finitary similarity in which (on the challenger side) the big-step reduction relation employed is finite. The proof of the characterization with the finitary similarity makes use of least fixed-points via a saturation construction on formal sums where, intuitively, a formal sum is better than another formal sum if the former conveys more accurate probabilistic information than the latter.

Up-to techniques. Our proofs and examples rely on a few enhancements of the bisimulation proof method (“bisimulations up-to”), some of which are extensions of common (bi)simulation enhancements, others are specific to probabilistic calculi. An example of the latter is “simulation up-to lifting,” whereby it is sufficient, in the coinductive game, that two derivative formal sums are in the probabilistic lifting of the candidate relation, rather than in the candidate relation itself.

While the bisimulations act on formal sums and use infinitary big-step reductions to values, we also explore coinductive games played on plain $\lambda$-terms and on finitary multi-step reductions to terms (not necessarily values) as sound proof techniques. In particular, we combine these with up-to context, so to be able to compare terms in the middle of their evaluation when a common context can be isolated and removed.

Structure of the article. Section 2 introduces some general definitions and notations for the article. Section 3 presents environmental bisimulations for pure call-by-name, establishes basic properties, including full abstraction for bisimilarity and similarity, and develops various up-to techniques. Section 4 considers pure call-by-value, and Section 5 an extension with ML-like references. Section 6 discusses additional related work, and Section 7 concludes, also mentioning possible future work.

2 PRELIMINARIES

We introduce general notations and terminologies for the article. Familiarity with standard terminologies (such as free/bound variables and $\alpha$-conversion) is assumed.

We use meta-variables $M,N,P,Q,\ldots$ for terms, and $V,W,\ldots$ for values. We identify $\alpha$-convertible terms. We write for the capture-avoiding substitution of $N$ for $x$ in $M$. A term is closed if it contains no free variables. The set of free variables of a term $M$ is ${{\rm \sf {fv}}}(M)$. A context $ C$ is an expression obtained from a term by replacing some subterms with holes of the form $[\cdot ]_{i}$, where for every $i$ there can be multiple occurrences of hole $[\cdot ]_{i}$. We write $ C [M_1,\ldots ,M_n] $ for the term obtained by replacing each occurrence of $[\cdot ]_{i}$ in $ C$ with $M_i$.

We use a tilde to denote a tuple; for instance $\widetilde{M}$ is a tuple of terms, and $(\widetilde{M})_{i}$ is its $i$th element. We write tuples as $\lbrace M_i \rbrace _{i \in I}$ when we want to emphasize the indexing set, and we sometimes abbreviate this as $\lbrace M_i \rbrace _{i}$, implicitly assuming that $i$ ranges over an index set $I$. All notations are extended to tuples componentwise. Hence, we often write $ C [\widetilde{M}] $ for $ C [M_1,\ldots ,M_n] $ and $\widetilde{M}{\mathcal {R}}\widetilde{N}$ for $(M_1{\mathcal {R}}N_1)\wedge \cdots \wedge (M_n{\mathcal {R}}N_n)$.

By default, the results and definitions in the article are (implicitly) stated for closed terms. They can be generalized to open terms in a standard way for bisimulations in $\lambda$-calculi [26, 45, 48]. Thus, the properties between open terms $M$ and $N$ are derived from the corresponding properties between the closed terms $\lambda \widetilde{x}.M$ and $\lambda \widetilde{x}.N$, for $\lbrace \widetilde{x}\rbrace \supseteq {{\rm \sf {fv}}}(M) \cup {{\rm \sf {fv}}}(N)$. The caveat is proving that any term $M$ with $\lbrace \widetilde{x}\rbrace = {{\rm \sf {fv}}}(M)$ is contextually equivalent to its $\beta$-expansion $(\lambda \widetilde{x}.M) \widetilde{x}$. This is done by defining the least congruence relating $N$ and $(\lambda y. N)y$, for any $N$, and then showing that such a relation is preserved by reduction. Adapting the technique, detailed in, e.g., References [26, 45, 48], to probabilistic $\lambda$-calculi is straightforward, also because both in References [26, 45, 48] and in the current article the reduction relation is “big-step” (the main difference is that the auxiliary congruence relation has to be extended to formal sums).

The pure $\lambda$-calculi will be untyped, whereas we will find types convenient to treat the extension with store.

3 PROBABILISTIC CALL-BY-NAME $\lambda$-CALCULUS

The terms of the probabilistic $\lambda$-calculus are generated by the following grammar:

\[ M,N \,::= \,x \;\; |\;\;\lambda x. M \;\; |\;\;M N \;\; |\;\;M \oplus N. \]
We write $\Lambda _{\oplus }$ for the subset of closed terms. The values are the terms of the form $\lambda x. M$ (the abstractions). In call-by-name, the evaluation contexts (which, in contrast with standard contexts, may have only one occurrence of a single hole $ [ \cdot ]$) are
\[ C := C M \mid [ \cdot ] . \]
In probabilistic languages, the semantics of a term is usually a (sub)distribution, that is, a function that specifies the probabilities of all possible outcomes for that term [12]. We prefer, by contrast, syntactic representations of distributions, as formal sums, because they allow us a tighter control on the manipulations of the operational semantics, which is important in various places of our coinductive definitions and proofs. Formal sums have the form
\[ \sum _{i \in I}{p_i};{M_i}, \]
where $0 \lt p_i \le 1$, for each $i$, $\sum _{i\in I} p_{i} \le 1$, and $I$ is a (possibly infinite) indexing set. In a summand $ {p_i};{M_i}$ of a formal sum, $p_i$ is its probability value (or weight), and $M_i$ is its term. The terms of different summands of a formal sum need not be different. The weight ${{\tt weight}} ( \sum _{i \in I}{p_i};{M_i})$ of a formal sum is the probability value $\sum _{i \in I} p_{i}$. We let $F,G$ range over formal sums, and we write the empty formal sum as $\emptyset$ (i.e., the formal sum with no summands). We write $F=G$ if $F$ and $G$ are syntactically equal modulo a permutation of the summands. We use “$+$” for binary sums, in the usual infix form, and sometimes apply it also to formal sums. Thus, for $F= \sum _{j \in J}{q_j};{N_j}$ and $G= \sum _{j^{\prime } \in J^{\prime }}{q^{\prime }_{j^{\prime }}};{N^{\prime }_{j^{\prime }}}$ with $\sum _{j\in J}{q_j}+ \sum _{j^{\prime }\in J^{\prime }}{q^{\prime }_{j^{\prime }}} \le 1$, we have
\[ F+G\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i \in J \cup J^{\prime }}{p_i};{M_i}, \]
with ${p_i};{M_i}= {q_j};{N_j}$ for $i \in J$ and ${p_i};{M_i}= {q^{\prime }_{j^{\prime }}};{N^{\prime }_{j^{\prime }}}$ for $i \in J^{\prime }$.

Value formal sums, ranged over by $Y,Z$ are formal sums in which the term of each summand is a value.

There is an obvious mapping from formal sums to distributions, whereby a formal sum $F$ yields the distribution in which the probability of a term $M$ is the sum of the weights with which $M$ appears in summands of $F$. The mapping is not injective: in general, infinitely many formal sums yield the same distribution (because of possible duplicates in the terms of the summands of a formal sum). For instance, ${ \frac{1}{2}};{M} + {\frac{1}{4}};{M}$ and ${\frac{3}{4}};{M}$ are two different formal sums that correspond to the same distribution assigning probability $\frac{3}{4}$ to term $M$ and probability 0 to any $N$ such that $N \ne M$.

We sometimes decompose formal sums using a lifting construction. If $F_{i}= \sum _{j \in J_{i}}{p_{i,j}};{M_{i,j}}$, for $i \in I$, then

\[ \sum _{i \in I}{p_{i}}{\cdot }{F_{i}} \stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i \in I, j \in J_{i}}{p_{i}\cdot p_{i,j}};{M_{i,j}}. \]
Note that some $F_{i}$ can be the empty formal sum $\emptyset$, in which case the corresponding probability value $p_{i}$ is lost, i.e., $ \sum _{i \in I}{p_{i}}{\cdot }{F_{i}} = \sum _{i \in I\backslash \lbrace j\rbrace }{p_{i}}{\cdot }{F_{i}}$ if $F_{j}=\emptyset$. The semantics of a term $M$, written , is a value formal sum produced as the supremum of the value formal sums obtained by finite computations starting from $M$, using a preorder $\le _{{\rm {\tt apx}}}$ on formal sums in which $F_{1} \le _{{\rm {\tt apx}}}F_{2}$ if $F_{1}$ is an approximant of $F_{2}$ (in other words $F_{2}$ conveys more information than $F_{1}$); formally, $F_{2}=F_{1}+G$ for some $G$. The semantics is obtained in various steps, whose rules are presented in Figure 1:

Fig. 1.
Fig. 1. Operational semantics for call-by-name.

  1. a single-step reduction relation $ \longrightarrow$ from terms to formal sums;
  2. a multi-step reduction relation $\Longrightarrow$ from terms and formal sums to formal sums, from which a relation to value formal sums is extracted by retaining only the summands whose term is a value via the function ${\tt val}$:
    \[ \,{{\tt val}}{\left( \sum _{i}{p_{i}};{M_{i}}\right)}\,\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{\lbrace i | M_{i}\ \text{is a value}\rbrace }{p_{i}};{M_{i}}; \]

  3. the semantics , mapping terms and formal sums to value formal sums via the supremum construction.

If $ M \Longrightarrow \sum _{i \in I}{p_i};{M_i}$, then $I$ is finite, and each $i$ represents a “possible world” of the probabilistic run of $M$, with probability $p_i$ and outcome $M_i$. The subset of possible worlds in which $M_i$ is a value makes for an approximant of $M$, and from such approximants the semantics of $M$ is obtained. The definition of the semantics of a term as a supremum requires formal sums with infinitely many summands. As an example, consider the term $P$ defined in Equation (2) in the Introduction, whose semantics is $ \sum _{n \ge 1}{\frac{1}{2^{n}}};{Q}$.

Since value formal sums form an $\omega$-complete partial order with respect to the $\le _{{\rm {\tt apx}}}$ preorder, and for every $M$ the set of those value formal sums $Y$ such that is a countable directed set, the semantics of a term $M$ exists and is unique.

Relations $\Longrightarrow$ and are finitary in the sense that a derivation proof where one of such relations appears in the conclusion only contains a finite number of “small steps” (relation $\longrightarrow$). When reasoning by induction, sometimes we will need to make such number explicit, therefore writing $\Longrightarrow _n$ and , respectively.

Rule MulT, in contrast with MulFS, does not need a finitary condition on the indexing set, because a formal sum obtained in a small step from a term may have at most two summands.

If we define a semantics based on probability distributions, rather than on formal sums, then the definition of the multi-step reduction relation $F\Longrightarrow F$ from distributions to distributions becomes more subtle. In the corresponding rule in Figure 1,

\[ \begin{array}{cc} { \mathchoice{\rm{M{\small UL}FS}}{\rm{M{\small UL} FS}}{\mbox{\sc MulFS}}{\mbox{MULFS}} } \hspace{2.84544pt}\displaystyle { M_i \Longrightarrow F_i \over \sum\nolimits _{i\in I}{p_i};{M_i} + G\Longrightarrow \sum\nolimits _{i\in I}{p_i}{\cdot }{F_i} + G}\;\; \mbox{$I$ finite,} \end{array} \]
we have two possibilities (we use here the notation for formal sums as a notation for probability distributions). If we allow a decomposition of the distribution $F= \sum _{i\in I}{p_i};{M_i} + G,$ such that the same term $M$ can be both in the support of $ \sum _{i\in I}{p_i};{M_i}$ and in the support of $G$, then we allow uncountably many different reductions from $F$. Otherwise, such decomposition is not allowed and a parallel reduction of terms in a probabilistic binary choice $M \oplus M$ is forced by the semantics whenever the terms in the choice coincide, since the formal sum $ \frac{1}{2};M + \frac{1}{2}; M$ is treated as $1;M$. By resorting to formal sums, we thus remain closer to the syntax of the calculus and to standard definitions of reductions over terms.

Additional notation. We introduce here some additional notation, allowing us to easily manipulate terms and formal sums. This simplified notation is only used in the proofs of our results; in the rest of the article, we use the extended notation defined above. For $Y= \sum _{i}{p_{i}};{\lambda x. M_{i}}$ and $F= \sum _{i}{p_{i}};{M_{i}}$, we define:

3.1 Environmental Bisimulation

In call-by-name, a probabilistic environmental relation is a set of elements each of which is of the form $ (M,N)$ or $((M,N),Y,Z)$, where $M,N,Y,Z$ are all closed, $M,N$ are $\Lambda _{\oplus }$-terms and $Y,Z$ value formal sums. Intuitively, in the former elements $M$ and $N$ are terms that we wish to prove equal, and in the latter elements $Y$ and $Z$ are value formal sums obtained from $M$ and $N$ via evaluations and interactions with the environment. We use ${\mathcal {R}},{\mathcal {S}}$ to range over probabilistic environmental relations. In a triple $((M,N),Y,Z)$ the pair component $(M,N)$ is the static environment, and $Y,Z$ are the tested formal sums. We write $\mathrel {{{\mathcal {R}}_{(M,N)}}}$ for the relation $\lbrace (Y,Z) \,\mid \,((M,N),Y,Z)\in {\mathcal {R}}\rbrace$; we accordingly use the infix notation $Y\mathrel {{{\mathcal {R}}_{(M,N)}}}Z$, and similarly for $M \mathrel {\mathcal {R}}N$. In the remainder of the article, when discussing probabilistic environmental relations, bisimulations, simulations, or similar, we abbreviate “probabilistic environmental” as “PE,” or even omit it when non-ambiguous. Static environments (that is, pairs of $\Lambda _{\oplus }$-terms) are ranged over by ${\mathcal {E}}$. If ${\mathcal {E}}= (M,N),$ then its context closure, written $\mathrel {{\mathcal {E}}^\star }$, is the set of all pairs of the form $(C [ M] , C [ N])$. We use a similar notation for the context closure of relations on $\lambda$-terms.

Our results would also hold admitting arbitrary sets of pairs of $\Lambda _{\oplus }$-terms as static environments, rather then single pairs. We have chosen single pairs so to bring up the minimal requirement on static environments for our proofs to hold (notably the congruence for bisimilarity).

A PE relation ${\mathcal {R}}$ is a (PE) bisimulation if

  1. $M \mathrel {\mathcal {R}}N$ implies ;
  2. $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{{\mathcal {R}}_{{\mathcal {E}}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$ implies:
    1. $\sum _{i} p_{i} = \sum _{j} q_{j}$;
    2. for all $(P,Q) \in {\mathcal {E}}^{{\star }}$, .

We write $\approx$ for (PE) bisimilarity, the union of all PE bisimulations.

While $\approx$ is a PE relation, we are ultimately interested in comparing $\lambda$-terms ($M\approx N$ if $M\, \mathcal {R}\,N$ for some bisimulation ${\mathcal {R}}$).

Using the additional notation defined in Section 3, we can write the bisimulation clauses for formal sums as follows:

  1. $Y\mathrel {{\mathcal {R}}_{{\mathcal {E}}}} Z$ implies:
    1. ${{\tt weight}} (Y)= {{\tt weight}} (Z)$;
    2. for all $(P,Q) \in {\mathcal {E}}^{{\star }}$, .

We have

\[ M \stackrel{{{{\rm {\tt def}}}}}{=}(\lambda . \lambda . \Omega) \oplus (\lambda . \Omega) \approx \lambda .((\lambda . \Omega) \oplus \Omega) \stackrel{{{{\rm {\tt def}}}}}{=}N \, . \]
This is proved noting that and , using the bisimulation $\, \mathcal {R}\,$ in which $M \, \mathcal {R}\,N$, , ${\frac{1}{2}};{ \lambda . \Omega } \mathrel {{{\mathcal {R}}_{(M,N)}}} {\frac{1}{2}};{ \lambda . \Omega }$, and $\emptyset \mathrel {{{\mathcal {R}}_{(M,N)}}} \emptyset$. Terms $M,N$ could not be equated by a bisimulation that acted only on terms (ignoring formal sums), as neither $\lambda . \lambda . \Omega$ nor $\lambda . \Omega$ can be equated to $N$.

In Definition 3, and in the remainder of the article for other definitions of probabilistic bisimulation, the corresponding simulation is obtained by replacing the equality “$=$” on the weights with “$ \le$”; thus, in Definition 3, clause (2a) becomes $\sum _{i} p_{i} \le \sum _{j} q_{j}$.

The union of all simulations, similarity, is written .

  1. $\approx$ and are the largest bisimulation and simulation, respectively.
  2. is a preorder, and $\approx$ an equivalence.
  3. .

  1. If $M \approx N,$ then there is a bisimulation ${\mathcal {R}}$ such that $M \mathrel {\mathcal {R}}N$. By the definition of ${\mathcal {R}}$ and $\approx$, we have Analogously, if $({\mathcal {E}},Y,Z) \in \,\approx$ then $({\mathcal {E}},Y,Z) \in \,\mathrel {\mathcal {R}}$ for some bisimulation ${\mathcal {R}}$ and the formal sums have the same weight and, for all $P,Q \in {\mathcal {E}}^{{\star }}$, . The same holds for simulation.
  2. Identity is a simulation, hence is reflexive. If $\, \mathcal {R}\,, \mathrel {\mathcal {S}}$ are simulations, then their relational composition
    \[ \begin{array}{ll}\, \mathcal {R}\,\mathrel {\mathcal {S}}\;=& \lbrace (M,N)\,|\,\exists P \text{ such that }M \, \mathcal {R}\,P \mathrel {\mathcal {S}}N\rbrace \\ &\cup\ \lbrace ((M,N),Y,Z)\,|\, \exists Y^{\prime },P \text{ such that }Y\, \mathcal {R}\,_{(M,P)} Y^{\prime } \mathrel {\mathcal {S}}_{(P,N)} Z\rbrace \end{array} \]
    is a simulation. If $M \mathrel {\mathcal {R}}P \mathrel {\mathcal {S}}N,$ then , hence
    If $Y\, \mathcal {R}\,_{(M,P)} Y^{\prime } \mathrel {\mathcal {S}}_{(P,N)} Z,$ then ${{\tt weight}} (Y)\le {{\tt weight}} (Y^{\prime }) \le {{\tt weight}} (Z)$ and for every $C$, . Thus, is transitive and reflexive. Analogously, $\approx$ is reflexive and transitive, and for any bisimulation $\, \mathcal {R}\,$ it holds that
    \[ \begin{array}{ll}\, \mathcal {R}\,^{-1}=& \lbrace (M,N)| N \, \mathcal {R}\,M\rbrace \cup \lbrace ((M,N),Y,Z)| Z\, \mathcal {R}\,_{(N,M)} Y\rbrace \end{array} \]
    is a bisimulation as well
  3. The result follows from (1) and from the fact that the calculus is deterministic:
    1. if ${\mathcal {R}}$ is a bisimulation then both ${\mathcal {R}}$ and ${\mathcal {R}}^{-1}$ are simulations;
    2. to prove that , we show that is a bisimulation. Let ${\mathcal {R}}$ and ${\mathcal {S}}$ be two simulations. If $M \mathrel {\mathcal {R}}N$ and $N \mathrel {\mathcal {S}}M,$ then and , which implies that . If $((M,N),Y,Z) \in {\mathcal {R}}$ and $((N,M),Z,Y) \in {\mathcal {S}},$ then for all $C$, we have and . Therefore, . Finally, the clause on the weights holds by $((M,N),Y,Z) \in {\mathcal {R}}$ and $((N,M),Z,Y) \in {\mathcal {S}}$, which imply ${{\tt weight}} (Y)\le {{\tt weight}} (Z)$ and ${{\tt weight}} (Z)\le {{\tt weight}} (Y)$, respectively.

The bisimilarity, or similarity, is directly defined using the semantics of terms, which is a least-fixed point on top of big-step approximants. When proving properties about bisimilarity and similarity, therefore, we need to reason about such approximants. For this, we introduce a finite-step simulation in which the challenge reductions of the simulation game employ the big-step approximants (the relation of Figure 1). We cannot have characterizations of bisimilarity in terms of a finite-step bisimilarity, because, in general, the weights of the approximants of two bisimilar terms are different, as shown in Example 8, and so we should allow related formal sums to have different weights. Hence, to reason about bisimilarity, we go through its characterization via similarity (Theorem 7), and then the characterization of similarity via the finite-step similarity (Corollary 12). In this case, since we are defining a preorder rather than an equivalence, we can allow related formal sums to have different weights.

Let $P$ and $Q$ be the terms discussed in Equation (2) in Section 1:

\[ P \stackrel{{{{\rm {\tt def}}}}}{=}{RR} \;\; \mbox{ and }\;\; Q\stackrel{{{{\rm {\tt def}}}}}{=}\lambda . \Omega \: , \;\; \mbox{ for }\;\; R \stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. ((x x) \oplus Q) \]
A bisimulation relating $P$ and $Q$ is
\[ \left\lbrace (P,Q),\left((P,Q), \sum _{n \ge 1}{\frac{1}{2^{n}}};{Q}, {1};{Q}\right), ((P,Q),\emptyset ,\emptyset)\right\rbrace . \]
We could not prove the equality using finite-step approximants for bisimulation, since those for $P$ are of the form $ \sum _{1 \le n \le m}{\frac{1}{2^{n}}};{Q}$, for some $m$, and thus have a smaller total weight than the formal sum $ {1};{Q}$ immediately produced by $Q$.

A PE relation $\, \mathcal {R}\,$ is a finite-step simulation if

  1. $M \, \mathcal {R}\,N$ and imply ;
  2. $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{{\mathcal {R}}_{{\mathcal {E}}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$ implies:
    1. $\sum _{i} p_{i} \le \sum _{j} q_{j}$;
    2. for all $(P,Q) \in {\mathcal {E}}^{{\star }}$, if then .

We write for finite-step similarity. In finite-step simulations, the challenges are expressed by finitary reductions, since only a finite number of small-steps reductions $\longrightarrow$ can occur in the derivation of . Moreover, any result about finite-step similarity on $\Lambda _{\oplus }$-terms can be established using a finite-step simulation with only finite formal sums (i.e., formal sums with a finite number of summands) on the challenger side, though this constraint is not required in the definition. Indeed, finite formal sums can only reach finite formal sums via the finitary, multi-step relation.

We do not define clause (2b) of Definition 9 as follows:

  • for all $(P,Q) \in {\mathcal {E}}^{{\star }}$, if for every $i$
  • then

since we would not know how to prove congruence, and thus soundness, for such proof technique. This is because, as the index set $I$, ranged over by $i$, can be infinite, the challenge in the simulation game might not be finitary, i.e., it could allow infinitely many summands to perform a small-step reduction at the same time. By contrast, reduction on formal sums (from Figure 1) is finitary. This allows us to perform proofs by induction on the number of small-steps in a reduction, which is the strategy we use for proving congruence (Lemma 18).

We denote by ${\tt Pairs}({\mathcal {R}})$ the set of pairs of terms in a PE relation $\, \mathcal {R}\,$. We use two saturation constructions to turn a simulation into a finite-step simulation and conversely. Given a PE relation ${\mathcal {R}}$, its saturation by approximants is

\[ {\tt Pairs}({\mathcal {R}})\cup \lbrace ({\mathcal {E}},Y, Z) \,\mid \,\begin{array}{l} \mbox{there is } Y^{\prime } \mbox{ with } Y^{\prime } \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} Z\mbox{ and } Y\le _{{\rm {\tt apx}}}Y^{\prime } \; \rbrace , \end{array} \]
and its saturation by suprema is $\bigcup _{n} {\mathcal {R}}^{n}$, where
\[ \begin{array}{lll}{\mathcal {R}}^{0}&\stackrel{{{{\rm {\tt def}}}}}{=}{\mathcal {R}},&\\ {\mathcal {R}}^{n+1}&\stackrel{{{{\rm {\tt def}}}}}{=}{\mathcal {R}}^{n} \cup &\lbrace ({\mathcal {E}},Y, Z) \,\mid \,\mbox{there is a countable sequence } \lbrace Y_{i}\rbrace _{i \ge 0}\\ &&\mbox{ with } Y_{i} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} Z, \; \mbox{ } Y_{i} \le _{{\rm {\tt apx}}}Y_{i+1} , \mbox{ and } Y = \sup \lbrace Y_{i}\rbrace _{i} \rbrace . \end{array} \]

The saturation by suprema $\bigcup _{n} {\mathcal {R}}^{n}$ of a relation ${\mathcal {R}}$ is saturated with respect to triples $({\mathcal {E}},Y, Z)$ where $Y$ is the supremum of an $\omega$-chain $\lbrace Y_{i}\rbrace _{i \ge 0}$ with respect to $\le _{{\rm {\tt apx}}}$ such that there exists an $n$ such that for all $i$ it holds $Y_{i} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} Z$. However, the relation $ \bigcup _{n} {\mathcal {R}}^{n}$ is not itself saturated by suprema in the following sense. There might exist an $\omega$-chain $\lbrace Y_{i}\rbrace _{i \ge 0}$ with respect to $\le _{{\rm {\tt apx}}}$ such that for all $i$ it holds $Y_{i} (\,\bigcup _{n} {\mathcal {R}}^{n}_{{\mathcal {E}}}\,) Z$ (i.e., such that for all $i$ there exists an $n$ such that it holds $Y_{i} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} Z$), and yet it does not hold that $\sup \lbrace Y_{i}\rbrace _{i} (\,\bigcup _{n} {\mathcal {R}}^{n}_{{\mathcal {E}}}\,) Z$.

  1. The saturation by approximants of a simulation is a finite-step simulation.
  2. The saturation by suprema of a finite-step simulation is a simulation.

The proof of (1) follows from the definition of as the supremum of the set . For (2), the crux is proving by induction on $n$ that if $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$ then:

  1. $\sum _{i} p_{i} \le \sum _{j} q_{j}$;
  2. implies , for all $(P,Q) \in {\mathcal {E}}^{{\star }}$.

The details of the proof can be found in Appendix A.

The similarity and finite-step similarity preorders, and , coincide.

The result follows from Lemma 11 and from the fact that a simulation (respectively, a finite-step simulation) is included in its saturation by approximants (respectively, by suprema).

The following example highlights the differences between simulations and finite-step simulations, by proving the equality in Example 8 using finite-step simulations.

