Hypernet Semantics ofProgramming Languages
byKoko Muroya

A thesis submitted to the University of Birmingham
for the degree of DOCTOR OF PHILOSOPHY

School of Computer Science
College of Engineering and Physical Sciences
University of Birmingham
June 2019

ii

Abstract
Comparison is common practice in programming, even regarding a single programming language. One would ask if two programs behave the same, if one programruns faster than another, or if one run-time system produces the outcome of a program faster than another system. To answer these questions, it is essential to have aformal specification of program execution, with measures such as result and resource
usage.
This thesis proposes a semantical framework based on abstract machines thatenables analysis of program execution cost and direct proof of program equivalence. These abstract machines are inspired by Girard’s Geometry of Interaction,and model program execution as dynamic rewriting of graph representation of a program, guided and controlled by a dedicated object (token) of the graph. The graphrepresentation yields fine control over resource usage, and moreover, the concept of
locality in analysing program execution. As a result, this framework enjoys novel
flexibility, with which various evaluation strategies and language features, whether
they are effects or not, can be modelled and analysed in a uniform way.

iii

iv

Acknowledgements
Throughout three years of studying in Birmingham I had far more opportunities
and experiences than I could have ever imagined, both inside and outside academia.
I owe many of these to my supervisor and friend Dan R. Ghica. I learned a lot frominteractions with him, and he deserves my special thanks for his continuous support
and positivity.
Thanks to Alexandra Silva for the invitation to the Bellairs workshop in March
2018, where the work on Spartan got going, to Nando Sola for giving me a unique
opportunity to present my work to functional programmers in Lambda World Cádiz,
and to David R. Sherratt in Bath for his interest and hospitality.
I am grateful to the members of the ever-growing Birmingham theory group,
especially my thesis group members Paul Levy and Uday Reddy, for giving me thesense of community. Many thanks go to Steven W. T. Cheung and Todd Waugh
Ambridge who have been my good colleagues, collaborators and friends. I am also
grateful to my external examiner, Ugo Dal Lago, for his encouraging comments.
Meeting people has given me motivation during my Ph.D. study. I would especially like to mention Ahmed Al-Ajeli, Dong Li, Yuning Feng and Simon Fong
who enriched my life. Thanks to my friends and family for their help and support,
sometimes all the way from Japan, without which this thesis could have never been
completed.

v

vi

Contents
1 Introduction
1.1

1.2

1.3

1

Context and motivation . . . . . . . . . . . . . . . . . . . . . . . . .

1

1.1.1

Abstract machines for programming languages . . . . . . . . .

1

1.1.2

Comparison between implementations . . . . . . . . . . . . . .

3

1.1.3

Comparison between programs . . . . . . . . . . . . . . . . . .

5Contribution and methodology . . . . . . . . . . . . . . . . . . . . . . 10
1.2.1

Two graph-rewriting abstract machines for reasoning . . . . . 10

1.2.2

Token-passing GoI . . . . . . . . . . . . . . . . . . . . . . . . 11

1.2.3

Interleaving GoI token passing with graph rewriting . . . . . . 13

1.2.4

Rewrites-first interleaving and locality . . . . . . . . . . . . . 14

Thesis outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

2 Efficient implementation of evaluation strategies

19

2.1

Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

2.2

A term calculus with sub-machine semantics . . . . . . . . . . . . . . 21

2.3

The token-guided graph-rewriting machine . . . . . . . . . . . . . . . 25
2.3.1

Graphs with interface . . . . . . . . . . . . . . . . . . . . . . . 25

2.3.2

Node labels and !-boxes . . . . . . . . . . . . . . . . . . . . . 27

2.3.3

Graph states and transitions . . . . . . . . . . . . . . . . . . . 28

2.4

Implementation of evaluation strategies . . . . . . . . . . . . . . . . . 36

2.5

Time-cost analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
vii

viii

CONTENTS

2.6

Rewriting vs. jumping . . . . . . . . . . . . . . . . . . . . . . . . . . 58

3 Focussed graph rewriting for the core calculus Spartan

67

3.1

Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

3.2

The Spartan calculus . . . . . . . . . . . . . . . . . . . . . . . . . . 68

3.3

3.4

3.5

3.2.1

The Spartan type system . . . . . . . . . . . . . . . . . . . . 72

3.2.2

Semantics of bindings: copying vs. sharing . . . . . . . . . . . 72

Overview of focussed graph rewriting . . . . . . . . . . . . . . . . . . 75
3.3.1

Monoidal hypergraphs and hypernets . . . . . . . . . . . . . . 75

3.3.2

Graphical conventions . . . . . . . . . . . . . . . . . . . . . . 78

3.3.3

From terms to hypernets . . . . . . . . . . . . . . . . . . . . . 79

3.3.4

Focussed rewriting . . . . . . . . . . . . . . . . . . . . . . . . 81

Observational equivalence . . . . . . . . . . . . . . . . . . . . . . . . 83
3.4.1

Structural laws . . . . . . . . . . . . . . . . . . . . . . . . . . 85

3.4.2

Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Technical details of focussed graph rewriting . . . . . . . . . . . . . . 91
3.5.1

Auxiliary definitions . . . . . . . . . . . . . . . . . . . . . . . 91

3.5.2

Focussed hypernets . . . . . . . . . . . . . . . . . . . . . . . . 94

3.5.3

Contexts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

3.5.4

States and transitions. . . . . . . . . . . . . . . . . . . . . . 96

4 Robustness and observational equivalence

99

4.1

Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

4.2

Contextual refinement and equivalence . . . . . . . . . . . . . . . . . 101
4.2.1

4.3

Observational equivalences on terms. . . . . . . . . . . . . . 103

A characterisation theorem . . . . . . . . . . . . . . . . . . . . . . . . 104
4.3.1

Determinism and refocusing . . . . . . . . . . . . . . . . . . . 105

4.3.2

Templates and robustness . . . . . . . . . . . . . . . . . . . . 106

4.3.3

Sufficient conditions for robustness . . . . . . . . . . . . . . . 115

CONTENTS

ix

4.4

Proof of the characterisation theorem . . . . . . . . . . . . . . . . . . 116

4.5

Applications of the characterisation theorem . . . . . . . . . . . . . . 130
4.5.1

Properties of compute transitions . . . . . . . . . . . . . . . . 131

4.5.2

Example templates . . . . . . . . . . . . . . . . . . . . . . . . 132

4.5.3

Combining templates . . . . . . . . . . . . . . . . . . . . . . . 137

4.5.4

Local reasoning . . . . . . . . . . . . . . . . . . . . . . . . . . 139

4.5.5

Details of input-safety and robustness proofs . . . . . . . . . . 145

5 Discussion
5.1

5.2

159

Linear-logic concepts, from the DGoIM to the UAM . . . . . . . . . . 159
5.1.1

Box structures . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

5.1.2

Generalised contractions as optimisation . . . . . . . . . . . . 160

5.1.3

Interaction with contractions . . . . . . . . . . . . . . . . . . . 161

Case study: data-flow networks . . . . . . . . . . . . . . . . . . . . . 163
5.2.1

TensorFlow networks . . . . . . . . . . . . . . . . . . . . . 163

5.2.2

Parametrised networks in the DGoIM style . . . . . . . . . . . 165

6 Related and future work

171

6.1

Environments in abstract machines . . . . . . . . . . . . . . . . . . . 171

6.2

Graph rewriting with boxes and token . . . . . . . . . . . . . . . . . 173

6.3

Extrinsic operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

6.4

Observations of program execution . . . . . . . . . . . . . . . . . . . 175

6.5Time and space efficiency

6.6

Improvement and optimisation . . . . . . . . . . . . . . . . . . . . . . 177

6.7

Further directions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177. . . . . . . . . . . . . . . . . . . . . . . . 176

A Technical appendix for Chap. 3

179

A.1 Equivalent definitions of hypernets . . . . . . . . . . . . . . . . . . . 179
A.2 Plugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
A.3 Rooted states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

x

CONTENTS

A.4 Accessible paths and stable hypernets . . . . . . . . . . . . . . . . . . 194
A.5 Parametrised (contextual) refinement andequivalence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
A.6 Proof for Sec. 4.3.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Bibliography

207

Index

219

List of Figures
2.1”Sub-machine” operational semantics . . . . . . . . . . . . . . . . . . 22

2.2

Evaluations of (λx.x) ((λy.y) (λz.z)) . . . . . . . . . . . . . . . . . . 24

2.3

Full (left) and simplified (right) representation of a graph G(3, 1)

2.4

Generators of graphs . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

2.5

Pass transitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

2.6

Rewrite transitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

2.7

Example of rewrite transition →σ . . . . . . . . . . . . . . . . . . . . 33

2.8

Example execution of the DGoIM . . . . . . . . . . . . . . . . . . . . 34

2.9

General form of translations . . . . . . . . . . . . . . . . . . . . . . . 38

. . 262.10 Translation of a term ((λf .λx.f @ (f @ x)) @ (λy.y)) @ (λz.z) . . . . 38
2.11 Inductive translation of terms and answer contexts . . . . . . . . . . 40
2.12 Inductive translation of evaluation contexts . . . . . . . . . . . . . . . 40
2.13 Decompositions of translations . . . . . . . . . . . . . . . . . . . . . . 40
2.14 Illustration of simulation: left-to-right call-by-value application . . . . 48
2.15 Illustration of simulation: call-by-need application and explicit substitutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
2.16 Illustration of simulation: right-to-left call-by-value application . . . . 50
2.17 Passes-only DGoIM for call-by-name [Danos and Regnier, 1996, Mackie,
1995] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
2.18 Passes-only DGoIM plus jumping for call-by-name [Danos and Regnier, 1996] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
xi

xii

LIST OF FIGURES

2.19 Example execution of the jumping machine: exponential growth ofthe environment stack . . . . . . . . . . . . . . . . . . . . . . . . . . 65
3.1

Spartan terms with extrinsic operations (highlighted in magenta) . . 70

3.2

The Spartan type system . . . . . . . . . . . . . . . . . . . . . . . . 73

3.3

Graphical conventions . . . . . . . . . . . . . . . . . . . . . . . . . . 77

3.4

Hypernet semantics of Spartan . . . . . . . . . . . . . . . . . . . . . 80

3.5Interaction rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

3.6

Example execution of the UAM . . . . . . . . . . . . . . . . . . . . . 84

3.7

Beta rewrite rule (G, GS are hypernets) . . . . . . . . . . . . . . . . . 86

3.8

Arithmetic rewrite rule (selected), where m, n, p ∈ N and p = m + n . 88

3.9

Reference creation (GS is a hypernet) . . . . . . . . . . . . . . . . . . 88

3.10 Equality, assignment, and dereferencing rewrite rules (C and C 0 arecontraction trees, and GS is a hypernet) . . . . . . . . . . . . . . . . 88
3.11 Contraction rules, with C a contraction tree, and H a copyable hypernet 96
4.1

Structural pre-templates (C :  ⇒ ? is a contraction tree, H is acopyable hypernet, G is a hypernet, (ρ, ρ0 ) is a box-permutation pair) 132

4.2

Name-exhaustive pre-templates (C is a contraction tree) . . . . . . . 134

4.3

Auxiliary laws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

4.4

A proof outline of the Parametricity 2 law, in the empty environment 140

4.5

Triggers (H is a copyable hypernet, and G is a hypernet) . . . . . . . 146

4.6

A shallow overlap (C is a contraction tree, Bi are box edges) . . . . . 150

4.7

A focussed context (C is a contraction tree) . . . . . . . . . . . . . . 152

List of Tables
2.1

Comparison between rewriting and jumping, case study: space usage
after n transitions from an initial state of a graph G0 . . . . . . . . . 63

4.1

Templates, with their robustness and implied contextual refinements/equivalences ( denotes anything) . . . . . . . . . . . . . . . . . . . . 135

4.2

Dependency of contextual refinements/equivalences on templates . . . 137

4.3

Triggers and their implied contextual refinements/equivalences . . . . 146

4.4

Summary of paths that witness shallow overlaps . . . . . . . . . . . . 151

5.1

Parameters, and their possible representation with name binding . . . 169

xiii

Chapter 1
Introduction

1.1

Context and motivation

1.1.1

Abstract machines for programming languages

Programming languages are for humans to communicate with computers. In thisone-way communication, humans write programs, and computers execute programs.
While the execution of programs is implemented by compilers and interpreters, it isspecified by semantic models. The specification can be in many terms, such as theoutcome, process, and properties, of program execution.
Given a computer program, executing it using one implementation is typicallynot the only concern. Comparison between programs, or between implementations,comes in various forms. One could ask if two programs have the same output, or
if one program has better execution cost than the other. It is desirable to havethe same output of a single program regardless of the choice of implementation, sothat the program is portable. The choice would depend on other measures, such as
execution cost, that can vary between implementations.
The comparison can only be possible if measures like output and execution cost
are formalised, independently of implementation details. What we need is a formal
specification of program execution that works across programs and implementations.
1

2

CHAPTER 1. INTRODUCTION

Abstract machines are the oldest of such formal specification [Landin, 1964].
They model program execution by changing a configuration step-by-step. Each configuration typically consists of a program fragment (code) under evaluation, and somedata structures, such as stacks and lookup tables, that record necessary information
to determine a possible change of the configuration. In loc. cit., the first abstract
machine for the lambda-calculus, called the SECD machine, was introduced. The
machine is named after the four components of the configurations it uses: Stack,Environment, Control and Dump. While the control represents the code under evaluation, the other three components serve as the auxiliary data structures. The stackrecords intermediate results, the environment serves as a lookup table for variables,
and the dump records computations that are to be resumed once the current codeis evaluated.
Using an abstract machine, the whole process of program execution can be obtained as a sequence of configurations, or a history of configuration changes. Thissequence enables us to analyse both the result and the cost of execution. The execution result is represented by the final configuration of the sequence, and the spacecost can be measured using the size of each configuration. The time cost can be
estimated by adding up time usage of configuration changes. If all changes finish
in constant time, the time cost can simply be measured in terms of the number ofchanges. If not, which is often the case, time usage of each configuration change
needs to be estimated. This is possible by examining how much each component,
namely data structure, of the configuration is modified each time.
Abstract machines are deemed “abstract”, and do not immediately yield implementations of program execution such as compilers, because they abstract away
details of computer architectures. At the same time, they are not as abstract asother formal specifications, such as denotational semantics and operational semantics, because they do not abstract away data structures and maintain them explicitly.
This balance lets abstract machines serve as a basis of implementations of program1.1. CONTEXT AND MOTIVATION

3

execution, such as compilers, and provide a cost measure of program execution thatis independent of implementation details.
Abstract machines may be abstract enough to specify execution steps and analyse
execution cost, but they are considered to be too concrete to reason about programs,
as recognised by Plotkin [1981, 2004] in his development of structural operationalsemantics. Programs are structured according to a formal grammar (syntax ), andthe syntactical, structural, information about programs is vital in reasoning. For
example, even the simple notion of program fragment, or sub-program, is syntactical. Comparison between two programs would therefore start with recognising theirsyntactical difference, which is given in terms of sub-programs. Nevertheless, thestructural information is obscured by the use of concrete data structures in abstract
machines. Each data structure captures an aspect of the structural information, if
any, and each modification of a configuration typically concerns only a part of theconfiguration. It is hard to recover the structural information from a sequence ofconfiguration changes, which represents the process of program execution.

1.1.2

Comparison between implementations

There are two main measures of program execution: result and cost. The execution
result is commonly given by a single value that a program returns, but it can beenriched in the presence of certain language features. Interactive I/O equips thereturn value with an entire history of interaction between the program and users,
non-determinism yields multiple possible return values, and probabilistic features
yield a probability distribution of return values. In any case, the result of a single program is supposed to be the same across implementations, which makes the
program portable.
On the other hand, execution cost can vary between implementations, leaving acertain freedom in managing efficiency. One may prefer better space efficiency, or
better time efficiency, and it is well known that one can be traded off for the other.

4

CHAPTER 1. INTRODUCTION

For example, time efficiency can be improved by caching more intermediate results,
which increases space cost, whereas bounding space requires repeating computations,which adds to the time cost.
The execution cost is a key factor in comparison between implementations ofa programming language. Each implementation should have its own specificationof execution cost. Yet we need a way to compare various specifications. To makethis possible, a language should come with a cost measure that is applicable toall implementations. The measure should be concrete enough to be realistic, but
at the same time abstract enough to be independent of implementation details.
Implementations can then be specified and compared uniformly by means of thecost measure.
Although an abstract machine can serve as a basis of implementations and provide a cost measure, its measure cannot necessarily be used for all possible implementations of the language. The main reason is that there is no generic abstract
machine that models all possible implementations. There is no canonical way todesign an abstract machine for a given programming language, and each abstract
machine has its own design choices, and accordingly, its own scope of implementations. Comparison between implementations can be alternatively done by comparing
abstract machines, but these machines come with their own cost measures.
Recent studies by Accattoli and Dal Lago [2016], Accattoli et al. [2014], Accattoli[2017] establish a methodology with which one can compare and classify abstract
machines in terms of their execution cost. They propose a cost measure that iswith respect to evaluation strategies, not to programming languages. Evaluation
strategies can be used to characterise programming languages, but different strategies could yield the same execution result, which means that the characterisation
may not be unique.
In the setting of functional programming, evaluation strategies determine how
an argument of a function is evaluated, and often imply how intermediate results

1.1. CONTEXT AND MOTIVATION

5

are copied, discarded, cached or reused, which affects execution cost. Examples
include call-by-name, call-by-need (or, lazy), and call-by-value evaluation strategies.
In the call-by-name evaluation strategy, evaluation of a function body proceeds until
its arguments are actually required. Each argument gets evaluated as many times
as it is requested. In the call-by-need, or lazy, strategy, computation proceeds inthe same way, but each argument is evaluated at most once. Once an argument isrequested, its evaluation result is cached for later use, preventing re-evaluation of thesame argument. The call-by-value strategy evaluates all arguments first and caches
the results, before evaluating the function body. This means that each argument isevaluated exactly once. The call-by-value strategy can be further classified in termsof the ordering of argument evaluations.
If evaluation of some of the arguments does not terminate, the call-by-value strategy does not terminate, whereas the other two strategies might terminate. These
two strategies could terminate namely when these non-terminating arguments are
not used. If some of the arguments do not have a unique evaluation result, the callby-name and call-by-need strategies could have different overall results. However,in programming languages where evaluation always terminates with a unique result,the choice of strategy should only affect the overall cost, but not the overall result.

1.1.3

Comparison between programs

Orthogonal to the comparison between implementations is comparison between programs. It also requires specification of program execution and formalisation of ameasure of execution, such as measures of result and cost. Programs, or moregenerally program fragments, can be compared with respect to one measure or combination of multiple measures.
One classical question is comparison with respect to execution result, asking
whether two program fragments have the same behaviour. The standard formalisation of this question is given as observational equivalence [Morris Jr, 1969]. Two

6

CHAPTER 1. INTRODUCTION

whole programs are observationally equivalent if their execution yields the same output. Program fragments are observationally equivalent if any two whole programs
whose only difference is these fragments are observationally equivalent.
Another established question, formalised as improvement [Moran and Sands,
1999], is whether one program simulates another program with less resource usage.
This comparison concerns both execution result and cost, and it can be generalised
to program fragments in the same way as observational equivalence.
These questions of observational equivalence and improvement are of interest to
programmers as well as language developers. When programmers update a software,they can make sure there is no regression, i.e. bugs introduced by the update, by
proving that the old and new versions of the software are observationally equivalent.
Observational equivalence can also be used to verify distributed algorithms with respect to their sequential specification. Compilers typically employ series of programtransformations, to turn a source code into an assembly code. Correctness of thesetransformations can be verified using observational equivalence. Moreover, sometransformations are intended to optimise a given program, which can be validated
using improvement.
To prove observational equivalence between program fragments, one needs toinspect all possible contexts, i.e. whole programs without the fragments, and theirinteraction with the fragments throughout execution. As proof methods of observational equivalence, logical relations [Plotkin, 1973, Statman, 1985] enable us toanalyse the interaction in terms of types, and applicative bisimulations [Abramsky,
1990] identify function application as the fundamental interaction between contexts
and fragments.
Alternatively, a specification of program execution itself can be designed by formalising interaction between program components. Game semantics [Abramsky
et al., 2000, Hyland and Ong, 2000] is one example, where programs are interpreted
in terms of possible interactions they can have. It solved the full abstraction prob-

1.1. CONTEXT AND MOTIVATION

7

lem, which is of giving an equivalent interpretation to program fragments if and only
if these fragments are observationally equivalent, firstly for the functional programming language PCF [Plotkin, 1977].
The more features a programming language has, the more problematic it becomesto inspect all possible interactions between contexts and fragments. Extra language
features could enable contexts to distinguish more program fragments, and hence tobreak some existing observational equivalences.
For example, mutable state enables contexts to distinguish some syntactically
identical program fragments. This leads to violation of certain standard observational equivalence, such as the identity law M = M ' true of the equality operation(‘=’), where M is an arbitrary program fragment. In the following two programs,
written in the style of OCaml, a context exploits mutable state and indeed violates
an instance of the identity law: (f ()) = (f ()) ' true, where f is a function definedelsewhere and is applied to the unit value (). The context distinguishes the two
syntactically identical arguments f () of the equality operation.
1
2
3
4
5
6
7

; ; a program t h a t r e t u r n s false
let b = ref true inlet f _ =b := not !b ;!bin
( f ()) = ( f ())

1
2
3
4
5
6
7

; ; a program t h a t r e t u r n s true
let b = ref true inlet f _ =b := not !b ;
!b
in
true
The distinguishing context appears in lines 2–6 of each program. It creates a mutableboolean state b, and provides a definition of the function f . The mutable state canbe accessed through an operation ‘:=’ for updating a stored value, and an operation‘!’ for reading a stored value. Upon each call, whatever the argument is, the function

8

CHAPTER 1. INTRODUCTION

f internally flips the value of the mutable state b (line 4), and returns the flippedvalue (line 5). The context distinguishes the two function calls (f ()), of which thefirst results in false and the second results in true, and therefore, violates theidentity law.
Introduction of new language features could bring extra distinguishing power tocontexts, and therefore, it often requires a reformulation of a formal specification tomodel the distinguishing power as well as the features themselves. The reformulationof a specification further invalidates a proof technique of observational equivalence.
This can be observed in the literature about functional programs in the presence ofeffects, such as state and control.
Since game semantics [Abramsky et al., 2000, Hyland and Ong, 2000] solved
the full abstraction problem for the functional programming language PCF, it wasadapted to accommodate ground state [Abramsky and McCusker, 1998], control [Laird,
1997], and general references [Abramsky et al., 1998]. While ground state only allows data, such as natural numbers, to be stored, general references (also calledhigher-order state) has no restriction as to what can be stored.
For logical relations [Plotkin, 1973, Statman, 1985], which is a type-based inductive proof method for observational equivalence, higher-order state poses a challenge by introducing types that are not inductive. To deal with non-inductive types,
namely recursive and quantified types, Ahmed [2006] equipped logical relations withstep indices [Appel and McAllester, 2001]. Step-indexed logical relations were thenused to model higher-order state together with abstract types [Ahmed et al., 2009],
and to model higher-order state as well as control [Dreyer et al., 2012].
Deviating from applicative bisimulations [Abramsky, 1990], environmental bisimulations have been developed to deal with more distinguishing power of contexts,
for instance caused by abstract types and recursive types [Sumii and Pierce, 2007],and higher-order state [Sangiorgi et al., 2007, Koutavas and Wand, 2006]. While thedeviation is analysed and justified in the presence of effects including state and poly-1.1. CONTEXT AND MOTIVATION

9morphism [Koutavas et al., 2011], yet another variant of environmental bisimulation
was proposed to model control [Yachi and Sumii, 2016].
The aforementioned work [Abramsky and McCusker, 1998, Laird, 1997, Abramsky et al., 1998] on game semantics resulted in so-called Abramsky’s cube, a semantical characterisation of combinations of state and control. Abramsky’s cube is alsostudied in terms of logical relations by Dreyer et al. [2012].
Since some common language features, such as mutable state, can indeed violate
as basic observational equivalences as the identity law M = M ' true, it is a naturaland important question to ask which observational equivalences are respected orviolated by which language features. To answer this question, it would not be enoughto analyse the impact that language features have on semantical specifications andtheir proof methodology of observational equivalence, as in the literature. Language
features should rather be analysed in terms of their effect directly on observational
equivalences, and this analysis would require a uniform framework that can model all
language features. The desirable framework should provide not only a specificationof program execution, but also a non-fragile reasoning principle that works in thepresence and absence of various language features in a uniform way.
Recall that the notion of improvement formalises comparison between programfragments with respect to both execution result and cost. Dealing with improvement instead of observational equivalence in the presence of rich language features
would be yet another complication. The uniform semantical framework, which accommodates all the language features of interest, is still desirable, but the framework
should additionally be equipped with a measure of execution cost. Furthermore, theframework should accommodate language features as first-class inhabitants. It is
not enough for the framework to provide a set of primitives with which language
features can be encoded, because encoding does not necessarily reflect efficiency ofthe language features.
The common motivation of research regarding improvement seems to be vali-

10

CHAPTER 1. INTRODUCTION

dation of program transformations used for a lazy programming language such as
Haskell. Recent studies with this motivation by Hackett and Hutton [2014], SchmidtSchauß and Sabel [2017] consider a core lazy language where effects such as state
are not first-class inhabitants but could be encoded. For richer languages, known
semantical frameworks for observational equivalence have been adapted. Hackett
and Hutton [2018] adapt a logical relation for parametric polymorphism to prove
improvement. Ghica [2005] proposes game semantics for a concurrent language that
can take a given cost measure into account, solving the full abstraction problem withrespect to improvement.

1.2

Contribution and methodology

1.2.1

Two graph-rewriting abstract machines for reasoning

This thesis develops two abstract machines: the Dynamic Geometry of Interaction Machine (DGoIM), and the Universal Abstract Machine (UAM). Both abstract
machines perform strategical graph rewriting, with the latter revising the former.
Unlike conventional abstract machines, whose configurations are code accompanied
by data structures, these abstract machines work on graph representation of whole
programs. Translating inductively-structured programs into graphs, as low-level representation, enables fine control over resources and introduces the novel concept of
locality in program execution.
The DGoIM is a first step towards an abstract machine, as a semantical framework, with which different specifications of time and space cost can be given in a
uniform way. Strategical graph rewriting has flexibility in terms of rewrite rules andstrategies of triggering the rewrite rules. This flexibility would enable the DGoIM
to explore the design space of abstract machines, and hence make a cost measure of
the DGoIM a generic measure of a given programming language.
As a case study, one setting of the DGoIM is proved to efficiently model the1.2. CONTRIBUTION AND METHODOLOGY

11

lambda-calculus with call-by-need and call-by-value evaluation strategies. The efficiency is proved using a taxonomy of abstract machines given by Accattoli [2017].
Based on the DGoIM, the UAM aims at a uniform semantical framework withwhich language features can be analysed in terms of observational equivalences,and possibly improvements, they respect or violate. The UAM specifies program
execution of a language called Spartan—a core language whose only primitives
are variable binding, name binding and thunking. Everything else, even lambdaabstraction and function application, are extrinsic in Spartan.
In this way, the UAM enables analysis of not just lambda-abstraction and function application, as the DGoIM does, but also other language features. The UAM
is dubbed “universal” in the sense of universal algebras; being parametrised by extrinsic operations and their behaviour, the UAM serves as a specification of various
languages without the need to change its intrinsic machinery.
In this framework, language features can be accommodated in two different ways:
as native operations, and as encoding in terms of other native operations. This
makes the UAM potentially suitable for reasoning about improvement, althoughobservational equivalence is the primary concern here.
The UAM is arguably the first known abstract machine that enables direct proofsof observational equivalence. A reasoning principle used in these direct proofs exploits a concept of locality that arises in strategical graph rewriting, and the principle
is formalised as a characterisation theorem (Thm. 4.3.14).
The sequel describes methodological background of these developments, namely
strategical graph rewriting and the concept of locality.

1.2.2

Token-passing GoI

Geometry of Interaction (GoI) [Girard, 1989], a semantics of linear logic proofs, provides a starting point towards a framework for studying the trade-off between timeand space efficiency. The token-passing style of GoI, in particular, gives abstract ma-

12

CHAPTER 1. INTRODUCTION

chines for the lambda-calculus, pioneered by Danos and Regnier [1996] and Mackie[1995]. These machines evaluate a term of the lambda-calculus by translating theterm to a graph, a network of simple transducers, which executes by passing adata-carrying token around.
Token-passing GoI decomposes higher-order computation into local token actions, or low-level interactions of simple components. It can give innovative implementation techniques for functional programs, such as Geometry of Implementation compiler [Mackie, 1995], Geometry of Synthesis (GoS) high-level synthesis
tool [Ghica, 2007], and resource-aware program transformation to a low-level language [Schöpp, 2014a]. The interaction-based approach is also convenient for thecomplexity analysis of programs, e.g. IntML type system of logarithmic-space evaluation [Dal Lago and Schöpp, 2016], and linear dependent type system of polynomialtime evaluation [Dal Lago and Gaboardi, 2011, Dal Lago and Petit, 2012].
Constant-space execution is essential for GoS, since in the case of digital circuits
the memory footprint of the program must be known at compile-time, and fixed.
Using a restricted version of the call-by-name language Idealised Algol [Ghica andSmith, 2011] not only the graph, but also the token itself can be given a fixed size.
Surprisingly, this technique also allows the compilation of recursive programs [Ghica
et al., 2011]. The GoS compiler shows both the usefulness of the GoI as a guideline
for unconventional compilation and the natural affinity between its space-efficient
abstract machine and call-by-name evaluation. The practical considerations match
the prior theoretical understanding of this connection [Danos and Regnier, 1996].
The token passed around a graph simulates graph rewriting without actual
rewriting, which is in fact an extremal instance of the trade-off mentioned above.
Token-passing GoI keeps the underlying graph fixed and uses the data stored in thetoken to route it. It therefore favours space efficiency at the cost of time efficiency.
The same computation is repeated when, instead, intermediate results could havebeen cached by saving copies of certain sub-graphs representing values.

1.2. CONTRIBUTION AND METHODOLOGY

1.2.3

13

Interleaving GoI token passing with graph rewriting

The original intention is to lift the token-passing GoI to a framework to analyse
the trade-off between time and space efficiency. This can be done by strategicallyinterleaving the GoI token passing with graph rewriting, resulting in an abstract
machine. The machine, called the Dynamic GoI Machine (DGoIM), is defined as astate transition system with transitions for token passing as well as transitions forgraph rewriting. The token holds control over graph rewriting, by visiting redexes
and triggering the rewrite transitions.
Graph rewriting offers fine control over caching and sharing intermediate results.
Through graph rewriting, the DGoIM can reduce sub-graphs visited by the token,
avoiding repeated token actions and improving time efficiency. However, fetchingcached results can increase the size of the graph. In short, introduction of graphrewriting sacrifices space while favouring time efficiency. The flexibility given by afine-grained control over interleaving would enable a careful balance between space
and time efficiency.
As a first step in exploration of the flexibility of this machine, we consider the two
extremal cases of interleaving. The first extremal case is passes-only, in which the
DGoIM never triggers graph rewriting, yielding an ordinary token-passing abstract
machine. As a typical example, the λ-term (λx.t) u is evaluated like this:
1. A token enters the graph on the left at the bottom openedge.
2. A token visits and goes through the left sub-graph λx.t.
λx.t

u

3. Whenever a token detects an occurrence of the variable
x in t, it traverses the right sub-graph u, then returns
carrying information about the resulting value of u.
4. A token finally exits the graph at the bottom open edge.

14

CHAPTER 1. INTRODUCTION

Step 3 is repeated whenever the argument u needs to be re-evaluated. This passesonly strategy of interleaving corresponds to call-by-name evaluation.
The other extreme is rewrites-first, in which the DGoIM interleaves token passing with as much, and as early, graph rewriting as possible, guided by the token.
This corresponds to both call-by-value and call-by-need evaluations, with different
trajectories of the token. In the case of left-to-right call-by-value, the token enters
the graph from the bottom, traverses the left-hand-side sub-graph, which happens
to be already a value, then visits the sub-graph u even before the bound variable x
is used in a call. The token causes rewrites while traversing the sub-graph u, andwhen it exits, it leaves behind a graph corresponding to a value v such that u reduces
to v. For right-to-left call-by-value, the token visits the sub-graph u straightaway
after entering the whole graph, reduces the sub-graph u, to the graph of the value
v, and visits the left-hand-side sub-graph. Finally, in call-by-need, the token visits
and reduces the sub-graph u only when the variable x is encountered in λx.t.
In this framework, all these three evaluations involve similar tactics for cachingintermediate results. Their only difference, which is the timing of cache creation, isrealised by different trajectories of the token. Cached values are fetched in the same
way: namely, whenever repeated evaluation is required, the sub-graph corresponding
to the cashed value is copied. One copy can be further rewritten, if needed, while
the original is kept for later reference.

1.2.4

Rewrites-first interleaving and locality

As for a semantical framework to analyse language features in terms of observational equivalence, the main challenge is to have a reasoning principle of inspecting
possible contexts. Direct inspection of contexts, as well as their interaction witha particular program fragment throughout execution, is particularly hard with abstract machines.
It turns out, however, that employing the rewrites-first interleaving of the DGoIM

1.2. CONTRIBUTION AND METHODOLOGY

15

makes the direct inspection possible. Due to the control the token holds over graphrewriting, program execution can be described locally in terms of the token and its
neighbourhood. The inspection of contexts boils down to local inspection aroundthe token that navigates through contexts: namely, inspection of token’s position,
data, and rewrites that are triggered by and around the token.
This local inspection can further be applied to analyse interaction that a context
C has with a fragment t, during execution of the composite program C[t]. At the
beginning of the execution, the token enters the graph that represents C[t]. The
graph can be split into two parts, one corresponding to the context C and the othercorresponding to the fragment t. As the token navigates through the graph C[t], thetoken position will therefore be either inside C, inside t or on the border between thetwo sub-graphs. By inspecting the token data and rewrites to be triggered, possible
scenarios can be classified into the following three:
Case I: move inside the context.
The token (•) moves within the sub-graph C, as indicatedtby magenta on the left. The sub-graph t is not involvedCin, and hence is irrelevant to, the move.
Case II: visit to the fragment.
The token (•) enters the sub-graph t. It will navigatetthrough the sub-graph t, as indicated by magenta on theCleft, and may trigger some rewrite. The rewrite possibly
involves a part of the sub-graph C.
Case III: rewrite.
The token (•) is in the sub-graph C and triggers a rewrite.
t
C

The rewrite may involve a part of the sub-graph t, as
indicated by magenta on the left.

In this way, the rewrites-first interleaving of the DGoIM enables us to inspect
interaction between a context C and a fragment t in an elementary case-by-case

16

CHAPTER 1. INTRODUCTION

manner, according to how the fragment t is involved in token moves and triggered
rewrites that are possible on the composite graph C[t]. This leads to a direct, caseby-case, reasoning principle to prove observational equivalence, namely to prove thattwo program fragments t and u interact with any context C in the same manner.
Intuitively, the way the fragment t is involved in token moves and triggered rewrites
on the graph C[t] should coincide with the way the fragment u is involved in token
moves and triggered rewrites on the graph C[u].
Sufficient conditions of observational equivalence can be identified by examining
scenarios of this coincidence, using the case analysis based on the local inspection.
Example scenarios of the coincidence are as follows:
Any scenario in Case I: move inside the common context.
The token moves within the common context C,

F

which is regardless of the fragments. The coin-Ccidence is in fact always guaranteed in Case I.

(F denotes t or u.)

A scenario in Case II: visit to the fragments.
Whenever the token visits the fragment t, trigutC

gered rewrites change the fragment t to the otherCfragment u, and hence the visit yields the same
result as visiting the fragment u. This typically
happens when the fragments t and u are takenfrom reduction, e.g. t ≡ 1 + 2 and u ≡ 3.
A scenario in Case III: rewrite.
F
C

F
C0

(F denotes t or u.)

The token in the common context C triggers arewrite that only affect a part of the context C.
The rewrite hence preserves the fragments.

The last scenario is of particular importance, giving rise to a new concept ofrobustness. It characterises safe involvement of the fragments in rewrites, namely
where the fragments are respected in the same manner by the rewrites, and provides

1.3. THESIS OUTLINE

17

a sufficient condition of observational equivalence. Measuring robustness of thefragments reveals when, namely with which rewrites allowed, the fragments can beobservationally equivalent.
The main technical result in Chap. 4, a characterisation theorem (Thm. 4.3.14),
identifies sufficient conditions of observational equivalence in the way describedabove, by formalising the case analysis based on the local inspection. The theorem provides a way to analyse which observational equivalences are respected bywhich language features, by identifying robustness as a key sufficient condition. Robustness of program fragments are relative to rewrites, but it can be seen as being
relative to language features as well, because behaviour of language features aremodelled by rewrites. Therefore, by measuring robustness of program fragments,
one can examine which language features can enable the fragments to be observationally equivalent.
Finally, it is worth noting that the concept of locality here is not to be confusedwith memory locality. Memory locality concerns memory access during program execution. On the other hand, locality, together with robustness, captures the impactthat operations in a program make on other parts of the program during execution.
Locality could be seen as a generalisation of memory locality, because memory accesscould be modelled as extrinsic features of Spartan and the UAM.

1.3

Thesis outline

Chap. 2 presents the DGoIM with the rewrites-first strategy, as efficient specification for the lambda-calculus with various evaluation strategies. Materials in thischapter have been produced under the supervision of Dan R. Ghica, and presented
in jointly-authored papers [Muroya and Ghica, 2017, 2018a], which are currently
under consideration as a journal article [Muroya and Ghica, 2018b]. We appreciateencouraging and insightful comments by Ugo Dal Lago and anonymous reviewers

18

CHAPTER 1. INTRODUCTION

on earlier versions of this work, and thank Steven W. T. Cheung for helping us
implement an on-line visualiser.
Chap. 3 presents the language Spartan and the UAM, and Chap. 4 presents
the local reasoning principle the UAM offers. Materials in these chapters havebeen produced under the supervision of Dan R. Ghica. Hypernet diagrams were
produced by Ghica, and an associated on-line visualiser was implemented by Todd
Waugh Ambridge. A preliminary idea of local reasoning was formulated for thelambda-calculus in Waugh Ambridge’s MSci thesis, under the joint supervision of
Ghica and the author, and was presented at the workshop on Syntax and Semantics
of Low-Level Languages (Oxford, 2018).
Chap. 5 discusses some topics that are relevant to both machines DGoIM and
UAM. Sec. 5.1 compares the two machines, and Sec. 5.2 gives an overview of related
work that adapts the DGoIM to model an unconventional programming paradigm.
This work can be seen as a case study of token-guided graph rewriting, which in fact
inspired the UAM. Materials mentioned in this section are based on joint work [Cheung et al., 2018, Muroya et al., 2018] with Steven W. T. Cheung, Victor Darvariu,
Dan R. Ghica and Reuben N. S. Rowe.
Chap 6 concludes this thesis with discussions about related and future work.

Chapter 2
Efficient implementation ofevaluation strategies
2.1

OutlineThis chapter presents a token-guided graph-rewriting abstract machine for call-byneed, left-to-right call-by-value, and right-to-left call-by-value evaluations. We givethe abstract machine as the Dynamic Geometry of Interaction Machine (DGoIM)
with the rewrite-first strategy, which turns out to be as natural as the passes-only
strategy for call-by-name evaluation. It switches the evaluations, by simply having
different nodes that correspond to the three different evaluations, rather than modifying the behaviour of a single node to suite different evaluation demands. This isa first step in exploration of the flexibility of the DGoIM, which is achieved throughcontrolled interleaving of rewriting and token-passing, and through changing graphrepresentations of terms.
We prove the soundness and completeness of the graph-rewriting machine withrespect to the three evaluations separately, using a sub-machine semantics, where theword “sub” indicates both a focus on substitution and its status as an intermediate
representation. The sub-machine semantics is based on token-passing semanticsof Sinot [2005, 2006] that makes explicit the two main tasks of abstract machines:
19

20

CHAPTER 2. EFFICIENT IMPLEMENTATION

searching redexes and substituting variables.
The time-cost analysis classifies the machine as efficient in a taxonomy of abstract machines of Accattoli [2017]. We follow a general methodology developedby Accattoli et al. [2014], Accattoli [2017] for quantitative analysis of abstract machines, however the method cannot be used “off the shelf”. Our machine is a morerefined transition system with more transition steps, and therefore does not satisfy
one of their assumptions [Accattoli, 2017, Sec. 3], which requires one-to-one correspondence of transition steps. We overcome this technical difficulty by building aweak simulation of the sub-machine semantics, which is also used in the proof ofsoundness and completeness. The sub-machine semantics resembles the storeless
abstract machine of Danvy and Zerny [2013], to which the general recipe of cost
analysis does apply.
Finally, an on-line visualiser1 is implemented, in which our machine can be executed on arbitrary closed (untyped) lambda-terms. The visualiser also supports anexisting abstract machine based on the token-passing GoI, which will be discussed
later, to illustrate various resource usage of abstract machines.
This chapter is organised as follows. We present the sub-machine semantics inSec. 2.2, and introduce the DGoIM with the rewrites-first strategy in Sec. 2.3. In
Sec. 2.4, we show how the DGoIM implements the three evaluation strategies via
translation of terms into graphs, and establish a weak simulation of the sub-machine
semantics by the DGoIM. The simulation result is used to prove soundness andcompleteness of the DGoIM, and to analyse its time cost, in Sec. 2.5. We compare
our graph-rewriting approach to improve time efficiency of token-passing GoI, withanother approach from the literature, namely the so-called jumping approach, inSec. 2.6.

1

Link to the on-line visualiser: https://koko-m.github.io/GoI-Visualiser/2.2. A TERM CALCULUS WITH SUB-MACHINE SEMANTICS

2.2

21

A term calculus with sub-machine semantics

We use an untyped term calculus that accommodates three evaluation strategiesof the lambda-calculus, by dedicated constructors for function application: namely,→−←−@ (call-by-need), @ (left-to-right call-by-value) and @ (right-to-left call-by-value).
Mixing strategies in a single calculus is solely for the purpose of not presenting
three almost identical calculi. Even though the term calculus allows one to writea term that uses all strategies, we are not interested in interaction between thethree strategies. Instead, our aim is to analyse evaluation cost of lambda-terms withrespect to each single strategy. In the rest of the chapter, we assume that each term
contains function applications of a single strategy only.
As shown in the top of Fig. 2.1, the calculus accommodates explicit substitutions[x ← u]. A term with no explicit substitutions is said to be pure.
The sub-machine semantics is used to establish the soundness of the graphrewriting abstract machine. It imitates an abstract machine, by having the following
two features. Firstly, it extends conventional reduction semantics with reduction
steps that explicitly search for a redex, following the style of token-passing semantics
given by Sinot [2005, 2006]. Secondly, it decomposes the meta-level substitution into
on-demand linear substitution, using explicit substitutions, as linear substitution
calculi do [Accattoli and Kesner, 2010]. The sub-machine semantics also resembles
a storeless abstract machine (e.g. [Danvy et al., 2012, Fig. 8]). However the submachine semantics is still too “abstract” to be considered an abstract machine, inthe sense that it works modulo alpha-equivalence to avoid variable captures.
Fig. 2.1 defines the sub-machine semantics of our calculus. It is given by labelled
relations between enriched terms that are in the form of EhLtMi. In an enriched
term EhLtMi, a sub-term t is not plugged directly into an evaluation context, but
into a window L·M which makes it syntactically obvious where the reduction context

is situated. Note that the term t inside the window can be arbitrary. This means

22

CHAPTER 2. EFFICIENT IMPLEMENTATION

Terms
ValuesAnswer contexts
Evaluation contexts→−←−
t ::= x | λx.t | t @ t | t @ t | t @ t | t[x ← t]v ::= λx.t
A ::= h·i | A[x ← t]
E ::= h·i | E[x ← t] | Ehxi[x ← E]
→
−
→
−
←
−
←
−
| E @ t | E @ t | Ahvi @ E | t @ E | E @ Ahvi

Basic rules 7→β , 7→σ , 7→ :Lt @ uM 7→ LtM @ u(2.1)
AhLλx.tMi @ u 7→β AhLtM[x ← u]i
(2.2)
→
−
→
−
Lt @ uM 7→ LtM @ u
(2.3)
→
−
→
−
AhLλx.tMi @ u 7→ Ahλx.ti @ LuM
(2.4)
→
− 0
Ahλx.ti @ A hLvMi 7→β AhLtM[x ← A0 hvi]i
(2.5)
←
−
←
−
Lt @ uM 7→ t @ LuM
(2.6)
←
−
←
−
t @ AhLvMi 7→ LtM @ Ahvi
(2.7)
←
− 0
AhLλx.tMi @ A hvi 7→β AhLtM[x ← A0 hvi]i(2.8)
EhLxMi[x ← Ahui] 7→ Ehxi[x ← AhLuMi](u is not in the form of A0 ht0 i)(2.9)
Ehxi[x ← AhLvMi] 7→σ AhEhLvMi[x ← v]i

Reductions (β , (σ , ( :(2.10)t̃ 7→χ ũ(χ ∈ {β, σ, })
Eht̃i (χ EhũiFigure 2.1: ”Sub-machine” operational semantics

that there may be several enriched terms that have the same underlying ordinary
term: namely, EhLtMi and E 0 hLt0 Mi such that EhLtMi =6 E 0 hLt0 Mi as enriched terms but
Ehti = E 0 ht0 i as ordinary terms forgetting the window. This is crucial to explicitly
represent the redex search process in the sub-machine semantics, as a move of thewindow on the same ordinary term.
Basic rules 7→ are labelled with β, σ or . The basic rules (2.2), (2.5) and (2.8),
labelled with β, apply beta-reduction and delay substitution for a bound variable.
Substitution is done one by one, and on demand, by the basic rule (2.10) withlabel σ. Each application of the basic rule (2.10) replaces exactly one occurrence2.2. A TERM CALCULUS WITH SUB-MACHINE SEMANTICS

23

of a bound variable with a value, and keeps a copy of the value for later use. Notethat the basic rule (2.10) does not duplicate the answer context (A in Fig. 2.1) thatused to accompany the substituted value. The answer context is instead left shared
between two copies of the value, which makes sure that only one value is duplicatedin each application of the basic rule (2.10). All other basic rules, with label , search
for a redex by moving the window without changing the underlying term.
Reduction is defined by congruence of basic rules with respect to evaluation contexts, and labelled accordingly. Any basic rules and reductions are indeed between
enriched terms, because the window L·M is never duplicated or discarded. They arealso deterministic.