Terms $P$ and $Q$ of Example 8 can be proved equivalent by exhibiting the following finite-step simulations, where $Y_{0}\stackrel{{{{\rm {\tt def}}}}}{=}\emptyset$ and $Y_{m}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{1 \le n \le m}{\frac{1}{2^{n}}};{Q}$ for $m \ge 1$:

$\begin{array}{ll}\mathrel {\mathcal {R}}&\stackrel{{{{\rm {\tt def}}}}}{=}\lbrace (P,Q), ((P,Q), \emptyset , \emptyset)\rbrace \cup \lbrace ((P,Q), Y_{m}, {1};{Q})\,\mid \,m\ge 0\rbrace ,\\ \mathrel {\mathcal {S}}&\stackrel{{{{\rm {\tt def}}}}}{=}\lbrace (Q,P), ((Q,P), \emptyset , \emptyset), ((Q,P), {1};{Q}, \sum _{n \ge 1}{\frac{1}{2^{n}}};{Q}) \rbrace . \end{array}$

By ${\mathcal {R}}$, we have , and by ${\mathcal {S}}$, we have . Since the saturation constructions used in Lemma 11 allow us to freely move from simulations to finite-step simulations and vice versa, this is equivalent to showing that and , which in turn coincides with proving bisimilarity. Relation $\, \mathcal {R}\,$ can be turned into a simulation by saturating it by suprema, i.e., by adding the triple $((P,Q), \sup _{m}Y_{m}, {1};{Q})$. Indeed, we have . Conversely, we can obtain the finite-step simulation $\, \mathcal {R}\,$ out of the simulation

\[ \left\lbrace (P,Q),\left((P,Q), \sum _{n \ge 1}{\frac{1}{2^{n}}};{Q}, {1};{Q}\right), ((P,Q),\emptyset ,\emptyset)\right\rbrace \]
by saturating it by approximants, i.e., by adding to the simulation all pairs
\[ \left((P,Q), \sum _{i \in I}{\frac{1}{2^{i}}};{Q}, {1};{Q}\right), \]
where $I$ is a finite subset of natural numbers (we assume that $ \sum _{i \in I}{\frac{1}{2^{i}}};{Q}=\emptyset$ if $I$ is empty).

Given a relation $\, \mathcal {R}\,$, we say that $\, \mathcal {R}\,$ is saturated by approximants if for every pair $((M,N),Y,Z)$ in $\, \mathcal {R}\,$, if $Y^{\prime } \le _{{\rm {\tt apx}}}Y^{\prime }$ then $((M,N),Y^{\prime },Z) \in \, \mathcal {R}\,$. Example 13 also shows that finite-step simulations do not have to be saturated by approximants: relation $\mathrel {\mathcal {S}}$ is a finite-step simulation but it does not contain, e.g., the triple $((P,Q), {\frac{1}{4}};{Q}, {1};{Q})$. However, given a finite-step step simulation, we can always build a finite-step simulation saturated by approximants that contains it, by taking its saturation by approximants.

To derive the substitutivity properties of the similarity, and hence of the bisimilarity, we also need an up-to technique for the finite-step similarity. Specifically, we need an up-to lifting technique whereby, in the simulation game, two derivative formal sums can be decomposed into “smaller” formal sums and it is then sufficient that these are pairwise related. We write $\,{{\tt lift}}{({\mathcal {S}})}\,$ for the probabilistic lifting of a relation ${\mathcal {S}}$ to another relation on formal sums:

\[ \begin{array}{ll} \,{{\tt lift}}{({\mathcal {S}})}\,\stackrel{{{{\rm {\tt def}}}}}{=}& \Bigg\lbrace (F,G) \,\mid \,\mbox{ there are $I$, $p_i, F_{i}, G_{i}$, for $i\in I$, with } \\ & F_{i}\; {\mathcal {S}}\; G_{i} \mbox{ and } F= \displaystyle\sum _{i}{p_{i}}{\cdot }{F_{i}} \mbox{ and } G= \displaystyle\sum _{i}{p_{i}}{\cdot }{G_{i}} \Bigg\rbrace .\end{array} \]

A PE relation $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting if

  1. $M \, \mathcal {R}\,N$ and imply ;
  2. $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{{\mathcal {R}}_{{\mathcal {E}}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$ implies:
    1. $\sum _{i} p_{i} \le \sum _{j} q_{j}$;
    2. for all $(P,Q) \in {\mathcal {E}}^{{\star }}$, if then .

If $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting, then .

Let $\, \mathcal {R}\,$ be a finite-step simulation up-to lifting. Then $\mathrel {\mathcal {S}}$ is finite-step simulation:

\[ \mathrel {\mathcal {S}}\ \stackrel{{{{\rm {\tt def}}}}}{=}{\tt Pairs}(\, \mathcal {R}\,)\cup \lbrace ((M,N),Y,Z)\, |\, Y\,{{\tt lift}}{(\, \mathcal {R}\,_{(M, N)})}\, Z\rbrace . \]

If $M \mathrel {\mathcal {S}}N$ then $M \, \mathcal {R}\,N$, which implies that if then . Hence, .

Let $Y\mathrel {\mathcal {S}}_{(M,N)} Z$, i.e., $Y= \sum _{i}{p_{i}}{\cdot }{Y_{i}}$, $Z= \sum _{i}{p_{i}}{\cdot }{Z_{i}}$ and $Y_{i} \, \mathcal {R}\,_{(M,N)} Z_{i}$. For every $i$, ${{\tt weight}} (Y_{i}) \le {{\tt weight}} (Z_{i})$, hence ${{\tt weight}} (Y) \le {{\tt weight}} (Z)$.

For every $i$, we have implies by the definition of ${\mathcal {R}}$. Since implies that $Y^{\prime }= \sum _{i}{p_{i}}{\cdot }{Y^{\prime }_{i}}$, for some $Y^{\prime }_{i}$ such that , and , then . The result follows from $\,{{\tt lift}}{(\,{{\tt lift}}{(\, \mathcal {R}\,_{(M,N)})}\,)}\,=\,{{\tt lift}}{(\, \mathcal {R}\,_{(M,N)})}\,$.

Let $P\stackrel{{{{\rm {\tt def}}}}}{=}\lambda .Q$, $Q\stackrel{{{{\rm {\tt def}}}}}{=}\lambda .\Omega$, and

\[ \begin{array}{c}M\stackrel{{{{\rm {\tt def}}}}}{=}(P \oplus P) \oplus (Q \oplus Q), \quad N\stackrel{{{{\rm {\tt def}}}}}{=}(P \oplus Q) \oplus (P \oplus Q). \end{array} \]
The following finite-step simulation up-to lifting shows :
\[ \begin{array}{ll}\lbrace (M,N), ((M,N), {1};{P}, {1};{P}), ((M,N), {1};{Q}, {1};{Q}), ((M,N), \emptyset , {1};{P}), ((M,N), \emptyset , {1};{Q}), ((M,N), \emptyset , \emptyset) \rbrace . \end{array} \]
For this example, the “up-to lifting” technique allows us to have a relation with only empty or Dirac formal sums (i.e., a single summand with probability 1).

We have seen in Example 8 that the terms $P$ and $Q$ defined as

\[ P \stackrel{{{{\rm {\tt def}}}}}{=}{RR} \;\; \mbox{ and }\;\; Q\stackrel{{{{\rm {\tt def}}}}}{=}\lambda . \Omega \: , \;\; \mbox{ for }\;\; R \stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. ((x x) \oplus Q) \]
cannot be proved equivalent using a bisimulation with small-step, finitary clauses. We could prove the terms equivalent by using a bisimulation with small-step clauses if we allowed the reached formal sums to be decomposed into equally weighted formal sums (formally: using the up-to-distribution-and-lifting technique discussed in Section 3.3). In this case, it would be sufficient to define a bisimulation relating $P$ and $Q$ and their Dirac formal sums, and we would only need to consider the formal sum ${ \frac{1}{2}};{P} + { \frac{1}{2}};{Q}$ (reached by $P$ in one step) and decompose ${1};{Q}$ (the formal sum reached in zero steps by $Q$) as ${ \frac{1}{2}};{Q} + { \frac{1}{2}};{Q}$.

However, such a bisimulation would not be complete, since the same reasoning would not apply to the terms $M$ and $N$ defined below, where $R_{1} \stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. ((xx) \oplus \lambda . Q)$ and $R_{2} \stackrel{{{{\rm {\tt def}}}}}{=}\lambda x. ((xx) \oplus Q)$:

\[ M \stackrel{{{{\rm {\tt def}}}}}{=}(R_{1} R_{1}) \oplus \lambda .\lambda .Q \quad N \stackrel{{{{\rm {\tt def}}}}}{=}\lambda . ((R_{2} R_{2}) \oplus \lambda . Q). \]
Terms $M$ and $N$ are contextually equivalent, but cannot be proved equivalent using a small-step, finitary bisimulation. Indeed, $ {1};{N}$ is only equivalent to the semantics of $M$, which is not reachable in a finite number of steps. No decomposition of $ {1};{N}$ can be matched with a decomposition of any approximation of the semantics of $M$.

We can now prove that is a precongruence on terms.

If then , for any context $C$.

Given a a finite-step simulation ${\mathcal {R}}$ saturated by approximants, we prove that the PE relation

\[ \begin{array}{ll}&\lbrace (C[M],C[N])\,\mid \,M \, \mathcal {R}\,N\rbrace \\ &\cup \lbrace ((C[M],C[N]),{1};{\lambda x. C^{\prime }[M]},{1};{\lambda x. C^{\prime }[N]}) \,\mid \,M \, \mathcal {R}\,N\rbrace \\ &\cup \lbrace ((C[M],C[N]),Y,Z) \,\mid \,Y\, \mathcal {R}\,_{(M,N)} Z\rbrace \\ &\cup \lbrace ((M,N),\emptyset ,Z) \,\mid \,\mbox{ for some } M,N, Z\rbrace \end{array} \]
is a finite-step simulation up-to lifting. The details of the proof can be found in Appendix A.

Hence, (pre)congruence results for bisimilarity and similarity follow from Lemma 18, Corollary 12 and the fact that (Theorem 7).

On $\Lambda _{\oplus }$-terms, $\approx$ is a congruence, and a precongruence.

3.2 Contextual Equivalence

Let be the probability of termination of $M$.

$M$ and $N$ are in the contextual preorder, written $M\le _{{\rm {\tt ctx}}}N$, (respectively, in contextual equivalence, written $M =_{{\rm {\tt ctx}}}N$), if ${ C [M] \Downarrow } \le { C [N] \Downarrow }$ (respectively, ${ C [M] \Downarrow } = { C [N] \Downarrow }$), for every context $ C$.

We pointed out in Section 2 that all our definitions and results are for closed terms. The definitions above of contextual preorder and equivalence could actually be used also for open terms. In contrast, the definitions of simulations and bisimulations (and alike relations) are on closed terms only (they are extended to open terms by considering closing $\lambda$-abstractions, see the discussion in Section 2).

On $\Lambda _{\oplus }$-terms, .

We prove that the following is a simulation:

We have $M \mathrel {\mathcal {R}}N$ if and only if $M \le _{{\rm {\tt ctx}}}N$, which by definition of ${\mathcal {R}}$ implies .

If $Y\mathrel {{\mathcal {R}}_{(M,N)}} Z,$ then and for some context $C$. Hence, for any $C^{\prime }$, we have and (we refer the reader to Appendix A for a proof of these properties) and by the definition of $\, \mathcal {R}\,$, we have .

On $\Lambda _{\oplus }$-terms:

  1. relations $\le _{{\rm {\tt ctx}}}$ and coincide.
  2. relations $=_{{\rm {\tt ctx}}}$ and $\approx$ coincide.

Completeness of the simulation preorder holds by Lemma 22. The converse, i.e., soundness, follows from the fact that is a precongruence (Corollary 19) and that implies (by clause (2a) of simulation). Hence, implies implies .

Completeness and soundness for $\approx$ follow from (1) and the fact that $\approx$ (respectively, $=_{{\rm {\tt ctx}}}$) is the kernel of (respectively, $\le _{{\rm {\tt ctx}}}$), by item (3) of Theorem 7.

3.3 Up-to Techniques

We have pointed out (Examples 5 and 8) that our simulations (and bisimulations) have to be based on formal sums and cannot employ finitary reductions, as in ordinary environmental bisimulations, to faithfully represent contextual equivalence. However, every one of these features is sound and can therefore be used in proof techniques. In this section, we show examples of such techniques. These techniques are very limited, and we leave for future work the development of more conclusive ones.

Finitary reductions—the possibility of stopping the evaluation of a term after a few $\beta$-reductions—are interesting in enhancements with up-to context (the ability of isolating and removing common contexts in derivative terms), because sometimes such common contexts appear in the middle of a reduction. For applicability, up-to context is usually combined with further up-to techniques that allow us to bring up the common contexts. In the first up-to technique, where the coinduction game still uses formal sums, we combine up-to context with up-to lifting, so to be able to decompose related formal sums into pieces with different common contexts. In the technique, the context closure of the up-to context is only applied onto $\lambda$-terms. The closure could probably be made more powerful by applying it also on formal sums, at the price of a more complex proof, but its usefulness is unclear.

In clause (2b) below, and in the remainder of the article, we use the function ${{\tt dirac}}$ that takes a set of pairs of $\lambda$-terms $(M,N)$ and returns the set of pairs of their (Dirac) formal sums $({1};{M}, {1};{N})$.

A PE relation $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting and context if:

  1. $M \, \mathcal {R}\,N$ and imply ;
  2. $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{{\mathcal {R}}_{{\mathcal {E}}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$ implies:
    1. $\sum _{i} p_{i} \le \sum _{j} q_{j}$;
    2. for all $(P,Q) \in {\mathcal {E}}^{{\star }}$, one of the following holds:
      • there are $F,G$ such that and
        with $F\,{{\tt lift}}{({{\tt dirac}}{({{\mathcal {E}}}^{{\star }})})}\, G$;
      • if then
        .

The following lemma proves the soundness of the up-to lifting and context technique.

If $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting and context, then .

Let ${\mathcal {R}}$ be a finite-step simulation up-to lifting and context. We prove that

\[ \begin{array}{l}{\mathcal {R}}^{\prime }\stackrel{{{{\rm {\tt def}}}}}{=}{\tt Pairs}({\mathcal {R}}) \\ \cup \: \lbrace ((M,N),Y,Z) \,\mid \,Y^{\prime } \, \mathcal {R}\,_{(M,N)} Z\mbox{ and } Y\le _{{\rm {\tt apx}}}Y^{\prime } \mbox{, for some $Y^{\prime }$} \rbrace \\ \cup \: \lbrace ((M,N),{1};{\lambda x. C[M]},{1};{\lambda x. C[N]})\,\mid \,M \mathrel {\mathcal {R}}N \rbrace \\ \cup \: \lbrace ((M,N),\emptyset ,Z) \,\mid \,\mbox{ for some } M,N,Z\rbrace \end{array} \]
is a finite-step simulation up-to lifting, from which the result follows by ${\mathcal {R}}\subseteq {\mathcal {R}}^{\prime }$. The details of the proof can be found in Appendix A.

The up-to lifting and context technique allows us to prove that terms $A,B$ defined in Equation (1) in Section 1 are bisimilar. We prove using the PE relation

Indeed, and and, for any pair of arguments of the form $(C[A], C[B])$ used to test the formal sums, we have ${1};{C[A] \oplus \Omega } \longrightarrow { \frac{1}{2}};{C[A]} +{ \frac{1}{2}};{\Omega }$ and the pair $({ \frac{1}{2}};{C[A]} +{ \frac{1}{2}};{\Omega }, { \frac{1}{2}};{C[B]}+{ \frac{1}{2}};{\Omega })$ is in $\,{{\tt lift}}{({{\tt dirac}}{(\lbrace (A,B)\rbrace ^{{\star }})})}$. Analogously, we prove using the relation . In this example, we have only used the option given by the first bullet for case (2b) in the definition of the up-to technique. The option given by the second bullet for case (2b) can be useful for dealing with analogous examples but with terms having an infinitary behavior (see Example 13 and Remark 17), which might force the opponent side in the bisimulation game to directly evaluate to its semantics to reply to the challenger.

In the second up-to technique, the game is entirely played on terms, without appeal to formal sums. We present the technique in combination with forms of up-to context, up-to distribution, up-to reduction, and up-to lifting. This technique will allow us to prove the equivalence of two probabilistic fixed-point combinators in Section 3.4.

A term relation is a relation $\mathrel {{\mathcal {T}}_{(M,N)}}$ on values of $\Lambda _{\oplus }$ and the index $(M,N)$ is a pair of $\Lambda _{\oplus }$-terms. The index corresponds, intuitively, to a static environment of an environmental bisimulation. We use the notation $\mathrel {{\mathcal {T}}_{(M,N)}^{\star -}}$ for $\mathrel {{\mathcal {T}}_{(M,N)}} \, \cup \, \mathrel {\lbrace (M,N)\rbrace ^\star }$.

A term $M$ deterministically reduces to $G$ (notation: $\overset{\rm {d}}{\Longrightarrow }$) if $M \Longrightarrow G$ and only the last reduction in the sequence may be derived using rule Sum . We write if $M$ and $M^{\prime }$ deterministically reduce to the same formal sum, but $M^{\prime }$ takes fewer steps. That is, there are $G,m,m^{\prime }$ with $m \ge m^{\prime }$ and with $M \overset{\rm {d}}{\Longrightarrow }_{m} G$, and $M^{\prime } \overset{\rm {d}}{\Longrightarrow }_{m^{\prime }} G$ (where $\overset{\rm {d}}{\Longrightarrow }_{m}$ denotes as usual that $m$ “small steps” are performed, i.e., that $m$ reductions $\longrightarrow$ occur in the derivation of $\overset{\rm {d}}{\Longrightarrow }$). Thus, in Definition 27, is the set

We write $F \mathrel {=_{{\rm {\tt dis}}}}F^{\prime }$ if $F$ and $F^{\prime }$ represent the same probability distribution. In the up-to technique below, gives us the “up-to reduction,” and $\mathrel {=_{{\rm {\tt dis}}}}$ the “up-to distribution.” We use up-to distribution to manipulate formal sums, which are purely syntactic objects. Finally, $\overset{\rm {d}}{\Longrightarrow }\mathrel {=_{{\rm {\tt dis}}}}$ is the composition of the two relations, i.e., $M \overset{\rm {d}}{\Longrightarrow }\mathrel {=_{{\rm {\tt dis}}}}F$ if there is $F^{\prime }$ with $M \overset{\rm {d}}{\Longrightarrow }F^{\prime }$ and $F^{\prime } \mathrel {=_{{\rm {\tt dis}}}}F$.

Let $\mathrel {{\mathcal {T}}_{(M,N)}}$ be a term relation. Then, {(M,N)} is a bisimulation up-to context closure, distribution, reduction, and lifting if

  1. ;
  2. if $ {\lambda x. M^{\prime }} \mathrel {{\mathcal {T}}_{(M,N)}}{\lambda x. N^{\prime }}$ then for all $(P,Q) \in \mathrel {\lbrace (M,N)\rbrace ^\star }$,

We first establish the soundness of the up-to distribution and lifting technique. For a relation ${\mathcal {R}}$ on formal sums, we write ${{\tt dislift}}({{\mathcal {R}}})$ for the set of pairs $F, G$ such that $F\mathrel {=_{{\rm {\tt dis}}}}\,{{\tt lift}}{({\mathcal {R}})}\, \mathrel {=_{{\rm {\tt dis}}}}G$. The up-to distribution and lifting technique is obtained by substituting $\,{{\tt lift}}{(\cdot)}\,$ with ${{\tt dislift}}({\cdot })$ in definition 14.

If ${\mathcal {R}}$ is a finite-step simulation up-to distribution and lifting, then .

The proof follows as the one for the up-to lifting technique (Lemma 15), and exploits the fact that ${{\tt dislift}}({{{\tt dislift}}({\cdot })})={{\tt dislift}}({\cdot })$. Then, by exploiting this result, we can derive the soundness of the full technique in Definition 27. An environmental relation has two kinds of components, i.e., it contains pairs of terms and it contains triples, each containing a pair of terms and two formal sums. In a bisimulation up-to context closure, distribution, reduction, and lifting we have only allowed the first kind of component, and the soundness proof exhibits the missing triples (the proof can be found in Appendix A).

If there is a term relation $\mathrel {{\mathcal {T}}_{(M,N)}}$ such that $\lbrace (M,N)\rbrace$ is a bisimulation up-to context closure, distribution, reduction, and lifting, then $(M,N) \in {\approx }$.

The restriction to deterministic transitions $\overset{\rm {d}}{\Longrightarrow }$ (i.e., to transitions where only the last reduction in the sequence may be derived using rule Sum) in the definition of the up-to technique is used in the proof of soundness, to carry out an induction over the number of small-steps reductions.

The first clause of the up-to technique in Definition 27 is not sound if $\mathrel {{\mathcal {T}}_{(M,N)}}$ is substituted by $\mathrel {{\mathcal {T}}_{(M,N)}^{\star -}}$: in this case, for any pair of values $V,W$, relation $ \mathrel {{\mathcal {T}}_{(V,W)}} \stackrel{{{{\rm {\tt def}}}}}{=}\emptyset$ would satisfy the definition, since , and ${1};{V} \;{{\tt dirac}}{(\lbrace (V,W)\rbrace ^{{\star }})}\; {1};{W}$.

3.4 Fixed-point Combinator Example

In the reductions of this example, we write a Dirac formal sum ${1};{M}$ as $M$, so to have reductions between $\lambda$-terms. We exploit the up-to technique of Definition 27 to prove the equivalence between two fixed-point combinators. One of the combinators is $\Upsilon$:

\[ \begin{array}{rrcl}& \Upsilon & \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda y. y (Dy(Dy)), \\ \mbox{where} & D &\stackrel{{{{\rm {\tt def}}}}}{=}& \lambda y . \lambda x. y (xx) . \end{array} \]
For any term $L$, we have
\begin{equation} \begin{array}{lrcl} & \Upsilon L & \longrightarrow & L (DL (DL)), \\ \mbox{and then } & DL (DL) & \longrightarrow \longrightarrow & L (DL (DL)) . \end{array} \end{equation}

The other combinator at any cycle can probabilistically decide whether to behave differently (i.e., as Turing's fixed-point combinator) or to turn for good into the previous $\Upsilon$ combinator:

\[ \begin{array}{lrcl}& \Upsilon ^{\prime }& \stackrel{{{{\rm {\tt def}}}}}{=}& D^{\prime }D^{\prime }, \\ \mbox{where } & D^{\prime }& \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda x. \lambda y . ((y (D y (Dy))) \oplus (y (xxy))) . \end{array} \]
Thus, the computation of $\Upsilon ^{\prime }L$ will unveil, for a while, some $L$’s while computing as Turing's combinator, and then will continue unveiling $L$’s by computing as $\Upsilon$. Indeed, for
\[ \Upsilon ^{\prime }_1 \stackrel{{{{\rm {\tt def}}}}}{=}\lambda y . ((y (D y (Dy))) \oplus (y (D^{\prime }D^{\prime }y))) \, , \]
we have
\begin{equation} \begin{array}{rcl} \Upsilon ^{\prime }L \longrightarrow \Upsilon ^{\prime }_1 L & \longrightarrow & (L(DL (DL))) \oplus (L (D^{\prime }D^{\prime }L)) \\[2pt] & \longrightarrow & { \frac{1}{2}};{ L (DL (DL))} + { \frac{1}{2}};{L (D^{\prime }D^{\prime }L) }. \end{array} \end{equation}
We can establish $\Upsilon \approx \Upsilon ^{\prime }$ using the term relation
\[ \mathrel {{\mathcal {T}}_{(\Upsilon , \Upsilon ^{\prime })}} \stackrel{{{{\rm {\tt def}}}}}{=}\lbrace (\Upsilon , \Upsilon ^{\prime }_1) \rbrace . \]
The interesting case is the bisimulation clause for $(\Upsilon , \Upsilon ^{\prime }_1)$. Take any $M \mathrel {\lbrace (\Upsilon , \Upsilon ^{\prime }) \rbrace ^\star } N$. By Equation (3), we have $ \Upsilon M \longrightarrow M (DM (DM))$, whereas by Equation (4), $\Upsilon ^{\prime }_{1} N \overset{\rm {d}}{\Longrightarrow }{ \frac{1}{2}};{ N (DN (DN))} + { \frac{1}{2}};{N (D^{\prime }D^{\prime }N) }$. Now, we could conclude, up-to context closure, distribution, reduction, and lifting, if we can show that the pairs
\[ \begin{array}{rl}& (M (DM (DM)), N (DN (DN)))\\ \mbox{and } & (M (DM (DM)), N (\Upsilon ^{\prime }N)) \end{array} \]
are in . This holds because: the first pair is in $ \mathrel {\lbrace (\Upsilon , \Upsilon ^{\prime }) \rbrace ^\star }$; for the second pair, by Equation (3), we deduce , and then we have

The example also shows the usefulness of static environments (whose terms need not be values) for context closures in “up-to context” techniques.

4 PROBABILISTIC CALL-BY-VALUE $\lambda$-CALCULUS

In call-by-value, the static environments are not anymore sufficient. As in ordinary environmental bisimulations, we need a dynamic environment to record the values produced during the bisimulation game. In ordinary environmental bisimulations, we can see such environments as tuples of values. In the probabilistic case formal sums come into the picture. Environment formal sums are terms of the form

\[ \sum _{i}{p_{i}};{\widetilde{V}_{i}} \]
(i.e., sums of weighted tuples), in which all tuples $\widetilde{V}_i$ have the same length and, as for ordinary formal sums, $0\lt p_i \le 1$ for each $i$ and $\sum _i p_i \le 1$. We call the length of the tuples $\widetilde{V}_i$’s the length of the environment formal sum. In case the index set $I$ of the formal sum is empty, i.e., if there are no summands, we assume to have an empty formal sum $\emptyset _{n}$ for any length $n$. This index will be generally omitted when clear by the context. The tuples $\widetilde{V}_i$ represent the dynamic environment: the knowledge that an observer has accumulated during the bisimulation game. There may be several such elements $ \widetilde{V}_i$, reflecting the possible worlds produced by the probabilistic evaluation. During the bisimulation game, the environment formal sum is updated. Viewing the environment formal sum as a matrix, in which $\widetilde{V}_i$ represents the $i$-row and the elements $(\widetilde{V}_1)_{r},(\widetilde{V}_2)_{r}, \ldots$ (the $r$th element of each row) represent the $r$th column, a column is a set of values that the various possible worlds have produced at the same step of the bisimulation game. (This explains why the tuples $\widetilde{V}_i$’s of the sum have the same length.)

More precisely, in the bisimulation game at each possible world $i$ a term $M_i$ (constructed from the $\widetilde{V}_i$’s using a context closure discussed below) is evaluated. The evaluation of $M_i$ yields, probabilistically, a multiset of values (as a formal sum). This multiset is empty when all evaluations from $M_i$ diverge; in this case the whole row $i$ disappears, meaning that in the $i$th possible world the observer never receives an answer. When the multiset is non-empty, the row $i$ is split into as many possible worlds as the values in the multiset. For instance, if the evaluation of $M_i$ produces $V$ with probability $ \frac{1}{2}$ and $V^{\prime }$ with probability $ \frac{1}{3}$, then the row $ {p_i};{\widetilde{V}_i}$ is split into the two rows $ { \frac{1}{2} \cdot p_i};{\widetilde{V}_i, V}$ and ${ \frac{1}{3} \cdot p_i};{\widetilde{V}_i, V^{\prime }}$.

This splitting operation is captured by the following multiplication of an environment formal sum $ \sum _{i\in I}{p_i};{\widetilde{V}_i}$ and a tuple of formal sums $Y_i = \sum _{j\in J_i}{p_{i,j}};{V_{i,j}}$:

\[ \sum _{i\in I}{p_i};{\widetilde{V}_i}\cdot Y_i \stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i\in I,j\in J_i}{{p_{i}}\cdot p_{i,j}};{{\widetilde{V}_{i}}, V_{i,j}}. \]
We use $\mathbf {Y},\mathbf {Z}$ to range over environment formal sums, and we sometimes treat a formal sum as a special case of environment formal sum in which all tuples have length one.

The view of environment formal sums as matrices is illustrated in Figure 2, for an environment formal sum $ \mathbf {Y}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{1\le i\le 3}{p_i};{\widetilde{V}_i}$ of length 4. The figure also illustrates the extraction of the column $r$ of the formal sum, written , that yields the tuple of values along the same column, and the multiplication of an environment formal sum with formal sums resulting from the semantics of terms, one per row (where $\,\mathit {I}\,=\lambda x. x$ is the identity function).

Fig. 2.
Fig. 2. Formal sums as matrices.

The dynamic environment of two environment formal sums of the same length $ \sum _{i\in I}{p_i};{\widetilde{V}_i}$ and $ \sum _{j\in J}{q_j};{\widetilde{W}_j}$ is the pair of tuples (of tuples of the same length) $(\lbrace \widetilde{V}_{i}\rbrace _{i\in I}, \lbrace \widetilde{W}_{j}\rbrace _{j\in J})$. In environmental bisimulations, the input for two higher-order functions is constructed as the context closure of their environments. In call-by-value, the environments have both a static and a dynamic component and the inputs are constructed accordingly. Given a static environment $(M,N)$ and a dynamic environment $(\lbrace \widetilde{V}_{i}\rbrace _{i}, \lbrace \widetilde{W}_{j}\rbrace _{j})$, their context closure, written

\[ (\lbrace M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}, \]
is the set of all pairs of tuples $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ for which there is a context $C$ such that for every $i$, we have $T_{i}=C[M,\widetilde{V}_{i}]$, and for every $j$ we have $U_{j}=C[N,\widetilde{W}_{j}]$. Thus, every $T_{i}$ is obtained from the same context $C$ by filling its holes with the first element $M$ of the static environment and the dynamic environment $\widetilde{V}_i$. Similarly for $U_{j}$, using $N$, the tuple $\widetilde{W}_j$ and the same context $C$. Moreover, as we are in call-by-value, $C$ should be a value context, that is, terms $T_{i}$ and $U_{j}$ are values for all $i,j$. Hence, if $M$ or $N$ are not values then $C\ne [\cdot ]_{1}$.

The operational semantics of call-by-value is defined as in call-by-name, provided that the rule for $\beta$-reduction and the evaluation contexts are redefined thus:

\[ \begin{array}{c} {\rm{B{\small ETA}V}} \displaystyle { \over (\lambda x. M) V \longrightarrow {{1};{M \lbrace V\!/\!x\rbrace }}}, \\[10pt] \text{Evaluation contexts } \qquad C={[\cdot ]}\;\; |\;\;C M \;\; |\;\;V C. \end{array} \]
The probabilistic lifting of a relation ${\mathcal {S}}$ on environment formal sums is defined as for call-by-name:
\[ \begin{array}{ll} \,{{\tt lift}}{({\mathcal {S}})}\,\stackrel{{{{\rm {\tt def}}}}}{=}& \Bigg\lbrace (\mathbf {F},\mathbf {G}) \,\mid \,\mbox{ there are $I$, $p_i, \mathbf {F}_{i}, \mathbf {G}_{i}$, for $i\in I$, with } \\ & \mathbf {F}_{i}\; {\mathcal {S}}\; \mathbf {G}_{i} \mbox{ and } F= \displaystyle\sum _{i}{p_{i}}{\cdot }{\mathbf {F}_{i}} \mbox{ and } G= \displaystyle\sum _{i}{p_{i}}{\cdot }{\mathbf {G}_{i}} \Bigg\rbrace .\end{array} \]

4.1 Environmental Bisimulation

In call-by-value, a probabilistic environmental relation (that we still abbreviate as PE relation) is like for call-by-name, except that formal sums are replaced by environment formal sums. That is, each element of the relation is either of the form $ (M,N)$ (a pair of $\Lambda _{\oplus }$-terms) or $\mathbf {Y}\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}\mathbf {Z}$ (two environment formal sums, collecting the dynamic environment, with a static environment).

If ${\mathcal {E}}=(M,N)$ is a static environment, then ${\mathcal {E}}_{1}$ and ${\mathcal {E}}_{2}$ denote the projections, i.e., the terms $M$ and $N$, respectively.

In a PE relation, related environment formal sums are compatible, meaning that they have the same length. In the remainder, compatibility of environment formal sums is tacitly assumed.

In clause (1) below, we see formal sums as special cases of environment formal sums.

A PE relation is a (PE) bisimulation if

  1. $M \mathrel {\mathcal {R}}N$ implies ;
  2. $ \sum _{i}{p_{i}};{\widetilde{V}_{i}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{\widetilde{W}_{j}}$ implies:
    1. $\sum _{i} p_{i} = \sum _{j} q_{j}$;
    2. for all $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $(\widetilde{W}_{j})_{r}=\lambda x. N_{j}$ then
      for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, we have

    3. .

(PE) bisimilarity, $\approx$, is the union of all PE bisimulations, and the corresponding similarity is .

The structure of the above definition is similar to that of ordinary environmental bisimulations. There are three main differences: first, the appearance of formal sums and of the probability measures (notably in clause (2a)); second, the use of an (infinitary) big-step semantics, rather than a small-step, which shows up in the function in clauses (1), (2b), and (2c); third, the appearance of a static environment, that is used in the context closure and in clauses (1) and (2c). In clause (2b), the related environment formal sums, viewed as matrices, grow by the addition of a new column resulting, on left-hand side, from the multiplication of each row ${p_i};{\widetilde{V}_i}$ with the formal sum , and similarly on the right-hand side. Thus, the compatibility between related environment formal sums is maintained. Clause (2c) allows to re-evaluate the static environment at any time. This clause and other features are necessary to achieve full abstraction in the imperative case (see Section 5.1); they could be removed in pure call-by-value, following Reference [8].

Clause (1) could be substituted by

  • $M \mathrel {\mathcal {R}}N$ implies ${1};{\emptyset }\mathrel {{\mathcal {R}}_{(M,N)}} {1};{\emptyset }$

where ${1};{\emptyset }$ is the Dirac formal sum with empty environment. Clause (2c) then guarantees that . We did not use this definition for continuity with the call-by-name case, and since it is not needed for pure calculi. By contrast, a modification of clause (1) analogous to ($1^{\prime }$) is used in Definition 42 of bisimulation for imperative calculi (see Example 43).

We have seen in Example 5 that the following terms $M$ and $N$ are equivalent in call-by-name:

\[ M \stackrel{{{{\rm {\tt def}}}}}{=}(\lambda . \lambda . \Omega) \oplus (\lambda . \Omega)\qquad N \stackrel{{{{\rm {\tt def}}}}}{=}\lambda .((\lambda . \Omega) \oplus \Omega). \]
In call-by-value, the presence of the dynamic environment in the definition of bisimulation allows us to distinguish the terms. A call-by-value bisimulation relating these terms should contain the formal sums and , with static environment ${\mathcal {E}}=(M,N)$, and thus the triple $ ({\mathcal {E}}, { \frac{1}{2}};{\lambda . \lambda . \Omega , \lambda . \Omega },{ \frac{1}{2}};{N, \lambda . \Omega })$ would be in the relation as well. However, the values in the first column of the dynamic environment can be tested again, by clause (2b) of bisimulation, leading to the triple
\[ \left({\mathcal {E}}, { \frac{1}{2}};{\lambda . \lambda . \Omega , \lambda . \Omega , \lambda . \Omega },{ \frac{1}{4}};{N, \lambda . \Omega , \lambda . \Omega }\right), \]
which does not satisfy clause (2a).

We want the bisimulation to distinguish the terms in call-by-value, since $M$ and $N$ are not contextually equivalent in a call-by-value setting, in contrast with call-by-name. In call-by-value, the context $C\stackrel{{{{\rm {\tt def}}}}}{=}(\lambda x. x \,(x \,\lambda y.y)) [ \cdot ]$ separates the two terms. The context first evaluates the given term in argument position, and then copies the value resulting from the evaluation and executes it (i.e., feeds it with an argument) twice. We have that $C[M]$ has probability one half of returning a value, and $C[N]$ has probability a quarter. In the first case, both value $\lambda . \lambda . \Omega$ and value $\lambda . \Omega$ are copied with probability one half, and thus $C[M]$ has probability one half of converging (i.e., one half times the probability that $\lambda .\lambda .\Omega$ converges two times in a row when applied to an argument, which is one) and one half of diverging (i.e., one half times the probability that $\lambda . \Omega$ converges two times in a row when applied to an argument, which is zero). In $C[N]$, the term $N$ itself is copied with probability one, so $C[N]$ converges with probability one quarter (i.e., one times the probability that $N$ converges two times in a row when applied to an argument, which is one half times one half).

The main results for environmental bisimilarity and similarity in call-by-value (congruence and full abstraction with respect to contextual preorder and equivalence) are as for call-by-name, and the structure of the proofs is similar. The details are, however, different due to the presence of dynamic environments. As for call-by-name, so in call-by-value to reason about bisimilarity and similarity, we need a finite-step simulation, with challenges produced by the finitary big-step approximants. To make sure that the challenges are finite-step, we define extended environment formal sums, i.e., terms

\[ \sum _{i}{p_{i}};{\widetilde{V}_{i}};{M_{i}}, \]
in which the environment formal sum $ \sum _{i}{p_{i}};{\widetilde{V}_{i}}$ is extended with an additional column of arbitrary $\Lambda _{\oplus }$-term (not necessarily values). Intuitively, an element $ \widetilde{V}_i; M_i$ indicates that the $\lambda$-term $M_i$ has to be run with an observer whose knowledge is $ \widetilde{V}_i$. Extended environment formal sums are ranged over by $\mathbf {F},\mathbf {G}$ and $\,{{\tt val}}{(\mathbf {F})}\,$ is defined analogously to formal sums:
\[ \,{{\tt val}}{\left( \sum _{i}{p_{i}};{\widetilde{V}_{i}};{M_{i}}\right)}\,\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{\lbrace i | M_{i} \text{is a value}\rbrace }{p_{i}};{\widetilde{V}_{i}, M_{i}}\text{.} \]

Extended environment formal sums allow us to define the multi-step reduction relation from extended environment formal sums to environment formal sums: for $ \mathbf {F}= \sum _{i \in I}{p_{i}};{\widetilde{V}_{i}};{M_{i}} + \mathbf {G}$, where $I$ is a finite set, we set

This intuitively corresponds to the multi-step reduction relation from formal sums to value formal sums. For an extended environment formal sum $\mathbf {F}= \sum _{i}{p_{i}};{\widetilde{V}_{i}};{M_{i}}$, we let , and we have .

Additional notation. As we shall now describe, we extend to (extended) environment formal sums the notations for $\beta$-reduction, contexts, and application on formal sums, and introduce a notation for extending the dynamic environments. We use $r$ to range over indexes of columns of environment formal sums, and we let $|\mathbf {Y}|$ denote the length of an environment formal sum $\mathbf {Y}$. Abusing notation, we sometimes write $|\mathbf {Y}|$ also for the index set $\lbrace 1,\ldots,|\mathbf {Y}|\rbrace$. Let $\mathbf {Y}= \sum _{i}{p_{i}};{\widetilde{V}_{i}}$ and $\mathbf {F}= \sum _{i}{p_{i}};{\widetilde{V}_{i}};{M_{i}}$ and $P$ be a term.

  • for any $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$, we let ;
  • for any $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $C$ is a context with holes with indexes ranging over $|\mathbf {Y}|+1$, we let ;
  • $\mathbf {Y} ; P\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i}{p_{i}};{\widetilde{V}_{i}};{P}$;
  • for any context $C$, we let $C[\mathbf {F}]\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i}{p_{i}};{\widetilde{V}_{i}};{C[M_{i}]}$;
  • for $F_{j}= \sum _{i \in I_{j}}{p_{j,i}};{M_{j,i}}$, we let $ \sum _{j}{q_{j}};{C_{j}[F_{j}]} \stackrel{{{{\rm {\tt def}}}}}{=} \sum _{j,i \in I_{j}}{q_{j} \cdot p_{j,i}};{C_{j}[M_{j,i}]}$.

Using this notation, the call-by-value bisimulation clauses for environment formal sums become as follows:

  1. $\mathbf {Y}\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}\mathbf {Z}$ implies:
    1. ${{\tt weight}} (\mathbf {Y})= {{\tt weight}} (\mathbf {Z})$;
    2. for all $r$ and for all contexts $C$,
    3. .

As for call-by-name, we will use this additional notation only for proofs.

We first establish the basic properties of similarity and bisimilarity.

  1. $\approx$ and are the largest bisimulation and simulation, respectively.
  2. is a preorder, and $\approx$ an equivalence.
  3. .

The proof follows analogously to call-by-name, except for transitivity (item (2)), which requires some modifications. Clause (2b) of (bi)simulation allows $M,N$ to be given as argument to functions (using context $C=[\cdot ]_{1}$) if and only if they are both values; thus, when one of them is not a value, we cannot use them as arguments. This prevents us from concluding that, given relations $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$ satisfying the simulation clauses, their relational composition is a simulation. Indeed, whenever $M,P$ are values and $N$ is not a value, we want to build a relation $\mathrel {\mathcal {S}}_{M,P}$ on environment formal sums such that the context $C=[\cdot ]_{1}$ can be applied in clause (2b). If $N$ is not a value, however, then the simulations $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$ do not allow us to use this context. The issue can be solved by noticing that whenever $M,P$ are values we can apply clause (2c) to $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$, which adds $M$ and $P$ as a column of the respective dynamic environments, and then allows us to use them as arguments. In other words, we have to work with a relation that allows environments to be extended with new columns. Adding columns is safe, because it means enlarging the dynamic environment: terms that are equal in the larger environment are also so in the smaller environment as the tests that can be built (when playing the bi-simulation game) with the latter environment are a subset of those that are obtained from the former environment. Define the following preorder $\le _{{\rm {\tt env}}}$ on pairs of formal sums (where, for each pair, the formal sums in the pair have the same length): $(\mathbf {Y},\mathbf {Z})$ are below formal sums $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if, in the second pair, the dynamic environment of the first pair is extended and the columns have been possibly permuted. Formally, $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{\widetilde{V}_{i}} , \mathbf {Z}= \sum _{j}{q_{j}};{\widetilde{W}_{j}},\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{\widetilde{W}^{\prime }_{j}}$ and for every index $r$ in $|\mathbf {Y}|$ there is an index $r^{\prime }$ in $|\mathbf {Y}^{\prime }|$ such that and . Let $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$ be relations on environment formal sums satisfying the simulation clauses. We show that relation $\mathrel {\mathcal {S}}_{(M,P)}\stackrel{{{{\rm {\tt def}}}}}{=}\ge _{{\rm {\tt env}}}(\mathrel {\mathcal {R}}_{(M,N)} \circ \mathrel {\mathcal {R}}^{\prime }_{(N,P)})$, that is

\[ \lbrace (\mathbf {Y},\mathbf {Z})\,\mid \,\exists \mathbf {Y}^{\prime },\mathbf {X}^{\prime },\mathbf {Z}^{\prime } \text{ such that } \mathbf {Y}^{\prime }\mathrel {\mathcal {R}}_{(M,N)}\mathbf {X}^{\prime } \text{ and } \mathbf {X}^{\prime } \mathrel {\mathcal {R}}^{\prime }_{(N,P)}\mathbf {Z}^{\prime } \text{ and } (\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })\rbrace \]
satisfies the simulation clauses. The interesting case is proving clause (2b) when $M,P$ are values and $N$ is not. In this case, if the context used is different from $C=[\cdot ]_{1}$, then we can directly appeal to clause (2b) for $\mathrel {\mathcal {R}}_{(M,N)}$ and $\mathrel {\mathcal {R}}^{\prime }_{(N,P)}$. If $C=[\cdot ]_{1}$, then we have $\mathbf {Y}^{\prime }\mathrel {\mathcal {R}}_{(M,N)}\mathbf {X}^{\prime } \text{ and } \mathbf {X}^{\prime } \mathrel {\mathcal {R}}^{\prime }_{(N,P)}\mathbf {Z}^{\prime } \text{ and } (\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$, and we want to show . By applying clause (2c) to $\mathbf {Y}^{\prime }\mathrel {\mathcal {R}}_{(M,N)}\mathbf {X}^{\prime } \text{ and } \mathbf {X}^{\prime } \mathrel {\mathcal {R}}^{\prime }_{(N,P)}\mathbf {Z}^{\prime }$, we have $\mathbf {Y}^{\prime \prime }\mathrel {\mathcal {R}}_{(M,N)}\mathbf {X}^{\prime \prime } \text{ and } \mathbf {X}^{\prime \prime } \mathrel {\mathcal {R}}^{\prime }_{(N,P)}\mathbf {Z}^{\prime \prime }$, for , , . Since $M$ and $P$ are values, they are, respectively, the only terms appearing in the last columns of $\mathbf {Y}^{\prime \prime }$ and $\mathbf {Z}^{\prime \prime }$, and we can use them to mimic context $C=[\cdot ]_{1}$. Moreover, by $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime \prime },\mathbf {Z}^{\prime \prime })$ there is a column $r^{\prime }$ of $(\mathbf {Y}^{\prime \prime },\mathbf {Z}^{\prime \prime })$ such that and . Hence, there are $r^{\prime }$ and $C^{\prime }$ (specifically, with $C^{\prime }$ being the context hole that gives the last column of $\mathbf {Y}^{\prime \prime }$ and $\mathbf {Z}^{\prime \prime }$) such that
and, by clause (2b),
Then the results follows, i.e., .

A PE relation is a finite-step simulation if

  1. $M \, \mathcal {R}\,N$ and imply ;
  2. $ \sum _{i}{p_{i}};{\widetilde{V}_{i}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{\widetilde{W}_{j}}$ implies:
    1. $\sum _{i} p_{i} \le \sum _{j} q_{j}$;
    2. for all $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $(\widetilde{W}_{j})_{r}=\lambda x. N_{j}$, then
      for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, we have
      implies ;
    3. implies .

We write for the union of all finite-step simulations. Analogously to call-by-name, we use a saturation by approximants and a saturation by suprema to move from a simulation to a finite-step simulation and conversely, and exploit this to prove that similarity and finite-step similarity coincide.

Relations and coincide.

The proof follows as in call-by-name. We prove that the saturation by approximants of a simulation is a finite-step simulation and that the saturation by suprema of a finite-step simulation is a simulation. Clause (2c) is treated analogously to clause (2b).

As in call-by-name, we derive congruence for bisimilarity and similarity by first proving the property for finite-step similarity. We also exploit a combination of two up-to techniques for finite-step simulation, namely, up-to lifting and up-to environment. Up-to lifting is defined analogously to call-by-name, using the lifting operation on environment formal sums. Up-to environment is based on the preorder $\le _{{\rm {\tt env}}}$ on pairs of formal sums, as defined in the proof of Theorem 34, which allows us to exchange columns of environment formal sums (when these are viewed as matrices as in Figure 2) and to add new columns. In the up-to lifting and environment technique, we combine this preorder with the probabilistic lifting of a relation. Then, $\mathbf {Y}\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}({\mathcal {R}}))}\, \mathbf {Z}$ holds if there are $p_{i}$, $\mathbf {Y}_{i}$ and $\mathbf {Z}_{i}$, for $i$ ranging over some index set, such that $\mathbf {Y}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Y}_{i}}$ and $\mathbf {Z}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Z}_{i}}$, and for every $i$ there are $\mathbf {Y}^{\prime }_{i},\mathbf {Z}^{\prime }_{i}$ such that $\mathbf {Y}^{\prime }_{i} \mathrel {\mathcal {R}}\mathbf {Z}^{\prime }_{i}$ and $(\mathbf {Y}_{i},\mathbf {Z}_{i}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime }_{i},\mathbf {Z}^{\prime }_{i})$.

A PE relation is a probabilistic finite-step simulation up-to lifting and environment if:

  1. $M \, \mathcal {R}\,N$ and imply ;
  2. $ \sum _{i}{p_{i}};{\widetilde{V}_{i}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{\widetilde{W}_{j}}$ implies:
    1. $\sum _{i} p_{i} \le \sum _{i} q_{i}$;
    2. for all $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $(\widetilde{W}_{j})_{r}=\lambda x. N_{j}$ then
      for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, we have
      implies ;
    3. implies .

We now prove that the up-to lifting and environment technique is sound.

If $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting and environment, then .

Let $\, \mathcal {R}\,$ be a finite-step simulation up-to lifting and environment. Then the following is a finite-step simulation:

\[ \begin{array}{ll}\mathrel {\mathcal {S}}=&{\tt Pairs}(\, \mathcal {R}\,)\cup \bigcup _{{\mathcal {E}}}\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}))}. \end{array} \]
If $M \mathrel {\mathcal {S}}N,$ then $M \, \mathcal {R}\,N$, which implies that if then . Hence, .

Let $\mathbf {Y}\mathrel {\mathcal {S}}_{(M,N)} \mathbf {Z}$, i.e., $\mathbf {Y}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Y}_{i}}$, $\mathbf {Z}= \sum _{i}{p_{i}}{\cdot }{\mathbf {Z}_{i}}$ and for every $i$ there are $\mathbf {Y}^{\prime }_{i} \mathrel {{\mathcal {R}}_{(M,N)}} \mathbf {Z}^{\prime }_{i}$ such that $(\mathbf {Y}_{i}, \mathbf {Z}_{i}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime }_{i}, \mathbf {Z}^{\prime }_{i})$.

Clause (a) holds, since for every $i$, ${{\tt weight}} (\mathbf {Y}_{i}^{\prime }) \le {{\tt weight}} (\mathbf {Z}_{i}^{\prime })$. Therefore, ${{\tt weight}} (\mathbf {Y}) \le {{\tt weight}} (\mathbf {Z})$.

To prove clause (b), suppose that . Then, $\mathbf {W}= \sum _{i}{p_{i}}{\cdot }{\mathbf {W}_{i}}$, for some $\mathbf {W}_{i}$ such that . Analogously, we have

Suppose that and . Then it follows from the definition of the environment preorder $\le _{{\rm {\tt env}}}$ that there are $r_{i}$ and $C_{i}$ such that and . Therefore, there is a $\mathbf {W}^{\prime }_{i}$ such that and
with , since ${\mathcal {R}}$ is a finite-step simulation up-to lifting and environment and $\mathbf {Y}^{\prime }_{i} \mathrel {{\mathcal {R}}_{(M,N)}} \mathbf {Z}^{\prime }_{i}$. Hence, we have
and the result follows from $\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{(M,N)}}))}\,))}\,=\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{(M,N)}}))}\,$.

Finally, clause (c) follows analogously to clause (b).

Having these up-to techniques, we derive the result by showing that the context closure (which, differently from call-by-name, is now applied both to terms and to the environments of formal sums) of a finite-step simulation saturated by approximants is a finite-step simulation up-to lifting and environment.

If then for every context $C$, we have .

We first define, for any pairs of terms $(M,N)$, the preorder $\le _{{\rm {\tt cce}}(M,N)}$ (context closure of environments) on pairs of environment formal sums: $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{\widetilde{V}_{i}}$, $\mathbf {Z}= \sum _{j}{q_{j}};{\widetilde{W}_{j}}$ with $|\mathbf {Y}|=|\mathbf {Z}|$, $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{\widetilde{V}^{\prime }_{i}}$, $\mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{\widetilde{W}^{\prime }_{j}}$ with $|\mathbf {Y}^{\prime }|=|\mathbf {Z}^{\prime }|$ and

  • for every index $r$ in $|\mathbf {Y}|$ there is an index $r^{\prime }$ in $|\mathbf {Y}^{\prime }|$ such that such that and
  • for every index $r^{\prime }$ in $|\mathbf {Y}^{\prime }|$ there is a value-context $C$ whose indexes range over $|\mathbf {Y}| +1$ such that for every $i,j$, $(\widetilde{V}^{\prime }_{i})_{r^{\prime }}=C[M,\widetilde{V}_{i}]$ and $(\widetilde{W}^{\prime }_{j})_{r^{\prime }}=C[N,\widetilde{W}_{j}]$ (i.e., ).

Intuitively, these requirements corresponds to considering all finite subsets of the context closure of a relation: given formal sums $(\mathbf {Y},\mathbf {Z})$, related elements are columns of their environments that have the same indexes, and $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ expands $(\mathbf {Y},\mathbf {Z})$ (up-to permutation of columns of the pair) with columns that are obtained by filling the same context with related columns and with the static environment. The first requirement ensures that the original relation is included in the context closure, and the second requirement says that new elements are obtained by applying the same context.

Let $\, \mathcal {R}\,$ be a finite-step simulation saturated by approximants such that $M \mathrel {\mathcal {R}}N$. We can assume without loss of generality that this is the only pair of terms in ${\mathcal {R}}$ and that for any ${\mathcal {E}}$ such that $\, \mathcal {R}\,_{{\mathcal {E}}} \subseteq {\mathcal {R}}$, we have ${\mathcal {E}}=(M,N)$. We can also assume that $\mathrel {{\mathcal {R}}_{(M,N)}}$ contains all pairs in $\lbrace (\emptyset , \mathbf {Y})\,\mid \,\mathbf {Y}\text{ is an environment formal sum}\rbrace$, and that it contains the pair of Dirac formal sums with empty environment $({1};{\emptyset }, {1};{\emptyset })$, since these pairs trivially satisfy the finite-step simulation clauses.

Let $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\stackrel{{{{\rm {\tt def}}}}}{=}\le _{{\rm {\tt cce}}(M,N)}(\mathrel {{\mathcal {R}}_{(M,N)}})$, which in turn denotes the set

\[ \lbrace (\mathbf {Y},\mathbf {Z}) \,\mid \,\exists \mathbf {Y}^{\prime },\mathbf {Z}^{\prime } \text{ such that }(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })\le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z}) \; \wedge \;\mathbf {Y}^{\prime } \mathrel {{\mathcal {R}}_{(M,N)}} \mathbf {Z}^{\prime }\rbrace . \]
We prove that the following is a finite-step simulation up-to lifting and environment:
\[ \begin{array}{ll}\mathrel {\mathcal {S}}\stackrel{{{{\rm {\tt def}}}}}{=}&\lbrace ({C[M]},{C[N]}| M \mathrel {\mathcal {R}}N\rbrace \cup \lbrace ((C[M] ,C[N]), \mathbf {Y}, \mathbf {Z}) \,\mid \,\mathbf {Y}\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\mathbf {Z}\rbrace . \end{array} \]
We require ${\mathcal {R}}_{(M,N)}$ to contain the pair $({1};{\emptyset }, {1};{\emptyset })$ to include triples such as
\[ ((\lambda x. C[M], \lambda x. C[N]), {1};{\lambda x. C[M]}, {1};{\lambda x. C[N]}), \]
which must be in $\mathrel {\mathcal {S}}$, since $\lambda x. C[M] \mathrel {\mathcal {S}}\lambda x. C[N]$.