An evaluation of a pure term t (i.e. a term with no explicit substitution) is
a sequence of reductions starting from hLtMi, which is simply LtM. Fig. 2.2 shows

evaluations of a pure term (λx.x) ((λy.y) (λz.z)) in the three evaluation strategies.
Reductions labelled with β and σ, which change an underlying term, are highlighted
in black. All three evaluations involve two beta-reductions, which apply λx.x andλy.y to an argument. Application of λx.x comes first in the call-by-need evaluation,and delayed application of λy.y happens inside an explicit substitution. On theother hand, in two call-by-value evaluations, application of λy.y comes first, and no
reduction happens inside an explicit substitution. The two call-by-value evaluations
differ only in the way the window is moved around function application.
The following lemma enables us to follow the use of sub-terms of the initial termt during the evaluation.

Lemma 2.2.1. For any evaluation LtM (∗ E 0 hLt0 Mi starting from a pure closed termt, the term t0 is a sub-term of t. Moreover, the evaluation context E 0 is given by the24

CHAPTER 2. EFFICIENT IMPLEMENTATION

Call-by-need evaluation:
L(λx.x) @ ((λy.y) @ (λz.z))M( Lλx.xM @ ((λy.y) @ (λz.z))(β LxM[x ← (λy.y) @ (λz.z)]( x[x ← L(λy.y) @ (λz.z)M]( x[x ← Lλy.yM @ (λz.z)](β x[x ← LyM[y ← λz.z]]( x[x ← y[y ← Lλz.zM]](σ x[x ← Lλz.zM[y ← λz.z]](σ Lλz.zM[x ← λz.z][y ← λz.z]

Call-by-value evaluations:→−→−L(λx.x) @ ((λy.y) @ (λz.z))M→−→−( Lλx.xM @ ((λy.y) @ (λz.z))→−→−( λx.x @ L(λy.y) @ (λz.z)M→−→−( λx.x @ (Lλy.yM @ (λz.z))→−→−( λx.x @ ((λy.y) @ Lλz.zM)→−(β λx.x @ (LyM[y ← λz.z])→−( λx.x @ (y[y ← Lλz.zM])→−(σ λx.x @ (Lλz.zM[y ← λz.z])(β LxM[x ← (λz.z)[y ← λz.z]]( x[x ← Lλz.zM[y ← λz.z]](σ Lλz.zM[x ← λz.z][y ← λz.z]←−←−
L(λx.x) @ ((λy.y) @ (λz.z))M←−←−( λx.x @ L(λy.y) @ (λz.z)M←−←−( λx.x @ ((λy.y) @ Lλz.zM)←−←−( λx.x @ (Lλy.yM @ (λz.z))←−(β λx.x @ (LyM[y ← λz.z])←−( λx.x @ (y[y ← Lλz.zM])←−(σ λx.x @ (Lλz.zM[y ← λz.z])←−( Lλx.xM @ ((λz.z)[y ← λz.z])(β LxM[x ← (λz.z)[y ← λz.z]]( x[x ← Lλz.zM[y ← λz.z]](σ Lλz.zM[x ← λz.z][y ← λz.z]

Figure 2.2: Evaluations of (λx.x) ((λy.y) (λz.z))

following restricted grammar:

A ::= h·i | A[x ← Ahui],E ::= h·i | E[x ← Ahui] | Ehxi[x ← E]

→
−
→
−
←
−
←
−
| E @ u | E @ u | Ahvi @ E | u @ E | E @ Ahvi

where u and v are sub-terms of t, and v is additionally a value.
Proof outline. The proof is by induction on the length k of the evaluation LtM (k2.3. THE TOKEN-GUIDED GRAPH-REWRITING MACHINE25

E 0 hLt0 Mi. In the base case, where k = 0, we have E = h·i and t0 = t. The inductive

case, where k > 0, is proved by inspecting a basic rule used in the last reduction of

the evaluation. In the case of the basic rule (2.9), the last reduction is in the formof E0 hEhLxMi[x ← Ahui]i ( E0 hEhxi[x ← AhLuMi]i where u is not in the form of
A00 ht00 i. By induction hypothesis, E0 hEhi[x ← Ahui]i follows the restricted grammar,
and in particular, Ahui can be decomposed into a restricted answer context and a
sub-term of t. Because a sub-term of t is also pure, it follows that A itself is a
restricted answer context and u is a sub-term of t.

2.3

The token-guided graph-rewriting machine

In the initial presentation of this work [Muroya and Ghica, 2017], we used proof
nets of the multiplicative and exponential fragment of linear logic [Girard, 1987] toimplement the call-by-need evaluation strategy. Aiming additionally at two call-byvalue evaluation strategies, we here use graphs that are closer to syntax trees but
are still augmented with the !-box structure taken from proof nets. Moving towards
syntax trees allows us to implement two call-by-value evaluations in a uniform way.
The !-box structure specifies duplicable sub-graphs, and help time-cost analysis of
implementations.

2.3.1

Graphs with interface

We use directed graphs, whose nodes are classified into proper nodes and link nodes.
Link nodes are required to meet the following conditions.
• For each edge, at least one of its two endpoints is a link node.
• Each link node is a source of at most one edge, and a target of at most oneedge.
In particular, a link node is called input if it is not a target of any edge, and output

26

CHAPTER 2. EFFICIENT IMPLEMENTATION

Figure 2.3: Full (left) and simplified (right) representation of a graph G(3, 1)
if it is not a source of any edge.2 An interface of a graph is given by the set of all
inputs and the set of all outputs. When a graph G has n input link nodes and m
output link nodes, we sometimes write G(n, m) to emphasise its interface. If a graphhas exactly one input, we refer to the input link node as root.
An example graph G(3, 1) is shown on the left in Fig. 2.3. It has four proper nodes
depicted by circles, and seven link nodes depicted by bullets. Its three inputs areplaced at the bottom and one output is at the top. Shown on the right in Fig. 2.3 is a
simplified version of the representation. We use the following simplification scheme:
not drawing link nodes explicitly (unless necessary), and using a bold-stroke arrow(resp. circle) to represent a bunch of parallel edges (resp. proper nodes).
The idea of using link nodes, as distinguished from proper nodes, comes from agraphical formalisation of string diagrams [Kissinger, 2012].3 String diagrams consistof boxes that are connected to each other by wires, and may have dangling or looping
wires. In the formalisation, boxes are modelled by box-vertices (corresponding toproper nodes in our case), and wires are modelled by consecutive edges connected
via wire-vertices (corresponding to link nodes in our case). It is link nodes thatallow dangling or looping wires to be properly modelled. The segmentation of wires
into edges can introduce an arbitrary number of consecutive link nodes, howeverthese consecutive link nodes are identified by the notion of wire homeomorphism.
We will later discuss these consecutive link nodes, from the perspective of the graph2

In graph-theoretical terminology, source means what we call input, and sink means what wecall output. Our terminology is to avoid the abuse of the term “source” that refers to one endpointof a directed edge.
3
Our link nodes should not be confused with the same terminology “link” of proof nets, whichrefers to a counterpart of our proper nodes.

2.3. THE TOKEN-GUIDED GRAPH-REWRITING MACHINE

27

rewriting machine. From now on we simply call a proper node “node”, and a link
node “link”.
Finally, an operation ◦n,m on graphs, parametrised by natural numbers n and m,
is defined as follows:G ◦n,m H :=G(1 + m, n)H(n, m).

In the sequel, we omit the parameters n, m and simply write ◦.

2.3.2

Node labels and !-boxes

We use the following set L to label nodes:→− ←−L = {λ, @, @ , @ , !, ?, D} ∪ {Cn | n: a natural number}.
A node labelled with X ∈ L is called an X-node. The first four labels correspondto the constructors of the calculus presented in Sec. 2.2, namely λ (abstraction), @→−←−(call-by-need application), @ (left-to-right call-by-value application) and @ (rightto-left call-by-value application). These three application nodes are a part of thenovelty of this work. The token, travelling in a graph, reacts to these nodes indifferent ways, and hence implements different evaluation orders. We believe that
it is a more extensible way to accommodate different evaluation orders as different
nodes, than to let the token react to the same node in different ways depending on
situation. The other labels, namely !, ?, D and Cn for any natural number n, areused in the management of copying sub-graphs. These are inspired by proof netsof the multiplicative and exponential fragment of linear logic [Girard, 1987], andCn -nodes generalise the standard binary contraction and subsume weakening.
We use the generators in Fig. 2.4 to build labelled graphs. Most generators are
given by a graph that consists of one labelled node and a fixed number of interface

28

CHAPTER 2. EFFICIENT IMPLEMENTATION

?

𝜆

⃖
@

@

→
@

𝐷

𝐶𝑛

𝐺

!

Figure 2.4: Generators of graphs
links, which are adjacent to the node. The label of the node determines the interface
links and their connection with the node, as indicated in the figure. For example, alabel λ indicates three edges connecting a λ-node with one input link and two output
links. Going clockwise from the bottom, they are: one edge from the input link, one→−
from an output link, and one to an output link. Application generators (@, @ or←−@ ) have one edge from an input link and two edges to output links. We distinguishthe two output links, calling one “function output” and the other “argument output”(cf. [Accattoli and Guerrini, 2009]). A bullet • in the figure specifies an edge to afunction output. A label Cn indicates n incoming edges from n input links and one
outgoing edge to an output link.
The last generator in Fig. 2.4 turns a graph G(1, m) into a sub-graph (!-box ), by
connecting it to one !-node (principal door ) and m ?-nodes (auxiliary doors). This!-box structure is indicated by a dashed box in the figure. The !-box structure, takenfrom proof nets, assists the management of duplication of sub-graphs by specifying
those that can be copied.4

2.3.3

Graph states and transitions

We define a graph-rewriting abstract machine as a labelled transition system between
graph states.
4

Our formalisation of graphs is related to the view of proof nets as string diagrams, and henceof !-boxes as functorial boxes [Melliès, 2006].

2.3. THE TOKEN-GUIDED GRAPH-REWRITING MACHINE

29

Definition 2.3.1 (Graph states). A graph state ((G(1, 0), e), δ) is formed of a graph
G(1, 0) with its distinguished link e, and token data δ = (d, f, S, B) that consists of:• a direction defined by d ::= ↑ | ↓,• a rewrite flag defined by f ::=  | λ | !,• a computation stack defined by S ::=  | ? : S | λ : S | @ : S, and• a box stack defined by B ::=  | ? : B | ! : B |  : B | e0 : B, where e0 is any
link of the graph G.
The distinguished link e of a graph state ((G, e), (d, f, S, B)) is called the positionof the token. Recall that any link of a graph, including the position, has at most one
incoming edge and at most one outgoing edge. The position will change along theoutgoing edge when the direction of the token is upwards (d = ↑), and move against
the incoming edge if the direction is downwards (d = ↓).5 These token moves canonly happen when the rewrite flag is not raised, namely when f = . Otherwise thegraph G is rewritten, as instructed by the flag; the rewrite targets a λ-node whenf = λ, and targets a !-box when f = !.
The token uses stacks to determine, and record, its reaction to potential targetsof rewrites: namely, it uses the computation stack S for λ-nodes, and the box stack
B for !-boxes. The element ‘?’ at the top of either stack instructs the token not to
perform a rewrite even if the token finds a λ-node or a !-box. Instead, a new elementis placed at the top of the stack: namely, ‘λ’ indicating the λ-node or ‘!’ indicating
the !-box. Any other elements at the top of the stacks enable the token to actuallytrigger a rewrite. They also help the token determine which rewrite to trigger, by
indicating a node to be involved in the rewrite. These elements are namely: ‘@’ of→−
the computation stack indicating an application node (i.e. nodes labelled with @, @5

The way the token direction works is tailored to our drawing convention of graphs, which is todraw directed edges mostly upwards.

30

CHAPTER 2. EFFICIENT IMPLEMENTATIONλ⟶ϵ◻, @ : S, B

→
@

⟶ϵ

◻, S, B

⃖
@

⟶ϵ

λ

λ

λ, S, B◻, ⋆ : S, B

→

→

@

@

◻, ⋆ : S, B◻, λ : S, B

⃖
@

⃖
@

◻, S, ⋆ : B◻, S, ! : B

⟶ϵ

⟶ϵ

⟶ϵ

λ

@

◻, λ : S, B◻, S, B

→

→

@

@

◻, S, ⋆ : B◻, S, ! : B

⃖
@

Cn

◻, @ : S, B◻, S, B@D◻, @ : S, B◻, S, B

⟶ϵ

→

⟶ϵ

@

!

◻, @ : S, B◻, S, X : B

Cn

!

⟶ϵ

e
◻, S, B⟶ϵD◻, S, ⋄ : B⟶ϵ!

!, S, X : B

⟶ϵ

!

e
◻, S, e : B◻, S, ⋆ : B◻, S, ! : B

where X 6= ?.
Figure 2.5: Pass transitions←−
or @ ), ‘’ of the box stack indicating a D-node, and a link of the graph G indicatinga C -node whose inputs include the link.
Definition 2.3.2 (Initial/final states).
1. A state ((G, e0 ), (↑, , , ? : )), where e0 is the root of the graph G(1, 0), issaid to be initial .
2. A state ((G, e0 ), (↓, , , ! : )), where e0 is the root of the graph G(1, 0), issaid to be final .
By the above definition, any graph G(1, 0) uniquely induces an initial state,denoted by Init(G), and a final state, denoted by Final (G). An execution on agraph G is a sequence of transitions starting from the initial state Init(G).
Each transition ((G, e), δ) →χ ((G0 , e0 ), δ 0 ) between graph states is labelled byeither β, σ or . Transitions are deterministic, and classified into pass transitions
that search for redexes and trigger rewriting, and rewrite transitions that actually
rewrite a graph as soon as a redex is found.
A pass transition ((G ◦ H, e), (d, , S, B)) → ((G ◦ H, e0 ), (d0 , f 0 , S 0 , B 0 )), always
labelled with , applies to a state whose rewrite flag is . The graph H contains only

2.3. THE TOKEN-GUIDED GRAPH-REWRITING MACHINE

31

one node, and the positions e and e0 are an input or an output of the node. Fig. 2.5
defines pass transitions, by showing the single-node graph H, token positions anddata, omitting the irrelevant graph G. The position of the token is drawn as a black
triangle, pointing towards the direction of the token.
Each pass transition simply moves the token over a node, and modifies the token
data, while keeping an underlying graph unchanged. When the token passes a λ-nodeor a !-node, a rewrite flag is changed to λ or !, which triggers a rewrite transition.
When the token passes a Cn -node, where n is positive, the old position e is pushed
to a box stack. This link e is drawn as a bullet in Fig. 2.5.
→−←−
The way the token reacts to application nodes (@, @ and @ ) corresponds tothe way the window L·M moves in evaluating these function applications in the sub-machine semantics (Fig. 2.1). When the token moves on to the function output ofan application node, the top element of a computational stack is either @ or ?. The
element ? makes the token return from a λ-node, which corresponds to reducing thefunction part of application to a value (i.e. abstraction). The element @ lets thetoken proceed at a λ-node, raises the rewrite flag λ, and hence triggers a rewrite
transition that corresponds to beta-reduction. The call-by-value application nodes→−←−( @ and @ ) send the token to their argument output, pushing the element ? to abox stack. This makes the token bounce at a !-node and return to the applicationnode, which corresponds to evaluating the argument part of function application toa value. Finally, pass transitions through D-nodes, Cn -nodes and !-nodes prepare
copying of values, and eventually raise the rewrite flag ! that triggers on-demand
duplication.
A rewrite transition ((G ◦ H, e), (d, f, S, B)) →χ ((G ◦ H 0 , e0 ), (d0 , f 0 , S, B 0 )), labelled with χ ∈ {β, σ, }, applies to a state whose rewrite flag is either λ or !. It
replaces the sub-graph H (redex ) with the graph H 0 of the same interface. The
position e that belongs to H is changed to the position e0 that belongs to H 0 . The
transition may pop an element from a box stack. Fig. 2.6 defines rewrite transi-

32

CHAPTER 2. EFFICIENT IMPLEMENTATION′

𝐻(𝑛 + 𝑚, 𝑙)

𝑌

𝑍

𝑌

?

?

?

?

𝐺(1, 𝑛)𝐺(1, 𝑛)𝐺(1, 𝑛)𝐺(1, 𝑛)

!

!

𝑍

⟶𝛽

𝜆

𝐻 (2𝑛 + 𝑚, 𝑙)⟶𝜖⟶𝜎𝐺(1, 𝑛)

!

!

𝐷

𝐶𝑘+1

$
𝐶𝑘

𝑒

𝑒
𝜆, 𝑆, 𝐵◻, 𝑆, 𝐵!, 𝑆, ⋄ : 𝐵◻, 𝑆, 𝐵!, 𝑆, 𝑒 : 𝐵◻, 𝑆, 𝐵→− ←−where Y ∈ L, Z ∈ L, $ ∈ {@, @ , @ }, and G(1, n) is any graph.
Figure 2.6: Rewrite transitions
tions, by showing the sub-graphs H and H 0 , as well as token positions and data,
omitting the graph G. Before we go through each rewrite transition, we note thatrewrite transitions are not exhaustive in general, as a graph may not match a redex
even though a rewrite flag is raised. However we will see that there is no failure oftransitions in implementing the term calculus.
The first rewrite transition in Fig. 2.6, with label β, occurs when a rewrite flagis λ. It implements beta-reduction by eliminating a pair of an abstraction node (λ)→− ←−and an application node ($ ∈ {@, @ , @ } in the figure). Outputs of the λ-node are
required to be connected to arbitrary nodes (labelled with Y and Z in the figure),
so that edges between links are not introduced. The Y -node and the Z-node may
be the same node.
The other rewrite transitions in Fig. 2.6 are for the rewrite flag !, and they target
at duplicable sub-graphs, i.e. !-boxes. They also pop the top element of a box stack,which is used to determine which rewrite to perform.
The second rewrite transition in the figure, labelled with , finishes off each
duplication process by opening the !-box G. This box-opening operation eliminates
all doors of the !-box G, and replaces the interface of G with output links of theauxiliary doors and the input link of the D-node, which is the new position of thetoken. Again, no edge between links are introduced.

2.3. THE TOKEN-GUIDED GRAPH-REWRITING MACHINE′

H (5, 2)C3?

H (8, 2)

C5

C2

?

33

?

?

G(1, 3)

C3

?

?

?

?

G(1, 3)G(1, 3)

!

!

?

⟶σ
!

Ck+1

Ck

Figure 2.7: Example of rewrite transition →σ
The last rewrite transition in the figure, with label σ, actually copies a !-box. It
requires the top element e of the old box stack to be one of input links of the Ck+1 node (where k is a natural number). The link e is popped from the box stack andbecomes the new position of the token, and the Ck+1 -node becomes a Ck -node bykeeping all the inputs except for the link e. The sub-graph H(n+m, l) must consist ofl parallel C -nodes that altogether have n+m inputs. Among these inputs, n must beconnected to auxiliary doors of the !-box G(1, n), and m must be connected to nodes
that are not in the redex. The sub-graph H(n + m, l) is turned into H 0 (2n + m, l) byintroducing n inputs to these C -nodes as follows: if an auxiliary door of the !-box G
is connected to a C -node in H, two copies of the auxiliary door are both connectedto the corresponding C -node in H 0 . Therefore the two sub-graphs consist of thesame number l of C -nodes, whose in-degrees are possibly increased. The m inputs,
connected to nodes outside a redex, are kept unchanged. Fig. 2.7 shows an example
where copying of the graph G(1, 3) turns the graph H(5, 2) into H 0 (8, 2).
All pass and rewrite transitions are well-defined, and indeed deterministic. Passtransitions are also reversible, in the sense that no two different pass transitions
result in the same graph state. No transition is possible at a final state, and no
pass transition results in an initial state. Fig. 2.8 shows an example execution of
the DGoIM, which starts from an initial state and terminates at a final state. As

34

CHAPTER 2. EFFICIENT IMPLEMENTATION

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝜆

𝜆

𝜆

𝜆

𝜆

𝜆

𝜆

𝜆

!

!

!

!

!

!

𝜖

𝜖

⟶

⟶

𝜖

⟶

!
!

𝐷

𝐷
𝐷

𝐷

@

◻, ◻, ⋆ : ◻

@

@

@

◻, ⋆ : ◻, ⋆ : ◻

◻, ⋆ : ◻, ⋄ : ⋆ : ◻

!, ⋆ : ◻, ⋄ : ⋆ : ◻

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝐶1

𝜆

𝜆

𝜆

𝜆

𝜆

𝜆

𝜆

𝜆

𝜖

𝜖

⟶

𝜖

⟶

!

𝜖

⟶

!

!

⟶

!

@

@

@

@

◻, ⋆ : ◻, ⋆ : ◻

◻, 𝜆 : ◻, ⋆ : ◻

◻, ◻, ⋆ : ⋆ : ◻

◻, ◻, ! : ⋆ : ◻

𝐶1

𝐶1

𝜆

𝜆

𝐶1

𝜖

𝐶1

𝐶1

𝐶1

𝐶1

𝜆

𝜆

𝜆

𝜆

𝜖

⟶

𝜖

𝛽

⟶

!

𝜆

⟶

!

!

𝜖

⟶

!

⟶
!

@

◻, @ : ◻, ⋆ : ◻

𝜆, ◻, ⋆ : ◻

◻, ◻, ⋆ : ◻

𝐶1

𝐶1

𝐶1

𝐶1

𝜆

𝜆

𝜆

𝜆

!

!

!

!

𝐶1

𝐶1

◻, ◻, 𝑒 : ⋆ : ◻

!, ◻, 𝑒 : ⋆ : ◻

𝜖

𝜎

⟶

𝐶1

@

⟶

𝐶0

◻, ◻, ⋆ : ◻

𝐶0◻, ◻, ! : ◻

Figure 2.8: Example execution of the DGoIM

2.3. THE TOKEN-GUIDED GRAPH-REWRITING MACHINE

35

will be apparent in Sec. 2.4, this execution corresponds to evaluation of a term→−
(λx.x) @ (λy.y).
An execution of only pass transitions has some continuity in the following sense.
Lemma 2.3.3 (Pass continuity). For any execution Init(G) →∗ ((G, e), δ) of passtransitions only, there exists a non-empty sequence e1 , . . . , en of links of G that satisfies the following.
• e1 is the root of G, and en = e.
• For each i ∈ {1, . . . , n − 1}, there exists a node whose inputs include ei andwhose outputs include ei+1 .
• Each link in the sequence appears as a token position in the execution Init(G) →∗((G, e), δ).
Proof outline. The proof is by induction on the length k of the execution Init(G) →∗((G, e), δ). In the base case, where k = 0, the link e is the root of G, and e itself asa sequence satisfies the conditions. The inductive case, where k > 0, is proved byinspecting all possibilities of the last pass transition in the sequence.
The following sub-graph property is essential in time-cost analysis, because it
bounds the size of duplicable sub-graphs (i.e. !-boxes) in an execution.
Lemma 2.3.4 (Sub-graph property). For any execution Init(G) →∗ ((H, e), δ),each !-box of the graph H appears as a sub-graph of the initial graph G.
Proof. Rewrite transitions can only copy or discard a !-box, and cannot introduce,
expand or reduce a single !-box. Therefore, any !-box of H has to be already a !-boxof the initial graph G.
When a graph has an edge between links, the token is just passed along. With thispass transition over a link at hand, the equivalence relation between graphs that identifies consecutive links with a single link—so-called wire homeomorphism [Kissinger,

36

CHAPTER 2. EFFICIENT IMPLEMENTATION

2012]—lifts to a weak bisimulation between graph states. Therefore, behaviourally,
we can safely ignore consecutive links. From the perspective of time-cost analysis,
we benefit from the fact that rewrite transitions can be performed without introducing any edge between links; in other words, any edges between links introduced bya rewrite transition can be immediately eliminated by identifying endpoints. Thismeans that, by assuming that an execution starts with a graph with no consecutive links, we can analyse time cost of the execution without caring the extra passtransition over a link.

2.4

Implementation of evaluation strategies

The implementation of the term calculus, by means of the dynamic GoI, starts
with translating (enriched) terms into graphs. The definition of the translation uses
multisets of variables, to track how many times each variable occurs in a term. A
multiset of variables is given by a function M : V → N from the set of variables tothe set of natural numbers, such that only a finite number of variables are mapped
to positive numbers. We assume that terms are alpha-converted in a form in which
all binders introduce distinct variables.

Notation 1 (Multiset). We write x ∈k M if M (x) = k, that is, the multiplicity ofx in a multiset M is k. The empty multiset is denoted by ∅, which means ∅(x) = 0
for any x. The sum of two multisets M1 and M2 , denoted by M1 + M2 , is definedby (M1 + M2 )(x) = M1 (x) + M2 (x). We can remove all occurrences of x from amultiset M by changing the multiplicity of x to zero. This yields the multiset M \x,e.g. [x, x, y]\x = [y]. We abuse the notation and refer to a multiset [x, . . . , x] of afinite number of x’s, simply as x.

Definition 2.4.1 (Free variables). The map FV of terms to multisets of variables

2.4. IMPLEMENTATION OF EVALUATION STRATEGIES

37

→
− ←
−
is inductively defined as below, where $ ∈ {@, @ , @ }:FV(x) := [x],FV(λx.t) := FV(t)\x,
FV(t $ u) := FV(t) + FV(u),FV(t[x ← u]) := (FV(t)\x) + FV(u).
For a multiset M of variables, the map FVM of evaluation contexts to multisets ofvariables is defined by:

FVM (h·i) := M,
FVM (E @ t) := FVM (E) + FV(t),→−FVM (E @ t) := FVM (E) + FV(t),→−FVM (Ahvi @ E) := FV(Ahvi) + FVM (E),←−FVM (t @ E) := FV(t) + FVM (E),←−FVM (E @ Ahvi) := FVM (E) + FV(Ahvi),
FVM (E[x ← t]) := (FVM (E)\x) + FV(t),FVM (E 0 hxi[x ← E]) := (FV(E 0 hxi)\x) + FVM (E).

A term t is said be closed if FV(t) = ∅. Consequences of the above definition are
the following equations.

FV(Ehti) = FVFV(t) (E),FVM (EhE 0 i) = FVFVM (E 0 ) (E),FVM +M 0 (E) = FVM (E) + M 0
FVx (E)\x = FV∅ (E)\x.

(if M 0 is not captured in E),

38

CHAPTER 2. EFFICIENT IMPLEMENTATION

C2

?

?

C1

D

@
D

@

FV(t)

t

†

FVM (A)†A

FVM (E)

E

λ

‡

!

M

M

M

M

λ

Figure 2.9: General form of translations

!

C1

C1

λ

λ

!

!

λ

λ

D

@

D

@

Figure 2.10: Translation of a term((λf .λx.f @ (f @ x)) @ (λy.y)) @ (λz.z)
We give translations of terms, answer contexts, and evaluation contexts separately. Fig. 2.11 and Fig. 2.12 define two mutually recursive translations (·)† and(·)‡ , the first one for terms and answer contexts, and the second one for evaluation→− ←−contexts. In the figures, $ ∈ {@, @ , @ }, and m is the multiplicity of x. Fig. 2.9
shows the general form of the translations, and Fig. 2.10 shows translation of a term((λf .λx.f @ (f @ x)) @ (λy.y)) @ (λz.z).
The DGoIM can evaluate a closed term t by starting an execution on the trans→−
lation t† . The execution shown in Fig. 2.8 is indeed on the translation ((λx.x) @(λy.y))† , and executions on any translated closed pure terms can be seen in our
on-line visualiser6 . The translations of answer contexts and evaluation contexts will
be used to define a weak simulation between the sub-machine semantics and the
DGoIM, both seen as labelled transition systems. The weak simulation plays a keyrole in proving soundness, completeness and efficiency of the DGoIM.
The annotation of bold-stroke edges means each edge of a bunch is labelled with
6

https://koko-m.github.io/GoI-Visualiser/2.4. IMPLEMENTATION OF EVALUATION STRATEGIES

39

an element of the annotating multiset, in a one-to-one manner. In particular if abold-stroke edge is annotated by a variable x, all edges in the bunch are annotated‡by the variable x. Translation EM
of an evaluation context has one input andone output that are not annotated, which we refer to as the main input and themain output. These annotations are only used to define the translations, and aresubsequently ignored during execution.
The translations are based on the so-called call-by-value translation of linear
logic to intuitionistic logic (e.g. [Maraist et al., 1999]). It is only abstraction thatis translated as a !-box, which captures the fact that only values (i.e. abstractions)can be duplicated (see the basic rule (2.10) in Fig. 2.1). Indeed, if a term u stored
in an explicit substitution [x ← u] is not a value, its translation is not a !-box, andit cannot be duplicated as a whole. Note that only one C -node is introduced foreach bound variable. This is vital to achieve constant cost in looking up a variable,
namely in realising the basic rule (2.9) in Fig. 2.1.
The two mutually recursive translations (·)† and (·)‡ are related by the decompositions in Fig. 2.13, which can be checked by straightforward induction. In thethird decomposition, M 0 is not captured in E. Note that, in general, the translation
Ehti† of a term in an evaluation context cannot be decomposed into translations→−‡
EFV(t)and t† . This is because a translation (Ahλx.ti @ E)‡M lacks a !-box structure,→−compared to a translation (Ahλx.ti @ u)† .
Translation of an evaluation context can be traversed by pass transitions without
raising the rewrite flag λ or !, as the following lemma states.
Lemma 2.4.2. Let E be an evaluation context and M be a multiset. For any‡
as a sub-graph and has no edge between links, let eigraph G(1, 0) that has EM‡, respectively.
and eo be the main input and the main output of the sub-graph EM

For any pair (S, B) of a computation stack and a box stack, there exists a pair
(S 0 , B 0 ) of a computation stack and a box stack, such that ((G, ei ), (↑, , S, B)) →∗((G, eo ), (↑, , S 0 , B 0 )) is a sequence of pass transitions.

40

CHAPTER 2. EFFICIENT IMPLEMENTATION

FV(t)∖x
?

x

†

†

⟨⋅⟩

=

M

=

x

M

Cm

FV(t)∖x

x

FV(t)
t

(λx. t)†FVM (A)∖x

FV(u)

FV(u)

u

FV(t)

†

t

†

†

t

=
(t $ u)

λ

†

†

u

†

=

(t[x ← u])†

Cm(A[x ← t])

=
x

D

t
!

Cm

†
M

=
x

†

A

$

†
M

M

→
− ←
−
where $ ∈ {@, @ , @ }.
Figure 2.11: Inductive translation of terms and answer contexts(E @ t)‡M‡⃖(t @ E)=M(E[x ← t])

=
‡

FV(t)

FV(t)

FVM (E)⟨⋅⟩=M

FVM (E)‡M=

FVM (E)∖x

FV(t)

M
E

‡

t

M

†

t

D

†

E

t

‡
M

Cm

D

→
(A⟨λx. t⟩ @ E)
⃖
@

@

‡
M

(E @ t)M⃖(E @ A⟨v⟩)

=

‡
M

E

FV(A⟨λx. t⟩)
M
A

‡

x

=
FVM (E)

M

→

M

′

E

‡

t

M

FV(A⟨v⟩)

†

E

‡

A⟨v⟩

M

M

FV(λx.t)=

FVM (E)

FV(t)

‡

†

(E ⟨x⟩[x ← E])

Cm

FVM (E)

†

‡
M

=

x

FVM (E)

†

t

†

E

‡

E

M

‡
M

′

FV∅ (E )∖x

D

λ

D

Cm+1
x

→

→

@

⃖
@

@
M

′

(E )
M

Figure 2.12: Inductive translation of evaluation contexts
FVFV(t) (A)FV(A⟨t⟩)FVM (A)

†

A

†

FV(t)

=

FV(t)

t

,

‡

†

=

A

M

A

,

M

†

M

FVM+M ′ (E)

E

‡
M+M

M+M

′

′

FVM (E)

=

′

E

FVFV

FVM (E⟨E ⟩)

‡

,

M

M

∅

M

M

A⟨t⟩

‡

M

′

′

M (E

‡

E⟨E ⟩

M

M

=

E

′

)

(E)

‡

′

FVM (E )′′FVM (E )

‡

(E )

M

M

Figure 2.13: Decompositions of translations

2.4. IMPLEMENTATION OF EVALUATION STRATEGIES

41

p ∗

Proof. By induction on E. We use → to denote a sequence of pass transitions inthis proof. In the base case, where E = h·i, the main input ei and the main output
eo coincides. An empty sequence suffices.
The first class of inductive cases are when the top-level constructor of E is function application, e.g. E ≡ E 0 @ t. Let e0i and e0o be the main input and the main
output of the sub-graph (E 0 )‡M , respectively. In each of the cases, there exist stacks
p ∗S 00 and B 00 such that ((G, ei ), (↑, , S, B)) → ((G, e0i ), (↑, , S 00 , B 00 )). By the inducp ∗tion hypothesis, there exist stacks S 0 and B 0 such that ((G, e0i ), (↑, , S 00 , B 00 )) →((G, e0o ), (↑, , S 0 , B 0 )). Combining these two sequences yields a desired sequence,
because e0o = eo .
The inductive case where E ≡ E 0 [x ← t] simply boils down to the induction
hypothesis.
The last inductive case is when E ≡ E1 hxi[x ← E2 ]. Let e0i and e0o be the main
input and the main output of the sub-graph (E1 )‡∅ , and e00i and e00o be the main input and the main output of the sub-graph (E2 )‡M , respectively. We have ei = e0i
and eo = e00o . The link e0o is an input of a C -node and e00i is the output of the C node. By the induction hypothesis on E1 , there exist stacks S 00 and B 00 such thatp ∗((G, e0i ), (↑, , S, B)) → ((G, e0o ), (↑, , S 00 , B 00 )). This sequence can be followed by apass transition ((G, e0o ), (↑, , S 00 , B 00 )) → ((G, e00i ), (↑, , S 00 , e0o : B 00 )). By the induction hypothesis on E2 , there exist stacks S 0 and B 0 such that ((G, e00i ), (↑, , S 00 , e0o :p ∗B 00 )) → ((G, e00o ), (↑, , S 0 , B 0 )). Combining all these sequences yields a desiredsequence, because ei = e0i and eo = e00o .
The inductive translations lift to a binary relation between closed enriched terms
and graph states.
Definition 2.4.3 (Binary relation ). The binary relation  is defined by EhLtMi ((E ‡ ◦t† , e), (↑, , S, B)), where: (i) EhLtMi is a closed enriched term, and (E ‡ ◦t† , e) isFV(t)given by

E

‡
FV(t)

t

†

with no edges between links, and (ii) there is an execution

42

CHAPTER 2. EFFICIENT IMPLEMENTATION

Init(E ‡ ◦ t† ) →∗ ((E ‡ ◦ t† , e), (↑, , S, B)) of pass transitions only, in which e appears
as a token position only in the last state.
A special case is LtM  Init(t† ), which relates the starting points of an evaluation

and an execution. We require the graph E ‡ ◦ t† to have no edges between links,
which is based on the discussion at the end of Sec. 2.3 and essential for time-cost
analysis. Although the definition of the translations and the operation ◦ on graphs
use edges between links (e.g. the translation x† ), such edges can be eliminated assoon as they are introduced, by identifying endpoints. For example, a variable canbe translated into a single link that is both an input and an output, and outputsof the translation (t @ u)† can be simply the union of outputs of t† and u† . The
graph E ‡ ◦ t† can be constructed by identifying interfaces of E ‡ and t† , instead of
introducing edges.
The binary relation  gives a weak simulation of the sub-machine semantics
by the graph-rewriting machine. The weakness, i.e. the extra transitions comparedwith reductions, comes from the locality of pass transitions and the bureaucracy ofmanaging !-boxes.
Theorem 2.4.4 (Weak simulation with global bound).
1. If EhLtMi (χ E 0 hLt0 Mi and EhLtMi  ((E ‡ ◦ t† , e), δ) hold, then there exists
a number n ≤ 3 and a graph state (((E 0 )‡ ◦ (t0 )† , e0 ), δ 0 ) such that ((E ‡ ◦t† , e), δ) →n →χ (((E 0 )‡ ◦ (t0 )† , e0 ), δ 0 ) and E 0 hLt0 Mi  (((E 0 )‡ ◦ (t0 )† , e0 ), δ 0 ).

2. If AhLvMi  ((A‡ ◦ v † , e), δ) holds, then the graph state ((A‡ ◦ v † , e), δ) is initial,from which only the transition Init(A‡ ◦ v † ) → Final (A‡ ◦ v † ) is possible.
Proof. For the second half, e is the root of the graph A‡ ◦ v † , which means the state((A‡ ◦ v † , e), δ) is not a result of any pass transition. Therefore, by the condition(ii) of the binary relation , we have Init(A‡ ◦ v † ) = ((A‡ ◦ v † , e), δ), and one passtransition from this state yields a final state Final (A‡ ◦ v † ).

2.4. IMPLEMENTATION OF EVALUATION STRATEGIES43

For the first half, Fig. 2.14, Fig. 2.15 and Fig. 2.16 illustrate how the graphrewriting machine simulates each reduction ( of the sub-machine semantics. Eachsequence of transitions → simulates a single reduction (. Annotations of edges areomitted, and only the first and the last states of each sequence are shown, except
for the case of the basic rule (2.10).
Some sequences involve equations that apply the four decomposition propertiesof the translations (·)† and (·)‡ , which are given earlier in this section. These equations rely on the fact that terms are alpha-converted in a form in which all binders
introduce distinct variables, and reductions with labels β and σ work modulo alphaequivalence to avoid name captures. This implies the following.
• Free variables of u are not captured by A in the case of the basic rule (2.2).
• Free variables of A0 hvi are not captured by A in the case of the basic rules (2.5)
and (2.8).
• The variable x is not captured by E or E 0 in the case of the basic rules (2.9)
and (2.10).
• In the case of the basic rule (2.10), free variables of E 0 are not captured by A,
free variables of v are not captured by E 0 , and x does not freely appear in v.
Simulation of the basic rule (2.10) involves duplicating the sub-graph v † , which
is a !-box. Because free variables of the value v are captured by either E or A, themultiset FV(v) can be partitioned into two multisets as FV(v) = ME + MA , suchthat ME is the multiset of those captured by E and MA is the multiset of those
captured by A. No variable is contained by both ME and MA . The translations
E ‡ and A† include C -nodes that correspond to ME and MA , respectively. TheseC -nodes get extra inputs by the rewrite transition labelled with σ, as represented
by the middle state in the simulation sequence.
In each sequence, let Gs and Gt be the first and the last graph, respectively.
By the condition (ii) of the binary relation , there exists an execution Exec :44

CHAPTER 2. EFFICIENT IMPLEMENTATION

Init(Gs ) →∗ ((Gs , e1 ), (↑, , S 0 , B 0 )) of only pass transitions, in which the link e1(see the figures) appears as a token position only once at the end.
1. In simulation of the basic rules (2.1), (2.3) and (2.6), the figures use S and B
instead of S 0 and B 0 . By Lem. 2.3.3, the result position e2 (see the figures)
does not appear in the execution Exec; if this is not the case, e1 would appear
more than once in Exec, which is a contradiction. Therefore, Exec followed by
the pass transitions shown in the figures gives a desired execution that meetsthe condition (ii) of the binary relation .
2. In simulation of the basic rule (2.9), the figure uses S and B instead of S 0 and
B 0 . Because x is not captured by E 0 , the starting position e1 is in fact an inputof the Cm+1 -node. Using Lem. 2.3.3 again in the same way, the result position
e2 does not appear in the execution Exec. Therefore, Exec followed by thepass transition shown in the figures gives a desired execution that meets thecondition (ii) of the binary relation .
3. In simulation of the basic rule (2.7), by the reversibility of pass transitions,
there exist stacks S and B such that: S 0 = S, B 0 = ? : B, and the execution
Exec can be decomposed into an execution Exec 0 : Init(Gs ) →∗ ((Gs , e0 ),(↑, , S, B)) and one subsequent pass transition (see the figure for e0 ). In theexecution Exec 0 , the link e0 appears as a token position only once at the end,
which can be checked by contradiction as follows.
• If e0 appears more than once in Exec 0 and its first appearance is withdirection ↓, it must be a result of a pass transition. However, no passtransition leads to this situation, because e0 is an input of a function
application node. This is a contradiction.
• If e0 appears more than once in Exec 0 and its first appearance is withdirection ↑, it must be with rewrite flag , because Exec 0 consists of pass

2.4. IMPLEMENTATION OF EVALUATION STRATEGIES

45transitions only. Regardless of token data, the first appearance leads toan extra appearance of e1 in Exec 0 , which is a contradiction.
Given this freshness of e0 in Exec 0 , by Lem. 2.3.3, the result position e2 does notappear in the execution Exec 0 . Therefore, Exec followed by the pass transitions
shown in the figures gives a desired execution that meets the condition (ii) of
the binary relation .
4. In simulation of the basic rules (2.2), (2.5) and (2.8), by the reversibility ofpass transitions, there exist stacks S and B such thatthe execution Exec canbe decomposed into an execution Exec 0 : Init(Gs ) →∗ ((Gs , e0 ), (↑, , S, B))
and at least one subsequent pass transition. In the execution Exec 0 , the link
e0 appears as a token position only once at the end, which can be checked in
the same manner as the previous case (3). Using this freshness of e0 in Exec 0
and Lem. 2.3.3, we can conclude that any node that interacts with a token in
the execution Exec 0 (i.e. that is relevant in a pass transition in the execution
Exec 0 ) belongs to E ‡ . This means that any pass transition in Exec 0 , on thestarting graph Gs , can be imitated in the resulting graph Gt . Namely, the linke0 corresponds to the result position e2 , and Exec 0 corresponds to an execution
Exec 00 : Init(Gt ) →∗ ((Gt , e2 ), (↑, , S, B)) of only pass transitions, in which e2
appears only once at the end. This execution Exec 00 gives a desired executionthat meets the condition (ii) of the binary relation .
5. In simulation of the basic rule (2.4), the same reasoning as the previous case (4)gives an execution Exec 00 : Init(Gt ) →∗ ((Gt , e0 ), (↑, , S, B)) of only passtransitions, in which e0 appears only once at the end. By Lem. 2.3.3, theresult position e2 does not appear in the execution Exec 00 . Therefore, Exec 00
followed by pass transitions gives a desired execution that meets the condition(ii) of the binary relation .
6. In simulation of the basic rule (2.10), by the reversibility of pass transitions,

46

CHAPTER 2. EFFICIENT IMPLEMENTATION

there exist an input e0 of the Cm+1 -node and stacks S and B such that: S 0 = S,
B 0 = e0 : B, and the execution Exec can be decomposed into an execution
Exec 0 : Init(Gs ) →∗ ((Gs , e0 ), (↑, , S, B)) and one subsequent pass transition
that pushes e0 to the box stack. By Lem. 2.3.3, the link e3 (see the figure)appears in the execution Exec 0 . Analysing this appearance, we can conclude
that the link e0 is in fact the main output of (E 0 )‡∅ .
• If e3 appears with direction ↓ in Exec 0 , because e3 is an input of a function
application node or a C -node, this appearance cannot be a result of any
pass transition. This is a contradiction.
• If e3 appears with direction ↑, it must be with rewrite flag , because
Exec 0 consists of pass transitions only. Because e3 is the main input of(E 0 )‡∅ , by Lem. 2.4.2, this appearance leads to a state whose token positionis the main output e0 of (E 0 )‡∅ , direction is ↑ and rewrite flag is . One
pass transition from the state leads to a state whose token position is e1 .
This means there exists an execution Exec 000 of pass transitions only, via
the token position e3 and the second last token position e0 , to the token
position e1 . Because pass transitions are deterministic, it is either: (1)Exec is strictly a sub-sequence of Exec 000 , (2) Exec = Exec 000 , or (3) Exec 000
is strictly a sub-sequence of Exec. Because Exec is followed by a passtransition and a rewrite transition as shown in the figure, the case (1)is impossible. Because e1 appears only once at the end in the execution
Exec, the case (3) leads to a contradiction. Therefore we can conclude
that (2) is the case, i.e. Exec = Exec 000 . This means e0 = e0 , i.e. e0 is themain output of (E 0 )‡∅ .
As a consequence, the link e2 is indeed the result position, corresponding to
the link e0 .
The rest of the reasoning is similar to the case 4. In the execution Exec to2.5. TIME-COST ANALYSIS

47

the starting position e1 , the token does not interact with nodes that belong
to A† or v † ; otherwise, by Lem. 2.3.3, e1 would have an extra appearance in
Exec, which is a contradiction. For the same reason, the execution Exec 0 to thelink e0 does not involve any interaction of the token with the Cm+1 -node, andhence e0 appears only once at the end in the execution Exec 0 . As a result, theexecution Exec 0 gives an execution Exec 00 : Init(Gt ) →∗ ((Gt , e2 ), (↑, , S, B))of only pass transitions on the resulting graph Gt , in which e2 appears only
once at the end. This execution Exec 00 gives a desired execution that meetsthe condition (ii) of the binary relation .

2.5

Time-cost analysis

We analyse how time-efficiently the token-guided graph-rewriting machine implements evaluation strategies, following the methodology developed by Accattoli et al.
[2014], Accattoli and Sacerdoti Coen [2014], Accattoli [2017]. The time-cost analysis
focuses on how efficiently an abstract machine implements an evaluation strategy.
In other words, we are not interested in efficiency of evaluation strategies themselves, nor in minimising the number of β-reduction steps simulated by an abstract
machine. Our aim is to see if the number of transitions of an abstract machine isreasonable, compared to the number of necessary β-reduction steps determined bya given evaluation strategy.
Accattoli’s methodology assumes that an abstract machine has three groups oftransitions: 1) β-transitions that correspond to β-reduction in which substitution isdelayed, 2) transitions that perform substitution, and 3) other overhead transitions.
We incorporate this classification using the labels β, σ and  of transitions.
Another assumption of the methodology is that, a single transition of an abstract
machine is enough to simulate each step of β-reduction, or each step of substitu-

48

CHAPTER 2. EFFICIENT IMPLEMENTATION→−→−
EhLt @ uMi ( EhLtM @ ui

(2.3)

t

E

†

†

u

t

‡

ϵ

→

E

2

(⟶)

D

FV(t@u)

†

†

u
e2

‡
→

D

FV(t@u)

→

→

@

@
e1

e1

◻, S, B◻, ⋆ : S, ⋄ : B→−→−
EhAhLλx.tMi @ ui ( EhAhλx.ti @ LuMi

(2.4)

†

A

FV(λx.t)

†

?