We assume $\emptyset \mathrel {\mathcal {R}}_{(M,N)} \mathbf {Z}$ for any $\mathbf {Z},$ since, for any $C$ that is not a value context, we have , so we want to derive .

Finally, relation $\, \mathcal {R}\,$ must be saturated by approximants, since, as showed in Example 13, a finite-step simulation need not be so, and it might contain, e.g., the triple $((P,Q),{\frac{1}{2}};{Q}+ { \frac{1}{4}};{Q},{1};{Q})$ but not the triple $((P,Q),{\frac{1}{4}};{Q},{1};{Q})$. However, if $C= \,\mathit {I}\,[\cdot ],$ then and it might be the case that there are no $\mathbf {Y},\mathbf {Z}$ such that $\mathbf {Y}\mathrel {{\mathcal {R}}_{(P,Q)}}\mathbf {Z}$ and $({\frac{1}{4}};{Q} , {1};{Q}) \le _{{\rm {\tt cce}}}(\mathbf {Y},\mathbf {Z})$.

The proof follows the same steps as the congruence proof for the imperative $\lambda$-calculus, and we thereby refer the reader to Appendix A, proof of Theorem 52.

4.2 Contextual Equivalence

The definitions of the contextual preorder and equivalence, $\le _{{\rm {\tt ctx}}}$ and $=_{{\rm {\tt ctx}}}$, are as for call-by-name.

If $M {\le _{{\rm {\tt ctx}}}} N,$ then .

We prove that the relation

is a simulation. Then, we derive the result as follows: let $M \le _{{\rm {\tt ctx}}}N$ and $P=(\lambda y\lambda x. x y)$. Then, if and , then and , which implies that . Hence, .

To prove that $\, \mathcal {R}\,$ is a simulation, suppose that there are $M,N$ and $C$ such that $M \le _{{\rm {\tt ctx}}}N$, and . Let $\mathbf {Y}= \sum _{i}{p_{i}};{V^{i}_{1},\ldots,V^{i}_{n}}$ and $\mathbf {Z}= \sum _{j}{q_{j}};{W^{j}_{1},\ldots,W^{j}_{n}}$. We want to prove that for any $r \in \lbrace 1,\ldots,n\rbrace$ and for any context $C^{\prime \prime }$,

which is equivalent to saying that there is a context $D$ such that
Let $C^{\prime }$ be any context and let
\[ P_{M,C^{\prime }}=\lambda x_{1},\ldots,x_{n}.(\lambda z, x. x x_{1} \ldots x_{n} z) C^{\prime }[M,x_{1},\ldots,x_{n}] \]
and $P_{N,C^{\prime }}$ the same term with $M$ substituted to $N$. It follows from $M \le _{{\rm {\tt ctx}}}N$ that $C[M] P_{M,C^{\prime }} \le _{{\rm {\tt ctx}}}C[N] P_{N,C^{\prime }}$. We have
and analogously for $N$:

Then, by the definition of $\, \mathcal {R}\,$, for any context $C^{\prime }$,

This holds in particular for any context of the form $C^{\prime }=[\cdot ]_{r+1} C^{\prime \prime }$, for $r \in \lbrace 1,\ldots,n\rbrace$ and $C^{\prime \prime }$ a value-context, which implies the clause (b) of simulation on formal sums.

Clause (c) is proved using the same result, by taking $C^{\prime }=[\cdot ]_{1}$.

The first clause of simulation on formal sums follows, since $M \le _{{\rm {\tt ctx}}}N$ implies $C[M] \le _{{\rm {\tt ctx}}}C[N]$, which in turn implies .

On $\Lambda _{\oplus }$-terms:

  1. relations $\le _{{\rm {\tt ctx}}}$ and coincide;
  2. relations $=_{{\rm {\tt ctx}}}$ and $\approx$ coincide.

is complete by Theorem 40. The soundness follows from the fact that it is a congruence, which is obtained by exploiting the characterization and Lemma 39.

The result for the equivalences follows from and ${=_{{\rm {\tt ctx}}}}= {\le _{{\rm {\tt ctx}}}\cap \le _{{\rm {\tt ctx}}}^{-1}}$.

5 PROBABILISTIC IMPERATIVE $\lambda$-CALCULUS

In this section, we add imperative features, namely, higher-order references (locations), to the call-by-value calculus, along the lines of the languages in References [26, 45]. The syntax of terms and values is:

\[ \begin{array}{rclr}M & :: = & x & \mbox{variables} \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& c & \mbox{constants}\\[2pt] & \; \; \mbox{{$\mid $}}\;\;& \lambda x. M & \mbox{functions} \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& M_1 M_2 & \mbox{applications} \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& l & \mbox{locations}\\[2pt] & \; \; \mbox{{$\mid $}}\;\;& ({\boldsymbol \nu } \,x\:{:=} M_1) {M_2}& \mbox{new location } \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& !M & \mbox{dereferencing}\\[2pt] & \; \; \mbox{{$\mid $}}\;\;& M_{1} := M_{2} & \mbox{assignments} \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& {\tt op}(M_1, \ldots , M_n) & \mbox{primitive operations} \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& \:{{\rm {\tt if}}}\:\ M_1\ \:{{\rm {\tt then}}}\:\ M_2\ \:{{\rm {\tt else}}}\:\ M_3 & \mbox{if-then-else} \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& \#_i (M) & \mbox{projection}\\[2pt] & \; \; \mbox{{$\mid $}}\;\;& (M_1, \ldots , M_n) & \mbox{tuples} \\[2pt] & \; \; \mbox{{$\mid $}}\;\;& M_1 \oplus M_2 & \mbox{probabilistic choice}\\ \ \\ V &:: = & c \; \; \mbox{{$\mid $}}\;\;\lambda x. M \; \; \mbox{{$\mid $}}\;\;l \; \; \mbox{{$\mid $}}\;\;(V_1, \ldots , V_n). \end{array} \]

We use $s,t$ to range over stores, i.e., mappings from locations to closed values, and $l,k$ over locations. Then ${s} [ {l} \rightarrow {V}]$ is the update of $s$ (possibly an extension of $s$ if $l$ is not in the domain of $s$). The locations that occur in a term $M$ are ${\tt Loc}(M)$. We assume that the set of primitive operations contains the equality function on constants, and write $\tt unit$ for the unit value (i.e., the nullary tuple).

The language is typed—a simply typed system with recursive types—to make sure that the values in the summands of a formal sum have the same structure (e.g., they are all abstractions). We allow recursive types to maintain the peculiar possibility of probabilistic languages of having infinite but meaningful computation trees. Whenever possible, we omit any mention of the types. For instance, in any store update ${s} [ {l} \rightarrow {V}]$ it is intended that $V$ has the type appropriate for $l$; in this case, we say that the type of $V$ is consistent with that of $l$. We require that in a term $({\boldsymbol \nu } \,x\:{:=}\: M_1) {M_2}$, the variable $x$ cannot occur free in $M_{1}$. For similar reasons, we assume that the type syntax is constrained in some way that ensures that for any location type $\text{Ref} \,T$ there exists a closed location-free term $M$ with type $T$. There are various ways of achieving this—the specific syntax is not relevant for this work.

In examples, $M_{1} \,\underline{{\tt seq}}\; M_{2}$ denotes term $(\lambda . M_{2}) M_{1}$, i.e., the execution of ${M_{1}}$ and $M_{2}$ in sequence. Reduction is defined on terms with a store, i.e., configurations of the form $\langle s \,;\,M\rangle$; hence such configurations appear also in formal sums (where we omit brackets). The small-step reduction and the evaluation contexts are defined in Figure 3, where we assume that the semantics of primitive operations (which take as input $n$ terms of ground type and return a ground type term) is already given by the function ${\tt Prim}$. The rules for the semantic mapping, , and the multistep reductions relations, $\Longrightarrow$ and , remain those of Figure 1, with the addition of a store. In all semantic rules, any configuration $\langle s \,;\,M\rangle$ is well-formed, in that $M$ is closed and all the locations in $M$ and $s$ are in the domain ${{{\rm \sf {dom}}}}(s)$ of $s$. As in the previous calculi, it is easy to check that the semantics of a term exists and is unique.

Fig. 3.
Fig. 3. Single-step reduction relation for imperative probabilistic $\lambda$-calculus.

Notations and terminology for (environment) formal sums are adapted to the extended syntax in the expected manner. We only recall the multiplication of an environment formal sum $\mathbf {Y}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}}$ and formal sums $Y_{i}\stackrel{{{{\rm {\tt def}}}}}{=} \sum _{j \in J_{i}}{p _{i,j}};{s_{i,j};V_{i,j}},$ which is defined as

\[ \sum _{i}{p_{i}};{\widetilde{V}_{i}} \cdot Y_{i} \stackrel{{{{\rm {\tt def}}}}}{=} \sum _{i,j \in J_{i}}{{p_{i}}\cdot p_{i,j}};{s_{i,j};{\widetilde{V}_{i}}, V_{i,j}}. \]

An environment formal sum now has not only a specific length, but it also has an associated sequence of types of that length. These types are the types of the terms in the corresponding columns, i.e., all terms in have the $r$th type in the type sequence associated to $\mathbf {Y}$. In the definition of dynamic environment, we then assume that the pairs of environment formal sums have not only the same length but also the same associated sequence of types. The context closure of an environment, $(\lbrace M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, is defined as in the previous section, but now contexts are location-free, i.e., no locations occur in the contexts. This constraint, standard in environmental bisimulations for imperative languages, ensures well-formedness of the terms, and is not really a limitation, because locations may occur in terms of the environments and may thus end up in the terms of the context closure. Hence, restricting to location-free values in the bisimulation game makes the proof technique simpler while maintaining full abstraction results with respect to contextual equivalence, which allows arbitrary contexts (Section 5.2).

5.1 Environmental Bisimulation

The notion of environmental relation is modified to accommodate stores, which are needed to run terms. The elements of an environmental relation are now well-formed pairs of configurations $(\langle s \,;\,M\rangle , \langle t \,;\,N\rangle)$ or well-formed triples,

\[ \left({\mathcal {E}}, \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}}, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}\right) . \]
Well-formedness on triples ensures that the store $s_i$ of the possible world $i$ defines all locations that appear in (the range of) $s_i$, in $\widetilde{V}_i$, and in ${\mathcal {E}}_1$, and similarly for $t_j$, $\widetilde{W}_j$ and ${\mathcal {E}}_2$. Further, the triples must be compatible: the related environment formal sums should have the same length, and should respect the types, that is, corresponding columns of the environment formal sums should contain terms that have the same type.

Since locations could occur in the terms we want to prove equivalent, we parametrize bisimulations with respect to a set $\lbrace \widetilde{l}\rbrace$ of locations so that the pairs of terms in the relation must have stores with domain $\lbrace \widetilde{l}\rbrace$. This allows us to put these locations in the dynamic environment of the relation (clause (1)), which reflects the fact that the locations occurring in the terms are public (i.e., contexts can access them). In what follows, when we write $\lbrace \widetilde{l}\rbrace$, we assume that no repetitions of the same location occur in the sequence $\widetilde{l}$. For a pair $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$ of (tuples of) stores, we say that locations $(\lbrace l_{i}\rbrace _{i}, \lbrace k_{j}\rbrace _{j})$ are $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$ -fresh if for every $i,j$, we have $l_{i} \not\in {{{\rm \sf {dom}}}}(s_{i})$ and $k_{j} \not\in {{{\rm \sf {dom}}}}(t_{j})$.

A PE relation is a (PE) $\lbrace \widetilde{l}\rbrace$-bisimulation if

  1. $\langle s \,;\,M\rangle \, \mathcal {R}\,\langle t \,;\,N\rangle$ implies ${{{\rm \sf {dom}}}}(s) = {{{\rm \sf {dom}}}}(t) = \lbrace \widetilde{l}\rbrace$ and ${1};{s;\widetilde{l}} \mathrel {{\mathcal {R}}_{(M,N)}} {1};{t;\widetilde{l}}$;
  2. $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ implies:
    1. $\sum _{i} p_{i} = \sum _{j} q_{j}$;
    2. for all $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $(\widetilde{W}_{j})_{r}=\lambda x. N_{j}$, then
      for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,

    3. for all $r$, if $(\widetilde{V}_{i})_{r}= l_{i}$ and $(\widetilde{W}_{j})_{r}= k_{j}$, then
      • $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},s_{i}(l_{i})}\,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},t_{j}(k_{j})}$,
      • for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
        \[ { \sum _{i}{p_{i}};{{s_{i}} [ {l_{i}} \rightarrow {T_{i}}];\widetilde{V}_{i}}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} { \sum _{j}{q_{j}};{{t_{j}} [ {k_{j}} \rightarrow {U_{j}}];\widetilde{W}_{j}}}\text{;} \]

    4. for any $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$-fresh locations $(\lbrace l_{i}\rbrace _{i}, \lbrace k_{j}\rbrace _{j})$,
      and for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
      \[ \sum _{i}{p_{i}};{{s_{i}} [ {l_{i}} \rightarrow {T_i}];\widetilde{V}_{i}, l_{i}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{{t_{j}} [ {k_{j}} \rightarrow {U_j}];\widetilde{W}_{j}, k_{j}}\text{;} \]

    5. for all $r$, if $(\widetilde{V}_{i})_{r}= c_{i}$ and $(\widetilde{W}_{j})_{r}= c_{j}$, then all constants in the two columns are the same (i.e., there is a $c$ with $c_i=c_j=c$ for all $i,j$);
    6. for all $r$, if $(\widetilde{V}_{i})_{r}=(V_{i,1},\ldots, V_{i,n})$ and $(\widetilde{W}_{j})_{r}=(W_{j,1},\ldots,W_{j,n}),$ then
      \[ \begin{array}{lc} \displaystyle\sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},V_{i,1},\ldots, V_{i,n}} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}})}\, \displaystyle\sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},W_{j,1},\ldots,W_{j,n}}; \end{array} \]

    7. .

We let $\approx ^{\lbrace \widetilde{l}\rbrace }$ denote the union of all $\lbrace \widetilde{l}\rbrace$-bisimulations.

With respect to the definition for pure call-by-value, the definition above has the additional ingredient of the store, and of clauses (2c) and (2d) to deal with the case in which the values are locations: (2c) gives an observer the possibility of reading and writing the store and (2d) the possibility of extending the store with fresh locations. Clause (2f) adds all elements of a tuple to the dynamic environment. These aspects are similar to those in ordinary environmental bisimulations for imperative languages [24, 45].

Three further aspects, however, are new. First, by clause (2e), related environment formal sums should be first-order consistent, meaning that corresponding columns of constants should contain exactly one constant. This constraint is a consequence of the equality test on constants in the language. To ensure that first-order consistency is maintained in the bisimulation game, most of the clauses use a lifting construction. Thus, when the evaluation of first-order terms may probabilistically yield different constants, lifting allows us to separate the final possible worlds according to the specific constants obtained (since the semantics of a term might be a formal sum assigning non-zero probability to infinitely many different constant, the definition of lifting must allow for a possibly infinite index set to ensure first-order consistency). This constraint is further discussed in Examples 46 and 47. A second new aspect is that, since the effect of the evaluation of the terms in the static environment may change depending on the current store, clauses (1) and (2g) allow us to derive a congruence result for arbitrary terms (not necessarily values), as illustrated in the example below. Finally, we parametrize the relation with a set of locations to deal with terms where (public) locations may occur.

If the domains of the stores are empty, then we can consider bisimulations parametrized by the empty set of locations, and in clause (1), we will have empty sequences of values in the dynamic environment. Anyway, clause (2g) can be applied independently of the presence of values in the dynamic environment.

In what follows, we sometimes omit any reference to the set of locations parametrizing the relation, and simply refer to (bi)simulations and (bi)similarity when the parametrizing set is not relevant.

Let $M\stackrel{{{{\rm {\tt def}}}}}{=}l:=1$ and $N\stackrel{{{{\rm {\tt def}}}}}{=}\:{{\rm {\tt if}}}\:\ !l=0\ \:{{\rm {\tt then}}}\:\ l:=1\ \:{{\rm {\tt else}}}\:\ \Omega$. Without the static environment, terms $\langle l=0 \,;\,M\rangle$ and $\langle l=0 \,;\,N\rangle$ are bisimilar. However, they are not contextually equivalent: if $C\stackrel{{{{\rm {\tt def}}}}}{=}[\cdot ] \,\underline{{\tt seq}}\; [\cdot ]$, then $\langle l=0 \,;\, C [M] \rangle$ terminates whereas $\langle l=0 \,;\, C [N] \rangle$ does not. This aspect is determined by the store, probabilities do not really matter. Ordinary environmental bisimulations do not have a static environment, and cannot therefore test repeated runs of given terms that are not values; as a consequence $M$ and $N$ are equated, and bisimulation is not fully substitutive on arbitrary terms (see Reference [45, Section 5.2]).

Clause (1) is also modified with respect to pure call-by-name and call-by-value calculi. Indeed, if we defined the clause as

then the bisimulation would not be sound with respect to terms that diverge at the first run. For instance, the terms $M\stackrel{{{{\rm {\tt def}}}}}{=}\:{{\rm {\tt if}}}\:\ !l=1\ \:{{\rm {\tt then}}}\:\ {\tt true}\ \:{{\rm {\tt else}}}\:\ \Omega$ and $N\stackrel{{{{\rm {\tt def}}}}}{=}\:{{\rm {\tt if}}}\:\ !l=1\ \:{{\rm {\tt then}}}\:\ {\tt false}\ \:{{\rm {\tt else}}}\:\ \Omega$ (that are not contextually equivalent because of contexts such as $ l:=1 \,\underline{{\tt seq}}\; [\cdot ]$) would be bisimilar with store $l=0$, by simply considering the relation $\lbrace (\langle l=0 \,;\,M\rangle , \langle l=0 \,;\,N\rangle), ((M,N), \emptyset ,\emptyset)\rbrace$.

Even if we make the location $l$ public by starting the bisimulation game from terms $(M,l)$ and $(N,l)$ and by exploiting clause (2f), to allow contexts to use the location (as in Reference [45, Theorem 5.10]), we still have $\langle l=0 \,;\,(M,l)\rangle$ and $\langle l=0 \,;\,(N,l)\rangle$ bisimilar, since .

Hence, clause (1) ensures that location $l$ is actually put in the dynamic environment, so that we can use clause (2c) to change the value of $l$ and then evaluate again $M$ and $N$ using clause (2g).

The following examples are meant to further illustrate and motivate the form and the clauses of our bisimulation. The examples only use boolean and integer locations, and we accordingly assume that all locations in the language are of these types. Higher-order locations would not affect the essence of the examples and would complicate the description of the required bisimulations due to the possibility of extending the store (clause (2d)). (The full abstraction results will not rely on the existence of locations of specific types.) Moreover, since the terms compared always have the same locations, we assume that fresh locations for the extensions of the store are the same on both sides. If not specified otherwise, then we also assume that thunks take arguments of unit type.

Example 44 shows that in imperative call-by-value, in contrast with pure call-by-value, to achieve full abstraction it is necessary to define bisimulation on formal sums rather than on terms.

We have explained in Section 1 why the terms

\[ \begin{array}{cc}H\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) (\lambda . (M \oplus N)) \quad &\quad K \stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) ((\lambda . M) \oplus (\lambda . N)), \end{array} \]
where
\[ \begin{array}{rcl} M&\stackrel{{{{\rm {\tt def}}}}}{=}&\:{{\rm {\tt if}}}\:\ !x=0\ \:{{\rm {\tt then}}}\:\ x:=1 \,\underline{{\tt seq}}\; {\tt true}\ \:{{\rm {\tt else}}}\:\ \Omega ,\\ N&\stackrel{{{{\rm {\tt def}}}}}{=}&\:{{\rm {\tt if}}}\:\ !x=0\ \:{{\rm {\tt then}}}\:\ x:=1 \,\underline{{\tt seq}}\; {\tt false}\ \:{{\rm {\tt else}}}\:\ \Omega \end{array} \]
are contextually equivalent, but would be separated by a bisimulation that acted on terms. With our bisimulation, we can prove $H$ and $K$ equal using a relation that contains the pair $({\langle s \,;\,H\rangle },{\langle s \,;\,K\rangle })$, for $s$ the empty store, and all triples $((H,K), \mathbf {Y},\mathbf {Z})$ in which $\mathbf {Y},\mathbf {Z}$ are first-order consistent, have the same total weight and, seeing them as matrices, for every column $r$ of the dynamic environments that is not made of constants one of the following properties holds:
  1. there is $l$ such that all terms in are , whereas all terms in are either or ; moreover, $l$ does not occur elsewhere in terms of the dynamic environment and its value in the stores is 1;
  2. there is $l$ such that all terms in are , whereas contains both and ; moreover, $l$ does not occur elsewhere in the dynamic environment and its value in the stores is 0. The right-hand matrix obtained by erasing all columns that are not of this shape is either $\emptyset$ or (without considering the stores) of the form $(\ldots((Y_{1} \cdot Y_{2}) \cdot Y_{3})\cdot \ldots)\cdot Y_{n}$, for . This clause guarantees that and have the same probability in every column (if $l_{i}$ is set to 0 in the stores), and that this property still holds if the matrix is splitted by separating the rows with from the rows with ;
  3. there is $l$ such that all terms in and are $l$; moreover, $l$ is set to the same value in all the stores.

Finally, we add to the relation the triple $((H,K), {1};{s;\emptyset }, {1};{s;\emptyset })$, where $\emptyset$ denotes the empty dynamic environment, to satisfy clause (1) of Definition 42. Clause (2g) is handled appealing to item (b). The most interesting case is the bisimulation clause (2b) applied to a column $r$ of functions that satisfy item (b). The result of the evaluation of such functions (with $\tt unit$ as argument) is that $l$ is set to 1 and then ${\tt true}$ and ${\tt false}$ are returned, with the same probability. Using the lifting construction, we can now split the possible worlds in which ${\tt true}$ has been produced and those in which ${\tt false}$ has been produced, yielding two pairs of environment formal sums, both of which are in the bisimulation (note that the lifting splits the original column $r$ so that the corresponding column in the two final pairs satisfies item (a) above).

In this work, we sometimes view environment formal sums as matrices (Figure 2). This, however, is only for representation convenience: our environments are tuples of rows (each row representing a possible world originated by the probabilistic evaluation of terms), rather than tuples of columns, that is, tuples of formal sums. The next example shows that if the environments were tuples of formal sums, where formal sums are added to the environment following the evaluation of terms during the bisimulation game, then bisimilarity would not be complete. Intuitively, this happens because the histories of different possible worlds would not be anymore separated and could interfere.

Let

\[ \begin{array}{c}A\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,y\:{:=} 0) (L \oplus M) \quad B\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,y\:{:=} 0) (L \oplus N), \\ L\stackrel{{{{\rm {\tt def}}}}}{=}\lambda . {! y} \quad M\stackrel{{{{\rm {\tt def}}}}}{=}\lambda . (y:=1 \,\underline{{\tt seq}}\; 2) \quad N\stackrel{{{{\rm {\tt def}}}}}{=}\lambda . 2. \end{array}\]

Terms $A$ and $B$ create a new location and allow the reading capability on it in the subterm $L$. The writing capability, in contrast, exists only in the subterm $M$ of $A$. A behaviour from $A$ that could not be mimicked with $B$ is the run of $M$, where 1 is assigned to the location $x$, followed by a run of $L$, where $x$ is read and 1 is emitted (with $B$, any value produced by $L$ would be 0). This behaviour, however, is impossible, because $L$ and $M$ are in a probabilistic choice and are therefore obtained in two distinct possible worlds, in one of which $x$ can only be read, in the other $x$ can only be written. Moreover, the writing capability alone is irrelevant, because the location is private; hence it can be omitted from $M$, resulting in the term $N$ that appears in $B$. Indeed, $A$ and $B$ are contextually equivalent.

However, the “wrong” behaviour above for $A$ could be reproduced in the bisimulation if the environments were tuples of formal sums (that is, all possible worlds have the same environment, made of formal sums). The formal sum obtained by the evaluation of $A$, with summand terms $L$ and $M$, would be stored in the environment and could then be executed several times, with possible interleaving of evaluations of $L$ and $M$. (The example could be made more complex to obtain a ‘wrong’ behaviour from the execution of two different formal sums in the environment, rather than by multiple executions of the same formal sum.)

With our bisimulation, we can prove $A,B$ equal using a relation composed by $(A,B)$ (for simplicity, we leave out the store) and by all triples $((A,B), \mathbf {Y},\mathbf {Z})$ where the environment formal sums $\mathbf {Y}={1};{s;V_{1},\ldots,V_{n}}$ and $ \mathbf {Z}={1};{t;W_{1},\ldots,W_{n}}$ are first-order consistent, and for each column $r$ that does not contain constants one of the following holds:

  1. there is $l$ such that ; moreover, $l$ does not occur elsewhere in the dynamic environment or within a location of the stores, and is set to 0 in both stores;
  2. there is $l$ such that and $W_{r}=N$; and, again, $l$ does not occur elsewhere in the dynamic environment or within a location of the stores; moreover, in the store $s$, we have $s(l) \in \lbrace 0,1\rbrace$ whereas in $t$, we have $t(l)= 0$;
  3. $V_{r}=W_{r}=l$ for some $l$ assigned to the same value in both stores.

The proof that this relation is a bisimulation crucially exploits the lifting construction. For instance, using (a) and (b) one shows that the semantics of $A$ and $B$ are in the lifting of the relation, and similarly one proceeds when handling clause (2g) of the bisimulation.

The main purpose of the lifting construct in Definition 42 of environmental bisimulation is to maintain the first-order consistency of related environment formal sums. One may wonder whether something simpler would suffice, namely, avoiding the lifting construct altogether and simply requiring that, whenever two first-order terms are evaluated, the probability of obtaining a given constant is the same on both sides (and thus maintaining first-order consistency by avoiding the addition of such values onto the dynamic environments). The example below shows that this would be unsound.