A

Cm

t

Cm

†

†

u

t

‡

E

ϵ

→

4

(⟶)

λ

FV(A⟨λx.t⟩@u)

FV(λx.t)

E

†

†

u

‡
→

e2

λ

FV(A⟨λx.t⟩@u)

!
e1
D

→

→

@

@

e0

◻, ⋆ : S, ⋄ : B

e0◻, S, ⋆ : B→−
EhAhλx.ti @ A0 hLvMii (β EhAhLtM[x ← A0 hvi]ii

(2.5)

†

A
†

A

′

FV(λx.t)′

FV(t[x←A ⟨v⟩])

†

(A )

FV(v)
′

†

(A )

FV(v)

Cm
†

v
t
E

†

†

v

‡
→

ϵ
′

FV(A⟨λx.t⟩@A ⟨v⟩)

e1

λ

3

(⟶)

β

⟶ =

E

Cm

‡
′

FV(A⟨t[x←A ⟨v⟩]⟩)

→

t

@

◻, S, ⋆ : B

e0

†

e2
◻, S, B

Figure 2.14: Illustration of simulation: left-to-right call-by-value application

2.5. TIME-COST ANALYSIS

EhLt @ uMi ( EhLtM @ ui

(2.1)

t

E

49

†

†

u

t

‡
ϵ

FV(t@u)

E

2

†

‡

†

u
e2

FV(t@u)

(⟶)

D

D
@

@

e1

e1

◻, S, B◻, @ : S, ⋄ : B

EhAhLλx.tMi @ ui (β EhAhLtM[x ← u]ii

(2.2)

†

A

FV(λx.t)?

†A

FV(t[x←u])

Cm
†

u
t
E

†

†

u

‡

ϵ

3

(⟶)

FV(A⟨λx.t⟩@u)

β

⟶ =

E

‡

Cm

FV(A⟨t[x←u]⟩)

λ

t

†

!

e2
e1

D

@

e0
◻, @ : S, ⋄ : B(2.9)◻, S, BEhE hLxMi[x ← Ahui]i ( EhE hxi[x ← AhLuMi]i
0

0

†

A

†

A

FV(u)

†

FV(u)

†

u

u

e2
E

Cm+1

‡

ϵ

= ⟶

′

FV(E ⟨x⟩[x←A⟨u⟩])

E

‡
′

Cm+1

FV(E ⟨x⟩[x←A⟨u⟩])

e1
‡

′

(E )

[x]

′

‡

(E )

∅

e1
◻, S, e1 : B◻, S, B

(2.10)

EhE hxi[x ← AhLvMi]i (σ EhAhE 0 hLvMi[x ← v]ii
0

†

A

†

†

A

A

FV(v)

MA +MA′FV(E ⟨v⟩[x←v])

†

†

v

†

v

†

v

v

e1
E

‡

ϵ
′

FV(E ⟨x⟩[x←A⟨v⟩])

Cm+1

σ

⟶⟶ =

E

‡
′

FV (E )∖x+ME +ME +FVM
∅

A

(A)
+M
A

=

Cm

E

Cm

‡
′

FV(A⟨E ⟨v⟩[x←v]⟩)

e0
′

‡

′

(E )

′

∅

‡

(E )

‡

(E )

FV(v)

†

v

∅

e3
◻, S, e0 : B

e2◻, S, B◻, S, B

Figure 2.15: Illustration of simulation: call-by-need application and explicit substitutions

50

CHAPTER 2. EFFICIENT IMPLEMENTATION

(2.6)

←
−
←
−
EhLt @ uMi ( Eht @ LuMi
t

E

‡

†

†

u

t

ϵ

⃖
FV(t@u)

E

⟶

D

†

⃖
FV(t@u)

⃖
@
e1

e1

◻, S, B◻, S, ⋆ : B←−←−
Eht @ AhLvMii ( EhLtM @ Ahvii

(2.7)

t

†

†

A

t

FV(v)

‡

ϵ

⃖
FV(t@A⟨v⟩)

3

(⟶)

†

v

D

⃖
@

E

†

†

A

FV(v)

e2

‡
⃖
FV(t@A⟨v⟩)

†

u

D

e1

⃖
@

e0

e0

◻, S, ⋆ : B

(2.8)

e2

D

⃖
@

E

†

u

‡

◻, @ : S, ⋄ : B←−
EhAhLλx.tMi @ A0 hvii (β EhAhLtM[x ← A0 hvi]ii†

A′

FV(λx.t)

†

(A )

FV(v)
†

A

′

FV(t[x←A ⟨v⟩])

?
′

†

(A )

FV(v)

Cm
†

v
t
E

†

†

v

‡

ϵ

⃖
′
FV(A⟨λx.t⟩@A ⟨v⟩)

3

(⟶)

λ

β

⟶ =

E

Cm

‡
′

FV(A⟨t[x←A ⟨v⟩]⟩)

t
!

†

e2
e1

D

⃖
@

◻, @ : S, ⋄ : B

e0◻, S, B

Figure 2.16: Illustration of simulation: right-to-left call-by-value application

tion in which one occurrence of a variable is replaced. This is satisfied by many
known abstract machines, including the storeless abstract machine of Danvy and
Zerny [2013] which our sub-machine semantics resembles, however not by the tokenguided graph-rewriting abstract machine. The machine has finer transitions andcan take several transitions to simulate a single step of reduction, as we can observe in Thm. 2.4.4. In spite of this mismatch we can still follow the methodology,
thanks to the weak simulation . It discloses what transitions of the token-guided
graph-rewriting machine exactly correspond to β-reduction and substitution, andgives a concrete number of overhead transitions that the machine needs to simulate

2.5. TIME-COST ANALYSIS

51

β-reduction and substitution.
The methodology of time-cost analysis has four steps: (I) bound the number oftransitions required in implementing evaluation strategies, (II) estimate time costof each transition, (III) bound overall time cost of implementing evaluation strategies, by multiplying the number of transitions with time cost for each transition,and finally (IV) classify the abstract machine according to its execution time cost.
Consider now the following taxonomy of abstract machines introduced in Accattoli[2017].
Definition 2.5.1 (classes of abstract machines [Accattoli, 2017, Def. 7.1]).
1. An abstract machine is said to be efficient if its execution time cost is linear
in both the input size and the number of β-transitions.
2. An abstract machine is said to be reasonable if its execution time cost ispolynomial in the input size and the number of β-transitions.
3. An abstract machine is said to be unreasonable if it is not reasonable.
In our case, the input size is given by the size |t| of the term t, inductively definedby:|x| := 1,|λx.t| := |t| + 1,→−←−
|t @ u| = |t @ u| = |t @ u| := |t| + |u| + 1,
|t[x ← u]| := |t| + |u| + 1.
The number of β-transitions of the DGoIM is simply the number of transitions →βlabelled with β. Thm. 2.4.4 implies that this number in fact corresponds to thenumber of reductions (β , labelled with β, of the sub-machine semantics.
Given an evaluation Eval , the number of occurrences of a label χ is denoted by|Eval |χ . The sub-machine semantics comes with the following quantitative bounds.

52

CHAPTER 2. EFFICIENT IMPLEMENTATION

Proposition 2.5.2. For any pure closed term t and any evaluation Eval : LtM (∗AhLvMi that terminates, the number of reductions is bounded by |Eval |σ = O(|Eval |β )and |Eval | = O(|t| · |Eval |β ).
Proof. The first equation can be proved by directly applying the methodology oftime-cost analysis by Accattoli et al. [2014] to the sub-machine semantics. Its outline
is as follows.
Recall our assumption that each term involves function applications of a single
evaluation strategy only, which is either one of these three: call-by-need, left-to-rightcall-by-value, or right-to-left call-by-value. Using the concept of distillery [Accattoli
et al., 2014, Sec. 4], we can establish simulation between evaluations by the submachine semantics and derivations in three linear substitution calculi [Accattoli
and Kesner, 2010], each of which uses one of the three evaluation strategies. At thecore of the simulation is the fact that enriched terms of the sub-machine semantics
can be turned into terms of the linear substitution calculi by simply forgetting thewindows.
The simulation in particular entails that each step of reduction (β (resp. (σ )of the sub-machine semantics is simulated by exactly one multiplicative (resp. exponential ) derivation step in the linear substitution calculi. This enables us to use thecomplexity result about the three linear substitution calculi [Accattoli and Sacerdoti
Coen, 2014, Cor. 1 & Thm. 2], which states that, in derivations that successfully
terminate, the number of exponential steps is linear with respect to the numberof multiplicative steps. Consequently, the number of reductions (σ is linear withrespect to the number of reductions (β in evaluations that successfully terminate,
and this is exactly the first equation |Eval |σ = O(|Eval |β ).
The second equation is proved by combining the first equation and an equation|Eval | = O(|t| · (|Eval |β + |Eval |σ )). This auxiliary equation can be proved usingideas from analysis of various abstract machines by Accattoli et al. [2014, Thm. 11.3
& Thm. 11.5], as below.

2.5. TIME-COST ANALYSIS

53

For any enriched term E 0 hLt0 Mi that appears in the evaluation Eval : LtM (∗AhLvMi, we define two measures. The first measure #1 (E 0 hLt0 Mi) is defined by: |t0 |+|u|→−←−if E 0 is in the form of E 00 hA0 h·i@ui, E 00 hA0 h·i @ ui, or E 00 hu @ A0 h·ii; and |t0 | otherwise.
By Lem. 2.2.1, both t0 and u above are sub-terms of t, and we have #1 (E 0 hLt0 Mi) ≤2 · |t|. The second measure #2 (E 0 ) is on E 0 only, and defined inductively as below.
#2 (h·i) := 0,#2 (E 00 hxi[x ← E 000 ]) := #2 (E 00 ) + #2 (E 000 ) + 1,→−→−
#2 (E 00 @ t) = #2 (E 00 @ t) = #2 (Ahvi @ E 00 ) := #2 (E 00 ),←−←−#2 (t @ E 00 ) = #2 (E 00 @ Ahvi) = #2 (E 00 [x ← t00 ]) := #2 (E 00 ).
Because the basic rules (2.1), (2.3), (2.4), (2.6) and (2.7) strictly reduce themeasure #1 , these rules can be consecutively applied at most 2 · |t| times. The
evaluation Eval can be seen as applications of these rules interleaved with otherrules, so the total number of applications of these five basic rules can be boundedby O(|t| · (|Eval |β + |Eval |σ + |Eval |9 )), where |Eval |9 denotes the total number ofapplications of the basic rule (2.9).
The measure #2 is increased only by the basic rule (2.9) and decreased onlyby the basic rule (2.10). Both the increase and the decrease are of one. Because
the measure #2 gives zero for both LtM and AhLvMi, namely #2 (h·i) = #2 (A) = 0,

the basic rule (2.9) must be applied as many times as the basic rule (2.10) in theevaluation Eval . This means |Eval |σ = |Eval |9 .
Combining the bound O(|t| · (|Eval |β + |Eval |σ + |Eval |9 )) with the equation|Eval |σ = |Eval |9 gives the auxiliary equation on |Eval | .
We use the same notation |Exec|χ , as for an evaluation, to denote the numberof occurrences of each label χ in an execution Exec. Additionally the number ofrewrite transitions with the label , i.e. those that eliminates a !-box structure, isdenoted by |Exec|R . Note that pass transitions are all labelled with , and hence

54

CHAPTER 2. EFFICIENT IMPLEMENTATION|Exec|R ≤ |Exec| . The following proposition completes the first step of the cost
analysis.
Proposition 2.5.3 (Soundness and completeness, with transition bounds). For any
pure closed term t, an evaluation Eval : LtM (∗ AhLvMi terminates with the enriched

term AhLvMi if and only if an execution Exec : Init(t† ) →∗ Final (A‡ ◦ v † ) terminateswith the graph A‡ ◦ v † . Moreover the number of transitions is bounded by |Exec|β =|Eval |β , |Exec|σ = O(|Eval |β ), |Exec| = O(|t| · |Eval |β ), |Exec|R = O(|Eval |β ).
Proof. Because the initial term t is closed, any enriched term E 0 hLt0 Mi that appears in

the evaluation Eval is also closed. This implies that a reduction is always possible
at E 0 hLt0 Mi unless it is in the form of A0 hv 0 i. In particular, if t0 is a variable, thevariable is captured by an explicit substitution in E 0 and the basic rule (2.10) is

possible. Consequently, if an evaluation of the pure closed term t terminates, thelast enriched term is in the form of A0 hv 0 i.
The forward direction of the equivalence, that is, the evaluation Eval implies
the execution Exec, follows from Thm. 2.4.4. The backward direction, that is, theexecution Exec implies the evaluation Eval , also follows from Thm. 2.4.4, because
an evaluation of the pure closed term t is in the form of LtM (∗ AhLvMi or neverterminates.

Thm. 2.4.4 also gives equations |Exec|β = |Eval |β , |Exec|σ = |Eval |σ and |Exec| =O(|Eval |β + |Eval |σ + |Eval | ). Combining these with Prop. 2.5.2 yields the desired
equations except for the last one (i.e. |Exec|R = O(|Eval |β )).
This last equation follows from an equation |Exec|R = |Exec|β that can beproved as follows. For any graph state ((G, e), δ) that appears in the execution
Exec : Init(t† ) →∗ Final (A‡ ◦ v † ), we define a measure #(G) by the number of λnodes that are outside any !-box in the graph G.
Firstly, at any point of the execution Exec, the token is inside a !-box if andonly if it has the rewrite flag ‘!’. This means that, if a λ-node gets eliminated bya rewrite transition labelled with β, the λ-node is outside a !-box. By Lem. 2.3.4,

2.5. TIME-COST ANALYSIS

55

each !-box has exactly one λ-node that directly belongs to it. It follows that eachrewrite transition labelled with  brings exactly one λ-node outside a !-box.
As a result, each rewrite transition labelled with β decreases the measure # by
one, and each rewrite transition labelled with  increases the measure # by one. No
other transitions change the measure #. Because the measure # gives zero for the
initial and final graph states Init(t† ) and Final (A‡ ◦v † ), namely #(t† ) = #(A‡ ◦v † ) =0, we have |Exec|R = |Exec|β .
The next step in the cost analysis is to estimate the time cost of each transition.
We are interested in implementing evaluation strategies, and therefore we focus ontransitions that happen in executions starting from the translation of a term. We
assume that graphs are implemented in the following particular way, for the purposesthat we will explain shortly afterwards.
Each ?-node, and its input and output, are identified and implemented as a single
link. Each link is given by two pointers to its child and its parent. If a node is not
a ?-node, it is given by its label, pointers to its inputs, and pointers to its outputs;
the pointers to inputs are omitted for C -nodes. Additionally, each link and node
has a pointer to a !-node, or a null pointer, to indicate the !-box structure it directly
belongs in. Note that each link has at most three pointers, and each node has at
most two input (resp. output) pointers, which are distinguished. The size of a graphcan be estimated using the number of nodes that are not ?-nodes. Accordingly, a
position of the token is a pointer to a link, a direction and a rewrite flag are two
symbols, a computation stack is a stack of symbols, and finally a box stack is a stackof symbols and pointers to links.
There are two key purposes of these rather involved assumptions of implementation. One purpose is to bound the number of pointers that represent each node.
Pointers to inputs are omitted at C -nodes for this purpose, because these nodes are
the only ones that can have an arbitrary number of inputs. The other purpose is toestimate that the translation of terms yields linear representation, namely that the56

CHAPTER 2. EFFICIENT IMPLEMENTATION

translation t† of each term t has the size that is linear to the size |t| of the term.
This estimation is impossible without the assumption that each !-box structure is
implemented using pointers to its principal door (!-node) and omitting auxiliary
doors (?-nodes). Without this assumption, a single variable may be translated using
multiple ?-nodes whose number can only be bounded by the size of the term, whichleads to not linear but polynomial representation.
The assumption about implementation of !-boxes is also for the purpose of determining !-boxes simply by traversing nodes, in executions that start from thetranslation of a term. At any point of these executions, each !-box already appeared
as a sub-graph of the initial graph (by Lem. 2.3.4), which is the translation of aterm. This means that the !-box is always the translation of abstraction, and moreover, every node inside the !-box is reachable from the principal door (!-node) of the!-box. The !-box structure can therefore be recovered by traversing nodes from theprincipal door. The end of traversal can be determined using the assumed pointersfrom nodes to !-nodes, and the traversal cost can be bounded by the size of the !-box.
Under the assumptions about implementation, time cost of each transition canbe finally estimated as follows. All pass transitions have constant cost. Each passtransition looks up one node and its outputs (that are either one or two) next to thecurrent position, and involves a fixed number of elements of the token data. Rewrite
transitions with the label β have constant cost, as they change a constant numberof nodes and links, and only a rewrite flag of the token data.
Rewrite transitions with the label  or σ manipulate !-boxes, namely, those withthe label  remove a !-box and those with the label σ copy a !-box. Both thesemanipulations amount to traversing nodes in the !-box, whose cost can be boundedby the size of the !-box. Additionally, rewrite transitions with the label σ update thesub-graph H 0 and a C -node connected to the copied !-box (see Fig. 2.6). Updating
cost of H 0 is bounded by the number of auxiliary doors of the !-box, which is lessthan the size of the !-box. Updating cost of the C -node is constant, because C -nodes

2.5. TIME-COST ANALYSIS

57

do not have pointers to its inputs, by the assumption about the implementation ofgraphs. Overall, rewrite transitions with the label  or σ have the time cost boundedby the size of the involved !-box.
With the results of the previous two steps, we can now give the overall time costof executions and classify our abstract machine.
Theorem 2.5.4 (Soundness and completeness, with cost bounds). For any pureclosed term t, an evaluation Eval : LtM (∗ AhLvMi terminates with the enriched term
AhLvMi if and only if an execution Exec : Init(t† ) →∗ Final (A‡ ◦ v † ) terminates withthe graph A‡ ◦ v † . The overall time cost of the execution Exec is bounded by O(|t| ·|Eval |β ).
Proof. Non-constant cost of rewrite transitions is the size of a !-box. By Lem. 2.3.4,
this size is less than the size of the initial graph t† , which can be bounded by the size|t| of the initial term. Therefore any non-constant cost of each rewrite transition, inthe execution Exec, can be also bounded by |t|. By Prop. 2.5.3, the overall time costof rewrite transitions labelled with β is O(|Eval |β ), and that of the other rewrite
transitions and pass transitions is O(|t| · |Eval |β ).
Note that the time cost of constructing the initial graph t† , and attaching a token
to it, does not affect the bound O(|t| · |Eval |β ), because it can be done in linear timewith respect to |t|. This is thanks to the assumption about implementation, namelythat ?-nodes and input pointers of C -nodes are omitted.
Corollary 2.5.5. The token-guided graph-rewriting machine is an efficient abstract
machine implementing call-by-need, left-to-right call-by-value and right-to-left callby-value evaluation strategies, in the sense of Def. 2.5.1.
Cor. 2.5.5 classifies the graph-rewriting machine as not just reasonable, but infact efficient. In terms of token passing, this efficiency benefits from the graphical representation of environments (i.e. explicit substitutions in our setting). The

58

CHAPTER 2. EFFICIENT IMPLEMENTATION

graphical representation is in such a way that each bound variable is associatedwith exactly one C -node, which is ensured by the translations (·)† and (·)‡ and therewrite transition →σ . Excluding any two sequentially-connected C -nodes is essential to achieve the efficient classification, because it yields the constant cost to lookup a bound variable and its associated computation.
As for graph rewriting, the efficient classification shows that introduction ofgraph rewriting to token passing does not bring in any inefficiencies. In our setting,graph rewriting can have non-constant cost in two ways. One is duplication costof a sub-graph, which is indicated by a !-box, and the other is elimination costof a !-box that delimits abstraction. Unlike the duplication cost, the elimination
cost leads to non-trivial cost that abstract machines in the literature usually do
not have. Namely, our graph-rewriting machine simulates a β-reduction step, in
which an abstraction constructor is eliminated and substitution is delayed, at the
non-constant cost depending on the size of the abstraction. The time-cost analysis
confirms that the duplication cost and the unusual elimination cost have the same
impact, on the overall time cost, as the cost of token passing. What is vital here is
the sub-graph property (Lem. 2.3.4), which ensures that the cost of each duplicationand elimination of a !-box is always linear in the input size.

2.6

Rewriting vs. jumping

The starting point of our development is the GoI-style token-passing abstract machines for call-by-name evaluation, given by Danos and Regnier [1996], and by Mackie[1995]. Fig. 2.17 recalls these token-passing machines as a version of the DGoIM
with the passes-only interleaving strategy (i.e. the DGoIM with only pass transitions). It follows the convention of Fig. 2.5, but a black triangle in the figure points
along (resp. against) the direction of the edge if the token direction is ↑ (resp. ↓).
Note that this version uses different token data, to which we will come back later.

2.6. REWRITING VS. JUMPING

59

Token data (d, S, B, E) consists of:• a direction defined by d ::= ↑ | ↓,• a computation stack defined by S ::=  | A : S | @ : S, and• a box stack B and an environment stack E, both defined by B, E ::= | σ : B, using exponential signatures σ ::= ? | e · σ | hσ, σi where eis any link of the underlying graph.
Pass transitions:λ⟶β@ : S, B, E@

⟶ϵ

S, B, E

D

⟶ϵ

λ

λ

S, B, E

S, B, E@@

@ : S, B, E

@ : S, B, E

D

D

S, ⋄ : B, E

S, ⋄ : B, E!

!

S, B, σ : E

S, B, σ : E

⟶ϵ

⟶ϵ

⟶ϵ

λ

λ

@ : S, B, E

𝖠 : S, B, E@@

S, B, E𝖠 : S, B, E

D

Cn

S, B, ES, σ : B, E

!

?

⟶ϵ

⟶ϵ

⟶σ

λ

λ

S, B, E

S, B, E@@

S, B, E

S, B, ECn

Cne
S, B, E!

S, σ : B, E

⟶ϵ⟶ϵ

S, σ : B, E

S, σ : B, σ

e

⟶ϵ

′

: E

⟶ϵ

𝖠 : S, B, E

⟶ϵ

⟶ϵ

Cn

e

e

S, (e ⋅ σ) : B, E

?

?

′

@

𝖠 : S, B, E

S, (e ⋅ σ) : B, E

S, ⟨σ, σ ⟩ : B, E

λ

′

⟶ϵ

S, ⟨σ, σ ⟩ : B, E

S, σ : B, E?

S, σ : B, σ′

: E

Given a term t with the call-by-need function application (@) abused, a successful execution ((t† , et ), (↑, , , , )) →∗ ((t† , ev ), (↑, , , , )) starts
at the root et of the translation t† , and ends at the root ev of the translationv † , for some sub-value v of the term t. The value v indicates the evaluation
result.
Figure 2.17: Passes-only DGoIM for call-by-name [Danos and Regnier, 1996, Mackie,
1995]

60

CHAPTER 2. EFFICIENT IMPLEMENTATION

Token-passing GoI keeps the underlying graph fixed, and re-evaluates a termby repeating token moves. It therefore favours space efficiency at the cost of time
efficiency. The repetition of token actions poses a challenge for evaluations in which
duplicated computation must not lead to repeated evaluation, especially call-byvalue evaluation [Fernández and Mackie, 2002, Schöpp, 2014b, Hoshino et al., 2014,
Dal Lago et al., 2015]. Moreover, in call-by-value the repetition of token actions
raises the additional technical challenge of avoiding repeating any associated computational effects [Schöpp, 2011, Muroya et al., 2016, Dal Lago et al., 2017]. A
partial solution to this conundrum is to focus on the soundness of the equational
theory, while deliberately ignoring the time costs [Muroya et al., 2016]. Introductionof graph reduction, the key idea of the DGoIM, is one complete solution that also
deals with the time costs. It namely avoids repeated token moves and also improves
time efficiency of token-passing GoI. Another such solution in the literature is introduction of jumps. We discuss how these two solutions affect machine design andspace efficiency.
The most greedy way of introducing graph reduction, namely the rewrites-firstinterleaving we studied in this work, simplifies machine design in terms of the variety of pass transitions and token data. First, some token moves turn irrelevant
to an execution. This is why Fig. 2.5 for the rewrites-first interleaving has fewerpass transitions than Fig. 2.17 for the passes-only interleaving. Certain nodes, like‘?’, always get eliminated before visited by the token, in the rewrites-first interleaving. Accordingly, token data can be simplified. The box stack and the environment
stack used in Fig. 2.17 are integrated to the single box stack used in Fig. 2.5. The
integrated stack does not need to carry the exponential signatures. They make surethat the token exits !-boxes appropriately in the token-passing GoI, by maintaining
binary tree structures, but the token never exits !-boxes with the rewrites-first interleaving. Although the rewrites-first interleaving simplifies token data, rewriting
itself, especially duplication of sub-graphs, becomes the source of space-inefficiency.

2.6. REWRITING VS. JUMPING

61

A jumping mechanism can be added on top of the token-passing GoI, and enables
the token to jump along the path it would otherwise follow step-by-step. Although noquantitative analysis is provided, it gives time-efficient implementations of evaluation
strategies, namely of call-by-name evaluation [Danos and Regnier, 1996] and callby-value evaluation [Fernández and Mackie, 2002]. Jumping can reduce the varietyof pass transitions, like rewriting, by letting some nodes always be jumped over.
Making a jump is just changing the token position, so jumping can be described asa variation of pass transitions, unlike rewriting. However, introduction of jumping
rather complicates token data. Namely it requires partial duplication of token data,
which not only complicates machine design but also damages space efficiency. The
duplication effectively represent virtual copies of sub-graphs, and accumulate during
an execution. Tracking virtual copies is the trade-off of keeping the underlying graphfixed. Some jumps that do not involve virtual copies can be described as a form ofgraph rewriting that eliminates nodes.
Finally, we give a quantitative comparison of space usage between rewriting
and jumping. As a case study, we focus on implementations of call-by-name/needevaluation, namely on the passes-only DGoIM recalled in Fig. 2.17, our rewrites-first
DGoIM, and the passes-only DGoIM equipped with jumping that we will recall in
Fig. 2.18. A similar comparison is possible for left-to-right call-by-value evaluation,
between our rewrites-first DGoIM and the jumping machine given by Fernández andMackie [2002].
Fig. 2.18 recalls the token-passing machine equipped with jumping, given by Danosand Regnier [1996], which is proved to be isomorphic to Krivine’s abstract machine [Krivine, 2007] for call-by-name evaluation. The machine has pass transitions
as well as the jump transition that lets the token jump to a remote position.7 Compared with the token-passing GoI (Fig. 2.17), pass transitions for nodes related to!-boxes are reduced and changed, so that the jumping mechanism imitates rewrites
7

Our on-line visualiser additionally supports this jumping machine.

62

CHAPTER 2. EFFICIENT IMPLEMENTATION

Token data (d, S, B, E) consists of:• a direction defined by d ::= ↑ | ↓,• a computation stack defined by S ::=  | A : S | @ : S, and• a box stack B and an environment stack E, both defined by B, E ::= | (e, E) : B, where e is any link of the underlying graph.
Pass transitions:⟶βλ@ : S, B, E@

⟶ϵ

S, B, E⟶ϵDe
S, B, Eλλ

S, B, E

S, B, E@@

@ : S, B, E

@ : S, B, E

D

Cn

⟶ϵ

⟶ϵ

⟶σ

λ

λ

@ : S, B, E

𝖠 : S, B, E@@

S, B, E𝖠 : S, B, E

Cn

!

⟶ϵ

⟶ϵ

⟶ϵ

λ

λ

S, B, E

S, B, E@@

S, B, E

S, B, E

!

?

⟶ϵ

λ

𝖠 : S, B, E⟶ϵ@

𝖠 : S, B, E

⟶ϵ

?

e
S, (e, E) : B, E

S, B, E

S, B, E′′S, (e , E ) : B, E

′

′

′

′

S, B, (e , E ) : E S, B, (e , E ) : E

S, B, E

Jump transition: ((G, e), (↓, S, B, (e0 , E 0 ) : E)) → ((G, e0 ), (↓, S, B, E 0 )),e

where the old position e is the output of a !-node:!

.

Given a term t with the call-by-need function application (@) abused, a successful execution ((t† , et ), (↑, , , , )) →∗ ((t† , ev ), (↑, , , , )) starts
at the root et of the translation t† , and ends at the root ev of the translationv † , for some sub-value v of the term t. The value v indicates the evaluation
result.
Figure 2.18: Passes-only DGoIM plus jumping for call-by-name [Danos and Regnier,1996]

2.6. REWRITING VS. JUMPING

machines
evaluations
implemented
size of graphsize oftoken position
size of token data

63

token-passing only
(Fig. 2.17)

rewriting added(Fig. 2.5 & Fig. 2.6)

jumping added(Fig. 2.18)

call-by-namecall-by-needcall-by-name|G0 |O(n · |G0 |)|G0 |log |G0 |O(log (n · |G0 |))log |G0 |O(n · log |G0 |)O(n · log (n · |G0 |))O(2n · log |G0 |)Table 2.1: Comparison between rewriting and jumping, case study: space usage
after n transitions from an initial state of a graph G0
involving !-boxes. The token remembers its old position, together with its current
environment stack, when passing a D-node upwards. The token uses this information and makes a jump back in the jump transition, in which the token exits a !-box
at the principal door (!-node) and changes its position to the remembered link e0 .
The quantitative comparison, whose result is stated below, shows that partial
duplication of token data impacts space usage much more than duplication of subgraphs, and therefore rewriting has asymptotically better space usage than jumping.
Proposition 2.6.1. After n transitions from an initial state of a graph of size |G0 |,space usage of three versions of the DGoIM is bounded as in Table 2.1.
Proof. The size |Gn | of the underlying graph after n transitions can be estimatedusing the size |G0 | of the initial graph. Our rewrites-first DGoIM is the only one
that changes the underlying graph during an execution. Thanks to the sub-graphproperty (Lem. 2.3.4), the size |Gn | can be bounded as |Gn | = O(nσ · |G0 |), where
nσ is the number of σ-labelled transitions in the n transitions. In the token-passing
machines with and without jumping (Fig. 2.17 and Fig. 2.18), clearly |Gn | = |G0 |.
In any of the three machines, the token position can be represented in the size oflog |Gn |.
Next estimation is of token data. Because stacks can have a link of the underlying
graph as an element, the size of token data after n transitions depends on log |Gn |.
Both in the token-passing machine (Fig. 2.17) and our rewrites-first DGoIM, at most

64

CHAPTER 2. EFFICIENT IMPLEMENTATION

one element is pushed in each transition. Therefore the size of token data is boundedby O(n · log (|Gn |)).
On the other hand, in the jumping machine (Fig. 2.18), it is only the computation
stack that has at most linear growth during execution. The other stacks (i.e. thebox stack and the environment stack) jointly grows at most exponentially, for thefollowing reason.
Possible changes that each transition can make to these two stacks are: pushinga pair (e, E) of a link e and a copy of the environment stack E onto the box stack;popping the top element of the environment stack; and simply moving the top
element from the box stack to the environment stack. Only the first one among
these changes increases the combined size of the box stack and the environment
stack. Let #(Sn ) and #(En ) be the number of links stored in the box stack and theenvironment stack, respectively, after n transitions. The combined number of links
therefore satisfies #(Sn+1 )+#(En+1 ) ≤ #(Sn )+2·#(En )+1 ≤ 2·(#(Sn )+#(En ))+1,
which implies the exponential bound #(Sn ) + #(En ) = O(2n ).
Since the jumping machine never changes the underlying graph, the size of eachlink stored in stacks is always bounded by log (|G0 |). Consequently, the combined
size of the box stack and the environment stack can be bounded by O(2n ·log (|G0 |)).
This overpowers the linear bound O(n) of the size of the computation stack, which
stores symbols A and @.
Fig. 2.19 illustrates an execution of the jumping machine where the token data,
namely the environment stack, indeed grows exponentially before the token performs any jump. The execution is on a term (λx.(λy.(λa.a)y) x) (λw.w). The term
contains nested η-expansions, and these are translated into a specific pattern of Dnodes and !-nodes that causes the exponential growth. The translation of the term
is shown in Fig. 2.19(a), where e0 , e1 , e2 , e3 are links.
Fig. 2.19(b) shows how the box stack and the environment stack evolve, until
the token reaches the link e3 for the first time. Starting from the root of the graph,2.6. REWRITING VS. JUMPING

65

𝐶1
𝐶1

𝐶1

𝜆

𝑒3

!

𝐷

𝑒2
@

𝜆

!

𝐷

𝑒1

𝐶1
@

𝜆

𝜆

!

!

𝐷

𝑒0

@

(a) Translation of a term (λx.(λy.(λa.a)y) x) (λw.w)

box stackenvironment stack(e0 , ) : (e1 , (e0 , ) : ) : (e2 , (e1 , (e0 , ) : ) : (e0 , ) : ) : (e0 , ) : (e0 , ) : (e1 , (e0 , ) : ) : (e0 , ) : (e1 , (e0 , ) : ) : (e0 , ) : (e2 , (e1 , (e0 , ) : ) : (e0 , ) : ): (e1 , (e0 , ) : ) : (e0 , ) : position
e0
e1
e2
e3

(b) Trace of the token data (selected), until the token reaches e3 for the first time

Figure 2.19: Example execution of the jumping machine: exponential growth of theenvironment stack

66

CHAPTER 2. EFFICIENT IMPLEMENTATION

the token follows the shortest (directed) path to e3 , visiting D-nodes and !-nodes
alternatively. First, the token passes a D-node. It pushes the input link e of the
D-node and a copy of the whole environment stack E (indicated by magenta in
Fig. 2.19(b)) onto the box stack. Immediately afterwards, the token passes a !-node.
It moves the new top element (e, E) of the box stack to the top of the environment
stack E. As a result, the environment stack E has become (e, E) : E, doubling insize and additionally gaining the extra element e.
By the time the token reaches the link e3 , the token repeats this doubling procedure three times in a row, and hence the environment stack exponentially grows.
Note that the token does not consume any element of the stack meanwhile. The
token does not visit any ?-nodes nor perform any jump until it reaches e3 . It is thenested η-expansions of the term that creates this behaviour here.

Chapter 3
Focussed graph rewriting forthe core calculus Spartan
3.1

OutlineThis chapter presents a semantical framework with which observational equivalence
can be proved directly by exploiting the idea of locality, the idea that naturally arises
in token-guided graph rewriting. We revise the rewrites-first DGoIM presented in
Chap. 2 for the lambda-calculus, into the Universal Abstract Machine (UAM) forthe core untyped language Spartan. All language features but three—variablebinding, name binding and thunking—have to be provided as extrinsic operations
to Spartan, with their behaviour provided as extrinsic graph-rewrite rules to the
UAM. This means that it is not necessary to classify features into intrinsic andextrinsic, or into effects and pure computation; in fact, even the function-abstraction
and application are modelled as extrinsic operations in our framework.
This chapter is organised as follows. In Sec. 3.2 we present a simple calculus(Spartan) which intermediates syntactically between languages with effects andthe focussed hypernet representation. Hypernet rewriting is overviewed in Sec. 3.3,
with enough technical detail to understand the examples of observational equivalence
listed in Sec. 3.4. The technical details of focussed hypernet rewriting, including the67

68

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

definition of the UAM, are given in Sec. 3.5. Execution of the UAM, given a variety
of pre-loaded extrinsic operations, can be seen in an on-line visualiser1 .

3.2

The Spartan calculus

The syntactic elements of Spartan are a set of variables V, (ranged over by x, y), a
set of atoms A, (ranged over by a), and a set of operations O (ranged over by φ). The
set of operations is partitioned into O = OX ] O , namely: passive operations OX(ranged over by φX ) and active operations O (ranged over by φ ). We will usuallydenote a sequence of variables x0 , . . . , xk by ~x, a sequence of atoms a0 , . . . , ak by~a, etc. These sequences may be empty, case in which we write −. We denote thelength of a sequence ~x by |~x|. If convenient we may treat the sequences as sets; forexample, we write y ∈ ~x if y appears in the sequence ~x, and we denote the set ofcommon elements between two sequences ~x and ~y by ~x ∩ ~y .
Definition 3.2.1 (Spartan terms). The terms of Spartan, typically ranged overby s, t, u, are generated by the grammar:
t ::= x | a | new a ( t in t | bind x → t in t | ~y .t | φ(~t; ~t).
The term formers are variables, names, name binding, variable binding, thunking
and operations. Note that the sequences above may be empty. In particular, thunking may be applied without binding any variable (−.t), in which case we may simply
write t. In the formation of an operation term φ(~s; ~t) arguments ~s are used eagerly
and the arguments ~t lazily (we also say they are deferred ). The eager arguments areevaluated in the given order, whereas the evaluation of lazy arguments is deferred.
The distinction between name-binding and variable-binding will be seen to play a
crucial role in the management of sharing vs. copying during execution.
1

Link to the on-line UAM visualiser: https://tnttodda.github.io/Spartan-Visualiser/3.2. THE SPARTAN CALCULUS

69

The calculus provides only the most basic infrastructure. All interesting computational content must be concretely provided as extrinsic operations. The following
is a non-exhaustive list of such operations which may be added to the Spartan
framework. These operations can be used to write Spartan terms that recursively
compute the factorial of five, for example, as shown in Fig. 3.1.
Some passive operations (constructors) that can be added to Spartan are nudef

def

def

merical constants (n = n(−; −)), boolean constants (tt = tt(−; −) and ff =
def

def

ff(−; −)), pairing (ht, ui = P(t, u; −)), empty tuple (hi = hi(−; −)), injections
def(inji (t) = inji (t; −), i ∈ {1, 2}), etc.
Some examples of active Spartan operations are successor (succ(t)
def

def

=

def

succ(t; −)), addition (t + u = +(t, u; −)), conjunction (t & u = &(t, u; −)), condef

def

ditionals (if t then u1 else u2 = if(t; u1 , u2 )), recursion (µx.t = µ(−; x.t)),def

sequential composition (t; u = ;(t; u) where the operation ‘;’ is distinguished fromthe punctuation ‘;’) etc.
Datatype destructors can also be added as active operations, for example projecdef

tions (πi (t) = πi (t; −), i ∈ {1, 2}), pattern matching (match t with x1 7→ u1 , x2 7→
def

u2 = match(t; x1 .u1 , x2 .u2 )), etc.
Operations with multiple arguments can come in different flavours depending
on order of evaluations and eagerness. For example conjunction can be left-to-right&(t, u; −), right-to-left &(u, t; −), or short-cut &(t; u) that evaluates u only whenthe evaluation result of t is true (tt). Pairs can be also evaluated left-to-right (asabove), but also, right-to-left, or lazily.
Most strikingly, abstraction and application themselves can be presented as opdef

erations. Abstraction is simply a thunking of the function body: λx.t = λ(−; x.t),
whereas application can be defined by-name or by-value, left-to-right or right-to−
def
def →
left: t u = @(t; u)(call-by-name), t u = @ (t, u; −)(left-to-right call-by-value), or−def ←t u = @ (u, t; −)(right-to-left call-by-value).
Algebraic operations are operations of certain arity and equational properties,

70

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

Simple recursion: with and without syntactic sugarbind fact → µf. λx. if x = 1 then 1 else x × (f (x − 1))in fact 5bind fact → µ(-; f. λ(-; x. if(=(x, 1(-; -); -);-.1(-; -),−→-.×(x, @ (f, −(x, 1(-; -); -); -); -))))−→
in @ (fact, 5(-; -); -)Tail recursion using pairs: with and without syntactic sugarbind factT → µf. λn. if π2 (n) = 1 then π1 (n)else f hπ1 (n) × π2 (n), π2 (n) − 1iin factT h1, 5i
bind factT → µ(-; f. λ(-; n. if(=(π2 (n; -), 1(-; -); -);-.π1 (n; -),−→-. @ (f, P(×(π1 (n; -), π2 (n; -); -),−(π2 (n; -), 1(-; -); -); -); -))))−→
in @ (factT , P(1(-; -), 5(-; -); -); -)Recursion using state: with and without syntactic sugarbind factS → new a ( 1 inµf. λx. if x = 1 then !a else ((a := !a × x); f (x − 1))in factS 5
bind factS → new a ( 1(-; -) inµ(-; f. λ(-; x. if(=(x, 1(-; -); -);-.deref(a; -),-.; (assign(a, ×(deref(a; -), x, ; -); -);−→-. @ (f, −(x, 1(-; -); -); -)))))−→
in @ (factS , 5(-; -); -)Figure 3.1: Spartan terms with extrinsic operations (highlighted in magenta)

3.2. THE SPARTAN CALCULUS

71

designed to characterise a class of computational effects [Plotkin and Power, 2003].
All examples of algebraic operations from loc. cit. can be presented as (active)
Spartan operations. Non-deterministic choice t(−; u1 , u2 ) selects one of its deferredargument non-deterministically; equipping it with a probability p ∈ [0, 1] yields a
probabilistic choice tp (−; u1 , u2 ). Interactive input read(−; x.u) assigns an input
value to bound variable x, whereas interactive output write(t; u) produces the resultof evaluating (eager) argument t as an output value. Both operations continue withthe deferred argument u. State lookup and update take form lookup(t0 ; x.u) and,
respectively, update(t0 , t; u). The difference from interactive I/O is that the firsteager argument t0 is evaluated to yield an atom, which serves as a location in a
def

def

store. In their generic form, state operations !t0 = deref(t0 ; −) and t0 := t =assign(t0 , t; −) return a stored value and the empty pair, respectively, instead ofcontinuing with a deferred argument. Finally, creation of a local state, in the genericform, is modelled by ref(t; −) that stores evaluation result of t to a fresh location(atom) and returns it.

Effect handlers are studied as a generalisation of exception handlers to algebraic
effects in Plotkin and Pretnar [2013]. In our setting, a handler that targets operations
φ1 , . . . , φm can be constructed by a passive operation handlerφ1 ,...,φm tagged withthe targets. It is natural to assume that targeted operations are never passive (e.g.
lambda-abstraction, pairing operation, injection, and handlers themselves). These
handler constructors are a (rare) example in which a deferred argument may bindmore than one variables. A handler can be then used with the handling operation
with handle(t, u; −) to evaluate u with handler t.
Control operators are similarly dealt with. The undelimited control operator
call/cc can be defined as:
defcallcc(t) = callcc(−; t),defabort(t) = abort(−; t)72

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

The delimited control operator shift/reset of Danvy and Filinski [1990] can be
defined as:
def

shift(t) = shift(−; t),

3.2.1

def

reset(t) = reset(t; −).

The Spartan type system

The type system is primarily used to distinguish thunks from eager terms and toensure terms are well formed. However, this type system does not enforce any notionof run-time safety.
Terms are defined by τ ::= ? | T m (?) where m ∈ N. Eager terms have type ? andthunks have type T m (?) for some m ∈ N, representing the number of bound variables
that accompany the thunk. Note that T 0 (?) is a valid type and that T 0 (?) 6= ?. A
sequence τ1 , . . . , τn of types is denoted by an expression ⊗ni=1 τi . This is empty if
n = 0, and equal to a single type if n = 1, i.e. ⊗1i=1 τ = τ . The empty sequence is00

written as . We use syntactic sugar τ ⊗n ≡ ⊗ni=1 τ , and τ ⊗n ⊗ τ ⊗n = τ ⊗(n+n ) .
Each operation φ ∈ O has an arity, given in the form of φ ` (me ; ~n) ∈ N × Nmd .
It indicates that the operation φ takes me eager arguments and md thunks. The
sequence ~n specifies the number of bound variables each thunk expects.
For a type τ and a term t, judgements are written as ~x | ~a ` t : τ , where all
variables in ~x and all atoms in ~a are distinct. The rules are given in Fig. 3.2, where|~x| = k, |~y | = n, |~a| = h. If − | − ` t : ? is derivable, term t is called a program.

3.2.2

Semantics of bindings: copying vs. sharing

We opt for simple semantics of bindings, that is, bound computation (u in bind x →u in t or new a ( u in t) is not evaluated eagerly. In variable binding bind x →u in t, moreover, the bound computation u is evaluated as many times as the variable
x is required in t. The eager version of variable binding, where u is always evaluatedexactly once, can be actually included in Spartan as a single extrinsic operationlet(u; x.t). On the other hand, the lazy version, where u is evaluated at most3.2. THE SPARTAN CALCULUS~x | ~a ` xi : ?

1≤i≤k~x | ~a ` u : ? ~x, x | ~a ` t : ?
x∈/ ~x~x | ~a ` bind x → u in t : ?

73~x | ~a ` aj : ?

1≤j≤h~x | ~a ` u : ? ~x | a, ~a ` t : ?
a∈/ ~a~x | ~a ` new a ( u in t : ?

~y , ~x | ~a ` t : ?
n = |~y |, ~x ∩ ~y = ∅~x | ~a ` ~y .t : T n (?)φ ` (m; ~n) ∈ N × Np{~x | ~a ` sj : T nj (?)}pj=1{~x | ~a ` ti : ?}mi=1~x | ~a ` φ(~t; ~s) : ?

Figure 3.2: The Spartan type systemonce, would require combination of extrinsic operations (à la CPS transformation
for the call-by-need lambda-calculus [Okasaki et al., 1994]) or an additional intrinsic
mechanism of Spartan such as memoisation.
Roughly speaking, the two kinds of binding in Spartan, namely variable binding
and name binding, deal with copying and sharing of computation respectively. In
variable binding bind x → u in t, the bound variable x is expected to be substitutedby its associated term u. This means that multiple occurrences of x in t would require
copying of u. On the other hand, in name binding new a ( u in t, the bound namea is expected to act merely as the unique reference to (or literally, the unique nameof) its associated term u. Even if the bound name a occurs multiple times in t, its
associated computation u remains shared. The shared computation u can only beaccessed by extrinsic operations, such as deref(t0 ; −) and assign(t0 , t; −) that we
mentioned earlier, using the name a.
The copying behaviour of variable binding and the sharing behaviour of namebinding are combined in Spartan, in such a way that shared computation is nevercopied unless it is deferred. In other words, the copying power of variable binding is
restricted, so that it does not violate sharing that is already caused by name binding.
→−We illustrate this below, using the aforementioned extrinsic operations λ and @ forthe lambda-calculus. What determines the restriction of duplication is where name

74

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

binding appears, namely whether name binding appears inside a thunk (i.e. deferredcomputation).
→−Firstly, in a term bind x → (new a ( u in λ(−; y.t)) in @ (x, x; −), the namebinding new a ( u in λ(−; y.t) appears outside any thunk, and hence is not deferred.
This means that the computation u is already shared, and is never copied by variablebinding. Reduction of the term would be as below:→−bind x → (new a ( u in λ(−; y.t)) in @ (x, x; −)→−new a ( u in bind x → λ(−; y.t) in @ (λ(−; y.t), λ(−; y.t); −)(3.1)

where the variable binding for x can only copy the term λ(−; y.t). The sharedcomputation u is kept shared via the unique name a across all the copies of theterm λ(−; y.t). Note that the type system ensures that the bound variable x does
not appear in the shared computation u, which allows the name binding and thevariable binding to be commutative.
→−
On the other hand, in a term bind x → λ(−; y.(new a ( u in t)) in @ (x, x; −),the name binding new a ( u in t appears inside a thunk. Sharing of the computationu is considered to be delayed accordingly, and reduction of the term would be as
follows:→−bind x → λ(−; y.(new a ( u in t)) in @ (x, x; −)bind x → λ(−; y.(new a ( u in t)) in→−@ (λ(−; y.(new a ( u in t)), λ(−; y.(new a ( u in t)); −).

(3.2)

In contrast to reduction (3.1), the variable binding for x is allowed to copy the wholeterm λ(−; y.(new a ( u in t)) including name binding.
Although it would be possible to define reduction semantics of Spartan, we
leave it for future work and opt for focussed graph-rewriting semantics. The fo-

3.3. OVERVIEW OF FOCUSSED GRAPH REWRITING

75

cussed graph-rewriting semantics can model the subtle interplay between copying
and sharing, namely the rather complicated behaviour of variable binding, in a simpler way than the reduction semantics. This is due to the name-free representationof terms as graphs where bindings are maintained simply by connections.
Representing terms as graphs is crucial also to develop a proof methodology ofobservational equivalence, in which one can directly analyse how sub-terms evolve
during evaluation. The analysis can be done simply by looking at sub-graphs, which
may not represent a term. For example, in reduction (3.1) above, the name binding
new a ( u in λ(−; y.t) syntactically evolves into two copies of the sub-term λ(−; y.t)
and a string “new a ( u in” that is not itself a sub-term. In the corresponding focussed graph-rewriting, however, the graph representation of new a ( u in λ(−; y.t)would evolve into three sub-graphs that represent the sub-terms λ(−; y.t), λ(−; y.t),
and the string “new a ( u in”. This suggests that the direct analysis is difficult bymeans of sub-terms, but instead possible by means of sub-graphs.

3.3

Overview of focussed graph rewriting

3.3.1

Monoidal hypergraphs and hypernets

Given a set X we write by X ∗ the set of elements of the free monoid over X. Givena function f : X → Y we write f ∗ : X ∗ → Y ∗ for the point-wise application (map)of f to the elements of X ∗ .
Definition 3.3.1. A monoidal hypergraph is a pair (V, E) of finite sets, vertices and(hyper)edges, along with a pair of functions S : E → V ∗ , T : E → V ∗ defining thesource list and target list, respectively, of an edge.
Definition 3.3.2. A labelled monoidal hypergraph consists of a monoidal hypergraph, a set of vertex labels L, a set of edge labels M , and labelling functions
fV : V → L, fE : E → M such that:

76

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN• For any edge e ∈ E, its source list S(e) consists of distinct vertices, and its
target list T (e) also consists of distinct vertices.
• For any vertex v ∈ V there exists at most one edge e ∈ E such that v ∈ S(e)and at most one edge e0 ∈ E such that v ∈ T (e0 ).
• For any edges e1 , e2 ∈ E if fE (e1 ) = fE (e2 ) then fV∗ S(e1 ) = fV∗ S(e2 ) , andfV∗ T (e1 ) = fV∗ T (e2 ) .

In words, the label of an edge is always consistent with the number and labellingof its endpoints. This makes it possible to use the vertex labels as types for edge
labels. Given m ∈ M we can write m : x ⇒ x0 for x, x0 ∈ L∗ such that x = fV∗ S(e)and x0 = fV∗ T (e) for any e ∈ E such that fE (e) = m.
If a vertex belongs to the target (resp. source) list of no edge we call it an input(resp. output).
Definition 3.3.3. A labelled monoidal hypergraph is interfaced if inputs and outputs are respectively ordered, and no vertex is both an input and an output.
We can type an interfaced hypergraph G : fV∗ (I) ⇒ fV∗ (O) where I, O are thelists of inputs and outputs, respectively. Note that a single hypergraph can beinterfaced, and hence typed, in several ways. Interfaces (i.e. pairs of a list of inputs
and a list of outputs) of the same hypergraph are given by permutations of inputs
and permutations of outputs.
Definition 3.3.4 (Interface permutation). Let G be a hypergraph with an input
list i1 , . . . , in and an output list o1 , . . . , om . Given two bijections ρ and ρ0 on sets
0{1, . . . , n} and {1, . . . , m}, respectively, we write Πρρ (G) to denote the hypergraphthat is defined by the same data as G except for the input list iρ(1) , . . . , iρ(n) and theoutput list oρ0 (1) , . . . , oρ0 (m) .
In the sequel, when we say hypergraphs we always mean interfaced labelled monoidal
hypergraphs.

3.3. OVERVIEW OF FOCUSSED GRAPH REWRITING

k

Y
l

l

GY

Y

l

X
m

m

GY

GY

GX

GX

l l"

l l"

l l"

X
m

k

k

Y

k

77

l

X
m

m

l l"

GX
m

m

(a) Hypergraph (b) Graph representation (c) Eliding some nodesm(d) Identity lines

Figure 3.3: Graphical conventions

Definition 3.3.5 (Hypernets). Given a set of vertex labels L and edge labels M wewrite H(L, M ) for the set of hypergraphs with these labels; we also call these level-0
hypernets H0 (L, M ). We call level-(k+1) hypernets the set of hypergraphs

Hk+1 (L, M ) = H L, M ∪

[

i≤k


Hi (L, M ) .

We call (labelled monoidal) hypernets the set Hω (L, M ) =Si∈N Hi (L, M ).

Informally, hypernets are nested hypergraphs, up to some finite depth, using thesame sets of labels. An edge labelled with a hypergraph is called box edge, and a
hypergraph labelling a box edge is called content. Edges of a hypernet G are said tobe shallow . Edges of nesting hypernets of G, i.e. edges of hypernets that recursively
appear as edge labels, are said to be deep edges of G. Shallow edges and deep edges
of a hypernet are altogether referred to as edges at any depth.

78

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

3.3.2

Graphical conventions

A monoidal hypergraph G with vertices V = {v0 , v1 , v2 , v3 , v4 , v5 } and edges E ={e0 , e1 } such that
S(e0 ) = {v0 , v1 }T (e0 ) = S(e1 ) = {v2 , v3 , v4 }T (e1 ) = {v5 }fV = {v0 7→ m, v1 7→ m0 , v2 7→ l, v3 7→ l0 , v4 7→ l00 , vk 7→ k}
fE = {e0 7→ X, e1 7→ Y }is normally represented as Fig. 3.3a. However, this style of representing hypergraphs
is awkward for understanding their structure. We will often graphically represent
hypergraphs as graphs, like Fig. 3.3b, with both vertices and edges drawn as nodes
marked by their labels and connecting input vertices with edges, and edges with
output vertices using arrows. To distinguish them, the edge labels are circled.
Since the node labels are often determined in our typed graphs by the edges we
can omit them to avoid clutter, showing only the edges and the way they link. The
graph G would be drawn like Fig. 3.3c.
Sometimes we will draw a hypergraph so that to identify sub-graphs of interest.
In this case we may draw interface nodes twice and connect them with arrowlesslines which indicate identity, i.e. the nodes at either ends are two graphical representations of the same node. If it is obvious from context we may just draw theidentity lines between the sub-graphs, or just one line if the entire input interface
of a sub-graph is identified with the entire output interface of another sub-graph.
For example, the graph G can be drawn like Fig. 3.3d, where GX and GY are thesub-graphs consisting just of edge e0 (labelled with X) and e1 (labelled with Y ),respectively.

3.3. OVERVIEW OF FOCUSSED GRAPH REWRITING79

The final conventions are that a bunch of parallel arrows can be drawn as a single
arrow with a dash across, and that a hypergraph-labelled edge is indicated with adotted box, and decorated with its type.

3.3.3

From terms to hypernets

We represent terms in Spartan as hypernets with vertex labels either τ or , ranged
over by `. The same notational conventions apply, extended with the extra symbol
. The edge labels have unique types, and they are: the operations φ (with theedge-label-type inherited from the Spartan type system), an instance label I :? ⇒ , an atom label ◦ :  ⇒ ?, a family of weakening and contraction labels{⊗`W :  ⇒ `, ⊗`C : `⊗2 ⇒ ` | ` ∈ {?, }}, a family of token labels ?, X,: ? ⇒ ?. Whena hypergraph is used as an edge label it must always have type G : ? ⇒ ?⊗n ⊗ ⊗h ;the box edge is assigned type T n−k (?) ⇒ ?⊗k ⊗ ⊗h for some k ≤ n.
The hypernet is said to be focussed if: there exists only one token-labelled edge,
the token-labelled edge is shallow, and the hypernet satisfies some other basic wellformedness conditions discussed later.
To graphically represent multiple occurrences of a single variable or a single atom,`
we will define and use a family of sub-graphs Dk,m: `⊗km ⇒ `⊗k with ` ∈ {, ?}which we call distributors (Def. 3.5.6). Intuitively, they are the k-interleaving of
?

?

⌦

⌦

∗
bunches of m-contraction edges, for instance, D2,3=⌦ ⌦ ⌦ ⌦
??

⇧ ⇧ ⇧

⌦

⌦

??

??


and D3,0= ⌦⌦⌦.

†The translation function (−) from Spartan terms to hypernets is given in
Fig 3.4, where m
i=1 Gi is a hypernet formed of a family of hypernets (Gi : ? ⇒?⊗ki ⊗ ⊗hi ) placed side by side. We can easily see that the hypernet of a Spartan
program always has type (− | − ` t : ?)† : ? ⇒ , i.e. one input and no outputs.
The hypernet of a program is focussed by adding a ? token in the input position.

80

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN<latexit sha1_base64="Jh2nZzjufDgZup8qpLmTcuu8HLc=">AAAB+nicbVBNS8NAEN3Ur1q/Uj16WSyCp5KIoMeCF48V7Ac0sWy2m3bpZjfsTpQS+1O8eFDEq7/Em//GbZuDtj4YeLw3w8y8KBXcgOd9O6W19Y3NrfJ2ZWd3b//ArR62jco0ZS2qhNLdiBgmuGQt4CBYN9WMJJFgnWh8PfM7D0wbruQdTFIWJmQoecwpASv13WpggOj7PFDAE2bweNp3a17dmwOvEr8gNVSg2Xe/goGiWcIkUEGM6fleCmFONHAq2LQSZIalhI7JkPUslcTuCfP56VN8apUBjpW2JQHP1d8TOUmMmSSR7UwIjMyyNxP/83oZxFdhzmWaAZN0sSjOBAaFZzngAdeMgphYQqjm9lZMR0QTCjatig3BX355lbTP675X928vag1cxFFGx+gEnSEfXaIGukFN1EIUPaJn9IrenCfnxXl3PhatJaeYOUJ/4Hz+AJeWlBc=</latexit>?⌦k<latexit sha1_base64="Sl3Iz1RFB6udTwUrnAKCXS0z8J0=">AAAB/XicbVDLSsNAFL2pr1pf8bFzM1gEVyURQZcFNy4r2Ae0sUwmk3boZCbMTIQair/ixoUibv0Pd/6N0zYLbT1w4XDOvdx7T5hypo3nfTulldW19Y3yZmVre2d3z90/aGmZKUKbRHKpOiHWlDNBm4YZTjupojgJOW2Ho+up336gSjMp7sw4pUGCB4LFjGBjpb571IsYTqSI7vOeNCyhGg0nfbfq1bwZ0DLxC1KFAo2++9WLJMkSKgzhWOuu76UmyLEyjHA6qfQyTVNMRnhAu5YKbPcE+ez6CTq1SoRiqWwJg2bq74kcJ1qPk9B2JtgM9aI3Ff/zupmJr4KciTQzVJD5ojjjyEg0jQJFTFFi+NgSTBSztyIyxAoTYwOr2BD8xZeXSeu85ns1//aiWkdFHGU4hhM4Ax8uoQ430IAmEHiEZ3iFN+fJeXHenY95a8kpZg7hD5zPH86ilVQ=</latexit>

⇧⌦h

?
Dk,m
e +md

⇧
Dh,m
e +md

?⌦kme ?⌦kmd⇧⌦hme ⇧⌦hmd?⌦kme⇧⌦hme ?⌦kmd
⇧⌦hmd
†
†
md
e
ni
⇥m
(~
x
|
~
a
`
t
:
?)
⇥i=1 ~x | ~a ` si : T (?)
i
i=1
md
O
?⌦me
T ni (?)<latexit sha1_base64="0m85L7A0QOr3/Pd534B/envctc0=">AAACAXicbVDLSsNAFJ3UV62vqBvBzWARXJVEBF0W3LisYB/QxDCZTNqh8wgzE6GEuvFX3LhQxK1/4c6/cdpmoa0HLhzOuZd774kzRrXxvG+nsrK6tr5R3axtbe/s7rn7Bx0tc4VJG0smVS9GmjAqSNtQw0gvUwTxmJFuPLqe+t0HojSV4s6MMxJyNBA0pRgZK0XuUZBQxKVI7otAGsqJhkPIIzKJ3LrX8GaAy8QvSR2UaEXuV5BInHMiDGZI677vZSYskDIUMzKpBbkmGcIjNCB9SwWyu8Ji9sEEnlolgalUtoSBM/X3RIG41mMe206OzFAvelPxP6+fm/QqLKjIckMEni9KcwaNhNM4YEIVwYaNLUFYUXsrxEOkEDY2tJoNwV98eZl0zhu+1/BvL+pNWMZRBcfgBJwBH1yCJrgBLdAGGDyCZ/AK3pwn58V5dz7mrRWnnDkEf+B8/gCDRZbN</latexit>

i=1

?
†
~x | ~a ` (~t; ~s)?⌦(i 1)?⌦(k i)?

?
Di? 1,0 D1,1
Dk? i,0?
(~x | ~a ` xi : ?)†

?⌦k
?
Dk,0

⇧⌦(j 1)
Dj⇧ 1,0

⇧

D1,1
I

?

?⌦k
?⌦k

~y , ~x | ~a ` t : ?
?
T n (?)
†

⇧⌦h
⇧
Dh,2

?⌦k
?
Dk,2

⇧⌦h
⇧
Dh,2

?⌦k ?⌦k⇧⌦h ⇧⌦h?⌦k ?⌦k⇧⌦h ⇧⌦h?⌦k⇧⌦h(~x | ~a ` u : ?)†?
⇧⌦(h j)Dh⇧ j,0?
(~x | ~a ` aj : ?)†

⌦n

?⌦k
?
Dk,2

⇧⌦h
⇧
Dh,0

⇧⌦h
⇧⌦h
†

~x | ~a ` ~y .t : T n (?) , where |~y | = n?⌦k⇧⌦h(~x | ~a ` u : ?)†
?

?⌦k ?
⇧⌦h
?⌦k
⇧
⇧⌦h
(~x, x | ~a ` t : ?)†(~x | a, ~a ` t : ?)†?
?
(~x | ~a ` bind x ! u in t : ?)† (~x | ~a ` new a ( u in t : ?)†
?⌦(

Pm

?⌦(

1

i=1

Pm

i=1

1

ki ) ⌦km ⌦(?

⇧ki ) ⌦(Pm⇧⇥m
i=1 Gi1⌦m
i=1 ⌧i

i=1

Pm

1

i=1

hi )

1

hi )
<latexit sha1_base64="iTIPAyFESbZbAw9xmE48aUelo9I=">AAAB/3icbVDLSsNAFJ3UV62vqODGzWARXJVEBF0W3LisYB/QxDCZTNqh8wgzE6HELvwVNy4UcetvuPNvnLZZaOuBC4dz7uXee+KMUW0879uprKyurW9UN2tb2zu7e+7+QUfLXGHSxpJJ1YuRJowK0jbUMNLLFEE8ZqQbj66nfveBKE2luDPjjIQcDQRNKUbGSpF7FCQUcSmS+yKQhnKi4TDik8itew1vBrhM/JLUQYlW5H4FicQ5J8JghrTu+15mwgIpQzEjk1qQa5IhPEID0rdUILspLGb3T+CpVRKYSmVLGDhTf08UiGs95rHt5MgM9aI3Ff/z+rlJr8KCiiw3ROD5ojRn0Eg4DQMmVBFs2NgShBW1t0I8RAphYyOr2RD8xZeXSee84XsN//ai3oRlHFVwDE7AGfDBJWiCG9ACbYDBI3gGr+DNeXJenHfnY95accqZQ/AHzucPXnuWNA==</latexit>⇧⌦hm?⌦km ⇧⌦hm
Gm⌧m⇥m
i=1 Gi , m > 0

Figure 3.4: Hypernet semantics of Spartan⇥0i=1 Gi

3.3. OVERVIEW OF FOCUSSED GRAPH REWRITING

3.3.4

81

Focussed rewriting

In this section we illustrate an abstract machine for rewriting hypernets of Spartan
terms, thus giving a notion of evaluation for the calculus. The machine, dubbed Universal Abstract Machine (UAM), is based on the DGoIM presented in Chap. 2, which
it generalises for the modelling of effects. The full technical details are presented
later, in Sec. 3.5.
In a conventional reduction semantics a subtle and often complex aspect of the
reduction bureaucracy is the identification and isolation of a sub-term which is aredex from the context [Felleisen and Hieb, 1992]. Similarly, in an abstract machinemuch of the work consists of moving information (representing the context) on andoff the stack in order to reach redexes [Wright and Felleisen, 1994]. In both cases theformal machinery identifies an implicit focus of action which either moves aroundthe term or is acted upon via a substitution. In the case of focussed graph rewriting
the focus is represented by the token edge. The redex search is defined by the local
interaction between the token and the neighbouring edges, which can cause the token
to navigate the graph. The same local interactions can determine a rewrite action.
The state of the token edge determines the possible actions. If the token is ?
then the applicable rules (interaction rules) are search rules, which do not change
the underlying graph; the ? token always travels in the direction of the edges and it
is searching for a redex. In comparison to a conventional reduction semantics thisis a narrowing of the term-in-context. If the token is X then the applicable rules
are also search (interaction) rules but the token travels against the direction of theedges. In comparison to a reduction semantics this is a widening of the term-incontext normally following the detection of a value. Finally, if the token isthen arewrite is about to be performed at the very next step.
Interaction rules are in Fig. 3.5. These rules capture the intuition behind redex
search discussed earlier:

82

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

?

?

?

⇧

⇧

⌦

⌦

⌦

⌦

I

I

?

?

?

X

?

?

?

?

?

•

?
?

?

•
? !
7

7!
?

?

?

?

?

?

(1a)

•

?
?

?

?

7!

(1b)
?

⌦k

?

?

N

?⌦k

?

iT

? ?

X

N

iT

ni

(?)

?

?

?⌦k

⌦k

?

iT

ni

(?)

??

•

?

⌦k0

?

?

N

7!

?

?
?

(?)

?

(2)
⌦k0

ni

(3)
N

iT

ni

(?)

?
•

7!
?

?

(4)
?⌦k

?
X
?

N

iT

ni

(?) ?⌦k

t

?

N

iT

ni

(?)

?

?
t

?

•

7!

t

t 2 { , X}
(5a)

?

N

iT

ni

(?)

N

iT

ni

t

t

?

?

?

•

7!

(?)

t

?
?
t 2 { , X}
(5b)

Figure 3.5: Interaction rules

Rule 1. When encountering a contraction (⊗) the search token (?) becomes arewrite token ( ) as a copying action will follow. This rule has two sub-rules depending on whether the focus is on the left or right branch.
Rule 2. When encountering an instance edge (I) the search token (?) changes to avalue token (X) as atoms block both evaluation and copying.
Rule 3. When encountering an operation (ψ) with at least one eager argument the
search token (?) will inspect the first argument.
Rule 4. After resolving a (k + 1)-th eager argument of an operation (ψ) the value
token (X) changes to a search token (?) which proceeds to inspect the next eager
argument, if it exists.
Rule 5a. After all eager arguments of an operation ψt (t ∈ {X, }), the token willchange to a t-token depending on the kind of operation ψt is, value or rewrite. (Rule5b. is a degenerate version for operations with no eager arguments).

3.4. OBSERVATIONAL EQUIVALENCE

83

Once the token is , it triggers a rewrite. There are two kinds of rewrites: those
intrinsic to the Spartan calculus and those extrinsic, defined by the operations.
The intrinsic rewrites are only copying of sub-graphs, and they are triggered whenatoken interacts with contraction ⊗. The extrinsic rewrites represent actual

computation with the operations, and they are triggered when atoken interacts

with an active operation φ .
Fig. 3.6 shows an example of focussed rewriting, given a hypernet with opera→−
tions λ(−; x.t) (abstraction) and @ (t, u; −) (left-to-right call-by-value application).
This example corresponds to an evaluation of a lambda-term (λx.x) (λy.y) with theleft-to-right call-by-value strategy, and it is a counterpart of the DGoIM execution•
presented in Fig. 2.8 (Chap. 2). In the example, steps →apply the interaction rules,

and steps → perform the extrinsic and intrinsic rewrites, whose actual definition will→−
be presented in Sec. 3.4 and Sec. 3.5.4. A token interacts with the application @in the first rewrite, and with contraction ⊗ in the second rewrite.

3.4

Observational equivalenceThis section formulates some desirable observational equivalences of Spartan. They
hold in general in well-behaved languages, but the Spartan framework is broad
enough to allow the definition of operations that would break these and most equivalences. This is why we would refer to them for now as desiderata. Later in Sec. 4.5,
we will show that they hold with respect to some of the operations discussed inSec. 3.2.
Recall that our framework is parametrised by an operation set O. Our notion ofequivalence is additionally parametrised by a set BO (behaviour ) of extrinsic rewrites
associated with the operations O. Given two derivable judgements ~x | ~a ` t1 : ? and~x | ~a ` t2 : ?, we write BO |= (~x | ~a ` t1 †all t2 : ?) (resp. BO |= (~x | ~a ` t1 '†all t2 :?)) if the hypernet of t1 is a refinement (resp. equivalence) of t2 in any context, with

84

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

⋆

⋆

⋆

⋆

⋆

⋆

⋆
𝑇

1

𝑇

1

𝜆

𝜆

⋆

⋆

𝑇

1

⋆

⋆

(⋆)

𝑇

⋆

⋆

⋆

(⋆)

⋆

⋆

⋆

(⋆)

⋆

1

⋆

(⋆)

𝜆

𝜆

⋆

⋆

𝑇

∙

1

⋆

(⋆)

𝑇

1

(⋆)

𝜆

𝜆

⋆

⋆

∙

⟶

⟶

@
?

✓

⋆

⋆

⋆

?

@

@

⋆

⋆

⋆

⋆

⋆

⋆

⋆

⋆

⋆

⋆
𝑇

1

𝑇

1

𝜆

𝜆

⋆

⋆

𝑇

∙

1

𝑇

1

⋆

(⋆)

𝜆

𝜆

⋆

⋆

𝑇

∙

⟶

⟶

⋆

⋆

(⋆)

⋆

⋆

⋆

(⋆)

⋆

⋆

⋆

(⋆)

⋆

1

⋆

(⋆)

𝑇

1

(⋆)

𝜆

𝜆

⋆

⋆

∙

⟶

@
?

✓

⋆

⋆

⋆

@

@

⋆

⋆

⋆

⋆

⋆

⋆

⋆

1

𝑇

𝜆

1

𝑇

𝜆

1

(⋆)

1

𝜆

𝜆

⋆

⋆

⋆

⋆

⟶

⋆

⋆

⋆

?

⋆

𝑇

1

(⋆)

⋆
𝑇

1

(⋆)

𝜆

𝜆

⋆

⋆

∙

⟶

⋆

⋆

(⋆)

∙

⟶

⋆

⋆
𝑇

⋆

⋆

⋆

(⋆)

⋆

⋆

⋆

(⋆)

⋆

⋆

⋆
𝑇

⋆

?

⋆

⟶

⋆

⋆

⋆

Figure 3.6: Example execution of the UAM

✓

⋆

⋆

⋆

3.4. OBSERVATIONAL EQUIVALENCE

85

the operation set being O and extrinsic rewrites being BO . In particular, we write
BO |= (~x | ~a ` t1 †bf t2 : ?) (resp. BO |= (~x | ~a ` t1 '†bf t2 : ?)), if the refinement(resp. equivalence) holds only in the contexts that do not bind a hole to a variable
nor an atom. These concepts are formally defined in Sec. 4.2.1.
In the sequel, we simply write t1 †all t2 etc., omitting the type ? and the sequences ~x and ~a, and making the parameter BO implicit.

3.4.1

Structural laws

Before considering equivalences involving specific operations, it is useful to examine
structural equivalences, which focus on intrinsic features of Spartan. Let fv (t) andfa(t) be the sets of free variables and free atoms of a term, respectively, defined as
usual.
Desiderata 3.4.1 (Coherences).

bind x → t in bind y → u in s '†all bind y → u in bind x → t in s

(3.3)

(whenever x 6∈ fv (u), y 6∈ fv (t))
new a ( t in new b ( u in s '†all new b ( u in new a ( t in s

(3.4)

(whenever a 6∈ fa(u), b 6∈ fa(t))
bind x → (bind y → u in t) in s '†all bind y → u in bind x → t in s

(3.5)

(whenever y 6∈ fv (s))
new a ( (new b ( u in t) in s '†all new b ( u in new a ( t in s

(3.6)

(whenever b 6∈ fa(s))
The second batch of laws concern non-generative terms defined below. Suchterms are referentially transparent, in the sense that they can be safely replicated or
substituted in other terms:
Definition 3.4.2 ((Non-)generative terms). A term is said to be generative if it

86

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN?⌦k ⇧⌦h? ?⌦k ⇧⌦h
G

~`
GS

~`
GS

T 1 (?)λ@7!

? ?⌦k ⇧⌦h
G

?
?

?

Figure 3.7: Beta rewrite rule (G, GS are hypernets)
contains a name-binder (‘new’) outside any thunks. A term u is said to be nongenerative, and written as u, if all name-binders appear inside thunks.

Desiderata 3.4.3 (Referential transparency). If u is non-generative thenbind x → u in bind y → x in bind z → x in t'†all bind y → u in bind z → u in t(whenever x 6∈ fv (t))

bind x → u in t '†all t[u/x]

(3.7)
(3.8)

To be clear, the referential transparency laws hold in contexts with most “reasonable” operations, including all mentioned in Sec. 3.4.2. However, even thoughreferential transparency laws are very robust, one can think of operations which may
violate them such as Gc.stat mentioned earlier.

3.4.2

Operations

We proceed to equivalences that involve some of the operations discussed in Sec. 3.2.
First we consider operations for the lambda-calculus, namely:def

λx.t = λ(−; x.t)→

def

(abstraction)→t @ u = @(t, u; −).

(left-to-right call-by-value application)

3.4. OBSERVATIONAL EQUIVALENCE

87→

While the abstraction λ is a passive operation, the application @ is an active opera→tion. Fig. 3.7 shows the beta rewrite rule associated with @. The usual observational
equivalences (laws) induced by the beta rewrite are as follows.

Desiderata 3.4.4 (Call-by-value beta laws). If v is a value then→

(λx.t) @ v '†bf bind x → v in t

(Micro beta)

Moreover, if v is a referentially-transparent value then→

(λx.t) @ v '†bf t[v/x](Beta)The beta law is also robust relative to the operations described in the sequel,but reasonable operations that violate it do exist. For example, we mentioned the
Gc.stat() function of OCaml which returns the size of the term violates this law.
Next we add some passive operations for constants (the empty pair, boolean
values and integers) and active operations for arithmetic:def

n = n(−; −),deffalse = ff(−; −),deft − u = −(t, u; −),() = ()(−; −),true = tt(−; −),t + u = +(t, u; −),

def

def

def

def

−t = −1 (t; −).

(empty pair, integers)(boolean values)(addition, subtraction)(negation)

Fig. 3.8 shows a selected rewrite rule for arithmetic.
We further add to the language state (assignment and dereferencing), namely

88

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

~`
GS
?
m

n

?

?
+

p

?

?
7!

~`
GS
?
⇧⇧
D1,1
⇧

ref

7! I

?

?

?

?

?

?
?

Figure 3.8: Arithmetic rewrite
rule (selected), where m, n, p ∈ N
and p = m + n
?

?

⇧
C

⇧⌦k1 ⇧
I

?

?

?
7!

=

?

?

?

⇧
C
⇧⌦k1 ⇧⇧⇧
C⇧⌦k1 ⇧

⇧

I

I

I

I

I

?

?

⇧
C0
⇧ ⇧⌦k2I

I?

Figure 3.9: Reference creation(GS is a hypernet)

?

⇧
⇧
C0
C
⇧ ⇧⌦k2 ⇧⌦k1 ⇧

?

?

ff

=

⌦ ? ⌦

?

?
tt

⌦ ? ⌦

?
⌦k1

⇧

⌦k2

⇧

?
?

⌦k1

⇧
~`

?

⌦k2

⇧

?
?

⌦

⌦k1

~`

⇧
⇧
C
C
⇧⌦k1 ⇧ ⇧⌦k2⇧⌦k1 ⇧ ⇧⌦k2
I
I⇧⌦k2 ~`⇧⌦k2 ~`
GS
GS
7!
?
?
?
?
:=

()

?

⌦ ?

⇧

⌦k1

⇧

?
?

?
?
?
D1,2
?
?

⇧
C

⇧⌦k1 ⇧
I

?

⇧
C
⌦k1

7! ⇧

?

⇧⌦k1

?

⇧
I

!

?

?

⌦

?
⇧⌦k1

?

7!

?
⇧⌦k1

?

⇧⌦k1

?

Figure 3.10: Equality, assignment, and dereferencing rewrite rules (C and C 0 arecontraction trees, and GS is a hypernet)

3.4. OBSERVATIONAL EQUIVALENCE

89

the following four active operations:def

ref t = ref(t; −)def

t = u = =(t, u; −)(reference creation)(equality testing on references)def

t := u = :=(t, u; −)(assignment)def!t = !(t; −).

(dereferencing)

The rewrite rule for reference creation is given in Fig. 3.9, while equality, assignmentand dereferencing are given in Fig. 3.10. Since Spartan is (essentially) untyped,by default we consider state which can store any terms (or rather values), including
lambda-abstractions.
For convenience we use the following syntactic sugar:def→t u = t@udef

νx.t = (λx.t) (ref ())
def

let x = u in t = (λx.t) udef

λ .t = λz.t(where z is not a free variable in t)

defu; t = (λ .t) u

Because we are focusing on the call-by-value function application, the let-binding
as a sugar has different behaviour from the intrinsic variable-binding, which has thecall-by-name nature as explained in Sec. 3.2.2.
Also note that in the absence of type restrictions it is straightforward to tie
recursive knots in the store. For example let x = ref 0 in x := x stores a selfreference into x, so that any dereferencing !x, !!x, !!!x, etc., will always produce thesame result.
Some desirable equivalences which hold in contexts containing stateful operations
are:

90

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

Desiderata 3.4.5 (Stateful laws).

νz.λx.x = z †bf λx.false(Freshness)νx.f '†bf f(Locality)

let x = ref 0 in (f (λ .x :=!x + 1)) (λ .!x)'†bf let x = ref 0 in (f (λ .x :=!x − 1)) (λ .−!x) (Parametricity 1)
let x = ref 1 in λf.((f ()); !x) '†bf λf.((f ()); 1)(Parametricity 2)

The first two equivalences originate in the ν-calculus of Pitts and Stark [1993],
a (call-by-value) lambda-calculus extended with construct νx.t which creates a newname and binds it to x in t, plus equality testing on names. These names are
virtually identical to unit references, therefore for economy of presentation we willconsider them as such. The proof techniques in loc. cit. rely on logical relations,which make essential use of the typing structure of the language. In contrast, we
can show that these equivalences hold even in untyped state, with the caveat thatone becomes a refinement, rather than an equivalence, since equality checking can
get stuck if not applied to names.

The other equivalences originate in the Idealised Algol literature [O’Hearn andTennent, 1997], a call-by-name language with ground-type local variables. The
proofs again use logical relations, but formulated in a denotational semantics offunctor categories. Escalating the proofs to call-by-value and higher-order state requires more complex techniques such as step-indexed logical relations [Ahmed et al.,2009]. Our approach will be seen to be rather different, involving a case analysis of
the operations involved as they interact in all possible pairwise combinations, in a
type-free setting.

3.5. TECHNICAL DETAILS OF FOCUSSED GRAPH REWRITING

3.5

91

Technical details of focussed graph rewriting

In this section we give a definition of the abstract machine introduced informallyin Sec. 3.3.4. We call it a universal abstract machine because it can be seen as auniversal algebra (the operations) combined with a mechanism for sharing or copying
resources and scheduling evaluation. The machine, and hence the definitions below,
are all globally parametrised by some operation set O and its behaviour BO .

3.5.1

Auxiliary definitions

We use the terms incoming and outgoing to characterise the incidence relation between neighbouring edges. Conventionally incidence is defined relative to nodes, but
we find it helpful to extend this notion to edges.
Definition 3.5.1 (Incoming and outgoing edges). An incoming edge of an edge e
has a target that is a source of the edge e. An outgoing edge of the edge e has asource that is a target of the edge e.
Definition 3.5.2 (Path). A path in a hypergraph is given by a non-empty sequenceof edges, where an edge e is followed by an edge e0 if the edge e is an incoming edgeof the edge e0 .
Note that, in general, the first edge (resp. the last edge) of a path may have nosource (resp. target). A path is said to be from a vertex v, if v is a source of thefirst edge of the path. Similarly, a path is said to be to a vertex v 0 , if v 0 is a targetof the last edge of the path. A hypergraph G is itself said to be a path, if all edgesof G comprise a path from an input (if any) and an output (if any) and every vertex
is an endpoint of an edge.
Definition 3.5.3 (Reachability). A vertex v 0 is reachable from a vertex v if v = v 0
holds, or there exists a path from the vertex v to the vertex v 0 .

92

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

To represent Spartan terms, we fix the vertex label set L and the edge label set
MO as described in Sec. 3.3.3, using the given operation set O.
L := {?, } ∪ {T n (?) | n ∈ N}
MO := {I : ? ⇒ , ? : ? ⇒ ?, X : ? ⇒ ?,: ? ⇒ ?}nid
∪ {φ : ? ⇒ ?⊗me ⊗ ⊗m
i=1 T (?) | (φ ` (me ; n1 , . . . , nmd )) ∈ O}

∪ {◦ :  ⇒ ?, ⊗`W :  ⇒ `, ⊗`C : `⊗2 ⇒ ` | ` ∈ {?, }}Definition 3.5.4 (Operation path). A path whose edges are all labelled with operations is called operation path.
Definition 3.5.5 (Contraction tree). For each ` ∈ {?, }, a contraction tree is a
hypernet (C : `⊗k ⇒ `) ∈ H({`}, {⊗`W , ⊗`C }), such that the unique output is reachable
from each vertex.
It can be observed that, for any contraction tree, an input (if any) is not an
output but a source of a contraction edge.
`
Definition 3.5.6 (Distributor). We define a family {Dk,m: `⊗km ⇒ `⊗k }k∈N , with` ∈ {?, }, of hypernets which we call distributors, inductively as follows:
`
D0,m
=∅
`
D1,0
=

`
D1,1
=

`

⌦

⌦
`

⌦
`
D1,m+2````
D1,m+1
⌦m
`
=`

`

`
Dk+1,m
= Πid
ρ

⌦

 `⌦k

`
`
`
`
Dk,m
D1,m
`⌦km `⌦m,

where ∅ denotes the empty hypernet, id is the identity map, and ρ is a bijection such

3.5. TECHNICAL DETAILS OF FOCUSSED GRAPH REWRITING

93

that, for each j ∈ {1, . . . , k} and i ∈ {1, . . . , m}, ρ(j + (k + 1)(i − 1)) = j + k(i − 1)and ρ((k + 1)i) = km + i.
?

?

⌦

⌦

∗
Examples of distributors are D2,3=⌦ ⌦ ⌦ ⌦
??

⇧ ⇧ ⇧

⌦

⌦

??

??


and D3,0= ⌦ ⌦ ⌦ . When k = 1,`
is a contraction tree that includes one weakening edge.
a distributor D1,mDefinition 3.5.7 (Box/stable hypernets). If a hypernet is a path of only one box
edge, it is called box hypernet. A stable hypernet is a hypernet (G : ? ⇒ ⊗m
i=1 `i ) ∈nmand each vertex isH(L, {I} ∪ OX ), such that ⊗m
i=1 `i ∈ ({} ∪ {T (?) | n ∈ N})

reachable from the unique input.
Definition 3.5.8 (Copyable hypernets). A hypernet H : ? ⇒ ?⊗k ⊗ ⊗h is called0

copyable if it is?⌦m ?⌦k0 ⇧⌦h⇥m
i=1 Bi~`I or, where φ ∈ O, and each Bi is a box hypernet.

⇧?

?

Definition 3.5.9 (One-way hypernets). A hypernet H is one-way if, for any pair(vi , vo ) of an input and an output of H such that vi and vo both have type ?, any
path from vi to vo is not an operation path.
Remark 3.5.10 (Distributors). To the reader familiar with diagrammatic languages
based on monoidal categories equipped with “sharing” (co)monoid operators, suchas the ZX-calculus by Coecke and Duncan [2011], the distributors may seem anawkward alternative to quotienting the hypernets by the equational properties of the(co)monoid operator. Indeed a formulation of Spartan semantics in which distributors are collapsed into n-ary contractions would be quite accessible.
However, the structural laws of Spartan including equational properties of contraction, mentioned in Sec. 3.4.1, can be invalidated by certain ill-behaved but definable operations. Forcing these properties into the framework does not seem tobe practically possible, as it leads to intractable interactions between such complex
n-ary contractions and operations in the context as required by the key notion ofrobustness which will be introduced in Sec. 4.3.2.

94

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

In Sec. 4.5.2, we will introduce the equational properties of contraction that are
validated by the extrinsic operations described in Sec. 3.4. These equational properties do not make contractions and weakenings form a (co)monoid, but they enable us
to identify contraction trees so long as the trees contain at least one weakening. If we
see the equations on contraction trees as rewrite rules from left to right, distributors
are indeed normal forms with respect to these rules.

3.5.2

Focussed hypernets

Definition 3.5.11. A token edge in a hypergraph is said to be exposed if its sourceis an input and its target is an output, and self-acyclic if its source and its target
are different vertices.
Definition 3.5.12 (Focussed hypernets). A hypernet is said to be focussed if it
contains only one token edge, and moreover, the token edge is shallow, self-acyclic
and not exposed.
Focussed hypernets are typically ranged over by Ġ, Ḣ, Ṅ .
Focus-free hypernets are given by Hω (L, MO \{?, X, }), i.e. hypernets without
token edges. A focussed hypernet Ġ can be turned into an underlying focus-free
hypernet |Ġ| with the same type, by removing its unique token edge and identifying
the source and the target of the edge. When a focussed hypernet Ġ has a t-token,
then changing the token label t to another one t0 yields a focussed hypernet denotedby hĠit0 /t . The source (resp. target) of a token is called token source (resp. token
target) in short.
Given a focus-free hypernet G, a focussed hypernet t;i G with the same type canbe yielded by connecting a t-token to the i-th input of G if the input has type ?.
Similarly, a focussed hypernet G;i t with the same type can be yielded by connecting
a t-token to the i-th output of G if the output has type ?. If it is not ambiguous,
we omit the index i in the notation ;i .

3.5. TECHNICAL DETAILS OF FOCUSSED GRAPH REWRITING

3.5.3

95

Contexts

The set of holed hypernets (typically ranged over by C) is given by Hω (L, MO ∪ M),
where the edge label set MO is extended by a set M of hole labels. Hole labels are
typed, and typically ranged over by χ : ~` ⇒ `~0 .
Definition 3.5.13 (Contexts). A holed hypernet C is said to be a context if eachhole label appears at most once (at any depth) in C.
Definition 3.5.14. A context is said to be simple if it contains a single hole, andmoreover, the hole is shallow.
When χ
~ gives a list of all and only hole labels that appear in a context C, thecontext can be also written as C[~χ]; a hypernet in Hω (L, MO ) can be seen as a“context without a hole”, C[ ].
Let C[χ~1 , χ, χ~2 ] and C 0 [χ~3 ] be contexts, such that the hole χ and the latter context
C 0 have the same type and χ~1 ∩ χ~2 ∩ χ~3 = ∅. A new context C[χ~1 , C 0 , χ~2 ] ∈ Hω (L, MO ∪
χ~1 ∪ χ~3 ∪ χ~2 ) can be obtained by plugging C 0 into C: namely, by replacing the (possiblydeep) hole edge of C that has label χ with the context C 0 , and by identifying each
input (resp. output) of C 0 with its corresponding source (resp. target) of the holeedge (Def. A.2.1). Each edge of the new context C[χ~1 , C 0 , χ~3 ] is inherited from either
C or C 0 , keeping the type; this implies that the new context is indeed a context
with hole labels χ~1 , χ~3 , χ~2 . Inputs and outputs of the new context coincide withthose of the original context C, and hence these two contexts have the same type.
The plugging is associative in two senses: plugging two contexts into two holes ofa context yields the same result regardless of the order, i.e. C[χ~1 , C 0 , χ~2 , C 00 , χ~3 ] iswell-defined; and nested plugging yields the same result regardless of the order, i.e.
C[χ~1 , C 0 [χ~3 , C 00 , χ~4 ], χ~2 ] = (C[χ~1 , C 0 , χ~2 ])[χ~1 , χ~3 , C 00 , χ~4 , χ~2 ].
The notions of focussed and focus-free hypernets can be naturally extended to˙ χ], the token is said to be entering if it is ancontexts. In a focussed context C[~

96

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

?⌦k
H
?

⇧⌦h

?
C
0
? ?⌦k

?⌦k
?
Dk,2

⇧⌦h
⇧
Dh,2

?⌦k ?⌦k⇧⌦h ⇧⌦h

?⌦k
H
?
7!

?

⇧⌦h ?⌦k

H
?

⇧⌦h

?
C
0
? ?⌦k

⌦
?

?⌦k

0

? ?⌦k

0

Figure 3.11: Contraction rules, with C a contraction tree, and H a copyable hypernet
incoming edge of a hole, and exiting if it is an outgoing edge of a hole. The token
may be both entering and exiting.

3.5.4

States and transitions

Given the two parameters O and BO , the universal abstract machine U(O, BO ) isdefined as a state transition system. It is namely given by data (SO , T ] BO ) as
follows, each of which we will describe in the sequel.
• SO ⊆ Hω (L, MO ) is a set of states,• T ⊆ SO × SO is a set of intrinsic transitions, and• BO ⊆ SO × SO is a set of extrinsic transitions.
A focussed hypernet of type ? ⇒  in Hω (L, MO ) is said to be a state. A state Ġis called initial if Ġ =?; |Ġ|, and final if Ġ = X; |Ġ|. A state is said to be stuck if it
is not final and cannot be followed by any transition. An execution on a focus-free
hypernet G : ? ⇒  is a sequence of transitions starting from an initial state ?; G.
The following will be apparent once transitions are defined: initial states are indeed
initial in the sense that no search transition results in an initial state; and final states
are indeed final in the sense that no transition is possible from a final state.
The interaction rules in Fig. 3.5 specify the first class of intrinsic transitions,search transitions, and the contraction rules in Fig. 3.11 specify the second class3.5. TECHNICAL DETAILS OF FOCUSSED GRAPH REWRITING

97

of intrinsic transitions, copy transitions. These intrinsic transitions are defined as•⊗follows: for each interaction rule Ġ 7→ Ġ0 (or resp. contraction rule Ġ 7→ Ġ0 ), if there
exists a focus-free simple context C[χ] : ? ⇒  such that C[Ġ] and C[Ġ0 ] are states,
C[Ġ] → C[Ġ0 ] is a search transition (or resp. copy transition).
Search transitions are deterministic, because at most one interaction rule can beapplied at any state. Although two different contraction rules may be possible ata state, copy transitions are still deterministic. Namely, if two different contraction
rules Ġ 7→ Ġ0 and Ḣ 7→ Ḣ 0 can be applied to the same state, i.e. there exist focusfree simple contexts CG and CH such that CG [Ġ] = CH [Ḣ], then these two rules yield
the same transition, by satisfying CG [Ġ0 ] = CH [Ḣ 0 ]. Informally, in Fig. 3.11, H isdetermined uniquely and the choice of C does not affect the result.
Intrinsic transitions are therefore all deterministic, and moreover, search transitions are reversible because the inverse of the interaction rules is again deterministic.
When a sequence Ġ →∗ Ġ0 of transitions consists of search transitions only, it is an∗•notated by the symbol • as Ġ →Ġ0 .

An execution on any stable net, or on representation of any value, terminates
successfully at a final state with only search transitions (by Lem. A.4.2, Lem. A.4.4
and Lem. A.4.6(1)).
The behaviour BO , which is a parameter of the machine, specifies a set of extrinsic
transitions. Extrinsic transitions are also called compute transitions, and each ofthem must target an active operation. Namely, a transition Ġ → Ġ0 is a computetransition if: the first state Ġ has a rewrite token ( ) that is an incoming edge ofan active operation edge; and the second state Ġ0 has a search token (?). Copytransitions or compute transitions are possible if and only if a state has a rewrite
token ( ), and they always change the token to a search token (?). We refer to copytransitions and compute transitions altogether as rewrite transitions.
Compute transitions may be specified locally, by rewrite rules, in the same manner as the intrinsic transitions. The rewrite rules introduced in Sec. 3.4.2 are such

98

CHAPTER 3. FOCUSSED GRAPH REWRITING FOR SPARTAN

examples. However, we leave it entirely open what the actual rewrite associated tosome operation is, by having the behaviour BO as parameter as well as the operation
set O. This is part of the semantic flexibility of our framework. We do not specify ameta-language for encoding effects as particular transitions. Any algorithmic statetransformation is acceptable.