We compare the terms $A\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) (M,N_1)$ and $B\stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x\:{:=} 0) (M,N_2),$ where

\[ \begin{array}{rcl}M& \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda . \begin{array}{l} \:{{\rm {\tt if}}}\:! x =0 \:{{\rm {\tt then}}}\:((x:=1 \,\underline{{\tt seq}}\; {\tt true})\oplus (x:=2 \,\underline{{\tt seq}}\; {\tt false})) \:{{\rm {\tt else}}}\:\Omega , \end{array} \\ N_1& \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda . \:{{\rm {\tt if}}}\:!x = 2 \begin{array}{l} \:{{\rm {\tt then}}}\:x:=3 \,\underline{{\tt seq}}\; n \:{{\rm {\tt else}}}\:\Omega , \end{array} \\ N_2& \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda . \:{{\rm {\tt if}}}\:(!x =1 \vee !x =2) \begin{array}{l} \:{{\rm {\tt then}}}\:x:=3 \,\underline{{\tt seq}}\; (n \oplus \Omega) \:{{\rm {\tt else}}}\:\Omega , \end{array} \end{array} \]
and $n$ is any integer. The terms $A$ and $B$ produce the values and and $l$ is a location that is accessible only to such values. The definitions of and (for $i=1,2$) use conditionals on the content of $l$ in such a way that the only meaningful manipulations with the values is to evaluate first, and then, possibly, to evaluate . Any other order of evaluation would produce a divergence.

We explain why, intuitively, bisimilarity would equate $A$ and $B$ if, on constants, bisimulation simply checked the probabilities of obtaining each constant (rather than employing the lifting construction). The evaluation of (the body of) produces ${\tt true}$ or ${\tt false}$, with the same probability $ \frac{1}{2}$ and with $l,$ respectively, set to 1 and 2. Then the only meaningful observation is the evaluation of the values . This means evaluating the formal sums

The evaluation of $F_1$ terminates only when $l=2$, yielding the value formal sum $Y_1 \stackrel{{{{\rm {\tt def}}}}}{=}{ \frac{1}{2}};{l= 3 ;n}$. The evaluation of $F_2$, in contrast, may terminate under both stores, yielding the value formal sum $Y_2 \stackrel{{{{\rm {\tt def}}}}}{=}{ \frac{1}{4}};{l= 3 ;n} + { \frac{1}{4}};{l= 3 ;n}$. Both in $Y_1$ and in $Y_2$ the outcome $n$ has the overall probability $ \frac{1}{2}$.

The terms $A$ and $B,$ however, are not contextually equivalent, because distinguished by a context $C$ that evaluates and then proceeds with the evaluation only when the outcome from was ${\tt true}$. Now, $ C [A] $ never terminates, whereas $ C [B] $ terminates and produces $n$ with probability $ \frac{1}{4}$.

Our environmental bisimulation distinguishes $A$ from $B$, because we separately analyze the possible worlds in which the evaluation of has produced ${\tt true}$ and the possible worlds in which the evaluation has produced ${\tt false}$, somehow mimicking the effect of the context $C$ above.

Yet another possibility for avoiding the lifting construct of the Definition 42 of bisimulation might have been to drop the requirement of first-order consistency, allowing environment formal sums in which a first-order column may contain different constants. Thus, constants would be added to the dynamic environment as any other type of value, and one would simply check that, at any time, the weights for the occurrences of a given constant in related columns are the same; formally, replacing clause (2e) with

  • (2e $^{\prime }$) for every column $r$ and every constant $c$,$$\sum _{\lbrace i \,\mid \,(\widetilde{V}_i)_{r} =c\rbrace } p_{i} = \sum _{\lbrace j \,\mid \,(\widetilde{W}_j)_{r}=c \rbrace } q_{j}$$.

The example below shows that this choice would be unsound too. We write $({\boldsymbol \nu } \,x,\,y\:{:=}\: 0) M$ for the creation of two locations in which the initialization of the first one is irrelevant.

This is a variation of the previous example.

We compare the terms $M_1 \stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x,\,y\:{:=}\: 0) (A,B_1)$ and $M_2 \stackrel{{{{\rm {\tt def}}}}}{=}({\boldsymbol \nu } \,x,\,y\:{:=}\: 0) (A,B_2),$ where

\[ \begin{array}{rcl}A & \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda . \begin{array}{l} \:{{\rm {\tt if}}}\:!y =0 \:{{\rm {\tt then}}}\:y:=1 \,\underline{{\tt seq}}\; (\lambda z. (x := z \,\underline{{\tt seq}}\; z))({\tt true}\oplus {\tt false}) \:{{\rm {\tt else}}}\:\Omega , \end{array} \\ B_1 & \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda . \:{{\rm {\tt if}}}\:!y =1 \begin{array}{l} \:{{\rm {\tt then}}}\:y:=2 \,\underline{{\tt seq}}\; !x \:{{\rm {\tt else}}}\:\Omega , \end{array} \\ B_2 & \stackrel{{{{\rm {\tt def}}}}}{=}& \lambda . \:{{\rm {\tt if}}}\:!y =1 \begin{array}{l} \:{{\rm {\tt then}}}\:y:=2 \,\underline{{\tt seq}}\; ({\tt true}\oplus {\tt false}) \:{{\rm {\tt else}}}\:\Omega . \end{array} \end{array} \]
As in the previous example, $M_1$ and $M_2$ yield the values and , and the interactions of the terms with the store is such that the only meaningful experiment is to evaluate first, and then (indeed, the location $l^{\prime }$ is only used to this end).

We explain why, intuitively, the variant (2e $^{\prime }$) above of the clause for first-order values would incorrectly equate $M_1$ and $M_2$. The evaluation of adds to the dynamic environment the formal sum

\[ { \frac{1}{2}};{l= {\tt true}, l^{\prime }=1 ;{\tt true}} + { \frac{1}{2}};{l= {\tt false}, l^{\prime }=1 ;{\tt false}} \]
(the values produced are also placed in the location $l$).

Now, in one case the evaluation of adds to the dynamic environment a column of boolean values identical to the column produced above (because emits the value stored in $l$, which is identical to the value produced by the evaluation of ). This means that we end up with an environment formal sum in which the relevant columns are

\begin{equation} \begin{array}{lll} \displaystyle\frac{1}{2} \: ; \hspace{5.69046pt}& {\tt true}\: , \hspace{5.69046pt}& {\tt true} \\[8pt] \displaystyle\frac{1}{2}\: ; \hspace{5.69046pt}& {\tt false}\: , \hspace{5.69046pt}& {\tt false}. \end{array} \end{equation}
In contrast, when evaluating each possible world is split into two, in each of which ${\tt true}$ and ${\tt false}$ have probability $ \frac{1}{2}$. Thus, the relevant columns of the final environment formal sum are
\[ \begin{array}{lll} \displaystyle\frac{1}{4} \: ; \hspace{5.69046pt}& {\tt true}\: , \hspace{5.69046pt}& {\tt true} \\[8pt] \displaystyle\frac{1}{4} \: ; \hspace{5.69046pt}& {\tt true}\: , \hspace{5.69046pt}& {\tt false} \\[8pt] \displaystyle\frac{1}{4} \: ; \hspace{5.69046pt}& {\tt false}\: , \hspace{5.69046pt}& {\tt true} \\[8pt] \displaystyle \frac{1}{4} \: ; \hspace{5.69046pt}& {\tt false}\: , \hspace{5.69046pt}& {\tt false}. \end{array} \]
In each of these columns, the probabilities for ${\tt true}$ and ${\tt false}$ are the same as in the columns of (5), as required by (2e $^{\prime }$).

However, the terms are not contextual equivalent. They are separated by a context that evaluates only if the outcome of the evaluation of is ${\tt true}$. Thus, the overall probability of obtaining ${\tt true}$ at the end is $ \frac{1}{2}$ in one case, and $ \frac{1}{4}$ in the other. Similarly the terms are distinguished in our bisimulation, reasoning along the lines of Example 46.

The definition of $\lbrace \widetilde{l}\rbrace$-simulation is the same as the definition of $\lbrace \widetilde{l}\rbrace$-bisimulation, but for the first clause on environment formal sums with stores, which becomes: $\sum _{i} p_{i} \le \sum _{j} q_{j}$. We let denote $\lbrace \widetilde{l}\rbrace$-similarity.

The basic properties and definitions for environmental (bi)simulations in pure call-by-value remain valid, with the due adjustments. In some cases, however, some subtleties arise.

It can be easily proved that, for any set $\lbrace \widetilde{l}\rbrace$, $\lbrace \widetilde{l}\rbrace$-bisimilarity and $\lbrace \widetilde{l}\rbrace$-similarity are an equivalence and a preorder relation, respectively. For proving transitivity, in particular, the restriction to parametrized relations, rather than to arbitrary relations, is fundamental. Analogously, we have that $\lbrace \widetilde{l}\rbrace$-(bi)simulations are closed under union, and thus relations $\approx ^{\lbrace \widetilde{l}\rbrace }$ and are, respectively, the largest $\lbrace \widetilde{l}\rbrace$-bisimulation and $\lbrace \widetilde{l}\rbrace$-simulation.

In finite-step simulation, clauses (2b) and (2g) are modified so to make sure that only a finite number of reductions are performed on the challenger side. No modification is made to the clauses (1), (2c), (2d), (2e), and (2f) for locations, constants, and tuples, because there is no evaluation of terms involved.

The definition of extended environment formal sum and of the multi-step reduction from extended environment formal sums to environment formal sums is adapted to the imperative case as expected, by assuming that when there is only a finite number of $\langle s_{i} \,;\,M_{i}\rangle$ that actually perform some reduction steps.

A PE relation is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation if it satisfies the same clauses (1), (2a), (2c), (2d), (2e) and (2f) of (the simulation version of) Definition 42; and, in place of clauses (2b) and (2g), we have

  1. $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ implies:
    1. for all $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $(\widetilde{W}_{j})_{r}=\lambda x. N_{j}$, then
      for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
      if then ;
    2. if then .

We write for finite-step $\lbrace \widetilde{l}\rbrace$-similarity. We prove that $\lbrace \widetilde{l}\rbrace$-similarity and finite-step $\lbrace \widetilde{l}\rbrace$-similarity coincide by exploiting the saturation by approximants and the saturation by suprema of $\lbrace \widetilde{l}\rbrace$-simulations and finite-step $\lbrace \widetilde{l}\rbrace$-simulations, respectively. Since only clauses (2b) and (2g) are modified, we can proceed as in the proofs for the pure calculi.

.

Precongruence is derived for the finite-step similarity using “up-to lifting and environment” techniques, and then transported to similarity, from which it is transported to bisimilarity using the characterization of bisimilarity as the equivalence induced by the simulation preorder.

The up-to lifting and environment technique is defined analogously to the probabilistic call-by-value case. The environment preorder is as follows: $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt env}}}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} , \mathbf {Z}= \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ with $|\mathbf {Y}|=|\mathbf {Z}|$ and $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ with $|\mathbf {Y}^{\prime }|=|\mathbf {Z}^{\prime }|$ and for every index $r$ in $|\mathbf {Y}|$ there is an index $r^{\prime }$ in $|\mathbf {Y}^{\prime }|$ such that for all $i,j$, $(\widetilde{V}_{i})_{r}=(\widetilde{V}^{\prime }_{i})_{r^{\prime }}$ and $(\widetilde{W}_{j})_{r}=(\widetilde{W}^{\prime }_{j})_{r^{\prime }}$.

A PE relation is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment if:

  1. $\langle s \,;\,M\rangle \, \mathcal {R}\,\langle t \,;\,N\rangle$ implies ${{{\rm \sf {dom}}}}(s) = {{{\rm \sf {dom}}}}(t) = \lbrace \widetilde{l}\rbrace$ and ${1};{s;\widetilde{l}} \mathrel {{\mathcal {R}}_{(M,N)}} {1};{t;\widetilde{l}}$;
  2. $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {{\mathcal {R}}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ implies:
    1. $\sum _{i} p_{i} \le \sum _{i} q_{i}$;
    2. for all $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $(\widetilde{W}_{j})_{r}=\lambda x. N_{j}$, then
      for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
      if then
    3. for all $r$, if $(\widetilde{V}_{i})_{r}= l_{i}$ and $(\widetilde{W}_{j})_{r}= k_{j}$, then for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
      • $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},s_{i}(l_{i})}\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}))}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},t_{j}(k_{j})}$,
      • ${ \sum _{i}{p_{i}};{{s_{i}} [ {l_{i}} \rightarrow {T_{i}}];\widetilde{V}_{i}}} \,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}))}\, { \sum _{j}{q_{j}};{{t_{j}} [ {k_{j}} \rightarrow {U_{j}}];\widetilde{W}_{j}}}$;
    4. for any $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$-fresh locations $(\lbrace l_{i}\rbrace _{i}, \lbrace k_{j}\rbrace _{j})$,
      and for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace {\mathcal {E}}_{1},\widetilde{V}_{i}\rbrace _{i}, \lbrace {\mathcal {E}}_{2},\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
      \[ \sum _{i}{p_{i}};{{s_{i}} [ {l_{i}} \rightarrow {T_{i}}];\widetilde{V}_{i}, l_{i}} \,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}))}\, \sum _{j}{q_{j}};{{t_{j}} [ {k_{j}} \rightarrow {U_{j}}];\widetilde{W}_{j}, k_{j}}; \]

    5. for all $r$, if $(\widetilde{V}_{i})_{r}= c_{i}$ and $(\widetilde{W}_{j})_{r}= c_{j}$, then all constants in the two columns are the same (i.e., there is $c_a$ with $c_i=c_j=c_a$ for all $i,j$) ;
    6. for all $r$, if $(\widetilde{V}_{i})_{r}=(V_{i,1},\ldots, V_{i,n})$ and $(\widetilde{W}_{j})_{r}=(W_{j,1},\ldots,W_{j,n}),$ then
      \[ \begin{array}{l} \displaystyle\sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},V_{i,1},\ldots, V_{i,n}} \,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}))}\, \displaystyle\sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},W_{j,1},\ldots,W_{j,n}} ;\end{array} \]

    7. then .

If $\, \mathcal {R}\,$ is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment, then .

The soundness of the up-to lifting and environment technique follows as in call-by-value (Lemma 38). Given a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment $\, \mathcal {R}\,$, we prove that $\mathrel {\mathcal {S}}={\tt Pairs}(\, \mathcal {R}\,)\cup \bigcup _{{\mathcal {E}}}\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\mathrel {{\mathcal {R}}_{{\mathcal {E}}}}))}\,$ is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation.

We first prove congruence of finite-step $\lbrace \widetilde{l}\rbrace$-similarity for contexts with locations in $\lbrace \widetilde{l}\rbrace$, and then we show how to derive congruence for general contexts. The proofs of these results are reported in Appendix A. The proof structure for Theorem 52 is as in call-by-value; we define the context closure of a finite-step $\lbrace \widetilde{l}\rbrace$-simulation, and we prove that it is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation up-to lifting and environment.

Finite-step $\lbrace \widetilde{l}\rbrace$-similarity is a precongruence for contexts with locations in $\lbrace \widetilde{l}\rbrace$: if then for every context $C$ with ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace$, we have .

Then, we derive precongruence for general contexts by showing how to move from relations parametrized by a set $\lbrace \widetilde{l}\rbrace$ to relations parametrized by $\lbrace \widetilde{l}^{\prime }\rbrace$, for $\lbrace \widetilde{l}^{\prime }\rbrace$ a set including $\lbrace \widetilde{l}\rbrace$.

Let $\widetilde{l}^{\prime }=\widetilde{l}, \widetilde{l}^{\prime \prime }$ and let $\widetilde{V}^{\prime }=\widetilde{V}, \widetilde{V}^{\prime \prime }$ be a sequence of values whose types are consistent with those of $\,\widetilde{l}^{\prime }$, and with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. Let $C$ be a context with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. If then:

  • ;
  • .

5.2 Contextual Equivalence

We set . Contextual equivalence and the contextual preorder are defined by quantifying over all stores and contexts.

$M$ and $N$ are in the contextual preorder, written $M\le _{{\rm {\tt ctx}}}N$ (respectively, contextually equivalent, written $M =_{{\rm {\tt ctx}}}N$), if, for any store $s$ and context $ C$ such that $\langle s \,;\, C [M] \rangle$ and $\langle s \,;\, C [N] \rangle$ are well-formed, ${\langle s \,;\, C [M] \rangle {\Downarrow }} \le {\langle s \,;\, C [N] \rangle {\Downarrow }}$ (respectively, ${\langle s \,;\, C [M] \rangle {\Downarrow }} = {\langle s \,;\, C [N] \rangle {\Downarrow }}$).

Let ${\tt Loc}(M) \cup {\tt Loc}(N)= \lbrace \widetilde{l}\rbrace $. If $M\le _{{\rm {\tt ctx}}}N,$ then , for any $\widetilde{V}$ whose types and locations are consistent with $\widetilde{l}$.

We prove that the relation

is a $\lbrace \widetilde{l}\rbrace$-simulation. The full proof is in Appendix A.

We can now derive full abstraction for the simulation preorder and bisimilarity. Contextual equivalence and preorder are defined on terms, while bisimilarity and the simulation preorder are defined over configurations of a term and a store. In the full abstraction result, we show that congruence on terms corresponds to bisimilarity when an arbitrary store is considered.

Let ${\tt Loc}(M) \cup {\tt Loc}(N)= \lbrace \widetilde{l}\rbrace $. We have, for any $\widetilde{V}$ whose types and locations are consistent with $\widetilde{l}$:

  • $M\le _{{\rm {\tt ctx}}}N$ if and only if ;
  • $M=_{{\rm {\tt ctx}}}N$ if and only if $\langle \widetilde{l} =\widetilde{V} \,;\,M\rangle \approx ^{\lbrace \widetilde{l}\rbrace }\langle \widetilde{l} = \widetilde{V} \,;\,N\rangle $.

Theorem 55 proves completeness. For soundness, suppose for some $\widetilde{V}$ consistent with $\widetilde{l}$. Let $s$ be a store and $C$ a context such that $\langle s \,;\,C[M]\rangle$ and $\langle s \,;\,C[N]\rangle$ are well-formed. We want to prove that $\langle s \,;\,C[M]\rangle \Downarrow \le \langle s \,;\,C[N]\rangle \Downarrow$.

By well-formedness, we know that $s=\emptyset [ \widetilde{l}^{\prime } \rightarrow \widetilde{V}^{\prime }]$, for some $\widetilde{l}^{\prime }$ such that $\widetilde{l}^{\prime }=\widetilde{l},\widetilde{l}^{\prime \prime }$ and for some consistent $\widetilde{V}^{\prime }$, and that $C$ has locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. By , we have and by Theorem 53, we derive . Then $\langle \widetilde{l}^{\prime } = \widetilde{V}^{\prime } \,;\,C[M]\rangle \Downarrow \le \langle \widetilde{l}^{\prime } = \widetilde{V}^{\prime } \,;\,C[N]\rangle \Downarrow$.

The universal quantification over stores in the full abstraction is outside, and not inside, the double implication, i.e., we do not prove

but rather
The latter statement implies the former one (assuming that a consistent initialisation of the store is possible). The reason why we can prove the latter one, and thereby consider an arbitrary store when proving contextual equivalence, is that the definition of simulation and bisimulation already includes the universal quantification over different assignments of the locations in $\widetilde{l}$, since the locations are in the dynamic environment, and we can apply the second item of clause (2c).

6 ADDITIONAL RELATED WORKS

We discuss here some additional works on probabilistic calculi based on different notions of bisimulations (with respect to applicative or environmental) or different techniques for proving contextual equivalence.

The probabilistic $\lambda$-calculus, i.e., a $\lambda$-calculus endowed with binary, fair, probabilistic choice, was first presented in Reference [12]. In References [11] and [8], probabilistic applicative bisimulations for pure call-by-name and call-by-value $\lambda$-calculi are shown to be congruences, using Howe's method coupled with a disentangling technique. Completeness, however, only holds in call-by-value, while it fails in call-by-name. The reason for this is that distributivity of lambda-abstraction over probabilistic choice holds for contextual equivalence in call-by-name but does not hold in call-by-value, and to prove such distributivity laws the bisimulation has to be defined over probability distributions or formal sums, rather than being defined over terms (see Examples 5 and 33). In call-by-name, completeness is obtained using coupled logical bisimulation [11], a probabilistic version of the logical bisimilarity for deterministic languages [44]. While applicative bisimulation requires two functions to be related whenever they take as input the same argument, logical bisimulation requires two functions to be related whenever they take as input terms in the contextual closure of the relation itself. Since the contextual closure of a relation includes identity, the set of terms with which related functions are tested is enlarged with respect to applicative bisimilarity. This makes the congruence proof easier by allowing a direct use of the inductive hypothesis, thereby removing the need for Howe's technique. Drawbacks of all forms of logical bisimilarity are a non-monotone functional (which makes it harder to prove that bisimilarity is the largest bisimulation) and a confinement to pure $\lambda$-calculi. Further, up-to techniques may be difficult in logical bisimilarity. For instance, Example 26 cannot be proved with the techniques in [11]: the equality fails for applicative bisimilarity, and the up-to context technique provided for logical bisimilarity is not powerful enough (the article shows a similar example, akin to Example 5, where, however, the functions employed immediately throw away their input, and this is essential for the proof).

A further difference between applicative bisimulations and environmental bisimulations shows up when one considers the corresponding simulations. Even in cases where applicative bisimilarity is fully abstract for contextual equivalence, the corresponding simulation may not be fully abstract for the contextual preorder. Pure call-by-value is such an example [8, 10]. In contrast, in all calculi in the article, full abstraction for environmental bisimilarity carries over to the corresponding simulation, with a similar proof.

An alternative bisimulation for enriched calculi is normal form (or open) bisimulation [22, 28, 42, 47]. This is complete (with respect to contextual equivalence) only in certain extensions of the $\lambda$-calculus (e.g., call-by-value with both state and callcc), and would be incomplete in other languages (such as $\lambda$-calculus without state or/and callcc).

Another approach to contextual equivalence in higher-order languages is via logical relations (see, e.g., Reference [31, Chapter 8] and Reference [37]). This technique has been applied to probabilistic typed higher-order languages by Bizjak and Birkedal [6]. Their probabilistic logical relation uses biorthogonality, and is defined on terms, rather than on distributions. These features introduce some universal quantification (e.g., on evaluation contexts), which makes it difficult to prove examples such as 44, as discussed in Reference [5, Section 1.5]. Proof techniques combining features of bisimulations and logical relations in the non-probabilistic case are studied in References [20, 21, 33].

In denotational semantics, fully abstract models for probabilistic PCF have been studied in Reference [18] using domain theory and adding statistical termination testers, and in Reference [16] using probabilistic coherence spaces. Reference [13] provides a fully abstract game semantics for probabilistic Algol, using a quotienting step.

Finally, in this work, we have only considered exact behavioral equivalences, as opposed to approximate behavioral equivalences (allowing the programs to differ up to a certain probability value $\epsilon$) or metrics (measuring the distance between the behaviors of probabilistic programs) [14, 15]. Bisimulation metrics for an affine probabilistic pure $\lambda$-calculus have been recently proposed in Reference [9]. Applicative bisimulation metric is proved to be sound with respect to the contextual distance, and a metric for an extensions of the language with tuples is defined. To be sound with respect to the contextual metric, the tuple distance is endowed with a notion of environment.

7 CONCLUSIONS AND FUTURE WORK

We have investigated environmental bisimulations in sequential higher-order languages, considering pure $\lambda$-calculi, both call-by-name and call-by-value, and an extension with higher-order references.

While we have tried to respect the general schema of environmental bisimulations, our definitions and results present noticeable technical differences. Some differences, such as the appeal to formal sums, are specific to probabilities. Other differences, however, may be seen as insights into environmental bisimulations that were suggested by the study of probabilities. An example is the distinction between a static and a dynamic environment, which reflects the copying facilities of the language on the terms of the environment. This distinction yields sharper congruence results, which show up well in the imperative $\lambda$-calculus: with ordinary environmental bisimulations, bisimilarity is fully substitutive only for values, since for general terms substitutivity holds only for evaluation contexts (see Example 43). The example in Section 3.4 shows that static environments can also be useful in context closures of “up-to context” techniques.

To understand environmental bisimulations for call-by-value calculi, we have found important the study of the imperative extension. Only in the richer language do various aspects of our definitions find a justification: the use of formal sums (Example 44); dynamic environments as formal sums of tuples of values, as opposite to, e.g., tuples of formal sums (Example 45); the lifting construct to handle first-order values (Example 46). The pure call-by-value calculus has allowed us to present the concepts in a simpler setting, as a stepping stone toward the imperative extension, but seems a rather peculiar language, one in which a number of variations of the definitions collapse.

The dynamic environments are used only for the call-by-value calculi. In general, the form of the bisimulation clauses depends on the features of the calculus. It would be interesting to investigate an abstract formulation of bisimulation, of which the concrete definitions presented in this article would be instances. Possible bases for such a framework could be coalgebras [40] or bigraphs [30].

Related to the problems with congruence of applicative bisimulations are also the difficulties with “up-to context” techniques (the usefulness of these techniques in higher-order languages and its problems with applicative bisimulations have been studied by Lassen [27]; see also References [26, 39, 41]). Enhancements of the bisimulation proof method, as up-to techniques, are particularly useful for environmental bisimulations [45] because of the quantification over contexts that appear in the definition and that can make bisimulation proofs tedious. We have explored some basic enhancements, mainly in call-by-name, including new forms of up-to techniques specific to probabilities such as “up-to lifting.” The study of powerful enhancements goes beyond the scopes of this work; we regard it as an important and challenging line for future work. The study could be pursued in a number of directions, for instance investigating other forms of up-to and strengthening the “up-to context” enhancements.

Another interesting direction for future work is the addition of concurrency. A major consequence of this could be the move to semantics that combine probabilities with non-determinism.

APPENDIX

A PROOFS

Proof of Lemma 11

  1. The proof of (1) follows from the definition of as the supremum of the set with respect to the $\le _{{\rm {\tt apx}}}$ preorder. Let $\, \mathcal {R}\,$ be a simulation and let $\mathrel {\mathcal {S}}$ be its saturation by approximants.
    If $M \mathrel {\mathcal {S}}N,$ then , since $\le _{{\rm {\tt apx}}}$ is reflexive and . If $Y\mathrel {{\mathcal {S}}_{(M,N)}} Z,$ then there is a $Y^{\prime }$ such that $Y\le _{{\rm {\tt apx}}}Y^{\prime }$ and $Y^{\prime } \mathrel {{\mathcal {R}}_{(M,N)}} Z$. We have ${{\tt weight}} (Y) \le {{\tt weight}} (Y^{\prime })$, by the definition of approximant, and , since $\, \mathcal {R}\,$ is a simulation.
    Suppose $Y+Y^{\prime \prime }= Y^{\prime }$. Then, for any context $C$,
    which implies .
  2. Let ${\mathcal {S}}= \bigcup _{n} {\mathcal {R}}^{n}$ be the saturation by suprema of a finite-step simulation ${\mathcal {R}}$. The clause on $\lambda$-terms is immediate, since $M \mathrel {\mathcal {S}}N$ and implies (by the definition of finite-step simulation), which in turn implies (since , and thus we can find an ordered sequence of formal sums that satisfies the condition for ${\mathcal {R}}^{1}$).
    For the clause on formal sums, the crux is proving the following lemma.

If $ \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {{\mathcal {R}}^{n}_{{\mathcal {E}}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}$, then:

  1. $\sum _{i} p_{i} \le \sum _{j} q_{j}$
  2. implies , for all $P,Q \in {\mathcal {E}}^{{\star }}$.