Chapter 4
Robustness and observational
equivalence
4.1

OutlineThis chapter presents a novel proof methodology of observational equivalence, offeredby the UAM. In focussed graph rewriting that is performed by the UAM, informationof program-execution status is centralised to the token (or focus), and each step ofprogram execution is determined by the token and its neighbourhood. This enables
a new style of reasoning centred around a graph-theoretic intuition of locality, inwhich one can analyse how a program fragment evolves during program execution
by examining how the token interacts with the fragment.
Exploiting local reasoning yields a case-by-case reasoning principle for proving
observational equivalence between two program fragments t and u. The proof namely
boils down to establishing coincidence between the way these two fragments interact
with the token. This can be done by direct, step-wise, comparison between two
executions of programs C[t] and C[u], the fragments in an arbitrary common context
C. At each step of these executions, we can enumerate possible interaction between
the token and either of the fragments, and identify sufficient conditions for the
fragments to have the same interaction with the token. A key sufficient condition,
99

100

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

robustness, is our conceptual contribution. It characterises when the fragments arerespected by a rewrite triggered by the token.
The main technical result, a characterisation theorem (Thm. 4.3.14), formalises
this local reasoning principle for proving observational equivalence, and identifies thesufficient conditions including robustness. The theorem focuses on the UAM thatis deterministic, to avoid over-complication of the technical development. Although
this restriction leaves some computational effects beyond the scope, the deterministic
UAM can still accommodate interesting effects such as state and exception. We will
illustrate that the theorem can be used to prove some challenging observational
equivalences from the literature, involving arbitrary (untyped) state.
Additionally, we propose a generalised notion of observational equivalence thathas two parameters: a class of contexts and a preorder on natural numbers. The firstparameter enables us to quantify over some contexts, instead of all contexts as in thestandard notion. This can be used to identify a shape of contexts that respects orviolates certain observational equivalences, given that not necessarily all arbitrarily
generated contexts arise in program execution. The second parameter, a preorderon natural numbers, deals with numbers of steps it takes for the UAM to terminate.
Taking the universal relation recovers the standard notion of observational equivalence. Observational equivalence with respect to the greater-than-equal relation,for example, means that replacing a fragment with another in any programs (within
the class specified by the first parameter) never increases the number of execution
steps.
This chapter is organised as follows. The generalised notion of observational
equivalence is defined in Sec. 4.2, and the characterisation theorem is presented inSec. 4.3. The proof of the theorem is given in Sec. 4.4, some of whose details can befound in an appendix. Sec. 4.5 gives applications of the characterisation theorem toproving observational equivalence.

4.2. CONTEXTUAL REFINEMENT AND EQUIVALENCE

4.2

101

Contextual refinement and equivalence

We propose notions of contextual refinement and equivalence that check for successful termination of execution. These notions generalise the standard notions, byadditionally taking into account a class of contexts to quantify over, and also thenumber of transitions. They are namely with respect to the universal abstract machine U(O, BO ) with some operation set O and its behaviour BO , and parametrisedby the following: a set C ⊆ Hω (L, MO ∪ M) of focus-free contexts that is closed
under plugging (i.e. for any contexts C[χ~1 , χ, χ~2 ], C 0 ∈ C such that C[χ~1 , C 0 , χ~2 ] isdefined, C[χ~1 , C 0 , χ~2 ] ∈ C); and a preorder Q on natural numbers.
Definition 4.2.1 (State refinement and equivalence). Let Q be a preorder on N,
and Ġ1 and Ġ2 be two states.
˙ Q Ġ2 ), if for any• Ġ1 is said to refine Ġ2 up to Q, written as BO |= (Ġ1 
number k1 ∈ N and any final state Ṅ1 such that Ġ1 →k1 Ṅ1 , there exist a
number k2 ∈ N and a final state Ṅ2 such that k1 Q k2 and Ġ2 →k2 Ṅ2 .
˙ Q Ġ2 ), if• Ġ1 and Ġ2 are said to be equivalent up to Q, written as BO |= (Ġ1 '˙ Q Ġ2 ) and BO |= (Ġ2 ˙ Q Ġ1 ).
BO |= (Ġ1 
Definition 4.2.2 (Contextual refinement and equivalence). Let C be a set of contexts that is closed under plugging, Q be a preorder on N, and H1 and H2 befocus-free hypernets of the same type.
• H1 is said to contextually refine H2 in C up to Q, written as BO |= (H1 CQ H2 ),if any focus-free context C[χ] ∈ C, such that ?; C[H1 ] and ?; C[H2 ] are states,
˙ Q ?; C[H2 ]).
yields refinement BO |= (?; C[H1 ] • H1 and H2 are said to be contextually equivalent in C up to Q, written as
BO |= (H1 'CQ H2 ), if BO |= (H1 CQ H2 ) and BO |= (H2 CQ H1 ).

102

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

˙ Q Ġ2 etc., making the parameter BO implicit.
In the sequel, we simply write Ġ1 
˙ Q and CQ are indeed preorders, and accordingly,
Because Q is a preorder, ˙ Q and 'CQ are indeed equivalences (Lem. A.5.2). Examples of preorderequivalences 'Q include: the universal relation N × N, the “greater-than-or-equal” order ≥N , andthe equality =N .
When the relation Q is the universal relation N×N, the notions concern successful
termination, and the number of transitions is irrelevant. If all compute transitions
are deterministic, contextual equivalences 'C≥N and 'C=N coincide for any C (as aconsequence of Lem. A.5.3).
Because C is closed under plugging, the contextual notions CQ and 'CQ indeed
become congruences. Namely, for any H1 C H2 and C ∈ C such that C[H1 ] andC[H2 ] are defined, C[H1 ] C C[H2 ], where  ∈ {Q , 'Q }.
As the parameter C, we will particularly use the set CO ⊆ Hω (L, MO ∪ M) of
any focus-free contexts, and its subset CO-bf of binding-free contexts.

Definition 4.2.3 (Binding-free contexts). A focus-free context C is said to bebinding-free if there exists no path, at any depth, from a source of a contraction,
atom, box or hole edge, to a source of a hole edge.

The set CO is closed under plugging, and so is the set CO-bf (Lem. A.5.1). Restriction to binding-free contexts is useful to focus on call-by-value languages, because
only values will be bound during evaluation in these languages. The restriction
syntactically means forbidding the hole of contexts from appearing in the boundpositions, as discussed below.
The standard notions of contextual refinement and equivalence can be recoveredOO
as N×N
and 'N×N, by taking the set CO ⊆ Hω (L, MO ∪M) of all focus-free contexts,

CC

and the universal relation N × N.

4.2. CONTEXTUAL REFINEMENT AND EQUIVALENCE

4.2.1

103

Observational equivalences on terms

The notion of observational refinement on terms, informally introduced in Sec. 3.4,
can now be defined using the contextual refinement on hypernets as follows. Recall
that the observational refinement is parametrised by an operation set O and its
behaviour BO . Given two derivable judgements ~x | ~a ` t1 : ? and ~x | ~a ` t2 : ?, wewrite:

O
BO |= (~x | ~a ` t1 †all t2 : ?) if BO |= ((~x | ~a ` t1 : τ )† N×N(~x | ~a ` t2 : τ )† ),COBO |= (~x | ~a ` t1 '†all t2 : ?) if BO |= ((~x | ~a ` t1 : τ )† 'N×N(~x | ~a ` t2 : τ )† ),C

O-bf
BO |= (~x | ~a ` t1 †bf t2 : ?) if BO |= ((~x | ~a ` t1 : τ )† N×N(~x | ~a ` t2 : τ )† ),C

O-bf
BO |= (~x | ~a ` t1 '†bf t2 : ?) if BO |= ((~x | ~a ` t1 : τ )† 'N×N(~x | ~a ` t2 : τ )† ).

C

The refinements †all and †bf enjoy different congruence properties, as specified
by the set CO of focus-free contexts (as hypernets) and its binding-free restriction
CO-bf . This difference can also be described in terms of syntactical contexts as follows. Let term-contexts and their binding-free restriction be defined by the following
grammar:C ::= [ ] | new a ( t in C | bind x → t in C
| new a ( C in t | bind x → C in t
| ~y .C | φ(~t, C, ~t0 ; ~s) | φ(~t; ~s, C, s~0 )(term-contexts)

C̃ ::= [ ] | new a ( t in C̃ | bind x → t in C̃| ~y .C̃ | φ(~t, C̃, ~t0 ; ~s) | φ(~t; ~s, C̃, s~0 )(binding-free term-contexts)

The type system of Spartan (Fig. 3.2) can be extended to term-contexts, by annotating the hole ‘[ ]’ as ‘[ ]~x|~a ’ and adding a typing rule ~x | ~a ` [ ]~x|~a : ?. We write
C[ ]~x|~a when the hole of C is annotated with ~x | ~a.

104

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Lemma 4.2.4. Let ~x | ~a ` t1 : ? and ~x | ~a ` t2 : ? be derivable judgements. Let C
be a term-context, x~0 be a sequence of variables and a~0 be a sequence of atoms, suchthat x~0 | a~0 ` C[ ]~x|~a : ?.
1. If ~x | ~a ` t1 †all t2 : ?, then x~0 | a~0 ` C[t1 ] †all C[t2 ] : ?.
2. If ~x | ~a ` t1 '†all t2 : ?, then x~0 | a~0 ` C[t1 ] '†all C[t2 ] : ?.
3. If ~x | ~a ` t1 †bf t2 : ?, and C is binding-free, then x~0 | a~0 ` C[t1 ] †bf C[t2 ] : ?.
4. If ~x | ~a ` t1 '†bf t2 : ?, and C is binding-free, then x~0 | a~0 ` C[t1 ] '†bf C[t2 ] : ?.
Proof outline. The translation (−)† of Spartan terms to hypernets (Fig. 3.4) canbe extended to term-contexts, by translating the rule ~x | ~a ` [ ]~x|~a : ? into a path
hypernet χ : ? ⇒ ?⊗|~x| ⊗ ⊗|~a| . Translating term-contexts indeed yields (graphical)
contexts, and translating binding-free term-contexts yields (graphical) binding-freecontexts (proof by induction on (binding-free) term-contexts).
For each i ∈ {1, 2}, a judgement x~0 | a~0 ` C[ti ] : ? is derivable, and moreover,(x~0 | a~0 ` C[ti ] : ?)† = (x~0 | a~0 ` C[ ]~x|~a : ?)† [(~x | ~a ` ti : ?)† ](proof by induction on C). The congruence property of contextual refinements
concludes the proof.

4.3

A characterisation theorem

We can now formalise a proof method for contextual refinement and equivalence.
All the technical development in this section is with respect to the universal abstract
machine U(O, BO ), parametrised by an operation set O and its behaviour BO , thatsatisfies some conditions including determinism.
Firstly in Sec. 4.3.1, we state the conditions of the machine, to which the proof
method applies. Sec. 4.3.2 formalises the proof method as a characterisation theorem

4.3. A CHARACTERISATION THEOREM

105(Thm. 4.3.14), introducing the key concept of robustness. Additionally, in Sec. 4.3.3,
we list some useful lemmas that can be used in robustness check.

4.3.1

Determinism and refocusing

We focus on the situation where the universal abstract machine is both deterministic
as a state transition system, and refocusing in the following sense.
Definition 4.3.1 (Rooted states and refocusing machine).
∗•• A state Ġ is rooted if ?; |Ġ| →Ġ.

• The universal abstract machine U(O, BO ) is refocusing if every transition preserves the rooted property.
Recall that intrinsic transitions are all deterministic, and that intrinsic transitions
and extrinsic transitions are mutually exclusive. The machine becomes deterministic, as a state transition system, if compute transitions specified by the behaviour
BO are deterministic.
Any initial state is trivially rooted, and search transitions preserve the rooted
property. The stationary property below gives a sufficient condition for a rewrite
transition to preserve the rooted property (Lem. A.3.8).
Definition 4.3.2 (Stationary rewrite transitions). A rewrite transition Ġ → Ġ0 is
stationary if there exist a focus-free simple context C, focus-free hypernets H and
H 0 , and a number i ∈ N, such that H is one-way, Ġ = C[ ;i H] and Ġ0 = C[?;i H 0 ],and the following holds. For any j ∈ N\{i}, such that C[?;j H] is a state, there exists•
a state Ṅ with a rewrite token, such that C[?;j H] →Ṅ .

Copy transitions are stationary, and hence they preserve the rooted property,
because each input of the contraction tree C in Fig. 3.11 is a source of a contraction edge. Therefore, the machine becomes refocusing if the behaviour BO specifies
compute transitions that preserve the rooted property.

106

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Remark 4.3.3 (Refocusing). When a rewrite transition results in a rooted stateṄ 0 , starting the search process (i.e. search transitions) from the state Ṅ 0 can be∗•seen as resuming the search process ?; |Ṅ 0 | →Ṅ 0 , from an initial state, on theunderlying hypernet |Ṅ 0 |. Resuming redex search after a rewrite, rather than starting from scratch, is an important aspect of abstract machines. In the case of thelambda-calculus, enabling the resumption is identified as one of the key steps (called
refocusing) to synthesise abstract machines from reduction semantics by Danvy et al.
[2012]. In our setting, it is preservation of the rooted property that justifies the resumption.
The stationary property, as a sufficient condition of preservation of the rooted
property, characterises many operations with local behaviour. Compute transitionsof operations that involve non-local change of a token position, like label jumping,
could preserve the rooted property without being stationary.

4.3.2

Templates and robustness

A candidate for contextual refinement, called pre-template, is given by a family ofpairs of hypernets, indexed by types.
Definition 4.3.4 (Pre-template). A pre-template is a union C := ∪I∈I CI of afamily of binary relations on focus-free hypernets Hω (L, MO \{?, X, }) indexed bya set I of types, such that for any G1 CI G2 where I ∈ I, G1 and G2 are focus-free
hypernets with type G1 : I and G2 : I.
Obviously, if C is a pre-template, its converse C−1 is also a pre-template.
Pre-templates do not necessarily relate hypernets that represent terms, nor hypernets that arise from rewrite rules of the operations. However, the rewrite rules areindeed natural candidates for contextual refinements, and therefore natural sourcesof pre-templates.

4.3. A CHARACTERISATION THEOREM

107

Example 4.3.5 (Beta pre-template). As a leading example, we consider the beta→

pre-template C @ derived from the beta rewrite rule (Fig. 3.7), by forgetting the token:→

namely, |Ġ1 | C @ |Ġ2 | if Ġ1 7→ Ġ2 is a beta rewrite rule. These hypernets |G1 | and|G2 | have the same type ? ⇒ ?⊗k ⊗ ⊗h ⊗ ~`, where k, h ∈ N and the sequence ~` oftypes can be arbitrary.
Throughout this section, let C be a set of contexts, and Q, Q0 and Q00 be binary
relations on N. Given a pre-template C, our goal is to prove that H1 C H2 implies
˙ up tocontextual refinement H1 CQ H2 , possibly with the help of state refinement 
Q0 or Q00 . As will be apparent in Sec. 4.5, the use of state refinement is particularly
convenient in reasoning, allowing us to identify different contraction trees of thesame type.
At the core of the proof is comparison between hypernets related by the pretemplate C, in any possible contexts specified by the set C. In other words, thecomparison is between a pair of states whose only difference is given by the pretemplate C. This pair is given by data called specimen. The comparison can be
˙ Q0 and ˙ Q00 , in addition to the pre-templaterelaxed by allowing state refinements C, to specify the difference between states. The relaxed comparison is targeted
at a pair of states, which is intuitively a specimen up to state refinements, called
quasi-specimen.
Definition 4.3.6 ((Quasi-)specimens). Let C be a pre-template, and R and R0 be
binary relations on states.
˙ χ]; H~ 1 ; H~ 2 ) is a C-specimen of C if the following hold:
1. A triple (C[~˙ χ]| ∈ C, and |~(A) |C[~
χ| = |H~ 1 | = |H~ 2 |.
χ|}.
(B) Hi1 C Hi2 for each i ∈ {1, . . . , |~˙ H~ p ] is a state for each p ∈ {1, 2}.
(C) C[
2. A pair (Ṅ1 , Ṅ2 ) of states is a quasi-C-specimen of C up to (R, R0 ), if there

108

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE
˙ H~ 1 ; H~ 2 ) of C such that the following hold:exists a C-specimen (C;˙ Ṅ1 and Ṅ2 all have the same label.
(A) The tokens of C,
˙ H~ 1 ] and C[
˙ H~ 2 ] are also rooted, Ṅ1 R C[
˙ H~ 1 ],(B) If Ṅ1 and Ṅ2 are rooted, then C[
˙ H~ 2 ] R0 Ṅ2 .
and C[

We can refer to the token label of a C-specimen and a quasi-C-specimen. Any
˙ H~ 1 ; H~ 2 ) gives a quasi-C-specimen (C[˙ H~ 1 ], C[H˙ 2 ]) up to (=, =). Note
C-specimen (C;that the focussed context of each C-specimen may have multiple holes. We say a
˙ χ]; H~ 1 ; H~ 2 ) is single if |~C-specimen (C[~χ| = 1, i.e. the context C˙ has exactly one holeedge (at any depth).
For the pre-template C to imply contextual refinement, hypernets related by Cshould intuitively induce the same behaviour of the token, regardless of contexts. We
use specimens to analyse the token behaviour, in a case-by-case manner. Namely,
˙ H~ 1 ; H~ 2 ) of a pre-template C, we analyse how the token in
given any C-specimen (C;the context C˙ interacts with the hypernets H~ 1 , and H~ 2 , that are contributed by C.
According to the actual position and the label of the token, the possible interaction
can be classified as follows:
Case I: move inside the common context. The token is a search token (?) or˙ It does nota value token (X), and it interacts with an edge of the context C.
interact with the fragments at all.
Case II: visit to the fragments. The token is a search token (?) or a value token (X), and it is set to interact with edges of the fragments. The token is˙necessarily next to a hole edge in the context C.
Case III: rewrite. The token in the context C˙ is a rewrite token ( ). It triggers acompute transition, in which a part of the fragments may be rewritten.
Case IV: termination. The token is a value token (X) and does not have an edge
to interact, which is an incoming edge of the token. In this case, both states

4.3. A CHARACTERISATION THEOREM

109

˙ H~ 1 ] and C[
˙ H~ 2 ] are necessarily final.
C[
Our objective is to establish that the token always interacts with the hypernets
H~ 1 in the same manner as with the hypernets H~ 2 . By step-wise reasoning whose
details will appear in Sec. 4.4,it suffices to show that the interaction in the C˙ H~ 1 ; H~ 2 ), described above, always results in another (quasi-)C-specimen
specimen (C;of C, unless it results in stuck states or final states.
Apart from Case IV which actually involves no interaction, it is only Case I thatalways results in another C-specimen (Ċ 0 ; H~ 1 ; H~ 2 ) with a different context Ċ 0 . For
the other cases, i.e. Case II and Case III, we identify sufficient conditions for the
pre-template C, as well as for the operations O, to yield a (quasi-)C-specimen as aresult.
There are two sufficient conditions for Case II, according to the token: inputsafety for a search token (?), and output-closure for a value token (X). Input-safety
enumerates some situations of interaction that yield a (quasi-)specimen or a pair ofstuck states. On the other hand, output-closure characterises a situation where avalue token cannot interact with the hypernets contributed by the pre-template C,
under the assumption that the machine is refocusing.
Definition 4.3.7 (Input-safety). A pre-template C is (C, Q, Q0 )-input-safe if, for˙ H~ 1 ; H~ 2 ) of C such that C˙ has an entering search token, one of
any C-specimen (C;the following holds.
˙ H~ p ] →∗ Ṅp for each p ∈ {1, 2}.
(I) There exist two stuck states Ṅ1 and Ṅ2 such that C[(II) There exist a C-specimen (Ċ 0 ; H~01 ; H~02 ) of C and two numbers k1 , k2 ∈ N, such
˙ H~ 1 ] →1+k1
that the token of Ċ 0 is not a rewrite token and not entering, (1+k1 ) Q k2 , C[
˙ H~ 2 ] →k2 Ċ 0 [H~02 ].
Ċ 0 [H~01 ], and C[
˙ Q0 , '˙ Q0 ), whose token(III) There exist a quasi-C-specimen (Ṅ1 , Ṅ2 ) of C up to ('is not a rewrite token, and two numbers k1 , k2 ∈ N, such that (1 + k1 ) Q (1 + k2 ),˙ H~ 1 ] →1+k1 Ṅ1 , and C[
˙ H~ 2 ] →1+k2 Ṅ2 .
C[

110

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Definition 4.3.8 (Output-closure). A pre-template C is output-closed if, for any
hypernets H1 C H2 , either H1 or H2 is one-way.
Definition 4.3.9 (Templates). A pre-template C is a (C, Q, Q0 )-template, if it is(C, Q, Q0 )-input-safe and also output-closed.
It is possible to allow a value token to interact with the hypernets contributedby the pre-template C, and define a counterpart of input-safety for a value token.
However, we here opt for a simple sufficient condition, output-closure, that excludes
interaction in the refocusing machine. It is simple yet powerful enough to prove
many interesting contextual refinements, as we will see in Sec. 4.5.
→

Example 4.3.10 (Beta template). We continue with the beta pre-template C @ from→Ex. 4.3.5. It is natural to expect that the beta pre-template C @ is input-safe, because→

it is derived from the beta rewrite rule. Given hypernets H1 C @ H2 , whenever asearch token enters H1 , it should eventually become a rewrite token and trigger thebeta rewrite of H1 to H2 . If this is the case, Def. 4.3.7(II) is fulfilled, where k2 = 0
˙
and the new context Ċ 0 has one less hole than the original context C.
However, the actual behaviour of an entering search token is not necessarily as
expected. When a search token visits the hypernet GS that is the second argument of
the application operation (see Fig. 3.7), there is no guarantee that the token returns
to the application edge (@) and hence triggers the beta rewrite of the hypernet H1 .
Even if it returns, it may have triggered some rewrites that change the hypernet GS→

to something else. Consequently, the pre-template C @ is not necessarily input-safe
as it is.
→One possible solution is to restrict the pre-template C @ , by requiring the hypernet
GS to be stable. This restriction ensures that a search token that enters H1 eventuallytriggers the beta rewrite of H1 to H2 , because a search token that visits the stablehypernet GS is guaranteed to return without triggering any rewrites (by Lem. A.4.4→

and Lem. A.4.6(1)). Moreover, this restriction makes the pre-template C @ output-

4.3. A CHARACTERISATION THEOREM

111

closed, because of the type of GS . The restriction in fact corresponds to restriction of
the standard beta law to the call-by-value one (λx.t) v ' v[t/x], where the argumentv is required to be a value.
For Case III, where the token in the context triggers a rewrite, we identify asufficient condition called robustness. It is in a similar style as input-safety, but
additionally relative to the triggered rewrite, whose target is a contraction ⊗ or an
active operation φ .
Definition 4.3.11 (Robustness). A pre-template C is (C, Q, Q0 , Q00 )-robust relative
˙ H~ 1 ; H~ 2 ) of C, such thatto a rewrite transition Ṅ → Ṅ 0 if, for any C-specimen (C;˙ H~ 1 ] = Ṅ and the token of C˙ is a rewrite token and not entering, one of theC[following holds.
˙ H~ 1 ] or C[
˙ H~ 2 ] is not rooted.
(I) C[(II) There exists a stuck state N˙ 00 such that Ṅ 0 →∗ N˙ 00 .
˙ Q0 , ˙ Q00 ), whose token is(III) There exist a quasi-C-specimen (N˙100 , N˙200 ) of C up to (not a rewrite token, and two numbers k1 , k2 ∈ N, such that (1+k1 ) Q k2 , Ṅ 0 →k1 N˙100 ,˙ H~ 2 ] →k2 N˙200 .
and C[
Example 4.3.12 (Robustness of beta pre-template). Let us see informally how→

robust the beta pre-template C @ , from Ex. 4.3.5, can be.
The beta pre-template is robust relative to the arithmetic rewrite rule in Fig. 3.8,
because application of the rewrite rule does not interfere with any hypernets con→˙ H~ 1 ; H~ 2 ) is therefore turned into
tributed by the pre-template C @ . Any specimen (C;another specimen (Ċ 0 ; H~ 1 ; H~ 2 ) with a different context Ċ 0 .
The beta pre-template is also robust relative to the beta rewrite rule. Hypernets→

contributed by the pre-template C @ may appear as a part of the redex of the rewrite
rule, namely, as a part of G and GS in Fig. 3.7. However, the rewrite does not manipulate what is inside G and GS , and hence it preserves the contributed hypernets.
Any specimen is again turned into another specimen with a different context.

112

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

When it comes to a copy transition, which applies a contraction rule (Fig. 3.11),
robustness is not guaranteed in general. Starting from a pair of states given by a˙ H~ 1 ; H~ 2 ), it may be the case that some copy transitions are possible withspecimen (C;out reaching another (quasi-)specimen. An example scenario is when the specimen
yields the following two states, where the context C˙ is indicated by magenta:
⋆

3

⋆

5

3

⋆

⋆

⋄

𝖨

⋆
𝑇

˙ H~ 1 ] =
C[

1

⋄

(⋆)

𝜆

5

⋆

,

𝖨

˙ H~ 2 ] =
C[

.

⋆

⋆

@

⋆

⋆

⋆

?

⋆
⋆

⋆

?

⋆

˙ H~ 1 ] eventually duplicate the application edge (@), theTransitions from the state C[
abstraction edge (λ) and also the entire box connected to the abstraction edge. In
particular, these transitions duplicate the atom edge contained in the box. However,˙ H~ 2 ] can never duplicate the atom edge, because the edgetransitions from the state C[
is shallow in this state. This mismatch of duplication prevents the beta pre-templatefrom being robust relative to a copy transition.

This is why we might prefer to restrict contexts to be binding-free. If the context
˙ is binding-free, the situation explained above would never happen. Application of|C|
a contraction rule can involve the hypernets H~ 1 and H~ 2 only as a part of box con-

4.3. A CHARACTERISATION THEOREM

113

tents that are duplicated as a whole. Any specimen is therefore turned into anotherspecimen whose context possibly has more holes, by a single copy transition. Notethat this explains why we allow the context of a specimen to have multiple holes.
Another interesting example is given by the operation stat mentioned earlier,
whose rewrite transition measures the size of the whole hypernet. The transition
introduces an edge labelled by an integer, which can be seen as a passive operation
with no arguments, that represents the measured size. Consequently, the rewrite
˙ H~ 1 ] and C[
˙ H~ 2 ] may introduce different integer edges, whichtransition on states C[→

cannot be related by the pre-template C @ . Robustness of the beta pre-template fails
relative to the operation stat.
Since robustness is only a sufficient condition, this failure does not necessarilymean that the beta pre-template cannot imply contextual refinement. Nevertheless,the failure suggests how the operation stat could violate the contextual refinement.
It namely indicates that such a violation would rely on equality testing of integers,
such as an active operation test(t, u; −) whose rewrite transition is only definedwhen the two eager arguments are the same integer.

Finally, the characterisation theorem (Thm. 4.3.14 below) enables us to prove
˙ Q0 and ˙ Q00 , under the assumpcontextual refinement CQ using state refinements tion that the machine is deterministic and refocusing, and that the triple (Q, Q0 , Q00 )is reasonable in the following sense.
Definition 4.3.13 (Reasonable triples). A triple (Q, Q0 , Q00 ) of preorders on N isreasonable if the following hold:(A) Q is closed under addition, i.e. any k1 Q k2 and k10 Q k20 satisfy (k1 + k10 ) Q(k2 + k20 ).
(B) Q0 ⊆ ≥N , and Q0 ⊆ Q00 .
(C) Q0 ◦ Q ◦ Q00 ⊆ Q, where ◦ denotes composition of binary relations.

114

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Examples of a reasonable triple (Q, Q0 , Q00 ) include:(N × N, ≥N , N × N),(N × N, ≥N , ≥N ), (N × N, =N , =N ), (≥N , ≥N , ≥N ), (≥N , =N , ≥N ), (≤N , =N , ≤N ),(≥N , =N , =N ), (≤N , =N , =N ), (=N , =N , =N ).
Theorem 4.3.14. If a universal abstract machine U(O, BO ) is deterministic andrefocusing, it satisfies the following property. For any set C ⊆ Hω (L, MO ∪ M) ofcontexts that is closed under plugging, any reasonable triple (Q, Q0 , Q00 ), and any
pre-template C on focus-free hypernets Hω (L, MO \{?, X, }):1. If C is a (C, Q, Q0 )-template and (C, Q, Q0 , Q00 )-robust relative to all rewrite
transitions, then C implies contextual refinement in C up to Q, i.e. any G1 C
G2 implies G1 CQ G2 .
2. If C is a (C, Q−1 , Q0 )-template and the converse C−1 is (C, Q, Q0 , Q00 )-robust
relative to all rewrite transitions, then C−1 implies contextual refinement in C
up to Q, i.e. any G1 C G2 implies G2 CQ G1 .
Proof. This is a consequence of Prop. 4.4.6, Prop. 4.4.2 and Prop. 4.4.4 in Sec. 4.4.

Remark 4.3.15 (Monotonicity). Contextual/state refinement and equivalence aremonotonic with respect to Q, in the sense that Q1 ⊆ Q2 implies Q1 ⊆ Q2 for each˙ ',˙ C , 'C }. Contextual refinement and equivalence are anti-monotonic with ∈ {,respect to C, in the sense that C1 ⊆ C2 implies C2 ⊆ C1 for each  ∈ {Q , 'Q }.
This means, in particular, 'QO ⊆ 'QO-bf .
CCGiven that C1 ⊆ C2 , Q1 ⊆ Q2 , Q01 ⊆ Q02 , Q01 ⊆ Q02 , R1 ⊆ R2 and R10 ⊆
R20 , the following holds. Any C1 -specimen is a C2 -specimen, and any quasi-C1 specimen up to (R1 , R10 ) is a quasi-C2 -specimen up to (R2 , R20 ). Any (C, Q1 , Q01 )template is a (C, Q2 , Q02 )-template. If C is (C, Q1 , Q01 , Q001 )-robust relative to a rewrite
transition, then it is also (C, Q2 , Q02 , Q002 )-robust relative to the same transition. Notethat the notions of template and robustness are not monotonic nor anti-monotonic
with respect to C.

4.3. A CHARACTERISATION THEOREM

115

To prove that a pre-template C induces contextual equivalence, one can use
Thm. 4.3.14(1) twice with respect to C and C−1 .

One can alternatively use

Thm. 4.3.14(1) and Thm. 4.3.14(2), both with respect to C. This alternative approach is often more economical. The reason is that the approach involves proving
input-safety of C with respect to two parameters (C, Q, Q0 ) and (C, Q−1 , Q0 ), which
typically boils down to a proof for one parameter, thanks to the monotonicity.

4.3.3

Sufficient conditions for robustness

A proof of robustness becomes trivial for a specimen with a rewrite token that givesa non-rooted state. Thanks to the lemma below, we can show that a state is not
rooted, by checking paths from the token target.
Definition 4.3.16 (Accessible paths).
• A path of a hypernet is said to be accessible if it consists of edges whose all
sources have type ?.
• An accessible path is called stable if the labels of its edges are included in{I} ∪ OX .
• An accessible path is called active if it starts with one active operation edge
and possibly followed by a stable path.
Note that box edges and atom edges never appear in an accessible path.
Lemma 4.3.17. If a state has a rewrite token that is not an incoming edge of acontraction edge, then the state satisfies the following property: If there exists anaccessible, but not active, path from the token target, then the state is not rooted.
Proof. This is a contraposition of a consequence of Lem. A.3.5 and Lem. A.4.6(2).

116

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Checking the condition (III) of robustness (see Def. 4.3.11) involves finding a
˙ Q0 , ˙ Q00 ), namely checking the condition (B) of
quasi-C-specimen of C up to (Def. 4.3.6(2). The following lemma enables us to use contextual refinement CQ0
˙ Q0 , via single C-specimens of a certain pre-template C.
to yield state refinement 
Definition 4.3.18. A pre-template C is a trigger if it satisfies the following:˙(A) For any single C-specimen (C[χ];H 1 ; H 2 ) of C, such that C˙ has an entering
˙ p ] → hC[H˙ p ]i /? for each p ∈ {1, 2}.
search token, C[H(B) For any hypernets H 1 C H 2 , both H1 and H2 are one-way.
Lemma 4.3.19. Let C be a set of contexts, and Q0 be a binary relation on N suchthat, for any k0 , k1 , k2 ∈ N, (k0 + k1 ) Q0 (k0 + k2 ) implies k1 Q0 k2 . Let C be a
pre-template that is a trigger and implies contextual refinement CQ0 . For any single
˙
C-specimen (C[χ];H 1 ; H 2 ) of C, if compute transitions are all deterministic, and˙ 1 ] and C[H˙ 2 ] is rooted, then the other state is also rooted, andone of states C[H˙ 1] 
˙ 2 ].
˙ Q0 C[Hmoreover, C[HProof. This is a corollary of Lem. A.6.1.
Remark 4.3.20. The notion of contextual refinement concerns initial states, andtherefore, only enables us to safely replace a part of a hypernet before execution.
Because any initial state is rooted, if all transitions preserve the rooted property,
we can safely assume that any state that arises in an execution is rooted. If alltransitions are also deterministic, Lem. 4.3.19 enables us to use some contextualrefinement and safely replace a part of a hypernet during execution. This can validate
run-time garbage collection, for example.

4.4

Proof of the characterisation theorem

This section details the proof of Thm. 4.3.14, with respect to the machine U(O, BO )parametrised by O and BO .

4.4. PROOF OF THE CHARACTERISATION THEOREM

117

At the core of the proof is step-wise reasoning, or transition-wise reasoning, using
a lax variation of simulation. Providing a simulation boils down to case analysis ontransitions, namely on possible interactions between the token and parts of states
contributed by a pre-template. While output-closure helps us disprove some cases
under the assumption that the machine is refocusing, input-safety and robustness
deal with the cases that are specific to a pre-template and an operation set.
The step-wise reasoning is enriched with the so-called up-to technique (see e.g. Milner [1999]). Our variation of simulation is namely up to state refinements, which isreflected in the definition of quasi-specimen (Def. 4.3.6(2)). In order to make thisparticular up-to technique work, it is essential to additionally equip our simulation
with a quantitative restriction. The restriction is implemented by the notion of reasonable triple. A similar form of up-to technique is studied categorically by Bonchi
et al. [2017], but for the ordinary notion of (weak) simulation, without this quantitative restriction.
The lax variation of simulation we use is namely (Q, Q0 , Q00 )-simulation,
parametrised by a triple (Q, Q0 , Q00 ). This provides a sound approach to prove state˙ Q , using ˙ Q0 and ˙ Q00 , given that all transitions are deterministic andrefinement (Q, Q0 , Q00 ) forms a reasonable triple.
Definition 4.4.1 ((Q, Q0 , Q00 )-simulations). Let R be a binary relation on states,and (Q, Q0 , Q00 ) be a triple of preorders on N. The binary relation R is a (Q, Q0 , Q00 )simulation if, for any two related states Ġ1 R Ġ2 , the following (A) and (B) hold:(A) If Ġ1 is final, Ġ2 is also final.
(B) If there exists a state Ġ01 such that Ġ1 → Ġ01 , one of the following (I) and (II)holds:(I) There exists a stuck state Ġ001 such that Ġ01 →∗ Ġ001 .
(II) There exist two states Ḣ1 and Ḣ2 , and numbers k1 , k2 ∈ N, such that˙ Q0 ◦ R ◦ ˙ Q00 ) Ḣ2 , (1 + k1 ) Q k2 , Ġ01 →k1 Ḣ1 , and Ġ2 →k2 Ḣ2 .
Ḣ1 (

118

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Proposition 4.4.2. When the universal abstract machine U(O, BO ) is deterministic, it satisfies the following.
For any binary relation R on states, and any reasonable triple (Q, Q0 , Q00 ), if R
is a (Q, Q0 , Q00 )-simulation, then R implies refinement up to Q, i.e. any Ġ1 R Ġ2
˙ Q Ġ2 .
implies Ġ1 

Proof. Our goal is to show the following: for any states Ġ1 R Ġ2 , any number k1 ∈ N
and any final state Ṅ1 , such that Ġ1 →k1 Ṅ1 , there exist a number k2 ∈ N and a
final state Ṅ2 such that k1 Q k2 and Ġ2 →k2 Ṅ2 . The proof is by induction on
k1 ∈ N.
In the base case, when k1 = 0, the state Ġ1 is itself final because Ġ1 = Ṅ1 .
Because R is a (Q, Q0 , Q00 )-simulation, Ġ2 is also a final state, which means we cantake 0 as k2 and Ġ2 itself as Ṅ2 . Because (Q, Q0 , Q00 ) is a reasonable triple, Q is apreorder and 0 Q 0 holds.
In the inductive case, when k1 > 0, we assume the induction hypothesis on
any h ∈ N such that h < k1 . Now that k1 > 0, there exists a state Ġ01 suchthat Ġ1 → Ġ01 →k−1 Ṅ1 . Because all intrinsic transitions are deterministic, theassumption that compute transitions are all deterministic implies that states andtransitions comprise a deterministic abstract rewriting system, in which final statesand stuck states are normal forms. By Lem. A.3.1, we can conclude that there exists
no stuck state Ġ001 such that Ġ01 →∗ Ġ001 .
Therefore, by R being a (Q, Q0 , Q00 )-simulation, there exist two states Ḣ1 and Ḣ2 ,˙ Q0 ◦ R ◦ ˙ Q00 ) Ḣ2 , (1 + l1 ) Q l2 , Ġ01 →l1 Ḣ1 ,and numbers l1 , l2 ∈ N, such that Ḣ1 (and Ġ2 →l2 Ḣ2 . By the determinism, 1 + l1 ≤ k1 must hold; if Ḣ1 is a final state,Ġ01 →l1 Ḣ1 must coincide with Ġ01 →k−1 Ṅ1 ; otherwise, Ġ01 →l1 Ḣ1 must be a suffixof Ġ01 →k−1 Ṅ1 . There exist two states Ḣ3 and Ḣ4 , and we have the following
˙ Q00 are represented by vertical dotted
˙ Q0 and 
situation, where the relations R, 

4.4. PROOF OF THE CHARACTERISATION THEOREM

119

lines from top to bottom.

G˙1

/ G˙0

k1 −1−l1

l1

/ Ḣ1

1

/

N˙1

˙ 0

Q
R

Ḣ3

(1+l1 ) Q l2

R
Ḣ4
˙ 00

Q

l2

/ Ḣ2

G˙2

We expand the above diagram as below (indicated by magenta), in three steps.

G˙1

/ G˙0

1

l1

/ Ḣ1

k1 −1−l1

˙ 0

Q
Ḣ3
R

(1+l1 ) Q l2/

(k1 −1−l1 ) Q0 m3
m3

/

m4

/

˙ 00

Q
G˙2

l2

/ Ḣ2

N˙3
m3 Q m4

R

Ḣ4

N˙1

N˙4

m4 Q00 m2
m2

/

N˙2

Firstly, by definition of state refinement, there exist a number m3 ∈ N and a final
state Ṅ3 such that (k1 − 1 − l1 ) Q0 m3 and Ḣ3 →m3 Ṅ3 . Because (Q, Q0 , Q00 ) is areasonable triple, Q0 ⊆≥N , and hence k1 > k1 − 1 − l1 ≥ m3 . Therefore, secondly,
by induction hypothesis on m3 , there exist a number m4 ∈ N and a final state Ṅ4such that m3 Q m4 and Ḣ4 →m4 Ṅ4 . Thirdly, by definition of state refinement, there
exist a number m2 ∈ N and a final state Ṅ2 such that m4 Q00 m2 and Ḣ2 →m2 Ṅ2 .
Now we have (k1 − 1 − l1 ) Q0 m3 , m3 Q m4 and m4 Q00 m2 , which means(k1 − 1 − l1 ) (Q0 ◦ Q ◦ Q00 ) m2 . Because (Q, Q0 , Q00 ) is a reasonable triple, this
implies (k1 − 1 − l1 ) Q m2 , and moreover, k1 Q (l2 + m2 ). We can take l2 + m2 as
k2 .

120

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

The token in a focussed context C˙ is said to be remote, if it is a search token, avalue token, or not entering. The procedure of contextual lifting reduces a proof ofcontextual refinement down to that of state refinement.
Definition 4.4.3 (Contextual lifting). Let C ⊆ Hω (L, MO ∪ M) be a set of contexts. Given a pre-template C on focus-free hypernets Hω (L, MO \{?, X, }), its
C-contextual lifting CC is a binary relation on states defined by: Ġ1 CC Ġ2 if there˙ H~ p ],˙ H~ 1 ; H~ 2 ) of C, such that the token of C˙ is remote, Ġp = C[exists a C-specimen (C;˙ H~ p ] is rooted, for each p ∈ {1, 2}.
and C[
The contextual lifting CC is by definition a binary relation on rooted states.
Proposition 4.4.4. For any set C ⊆ Hω (L, MO ∪ M) of contexts that is closed
under plugging, any preorder Q on N, and any pre-template C on focus-free hy˙Qpernets Hω (L, MO \{?, X, }), if the C-contextual lifting CC implies refinement ˙ Q ), then C implies contextual refinement CQ (resp. contextual(resp. equivalence 'equivalence 'CQ ).
Proof of refinement case. Our goal is to show that, for any H1 C H2 and any focusfree context C[χ] ∈ C such that ?; C[H1 ] and ?; C[H2 ] are states, we have refinement
˙ Q ?; C[H2 ].
?; C[H1 ] Because ?; C[Hp ] =?; (C[Hp ]) = (?; C)[Hp ] for p ∈ {1, 2}, and |?; C| = C ∈ C, thetriple ((?; C); H1 ; H2 ) is a C-specimen of C with a search token. Moreover the states?; C[H1 ] and ?; C[H2 ] are trivially rooted. Therefore, ?; C[H1 ] CC ?; C[H2 ], and by the˙ Q ?; C[H2 ].
assumption, ?; C[H1 ] Proof of equivalence case. It suffices to show that, for any H1 C H2 and any focusfree context C[χ] ∈ C such that ?; C[H1 ] and ?; C[H2 ] are states, we have refinements
˙ Q ?; C[H2 ] and ?; C[H2 ] ˙ Q ?; C[H1 ], i.e. equivalence ?; C[H1 ] '˙ Q ?; C[H2 ].
?; C[H1 ] Because ?; C[Hp ] =?; (C[Hp ]) = (?; C)[Hp ] for p ∈ {1, 2}, and |?; C| = C ∈ C, thetriple ((?; C); H1 ; H2 ) is a C-specimen of C with a search token. Moreover the states

4.4. PROOF OF THE CHARACTERISATION THEOREM

121?; C[H1 ] and ?; C[H2 ] are trivially rooted. Therefore, ?; C[H1 ] CC ?; C[H2 ], and by the˙ Q ?; C[H2 ].
assumption, ?; C[H1 ] 'Lemma 4.4.5. For any set C ⊆ Hω (L, MO ∪ M) of contexts that is closed underplugging, any pre-template C on focus-free hypernets Hω (L, MO \{?, X, }), and any
˙ χ]; H~ 1 ; H~ 2 ) of C, the following holds.
C-specimen (C[~˙ H~ 1 ] is final (resp. initial) if and only if the state C[
˙ H~ 2 ] is final
1. The state C[(resp. initial).
˙ H~ 1 ] and C[
˙ H~ 2 ] are both rooted states, then the
2. If C is output-closed, and C[
token of C˙ is not exiting.
˙ H~ 1 ] and C[
˙ H~ 2 ] are both rooted states, the token of C˙ is
3. If C is output-closed, C[a value token or a non-entering search token, and a transition is possible from˙ H~ 1 ] or C[
˙ H~ 2 ], then there exists a focussed context Ċ 0 with a remote tokenC[˙ and C[˙ H~ p ] → Ċ 0 [H~ p ] for each p ∈ {1, 2}.
such that |Ċ 0 | = |C|˙ H~ p ]Proof of point (1). Let (p, q) be an arbitrary element of a set {(1, 2), (2, 1)}. If C[
˙ H~ p ]. Because input lists ofis final (resp. initial), the token source is an input in C[
˙ H~ p ], C˙ and C[
˙ H~ q ] all coincide, the token source must be an input in C,
˙ and inC[
˙ H~ q ] too. This means C[
˙ H~ q ] is also a final (resp. initial) state.
C[
Proof of point (2). This is a consequence of the contraposition of Lem. A.3.7(3).
˙ H~ 1 ] or C[
˙ H~ 2 ] is necessarily a
Proof of the point (3). The transition possible from C[
˙ we can confirm that the searchsearch transition. By case analysis on the token of C,˙transition applies an interaction rule to the token and an edge from C.
• When the token of C˙ is a value token, the transition can only change the token
and its incoming operation edge. Because C is output-closed, by the point (2),the token of C˙ is not exiting. This implies that the incoming operation edge
˙ H~ 1 ] and C[
˙ H~ 2 ].
of the token is from C˙ in both states C[

122

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE• When the token of C˙ is a non-entering search token, the transition can onlychange the token and its outgoing edge. Because the token is not entering in
˙ the outgoing edge is from C˙ in both states C[
˙ H~ 1 ] and C[
˙ H~ 2 ].
C,
Therefore, there exist a focus-free simple context C0 [χ, χ~ ] and an interaction rule~ ] is a focussed context.
~ ], and C0 [Ṅ00 , χṄ0 7→ Ṅ00 , such that C˙ = C0 [Ṅ0 , χ
˙ = |C0 [Ṅ0 , χ~ ]| =
Examining interaction rules confirms |Ṅ0 | = |Ṅ00 |, and hence |C|~ ]|. By definition of search transitions, we have:|C0 [Ṅ00 , χ
˙ H~ p ] = C0 [Ṅ0 , H~ p ] → C0 [Ṅ00 , H~ p ]C[for each p ∈ {1, 2}.
The rest of the proof is to check that C0 [Ṅ00 , χ~ ] has a remote token, namely that,
if its token is a rewrite token, the token is not entering. This is done by inspecting
interaction rules.
• When the interaction rule Ṅ0 7→ Ṅ00 changes a value token to a rewrite token,
this must be the interaction rule (5a), which means Ṅ00 consists of the rewrite
token and its outgoing operation edge. The operation edge remains to be a(unique) outgoing edge of the token in C0 [Ṅ00 , χ~ ], and hence the token is notentering in C0 [Ṅ00 , χ~ ].
• When the interaction rule Ṅ0 7→ Ṅ00 changes a search token to a rewrite token,
this must be the interaction rule (1a), (1b) or (5b), which means Ṅ00 = hṄ0 i /? .
˙ the token is also not entering
Because the token is not entering in C0 [Ṅ0 , χ~ ] = C,in C0 [Ṅ00 , χ~ ] = hC0 [Ṅ0 , χ~ ]i /? .