The proof is by induction on $n$.

For the case $n=0$, the two properties above are immediate consequences of the definition of $\, \mathcal {R}\,$.

For the inductive case, if $Y\, \mathcal {R}\,^{n+1}_{(M,N)} Z$ then either $Y\, \mathcal {R}\,^{n}_{(M,N)} Z$, and the result follows by the inductive hypothesis, or $Y= \sup S$ for $S=\lbrace Y_{k}\rbrace _{k \ge 0}$ a set of formal sums such that $Y_{k} \, \mathcal {R}\,^{n}_{(M,N)}Z$ for all $k$ and $Y_{k}\le _{{\rm {\tt apx}}}Y_{k+1}$. As a consequence, there is a sequence $Y^{\prime }_{k}$ such that $Y_{0}=Y^{\prime }_{0}$ and $Y_{k+1}=Y_{k}+Y^{\prime }_{k+1}$, i.e., $Y_{k}=\sum _{0 \le h \le k}Y^{\prime }_{h}$. Hence, it follows from $Y= \sup S$ that $Y= \sum _{k\ge 0} Y^{\prime }_{k}$.

The first item follows by the inductive hypothesis, since $Y$ is the supremum of $S$ and $Y_{k} \in S$ implies ${{\tt weight}} (Y_{k}) \le {{\tt weight}} (Z)$. As to the second item, we have $Y\bullet C[M]=\sup \lbrace Y_{k}\bullet C[M]\rbrace =\sum _{k \ge 0} Y^{\prime }_{k}\bullet C[M]$. We want to prove that if for some formal sum $X$ then .

If then, by the definition of the multi-step reduction relation (which guarantees that only a finite number of terms are evaluated in the formal sum), there is an $m\ge 0$ such that and $X=X^{\prime }+\,{{\tt val}}{(\sum _{k\gt m} Y^{\prime }_{k}\bullet C[M])}$.

For any $m^{\prime }\ge 0$, we have

Since $\sum _{0\le k \le m+m^{\prime }} {Y^{\prime }_{k}}=Y_{m+m^{\prime }}$ and $Y_{m+m^{\prime }} \, \mathcal {R}\,^{n}_{(M,N)} Z$, by the inductive hypothesis implies
Hence, by the definition of $\, \mathcal {R}\,^{n+1}_{(M,N)}$ and by
\[ X=\sup \left\lbrace X^{\prime }+\,{{\tt val}}{\left( \sum _{m\le k \le m+m^{\prime }} Y^{\prime }_{k}\bullet C[M]\right)}\,\right\rbrace _{m^{\prime }\ge 0}, \]
we derive .

Then the result follows, since $Y= \sum _{i}{p_{i}};{\lambda x. M_{i}} \mathrel {\mathcal {S}}_{{\mathcal {E}}} \sum _{j}{q_{j}};{\lambda x. N_{j}}=Z$ implies $Y\mathrel {\mathcal {R}}^{n}_{{\mathcal {E}}} Z$ for some $n$, and we have $\sum _{i} p_{i} \le \sum _{j} q_{j}$ (by the first item of lemma 57), and

for all $P,Q \in {\mathcal {E}}^{{\star }}$ (by the second item of lemma 57 and by the definition of relation ${\mathcal {R}}^{n+1}$), which implies ${\mathrel {{\mathcal {R}}^{n+1}_{{\mathcal {E}}}}} \subseteq {\mathrel {\mathcal {S}}_{{\mathcal {E}}}}$.

Proof of Lemma 18

Let ${\mathcal {R}}$ be a finite-step simulation saturated by approximants and let

\[ \begin{array}{ll}\mathrel {\mathcal {S}}= &\lbrace (C[M],C[N])\,\mid \,M \, \mathcal {R}\,N\rbrace \cup \lbrace ((C[M],C[N]),Y,Z) \,\mid \,Y\mathrel {\mathcal {S}}_{(M,N)}^{\prime } Z\rbrace , \end{array} \]
with
\[ \begin{array}{ll}{\mathcal {S}}^{\prime }=&\lbrace ((M,N),{1};{\lambda x. C^{\prime }[M]},{1};{\lambda x. C^{\prime }[N]}) | M \mathrel {\mathcal {R}}N\rbrace \\ &\cup \lbrace ((M,N),Y,Z)\, |\, Y\mathrel {{\mathcal {R}}_{(M,N)}} Z\rbrace \\ &\cup \lbrace ((M,N),\emptyset ,Z)\, |\, \text{ for some }M,N,Z\rbrace . \end{array} \]
We show that $\mathrel {\mathcal {S}}$ is a finite-step simulation up-to lifting. Note that the last set of triples is added to the relation, since for any term $M$ that is not a value we have , and $\emptyset$ is simulated by any formal sum $Z$. We first prove the following result:

For any context $C$, if $M \mathrel {\mathcal {R}}N$ and , then we have .

We prove by induction on the length $n$ of the reduction that $M \, \mathcal {R}\,N$ and imply . If $Y= \emptyset ,$ then the result follows by the third set of ${\mathcal {S}}^{\prime }$. Suppose that $Y\ne \emptyset$. If $n=0,$ then we have two cases:

  • $C=[\cdot ]$ and $M$ is a value. Then and since $\, \mathcal {R}\,$ is a finite-step simulation, we have , which implies that they are in $\mathrel {\mathcal {S}}^{\prime }_{(M,N)}$ as well.
  • $C=\lambda x. C^{\prime }$. Then , by the first set of $\mathrel {\mathcal {S}}^{\prime }$.

Suppose now that .

  • $C=[\cdot ]$ and . The result follows from the fact that $\, \mathcal {R}\,$ is a finite-step simulation, as in the first case of $n=0$.
  • $C=C_{1} \oplus C_{2}$ and . Then , and $Y= { \frac{1}{2}};{Y_{1}}+ { \frac{1}{2}};{Y_{2}}$. We have and it follows from the inductive hypothesis on $n_{1}$ and $n_{2}$ that and . Hence, .
  • $C=C_{1} C_{2}$. Then implies , where . Since $n_{1} \le n$ (by $Y\ne \emptyset$), we can apply the inductive hypothesis and derive , i.e., $Y_{1}= \sum _{j}{r_{j}}{\cdot }{Y^{\prime }_{j}}$ and for $Y^{\prime }_{j} \mathrel {\mathcal {S}}^{\prime }_{(M,N)} Z^{\prime }_{j}$. Hence, implies , with $\sum _{j}{n^{\prime }_{j}}=n_{2}$ and $Y= \sum _{j}{r_{j}}{\cdot }{Y^{\prime \prime }_{j}}$, and .
    Since $\,{{\tt lift}}{(\,{{\tt lift}}{(\, \mathcal {R}\,)}\,)}\,=\,{{\tt lift}}{(\, \mathcal {R}\,)}\,$ for any relation $\, \mathcal {R}$, the result follows if we can prove that for every $j\,$ implies . If $Y^{\prime }_{j} \mathrel {\mathcal {S}}^{\prime }_{(M,N)} Z^{\prime }_{j}$, then either $Y_{j}^{\prime }=\emptyset$ and the result trivially follows, or one of these cases hold:
    • $Y^{\prime }_{j}={{1};{\lambda x. C^{\prime }[M]}}$ and $Z^{\prime }_{j}= {{1};{\lambda x. C^{\prime }[N]}}$. Hence, either $Y^{\prime \prime }_{j} = \emptyset$, in which case the result follows by the third set of ${\mathcal {S}}^{\prime }$, or , with $n^{\prime \prime }_{j} \le n$. Terms and $C^{\prime }[N] \lbrace C_{2}[N]\!/\!x\rbrace$ are, respectively, of the form $C^{\prime \prime }[M]$ and $C^{\prime \prime }[N]$, so we can apply the inductive hypothesis to derive $ Y^{\prime \prime }_{j} \,{{\tt lift}}{(\mathrel {\mathcal {S}}^{\prime }_{(M,N)})}\, {Z^{\prime }_{j}\bullet C_{2} [N]}$.
    • $Y^{\prime }_{j}\, \mathcal {R}\,_{(M,N)} Z^{\prime }_{j}$. It is easy to check that iff for some ${Y^{\prime \prime \prime }_{j} \le _{{\rm {\tt apx}}}Y^{\prime }_{j} }$. Since $\, \mathcal {R}\,$ is finite-step simulation saturated by approximants, implies , and the result follows from $\, \mathcal {R}\,_{(M,N)} \subseteq \,{{\tt lift}}{(\mathrel {\mathcal {S}}^{\prime }_{(M,N)})}$.

We derive from Lemma 58 that ${\mathcal {S}}$ is a finite-step simulation up-to lifting as follows:

  • Let $C[M] \mathrel {\mathcal {S}}C[N]$ with $M \, \mathcal {R}\,N$. If then, by Lemma 58, . Therefore, .
  • Let ${1};{\lambda x. C^{\prime }[M]} \mathrel {{\mathcal {S}}_{C[M],C[N]}} {1};{\lambda x. C^{\prime }[N]}$ with $M \, \mathcal {R}\,N$. Then for any $C^{\prime \prime }$ there is a context $C^{\prime \prime \prime }$ such that ${1};{\lambda x. C^{\prime }[M]}\bullet C^{\prime \prime }[C[M]]= {1};{C^{\prime \prime \prime }[M]}$ and ${1};{\lambda x. C^{\prime }[N]}\bullet C^{\prime \prime }[C[N]]= {1};{C^{\prime \prime \prime }[N]}$. It is easy to check that iff and that for any term $P$. Therefore, by Lemma 58, implies , which implies .
  • Let $Y\, \mathcal {R}\,_{C[M],C[N]} Z$ with $Y\, \mathcal {R}\,_{(M,N)} Z$. Then, as $\, \mathcal {R}\,$ is a finite-step simulation, for any $C^{\prime }$ implies , which in turn implies .
  • Let $\emptyset \, \mathcal {R}\,_{C[M],C[N]} Z$. Then for any $P$, we have implies $Y=\emptyset$, and we stay in the third set.

Proof of Lemma 22

To complete the proof, it remains to prove that for any $C^{\prime }$, we have . This result can be derived by Lemma 59 below, since

For any $M,N, Y$ it holds:



  1. For the left to right inequality (i.e., ), we prove that implies for some $Z\le _{{\rm {\tt apx}}}Z^{\prime }$. Since implies and for some $Z^{\prime \prime }$. By definition , so we derive for some $Z^{\prime }$ such that $Z\le _{{\rm {\tt apx}}}Z^{\prime }$.
    For the converse inequality, we analogously prove that implies for some $Z\le _{{\rm {\tt apx}}}Z^{\prime }$. Since relations $\Longrightarrow$ and are small-step and finitary, although could have an infinite support (i.e., be a sum of infinitely many values) only a finite number of $\beta$-reductions substituting $N$ in a value of can be performed in the reduction . Hence, there is some formal sum $Z^{\prime \prime }$ with finite support such that and . This implies that for some $Z^{\prime \prime \prime }$ such that $Z^{\prime \prime } \le _{{\rm {\tt apx}}}Z^{\prime \prime \prime }$, which in turn implies for some $Z^{\prime }$ such that $Z\le _{{\rm {\tt apx}}}Z^{\prime }$.
  2. The left to right inequality (i.e., ) follows trivially, since implies for some $Z^{\prime }$ such that $Z\le _{{\rm {\tt apx}}}Z^{\prime }$.
    To prove , we show that implies that there is a sequence of formal sums $\lbrace {Z}_{j}\rbrace _{j\ge 0}$ (for $j$ ranging over natural numbers) ordered with respect to $\le _{{\rm {\tt apx}}}$ such that for every $j$, and with $\sup \lbrace Z_{j}\rbrace _{j\ge 0}= Z$. Hence, the result follows, since
    and since for every $Z$ we have , we derive
    Hence, it remains to prove that implies that there is a (infinite) sequence of formal sums $\lbrace {Z}_{j}\rbrace _{j\ge 0}$ ordered with respect to $\le _{{\rm {\tt apx}}}$ such that for every $j$, and with $\sup \lbrace Z_{j}\rbrace _{j\ge 0}= Z$. Let $Y= \sum _{i \in I}{p_{i}};{\lambda x. P_{i}}$ and . It follows by the definition of that there is a finite $I^{\prime }\subseteq I$ and a formal sum $Z^{\prime }$ such that and (only a finite number of steps can be taken, and thus only a finite number of summands can move). Hence, by allowing all and only the summands with index $i \in I^{\prime }$ to perform the $\beta$-reduction substituting $N$ in $P_{i}$, we derive . Then, by allowing one at a time the summands of $Y$ with index $i \in I\backslash I^{\prime }$ to perform the $\beta$-reduction substituting $N$ in $P_{i}$, we obtain a sequence $\lbrace {Z}_{j}\rbrace _{j\ge 0}$, that starts from $Z_{0}=Z^{\prime }$ and progressively adds to it the values in one by one. This sequence is ordered with respect to $\le _{{\rm {\tt apx}}}$, it is such that for every $j$, and it has $\sup \lbrace Z_{j}\rbrace _{j\ge 0}= Z$.

Proof of Lemma 25

Let ${\mathcal {R}}$ be a finite-step simulation up-to lifting and context. We prove that

\[ \begin{array}{rl}{\mathcal {R}}^{\prime }\stackrel{{{{\rm {\tt def}}}}}{=}&{\tt Pairs}({\mathcal {R}}) \\ &\cup \: \lbrace ((M,N),{1};{\lambda x. C[M]},{1};{\lambda x. C[N]})\,\mid \,M \mathrel {\mathcal {R}}N \rbrace \\ &\cup \: \lbrace ((M,N),Y,Z) \,\mid \,Y^{\prime } \, \mathcal {R}\,_{(M,N)} Z\mbox{ and } Y\le _{{\rm {\tt apx}}}Y^{\prime } \mbox{, for some $Y^{\prime }$} \rbrace \\ &\cup \: \lbrace ((M,N),\emptyset ,Z)\, |\, \text{ for some }M,N,Z\rbrace \end{array} \]
is a finite-step simulation up-to lifting, from which the result follows by ${\mathcal {R}}\subseteq {\mathcal {R}}^{\prime }$.

Note that the relation $\,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\,$ is saturated by approximants, i.e., the following property holds: if $Y\le _{{\rm {\tt apx}}}Y^{\prime } \,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\, Z$ then $Y\,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\, Z$. We first prove the following result:

For any context $C$, if $M \mathrel {\mathcal {R}}N$ and , then we have .

We prove that $M \mathrel {\mathcal {R}}N$ and imply , by induction on $n$. If $Y= \emptyset ,$ then the result holds by the last set of ${\mathcal {R}}^{\prime }$. Suppose that $Y\ne \emptyset$. If $n=0,$ then we have two cases:

  • $C=[\cdot ]$ and $M$ is a value. Then and we have .
  • $C=\lambda x. C^{\prime }$. Then .

Suppose now that .

  • $C=[\cdot ]$ and . The result follows from the fact that $\, \mathcal {R}\,$ is a finite-step simulation up-to lifting and context, as in the first case of $n=0$.
  • $C=C_{1} \oplus C_{2}$ and . Then , with $n_{1}+n_{2}\le n$ and $Y= { \frac{1}{2}};{Y_{1}}+ { \frac{1}{2}};{Y_{2}}$. We have and it follows from the inductive hypothesis on $n_{1}$ and $n_{2}$ that and . Hence, we derive .
  • $C=C_{1} C_{2}$. Then implies , where . Since $n_{1} \le n$ (by $Y\ne \emptyset$), we can apply the inductive hypothesis and derive , i.e., $Y_{1}= \sum _{j}{r_{j}}{\cdot }{Y^{\prime }_{j}}$ and for $Y^{\prime }_{j} {\mathcal {R}}^{\prime }_{(M,N)} Z^{\prime }_{j}$. Hence, implies , with $\sum _{j}{n^{\prime }_{j}}=n_{2}$ and $Y= \sum _{j}{r_{j}}{\cdot }{Y^{\prime \prime }_{j}}$, and
    Since $\,{{\tt lift}}{(\,{{\tt lift}}{(\, \mathcal {R}\,)}\,)}\,=\,{{\tt lift}}{(\, \mathcal {R}\,)}\,$ for any relation $\, \mathcal {R}$, the result follows if we can prove that for every $j\,$ implies . If $Y^{\prime }_{j} \mathrel {\mathcal {R}}^{\prime }_{(M,N)} Z^{\prime }_{j},$ then one of the following cases holds:
    • $Y^{\prime }_{j}={{1};{\lambda x. C^{\prime }[M]}}$ and $Z^{\prime }_{j}= {{1};{\lambda x. C^{\prime }[N]}}$. Hence, either $Y^{\prime \prime }_{j} = \emptyset$, in which case the result follows by the last set of ${\mathcal {R}}^{\prime }$, or , with $n^{\prime \prime }_{j} \le n$. Terms and are, respectively, of the form $C^{\prime \prime }[M]$ and $C^{\prime \prime }[N]$, and we can apply the inductive hypothesis to derive .
    • $Y^{\prime }_{j} \le _{{\rm {\tt apx}}}X\, \mathcal {R}\,_{(M,N)} Z^{\prime }_{j}$. If $Y^{\prime }_{j} C_{2}[M] \Longrightarrow Y^{\prime \prime }_{j}$, then there is a $X^{\prime }$ such that and $Y^{\prime \prime }_{j} \le _{{\rm {\tt apx}}}X^{\prime }$, for some $n^{\prime \prime }_{j}\le n^{\prime }_{j}$. It is easy to check that there exists a $X^{\prime \prime }$ such that and $X^{\prime } \le _{{\rm {\tt apx}}}X^{\prime \prime }$, for some $n^{\prime \prime \prime }_{j} \lt n^{\prime \prime }_{j}$. Since $X\, \mathcal {R}\,_{(M,N)} Z^{\prime }_{j}$, there are two cases:
      • $X\bullet C_{2}[M] \Longrightarrow F$ and $Z^{\prime }_{j}\bullet C_{2} [N] \Longrightarrow G$ with $F\,{{\tt lift}}{({{\tt dirac}}{({(M,N)}^{{\star }})})}\, G$.
        Hence, with $X^{\prime \prime } \le _{{\rm {\tt apx}}}X^{\prime \prime \prime }$, for some $n^{\prime \prime \prime \prime }_{j}\le n^{\prime \prime \prime }_{j} \lt n$. We can apply the inductive hypothesis to the pairs in ${{(M,N)}^{{\star }}}$ whose projections, respectively, compose $F$ and $G$ through the lifting, and derive . It follows from $Y^{\prime \prime }_{j} \le _{{\rm {\tt apx}}}X^{\prime \prime \prime }$ that .
      • .
        As $Y^{\prime \prime }_{j} \le _{{\rm {\tt apx}}}X^{\prime \prime }$, we then derive , since $\,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\,$ is saturated by approximants.
    • the result is immediate if $Y^{\prime }_{j} =\emptyset$.

From Lemma 60, we can now derive that ${\mathcal {R}}^{\prime }$ is a finite-step simulation up-to lifting:

  1. if $M \mathrel {\mathcal {R}}^{\prime } N,$ then $M \mathrel {\mathcal {R}}N$, and implies , by the definition of ${\mathcal {R}}$. Then the result follows by ${\mathcal {R}}\subseteq {\mathcal {R}}^{\prime }$.
  2. if $Y\mathrel {\mathcal {R}}^{\prime }_{(M,N)} Z,$ then:
    • if $Y\le _{{\rm {\tt apx}}}Y^{\prime } \mathrel {{\mathcal {R}}_{(M,N)}} Z,$ then for all $P,Q \in (M,N)^{{\star }}$, we have two cases:
      • $Y^{\prime }\bullet P \Longrightarrow F$ and $Z\bullet Q \Longrightarrow G$ with $F\,{{\tt lift}}{({{\tt dirac}}{({(M,N)}^{{\star }})})}\, G$.
        If then there is a $Y^{\prime \prime \prime }$ such that and $Y^{\prime \prime } \le _{{\rm {\tt apx}}}Y^{\prime \prime \prime }$. It follows from $F\,{{\tt lift}}{({{\tt dirac}}{({(M,N)}^{{\star }})})}\, G$ and from Lemma 60 that implies , which is equivalent to saying that . Since $F^{\prime \prime }\le _{{\rm {\tt apx}}}Y^{\prime \prime \prime }$ and $\,{{\tt lift}}{(\mathrel {\mathcal {R}}^{\prime }_{(M,N)})}\,$ is saturated by approximants, we derive .
      • and .
        If then there is a $Y^{\prime \prime \prime }$ such that and, by the definition of ${\mathcal {R}}$, , which implies . Since $Y^{\prime \prime } \le _{{\rm {\tt apx}}}Y^{\prime \prime } +Y^{\prime \prime \prime }$, we have .
    • If $Y= {1};{\lambda x. C[M]}$ and $Z={1};{\lambda x. C[N]}$ with $M \mathrel {\mathcal {R}}N,$ then for all $P,Q \in (M,N)^{{\star }}$, we have $Y\bullet P= {1};{C^{\prime }[M]}$ and $Z\bullet Q= {1};{C^{\prime }[N]}$ for some $C^{\prime }$. Then, by Lemma 60, having , we derive .
    • If $Y= \emptyset ,$ then the simulation clause holds, and we stay in the last set of ${\mathcal {R}}^{\prime }$.

Proof of Lemma 29

Let denote the transitive closure of , i.e., if there are $P=P_{1}, P_{2},\ldots,P_{k}=P^{\prime }$ such that for every $1 \le i \lt k$ there are a context $C_{i}$ and tuples $\widetilde{P_{i}}, \widetilde{P^{\prime }_{i}}$ with $P_{i}= C_{i}[\widetilde{P_{i}}]$ and $P_{i+1}=C_{i}[\widetilde{P^{\prime }_{i}}]=C_{i+1}[\widetilde{P}_{i+1}]$ and . Define the following term relation:

We consider , instead of just considering , since otherwise the induction hypothesis would not suffice in the proof of Lemma 61(**), for the application case.

Let $\,{{\tt liftd}}{(\cdot)}\,$ denote $\,{{\tt lift}}{({{\tt dirac}}{(\cdot)})}$.

It holds that

  • and imply with $n \ge n^{\prime }$ and
  • and imply

We first prove (*). Let $P=P_{1}, P_{2},\ldots,P_{k}=P^{\prime }$ be such that for every $i$, for $1 \le i \lt k$, there are a context $C_{i}$ and tuples $\widetilde{P_{i}}, \widetilde{P^{\prime }_{i}}$ with $P_{i}= C_{i}[\widetilde{P_{i}}]$ and $P_{i+1}=C_{i}[\widetilde{P^{\prime }_{i}}]=C_{i+1}[\widetilde{P}_{i+1}]$ and . Suppose that . We prove by induction on $k$ that for every $i$ such that $1 \le i \lt k$, we have and $m_{i} \ge m_{i+1}$ and .

The result is trivial for $k=1$. Suppose that $k=k^{\prime }+1$. The result follows from the inductive hypothesis and from

if we can prove that for any $C$ and $\widetilde{P}, \widetilde{P}^{\prime }$ such that , whenever , then with $m \ge m^{\prime }$ and . This is proved by induction on $m$. If $m=0,$ then $Y=Y^{\prime }$ and the result follows. Suppose . We have three cases:
  • if $C=[\cdot ],$ then the result immediately follows by .
  • $C=C_{1}\oplus C_{2}$. Then there are $Y_{1},Y_{2}$ such that $Y= { \frac{1}{2}};{Y_{1}}+{ \frac{1}{2}};{Y_{2}}$ and $C_{i}[\widetilde{P}] \Longrightarrow _{m_{i}} Y_{i}$ for $i =1,2$ and $m_{i} \lt m+1$. The result follows from the inductive hypothesis
  • $C= C_{1} C_{2}$. If $C_{1}[\widetilde{P}]$ is a value, then, by the definition of , $C_{1}[\widetilde{P}^{\prime }]$ is exactly the same value. Then the terms resulting after the $\beta$-reduction are in , and we conclude by the inductive hypothesis.
    If then we can apply the inductive hypothesis to $m_{i}$ and the result follows.

We can now prove (**) by showing by induction on $n$ that and imply .

Let , $P^{\prime }=C[M]$ and $Q=C[N]$. If $n=0$ and $Y\ne \emptyset ,$ then $P$ is a value, $Y={1};{P}$ and by (*) $P^{\prime }$ is a value too, with . We have two cases:

  • $C=[\cdot ]$, with ${P^{\prime }=M}$ a value, and $Q=N$.
    By the definition of $\mathrel {\mathrel {{\mathcal {T}}_{(M,N)}}}$, we have and it follows from that .
  • $P^{\prime }=\lambda x. C^{\prime }[M]$ and $Q=\lambda x. C^{\prime }[N]$.
    Then .

If then by (*), we have with $m \le n+1$ and . Suppose that $Y^{\prime } \ne \emptyset$. We have three cases:

  • $C=[\cdot ]$. If then . For any term relations ${\mathcal {S}},{\mathcal {S}}^{\prime }$, we have
    • ${{\tt liftd}}{({\mathcal {S}})}\,{{\tt dirac}}{({\mathcal {S}}^{\prime })} \subseteq {{\tt disliftd}}({{\mathcal {S}}{\mathcal {S}}^{\prime }})$
    • $\le _{{\rm {\tt apx}}}{{\tt disliftd}}({\mathrel {\mathrel {{\mathcal {T}}_{(M,N)}}}})$ $\subseteq$ ${{\tt disliftd}}({\mathrel {\mathrel {{\mathcal {T}}_{(M,N)}}}}) \le _{{\rm {\tt apx}}}$
    Hence, we derive .
  • $C=C_{1}+C_{2}$. Then there are $Y_{1},Y_{2}$ such that $Y^{\prime }= { \frac{1}{2}};{Y_{1}}+{ \frac{1}{2}};{Y_{2}}$ and $C_{i}[M] \Longrightarrow _{m_{i}} Y_{i}$ for $i =1,2$ and $m_{i} \le n$. By the inductive hypothesis, we have
    As $\,{{\tt lift}}{({{\tt disliftd}}({\cdot }))}\,= {{\tt disliftd}}({\cdot })$ and $\,{{\tt liftd}}{({\mathcal {S}})}\,{{\tt disliftd}}({{\mathcal {S}}^{\prime }})$ $\subseteq$ ${{\tt disliftd}}({{\mathcal {S}}{\mathcal {S}}^{\prime }})$ for any ${\mathcal {S}}$ and ${\mathcal {S}}^{\prime }$, from , we derive

  • $C= C_{1} C_{2}$. We consider two cases:
    • $C_{1}[M]=M$ and $M=\lambda x. M^{\prime }$ and $N= \lambda x. N^{\prime }$ are values.
      Then $M \mathrel {\mathrel {{\mathcal {T}}_{(M,N)}}}N$, and we have iff , with $m^{\prime } \lt m \le n+1$ and , where (note that here the determinism of the reduction to $F$ is used to guarantee that and that $m^{\prime } \lt m \le n+1$). Hence, we have , with either (which implies $Y_{i} {{\tt dirac}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}Z_{i}$) or and for and $m_{i} \le m^{\prime } \lt n+1$, and by applying the inductive hypothesis, we derive $Y_{i} {{\tt disliftd}}({\mathrel {{\mathcal {R}}_{(M,N)}}}) \le _{{\rm {\tt apx}}}Z_{i}$. Therefore, , and the result follows.
    • $C_{1}[M]=\lambda x. C^{\prime }_{1}[M]$ and $C_{1}[N]=\lambda x. C^{\prime }_{1}[N]$.
      We can apply the inductive hypothesis to to derive
      then we have , which implies the result.

We can now show that the relation

\[ \mathrel {\mathcal {S}}\stackrel{{{{\rm {\tt def}}}}}{=}\lbrace (M,N)\rbrace \cup \lbrace ((M,N), {1};{V}, {1};{W}) \,\mid \,V \mathrel {{\mathcal {R}}_{(M,N)}}W\rbrace \cup \lbrace ((M,N),\emptyset , Z) | \text{ for any } Z\rbrace \]
is a finite-step simulation up-to distribution and lifting:
  • since , by Lemma 61(**), if then
    which implies (using the last set of relation $\mathrel {{\mathcal {S}}_{(M,N)}}$ to eliminate the approximation preorder $\le _{{\rm {\tt apx}}}$).
  • the weight of the formal sums is the same.
  • if ${1};{V} \mathrel {{\mathcal {S}}_{(M,N)}}{1};{W}$ and then for any $ (P,Q) \in (M,N)^{{\star }}$, we have . Then clause (2b) of finite-step simulation holds by Lemma 61(**).
    If then for any $ (P,Q) \in {(M,N)}^{{\star }}$ we have . Hence, implies, by Lemma 61(*), that with . By the definition of $\mathrel {\mathrel {{\mathcal {T}}_{(M,N)}}}$ and since $\overset{\rm {d}}{\Longrightarrow }$ is deterministic, from and Lemma 61(**), we derive (see the proof of Lemma 61(**), application case, for more details). Then , which implies .

Hence, we have .

It remains to prove that (then it follows from Corollary 12 and Theorem 7(3) that $M \approx N$). To do so, we first prove the following lemma.

It holds that

  • and imply with
  • and imply for some $Y$ such that $Y{{\tt disliftd}}({\mathrel {{\mathcal {R}}_{(M,N)}}}) Z.$

The results in Lemma 62 are symmetric to the results in Lemma 61 and are proved analogously. For item (*), we proceed first by induction on the length $k$ of the sequence , and then, for the inductive step, we show by induction on the length of $m$ that and imply with . Item (**) is proved by induction on the length of the reduction .

There are two main differences with respect to Lemma 61. In item (*), since the direction of is now reversed, the length of the reduction is not greater than or equal to the length of the reduction from $P$. Second, in item (**), instead of considering the semantics of terms (on one side), we only relate formal sums reached via the multi-step reduction relation. This is a stronger condition, that is needed in the remainder of the proof.

Finally, we prove that relation

\[ \mathrel {\mathcal {S}}^{\prime }\stackrel{{{{\rm {\tt def}}}}}{=}\lbrace (N,M)\rbrace \cup \lbrace ((N,M), {1};{W}, {1};{V}) \,\mid \,V \mathrel {{\mathcal {R}}_{(M,N)}}W\rbrace \cup \lbrace ((N,M), \emptyset , Z) \,\mid \,\text{ for any } Z\rbrace \]
is a finite-step simulation up-to distribution and lifting. The proof proceeds as the proof for $\mathrel {\mathcal {S}}$. The conditions on the first and the last set of $\mathrel {\mathcal {S}}^{\prime }$ are immediate; for the second set of $\mathrel {\mathcal {S}}^{\prime }$, the simulation clauses follow by deriving from Lemma 62(*) and (**) the following property: if $V \mathrel {{\mathcal {R}}_{(M,N)}}W$ and $P (M,N)^{\star } Q$ then implies and $Y{{\tt disliftd}}({\mathrel {{\mathcal {R}}_{(M,N)}}}) Z$.

Proof of Theorem 52

Let $\, \mathcal {R}\,$ be a finite-step $\lbrace \widetilde{l}\rbrace$-simulation saturated by approximants. We first define, for any pair of terms $(M,N)$, the preorder $\le _{{\rm {\tt cce}}(M,N)}$ (context closure of environments) on pairs of environment formal sums with store: $(\mathbf {Y},\mathbf {Z}) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })$ if $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} , \mathbf {Z}= \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ with ${|\mathbf {Y}|}={|\mathbf {Z}|}$ and $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ with ${|\mathbf {Y}^{\prime }|}={|\mathbf {Z}^{\prime }|}$ and

  • for every index $r$ in $|\mathbf {Y}|$ there is an index $r^{\prime }$ in $|\mathbf {Y}^{\prime }|$ such that and ;
  • for every index ${r^{\prime }} \le {|\mathbf {Y}^{\prime }|}$ there is a location-free value-context $C$ such that for every $i,j$ it holds that $(\widetilde{V}^{\prime }_{i})_{r^{\prime }}=C[M,\widetilde{V}_{i}]$ and $(\widetilde{W}^{\prime }_{j})_{r^{\prime }}=C[N,\widetilde{W}_{j}]$ (i.e., $ \in$ $(\lbrace (M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$).

For any indexed relation $\mathrel {{\mathcal {R}}_{(M,N)}}$ on environment formal sums, we write $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$ for relation $\le _{{\rm {\tt cce}}(M,N)}(\mathrel {{\mathcal {R}}_{M,N}})$, i.e.,

\[ \begin{array}{l}\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}= \lbrace (\mathbf {Y},\mathbf {Z})| \exists \mathbf {Y}^{\prime },\mathbf {Z}^{\prime } \text{ such that }(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime })\le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z}) \; \wedge \;\mathbf {Y}^{\prime } \mathrel {{\mathcal {R}}_{(M,N)}} \mathbf {Z}^{\prime }\rbrace . \end{array} \]

Note that we can add to a finite-step $\lbrace \widetilde{l}\rbrace$-simulation ${\mathcal {R}}$ saturated by approximants the set

\[ \begin{array}{rl}\lbrace ((M,N),\emptyset , \mathbf {Y})\,\mid \,\mathbf {Y}\text{ is an environment formal sum}\rbrace \end{array} \]
for any $(M,N)$, and we still have that ${\mathcal {R}}$ is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation saturated by approximants, since the presence of the empty formal sum on the left is irrelevant and trivially satisfies the simulation clauses. Hence, we assume that finite-step simulations have this property, that we refer to as ${\mathcal {R}}$ is saturated by $\emptyset$.

The following result is used in the proof of Lemma 64 (in Lemma 63 and 64, the set of locations parametrizing the relations is not relevant; hence, we omit it).

Let ${\mathcal {R}}$ be a finite-step simulation and let

\[ \mathbf {Y}= \sum _{i}{p_{i}};{s_{i} ;\widetilde{V}_{i}} \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}} =\mathbf {Z}. \]
Let $(\lbrace \lambda x. P_{i}\rbrace _{i}, \lbrace \lambda x. Q_{j}\rbrace _{j}) \in (\lbrace M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$ and $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$. Then one of the following holds:

  • for every $\mathbf {W}$, implies

We have the three cases below:

  • If $\lambda x. P_{i}= \lambda x. C^{\prime }[M, \widetilde{V}_{i}]$ and $\lambda x. Q_{j}=\lambda x. C^{\prime }[N, \widetilde{W}_{j}]$ for some location-free context $C^{\prime }$, then there is a location-free context $C^{\prime \prime }$ such that
    and the first item holds.
  • If there is an $r$ such that $\lambda x. P_{i}= (\widetilde{V}^{\prime }_{i})_{r}$ and $\lambda x. Q_{j}=(\widetilde{W}^{\prime }_{j})_{r}$ for some
    \[ \mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i}} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}} =\mathbf {Z}^{\prime }, \]
    such that $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime }) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z})$, then it follows from the fact that ${\mathcal {R}}$ is a finite-step simulation that implies
    Since implies
    we derive

  • If $\lambda x. P_{i}= M$ and $\lambda x. Q_{j}= N,$ then $M$ and $N$ are values and by clause (2g) applied to $\mathrel {{\mathcal {R}}_{(M,N)}}$,
    \[ \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}, M} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}, N,} \]
    for some $( \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}}, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z})$. By clause (2b) applied to $\mathrel {{\mathcal {R}}_{(M,N)}}$, from we derive

    By the assumptions $\lambda x. P_{i}= M$ and $\lambda x. Q_{j}= N$ there are already columns in the dynamic environments of $\mathbf {Y}$ and $\mathbf {Z}$ composed by $M$ and $N,$ respectively; thus,
    from which the result follows.

In what follows, we sometimes use relations $\le _{{\tt lift}}$ and $\le _{{\tt lift}}\le _{{\rm {\tt env}}}$, defined as follows:

  • $(\mathbf {Y},\mathbf {Z})\le _{{\tt lift}}\lbrace (\mathbf {Y}_{g}, \mathbf {Z}_{g})\rbrace _{g}$ if there are probability values $p_{g}$ such that $\mathbf {Y}=\sum _{g}p_{g} \cdot \mathbf {Y}_{g}$ and $\mathbf {Z}=\sum _{g}p_{g} \cdot \mathbf {Z}_{g}$;
  • $(\mathbf {Y},\mathbf {Z})\le _{{\tt lift}}\le _{{\rm {\tt env}}}\lbrace (\mathbf {Y}_{g}, \mathbf {Z}_{g})\rbrace _{g}$ if there are probability values $p_{g}$ such that $\mathbf {Y}=\sum _{g}p_{g} \cdot \mathbf {Y}^{\prime }_{g}$ and $\mathbf {Z}=\sum _{g}p_{g} \cdot \mathbf {Z}^{\prime }_{g}$ with $(\mathbf {Y}^{\prime }_{g},\mathbf {Z}^{\prime }_{g}) \le _{{\rm {\tt env}}}(\mathbf {Y}_{g},\mathbf {Z}_{g})$ for every $g$.

The notation, as for relations $\le _{{\rm {\tt env}}}$ and $\le _{{\rm {\tt cce}}(M,N)}$, is extended to environment formal sums with running terms by requiring the running term to be the same everywhere.

Suppose that $\mathrel {{\mathcal {R}}_{(M,N)}}$ is a finite-step simulation saturated by approximants (only defined on formal sums). For any location-free context $C$ if $\mathbf {Y}\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\mathbf {Z}$ and then .

Suppose that $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}=\mathbf {Z}$, with $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}}$ and $ \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ related by $\mathrel {{\mathcal {R}}_{(M,N)}}$ and such that $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime }) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z})$.

We prove by induction on $n$ and then by induction on the structure of $C$ that

implies .

(In the proof, we sometimes assume that $\widetilde{V}_{i}=\widetilde{V}^{\prime }_{i},\widetilde{V}^{\prime \prime }_{i}$ and $\widetilde{W}_{j}=\widetilde{W}^{\prime }_{j},\widetilde{W}^{\prime \prime }_{j}$. This does not affect the results, since the context closure of environments allows us to permute the columns in the formal sums.)

If $\mathbf {W}= \emptyset ,$ then the result follows by the fact that ${\mathcal {R}}$ is saturated by $\emptyset$. Suppose that $\mathbf {W}\ne \emptyset$ and $n=0$. We have one of the following cases:

  • $C=[\cdot ]_{1}$ and $M$ is a value. Then,
    and we derive

  • $C \ne [\cdot ]_{1}$ and for every $i,j$, $C[M,\widetilde{V}_{i}]$ and $C[N,\widetilde{W}_{j}]$ are values. Then it follows from the definition of $\le _{{\rm {\tt cce}}(M,N)}$ that

Suppose now that , with $\mathbf {W}\ne \emptyset$. We have the following cases:

  • $C=[\cdot ]_{1}$ and $M$ is not a value. Then the result follows analogously to the $n=0$ case.
  • $C=C_{1}\oplus C_{2}$. In this case implies
    \[ \sum _{i}{p_{i}};{ s_{i} ;\widetilde{V}_{i}};{(C_{1} \oplus C_{2})[M,\widetilde{V}_{i}]} \longrightarrow \frac{1}{2}\cdot \sum _{i}{p_{i}};{ s_{i} ;\widetilde{V}_{i}};{C_{1} [M,\widetilde{V}_{i}]} + \frac{1}{2} \sum _{i}{p_{i}};{ s_{i} ;\widetilde{V}_{i}};{C_{2}[M,\widetilde{V}_{i}],} \]
    and $\mathbf {W}= \frac{1}{2}\cdot \mathbf {W}_{1} + \frac{1}{2}\cdot \mathbf {W}_{2}$, with , for $h=1,2$ and $n_{h} \le n$. Since
    we can apply the inductive hypothesis to $n_{1}$ and $n_{2}$ and derive
    The result follows from $\,{{\tt lift}}{(\,{{\tt lift}}{({\mathcal {R}})}\,)}\,=\,{{\tt lift}}{({\mathcal {R}})}$.
  • $C=C_{1} C_{2}$.
    Suppose that there exists some $i$ such that ${C_{1} [M,\widetilde{V}_{i}]}$ is not a value, and such that ${C_{1} [M,\widetilde{V}_{i}]}$ performs some small steps in the reduction leading to $\mathbf {W}$. Hence, there is a set $I^{\prime } \subseteq I$ such that
    with $n_{1} \gt 1$ and
    We have
    for . Then we can apply the inductive hypothesis to $n_{1}$ and derive
    \[ \sum _{i \in I^{\prime },k}{p_{i,k}};{s_{i,k} ;\widetilde{V}_{i},V_{i,k}} \,{{\tt lift}}{\big(\!\ge _{{\rm {\tt env}}}\big(\!\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\!\big)\big)}\, \sum _{j \in J^{\prime },h}{q_{j,h}};{t_{j,h};\widetilde{W}_{j},W_{j,h} }, \]
    which is equivalent to saying
    \[ \left( \sum _{i \in I^{\prime },k}{p_{i,k}};{s_{i,k} ;\widetilde{V}_{i},V_{i,k}}, \sum _{j \in J^{\prime },h}{q_{j,h}};{t_{j,h};\widetilde{W}_{j},W_{j,h} }\right) \le _{{\tt lift}}\le _{{\rm {\tt env}}}\lbrace (\mathbf {Y}_{g}, \mathbf {Z}_{g})\rbrace _{g} \subseteq \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}, \]
    with $\mathbf {Y}_{g}= \sum _{i,k \in I_{g}}{p^{\prime }_{i,k}};{s_{i,k} ;\widetilde{V}_{i,k}},$ and $\mathbf {Z}_{g}= \sum _{j,h \in J_{g}}{q^{\prime }_{j,h}};{t_{j,h};\widetilde{W}_{j,h}}$ such that for every $g$ there is a context $C_{g}$ such that for all $i,k \in I_{g}$ and for all $j,h \in J_{g}$, we have $V_{i,k} C_{2}[M,\widetilde{V}_{i}]= C_{g}[M, \widetilde{V}_{i,k}]$ and $W_{j,h} C_{2}[N,\widetilde{W}_{j}]= C_{g}[N, \widetilde{W}_{j,h}]$.
    If then for every $g$ there is a $\mathbf {W}_{g}$ such that and $\sum _{g} n^{\prime }_{g}=n_{2}$ and
    By the inductive hypothesis on each of the $n^{\prime }_{g}$, we derive
    from which the result follows by $\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}(\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}({\mathcal {R}}))}\,))}\,=\,{{\tt lift}}{(\ge _{{\rm {\tt env}}}({\mathcal {R}}))}\,$.
    We now consider the case when no $C_{1}[M, \widetilde{V}_{i}]$ contributes to the multi-step reduction to $\mathbf {W}$. If there exist some $i$ such that ${C_{2} [M,\widetilde{V}_{i}]}$ contributes to the multi-step reduction to $\mathbf {W}$, then we can derive the result using the same reasoning as above.
    Otherwise, there is a set $I^{\prime } \subseteq I$ such that $C_{1} [M,\widetilde{V}_{i}]$ and $C_{2} [M,\widetilde{V}_{i}]$ are values for every $i \in I^{\prime }$, and
    with $n_{1}\le n+1$ and $n_{2} \le n$.
    Suppose that $C_{1}[N,\widetilde{W}_{j}] = \lambda x. Q_{j}$ is a value, for all $j$, and $C_{2}[N,\widetilde{W}_{j}]$ is a value. Then,
    Since ${\mathcal {R}}$ is saturated by approximants,
    \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}_{i}} \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}, \]
    which implies, by Lemma 63, that one of the following holds:
    • there is a context $C^{\prime }$ such that
      and
      Then, we can apply the inductive hypothesis on the reduction
      and derive the result.
    • for any $\mathbf {W}^{\prime }$, if , then
      Then, we have
      and the result follows by $\ge _{{\rm {\tt env}}}{\,{{\tt lift}}{({\mathcal {R}})}\,} \subseteq \,{{\tt lift}}{(\ge _{{\rm {\tt env}}}({\mathcal {R}}))}\,$.
    It remains to consider the case when $C_{1}[N,\widetilde{W}_{j}]$ or $C_{2}[N,\widetilde{W}_{j}]$ are not values for some $j$. If $C_{1}[N,\widetilde{W}_{j}]$ is not a value for some $j,$ then $C_{1}=[\cdot ]_{1}$ and $N$ is not a value. Suppose $C_{2}[N,\widetilde{W}_{j}]$ is a value for all $j$. Then, we have
    for . Since ${\mathcal {R}}$ is a finite-step simulation saturated by approximants, by clause (2g), we derive
    \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i}, \lambda x. P_{i}} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j \in J^{\prime },h}{q_{j,h}};{t_{j,h};\widetilde{W}^{\prime }_{j},\lambda x. Q_{j,h} }, \]
    which implies
    \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}_{i}, \lambda x. P_{i}} \,{{\tt lift}}{\big(\!\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\!\big)}\, \sum _{j \in J^{\prime },h}{q_{j,h}};{t_{j,h};\widetilde{W}_{j},\lambda x. Q_{j,h} }. \]
    Then,
    \[ \left( \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}_{i}, \lambda x. P_{i}} , \sum _{j \in J^{\prime },h}{q_{j,h}};{t_{j,h};\widetilde{W}_{j},\lambda x. Q_{j,h} }\right) \le _{{\tt lift}}\lbrace (\mathbf {Y}_{g}, \mathbf {Z}_{g})\rbrace _{g} \subseteq \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}, \]
    with $\mathbf {Y}_{g}= \sum _{i\in I_{g}}{p^{\prime }_{i}};{s_{i} ;\widetilde{V}_{i}, \lambda x. P_{i}}$ and $\mathbf {Z}_{g}= \sum _{j,h\in J_{g}}{q^{\prime }_{j,h}};{t_{j,h};\widetilde{W}_{j},\lambda x. Q_{j,h}},$ such that for every $g$, we have
    \[ \sum _{i\in I_{g}}{p^{\prime }_{i}};{ s_{i} ;\widetilde{V}_{i}, \lambda x. P_{i}};{\lambda x. P_{i} C_{2}[M,\widetilde{V}_{i}]} \]
    and
    \[ \sum _{j,h\in J_{g}}{q^{\prime }_{j,h}};{ t_{j,h};\widetilde{W}_{j},\lambda x. Q_{j,h}};{\lambda x. Q_{j,h} C_{2}[N,\widetilde{W}_{j}],} \]
    which satisfy the premises of Lemma 63. Then, we can proceed as in the previous case and derive that implies
    from which the result follows.
    Finally, if there are some $j$ such that $C_{2}[N,\widetilde{W}_{j}]$ is not a value, then we can proceed as in the previous case, exploiting clause (2g) on ${\mathcal {R}}_{(M,N)}$ to evaluate $N$ in argument position as well.
  • case $C=! C^{\prime }$.
    The interesting case is when $C^{\prime }[M,\widetilde{V}_{i}]$ does not contribute to the reduction, for every $i$ (otherwise, we can apply the inductive hypothesis analogously to the application case), i.e., there is a subset $I^{\prime } \subseteq I$, such that
    \[ \sum _{i \in I^{\prime }}{p_{i}};{ s_{i} ;\widetilde{V}_{i}};{!C^{\prime }[M,\widetilde{V}_{i}]}= \sum _{i \in I^{\prime }}{p_{i}};{ s_{i} ;\widetilde{V}_{i}};{!l_{i}} \Longrightarrow _{n+1} \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}_{i},s_{i}(l_{i}).} \]

    Since ${\mathcal {R}}$ is saturated by approximants, $ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i}} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$.
    Since contexts are location-free, there are two cases:
    • $C^{\prime }[M,\widetilde{V}_{i}] \in \widetilde{V}^{\prime }_{i}$. Then, $C^{\prime }[N,\widetilde{W}_{j}]=l^{\prime }_{j} \in \widetilde{W}^{\prime }_{j}$ and by clause (2c) on ${\mathcal {R}}$, we have
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i}, s_{i}(l_{i})} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}, t_{i}(l^{\prime }_{j}),} \]
      and the result follows from

    • $C=[\cdot ]_{1}$ and $M=l$.
      Suppose that $N=l^{\prime }$. Then by clause (2g), we have
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i},M} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}, N,} \]
      and by clause (2c)
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i},M, s_{i}(l_{i})} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}, N, t_{j}(l^{\prime }_{j}).} \]
      Then,
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}_{i}, s_{i}(l_{i})} \,{{\tt lift}}{\big(\!\ge _{{\rm {\tt env}}}\big(\!\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\!\big)\big)}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}, t_{j}(l^{\prime }_{j}).} \]
      The case when $N$ is not a value follows analogously.
  • $C=C_{1}:=C_{2}$.
    Again, the interesting case is when for every $i$ neither $C_{1}[M,\widetilde{V}_{i}]$ nor $C_{2}[M,\widetilde{V}_{i}]$ contributes to the reduction, i.e., there is a subset $I \subseteq I^{\prime }$ such that

    As above, since ${\mathcal {R}}$ is saturated by approximants, $ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i}} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ and, since contexts are location-free, there are two cases:
    • $C_{1}[M,\widetilde{V}_{i}] \in \widetilde{V}^{\prime }_{i}$. Then $C_{1}[N,\widetilde{W}_{j}]=l^{\prime }_{j} \in \widetilde{W}^{\prime }_{j}$. Suppose that $C_{2}[N,\widetilde{W}_{j}]=U_{j}$ is a value for every $j$. Then $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace M,\widetilde{V}^{\prime }_{i}\rbrace _{i}, \lbrace N,\widetilde{W}^{\prime }_{j}\rbrace _{j})^{\widehat{\star }}$ and by clause (2c) on ${\mathcal {R}}$, we have
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i}[l_{i} \rightarrow T_{i}];\widetilde{V}^{\prime }_{i}} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j}[l^{\prime }_{j} \rightarrow U_{j}];\widetilde{W}^{\prime }_{j}}, \]
      and the result follows.
      If $C_{2}[N,\widetilde{W}_{j}]$ is not a value for some $j,$ then $C_{2}[M,\widetilde{V}_{j}]=M$ and $C_{2}[N,\widetilde{W}_{j}]=N$. Then, we derive from clause (2g) that
      and we can derive, as in the previous case, that
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i}[l_{i} \rightarrow M];\widetilde{V}^{\prime }_{i},M} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j,h}{q_{j}};{t_{j}[l^{\prime }_{j} \rightarrow U_{j,h}];\widetilde{W}^{\prime }_{j},U_{j,h}}, \]
      from which the result follows.
    • $C=[\cdot ]_{1}$ and $M=l$.
      Suppose that $N=l^{\prime }$ and $C_{2}[N,\widetilde{W}_{j}]=U_{j}$ is a value for every $j$. Then, $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace M,\widetilde{V}^{\prime }_{i}\rbrace _{i}, \lbrace N,\widetilde{W}^{\prime }_{j}\rbrace _{j})^{\widehat{\star }}$. Then by clause (2g), we have
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i} ;\widetilde{V}^{\prime }_{i},M} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}, N,} \]
      and by clause (2c) on ${\mathcal {R}}$, we have
      \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i}[l \rightarrow T_{i}];\widetilde{V}^{\prime }_{i},M} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j}[l^{\prime } \rightarrow U_{j}];\widetilde{W}^{\prime }_{j},N,} \]
      and the result follows.
      If $N$ or $C_{2}[N,\widetilde{W}_{j}]$ are not values, then we proceed analogously to the previous cases, by proving that we can add to the environment the values they evaluate to while staying in relation $\mathrel {{\mathcal {R}}_{(M,N)}}$.
  • $C=({\boldsymbol \nu } \,x\:{:=} C_{1}) {C_{2}}$, with $C_{2}$ a context with free variable $x$.
    We consider the case when
    and $C_{1}[M,\widetilde{V}_{i}]=U_{j}$ is a value for every $j$, thus
    for $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace M,\widetilde{V}^{\prime }_{i}\rbrace _{i}, \lbrace N,\widetilde{W}^{\prime }_{j}\rbrace _{j})^{\widehat{\star }}$ and for locations $(\lbrace l_{i}\rbrace _{i}, \lbrace k_{j}\rbrace _{j}),$ which are $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$-fresh. By clauses (2d) and (2c), we have
    \[ \sum _{i \in I^{\prime }}{p_{i}};{s_{i}[l_{i} \rightarrow T_{i}];\widetilde{V}^{\prime }_{i},l_{i}} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j}[k_{j} \rightarrow U_{j}];\widetilde{W}^{\prime }_{j},k_{j}}, \]
    which implies
    Then the result follows from the inductive hypothesis on $n_{2}$.
  • case $C=\:{{\rm {\tt if}}}\:\ C_{1}\ \:{{\rm {\tt then}}}\:\ C_{2}\ \:{{\rm {\tt else}}}\:\ C_{3}$ and case $C={\tt op}(C_{1}, \ldots ,C_m)$.
    The result follows from the fact that $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$ satisfies clause (2e) for constants and then from the inductive hypothesis.
  • $C=(C_{1},\ldots,C_{m})$.
    Since the multi-step reduction to $\mathbf {W}$ has length strictly greater than one, there is some $z$ such that $1 \le z \le m$ and some $i$ such that $C_{z}[M,\widetilde{V}_{i}]$ contributes to the multi-step reduction to $\mathbf {W}$. Then, we can apply the inductive hypothesis on the contexts to $C_{z}$ and derive that
    for $n^{\prime } \le n+1$ implies
    i.e.,
    \[ \left( \sum _{i \in I^{\prime },k}{p_{i,k}};{s_{i,k} ;\widetilde{V}_{i},V_{i,k}}, \sum _{j \in J^{\prime },h}{q_{j,h}};{t_{j,h};\widetilde{W}_{j},W_{j,h} }\right) \le _{{\tt lift}}\le _{{\rm {\tt env}}}\lbrace (\mathbf {Y}_{g}, \mathbf {Z}_{g})\rbrace _{g} \subseteq \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}, \]
    with $\mathbf {Y}_{g}= \sum _{i,k \in I_{g}}{p^{\prime }_{i,k}};{s_{i,k} ;\widetilde{V}_{i,k}}$ and $\mathbf {Z}_{g}= \sum _{j,h \in J_{g}}{q^{\prime }_{j,h}};{t_{j,h};\widetilde{W}_{j,h}},$ and for every $g$ there is a context $C_{g}$ such that for every $i,k \in I_{g}$ and $j,h \in J_{g}$:
    (where the substitution only concerns the specific instance of $C_{z}[M,\widetilde{V}_{i}]$ in $C_{z}[M,\widetilde{V}_{i}]$ that occurs as the $z$th element of the tuple $C[M,\widetilde{V}_{i}]$, and the same for $C_{z}[N,\widetilde{W}_{i}]$). Finally, we derive the result by applying the inductive hypothesis on the number of reductions from
    \[ \sum _{i,k \in I_{g}}{p^{\prime }_{i,k}};{ s_{i,k} ;\widetilde{V}_{i,k}};{C_{g}[M,\widetilde{V}_{i,k}]}. \]

  • $C= \#_{z}(C^{\prime })$.
    We consider the case when $C^{\prime }[M,\widetilde{V}_{i}]=(V_{i,1},\ldots,V_{i,m})$ is a value for every $i$ and
    \[ \begin{array}{l} \displaystyle\sum _{i \in I}{p_{i}};{ s_{i} ;\widetilde{V}_{i}};{\#_{z}(C^{\prime }[M,\widetilde{V}_{i}])} \longrightarrow \mathbf {W}= \displaystyle\sum _{i \in I}{p_{i}};{s_{i} ;\widetilde{V}_{i},V_{i,z}}. \end{array} \]
    We have three cases:
    • $C^{\prime }[M,\widetilde{V}_{i}]=(V_{i,1},\ldots,V_{i,m}) \in \widetilde{V}^{\prime }_{i}$.
      Then $C^{\prime }[N,\widetilde{W}_{j}]=(U_{j,1},\ldots,U_{j,m})\in \widetilde{W}^{\prime }_{j}$, and we have, by clause (2f) on ${\mathcal {R}}$,
      \[ \sum _{i }{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}, V_{i,1},\ldots,V_{i,m}} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}, U_{j,1},\ldots,U_{j,m} }. \]
      Therefore,

    • $C^{\prime }[M,\widetilde{V}_{i}]=(C_{1}[M,\widetilde{V}_{i}],\ldots, C_{m}[M,\widetilde{V}_{i}])$ and $C^{\prime }[N,\widetilde{W}_{j}]=(C_{1}[N,\widetilde{W}_{j}],\ldots, C_{m}[N,\widetilde{W}_{j}])$.
      The result directly follows from the definition of the preorder $\le _{{\rm {\tt cce}}(M,N)}$.
    • $C^{\prime }=[\cdot ]_{1}$.
      The result follows from clauses (2g) and (2f) for ${\mathcal {R}}$.