Proposition 4.4.6. When the universal abstract machine U(O, BO ) is deterministic
and refocusing, it satisfies the following, for any set C ⊆ Hω (L, MO ∪ M) of contexts

4.4. PROOF OF THE CHARACTERISATION THEOREM

123

that is closed under plugging, any reasonable triple (Q, Q0 , Q00 ), and any pre-template
C on focus-free hypernets Hω (L, MO \{?, X, }).
1. If C is a (C, Q, Q0 )-template and (C, Q, Q0 , Q00 )-robust relative to all rewrite
transitions, then the C-contextual lifting CC is a (Q, Q0 , Q00 )-simulation.
2. If C is a (C, Q−1 , Q0 )-template and the converse C−1 is (C, Q, Q0 , Q00 )-robust
relative to all rewrite transitions, then the C-contextual lifting C−1

Cof theconverse is a (Q, Q0 , Q00 )-simulation.
˙ H~ 1 ; H~ 2 ) be an arbitrary C-specimen of C, such that the token
Proof prelude. Let (C;˙ H~ p ] is a rooted state for each p ∈ {1, 2}. By definitionof C˙ is remote, and Ġp := C[of contextual lifting, Ġ1 CC Ġ2 , and equivalently, Ġ2 (CC )−1 Ġ1 . Note that C−1 =C(CC )−1 .
˙ ThisBecause C is output-closed, by Lem. 4.4.5(2), the token is not exiting in C.
implies that, if the token has an incoming edge in Ġ1 or Ġ2 , the incoming edge must˙
be from C.
Because the machine is deterministic and refocusing, rooted states and transitions comprise a deterministic abstract rewriting system, in which final states andstuck states are normal forms. By Lem. A.3.1, from any state, a sequence of transitions that results in a final state or a stuck state is unique, if any.
Because (Q, Q0 , Q00 ) is a reasonable triple, Q0 and Q00 are reflexive. By Lem. A.5.2,
˙ Q0 ◦ CC ◦ 
˙ Q00 , and˙ Q0 and ˙ Q00 are reflexive, and hence CC ⊆ this implies that ˙ Q0 ◦ (CC )−1 ◦ 
˙ Q00 .
(CC )−1 ⊆ 
Proof of the point (1). Our goal is to check conditions (A) and (B) of Def. 4.4.1 forthe states Ġ1 CC Ġ2 .
If Ġ1 is final, by Lem. 4.4.5(1), Ġ2 is also final. The condition (A) of Def. 4.4.1
is fulfilled.
If there exists a state Ġ01 such that Ġ1 → Ġ01 , we show that one of the conditions
˙(I) and (II) of Def. 4.4.1 is fulfilled, by case analysis of the token in C.

124

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE• When the token is a value token, or a search token that is not entering, byLem. 4.4.5(3), there exists a focussed context Ċ 0 with a remote token, such˙ and Ġp = C[˙ H~ p ] → Ċ 0 [H~ p ] for each p ∈ {1, 2}. We have thethat |Ċ 0 | = |C|following situation, namely the black part of the diagram below. Showing themagenta part confirms that the condition (II) of Def. 4.4.1 is fulfilled.
/ C˙0 [H~1 ] = G˙0

˙ H~1 ]
G˙1 =C[C1

1Q1
C
˙ H~2 ]
G˙2 =C[CC/ C˙0 [H~2 ]By the determinism, Ċ 0 [H~ 1 ] = Ġ01 . Because (Q, Q0 , Q00 ) is a reasonable triple, Q˙ ∈ C, so (Ċ 0 ; H~ 1 ; H~ 2 )is a preorder and 1 Q 1. The context Ċ 0 satisfies |Ċ 0 | = |C|is a C-specimen of C. The context Ċ 0 has a remote token, and the states Ċ 0 [H~ 1 ]and Ċ 0 [H~ 2 ] are both rooted. Therefore, we have Ċ 0 [H~ 1 ] CC Ċ 0 [H~ 2 ].
˙ because C is (C, Q, Q0 )• When the token is a search token that is entering in C,
input-safe, we have one of the following three situations corresponding to (I),(II) and (III) of Def. 4.3.7.
– There exist two stuck states Ṅ1 and Ṅ2 such that Ġp →∗ Ṅp for eachp ∈ {1, 2}. By the determinism of transitions, we have Ġ1 → Ġ01 →∗ Ṅ1 ,which means the condition (I) of Def. 4.4.1 is satisfied.
– There exist a C-specimen (Ċ 0 ; H~01 ; H~02 ) of C and two numbers k1 , k2 ∈ N,
such that the token of Ċ 0 is not a rewrite token and not entering, (1+k1 ) Q
˙ H~ 1 ] →1+k1 Ċ 0 [H~01 ], and C[
˙ H~ 2 ] →k2 Ċ 0 [H~02 ]. By the determinism of
k2 , C[transitions, we have the following situation, namely the black part of the
diagram below. Showing the magenta part confirms that the condition(II) of Def. 4.4.1 is fulfilled.

˙ H~1 ]
G˙1 =C[CC˙ H~2 ]
G˙2 =C[/ G˙0

k1/ C˙0 [H~01 ](1+k1 ) Q k2

CCk2
/ C˙0 [H~02 ]1

4.4. PROOF OF THE CHARACTERISATION THEOREM

125

The context Ċ 0 has a remote token, and states Ċ 0 [H~01 ] and Ċ 0 [H~02 ] arerooted. Therefore, Ċ 0 [H~01 ] CC Ċ 0 [H~02 ].
˙ Q0 , '˙ Q0 ), whose– There exist a quasi-C-specimen (Ṅ1 , Ṅ2 ) of C up to ('token is not a rewrite token, and two numbers k1 , k2 ∈ N, such that˙ H~ 1 ] →1+k1 Ṅ1 , and C[
˙ H~ 2 ] →1+k2 Ṅ2 . By the(1 + k1 ) Q (1 + k2 ), C[
determinism of transitions, we have the following situation, namely theblack part of the diagram below. Showing the magenta part confirmsthat the condition (II) of Def. 4.4.1 is fulfilled.

˙ H~1 ]
G˙1 =C[CC˙ H~2 ]
G˙2 =C[/ G˙0

1(1+k1 ) Q (1+k2 )

k1
/ N˙1
˙ 0 ◦CC ◦
˙ 00

Q
Q
1+k2
/ N˙2

˙ Q0 , '˙ Q0 ), and states
Because (Ṅ1 , Ṅ2 ) is a quasi-C-specimen of C up to ('Ṅ1 and Ṅ2 are rooted, there exists a C-specimen (Ċ 0 ; H~01 ; H~02 ) of C with
˙ Q0
a non-rewrite token, such that Ċ 0 [H~01 ] and Ċ 0 [H~02 ] are also rooted, Ṅ1 '˙ Q0 Ṅ2 . Because (Q, Q0 , Q00 ) is a reasonable triple,
Ċ 0 [H~01 ], and Ċ 0 [H~02 ] '˙ Q0 ⊆ '˙ Q00 . Therefore, we have:Q0 ⊆ Q00 , and hence '˙ Q00 Ṅ2 .
˙ Q0 Ċ 0 [H~01 ] CC Ċ 0 [H~02 ] Ṅ1 • When the token is a rewrite token, Ġ1 → Ġ01 is a rewrite transition, and by˙ Because C
definition of contextual lifting, the token is not entering in C.
is (C, Q, Q0 , Q00 )-robust relative to all rewrite transitions, and Ġ1 and Ġ2 arerooted, we have one of the following two situations corresponding to (II) and(III) of Def. 4.3.11.
– There exists a stuck state Ṅ such that Ġ01 →∗ Ṅ . The condition (I) of
Def. 4.4.1 is satisfied.
˙ Q0 , ˙ Q00 ), whose– There exist a quasi-C-specimen (Ṅ1 , Ṅ2 ) of C up to (126

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

token is not a rewrite token, and two numbers k1 , k2 ∈ N, such that
(1 + k1 ) Q k2 , Ġ01 →k1 Ṅ1 , and Ġ2 →k2 Ṅ2 . We have the following
situation, namely the black part of the diagram below. Showing themagenta part confirms that the condition (II) of Def. 4.4.1 is fulfilled.

˙ H~1 ]
G˙1 =C[/ G˙0

1(1+k1 ) Q k2
CC
˙ H~2 ]
G˙2 =C[k1/ N˙1
˙ 0 ◦CC ◦
˙ 00

Q
Q
k2
/ N˙2

˙ Q0 , ˙ Q00 ), and states
Because (Ṅ1 , Ṅ2 ) is a quasi-C-specimen of C up to (Ṅ1 and Ṅ2 are rooted, there exists a C-specimen (Ċ 0 ; H~01 ; H~02 ) of C with
˙ Q0
a non-rewrite token, such that Ċ 0 [H~01 ] and Ċ 0 [H~02 ] are also rooted, Ṅ1 
˙ Q00 Ṅ2 . This means Ċ 0 [H~01 ] CC Ċ 0 [H~02 ], and hence:Ċ 0 [H~01 ], and Ċ 0 [H~02 ] ˙ Q0 Ċ 0 [H~01 ] CC Ċ 0 [H~02 ] ˙ Q00 Ṅ2 .
Ṅ1 

Proof of the point (2). It suffices to check the reverse of conditions (A) and (B) of
Def. 4.4.1 for the states Ġ2 (CC )−1 Ġ1 , namely the following conditions (A’) and(B’).
(A’) If Ġ2 is final, Ġ1 is also final.
(B’) If there exists a state Ġ02 such that Ġ2 → Ġ02 , one of the following (I’) and(II’) holds.
(I’) There exists a stuck state Ġ002 such that Ġ02 →∗ Ġ002 .
(II’) There exist two states Ṅ2 and Ṅ1 , and numbers k2 , k1 ∈ N, such that˙ Q0 ◦ (CC )−1 ◦ 
˙ Q0 ) Ṅ1 , (1 + k2 ) Q k1 , Ġ02 →k2 Ṅ2 , and Ġ1 →k1 Ṅ1 .
Ṅ2 (
The proof is mostly symmetric to the point (1). Note that there is a one-to-one
correspondence between C-specimens of C and C-specimens of C−1 ; any C-specimen(C˙0 ; H~01 ; H~02 ) of C gives a C-specimen (C˙0 ; H~02 ; H~01 ) of C−1 . Because C is outputclosed, its converse C−1 is also output-closed.

4.4. PROOF OF THE CHARACTERISATION THEOREM

127

If Ġ2 is final, by Lem. 4.4.5(1), Ġ1 is also final. The condition (A’) is fulfilled.
If there exists a state Ġ02 such that Ġ2 → Ġ02 , we show that one of the conditions
˙(I’) and (II’) above is fulfilled, by case analysis of the token in C.

• When the token is a value token, or a search token that is not entering, byLem. 4.4.5(3), there exists a focussed context Ċ 0 with a remote token, such˙ and Ġp = C[˙ H~ p ] → Ċ 0 [H~ p ] for each p ∈ {1, 2}. We have thethat |Ċ 0 | = |C|following situation, namely the black part of the diagram below. Showing themagenta part confirms that the condition (II’) is fulfilled.

˙ H~1 ]
G˙2 =C[
1Q1(CC )−1~1˙˙
G1 =C[H ]/ C˙0 [H~2 ] = G˙02(CC )−1/ C˙0 [H~1 ]By the determinism, Ċ 0 [H~ 2 ] = Ġ02 . Because (Q, Q0 , Q00 ) is a reasonable triple, Q˙ ∈ C, so (Ċ 0 ; H~ 2 ; H~ 1 )is a preorder and 1 Q 1. The context Ċ 0 satisfies |Ċ 0 | = |C|is a C-specimen of C−1 . The context Ċ 0 has a remote token, and the statesĊ 0 [H~ 1 ] and Ċ 0 [H~ 2 ] are both rooted. Therefore, we have Ċ 0 [H~ 2 ] (CC )−1 Ċ 0 [H~ 1 ].
˙ because C is (C, Q−1 , Q0 )• When the token is a search token that is entering in C,
input-safe, we have one of the following three situations corresponding to (I),(II) and (III) of Def. 4.3.7.

– There exist two stuck states Ṅ1 and Ṅ2 such that Ġp →∗ Ṅp for eachp ∈ {1, 2}. By the determinism of transitions, we have Ġ2 → Ġ02 →∗ Ṅ2 ,which means the condition (I’) is satisfied.
– There exist a C-specimen (Ċ 0 ; H~01 ; H~02 ) of C and two numbers k1 , k2 ∈N, such that the token of Ċ 0 is not a rewrite token and not entering,˙ H~ 1 ] →1+k1 Ċ 0 [H~01 ], and C[
˙ H~ 2 ] →k2 Ċ 0 [H~02 ]. We have
(1 + k1 ) Q−1 k2 , C[

128

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

the following situation, namely the black part of the diagram below.
k2/

˙ H~2 ]
G˙2 =C[(CC )−1C˙0 [H~02 ](CC )−1

k2 Q (1+k1 )1+k1/

˙ H~1 ]
G˙1 =C[C˙0 [H~01 ]The magenta part holds, because the token of Ċ 0 is not a rewrite token
and not entering, and because states Ċ 0 [H~01 ] and Ċ 0 [H~02 ] are rooted. We
check the condition (II’) by case analysis on the number k2 .
∗ When k2 > 0, by the determinism of transitions, we have the following diagram, which means the condition (II’) is fulfilled.

(CC )−1

k2 −1

/

/ G˙0

˙ H~2 ]
G˙2 =C[

2(CC )−1

k2 Q (1+k1 )1+k1/

˙ H~1 ]
G˙1 =C[C˙0 [H~02 ]C˙0 [H~01 ]˙ H~ 2 ] = Ċ 0 [H~02 ], and we have the following∗ When k2 = 0, Ġ2 = C[situation, namely the black part of the diagram below.
0/

˙ H~2 ]
G˙2 =C[
C −1

(C )

C −1

0 Q (1+k1 )˙ H~1 ]
G˙1 =C[/ G˙0 =C˙00 [H~01 ]G˙2 =C˙0 [H~02 ]
(C )

1+k1

/

C˙0 [H~01 ]2

1Q1(CC )−1/ C˙00 [H~01 ]Because Ġ2 → Ġ02 , and the token of Ċ 0 is a value token, or a nonentering search token, by Lem. 4.4.5(3), there exists a focussed context C˙00 with a remote token, such that |C˙00 | = |Ċ 0 | and Ċ 0 [H~0p ] →C˙00 [H~0p ] for each p ∈ {1, 2}.

By the determinism of transitions,Ġ02 = C˙00 [H~01 ]. Because (Q, Q0 , Q00 ) is a reasonable triple, Q is apreorder and 1 Q 1. The context C˙00 satisfies |C˙00 | = |Ċ 0 | ∈ C, so(C˙00 ; H~02 ; H~01 ) is a C-specimen of C−1 . The context C˙00 has a remotetoken, and the states C˙00 [H~01 ] and C˙00 [H~02 ] are both rooted. Therefore,
we have C˙00 [H~02 ] (CC )−1 C˙00 [H~01 ]. Finally, because (Q, Q0 , Q00 ) is a rea-

4.4. PROOF OF THE CHARACTERISATION THEOREM

129

sonable triple, Q is closed under addition, and hence 1 Q (2 + k1 ).
The condition (II’) is fulfilled.
˙ Q0 , '˙ Q0 ), whose– There exist a quasi-C-specimen (Ṅ1 , Ṅ2 ) of C up to ('token is not a rewrite token, and two numbers k1 , k2 ∈ N, such that˙ H~ 1 ] →1+k1 Ṅ1 , and C[
˙ H~ 2 ] →1+k2 Ṅ2 . By the(1 + k1 ) Q−1 (1 + k2 ), C[
determinism of transitions, we have the following situation, namely theblack part of the diagram below. Showing the magenta part confirmsthat the condition (II’) is fulfilled.

˙ H~2 ]
G˙2 =C[(CC )−1
˙ H~1 ]
G˙1 =C[/ G˙0

2(1+k2 ) Q (1+k1 )

k2
/ N˙2
˙ 0 ◦(CC )−1 ◦
˙ 00

Q
Q
1+k1
/ N˙1

˙ Q0 , '˙ Q0 ), and states
Because (Ṅ1 , Ṅ2 ) is a quasi-C-specimen of C up to ('Ṅ1 and Ṅ2 are rooted, there exists a C-specimen (Ċ 0 ; H~01 ; H~02 ) of C with
˙ Q0
a non-rewrite token, such that Ċ 0 [H~01 ] and Ċ 0 [H~02 ] are also rooted, Ṅ1 '˙ Q0 Ṅ2 . Because (Q, Q0 , Q00 ) is a reasonable triple,
Ċ 0 [H~01 ], and Ċ 0 [H~02 ] '˙ Q0 ⊆ '˙ Q00 . Therefore, we have:Q0 ⊆ Q00 , and hence '˙ Q0 Ċ 0 [H~02 ] (CC )−1 Ċ 0 [H~01 ] ˙ Q00 Ṅ1 .
Ṅ2 • When the token is a rewrite token, Ġ2 → Ġ02 is a rewrite transition, and by˙ Because C−1
definition of contextual lifting, the token is not entering in C.
is (C, Q, Q0 , Q00 )-robust relative to all rewrite transitions, and Ġ1 and Ġ2 arerooted, we have one of the following two situations corresponding to (II) and(III) of Def. 4.3.11.
– There exists a stuck state Ṅ such that Ġ02 →∗ Ṅ . The condition (I’) issatisfied.
˙ Q0 , ˙ Q00 ), whose– There exist a quasi-C-specimen (Ṅ2 , Ṅ1 ) of C−1 up to (130

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

token is not a rewrite token, and two numbers k2 , k1 ∈ N, such that
(1 + k2 ) Q k1 , Ġ02 →k2 Ṅ2 , and Ġ1 →k1 Ṅ1 . We have the following
situation, namely the black part of the diagram below. Showing themagenta part confirms that the condition (II’) is fulfilled.

˙ H~2 ]
G˙2 =C[/ G˙0

2(1+k2 ) Q k1
(CC )−1
˙ H~1 ]
G˙1 =C[k2/ N˙2
˙ 0 ◦(CC )−1 ◦
˙ 00

Q
Q
k1
/ N˙1

˙ Q0 , ˙ Q00 ), andBecause (Ṅ2 , Ṅ1 ) is a quasi-C-specimen of C−1 up to (states Ṅ2 and Ṅ1 are rooted, there exists a C-specimen (Ċ 0 ; H~02 ; H~01 )of C−1 with a non-rewrite token, such that Ċ 0 [H~02 ] and Ċ 0 [H~01 ] are also
˙ Q0 Ċ 0 [H~02 ], and Ċ 0 [H~01 ] ˙ Q00 Ṅ1 . This means Ċ 0 [H~02 ] C−1 C
rooted, Ṅ2 
Ċ 0 [H~01 ], and hence:
˙ Q0 Ċ 0 [H~02 ] (CC )−1 Ċ 0 [H~01 ] ˙ Q00 Ṅ1 .
Ṅ2 

4.5

Applications of the characterisation theorem

This section shows applications of Thm. 4.3.14, with respect to an instantiation
U(Oex , BOex ) of the universal abstract machine. We start by defining the specific operation set Oex and its behaviour BOex in Sec. 4.5.1, which are informally introducedin Sec. 3.4.2, and proceed to illustrate proofs of the observational equivalences listed
in Sec. 3.4. Necessary templates and their robustness are discussed in Sec. 4.5.2, andSec. 4.5.3 describes how these templates can be combined to prove the observational
equivalences. Finally, Sec. 4.5.4 and Sec. 4.5.5 give further details of the reasoning
about templates and their robustness.

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

4.5.1

131

Properties of compute transitionsex
The operation set Oex = Oex
we use here is taken from those discussed in
X ] OSec. 3.4.2. It is namely given by passive operations Oex
X = Z ∪ {λ, (), tt, ff}, where→

Z is the set of integers, and active operations Oex = {@, ref, =, :=, !, +, −, −1 }.
The behaviour BOex , namely compute transitions for the active operations Oex ,are all defined locally via rewrite rules; for function application in Fig. 3.7, reference
manipulation in Fig. 3.9 and Fig. 3.10, and arithmetic in Fig. 3.8 (showing just addition, but other operators can be similarly added). In these rules, the hypernet GS
is additionally required to be stable.
Determinism and refocusing of the particular machine U(Oex , BOex ) boils down
to determinism and preservation of the rooted property of compute transitions.
→

Compute transitions of operations {@, ref, +, −, −1 } are deterministic, because
at most one rewrite rule can be applied to each state. In particular, the stablehypernet GS in the figures is uniquely determined (by Lem. A.4.1(3)).
As discussed in Sec. 3.5, copy transitions are all deterministic, because any possible application of a contraction rule results in the same state. Compute transitionsof name-accessing operations {=, :=, !} are deterministic for the same reason.
Compute transitions of all the operations Oex are stationary, and hence theypreserve the rooted property. The stationary property can be checked using local
rewrite rules. Namely, in each rewrite rule Ḣ 7→ Ḣ 0 of the operations, only one
input of |Ḣ| has type ?, and Ḣ = ; |Ḣ| and Ḣ 0 = ?; |Ḣ 0 |. Moreover, any output of|Ḣ| with type ? is a target of an atom edge or a box edge (by definition of stablehypernets), which implies |Ḣ| is one-way.
Because any initial state is rooted, given that all transitions preserve the rooted
property, we can safely assume that any state that arises in an execution is rooted.
This means that the additional specification on stable hypernets in local rewrite rules
is in fact guaranteed to be satisfied in any execution (by Lem. A.3.5, Lem. A.4.6

132

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

`

`

`

⊗ /⌦Assoc ⊗`⊗ /⌦Comm ⊗

`

`

⊗

⊗

`
` ?⌦k ⇧⌦h?⌦k ⇧⌦h?⌦k ⇧⌦h⌦(n+k) ⌦h⌦(n+k) ⌦h?
⇧?
⇧⊗ /⌦Idem ⊗ H
0?⌦k ⇧⌦h⇧⇢id (G) /BPerm ⇧⇢?
G
id
GC D ? D ⇧
?
?
/
k,0
h,0
` `
?
T n (?)T n (?)C` ⊗ ⊗<latexit sha1_base64="KF+NWGrc7RCmz91JrPxwQQLfzlw=">AAACBHicbVDLSsNAFJ34rPUVddnNYBHqpiQi6LLgQpcV7AOaGCaTaTt0JhNmJkIJWbjxV9y4UMStH+HOv3HSZqGtBy4czrmXe+8JE0aVdpxva2V1bX1js7JV3d7Z3du3Dw67SqQSkw4WTMh+iBRhNCYdTTUj/UQSxENGeuHkqvB7D0QqKuI7PU2Iz9EopkOKkTZSYNe8Nr3PPDkWeZB5HOmx5BmN8rxxfRrYdafpzACXiVuSOijRDuwvLxI45STWmCGlBq6TaD9DUlPMSF71UkUShCdoRAaGxogT5WezJ3J4YpQIDoU0FWs4U39PZIgrNeWh6SzOVIteIf7nDVI9vPQzGiepJjGeLxqmDGoBi0RgRCXBmk0NQVhScyvEYyQR1ia3qgnBXXx5mXTPmq7TdG/P6y1YxlEBNXAMGsAFF6AFbkAbdAAGj+AZvII368l6sd6tj3nrilXOHIE/sD5/ABklmEA=</latexit><latexit sha1_base64="T157myBTo65GMqrL00/4OcfPSYo=">AAACAnicbVDLSsNAFJ34rPUVdSVuBovoqiQi6LLgxmUF+4Amhslk0g6dyYSZiVBCcOOvuHGhiFu/wp1/46TNQlsPXDiccy/33hOmjCrtON/W0vLK6tp6baO+ubW9s2vv7XeVyCQmHSyYkP0QKcJoQjqaakb6qSSIh4z0wvF16fceiFRUJHd6khKfo2FCY4qRNlJgH3ptep97ciROiyD3ONIjyXMaFUVgN5ymMwVcJG5FGqBCO7C/vEjgjJNEY4aUGrhOqv0cSU0xI0XdyxRJER6jIRkYmiBOlJ9PXyjgiVEiGAtpKtFwqv6eyBFXasJD01neqOa9UvzPG2Q6vvJzmqSZJgmeLYozBrWAZR4wopJgzSaGICypuRXiEZIIa5Na3YTgzr+8SLrnTddpurcXjRas4qiBI3AMzoALLkEL3IA26AAMHsEzeAVv1pP1Yr1bH7PWJauaOQB/YH3+AAp8l7s=</latexit>

`

` `

?⌦k

` `

` `

`
`

` ⇧⌦h
`

?
` ` ⇧⌦h?⌦(n+k) ` ` ⇧⌦h?⌦(n+k) ` ` ⇧⌦hG
G/BPullC
?
?
n
n
T (?)
T (?)

` ⇧
`

`

⊗

⊗

⌦k

<latexit sha1_base64="9SMy2RmFP6GWTzCMKl9BndkWEyI=">AAACIXicbVDLSgMxFM34rPVVdekmWISKUGaqYJcFNy4r2Ad0aslk0jY0kwzJHaEM/RU3/oobF4p0J/6M6UPU1gsJh3PO5d57glhwA6774aysrq1vbGa2sts7u3v7uYPDulGJpqxGlVC6GRDDBJesBhwEa8aakSgQrBEMrid644Fpw5W8g2HM2hHpSd7llIClOrmyb4Do+9RXwCNmcEGeD85GPvaZEN8/9kNOIiXDH1t/1Mnl3aI7LbwMvDnIo3lVO7mxHyqaREwCFcSYlufG0E6JBk4FG2X9xLCY0AHpsZaFktg57XR64QifWibEXaXtk4Cn7O+OlETGDKPAOiMCfbOoTcj/tFYC3XI75TJOgEk6G9RNBAaFJ3HhkGtGQQwtIFRzuyumfaIJBRtq1obgLZ68DOqlondRLN1e5it4HkcGHaMTVEAeukIVdIOqqIYoekTP6BW9OU/Oi/PujGfWFWfec4T+lPP5BQeto1Q=</latexit>

⌦h

?⌦k

⊗

⊗

<latexit sha1_base64="9SMy2RmFP6GWTzCMKl9BndkWEyI=">AAACIXicbVDLSgMxFM34rPVVdekmWISKUGaqYJcFNy4r2Ad0aslk0jY0kwzJHaEM/RU3/oobF4p0J/6M6UPU1gsJh3PO5d57glhwA6774aysrq1vbGa2sts7u3v7uYPDulGJpqxGlVC6GRDDBJesBhwEa8aakSgQrBEMrid644Fpw5W8g2HM2hHpSd7llIClOrmyb4Do+9RXwCNmcEGeD85GPvaZEN8/9kNOIiXDH1t/1Mnl3aI7LbwMvDnIo3lVO7mxHyqaREwCFcSYlufG0E6JBk4FG2X9xLCY0AHpsZaFktg57XR64QifWibEXaXtk4Cn7O+OlETGDKPAOiMCfbOoTcj/tFYC3XI75TJOgEk6G9RNBAaFJ3HhkGtGQQwtIFRzuyumfaIJBRtq1obgLZ68DOqlondRLN1e5it4HkcGHaMTVEAeukIVdIOqqIYoekTP6BW9OU/Oi/PujGfWFWfec4T+lPP5BQeto1Q=</latexit>`<latexit sha1_base64="myOHjCICD4dudFRnwYHK+2l6HOA=">AAACFHicbVDLSgNBEJyNrxhfUY9eBoMQCYTdKOgx4MVjBPOAbAyzs5NkyOzMMtMrhCUf4cVf8eJBEa8evPk3Th6gJhY0FFXddHcFseAGXPfLyaysrq1vZDdzW9s7u3v5/YOGUYmmrE6VULoVEMMEl6wOHARrxZqRKBCsGQyvJn7znmnDlbyFUcw6EelL3uOUgJW6+ZJvgOi71FfAI2ZwUZaGp2Mf+yEnkZLhjzMYd/MFt+xOgZeJNycFNEetm//0Q0WTiEmgghjT9twYOinRwKlg45yfGBYTOiR91rZUErunk06fGuMTq4S4p7QtCXiq/p5ISWTMKApsZ0RgYBa9ifif106gd9lJuYwTYJLOFvUSgUHhSUI45JpRECNLCNXc3orpgGhCweaYsyF4iy8vk0al7J2VKzfnhSqex5FFR+gYFZGHLlAVXaMaqiOKHtATekGvzqPz7Lw577PWjDOfOUR/4Hx8A8MGnog=</latexit>⇧⌦h?⌦k?⌦(n+k) ⇧⌦h?⌦(n+k) ⇧⌦h
G/BPullW
G
?
?
n
T (?)
T n (?)<latexit sha1_base64="myOHjCICD4dudFRnwYHK+2l6HOA=">AAACFHicbVDLSgNBEJyNrxhfUY9eBoMQCYTdKOgx4MVjBPOAbAyzs5NkyOzMMtMrhCUf4cVf8eJBEa8evPk3Th6gJhY0FFXddHcFseAGXPfLyaysrq1vZDdzW9s7u3v5/YOGUYmmrE6VULoVEMMEl6wOHARrxZqRKBCsGQyvJn7znmnDlbyFUcw6EelL3uOUgJW6+ZJvgOi71FfAI2ZwUZaGp2Mf+yEnkZLhjzMYd/MFt+xOgZeJNycFNEetm//0Q0WTiEmgghjT9twYOinRwKlg45yfGBYTOiR91rZUErunk06fGuMTq4S4p7QtCXiq/p5ISWTMKApsZ0RgYBa9ifif106gd9lJuYwTYJLOFvUSgUHhSUI45JpRECNLCNXc3orpgGhCweaYsyF4iy8vk0al7J2VKzfnhSqex5FFR+gYFZGHLlAVXaMaqiOKHtATekGvzqPz7Lw577PWjDOfOUR/4Hx8A8MGnog=</latexit>

0⌦(h+h0 )00?⌦(k+k ) 0 ⇧ 0?⌦k ⇧⌦hH?⌦k ⇧⌦h
?
H
⌦k
?
? ⇧⌦h
? ⌦(n+k)?
? ⇧⌦h?⌦(n+k) ? ⇧⌦hGG/BPullD?
?
T n (?)T n (?)

Figure 4.1: Structural pre-templates (C :  ⇒ ? is a contraction tree, H is a copyable
hypernet, G is a hypernet, (ρ, ρ0 ) is a box-permutation pair)and Lem. A.4.4).

4.5.2

Example templates

Now we enumerate pre-templates that we will use to prove the equivalences listed
in Sec. 3.4. We use the following auxiliary definition to specify one of these pretemplates (namely CBPerm in Fig. 4.1).
Definition 4.5.1 (Box-permutation pair). For any n, k, h ∈ N, let ρ and ρ0 be
bijections on sets {1, . . . , n+k +h} and {1, . . . , k +h}, respectively. These bijections
form a box-permutation pair (ρ, ρ0 ) if, for each i ∈ {1, . . . , n + k + h}, the following
holds:(A) ρ(i) = i if 1 ≤ i ≤ n,(B) ρ(i) = ρ0 (i − n) if n < i ≤ n + k + h,(C) 1 ≤ ρ0 (i − n) ≤ k if n < i ≤ n + k,(D) k < ρ0 (i − n) ≤ k + h if n + k < i ≤ n + k + h.
The pre-templates we use are classified into three: structural pre-templates, operational pre-templates, and name-exhaustive pre-templates. While the structurallaws in Sec. 3.4.1 can be proved using only structural pre-templates, the beta laws

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

133

and stateful laws in Sec. 3.4.2 require operational and name-exhaustive pre-templates
as well as structural pre-templates.
Fig. 4.1 shows all the structural pre-templates but the one derived from contraction rules: namely, |Ġ1 | C⊗ |Ġ2 | whenever Ġ1 7→ Ġ2 is a contraction rule. The
structural pre-templates primarily concern contraction edges, weakening edges andbox edges. Contextual equivalences implied by C⊗Assoc , C⊗Comm and C⊗Idem enable
the so-called idempotent completion (aka. Karoubi envelope or Cauchy completion)
on contractions and weakenings. This means that contraction trees with the same
type can be identified, so long as they contain at least one weakening edge.
We use two operational pre-templates, which are directly derived from some local→

rewrite rules of active operations. Namely, |Ġ1 | C @ |Ġ2 | if Ġ1 7→ Ġ2 is a beta rewrite
rule (Fig. 3.7); and |Ġ1 | Cref |Ġ2 | if Ġ1 7→ Ġ2 is a reference-creation rewrite rule(Fig. 3.9). Note that we keep the additional specification that GS in these figures
are stable hypernets.
Fig. 4.2 shows the last class of pre-templates, namely four name-exhaustive pretemplates. They are specific to the four stateful laws in Desiderata 3.4.5, and they
analyse possible usages of a single name of interest.
Output-closure of all the pre-templates can be easily checked, typically by spotting that an input or an output, of type ?, is a source or a target of a contraction,
atom or box edge.
Table. 4.1 outlines the way we will use Thm. 4.3.14 on all the pre-templates.
For example, C⊗ is a (COex , ≥N , =N )-template, as shown in the “template” column,
and both itself and its converse are (COex , =N , =N , =N )-robust relative to all rewrite
transitions, as shown in the “robustness” columns. Thanks to the monotonicity(Remark 4.3.15), we can use Thm. 4.3.14(1) with a reasonable triple (≥N , =N , =N ),and Thm. 4.3.14(2) with a reasonable triple (≤N , =N , =N ). Consequently, H1 C⊗ H2
implies H1 ≥ON H2 and H2 ≤ON H1 , which is shown in the “implication of H1 C
C ex

H2 ” column.

C ex

134

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

()
⇧
D1,1

I
C

?⌦m
?
?

??
D1,1
m

?
?
m

=

⇥

ff

⇥

?

()

⊗

⇧
D1,1
/NE2

?

/NE1

λ

λ

?
?⌦m

?
?⌦m

I

⊗

k

-k

⇧
D1,1

⇧
D1,1

I

I

C

C

?⌦m1
?
??
D1,2

?⌦m1
?
??
D1,2

<latexit sha1_base64="trrDvg31bl8xLZSC6wegx4xo65A=">AAAB/HicbVBNS8NAEN34WetXtEcvi0XwVBIR9Fjw4rGC/YA2hs120y7dzYbdiRBC/StePCji1R/izX/jts1BWx8MPN6bYWZelApuwPO+nbX1jc2t7cpOdXdv/+DQPTruGJVpytpUCaV7ETFM8IS1gYNgvVQzIiPButHkZuZ3H5k2XCX3kKcskGSU8JhTAlYK3drAANEPxUABl8xgGfrT0K17DW8OvEr8ktRRiVbofg2GimaSJUAFMabveykEBdHAqWDT6iAzLCV0Qkasb2lC7KagmB8/xWdWGeJYaVsJ4Ln6e6Ig0phcRrZTEhibZW8m/uf1M4ivg4InaQYsoYtFcSYwKDxLAg+5ZhREbgmhmttbMR0TTSjYvKo2BH/55VXSuWj4XsO/u6w3cRlHBZ2gU3SOfHSFmugWtVAbUZSjZ/SK3pwn58V5dz4WrWtOOVNDf+B8/gDM+JS9</latexit>

?
⇥ ⊗

m1

<latexit sha1_base64="trrDvg31bl8xLZSC6wegx4xo65A=">AAAB/HicbVBNS8NAEN34WetXtEcvi0XwVBIR9Fjw4rGC/YA2hs120y7dzYbdiRBC/StePCji1R/izX/jts1BWx8MPN6bYWZelApuwPO+nbX1jc2t7cpOdXdv/+DQPTruGJVpytpUCaV7ETFM8IS1gYNgvVQzIiPButHkZuZ3H5k2XCX3kKcskGSU8JhTAlYK3drAANEPxUABl8xgGfrT0K17DW8OvEr8ktRRiVbofg2GimaSJUAFMabveykEBdHAqWDT6iAzLCV0Qkasb2lC7KagmB8/xWdWGeJYaVsJ4Ln6e6Ig0phcRrZTEhibZW8m/uf1M4ivg4InaQYsoYtFcSYwKDxLAg+5ZhREbgmhmttbMR0TTSjYvKo2BH/55VXSuWj4XsO/u6w3cRlHBZ2gU3SOfHSFmugWtVAbUZSjZ/SK3pwn58V5dz4WrWtOOVNDf+B8/gDM+JS9</latexit>

?
⇥ ⊗

m1

!

1

<latexit sha1_base64="37X0g/FJ6PBf627vONoXDb4BlL8=">AAAB/HicbVBNS8NAEN3Ur1q/oj16WSyCp5IUQY8FLx4r2A9oYthsN+3S3STsToQQ6l/x4kERr/4Qb/4bt20O2vpg4PHeDDPzwlRwDY7zbVU2Nre2d6q7tb39g8Mj+/ikp5NMUdaliUjUICSaCR6zLnAQbJAqRmQoWD+c3sz9/iNTmifxPeQp8yUZxzzilICRArvuaSDqofAS4JJpLIPWLLAbTtNZAK8TtyQNVKIT2F/eKKGZZDFQQbQeuk4KfkEUcCrYrOZlmqWETsmYDQ2NidnkF4vjZ/jcKCMcJcpUDHih/p4oiNQ6l6HplAQmetWbi/95wwyia7/gcZoBi+lyUZQJDAmeJ4FHXDEKIjeEUMXNrZhOiCIUTF41E4K7+vI66bWartN07y4bbVzGUUWn6AxdIBddoTa6RR3URRTl6Bm9ojfryXqx3q2PZWvFKmfq6A+szx/OfZS+</latexit>

+

?⌦m2
?
? ?

m2

⇥⊗ !
?

:=

?
λ

<latexit sha1_base64="37X0g/FJ6PBf627vONoXDb4BlL8=">AAAB/HicbVBNS8NAEN3Ur1q/oj16WSyCp5IUQY8FLx4r2A9oYthsN+3S3STsToQQ6l/x4kERr/4Qb/4bt20O2vpg4PHeDDPzwlRwDY7zbVU2Nre2d6q7tb39g8Mj+/ikp5NMUdaliUjUICSaCR6zLnAQbJAqRmQoWD+c3sz9/iNTmifxPeQp8yUZxzzilICRArvuaSDqofAS4JJpLIPWLLAbTtNZAK8TtyQNVKIT2F/eKKGZZDFQQbQeuk4KfkEUcCrYrOZlmqWETsmYDQ2NidnkF4vjZ/jcKCMcJcpUDHih/p4oiNQ6l6HplAQmetWbi/95wwyia7/gcZoBi+lyUZQJDAmeJ4FHXDEKIjeEUMXNrZhOiCIUTF41E4K7+vI66bWartN07y4bbVzGUUWn6AxdIBddoTa6RR3URRTl6Bm9ojfryXqx3q2PZWvFKmfq6A+szx/OfZS+</latexit>

?⌦m2
?
? ?

m2

⇥⊗ !

1
-

/NE3

-

:=

?

?

λ

?

?⌦m1

<latexit sha1_base64="37X0g/FJ6PBf627vONoXDb4BlL8=">AAAB/HicbVBNS8NAEN3Ur1q/oj16WSyCp5IUQY8FLx4r2A9oYthsN+3S3STsToQQ6l/x4kERr/4Qb/4bt20O2vpg4PHeDDPzwlRwDY7zbVU2Nre2d6q7tb39g8Mj+/ikp5NMUdaliUjUICSaCR6zLnAQbJAqRmQoWD+c3sz9/iNTmifxPeQp8yUZxzzilICRArvuaSDqofAS4JJpLIPWLLAbTtNZAK8TtyQNVKIT2F/eKKGZZDFQQbQeuk4KfkEUcCrYrOZlmqWETsmYDQ2NidnkF4vjZ/jcKCMcJcpUDHih/p4oiNQ6l6HplAQmetWbi/95wwyia7/gcZoBi+lyUZQJDAmeJ4FHXDEKIjeEUMXNrZhOiCIUTF41E4K7+vI66bWartN07y4bbVzGUUWn6AxdIBddoTa6RR3URRTl6Bm9ojfryXqx3q2PZWvFKmfq6A+szx/OfZS+</latexit>!

λ?
<latexit sha1_base64="trrDvg31bl8xLZSC6wegx4xo65A=">AAAB/HicbVBNS8NAEN34WetXtEcvi0XwVBIR9Fjw4rGC/YA2hs120y7dzYbdiRBC/StePCji1R/izX/jts1BWx8MPN6bYWZelApuwPO+nbX1jc2t7cpOdXdv/+DQPTruGJVpytpUCaV7ETFM8IS1gYNgvVQzIiPButHkZuZ3H5k2XCX3kKcskGSU8JhTAlYK3drAANEPxUABl8xgGfrT0K17DW8OvEr8ktRRiVbofg2GimaSJUAFMabveykEBdHAqWDT6iAzLCV0Qkasb2lC7KagmB8/xWdWGeJYaVsJ4Ln6e6Ig0phcRrZTEhibZW8m/uf1M4ivg4InaQYsoYtFcSYwKDxLAg+5ZhREbgmhmttbMR0TTSjYvKo2BH/55VXSuWj4XsO/u6w3cRlHBZ2gU3SOfHSFmugWtVAbUZSjZ/SK3pwn58V5dz4WrWtOOVNDf+B8/gDM+JS9</latexit>

;

λ

?

?⌦m2

<latexit sha1_base64="trrDvg31bl8xLZSC6wegx4xo65A=">AAAB/HicbVBNS8NAEN34WetXtEcvi0XwVBIR9Fjw4rGC/YA2hs120y7dzYbdiRBC/StePCji1R/izX/jts1BWx8MPN6bYWZelApuwPO+nbX1jc2t7cpOdXdv/+DQPTruGJVpytpUCaV7ETFM8IS1gYNgvVQzIiPButHkZuZ3H5k2XCX3kKcskGSU8JhTAlYK3drAANEPxUABl8xgGfrT0K17DW8OvEr8ktRRiVbofg2GimaSJUAFMabveykEBdHAqWDT6iAzLCV0Qkasb2lC7KagmB8/xWdWGeJYaVsJ4Ln6e6Ig0phcRrZTEhibZW8m/uf1M4ivg4InaQYsoYtFcSYwKDxLAg+5ZhREbgmhmttbMR0TTSjYvKo2BH/55VXSuWj4XsO/u6w3cRlHBZ2gU3SOfHSFmugWtVAbUZSjZ/SK3pwn58V5dz4WrWtOOVNDf+B8/gDM+JS9</latexit>

?

?⌦m1

<latexit sha1_base64="37X0g/FJ6PBf627vONoXDb4BlL8=">AAAB/HicbVBNS8NAEN3Ur1q/oj16WSyCp5IUQY8FLx4r2A9oYthsN+3S3STsToQQ6l/x4kERr/4Qb/4bt20O2vpg4PHeDDPzwlRwDY7zbVU2Nre2d6q7tb39g8Mj+/ikp5NMUdaliUjUICSaCR6zLnAQbJAqRmQoWD+c3sz9/iNTmifxPeQp8yUZxzzilICRArvuaSDqofAS4JJpLIPWLLAbTtNZAK8TtyQNVKIT2F/eKKGZZDFQQbQeuk4KfkEUcCrYrOZlmqWETsmYDQ2NidnkF4vjZ/jcKCMcJcpUDHih/p4oiNQ6l6HplAQmetWbi/95wwyia7/gcZoBi+lyUZQJDAmeJ4FHXDEKIjeEUMXNrZhOiCIUTF41E4K7+vI66bWartN07y4bbVzGUUWn6AxdIBddoTa6RR3URRTl6Bm9ojfryXqx3q2PZWvFKmfq6A+szx/OfZS+</latexit>

?⌦m2

1
⇧
D1,1

I
C

?⌦m1
?
?? ?
D1,1
<latexit sha1_base64="trrDvg31bl8xLZSC6wegx4xo65A=">AAAB/HicbVBNS8NAEN34WetXtEcvi0XwVBIR9Fjw4rGC/YA2hs120y7dzYbdiRBC/StePCji1R/izX/jts1BWx8MPN6bYWZelApuwPO+nbX1jc2t7cpOdXdv/+DQPTruGJVpytpUCaV7ETFM8IS1gYNgvVQzIiPButHkZuZ3H5k2XCX3kKcskGSU8JhTAlYK3drAANEPxUABl8xgGfrT0K17DW8OvEr8ktRRiVbofg2GimaSJUAFMabveykEBdHAqWDT6iAzLCV0Qkasb2lC7KagmB8/xWdWGeJYaVsJ4Ln6e6Ig0phcRrZTEhibZW8m/uf1M4ivg4InaQYsoYtFcSYwKDxLAg+5ZhREbgmhmttbMR0TTSjYvKo2BH/55VXSuWj4XsO/u6w3cRlHBZ2gU3SOfHSFmugWtVAbUZSjZ/SK3pwn58V5dz4WrWtOOVNDf+B8/gDM+JS9</latexit><latexit sha1_base64="37X0g/FJ6PBf627vONoXDb4BlL8=">AAAB/HicbVBNS8NAEN3Ur1q/oj16WSyCp5IUQY8FLx4r2A9oYthsN+3S3STsToQQ6l/x4kERr/4Qb/4bt20O2vpg4PHeDDPzwlRwDY7zbVU2Nre2d6q7tb39g8Mj+/ikp5NMUdaliUjUICSaCR6zLnAQbJAqRmQoWD+c3sz9/iNTmifxPeQp8yUZxzzilICRArvuaSDqofAS4JJpLIPWLLAbTtNZAK8TtyQNVKIT2F/eKKGZZDFQQbQeuk4KfkEUcCrYrOZlmqWETsmYDQ2NidnkF4vjZ/jcKCMcJcpUDHih/p4oiNQ6l6HplAQmetWbi/95wwyia7/gcZoBi+lyUZQJDAmeJ4FHXDEKIjeEUMXNrZhOiCIUTF41E4K7+vI66bWartN07y4bbVzGUUWn6AxdIBddoTa6RR3URRTl6Bm9ojfryXqx3q2PZWvFKmfq6A+szx/OfZS+</latexit>

? ?
m1

⇥

?
m1

m2

⊗ !
?

()
@
λ

⇥⊗ !
?

@

λ

?

?

λ

<latexit sha1_base64="trrDvg31bl8xLZSC6wegx4xo65A=">AAAB/HicbVBNS8NAEN34WetXtEcvi0XwVBIR9Fjw4rGC/YA2hs120y7dzYbdiRBC/StePCji1R/izX/jts1BWx8MPN6bYWZelApuwPO+nbX1jc2t7cpOdXdv/+DQPTruGJVpytpUCaV7ETFM8IS1gYNgvVQzIiPButHkZuZ3H5k2XCX3kKcskGSU8JhTAlYK3drAANEPxUABl8xgGfrT0K17DW8OvEr8ktRRiVbofg2GimaSJUAFMabveykEBdHAqWDT6iAzLCV0Qkasb2lC7KagmB8/xWdWGeJYaVsJ4Ln6e6Ig0phcRrZTEhibZW8m/uf1M4ivg4InaQYsoYtFcSYwKDxLAg+5ZhREbgmhmttbMR0TTSjYvKo2BH/55VXSuWj4XsO/u6w3cRlHBZ2gU3SOfHSFmugWtVAbUZSjZ/SK3pwn58V5dz4WrWtOOVNDf+B8/gDM+JS9</latexit>

??
D1,1

?⌦m2
?
? ?