Suppose that $\mathrel {{\mathcal {R}}_{(M,N)}}$ is a finite-step $\lbrace \widetilde{l}\rbrace$-simulation saturated by approximants (only defined on formal sums), and that $C$ is a context with locations in $\lbrace \widetilde{l}\rbrace$. The following relation satisfies the clauses on formal sums for finite-step simulations up-to lifting and environment:

\[ \begin{array}{ll}\mathrel {\mathcal {S}}\, \stackrel{{{{\rm {\tt def}}}}}{=}\big\lbrace ((C[M] ,C[N]), \mathbf {Y}, \mathbf {Z}) \,\mid \,\mathbf {Y}\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\mathbf {Z}\big\rbrace . \end{array} \]

We can assume that the relation $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed by $\lbrace \widetilde{l}\rbrace$ , i.e., each location $l \in \lbrace \widetilde{l}\rbrace$ occurs in corresponding columns in the dynamic environment of the formal sums (formally: for any $\mathbf {Y},\mathbf {Z}$ in the relation and for every $l \in \lbrace \widetilde{l}\rbrace$ there is an index $r$, for $ 1\le r \le |\mathbf {Y}|$, such that both and are tuples composed by location $l$). This assumption simplifies our proof, while not affecting the results. Indeed, we can eliminate all the pairs that do not satisfy the requirement of $\lbrace \widetilde{l}\rbrace$-closure, and we still have a finite-step $\lbrace \widetilde{l}\rbrace$-simulation saturated by approximants.

The proof exploits the fact that if $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed by $\lbrace \widetilde{l}\rbrace ,$ then $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$ is closed by $\lbrace \widetilde{l}\rbrace$ and, for any $C$ such that ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace$, if it holds that $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}$ and $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $ (\lbrace C[M],\widetilde{V}_{i}\rbrace _{i}, \lbrace C[N],\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, then $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $ (\lbrace M,\widetilde{V}_{i}\rbrace _{i}, \lbrace N,\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, since the locations in $\lbrace \widetilde{l}\rbrace$ are guaranteed to occur at corresponding columns in $\lbrace \widetilde{V}_{i}\rbrace _{i}$ and $\lbrace \widetilde{W}_{j}\rbrace _{j}$ and then $C$ can be turned into a location-free context.

The condition (2a) on the weights is immediately satisfied by the definition of $\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$, since ${\mathcal {R}}$ is a simulation.

Then, we prove that the conditions from (2b) to (2g) of finite-step simulation up-to lifting and environment are satisfied by ${\mathcal {S}}$. Suppose that $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i}} \mathrel {{\mathcal {S}}_{(C[M],C[N])}} \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j}}=\mathbf {Z}$ with $\mathbf {Y}^{\prime }= \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}} , \mathbf {Z}^{\prime }= \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}}$ related by $\mathrel {{\mathcal {R}}_{(M,N)}}$ and such that $(\mathbf {Y}^{\prime },\mathbf {Z}^{\prime }) \le _{{\rm {\tt cce}}(M,N)}(\mathbf {Y},\mathbf {Z})$.

  • for all $r$, if $(\widetilde{V}_{i})_{r}= \lambda x. M_{i}$ and $(\widetilde{W}_{j})_{r}=\lambda x. N_{j}$ then
    for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $ (\lbrace C[M],\widetilde{V}_{i}\rbrace _{i}, \lbrace C[N],\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
    if then

    We have three cases:

    • if $(\widetilde{V}_{i})_{r}= \lambda x. C^{\prime }[M, \widetilde{V}^{\prime }_{i}]$ and $(\widetilde{W}_{j})_{r}=\lambda x. C^{\prime }[N, \widetilde{W}^{\prime }_{j}]$ for some location-free context $C^{\prime }$ then, since $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed with respect to $\widetilde{l}$, there is a location-free context $C^{\prime \prime }$ such that
      and we derive the result by Lemma 64.
    • if $(\widetilde{V}_{i})_{r}= (\widetilde{V}^{\prime }_{i})_{r^{\prime }}$ and $(\widetilde{W}_{j})_{r}=(\widetilde{W}^{\prime }_{j})_{r^{\prime }}$ for some $r^{\prime }$, then, since $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed with respect to $\widetilde{l}$, there is a location-free context $C^{\prime \prime }$ such that
      Since $\mathrel {{\mathcal {R}}_{(M,N)}}$ is a finite-step simulation,
      implies , which in turn implies the result analogously to Lemma 63.
    • if $(\widetilde{V}_{i})_{r}= M$ and $(\widetilde{W}_{j})_{r}= N,$ then $M$ and $N$ are values, and by clause (2g) applied to $\mathrel {{\mathcal {R}}_{(M,N)}}$, we have
      \[ \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}, M} \,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}, N.} \]
      Hence, by clause (2b) applied to $\mathrel {{\mathcal {R}}_{(M,N)}}$, we have
      which implies , which in turn implies the result (see the proof of Lemma 63).


  • for all $r$, if $(\widetilde{V}_{i})_{r}= l_{i}$ and $(\widetilde{W}_{j})_{r}= k_{j}$ then
    • $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},s_{i}(l_{i})}\,{{\tt lift}}{(\mathrel {{\mathcal {S}}_{(C[M],C[N])}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},t_{j}(k_{j})}$,
    • for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace C[M],\widetilde{V}_{i}\rbrace _{i}, \lbrace C[N],\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$, we have
      \[ { \sum _{i}{p_{i}};{{s_{i}} [ {l_{i}} \rightarrow {T_{i}}];\widetilde{V}_{i}}} \mathrel {{\mathcal {S}}_{(C[M],C[N])}} { \sum _{j}{q_{j}};{{t_{j}} [ {k_{j}} \rightarrow {U_{j}}];\widetilde{W}_{j}}}\, . \]


    Since contexts used in $\le _{{\rm {\tt cce}}(M,N)}$ are location-free and $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed with respect to the locations in $\widetilde{l}$ (and thereby the locations in $C[M],C[N]$ are in the dynamic environment of the formal sums in $\mathrel {{\mathcal {R}}_{(M,N)}}$ in corresponding columns), there is $r^{\prime }$ such that $(\widetilde{V}^{\prime }_{i})_{r^{\prime }}=l_{i}$ and $(\widetilde{W}^{\prime }_{j})_{r^{\prime }}=k_{j}$, then:

    • $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i},s_{i}(l_{i})}\,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j},t_{j}(k_{j})},$ and we have
      \[ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},s_{i}(l_{i})}\,{{\tt lift}}{\big(\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\big)}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},t_{j}(k_{j})}, \]
      from which the result follows.
    • by $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j}) \in (\lbrace M,\widetilde{V}^{\prime }_{i}\rbrace _{i}, \lbrace N,\widetilde{W}^{\prime }_{j}\rbrace _{j})^{\widehat{\star }}$ we derive
      \[ { \sum _{i}{p_{i}};{{s_{i}} [ {l_{i}} \rightarrow {T_{i}}];\widetilde{V}^{\prime }_{i}}} \mathrel {{\mathcal {R}}_{(M,N)}} { \sum _{j}{q_{j}};{{t_{j}} [ {k_{j}} \rightarrow {U_{j}}];\widetilde{W}^{\prime }_{j}}}\,, \]
      which implies


  • for any $(\lbrace s_{i}\rbrace _{i}, \lbrace t_{j}\rbrace _{j})$-fresh locations $(\lbrace l_{i}\rbrace _{i}, \lbrace k_{j}\rbrace _{j})$,
    and for all $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $ (\lbrace C[M],\widetilde{V}_{i}\rbrace _{i}, \lbrace C[N],\widetilde{W}_{j}\rbrace _{j})^{\widehat{\star }}$,
    \[ \sum _{i}{p_{i}};{{s_{i}} [ {l_{i}} \rightarrow {T_i}];\widetilde{V}_{i}, l_{i}} \mathrel {{\mathcal {S}}_{(C[M],C[N])}} \sum _{j}{q_{j}};{{t_{j}} [ {k_{j}} \rightarrow {U_j}];\widetilde{W}_{j}, k_{j}}. \]

    The result follows from $(\lbrace T_{i}\rbrace _{i}, \lbrace U_{j}\rbrace _{j})$ $\in$ $(\lbrace M,\widetilde{V}^{\prime }_{i}\rbrace _{i}, \lbrace N,\widetilde{W}^{\prime }_{j}\rbrace _{j})^{\widehat{\star }}$ as in the previous clause, by exploiting clause () on ${\mathcal {R}}$.


  • for all $r$, if $(\widetilde{V}_{i})_{r}= c_{i}$ and $(\widetilde{W}_{j})_{r}= c_{j}$ then all constants in the two columns are the same (i.e., there is $c_a$ with $c_i=c_j=c_a$ for all $i,j$).

    For every $r$, there are three cases: either and for some $r^{\prime }$, in which case both columns are composed by the same constant, since ${\mathcal {R}}$ is a finite-step simulation; or the value-context is a constant and ; or the constants are, respectively, $M$ and $N$, in which case

    \[ \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}},{M}\,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}},{N} \]
    (by clause (2g)) and thus they have to be the same constant, otherwise ${\mathcal {R}}$ would not respect condition (2e).


  • for all $r$, if $(\widetilde{V}_{i})_{r}=(V_{i,1},\ldots, V_{i,n})$ and $(\widetilde{W}_{j})_{r}=(W_{j,1},\ldots,W_{j,n})$ then
    \[ \begin{array}{lc} \displaystyle \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},V_{i,1},\ldots, V_{i,n}} \,{{\tt lift}}{(\mathrel {{\mathcal {S}}_{(C[M],C[N])}})}\, \displaystyle\sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},W_{j,1},\ldots,W_{j,n}}. \end{array} \]

    If and for some $r^{\prime },$ then it follows from the definition of ${\mathcal {R}}$ that

    \[ \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},V_{i,1},\ldots, V_{i,n}} \,{{\tt lift}}{(\mathrel {{\mathcal {S}}_{(C[M],C[N])}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},W_{j,1},\ldots,W_{j,n}}. \]
    Otherwise, for every $1 \le h \le n$, we have $(\lbrace V_{i,h}\rbrace _{i}, \lbrace U_{j,h}\rbrace _{j}) \in (\lbrace M,\widetilde{V}^{\prime }_{i}\rbrace _{i}, \lbrace N,\widetilde{W}^{\prime }_{j}\rbrace _{j})^{\widehat{\star }}$, which implies
    \[ (\mathbf {Y}^{\prime },\mathbf {Z}^{\prime }) \le _{{\rm {\tt cce}}(M,N)}\left( \sum _{i}{p_{i}};{s_{i};\widetilde{V}_{i},V_{i,1},\ldots, V_{i,n}}, \sum _{j}{q_{j}};{t_{j};\widetilde{W}_{j},W_{j,1},\ldots,W_{j,n}}\right), \]
    i.e., the formal sums are in relation $\,{{\tt lift}}{(\mathrel {{\mathcal {S}}_{(C[M],C[N])}})}$.

    Finally, if $(\widetilde{V}_{i})_{r}=M$ and $(\widetilde{W}_{j})_{r}=N,$ then the clause follows as in the previous cases from $ \sum _{i}{p_{i}};{s_{i};\widetilde{V}^{\prime }_{i}},{M}\,{{\tt lift}}{(\mathrel {{\mathcal {R}}_{(M,N)}})}\, \sum _{j}{q_{j}};{t_{j};\widetilde{W}^{\prime }_{j}},{N}$, by clause ().


  • .

    Since $\mathrel {{\mathcal {R}}_{(M,N)}}$ is closed with respect to $\widetilde{l}$, there is a location-free context $C^{\prime }$ such that

    \[ \begin{array}{l}\mathbf {Y} ; C[M]= \mathbf {Y} ; C^{\prime }[M,\mathbf {Y}],\\ \mathbf {Z} ; C[N]= \mathbf {Z} ; C^{\prime }[N,\mathbf {Z}], \end{array} \]
    and the result follows from Lemma 64.


We can now derive from Lemma 65 the congruence result. Let $C$ be a context such that ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace$. Let ${\mathcal {R}}$ be a finite-step $\lbrace \widetilde{l}\rbrace$-simulation such that $\langle s \,;\,M\rangle \mathrel {\mathcal {R}}\langle t \,;\,N\rangle$. Then the relation

\[ \left\lbrace (\langle s \,;\,C[M]\rangle , \langle t \,;\,C[N]\rangle)\rbrace \cup \lbrace ((C[M],C[N]), \mathbf {Y},\mathbf {Z}) |\, \mathbf {Y}\mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}\mathbf {Y}\right\rbrace \]
is a finite step simulation up-to lifting and environment, since:
  • clause (1) on terms follows, since ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace$ and by clause (1) for ${\mathcal {R}}$, we have $({1};{s;\widetilde{l}}, {1};{t;\widetilde{l}}) \in {\mathrel {{\mathcal {R}}_{(M,N)}}} \subseteq \mathrel {\mathcal {R}_{(M,N)}^{{\rm {\tt cce}}}}$;
  • the clauses for formal sums follow by Lemma 65.

Proof of Theorem 53

Let $\widetilde{l}^{\prime }=\widetilde{l}, \widetilde{l}^{\prime \prime }$ and let $\widetilde{V}^{\prime }=\widetilde{V}, \widetilde{V}^{\prime \prime }$ be a sequence of values whose types are consistent with those of $\widetilde{l}^{\prime }$ and with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$. Let $C$ be a context with locations in $\lbrace \widetilde{l}^{\prime }\rbrace$ and let ${\mathcal {R}}$ be a finite-step $\lbrace \widetilde{l}\rbrace$-simulation (saturated by approximants) relating $\langle s \,;\,M\rangle$ and $\langle t \,;\,N\rangle$. Then ${1};{s;\widetilde{l}} \mathrel {{\mathcal {R}}_{(M,N)}} {1};{t;\widetilde{l}}$ and by repeatedly applying clause (2d), we derive

\[ {1};{s[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{W}];\widetilde{l}^{\prime }} \mathrel {{\mathcal {R}}_{(M,N)}} {1};{t[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{W}];\widetilde{l}^{\prime }}, \]
for a consistent sequence of values $\widetilde{W}$. (Note that we cannot guarantee by just using clause (2d) that the tuple of values $\widetilde{V}^{\prime \prime }$ is assigned to $\widetilde{l}^{\prime \prime }$, since locations in $\widetilde{l}^{\prime \prime }$ might occur in any value in $\widetilde{V}^{\prime \prime }$. Hence, we first have to put all the locations in $\lbrace \widetilde{l}^{\prime \prime }\rbrace$ in the dynamic environment.) Then by repeatedly applying clause (2c), we derive
\[ {1};{s[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{V}^{\prime \prime }];\widetilde{l}^{\prime }} \mathrel {{\mathcal {R}}_{(M,N)}} {1};{t[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{V}^{\prime \prime }];\widetilde{l}^{\prime }}\,. \]
It is easy to see that if we restrict ${\mathcal {R}}_{(M,N)}$ to those pairs of formal sums whose dynamic environments begin with the sequence $\widetilde{l}^{\prime }$ of locations, then the clauses of finite-step $\lbrace \widetilde{l}^{\prime }\rbrace$-simulation are satisfied. Let ${\mathcal {R}}^{\prime }_{(M,N)}$ be such a restriction of ${\mathcal {R}}_{(M,N)}$. Then, we can apply Lemma 65 (see the proof of Theorem 52) and derive that relation
\[ \begin{array}{ll}\mathrel {\mathcal {S}}\stackrel{{{{\rm {\tt def}}}}}{=}\lbrace ((C[M] ,C[N]), \mathbf {Y}, \mathbf {Z}) \,\mid \,\mathbf {Y}\mathrel {\mathcal {R^{\prime }}_{(M,N)}^{{\rm {\tt cce}}}} \mathbf {Z}\rbrace \end{array} \]
is a finite-step $\lbrace \widetilde{l}^{\prime }\rbrace$-simulation (up-to lifting and environment). Since
\[ ({1};{s[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{V}^{\prime \prime }];\widetilde{l}^{\prime }}, {1};{t[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{V}^{\prime \prime }];\widetilde{l}^{\prime }}) \in {\mathcal {R}}^{\prime }_{(M,N)} \subseteq \mathcal {R^{\prime }}_{(M,N)}^{{\rm {\tt cce}}} = \,\mathrel {\mathcal {S}}_{(C[M],C[N])}, \]
we conclude .

Finally, by repeatedly applying clause (2c) to locations $\widetilde{l}$ in the pair

\[ {1};{s[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{V}^{\prime \prime }];\widetilde{l}^{\prime }} \mathrel {\mathcal {S}}_{(C[M],C[N])} {1};{t[\widetilde{l}^{\prime \prime } \rightarrow \widetilde{V}^{\prime \prime }];\widetilde{l}^{\prime }}, \]
we derive
\[ {1};{\widetilde{l}^{\prime } = \widetilde{V}^{\prime };\widetilde{l}^{\prime }} \mathrel {\mathcal {S}}_{(C[M],C[N])} {1};{\widetilde{l}^{\prime } = \widetilde{V}^{\prime };\widetilde{l}^{\prime }}, \]
which in turn implies .

Proof of Theorem 55

We prove that the relation

satisfies the clauses of $\lbrace \widetilde{l}\rbrace$-simulation. Let $\widetilde{l}=l_{1},\ldots.l_{n}= {\tt Loc}(M) \cup {\tt Loc}(N)$ and $\langle \widetilde{l} = \widetilde{V} \,;\,M\rangle \mathrel {\mathcal {R}}\langle \widetilde{l} = \widetilde{V} \,;\,N\rangle$. Hence, $M \le _{{\rm {\tt ctx}}}N$ and clause (1) holds, since, using context $C= \lambda x. x l_{1} \ldots l_{n}$ (with no holes), we derive from ${M} \le _{{\rm {\tt ctx}}}{N}$ that ${1};{\widetilde{l} = \widetilde{V};l_{1}, \ldots ,l_{n}} \mathrel {{\mathcal {R}}_{(M,N)}} {1};{\widetilde{l} = \widetilde{V}; l_{1}, \ldots ,l_{n}}$.

To prove that ${\mathcal {R}}$ satisfies the clauses of simulation for formal sums, we first show the following lemma.

If $\mathbf {Y}\mathrel {{\mathcal {R}}_{(M,N)}}\mathbf {Z},$ then for any $C$ with ${\tt Loc}(C) \subseteq {\tt Loc}(M) \cup {\tt Loc}(N)$:

  • If and are first-order consistent, then

  • If and are not first-order consistent, then

If $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};V^{i}_{1},\ldots,V^{i}_{n}}\mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};W^{j}_{1},\ldots,W^{j}_{n}}=\mathbf {Z},$ then they are first-order consistent environment formal sums and there are $C,s$ such that and and ${\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace = {\tt Loc}(M) \cup {\tt Loc}(N)$.

Let $C^{\prime }$ be any context with $ {\tt Loc}(C) \subseteq \lbrace \widetilde{l}\rbrace ={\tt Loc}(M) \cup {\tt Loc}(N)$ and let

\[ P_{M,C^{\prime }}=\lambda x_{1},\ldots,x_{n}.(\lambda z, x. x x_{1} \ldots x_{n} z) C^{\prime }[M,x_{1},\ldots,x_{n}] \]
and $P_{N,C^{\prime }}$ the same term with $M$ substituted to $N$. It follows from $M \le _{{\rm {\tt ctx}}}N$ that $C[M] P_{M,C^{\prime }} \le _{{\rm {\tt ctx}}}C[N] P_{N,C^{\prime }}$.

We have

for and analogously for $N$:
for .

If and are first-order consistent, then we can conclude, by the definition of $\, \mathcal {R}$, that

If and are not first-order consistent, which means that the dynamic environment is composed of different constants, then for any constant $c$, we can use the term
\[ P_{M,C^{\prime },c}=\lambda x_{1},\ldots,x_{n}.(\lambda z, x. x x_{1} \ldots x_{n} z) \:{{\rm {\tt if}}}\:\ C^{\prime }[M,x_{1},\ldots,x_{n}]=c\ \:{{\rm {\tt then}}}\:\ c\ \:{{\rm {\tt else}}}\:\ \Omega \]
to derive, analogously as above, that
\[ \sum _{\lbrace i,k| V_{i,k}=c \rbrace }{p_{i,k}};{s_{i,k};V^{i}_{1},\ldots,V^{i}_{n},V_{i,k}} \mathrel {{\mathcal {R}}_{(M,N)}} \sum _{\lbrace j,h| W_{j,h}=c\rbrace }{q_{j,h}};{t_{j,h};W^{j}_{1},\ldots,W^{j}_{n},W_{j,h}}, \]
and thus

Let $\mathbf {Y}= \sum _{i}{p_{i}};{s_{i};V^{i}_{1},\ldots,V^{i}_{n}}\mathrel {{\mathcal {R}}_{(M,N)}} \sum _{j}{q_{j}};{t_{j};W^{j}_{1},\ldots,W^{j}_{n}}=\mathbf {Z}$ be first-order consistent environment formal sums and let $C,s$ be such that and . We can now prove that ${\mathcal {R}}$ satisfies the simulation clauses on formal sums.

  • It follows from the definition of $\le _{{\rm {\tt ctx}}}$ that $M \le _{{\rm {\tt ctx}}}N$ implies $C[M] \le _{{\rm {\tt ctx}}}C[N]$, which implies .
  • Let $V^{i}_{r}= \lambda x. M_{i}$ and $W^{j}_{r}=\lambda x. N_{j}$. The result follows from Lemma 66, using context $C=[\cdot ]_{r+1} C^{\prime }$, for any value context $C^{\prime }$.
  • Let $V^{i}_{r}= l_{i}$ and $W^{j}_{r}= k_{j}$. The result follows from Lemma 66, respectively, using contexts $C_{1}=![\cdot ]_{r+1}$ and $C_{2}=[\cdot ]_{r+1}:=C^{\prime }$, for any value context $C^{\prime }$. In the latter case, since the formal sums are first-order consistent, we can use directly relation $\mathrel {{\mathcal {R}}_{(M,N)}}$, without the lifting construction (by the first item of Lemma 66).
  • The result follows from the first item of Lemma 66, using context $C= ({\boldsymbol \nu } \,x\:{:=} C_{1}) C_{2}$, for $C_{1}$ a value context and $C_{2}$ a context with free variable $x$.
  • The result directly follows from the definition of ${\mathcal {R}}$.
  • For all $r$, if $V^{i}_{r}=(V_{i,1},\ldots, V_{i,n})$ and $W^{j}_{r}=(W_{j,1},\ldots,W_{j,n}),$ then the result follows by iteratively applying Lemma 66, using contexts $C_{1}=\#_{1}({[\cdot ]}_{r+1}),\ldots, C_{n}=\#_{n}({[\cdot ]}_{r+1})$.
  • The result follows from Lemma 66, using context $C=[\cdot ]_{1}$.

ACKNOWLEDGMENTS

We have benefited from discussions with Raphaëlle Crubillé and Ugo Dal Lago. We are deeply grateful to the reviewers for their detailed reading of the article and their many useful comments and remarks.

REFERENCES

Footnote

This work has been supported by the ERC H2020 project “CoVeCe” (Grant Agreement No. 678157), by the LABEX MILYON (ANR-10-LABX-0070) of Université de Lyon, within the program “Investissements d'Avenir” (ANR-11-IDEX-0007), by the project ANR-16-CE25-0011 “REPAS,” by the project ANR 12IS02001 “PACE,” and by H2020-MSCA-RISE project “Behapi” (ID 778233).

Authors’ addresses: D. Sangiorgi, Dipartimento di Informatica - Scienza e Ingegneria (DISI), Università di Bologna, Mura Anteo Zamboni, 7, 40126 Bologna, Italy; email: davide.sangiorgi@unibo.it; V. Vignudelli, ENS de Lyon, site Monod - LIP, 46 Allée d'Italie, 69007 Lyon, France; email: valeria.vignudelli@ens-lyon.fr.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org.

©2019 Copyright held by the owner/author(s). Publication rights licensed to ACM.
0164-0925/2019/10-ART22 $15.00
DOI: https://doi.org/10.1145/3350618

Publication History: Received July 2017; revised May 2019; accepted June 2019