?
?⌦m1

<latexit sha1_base64="37X0g/FJ6PBf627vONoXDb4BlL8=">AAAB/HicbVBNS8NAEN3Ur1q/oj16WSyCp5IUQY8FLx4r2A9oYthsN+3S3STsToQQ6l/x4kERr/4Qb/4bt20O2vpg4PHeDDPzwlRwDY7zbVU2Nre2d6q7tb39g8Mj+/ikp5NMUdaliUjUICSaCR6zLnAQbJAqRmQoWD+c3sz9/iNTmifxPeQp8yUZxzzilICRArvuaSDqofAS4JJpLIPWLLAbTtNZAK8TtyQNVKIT2F/eKKGZZDFQQbQeuk4KfkEUcCrYrOZlmqWETsmYDQ2NidnkF4vjZ/jcKCMcJcpUDHih/p4oiNQ6l6HplAQmetWbi/95wwyia7/gcZoBi+lyUZQJDAmeJ4FHXDEKIjeEUMXNrZhOiCIUTF41E4K7+vI66bWartN07y4bbVzGUUWn6AxdIBddoTa6RR3URRTl6Bm9ojfryXqx3q2PZWvFKmfq6A+szx/OfZS+</latexit>

/NE4

⇥

?
m2

⊗1
?

()
@
λ

?⌦m2

@

λ

?

?

λ

<latexit sha1_base64="trrDvg31bl8xLZSC6wegx4xo65A=">AAAB/HicbVBNS8NAEN34WetXtEcvi0XwVBIR9Fjw4rGC/YA2hs120y7dzYbdiRBC/StePCji1R/izX/jts1BWx8MPN6bYWZelApuwPO+nbX1jc2t7cpOdXdv/+DQPTruGJVpytpUCaV7ETFM8IS1gYNgvVQzIiPButHkZuZ3H5k2XCX3kKcskGSU8JhTAlYK3drAANEPxUABl8xgGfrT0K17DW8OvEr8ktRRiVbofg2GimaSJUAFMabveykEBdHAqWDT6iAzLCV0Qkasb2lC7KagmB8/xWdWGeJYaVsJ4Ln6e6Ig0phcRrZTEhibZW8m/uf1M4ivg4InaQYsoYtFcSYwKDxLAg+5ZhREbgmhmttbMR0TTSjYvKo2BH/55VXSuWj4XsO/u6w3cRlHBZ2gU3SOfHSFmugWtVAbUZSjZ/SK3pwn58V5dz4WrWtOOVNDf+B8/gDM+JS9</latexit>⇥⊗ 1?

<latexit sha1_base64="37X0g/FJ6PBf627vONoXDb4BlL8=">AAAB/HicbVBNS8NAEN3Ur1q/oj16WSyCp5IUQY8FLx4r2A9oYthsN+3S3STsToQQ6l/x4kERr/4Qb/4bt20O2vpg4PHeDDPzwlRwDY7zbVU2Nre2d6q7tb39g8Mj+/ikp5NMUdaliUjUICSaCR6zLnAQbJAqRmQoWD+c3sz9/iNTmifxPeQp8yUZxzzilICRArvuaSDqofAS4JJpLIPWLLAbTtNZAK8TtyQNVKIT2F/eKKGZZDFQQbQeuk4KfkEUcCrYrOZlmqWETsmYDQ2NidnkF4vjZ/jcKCMcJcpUDHih/p4oiNQ6l6HplAQmetWbi/95wwyia7/gcZoBi+lyUZQJDAmeJ4FHXDEKIjeEUMXNrZhOiCIUTF41E4K7+vI66bWartN07y4bbVzGUUWn6AxdIBddoTa6RR3URRTl6Bm9ojfryXqx3q2PZWvFKmfq6A+szx/OfZS+</latexit>

?⌦m2

?
?⌦m1

Figure 4.2: Name-exhaustive pre-templates (C is a contraction tree)4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

template

C⊗Assoc
C⊗CommC⊗Idem

robustness

implication(input-safety)of C

of C−1

dependency

COex , =, =COex , =, =, =COex , =, =, =—H1 '=ONof H1 C H2
C ex

H2

COex , =, =COex , =, =, =COex , =, =, =—C ex
H1 '=ON H2

, , COex , =, =, =COex , =, =, =—H1 '=ONC⊗AssocC⊗

135

COex , ≥, =COex , =, =, =COex , =, =, =

C

⊗Comm

C ex

C ex

H1 ≥O

N

H2
H2 ,

C ex

H2 ≤O

H1

N

CGC

, , COex , =, =, =COex , =, =, =—C ex
H1 '=ON H2

CBPerm, , COex , =, =, =COex , =, =, =—H1 '=ON

C ex

H2

C

⊗Assoc

CBPullC, , COex , =, =, =COex , =, =, =C⊗CommC ex

H1 '=ON

H2

C⊗Idem
CBPullW, , COex , =, =, =COex , =, =, =C⊗IdemC⊗Assoc

CBPullD, , COex , =, =, ≤COex , =, ≥, =C⊗CommC ex

H1 '=ONC ex

H1 ≤ON

H2
H2 ,C⊗IdemCOex , ≤, =, ≤C⊗

COex , ≥, ≥, ≥C ex

H2 ≥O

N

H1

CGC
→

C@

COex , ≥, =COex -bf , =, =, =C ex -bf

COex -bf , =, =, =—COex -bf , ≥, =Cref

COex , ≥, =COex -bf , =, =, =H1 ≥ON

C ex -bf

COex -bf , =, =, =—COex -bf , ≥, =

H2 ,

C ex
H2 ≤O -bf H1N

H1 ≥O

N

H2 ,

C ex
H2 ≤O -bf H1
NC⊗Assoc
CNE1

COex , =, =COex , ≥, =, =—C⊗IdemC ex

H1 ≥O

N

H2

CGC
CNE2

, , COex , =, =, =COex , =, =, =—C

⊗Assoc

CNE3

CNE4

COex , =, =COex , =, =COex , ≤, ≥, ≤COex , ≥, ≥, ≤COex , N × N, ≥, N × N

COex , N × N, ≥, N × N

COex , ≥, ≥, =COex , ≤, =, ≤COex , ≥, ≥, ≥C⊗IdemC ex

H1 '=ON

H2

C ex

O
H2
H1 'N×NC⊗
CGC
C⊗Assoc
C

⊗Idem

C⊗
CGC

C ex

H1 ≥ONC ex

H2 ≤ON

H2

H1

Table 4.1: Templates, with their robustness and implied contextual refinements/equivalences ( denotes anything)

136

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Pre-templates that relate hypernets with no input of type ? are trivially a(C, Q, Q0 )-template for any C, Q and Q0 . The table uses ‘, , ’ to represent
this situation.
For many pre-templates, a reasonable triple can be found by selecting bigger
parameters from those of input-safety and robustness, thanks to the monotonicity. However, pre-templates CBPullD , CNE3 and CNE4 require non-trivial use of themonotonicity. For each of these pre-templates, an upper row shows a parameter(C, Q1 , Q01 , Q001 ) that makes it (or its converse) robust, and a lower row shows aparameter (C, Q2 , Q02 , Q002 ) to which Thm. 4.3.14 can be applied.
In the table, cyan symbols indicate where a proof of input-safety or robustness relies on contextual refinement. The “dependency” column indicates which
pre-templates can be used to prove the necessary contextual refinement, given thatthese pre-templates imply contextual refinement as shown elsewhere in the table.
This reliance specifically happens in finding a quasi-specimen, using contextual refinements/equivalences via Lem. 4.3.19. In the case of C⊗ , its input-safety androbustness are proved under the assumption that C⊗Assoc and C⊗Comm imply contextual equivalence '=ON .
C ex

The restriction to binding-free contexts plays a crucial role only in robustness→

regarding the operational pre-templates C @ and Cref . In fact, these pre-templates
are input-safe with respect to both COex and COex -bf . This gap reflects duplication
behaviour on atom edges, which is only encountered in a proof of robustness. A
shallow atom edge is never duplicated, whereas a deep one can be duplicated as partof a box (which represents a thunk).
Finally, the pre-template CNE1 is the only example whose converse is not robust.
This is because the equality operation ‘=’ is only defined on names, whereas it ispossible in Spartan to give values, other than names, as arguments of the equality
operation.
The key part of proving input-safety or robustness of a pre-template is to analyse◦, (W)◦, (W)◦•◦, (W)◦, (W)

◦
◦
◦
◦

◦
•
◦
◦

◦
•
◦
◦

@

→

BPullD

1
2
3
4

(W)
(W)

◦

◦

◦, (Ex)◦◦(W)◦, (W)

•
•

◦
◦
◦

(Ex)
◦, (W)◦, (W)◦, (W)◦, (W)

◦
◦
◦
◦

◦
◦
(Ex)

◦
◦
◦
◦
◦

NEi

◦
◦
◦
•
◦
◦

BPullW

BPullC

BPerm

GC

⊗

Idem

Comm
⊗

◦
◦
◦
•
◦
◦

Micro beta
Freshness
Locality
Param. 1
Param. 2

⊗

Assoc

◦

137

ref

Weakening
Exchange
Struct. (3.3) (3.4)
Struct. (3.5) (3.6)
Aux. Copy
Aux. Subst.
Struct. (3.7)
Struct. (3.8)⊗

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

•

◦

◦

•
•

◦
◦

◦
◦

◦, (W)(W)◦, (W)◦, (W)◦◦◦◦

Table 4.2: Dependency of contextual refinements/equivalences on templates
how a rewrite transition involves edges (at any depth) of a state that are contributedby the pre-template. Given that all rewrite transitions (including copy transitions)
are specified by local rewrite rules, the analysis boils down to checking possible
overlaps between a local rule and the pre-template. A typical situation is wherea local rule simply preserves or duplicates edges contributed by a pre-template,
without breaking them. Lem. 4.5.2 in Sec. 4.5.4 identifies two such situations: when
the overlaps are all about deep edges, and when the pre-template relates contraction
trees only.

4.5.3

Combining templates

Each law in Sec. 3.4 can be proved for the operation sets Oex
X = Z∪{λ, (), tt, ff} and→Oex = {@, ref, =, :=, !, +, −, −1 } by combining the pre-templates. The assumption
here is that the pre-templates imply contextual refinement as listed in Table 4.1.
We describe below how each law depends on pre-templates, using Table 4.2. The(full) Beta law is simply the combination of the Micro Beta law and the substitution
law (3.8), so it is omitted in the table.
The table includes some extra laws that are useful to prove the laws in Sec. 3.4.
These laws are namely: Weakening, Exchange, Auxiliary Copy and Auxiliary Substitution; and shown in Fig. 4.3. When a law can be proved using the Weakening

138

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE
?
⌦k1

⌦k2

⌦h

?
??
⇧
(~x, z, ~y | ~a ` t : ⌧ )†
⌧

⌦k1

?

'Call
=N

?⌦k ⇧⌦h1 ⇧ ⇧⌦h2(~x | ~a, b, ~c ` t : ⌧ )†⌧⊗?⌦k2 ⇧⌦h(~x, ~y | ~a ` t : ⌧ )†⌧⇧?⌦k ⇧⌦h1 ⊗ ⇧⌦h2(~x | ~a, ~c ` t : ⌧ )†
⌧

'Call
=N

(a) Weakening (z ∈/ fv (t), b ∈/ fa(t))
??
⌦k

⌦k

h

? 1 ??? 2 ⇧?⌦k1 ? ? ?⌦k2 ⇧h(~x, z, z 0 , ~y | ~a ` t : ⌧ )† 'Callx, z 0 , z, ~y | ~a ` t : ⌧ )†
=N (~
⌧
⌧
⇧⇧
?⌦k ⇧⌦h1 ⇧ ⇧ ⇧h2?⌦k ⇧⌦h1 ⇧ ⇧ ⇧h2
Call(~x | ~a, c, c0 , ~b ` t : ⌧ )† '=N (~x | ~a, c0 , c, ~b ` t : ⌧ )†⌧⌧(b) Exchange
?⌦k
?
Dk,n

?⌦k ⇧⌦h(~x | ~a ` t : ?)†
?
D1,n

?⌦n

'Call
=N⇥N

⇧⌦h
⇧
Dh,n

⇥n (~x | ~a ` t : ?)†?⌦n(c) Auxiliary Copy (t is nongenerative)?⌦k1 ?⌦k ?⌦k2 ⇧⌦h ⇧⌦h1<latexit sha1_base64="yDSn3JKKKDVSIW8ZYCB1lL0jdCs=">AAACVHicbZFLSwMxFIUzU6u1vqou3QSLUBHKTBF0WXDjsoJ9QFuHTCZtw2SSIbkjlKE/UheCv8SNC9MHqG0vBA7fuZebnISp4AY879NxCzvF3b3Sfvng8Oj4pHJ61jEq05S1qRJK90JimOCStYGDYL1UM5KEgnXD+GHud1+ZNlzJZ5imbJiQseQjTglYFFTigQGiX/KBAp4wg2sS3+A48K9n5TUn3iRBw7KIk0TJ6BdPtsLAnwWVqlf3FoU3hb8SVbSqVlB5H0SKZgmTQAUxpu97KQxzooFTweyazLCU0JiMWd9KSeymYb4IZYavLInwSGl7JOAF/TuRk8SYaRLazoTAxKx7c7jN62cwuh/mXKYZMEmXi0aZwKDwPGEccc0oiKkVhGpu74rphGhCwf5D2Ybgrz95U3Qadd+r+0+31SZexVFCF+gS1ZCP7lATPaIWaiOK3tCXgxzH+XC+3YJbXLa6zmrmHP0r9/gH0rezcQ==</latexit>?⌦k ⇧⌦h(~x | ~a ` t : ?)†?
?⌦k1 ? ?⌦k2 ⇧⌦h1?⌦(n+k1 ) ? ?⌦k2 ⇧⌦h1 Call
G
'=N⇥N
?
T n (?)(d) Auxiliary
generative)?⌦k1 ?⌦k ?⌦k2 ⇧⌦h ⇧⌦h1?⌦(n+k1 ) ?⌦k ?⌦k2 ⇧⌦h ⇧⌦h1?⌦k ⇧⌦h(~x | ~a ` t : ?)†?
?⌦(n+k1 ) ? ?⌦k2 ⇧⌦h1G?
T n (?)

Substitution

(t

is

non-

Figure 4.3: Auxiliary laws

or Exchange law, it is indicated by (W) or (E), respectively, in the table. The Auxiliary Copy law is used to prove both the Structural laws (3.7) and (3.8), while the
Auxiliary Substitution law is used to prove the Structural law (3.8).
The symbol ‘◦’ indicates direct dependency on pre-templates, in the sense thata law can be proved by combining contextual refinements implied by these pretemplates. For these pre-templates to imply contextual refinements, some otherpre-templates may need to imply contextual refinements; these other pre-templates
are indirectly depended by the law. The indirect dependency is indicated by the4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

139

symbol ‘•’.
Thanks to the Weakening law, it suffices to check the minimum judgement toprove an observational equivalence. This is the case for binding-free contexts, too,because any context that consists of a hole with no target, and weakening edges, isbinding-free. For example, Fig. 4.4 illustrates a proof of the Parametricity 2 law inthe empty environment (− | − `  : ?), and this proof is enough to show the law inany environment (~x | ~a `  : ?).

4.5.4

Local reasoning

For the particular operation set Oex , the following lemma identifies two typicalsituations, where a local rule simply preserves or duplicates edges contributed by apre-template, without breaking them.
Lemma 4.5.2. Assume any C-specimen of an output-closed pre-template C that has
the form~ 0 , G~00 ; H~ 0 , H~ 00 ),~0 , C˙2 [χ~00 ]]; G(C1 [χ
~ 0 , C˙2 [G~00 ]] and C1 [H~ 0 , C˙2 [H~ 00 ]] are states,
and any focussed hypernet Ṅ , such that C1 [Gand C˙2 [G~00 ] 7→ Ṅ is a contraction rule or a local rewrite rule of an operation of→

Oex = {@, ref, =, :=, !, +, −, −1 }.
1. If all holes of C˙2 are deep, then there exist a focussed context C˙20 and two
sequences G~000 and H~000 of focus-free hypernets, such that C˙2 [G~00 ] 7→ C˙20 [G~000 ] = Ṅ ,000
C˙2 [H~ 00 ] 7→ C˙20 [H~000 ], and G000
i C Hi for each index i.

~ 0 , C˙2 [G~00 ]] and C1 [H~ 0 , C˙2 [H~ 00 ]]2. In the situation of (1), if additionally both states C1 [G~0 , C˙2 [χ~00 ]]| is binding-free, then C˙20 can be taken so thatare rooted, and |C1 [χ~0 , C˙20 [χ~000 ]]| is also binding-free.
|C1 [χ
3. If the pre-template C is a relation on contraction trees, then there exist a
focussed context C˙20 and two sequences G~000 and H~000 of focus-free hypernets,

140

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE~ @()))~~(− | − ` (λx.λf.(λz.!x)@(f@(ref1) : ?)† =
??
D1,1
??
?
D2,2
?
D2,1

??
D1,1
?
D2,2

??
D1,1

? ?? ?
D3,1
?
D1,1

?
?
⊗ D2,0
D1,1

⊗⊗ !
?

()

λ

@
@

?
λ

?
'Call 1/⌦Assoc
B /⌦Comm C
BC
B /⌦Idem C
B ⌦BParam C
B /C
B ⌦BPullC C@ /A/BPullW

??
D1,1

?

??
D1,1

?

⊗

?

!

0

?

'Cbf
/ref

()

λ

⊗

!

?

()
@

@

@

?

?

λ

?

?

λ

@

1

?

λ

1

?
ref

λ

1

⇧
D1,1

?
ref

λ

λ

I

@

@

@

?

?

?

1

⇧
D1,1

I

??
D1,1
Cbf

⇣' ! ⌘
/@

??
D1,1

??
D1,2

?

?
?
D1,1

'Call
(/NE4 )

'Call 1/⌦Assoc
B /⌦Comm C
B ⌦Idem C@ /A/BPullW0<latexit sha1_base64="d4WmaNS9XS1QXN6iYX15izckke8=">AAAChHicbVFdixMxFM2MuruOX1UffQkWcQUpM7qiT1LYFx9XsLsLnVqS9M40bD7G5I5SwvwS/5Vv/hsz7Qjr1guBwzn3npuc8EZJj3n+O0lv3b5zcHh0N7t3/8HDR6PHT869bZ2AmbDKukvOPChpYIYSFVw2DpjmCi741WmvX3wH56U1X3DTwEKz2shKCoaRWo5+lhxqaQJzjm26ILqs9FLDt6+h1AzXnNPTLXA68KqLapmVCio8zvYH0UlmagW9HudtvxcwlE7Wa4x99kcX/ppNu94MzGowyHZdr65zy9E4n+TbovugGMCYDHW2HP0qV1a0GgwKxbyfF3mDi+iGUiiIO1oPDRNXrIZ5hIZp8IuwDbGjLyKzopV18RikW/b6RGDa+43msbN/g7+p9eT/tHmL1YdFkKZpEYzYLapaRdHS/kfoSjoQqDYRMOFkvCsVa+aYwJhfFkMobj55H5y/mRT5pPh8Mp7SIY4j8ow8J8ekIO/JlHwiZ2RGRJIkL5M8KdKD9HX6Nn23a02TYeYp+afSj38ALtPG4A==</latexit>

?

?

?

⊗

!

⊗ 1

?

()

λ

@

?

()

λ

@

?
D1,1
?
D1,2

??
?
D2,0
1

?
D1,1

?
D1,0

?

()

λ

@

@

@

@

?

?

?

λ

λ

λ

?

?

?

~ @())~= (− | − ` λf.(λz.1)@(f: ?)† .
Figure 4.4: A proof outline of the Parametricity 2 law, in the empty environment

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

141

000
such that C˙2 [G~00 ] 7→ C˙20 [G~000 ] = Ṅ , C˙2 [H~ 00 ] 7→ C˙20 [H~000 ], and G000
i C Hi for eachindex i.
Proof of the point (1). The proof is by case analysis on the local rule C˙2 [G~00 ] 7→ Ṅ .
• When the rule is a contraction rule, the rule simply duplicates all box edges
without changing any deep edges. Because all holes of C˙2 are deep, there exists
a focussed context C˙20 , whose holes are all deep, such that C˙2 [G~00 ] 7→ C˙20 [G~00 , G~00 ]is a contraction rule. Moreover, C˙2 [H~ 00 ] 7→ C˙20 [H~ 00 , H~ 00 ] is also a contraction
rule.
• When the rule is a beta rewrite rule, the rule replaces a box edge with thehypernet that labels the box. Because all holes of C˙2 are deep, there exists a
focussed context C˙20 such that C˙2 [G~00 ] 7→ C˙20 [G~00 ] is a beta rewrite rule. Moreover,C˙2 [H~ 00 ] 7→ C˙20 [H~ 00 ] is also a beta rewrite rule.
• Otherwise, the rule does not involve any deep edge. This means the focussed
context C˙2 must have no hole, and the sequences G~00 and H~ 00 must be empty.
We can take a focussed context C˙20 with no hole, such that C˙2 [ ] 7→ C˙20 [ ].
Because contraction rules and local rewrite rules are all deterministic, C˙20 [G~000 ] = Ṅfollows from C˙2 [G~00 ] 7→ C˙20 [G~000 ].
Proof of the point (2). The proof is built on top of the proof of the point (1). In
particular, we assume that all holes of C˙20 are deep in the case of contraction rules,→

and C˙20 has no hole in the case of local rules of Oex \{@}. Under this assumption,~0 , C˙20 ]| is binding-free.
our goal is to prove that |C1 [χ~0 , |C˙2 |] and C 0 denote C1 [χ~0 , |C˙20 |]. Because C = |C1 [χ~0 , C˙2 ]| andLet C denote C1 [χ~0 , C˙20 ]|, it suffices to prove that C 0 is binding-free, given that C is bindingC 0 = |C1 [χfree.
Firstly, because C is binding-free, |C˙2 | is necessarily binding-free. By inspecting
the local rule C˙2 [G~00 ] 7→ C˙20 [G~000 ], we check below that |C˙20 | is also binding-free.

142

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE• When the rule is a contraction rule, or a beta rewrite rule, any path that makes|C˙20 | not binding-free gives a path in |C˙2 |, which leads to a contradiction.
• Otherwise, |C˙20 | is trivially binding-free because it does not have any hole edges.
Now we prove that C 0 is binding-free by contradiction; we assume that there
exists a path P in C 0 , from a source of a contraction, atom, box or hole edge e, to~0 , χ]), anda source of a hole edge e0 . Let χ be the last hole label of C1 (i.e. C1 [χeχ denote the hole edge of C1 labelled with χ. We derive a contradiction by caseanalysis on the path P .
• When e0 comes from C1 , and the path P consists of edges from C1 only, thepath P gives a path in C1 . Because P does not contain eχ , it also gives a pathin C. This contradicts C being binding-free.
• When e0 comes from C1 , and the path P contains an edge from C2 , by finding
the last edge from C2 in P , we can take a suffix of P that gives a path P 0 froma target of the hole edge eχ to a source of the hole edge e0 , in C1 . Because thesuffix path P 0 does not contain eχ , it gives a path in C. We inspect the local
rule C˙2 [G~00 ] 7→ C˙20 [G~000 ] as follows.
– When the rule is a contraction rule, because each output of |C˙2 | is reachable from a source of a contraction edge, adding the contraction edge atthe beginning of P 0 gives a path in C from a source of the contraction edge
to a source of the hole edge e0 . This contradicts C being binding-free.
→– When the rule is a rewrite rule of operations {@, ref, =, :=, !}, P 0 gives apath in C to the hole edge e0 , from either of the following: a target of an
atom or box edge; or a source of a contraction, atom or a box edge (bytyping). This contradicts C being binding-free.
– Otherwise, i.e. when the rule is a rewrite rule of operations {+, −, −1 },the hole edge eχ actually does not have any target. This contradicts, in4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

143

the first place, the path P containing an edge from C2 .
• When both e and e0 come from |C˙20 |, and the path P gives a path in |C˙20 |, thiscontradicts |C˙20 | being binding-free.
• When both e and e0 come from |C˙20 |, and the path P does not give a single
path in |C˙20 |, we inspect the local rule C˙2 [G~00 ] 7→ C˙20 [G~000 ] as follows.
– When the rule is a contraction rule, all holes of C˙20 are deep. It is impossible for P , which is to a target of a deep hole edge, not to give a path in|C˙20 |. This is a contradiction.
→– When the rule is a local rewrite rule of any operations but ‘@’, C˙20 actually
does not have any hole edge. It is impossible for the hole edge e0 to befrom |C˙20 |. This is a contradiction.
– When the rule is a beta rewrite rule, the hole edge eχ actually has only
one source. If P consists of edges from |C˙20 | only, the source must be alsoa target of eχ ; otherwise, P has a sub-sequence that gives a path in C1 .
In either case, there exists a path P 0 from the source of eχ to the sourceof eχ , i.e. a cycle around the source of eχ , in C1 . This cycle gives a cycle
in C around the source of eχ .
In the case of a beta rewrite rule, outputs are all reachable from the input,
which coincides with the token source, in C˙2 [χ~00 ]. Therefore, the cycle P 0~0 , C˙2 [χ~00 ]], around the token source. Because
also gives a cycle in C1 [χ~ 0 , G~00 ; H~ 0 , H~ 00 ) is a C-specimen of the output-closed pre~0 , C˙2 [χ~00 ]]; G(C1 [χ
~ 0 , C˙2 [G~00 ]]template C, by Lem. A.3.7(3), at least one of the states C1 [G~ 0 , C˙2 [H~ 00 ]] is not rooted. This is a contradiction.
and C1 [H• When e comes from C1 and e0 comes from |C˙20 |, we inspect the local ruleC˙2 [G~00 ] 7→ C˙20 [G~000 ] as follows.

144

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE– When the rule is a contraction rule, by finding the last edge from C1 in P ,we can take a suffix of P that gives a path P 0 from an input to a sourceof the hole edge e0 in |C˙20 |. However, the path P 0 cannot exist because thehole edge e0 is deep in |C˙20 |. This is a contradiction.

→– When the rule is a local rewrite rule of any operations but ‘@’, C˙20 actually
does not have any hole edge. It is impossible for the hole edge e0 to befrom |C˙20 |. This is a contradiction.
– When the rule is a beta rewrite rule, by finding the first edge from |C˙20 |in P , we can take a prefix of P that gives a path P 0 from a source of theedge e to a source of the hole edge eχ , in C1 . Because P does not containeχ , P 0 does not contain eχ either.
In the case of a beta rewrite rule, eχ has only one source, and the input of C˙2 [χ~00 ] coincides with the token source. Therefore, P 0 gives a~0 , C˙2 [χ~00 ]], and thispath from a source of e to the token source in C1 [χpath is not an operation path, because of its first edge e.

Because~ 0 , G~00 ; H~ 0 , H~ 00 ) is a C-specimen of the output-closed pre~0 , C˙2 [χ~00 ]]; G(C1 [χ
~ 0 , C˙2 [G~00 ]]template C, by Lem. A.3.7(3), at least one of the states C1 [G~ 0 , C˙2 [H~ 00 ]] is not rooted. This is a contradiction.
and C1 [HProof of the point (3). The proof is by case analysis on the local rule C˙2 [G~00 ] 7→ Ṅ .
• When the rule is a contraction rule, the rule simply duplicates all box edges
without changing any deep edges, and does not change any existing shallow
contraction/weakening edges. Because C relates only contraction trees, deepedges from G~00 are duplicated and shallow ones from G~00 are preserved, by therule. There exist a sequence G~000 of contraction trees and a focussed context
C˙20 , such that G~000 ⊆ G~00 (as sets) and C˙2 [G~00 ] 7→ C˙20 [G~00 , G~000 ] is a contraction
rule. Moreover, there exists a sequence H~000 of contraction trees that satisfies

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

145

H~000 ⊆ H~ 00 (as sets) and corresponds to G~000 . Because C relates only contraction
trees, C˙2 [H~ 00 ] 7→ C˙20 [H~ 00 , H~000 ] is also a contraction rule.
• When the rule is a beta rewrite rule, the rule involves no shallow contraction
trees. Because C relates only contraction trees, all holes of C˙2 must be deep,
and the proof is reduced to the point (1).
• When the rule is a rewrite rule of name-accessing operations {=, :=, !}, therule preserves contraction trees at any depth. There exists a focussed context
C˙20 such that C˙2 [G~00 ] 7→ C˙20 [G~00 ] is a local rewrite rule. Moreover, because C
relates only contraction trees, C˙2 [H~ 00 ] 7→ C˙20 [H~ 00 ] is also a local rewrite rule.
• Otherwise, the rule involves no contraction trees, which means the focussed
context C˙2 must have no hole, and the sequences G~00 and H~ 00 must be empty.
We can take a focussed context C˙20 with no hole, such that C˙2 [ ] 7→ C˙20 [ ].
Because contraction rules and local rewrite rules are all deterministic, C˙20 [G~000 ] = Ṅfollows from C˙2 [G~00 ] 7→ C˙20 [G~000 ].

4.5.5

Details of input-safety and robustness proofs

In this section we give some details of proving input-safety and robustness of the
pre-templates.
Fig. 4.5 lists triggers that we use to prove some input-safety and robustnessof the pre-templates. Table 4.3 shows contextual refinements/equivalences impliedby these triggers, given that some pre-templates (shown in the “dependency” column) imply contextual refinement as shown in Table 4.1. All the implications canbe proved simply using the congruence property and transitivity of contextual refinement. Table 4.3 shows which pre-template requires each trigger in its proof of
input-safety or robustness (in the “used for” column). Note that the converse of any
trigger is again a trigger.

146

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

`
`
D1,2

`
`
D1,2

`
D1,2
/1

` ` `
`
`
D1,2

`
`
D1,2
` ` /3

`
D1,2

⊗⊗

⊗

`
`
D1,2
` `

`
`
`
`
D1,2
D1,2

` ` `
`
`
D1,2

`
`
D1,2
/2 D1,2

` ` `

⇧
⇧
D1,1

`

` ` `

` ` ` `

` `

`

⊗⊗

` `

0

/4

⊗

0

?⌦k
Dk?0 ,2⇧⌦hDh⇧ 0 ,2

H

H

⇧
⇧
⇧
D1,2
/6 D1,1
⇧ ⇧
⇧

I

I

?

?

/7

⊗

⊗

k

?
?
?
D1,2
/9
? ?
⇧

⇧

⊗

?

?
0

⇧

⊗

⇧
⇧
D1,1

0

?
D1,2

/5

k

⊗ D1,1?

I?⌦k ⇧⌦hH?⌦k ? ⇧⌦h?⌦k ? ⇧⌦h?⌦(n+k) ? ⇧⌦h ?⌦(n+k) ? ⇧⌦h
G
G
?
?
n
n
T (?)
T (?)

⇧
⇧
D1,2
⇧ ⇧

?⌦k ? ⇧⌦h?⌦k ? ⇧⌦h?⌦(n+k) ? ⇧⌦h ?⌦(n+k) ? ⇧⌦h
G
G
?
?
n
n
T (?)
T (?)

⇧
⇧
⇧
⇧
D1,2
/8 D1,1
⇧
⇧
⇧
D1,2
? ⇧ ⇧

I

⊗ I
?

⊗

Figure 4.5: Triggers (H is a copyable hypernet, and G is a hypernet)

dependency

implication of H1 C H2

used for

C1

C⊗Assoc , C⊗Comm

H1 '=ON H2
C ex

C⊗

C2

C⊗Assoc , C⊗Comm

H1 '=ON H2
C ex

C⊗

C3

C⊗Assoc , C⊗Comm , C⊗Idem

H1 '=ON H2
C ex

CBPullC

C4

C⊗Idem

CBPullW , CNE3C5C⊗Assoc , C⊗Comm , C⊗Idem ,C⊗ , CGC

H1 '=ON H2
H1 ≤ON H2 , H2 ≥ON H1

CBPullD

C6

C⊗Assoc , C⊗Idem , CGC

H1 '=ON H2
C ex

CNE1 , CNE4

C7C⊗Idem , C⊗GC

H1 '=ON H2
C ex

CNE1

C8

C⊗Assoc , C⊗Idem , CGC

H1 '=ON H2

CNE3

C9

C⊗ , CGC

H1 ≥ON H2 , H2 ≤ON H1

C ex

C ex

C ex

C ex

C ex

C ex

CNE3 , CNE4

Table 4.3: Triggers and their implied contextual refinements/equivalences

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

147

Recall that there may be a choice of local rewrite rules to achieve the same
copy transition, or the same compute transition of a name-accessing operation φ ∈{=, :=, !}. This choice boils down to a choice of contraction trees. The minimum
choice is to collect only contraction edges whose target is reachable from the token
target. The maximum choice is to take the contraction tree(s) so that no contraction
or weakening edge is incoming to the unique hole edge in a context.

Pre-templates on contraction trees

First we check input-safety and robustness of C⊗Assoc , C⊗Comm and C⊗Idem , which
are all on contraction trees.
Input-safety of C⊗Assoc and C⊗Comm can be checked as follows. Given a COex ˙ H~ 1 ; H~ 2 ) with an entering search token, because any input of a contracspecimen (C;tion tree is a source of a contraction edge, we have:•˙ H~ 1 ] →˙ H~ 1 ]i /? ,
C[
hC[

•
˙ H~ 2 ] →˙ H~ 2 ]i /? .
C[hC[

˙ H~ 1 ]i /? if and only if a
It can be observed that a rewrite transition is possible in hC[
˙ H~ 2 ]i /? . When a rewrite transition is possible inrewrite transition is possible in hC[
both states, we can use Lem. 4.5.2(3), by considering a maximal possible contraction
rule. The results of the rewrite transition can be given by a new quasi-COex -specimen
up to (=, =) (here = denotes equality on states). When no rewrite transition ispossible, both of the states are not final but stuck.
Robustness of the three pre-templates and their converse can also be proved using
Lem. 4.5.2(3), by considering a maximal possible local (contraction or rewrite) rulein each case.

148

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Input-safety of pre-templates not on contraction trees
As mentioned in Sec. 4.5.2, pre-templates that relate hypernets with no input of type? are trivially input-safe for any parameter (C, Q, Q0 ). This leaves us pre-templates→C⊗ , C @ , Cref , CNE1 , CNE3 and CNE4 to check.
As for C⊗ , note that the pre-template C⊗ relates hypernets with at least one
input. Any COex -specimen of C⊗ with an entering search token can be turned into
the form (C[(?;j χ), χ~ ]; H 1 , H~ 1 ; H 2 , H~ 2 ) where j is a positive number. The proof isby case analysis on the number j.
• When j = 1, we have:•C[(?;j H 1 ), H~ 1 ] →C[( ;j H 1 ), H~ 1 ]→ C[(?;j H 2 ), H~ 1 ].
We can take (C[(?;j H 2 ), χ~ ]; H~ 1 ; H~ 2 ) as a COex -specimen, and the token in
C[(?;j H 2 ), χ~ ] is not entering.
• When j > 1, the token target must be a source of a contraction edge. Thereexist a focus-free context C 0 [χ0 ], two focus-free hypernets H 01 C⊗ H 02 and afocus-free hypernet G, such that•
C[(?;j H 1 ), H~ 1 ] →C[( ;j H 1 ), H~ 1 ]→ C[(?;j C 0 [H 01 ]), H~ 1 ],•C[(?;j H 2 ), H~ 2 ] →C[( ;j H 2 ), H~ 2 ]→ C[(?;j G), H~ 2 ],˙ =N G given by the trigger C1 via Lem. 4.3.19. The results ofand C 0 [H 02 ] '˙ =N ).
these sequences give a quasi-COex -specimen up to (=, '→A proof of input-safety of the operational pre-templates C @ and Cref is a simpler

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

149

version of that of C⊗ , because the operational pre-templates relate hypernets with
only one input.
Let C be either COex or COex -bf . Any C-specimen of an operational pre-templatewith an entering search token can be turned into the form (C[(?; χ), χ~ ]; H 1 , H~ 1 ;
H 2 , H~ 2 ). Note that the parameter j that we had for C⊗ is redundant in ?; χ. We
have:•
C[(?; H 1 ), H~ 1 ] →C[( ; H 1 ), H~ 1 ]→ C[(?; H 2 ), H~ 1 ].
We can take (C[(?; H 2 ), χ~ ]; H~ 1 ; H~ 2 ) as a COex -specimen, and the token in C[(?;j H 2 ), χ~]
is not entering. This data gives a COex -bf -specimen when C = COex -bf , which follows
from the closedness of COex -bf with respect to plugging (Lem. A.5.1). Note that ?; H 1
can be seen as a context with no holes, which is trivially binding-free.
Finally, we look at the name-exhaustive pre-templates CNE1 , CNE3 and CNE4 .
Any COex -specimen of one of these pre-templates, with an entering search token, canbe turned into the form (C[(?;j χ), χ~ ]; H 1 , H~ 1 ; H 2 , H~ 2 ) where j is a positive number.
The token target is a source of an edge labelled with λ ∈ Oex
X , so we have:•C[(?;j H 1 ), H~ 1 ] →C[(X;j H 1 ), H~ 1 ],•C[(?;j H 2 ), H~ 2 ] →C[(X;j H 2 ), H~ 2 ].

The results of these sequences give a quasi-COex -specimen up to (=, =).

Robustness of pre-templates not on contraction trees: a principle
˙ H~ 1 ] → Ṅ 0 from the
Robustness can be checked by inspecting rewrite transition C[
˙ H~ 1 ; H~ 2 ) of a pre-template, where the token of C˙ is notstate given by a specimen (C;entering. We in particular consider the minimum local (contraction or rewrite) rule

150

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Ġ 7→ Ġ0 applied in this transition. This means that, in the hypernet Ġ, every vertex
is reachable from the token target.
The inspection boils down to analysing how the minimum local rule involves
edges that come from the hypernets H~ 1 . If all the involvement is deep, i.e. only
deep edges from H~ 1 are involved in the local rule, these deep edges must come via
˙ We can use Lem. 4.5.2(1).
deep holes in the context C.
If the minimum local rule involves shallow edges that are from H~ 1 , endpoints ofthese edges are reachable from the token target. This means that, in the context
˙ some holes are shallow and their sources are reachable from the token target.
C,˙ the context has a path from theMoreover, given that the token is not entering in C,
token target to a source of a hole edge.
~`⇥ i Bi

?⌦k
!

?

C
?

?⌦k

0

?

Figure 4.6: A shallow overlap (C is a contraction tree, Bi are box edges)
For example, in checking robustness of CBPerm with respect to copy transitions,
one situation of shallow overlaps is when Ġ is in the form of Fig. 4.6, and some of
the box edges Bi are from H~ 1 . Taking the minimum contraction rule means that C
in the graph is a contraction tree that gives a path from the token target. This path
C followed by the operation edge φ corresponds to paths from the token target to˙hole sources in the context C.
So, if the minimum local rule involves shallow edges that are from H~ 1 , the context
C˙ necessarily has a path P from the token target to a hole source. The path becomes˙ H~ 1 ], from the token target to a source of an edge e that is froma path in the state C[
H~ 1 . The edge e is necessarily shallow, and also involved in the application of theminimum local rule, because of the connectivity of Ġ. Moreover, a source of the edge

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

151

e is an input, in the relevant hypernet of H~ 1 . By inspecting minimum local rules,
we can enumerate possible labelling of the path P and the edge e, as summarised inTable 4.4. Explanation on the notation used in the table is to follow.

local rulelabels of path P

contraction(⊗?C )+ · Oex(⊗?C )+

→

→

@
→

ref
=
:=
!
+
−
−1

@·λ

∗
@ · (Oex
X)∗
ref · (OexX)=
= · I · (⊗C )∗∗⊗ ∗:= · (Oex
X ) · I · ( C)∗:= · (OexX)!
! · I · (⊗C )∗+−−1label of edge e
⊗? ,
C

box
I, Oex
box

Oex
X, I
Oex
X, I
I

⊗ , ◦
C
⊗ , ◦
C
Oex
X, I
I

⊗ , ◦
C
Z
Z
Z

Table 4.4: Summary of paths that witness shallow overlaps

We use the regular-expression like notation in Table 4.4. For example, (⊗?C )+ ·Oex represents finite sequences of edge labels, where more than one occurrences ofthe label ⊗?C is followed by one operation φ ∈ Oex . This characterises paths that
inhabit the overlap shown in Fig. 4.6, i.e. the contraction tree C followed by theoperation edge φ. Note that this regular-expression like notation is not a proper
regular expression, because it is over the infinite alphabet MOex , the edge label set,
and it accordingly admits infinite alternation (aka. union) implicitly.
To wrap up, checking robustness of each pre-template (that are not on contraction trees) boils down to using Lem. 4.5.2(1) and/or analysing the cases enumerated
in Table 4.4.

152

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE
~`
χ

?⌦k1

? ?⌦k2

C
?

?⌦k

?

Figure 4.7: A focussed context (C is a contraction tree)

Robustness of C⊗ and its converse
Robustness check of the pre-template C⊗ with respect to copy transitions has twocases. The first case is when one shallow overlap is caused by a path characterised by(⊗?C )+ , and the second case is when no shallow overlaps are present and Lem. 4.5.2(1)can be used.
In the first case, namely, a COex -specimen with a non-entering rewrite token canbe turned into the form (C[Ċ 0 [χ0 ], χ~ ]; H 1 , H~ 1 ; H 2 , H~ 2 ) where j is a positive number,and Ċ 0 is a focussed context in the form of Fig. 4.7. A rewrite transition is possible
on both states given by the specimen, in which a contraction rule is applied to Ċ 0 [H 1 ]and Ċ 0 [H 2 ]. Results of the rewrite transition give a new quasi-COex -specimen. When
˙ =N ), using the trigger C2 . When k1 > 0,
k1 = 0, this quasi-specimen is up to (=, '˙ =N ), but using the trigger C1 .
the quasi-specimen is also up to (=, 'Robustness check of the pre-template C⊗ with respect to rewrite transitions
always boils down to Lem. 4.5.2(1). This is intuitively because no local rewrite ruleof operations involves any shallow contraction edge of type ?.
Robustness of (C⊗ )−1 can be checked in a similar manner. Namely, using Table 4.4, shallow overlaps are caused by paths:(⊗?C )+ ,

=,

+,

∗
@ · (OexX) ,∗:= · (Oex
X) ,

−,

∗
ref · (Oex
X) ,

!,

−1

→

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

153

from the token target. All paths but (⊗?C )+ give rise to a state that is not rooted,
which can be checked using Lem. 4.3.17. This reduces the robustness check of (C⊗ )−1
to that of C⊗ .
Robustness of CGC and CNE2 , and their converse
These four pre-templates both relate hypernets with no inputs. Proofs of robustnessof them and their converse always boils down to the use of Lem. 4.5.2(1), following
the discussion in Sec. 4.5.5. Namely, it is impossible to find the path P in the context
C˙ from the token target to a hole source.
Robustness of CBPerm , CBPullC , CBPullW and CBPullD , and their converse
These eight pre-templates all concern boxes. Using Table 4.4, shallow overlaps are→caused by paths (⊗?C )+ · Oex and @ · λ from the token target.

→

Robustness check with respect to compute transitions of operations Oex \{@}
always boil down to Lem. 4.5.2(1).
→→As for compute transitions of the operation ‘@’, either one path @ · λ causes
one shallow overlap, or all overlaps are deep. The latter situation boils down toLem. 4.5.2(1). In the former situation, a beta rule involves one box that is contributed by a pre-template, and states given by a COex -specimen are turned into aquasi-COex -specimen up to (=, =), by one rewrite transition.
As for copy transitions, there are two possible situations.
• Paths (⊗?C )+ ·Oex cause some shallow overlaps and there are some deep overlaps
too.
• All overlaps are deep, which boils down to Lem. 4.5.2(1).
In the first situation, some of the shallow boxes duplicated by a contraction rule
are contributed by a pre-template, and other duplicated boxes may have deep edges
contributed by the pre-template. By tracking these shallow and deep contributions

154

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

in a contraction rule, it can be checked that one rewrite transition turns states given
by a COex -specimen into a quasi-COex -specimen. This quasi-specimen is up to thefollowing, depending on pre-templates:• (=, =) for CBPerm and its converse,
˙ =N ) for CBPullC , and ('˙ =N , =) for its converse, using the trigger C3 ,• (=, '
˙ =N ) for CBPullW , and ('˙ =N , =) for its converse, using the trigger C4 , and• (=, '
˙ ≤N ) for CBPullD , and (˙ ≥N , =, ) for its converse, using the trigger C5 .
• (=, Robustness of operational pre-templates and their converse
For the operational pre-templates and their converse, we use the class COex -bf ofbinding-free contexts. This restriction is crucial to rule out some shallow overlaps.
→

Using Table 4.4, shallow overlaps with the operational pre-templates C @ andCref are caused by paths (⊗?C )+ from the token context. However, the restriction tobinding-free contexts makes this situation impossible, which means the robustness
check always boils down to Lem. 4.5.2(1) and Lem. 4.5.2(2).
→In checking robustness of the converse (C @ )−1 and (Cref )−1 , shallow overlaps arecaused by paths:(⊗?C )+ ,

=,

+,

∗
@ · (OexX) ,∗:= · (Oex
X) ,

−,

∗
ref · (Oex
X) ,

!,

−1

→

from the token target. Like the case of (C⊗ )−1 , all paths but (⊗?C )+ give rise to astate that is not rooted, which can be checked using Lem. 4.3.17. The paths (⊗?C )+are impossible because of the binding-free restriction. As a result, this robustness
check also boils down to Lem. 4.5.2(1) and Lem. 4.5.2(2).

4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

155

Robustness of name-exhaustive pre-templates on lambda-abstractions,and their converse
We here look at the three name-exhaustive pre-templates CNE1 , CNE3 and CNE4 , andtheir converse. All these six pre-templates concern lambda-abstractions and theirdifferent use of a name. The pre-templates CNE1 , CNE4 and their converse compare
lambda-abstractions that all refer to a single name, with lambda-abstractions that
instantly return a value without using the name at all. The pre-template CNE3 andits converse compare lambda-abstractions that increment a number associated witha name, with lambda-abstractions that decrement the number. The latter lambdaabstractions additionally flip the sign of the number after dereferencing the name.
As a result, all the six pre-templates give rather rare examples of robustness check
where we compare different numbers of computation steps, i.e. transitions.
Using Table 4.4, shallow overlaps with these pre-templates are caused by paths:→(⊗?C )+ ,∗@ · (OexX) ,∗ref · (OexX) ,∗:= · (OexX)

from the token target.
→

As for compute transitions of operations Oex \{@}, there are two possible situations.
∗ex ∗• Shallow overlaps are caused by paths ref · (Oex
X ) or := · (OX ) .

• There is no overlap at all, which boils down to Lem. 4.5.2(1).
In the first situation, a stable hypernet GS of a local rewrite rule (see e.g. Fig. 3.9)
contains shallow edges, labelled with λ ∈ Oex
X , that are contributed by a pretemplate. The overlapped shallow contributions are not modified at all by the rewrite
rule, and consequently, one rewrite transition results in a quasi-COex -specimen up to(=, =).

156

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

As for copy transitions, either one path (⊗?C )+ causes one shallow overlap, or
all overlaps are deep. The latter situation boils down to Lem. 4.5.2(1). In theformer situation, one lambda-abstraction contributed by a pre-template gets duplicated. Namely, a COex -specimen with a non-entering rewrite token can be turned
into the form (C[Ċ 0 [χ0 ], χ~ ]; H 1 , H~ 1 ; H 2 , H~ 2 ) where Ċ 0 is a focussed context in the formof Fig. 4.7. There exist a focussed context C˙00 and two hypernets G1 CNE1 G2 suchthat:
C[Ċ 0 [H 1 ], H~ 1 ] → C[C˙00 [G1 ], H~ 1 ],C[Ċ 0 [H 2 ], H~ 2 ] → C[C˙00 [G2 ], H~ 2 ].
Results of these rewrite transitions give a new quasi-COex -specimen up to (=, =).
→As for compute transitions of the operation ‘@’, there are two possible situations.
→• One path @ causes a shallow overlap of the edge that has label λ and gets→∗
eliminated by a beta rewrite rule, and possibly some other paths @ · (OexX)

cause shallow overlaps in the stable hypernet GS (see Fig. 3.7).
→∗• There are possibly deep overlaps, and paths @ · (Oex
X ) may cause shallow

overlaps in the stable hypernet GS .
In the second situation, all overlaps are not modified at all by the beta rewrite
rule, except for some deep overlaps turned shallow. Consequently, one rewrite transition results in a quasi-COex -specimen up to (=, =).
In the first situation, one lambda-abstraction contributed by the pre-template
is modified, while all the other shallow overlaps (if any) are not. We can focus on
the lambda-abstraction. The beta rewrite acts on the lambda-abstraction, an edge→

labelled with ‘@’, and the stable hypernet GS .
In the case of CNE1 , application of the beta rule is followed by a few moretransitions. When GS is not an instance edge, we can prove that a token eventually4.5. APPLICATIONS OF THE CHARACTERISATION THEOREM

157

gets stuck, failing to apply a rewrite rule of the equality operation ‘=’. When GS
is simply an instance edge, a token may still get stuck for the same reason, but if
there is an applicable rewrite rule of the equality operation ‘=’, we obtain a quasi˙ =N , '˙ =N ), using triggers C6 and C7 on the left, and CGC on
COex -specimen up to ('the right.
The case of CNE3 and CNE4 , and their converse, is similar. The only differenceis the triggers used to find a quasi-specimen, as summarised in Table 4.3.

158

CHAPTER 4. ROBUSTNESS AND OBSERVATIONAL EQUIVALENCE

Chapter 5
Discussion
5.1

Linear-logic concepts, from the DGoIM to the
UAM

While the DGoIM is proposed as a framework for execution cost analysis, the conceptof locality it offers leads to the development of the UAM, the machine for direct
equational reasoning. Concepts taken from linear logic [Girard, 1987], namely the !box structure and generalised contractions, are essential for the rewrites-first DGoIM
to achieve time efficiency. Based on the rewrites-first DGoIM, the UAM also benefits
from these concepts, but not necessarily in the same way.

5.1.1

Box structures

The DGoIM uses a box structure to represent lambda-abstractions, which are theonly values of the pure lambda-calculus, via the so-called call-by-value translationof linear logic to intuitionistic logic (e.g. [Maraist et al., 1999]). In the lambdacalculus with the call-by-need or call-by-value evaluation, which the DGoIM aims
at in Chap. 2, lambda-abstractions serve as the unit of duplication and delay; eachfunction body gets copied as a whole, and never gets evaluated until an argument
is provided by function application. The boxes hence indicate values, computation
159

160

CHAPTER 5. DISCUSSION

to be duplicated, and computation to be delayed.
The UAM employs a box structure for a restricted purpose. Boxes used by theUAM correspond not to values but thunks, which are identified as the unit of delay inthe language Spartan. Thunks do not themselves become a unit of duplication, butthey provide enough information to determine which sub-graphs to duplicate. The
UAM does not rely on boxes to determine and trace values during execution. Values
are instead characterised by passive operations, which never trigger any rewrite.

5.1.2

Generalised contractions as optimisation

Time efficiency of the rewrites-first DGoIM crucially relies on the translation ofterms to graphs that introduces exactly one generalised contraction per variable(see Fig. 2.11). In comparison, the UAM takes a more primitive approach. Multiple
occurrences of a single variable in Spartan is represented by a combination of binary
contractions and weakenings as in proof nets [Girard, 1987].
This deviation is because of the different purposes these machines have. The
UAM together with the core language Spartan provides a rather primitive framework, in which observational equivalence can be proved and sophistication of language features can be justified using the equivalence. In a language as flexible as
Spartan, observational equivalences are not guaranteed to hold in any settings.
The rewrites-first DGoIM is implicitly optimised to achieve time efficiency, whose
safety could be justified by the UAM in terms of observational equivalence. Indeed,
equivalences implied by some templates in Sec. 4.5.2 seem to be helpful in justifying
the optimisation. The equivalences implied by templates CAssoc , CComm and CIdem
enable us to identify certain contraction trees of the same number of inputs, andhence to think of one generalised contraction to denote these all. Additionally, theequivalences implied by templates CBPullC and CBPullW would enable us to merge
generalised contractions across the boundary of the box structure, and hence tointroduce only one generalised contraction to represent a single variable.

5.1. LINEAR-LOGIC CONCEPTS, FROM THE DGOIM TO THE UAM

5.1.3

161

Interaction with contractions

Contractions, whether generalised or not, are used to represent multiple occurrencesof a variable, and to graphically connect the occurrences to computation associatedwith the variable. For example, the following graph represents a term x ∗ x whose
variable x is associated with computation 1 + 2, using an idealised contraction •:
1

2
+

∗

From the perspective of the DGoIM, the idealised contraction • denotes a generalised
contraction, and the graph represents a term (x∗x)[x ← 1+2]. From the perspectiveof the UAM, the idealised contraction • denotes a contraction tree, and the graphrepresents a term bind x → 1 + 2 in x ∗ x.
In strategical graph rewriting, there is a choice of the way the token interacts with
contractions. This affects evaluation of computation associated with a variable, inother words, computation shared via a variable. The two abstract machines DGoIM
and UAM, in fact, support different interactions between the token and contractions.
In the following, the difference is informally illustrated using the above example
graph. The token position is depicted as a thick arrow, the token data is mostly
omitted, and possibly multiple transitions are represented by.

In the rewrites-first DGoIM, the token passes through the contraction •, visits
and reduces the sub-graph representing 1 + 2, and then duplicates the result:
1

2

1

2
3

+

+

3

3
∗

∗
∗

∗

···

162

CHAPTER 5. DISCUSSION

When the token passes through the contraction •, it remembers its old position, as
indicated by a dashed line. This record is necessary to determine a token position
after the duplication. In the rewrites-first DGoIM, the record of previous positions
is the only part of the token data that depends on underlying graphs, namely a box
stack (see Def. 2.3.1).
On the other hand, in the UAM, the token never passes through the contraction •, which is a contraction tree, but instead immediately triggers duplication.
The duplication starts with ‘+’, and as the token continues travelling, the wholesub-graph representing 1 + 2 is eventually duplicated:
1

2

1

2

1

2
1

+

2

1

+
+

+

+
∗

∗

2

+

∗

···

∗

The token then proceeds to reduce each copy of 1 + 2 separately, which means
repeated evaluation of the computation 1 + 2 that was originally shared. Despite
the inefficiency of repeated evaluation, the immediate trigger of duplication leads tosimpler token data. The token does not need to record any previous position, andas a result, the token data of the UAM is completely independent from underlying
graphs.
To summarise, the rewrites-first DGoIM takes a reduction-oriented approach,the UAM takes a duplication-oriented approach, and these approaches are governedby the way the token interacts with contractions.
The reduction-oriented approach avoids repeated evaluation, which is essential
for the rewrites-first DGoIM to implement the call-by-need evaluation efficiently. On
the other hand, the UAM benefits from simpler token data, which is made possibleby the duplication-oriented approach. The token data of the UAM is as simple
as an edge label (?, X or), which is independent from underlying graphs. This

independence greatly simplifies the local, case-by-case, inspection of token moves5.2. CASE STUDY: DATA-FLOW NETWORKS

163

and triggered rewrites, which is at the core of observational equivalence proofs.
Recall that the duplication-oriented approach is at the cost of repeated evaluation. This results in the call-by-name binding, instead of the call-by-need binding,native to Spartan and the UAM. Unlike the call-by-need binding, the call-by-namebinding may enable contexts to distinguish computation from values. The restriction of contexts to binding-free contexts (Def. 4.2.3, with syntactical explanation in
Sec. 4.2.1) provides a way to avoid this extra distinguishing power from invalidatingsome observational equivalences, such as the call-by-value beta law.

5.2

Case study: data-flow networks

The DGoIM is introduced as a framework that combines token passing with graphrewriting in a flexible and disciplined way. It turns out that this combination cannaturally model unconventional but increasingly significant paradigms of programming, namely programming with data-flow networks. In addition to conventional
computation, such a style of programming involves construction, manipulation andobservation of data-flow networks. This section briefly explains a case study on
accommodating the data-flow networks in the context of token-guided graph rewriting [Cheung et al., 2018, Muroya et al., 2018].

5.2.1

TensorFlow networks

TensorFlow, a machine-learning library developed by Google1 , is a successful
example in which machine-learning models are managed as parametrised data-flow
networks. A constructed model has input, output, and additionally, parameters. It
can be used in two ways: for training, where parameters get updated so that themodel better describe given knowledge about input and output; and for prediction,
where the output is computed with respect to the current parameters and given1

https://www.tensorflow.org/

164

CHAPTER 5. DISCUSSION

input. This dual usage of the model can be understood in terms of manipulationand observation of the corresponding network.
Informally, a linear regression model f (x) = a ∗ x + b with two parameters a andb can be represented as a network on the left below, where the input x is denotedby a rectangle and the parameters are denoted by diamonds. Computation on theseelements is graphically described with the two circle nodes that denote operations∗ and +. Training this model results in updating the two parameters a and b (to,say, a0 and b0 ), and this update can be seen as the following simple manipulation of
the network:
a

x

a0

b

99K

∗

x

b0

∗

+

+

Given parameters a and b, and actual input data x0 , predicting output amounts toobservation following subtle manipulation. The subtle manipulation is the replacement of the rectangle node that denotes the input with a circle node that denotes
the actual value x0 , as depicted below. After this, the output data f (x0 ) = a ∗ x0 + b
can be read back from the network on the right, by an in-order traversal of the graphas indicated by a thick grey arrow:
a

x

99K

∗
+

x0

a

b

b

∗
+

TensorFlow, as an embedded domain specific language, provides a syntacticalinterface to construct and use the data-flow networks. The key idea that underlies
these networks is the classification of nodes into three, as described above: computation nodes (circles) that denote operations and constant values, which can be
multi-dimensional arrays; input nodes (rectangles) that are to be replaced with values; and parameter nodes (diamonds) that can be updated in place and also observed

5.2. CASE STUDY: DATA-FLOW NETWORKS

165

as values. In the TensorFlow terminology, input nodes are referred to as placeholders and parameter nodes as variables. The following code, written in a simplified
form of the Python binding of TensorFlow, describes the linear regression modelf (x) = a ∗ x + b that is constructed with initial parameters a = 1 and b = 0, used
once for prediction, trained, and used again for prediction with given input x = 10:
1
2
3
4
5
6
7
8
9
10
11
12
13

import t e n s o r f l o w as t f# c o n s t r u c t t h e modelx = t f . placeholder ( t f . float32 ) # input ‘ x ’
a = t f . V a r i a b l e (1)# parameter ‘ a ’
b = t f . V a r i a b l e (0)# parameter ‘ b ’
y = a ∗ x + b
with t f . S e s s i o n () as s :# i n i t i a l i s e parameters , using ‘ i n i t ’ de f i n ed elsewheres . run ( i n i t )# t r a i n t h e model , u s i n g ‘ t r a i n ’ d e f i n e d e l s e w h e r es . run ( t r a i n )# p r e d i c t o u t p u t w i t h t h e u p d a t e d modely 0 = s . run (y, f e e d d i c t ={x: 10} )Parameter nodes are updated in-place in line 11, whose result is used in line 13
for prediction. Also in line 13, an input value 10 is associated with the input node‘x’ using ‘ feed dict ’. Note that all these manipulation and observation are done
single-handedly by calling ‘run’ within what is called session.

5.2.2

Parametrised networks in the DGoIM style

The construction, manipulation and observation of parametrised data-flow networks
can be understood as combination of token passing and graph rewriting, from theperspective of the DGoIM that models the lambda-calculus. In collaboration with
Steven W. T. Cheung, Victor Darvariu, Dan R. Ghica and Reuben N. S. Rowe,
we formalise this as a token-guided graph-rewriting abstract machine à la DGoIM,
which models an extension of the simply-typed lambda calculus Cheung et al. [2018],
Muroya et al. [2018].
The extended calculus is dubbed Idealised TensorFlow (ITF). It has two novel
language features, namely parameters and graph abstraction, to express the computa-

166

CHAPTER 5. DISCUSSION

tion with parametrised data-flow networks. Its semantics, a variation of the DGoIM,
accordingly has extra nodes that represent parameters, and an extra rewriting ruleof graph abstraction. These extra features altogether model the behaviour of theparameter nodes in TensorFlow network, in a functional way. The rest of thissection gives an informal description using a simplified style of the DGoIM graphs,
deliberately ignoring their box structure, and making the token implicit in rewriting
rules.
The starting point is to get rid of one of the three classes of nodes in the TensorFlow network, namely input nodes. They can be replaced with the nodes
for lambda-abstraction and function application à la DGoIM. The linear regression model f (x) = a ∗ x + b can be represented as a lambda-abstraction with twoparameter nodes:
a

b
∗
+
λ

The subtle manipulation required by prediction, which was to replace the input nodewith a value node x0 , can be simply modelled by graphical beta reduction:
a

b
x0

a

∗

99K

+
x0

λ

b

∗
+

@

Observation of the resulting network, which involves parameter nodes, can beachieved solely by token passing. The output data a ∗ x0 + b can be obtained byletting the token travel through the network from the bottom, as indicated by athick gray arrow:5.2. CASE STUDY: DATA-FLOW NETWORKS

x0

a

167

b

∗
+

a ∗ x0 + b?

Values in gray (‘?’ and ‘a ∗ x0 + b’) represents token data, enriched to record values;
recall that the token uses its data to determine routing and control rewriting in the
DGoIM. The token can itself read back a value from the network, if it can record avalue of a node and perform an operation denoted by a node as it travels throughthe network.
The main manipulation of parametrised data-flow networks is to update parameter nodes. This can be modelled as a combination of graphical beta reduction andgraph abstraction, a new graph-rewriting rule. Graph abstraction “abstracts away”
all the parameters of a network, and turns the parametrised network into an ordinary network that represents a function on vectors. As a side product, it createsa value node that represents a vector whose elements are the current values of theparameters. The rewriting rule is formalised using two additional nodes: the node
‘A’ dedicated to trigger the rewrite, and a node ‘P’ that denotes projections of avector. When applied to the linear regression model, the rule looks like below:
a

b

P

∗

∗
+

99K

+

λ

λ

A

λ

(a, b)

Graph abstraction is not a local rewriting rule, because it extracts all parameters
in a network, which are not necessarily neighbours of the triggering node ‘A’. Parameters are extracted altogether as a function argument, so that parameter update
can be completed with graphical beta reduction. This deviates from the in-place
update of TensorFlow. Once a new parameter vector (a0 , b0 ) is computed, pre-

168

CHAPTER 5. DISCUSSION

diction with the updated model f (x) = a0 ∗ x + b0 using input data x0 can be started
with two steps of graphical beta reduction:P(a0 , b0 )(a0 , b0 )

∗
P

P

+

99K

λ

∗

99K

x0

+
λ

(a0 , b0 )

∗
x0

λ
x0

@

+
@

@

This will be followed by projections of the new parameter vector into each element.
The calculus ITF is proposed as an extension of the simply-typed lambdacalculus, in which the computation described above can be expressed with two extra
language features: parameters and graph abstraction. The TensorFlow code inSec. 5.2.1 corresponds to the following program in ITF, using the OCaml-like convention:
1
2
3
4
5
6
7
8
9
10
11

; ; c o n s t r u c t t h e model as a f u n c t i o n w i t h two p a r a m e t e r s
let a = {1} in
let b = {0} in
let y = fun x -> a ∗ x + b in
; ; t u r n t h e model i n t o a f u n c t i o n and a parameter v e c t o rlet (model ,p) = abs y in
; ; u p d a t e t h e parameter v e c t o r w i t h ‘ t r a i n ’ d e f i n e d e l s e w h e r e
let q = t r a i n model p in
; ; p r e d i c t o u t p u t w i t h t h e u p d a t e d model
let y 0 = model q 10 in
y 0
The parameters, indicated by {−}, enable users to construct a model without
explicitly declaring which parameters are involved in each model. This convenientstyle of construction is taken from TensorFlow. What used to be in-place update of parameters in TensorFlow is now decomposed through graph abstraction,
which can be accessed by programmers using the operation ‘abs’ (line 6).
As a final remark, the idea of local reasoning, which is extensively investigatedin Chap. 4, was initially tried out with ITF and its DGoIM-style model. Although5.2. CASE STUDY: DATA-FLOW NETWORKSITF term using parameters
let a = {1} in(fun x -> a ∗ x + a)
fun x -> {1} ∗ x + {0}169Spartan term using names
new a ( 1 in λx. !a × x + !a

new a ( 1 in new b ( 0 in λx. !a × x + !b
λx. (new a ( 1 in new b ( 0 in !a × x + !b)

Table 5.1: Parameters, and their possible representation with name binding

the model is a variation of the DGoIM, it is not as tuned for efficiency as the
DGoIM in the way discussed in Sec. 5.1.2. The model is rather used to provesoundness of ITF programs (recall that ITF is simply-typed) and some observational
equivalence, namely garbage collection and a restricted form of the beta law. The
proof technique introduced for observational equivalence on ITF programs is basedaround the concept of local reasoning, which inspired the development of the UAM
and the characterisation theorem (Thm. 4.3.14).
It would be interesting to reformulate ITF and its semantics using Spartan andthe UAM, which seems possible but not straightforward. Graph abstraction could
be modelled as an extrinsic operation of Spartan that has global behaviour, i.e. a
behaviour that cannot be specified by a local rewrite rule. It is tempting to represent
parameters of ITF in Spartan using name binding and the extrinsic operation for
dereferencing. However, it seems that the representation should be a non-trivial,
global, one. Table 5.1 shows some illustrating examples.
The first ITF term in Table 5.1 represents a model with one parameter thatis named ‘a’ and used twice. The multiple occurrences of the name do not mean
duplication of the parameter ‘{1}’ itself, which matches the sharing behaviour ofname binding in Spartan. The ITF term therefore seems to correspond to thesimilar Spartan term (namely, the first Spartan term in Table 5.1) that introduces
the bound name a and dereferences it twice.
However, parameters can also be introduced and used anonymously in ITF, likethe second ITF term in Table 5.1. Anonymous parameters could be representedin Spartan by introducing fresh name bindings, but there is not a single way to

170

CHAPTER 5. DISCUSSION

do so. The table shows two possible ways: introducing name bindings outside thelambda-abstraction, and inside the lambda-abstraction. These two representations
have different behaviours in Spartan, because the sharing behaviour of name binding varies according to where the name binding is placed, as explained in Sec. 3.2.2.
It is in fact the first representation, which places fresh name bindings all outside
the lambda-abstraction, that achieves the same behaviour as the original ITF term.
This suggests that it would require some global perspective to appropriately introduce name bindings, so that ITF parameters, especially anonymous parameters, areproperly represented in Spartan.

Chapter 6
Related and future work
6.1

Environments in abstract machines

In an abstract machine of any functional programming language, computations assigned to variables have to be stored for later use. This storage, often called environment, is expanded when the abstract machine encounters a new variable, andreferred to when the machine encounters a known variable. The environment needs
to be carefully managed throughout program execution, so that each variable isassociated with unique computation in the environment, otherwise there would be
conflicting results of looking up a variable.
However, naive management of the environment would generate such conflicting
entities. For example, executing a functional program (λf. (f 0)+(f 1)) (λx. x) would
apply the identity function λx. x twice with different arguments 0 and 1. This means
that, naively, both these arguments would be associated with the same variable x
in the environment.
Different solutions to this conflict lead to different representations of the environment, some of which are examined by Accattoli and Barras [2017] from theperspective of time-cost analysis. A few solutions seem relevant to token-guided
graph rewriting.
One solution is to allow at most one assignment to each variable. This is typi171

172

CHAPTER 6. RELATED AND FUTURE WORK

cally achieved by renaming bound variables during execution, possibly symbolically.
Examples for call-by-need evaluation are Sestoft’s abstract machines [Sestoft, 1997],
and the storeless and store-based abstract machines studied by Danvy and Zerny[2013]. The graph-rewriting abstract machines presented in this thesis give anotherexample. This is shown, in the case of the rewrites-first DGoIM, by the simulation of
the sub-machine semantics that resembles the storeless abstract machine mentioned
above. Variable renaming is trivial in both the DGoIM and the UAM, thanks to theuse of graphs, in which variables are represented anonymously by mere edges.

Another solution is to allow multiple assignments to a variable, with restrictedvisibility. The common approach is to pair a sub-term with its own localised environment that maps its free variables to their assigned computations, forming a so-called
closure. Conflicting assignments are distributed to distinct localised environments.
Examples include Cregut’s lazy variant [Crégut, 2007] of Krivine’s abstract machinefor call-by-need evaluation, and the SECD machine of Landin [1964] for call-by-value
evaluation. Fernández and Siafakas [2009] refine this approach for call-by-nameand call-by-value evaluations, based on closed reduction [Fernández et al., 2005],
which restricts beta-reduction to closed function arguments. This suggests thatthe approach with localised environments can be modelled with token-guided graphrewriting by implementing closed reduction. The implementation would require theability to manipulate boxes, especially to merge them.

Finally, Fernández and Siafakas [2009] propose another approach to multiple
assignments, in which multiple assignments are augmented with binary strings sothat each occurrence of a variable can only refer to one of them. This approachis inspired by the token-passing GoI, namely a token-passing abstract machine forcall-by-value evaluation, designed by Fernández and Mackie [2002]. The augmenting
binary strings come from paths of trees of binary contractions, which are used by
the token-passing machine, as well as the UAM, to represent shared assignments.

6.2. GRAPH REWRITING WITH BOXES AND TOKEN

6.2

173

Graph rewriting with boxes and token

The box structures used by the DGoIM and the UAM are inspired by the exponential
boxes of proof nets, a graphical representation of linear logic proofs [Girard, 1987].
In the framework of proof nets, and an established graph-rewriting framework ofinteraction nets [Lafont, 1990] that subsume proof nets, several graphical representations of exponential boxes have been proposed. Lafont [1995] formalises boxes
by parametrising an agent (which corresponds to an edge of hypernets) by anothernet, and Mackie [1998] introduces coordinated agents that altogether represent aboundary of a box. Accattoli and Guerrini [2009] proposes a box structure that isrepresented by extra edges. Each of these approaches is relevant to the DGoIM or
the UAM.
In the rewrites-first DGoIM, boxes are formalised by coordinating nodes labelledwith ‘!’ and ‘?’, which resembles Mackie’s approach. However, cost analysis of the
DGoIM in Sec. 2.5 adopts the view of boxes as extra edges to achieve efficiency,
sharing the idea with the approach of Accattoli and Guerrini.
Boxes of the UAM, on the other hand, are closely related to Lafont’s exponential
boxes. In comparison with exponential boxes, the boxes of hypernets, namely box
edges, have flexibility regarding types of a box edge itself and its content (i.e. thehypernet that labels it). Each box edge represents a thunk, and it can have lesstargets than outputs of its contents, reflecting the number of bound variables thethunk has.
The idea of using the token as a guide of graph rewriting was also proposedby Sinot [2005, 2006] for interaction nets. He shows how using a token can make theinteraction-net rewriting system implement the call-by-name, call-by-need and callby-value evaluation strategies. The rewrites-first DGoIM can be seen as a realisationof the rewriting system as an abstract machine, in particular with explicit control
over copying sub-graphs. As a revision of the rewrites-first DGoIM, the UAM could

174

CHAPTER 6. RELATED AND FUTURE WORK

possibly be formalised with interaction nets. However, local reasoning does not seemas easy in interaction-net rewriting as in the UAM, because of technical subtleties
observed in loc. cit. Namely, a status of evaluation is remembered by not only thetoken but also some other agents around an interaction net, which blurs locality of
information.
A similar structure to the box structure of the UAM is studied by Drewes et al.
[2002] as hierarchical graphs, in the context of double-pushout graph transformation [Rozenberg, 1997], a well-established algebraic approach to graph rewriting.
Investigating local reasoning in this context is an important future direction.
The double-pushout approach has been used to rewrite string diagrams [Kissinger,
2012, Bonchi et al., 2016], which provide graphical representation that can accommodate some built-in equations. The graphs used by the DGoIM and the UAM could
also perhaps be formalised as string diagrams, with boxes modelled as functorial
boxes [Melliès, 2006]. Nevertheless, local reasoning rather aims at discovering such
built-in equations on graphs that represent programs, because it is not clear whatshould be, or can be, such a built-in equation in the presence of arbitrary language
features.

6.3

Extrinsic operations

Extrinsic operations of Spartan are greatly inspired by algebraic operations [Plotkin
and Power, 2001, 2003]. Algebraic operations are introduced as a syntactic interface
to computational effects, such as non-determinism, I/O, exception and state. In themost general form, algebraic operations do have eager arguments, as well as deferredarguments with bound variables. They use eager arguments to determine effectful
behaviour, and then continue computation with deferred arguments.
Algebraic operations provide a view of language features, namely effects, as behaviour of operations. This is in contrast to the view of language features as encoding

6.4. OBSERVATIONS OF PROGRAM EXECUTION

175

into the host language, that is to say, features of a language are described within
the language. In the case of computational effects, this means encoding effects intoa pure language, which can be achieved via monads [Moggi, 1988].
Spartan takes the behavioural view to the extreme, to the level that only binding of variables and names, and thunking, are intrinsic. Everything else becomes
extrinsic operations, which have the same form as algebraic operations, and extrinsic
operations are specified in terms of behaviour. The behaviour is represented as extrinsic transitions of the UAM, which are focussed graph-rewriting rule. The UAM
benefits its “universality” from this extreme behavioural view of language features.
It can model language features in a uniform way, whether they are effectful or pure,whether they are encoded or native.

6.4

Observations of program execution

Although the UAM itself can accommodate computational effects by means of extrinsic operations, its local reasoning principle was formalised in Chap. 4 for only
the UAM that is deterministic. This restriction was primarily to keep the technical development relatively simple, in particular the notion of contextual refinement
presented in Sec. 4.2 and step-wise reasoning presented in Sec. 4.4.
It is important future work to broaden the scope of local reasoning, by lifting thecurrent restriction to sequential and deterministic computation. This would require
an expanded model of program execution, and more significantly, a new definitionof observational equivalence. The principle of local reasoning is expected to be stillvalid, but its details, such as the variant of simulation (Def. 4.4.1), would require aminor adaptation.
Parallelism and concurrency can be modelled with multiple tokens, which aretravelling around a graph at the same time, as shown by Dal Lago et al. [2017]
in the case of token-passing GoI. Non-deterministic computation, or computation

176

CHAPTER 6. RELATED AND FUTURE WORKwith probability or I/O, would require a minor extension of the UAM to be a nondeterministic and labelled transition system.
A significant modification required by these computations would rather be on adefinition of observational equivalence, because these computations enrich observation of program executions with probability, input/output sequences, etc. Such a
definition is studied by Johann et al. [2010] for algebraic effects, which include thesecomputations.

6.5

Time and space efficiency

Cost analysis of the rewrites-first DGoIM, carried out in Chap. 2, primarily focussed
on time efficiency. This is to complement existing work on operational semantics
given by token-passing GoI, which usually achieves space efficiency, and also to
confirm that introduction of graph rewriting to token passing does not bring in any
hidden inefficiencies.
Only the rewrites-first and passes-only interleaving of graph rewriting with token
passing have been studied, and flexible interleaving is yet to be explored. For instance, the DGoIM could choose between token passing and graph rewriting at eachstep of execution, taking its resource usage into account. One possible interleaving
strategy would be to choose graph rewriting, in particular duplication of sub-graphs,
as long as there is enough space left. It is future work to study the DGoIM withflexible interleaving, as a model of program execution under various time and spaceconstraints.
Moreover, interleaving is not the only source of flexibility for the DGoIM. Eachof its components, token passing and graph rewriting, could be adapted to serve particular objectives in the trade-off between time and space efficiency. As discussed inSec. 5.1.3, different approaches to token passing, with respect to contractions, leadto different evaluation strategies regarding variable binding. Accommodation of call-6.6. IMPROVEMENT AND OPTIMISATION

177

by-need variable binding in the UAM and Spartan is an interesting topic. Graphrewriting could also be refined, in terms of management of boxes for instance, toserve further objectives such as: full lazy evaluation, whose implementation with interaction nets and the token is studied by Sinot [2005]; and optimal reduction [Lévy,
1980, Lamping, 1990], whose relation to GoI is studied by Gonthier et al. [1992].

6.6

Improvement and optimisation

Although the UAM was not designed to study cost of program execution, one canthink of a cost model of the machine in a similar way as the DGoIM. Additionally,
the indexing of observational equivalence with a preorder that represents the numberof execution steps paves the way for comparison between programs, with respect toexecution result and also execution cost. An observational equivalence indexed by
the “greater-than-or-equal” preorder ≥ can indeed state that replacing a programfragment with another always requires fewer steps in execution of the whole program.
By combining the indexed observational equivalence with a cost model of the UAM,
one could hopefully prove improvement [Moran and Sands, 1999], which integrates
the idea of reduction of execution cost with observational equivalence.
As a related matter, Sec. 5.1.2 discussed a view of the rewrites-first DGoIM as
an optimised variant of the UAM. Another future work is to formalise the idea of
optimising the UAM, possibly with the notion of improvement. Optimisation of theUAM could give another avenue for exploring the time-space efficiency trade-off ofprogram execution.

6.7

Further directions

Universality of the UAM The UAM presented in Chap. 3 is dubbed universal
in the sense of universal algebras. Like universal algebras are parametrised by aset of operations and their equational theory, the UAM is parametrised by a set of

178

CHAPTER 6. RELATED AND FUTURE WORK

operations and their behaviour, which is given in terms of focussed graph rewriting.
One could ask if the UAM is universal also in the sense of universal Turing machines,
which can simulate arbitrary Turing machines. It would be interesting to see how
the UAM can be instantiated to simulate known abstract machines, such as Landin’s
SECD machine [Landin, 1964] for the lambda-calculus.

Local-reasoning assistant Chap. 4 formulated the proof methodology of observational equivalence that exploits locality. An equivalence proof is boiled down toelementary case-by-case analysis of interference between sub-graphs, formalised as
the notions of input-safety and robustness. Although analysis of each case is arguably elementary, the main challenge, which can be observed in Sec. 4.5.5, is to
identify all possible interference between particular sub-graphs. An approach taken
in Sec. 4.5.5 was to focus on paths and labels, as summarised in Table 4.6. Investigating this approach, and in general, approaches to detecting interference, is
important future work, which would be an essential aid to local reasoning.

Type system Another direction of further research is to equip Spartan with amore expressive type system, compared with the current one which merely ensuresthat terms are formed correctly. More powerful type systems could be used to ensure
safety of program execution, by disproving an error state, or to statically trace andanalyse behaviour of certain operations, like with type and effect systems [Nielson
and Nielson, 1999]. Although these type systems are not necessary for the UAM andits proof methodology of observational equivalence, which can be seen as a strengthof the UAM, it would be interesting to study how the notion of typing in Spartan
can benefit local reasoning.

Chapter A
Technical appendix for Chap. 3
A.1

Equivalent definitions of hypernets

Informally, hypernets are nested hypergraphs, and one hypernet can contain nested
hypergraphs up to different depths. This intuition is reflected by Def. 3.3.5 of hyS
pernets, in particular the big union in Hk+1 (L, M ) = H L, M ∪ i≤k Hi (L, M ) . In

fact, the definition can be replaced by a simpler, but possibly less intuitive, definition
below that does not explicitly deal with the different depths of nesting.
Definition A.1.1. Given sets L and M , a set Hk0 (L, M ) is defined by induction onk ∈ N:
H00 (L, M ) := H(L, M )00
Hk+1 (L, M ) := H L, M ∪ Hk (L, M )and hence a set Hω0 (L, M ) :=S

0i∈N Hi (L, M ).

Lemma A.1.2. Given arbitrary sets L and M , any two numbers k, k 0 ∈ N satisfy0
Hk0 (L, M ) ⊆ Hk+k
0 (L, M ).

Proof. If k 0 = 0, the inclusion trivially holds. If not, i.e. k 0 > 0, it can be provedby induction on k ∈ N. The key reasoning principle we use is that M ⊆ M 0 implies
H(L, M ) ⊆ H(L, M 0 ).
179

180

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

In the base case, when k = 0 (and k 0 > 0), we have

H00 (L, M ) = H(L, M )⊆ H L, M ∪ Hk0 0 −1 (L, M ) = Hk0 0 (L, M ).
In the inductive case, when k > 0 (and k 0 > 0), we have0
Hk0 (L, M ) = H L, M ∪ Hk−1
(L, M )
00
⊆ H L, M ∪ Hk−1+k= Hk+k0 (L, M )0 (L, M )where the inclusion is by induction hypothesis on k − 1.

Proposition A.1.3. Any sets L and M satisfy Hk (L, M ) = Hk0 (L, M ) for any
k ∈ N, and hence Hω (L, M ) = Hω0 (L, M ).

Proof. We first prove Hk (L, M ) ⊆ Hk0 (L, M ) by induction on k ∈ N. The base case,when k = 0, is trivial. In the inductive case, when k > 0, we have[
Hk (L, M ) = H L, M ∪Hi (L, M )⊆ H L, M ∪
=H



i≤k−1

[

i≤k−1


Hi0 (L, M )

0(L, M )
L, M ∪ Hk−1

= Hk0 (L, M ).

(by I.H.)(by Lem. A.1.2)

The other direction, i.e. Hk0 (L, M ) ⊆ Hk (L, M ), can be also proved by induction
on k ∈ N. The base case, when k = 0, is again trivial. In the inductive case, weA.1. EQUIVALENT DEFINITIONS OF HYPERNETS

181

have


0
(L, M )
Hk0 (L, M ) = H L, M ∪ Hk−1
⊆ H L, M ∪ Hk−1 (L, M )[⊆ H L, M ∪Hi (L, M )(by I.H.)i≤k−1= Hk (L, M ).

Given a hypernet G, by Lem. A.1.2 and Prop. A.1.3, there exists a minimum
number k such that G ∈ Hk0 (L, M ), which we call the minimum level of G.

Lemma A.1.4. Any hypernet has a finite number of shallow edges, and a finite
number of deep edges.

Proof. Any hypernet has a finite number of shallow edges by definition. We provethat any hypernet G has a finite number of deep edges, by induction on minimum
level k of the hypernet.
When k = 0, the hypernet has ho deep edges.
When k > 0, each hypernet H that labels a shallow edge of G belongs to0
Hk−1(L, M ), and therefore its minimum level is less than k. By induction hypoth-esis, the labelling hypernet H has a finite number of deep edges, and also a finite
number of shallow edges. Deep edges of G are given by edges, at any depth, ofany hypernet that labels a shallow edge of G. Because there is a finite number ofthe hypernets that label the shallow edges of G, the number of deep edges of G isfinite.

182

A.2

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

Plugging

An interfaced labelled monoidal hypergraph can be given by data of the following
form: ((V ] I ] O, E), (S, T ), (fV , fE )) where I is the input list, O is the output list,
V is the set of all the other vertices, E is the set of edges, (S, T ) defines source andtarget lists, and (fV , fE ) is labelling functions.

Definition A.2.1 (Plugging). Let C[χ~1 , χ, χ~2 ] = ((V ] I ] O, E), (S, T ), (fV , fE ))and C 0 [χ~3 ] = ((V 0 ] I 0 ] O0 , E 0 ), (S 0 , T 0 ), (fV0 , fE0 )) be contexts, such that the hole χand the latter context C 0 have the same type and χ~1 ∩ χ~2 ∩ χ~3 = ∅. The plugging
C[χ~1 , C 0 , χ~2 ] is a hypernet given by data ((V̂ , Ê), (Ŝ, T̂ ), (fˆV , fˆE )) such that:V̂ = V ] V 0 ] I ] O
Ê = (E\{eχ }) ] E 0



S(e)
(if e ∈ E\{eχ })Ŝ(e) =g ∗ (S 0 (e)) (if e ∈ E 0 )T (e)(if e ∈ E\{eχ })T̂ (e) =g ∗ (T 0 (e)) (if e ∈ E 0 )




v
(if v ∈ V 0 )g(v) = (S(eχ ))i (if v = (I 0 )i )






(T (eχ ))i (if v = (O0 )i )
fV (v) (if v ∈ V )ˆ
fV (v) =fV0 (v) (if v ∈ V 0 )fE (e) (if e ∈ E\{eχ })fˆE (e) =fE0 (e) (if e ∈ E 0 )A.3. ROOTED STATES

183

where eχ ∈ E is the hole edge labelled with χ, and (−)i denotes the i-th element ofa list.
~0 , C 0 , χ~00 ], each edge comes from either C or C 0 . If a
In the resulting context C[χ~0 , C 0 , χ~00 ].
path in C does not contain the hole edge eχ , the path gives a path in C[χ~0 , C 0 , χ~00 ] consists of edges from C only, the path gives a
Conversely, if a path in C[χpath in C.
~0 , C 0 , χ~00 ]. However, if a path in C[χ~0 , C 0 , χ~00 ]Any path in C 0 gives a path in C[χconsists of edges from C 0 only, the path does not necessarily give a path in C 0 . The
path indeed gives a path in C 0 , if sources and targets of the hole edge eχ are distinct
in C (i.e. the hole edge eχ is not a self-loop).

A.3

Rooted states

Lemma A.3.1. Let (X, _) is an abstract rewriting system that is deterministic.

1. For any x, y, y 0 ∈ X such that y and y 0 are normal forms, and for any k, h ∈ N,
if there exist two sequences x _k y and x _h y 0 , then these sequences areexactly the same.

2. For any x, y ∈ X such that y is a normal form, and for any i, j, k ∈ N suchthat i 6= j and i, j ∈ {1, . . . , k}, if there exists a sequence x _k y, then its i-th
rewrite z _ z 0 and j-th rewrite w _ w0 satisfy z 6= w.

Proof. The point (1) is proved by induction on k + h ∈ N. In the base case, whenk + h = 0 (i.e. k = h = 0), the two sequences are both the empty sequence, andx = y = y 0 . The inductive case, when k + h > 0, falls into one of the following
two situations. The first situation, where k = 0 or h = 0, boils down to the basecase, because x must be a normal form itself, which means k = h = 0. In thesecond situation, where k > 0 and h > 0, there exist elements z, z 0 ∈ X such thatx _ z _k−1 y and x _ z 0 _h−1 y 0 . Because _ is deterministic, z = z 0 follows,

184

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

and hence by induction hypothesis on (k − 1) + (h − 1), these two sequences are thesame.
The point (2) is proved by contradiction. The sequence x _k y from x to thenormal form y is unique, by the point (1). If its i-th rewrite z _ z 0 and j-th rewrite
w _ w0 satisfy z = w, determinism of the system implies that these two rewrites

are the same. This means that the sequence x _k y has a cyclic sub-sequence, andby repeating the cycle different times, one can yield different sequences of rewrites
x _∗ y from x to y. This contradicts the uniqueness of the original sequencex _k y.

∗•Ġ from the initial
Lemma A.3.2. If a state Ġ is rooted, a search sequence ?; |Ġ| →state ?; |Ġ| to the state Ġ is unique. Moreover, for any i-th search transition andj-th search transition in the sequence such that i 6= j, these transitions do not resultin the same state.
Proof. Let X be the set of states with search or value token. We can define an•
Ḣ. Any
abstract rewriting system (X, _) of “reverse search” by: Ḣ _ Ḣ 0 if Ḣ 0 →search sequence corresponds to a sequence of rewrites in this rewriting system.

••
The rewriting system is deterministic, i.e. if Ḣ 0 →Ḣ and H˙ 00 →Ḣ then Ḣ 0 = H˙ 00 ,because the inverse 7→−1 of the interaction rules (Fig. 3.5) is deterministic.
If a search transition changes a token to a search token, the resulting searchtoken always has an incoming operation edge. This means that, in the rewriting
system (X, _), initial states are normal forms. Therefore, by Lem. A.3.1(1), if there
exist two search sequences from the initial state ?; |Ġ| to the state Ġ, these searchsequences are exactly the same. The rest is a consequence of Lem. A.3.1(2).
Lemma A.3.3. For any hypernet N , if there exists an operation path from an input
to a vertex, the path is unique. Moreover, no edge appears twice in the operation
path.
Proof. Given the hypernet N whose set of (shallow) vertices is X, we can define anA.3. ROOTED STATES

185

abstract rewriting system (X, _) of “reverse connection” by: v _ v 0 if there exists
an operation edge whose unique source is v 0 and targets include v. Any operation

path from an input to a vertex in N corresponds to a sequence of rewrites in thisrewriting system.
This rewriting system is deterministic, because each vertex can have at most one
incoming edge in a hypergraph (Def. 3.3.2) and each operation edge has exactly one
source. Because inputs of the hypernet N have no incoming edges, they are normal
forms in this rewriting system. Therefore, by Lem. A.3.1(1), an operation path fromany input to any vertex is unique.
The rest is proved by contradiction. We assume that, in an operation path P
from an input to a vertex, the same operation edge e appears twice. The edge e has
one source, which either is an input of the hypernet N or has an incoming edge. In
the former case, the edge e can only appear as the first edge of the operation path
P , which is a contradiction. In the latter case, the operation edge e has exactly one
incoming edge e0 in the hypernet N . In the operation path P , each appearance ofthe operation edge e must be preceded by this edge e0 via the same vertex. This
contradicts Lem. A.3.1(2).
Lemma A.3.4. For any rooted state Ġ, if its token source (i.e. the source of thetoken) does not coincide with the unique input, then there exists an operation pathfrom the input to the token source.
∗•
Proof. By Lem. A.3.2, the rooted state Ġ has a unique search sequence ?; |Ġ| →Ġ.

The proof is by the length k of this sequence.
In the base case, where k = 0, the state Ġ itself is an initial state, which means
the input and token source coincide in Ġ.
k−1•
In the inductive case, where k > 0, there exists a state Ġ0 such that ?; |Ġ| →

•
•
Ġ0 →
Ġ. The proof here is by case analysis on the interaction rule used in Ġ0 →Ġ.

• When the interaction rules (1a), (1b), (2) or (5b) is used (see Fig. 3.5), the186

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3•transition Ġ0 →Ġ only changes a token label.

•• When the interaction rule (3) is used, the transition Ġ0 →Ġ turns the token

and its outgoing operation edge eG0 into an operation edge eG and its outgoing
token. By induction hypothesis on Ġ0 , the token source coincides with its
input, or there exists an operation path from the input to the token source, inĠ0 .
In the former case, in Ġ, the source of the operation edge eG coincides with
the input. The edge eG itself gives the desired operation path in Ġ.
In the latter case, the operation path PG0 from the input to the token sourcein Ġ0 does not contain the outgoing operation edge eG0 of the token; otherwise,
the edge eG0 must be preceded by the token edge in the operation path PG0 ,which is a contradiction. Therefore, the operation path PG0 in Ġ0 is inherited inĠ, becoming a path PG from the input to the source of the incoming operationedge eG of the token. In the state Ġ, the path PG followed by the edge eGyields the desired operation path.
•Ġ changes the token• When the interaction rule (4) is used, the transition Ġ0 →from a (k + 1)-th outgoing edge of an operation edge e to a (k + 2)-th outgoingedge of the same operation edge e, for some k ∈ N. In Ġ0 , the token source is
not an input, and therefore, there exists an operation path PG0 from the input
to the token source, by induction hypothesis.
The operation path PG0 ends with the operation edge e, and no outgoing edge ofthe edge e is involved in the path PG0 ; otherwise, the edge e must appear morethan once in the path PG0 , which is a contradiction by Lem. A.3.3. Therefore,
the path PG0 is inherited exactly as it is in Ġ, and it gives the desired operationpath.
• When the interaction rule (5a) is used, by the same reasoning as in the case

A.3. ROOTED STATES

187

of rule (4), Ġ0 has an operation path PG0 from the input to the token source,
where the incoming operation edge eG0 of the token appears exactly once, atthe end. Removing the edge eG0 from the path PG0 yields another operation
path P from the input in Ġ0 , and it also gives an operation path from the
input to the token source in Ġ.

Lemma A.3.5. For any state Ġ with a t-token such that t 6= ?, if Ġ is rooted, then
∗

+

•
•
there exists a search sequence ?; |Ġ| →hĠi?/t →Ġ.
∗•Proof. By Lem. A.3.2, the rooted state Ġ has a unique search sequence ?; |Ġ| →Ġ.

The proof is to show that a transition from the state hĠi?/t appears in this searchseqeunce, and it is by the length k of the search sequence.
Because Ġ does not have a search token, k = 0 is impossible, and therefore the•base case is when k = 1. The search transition ?; |Ġ| →Ġ must use one of theinteraction rules (1a), (1b), (2) and (5b). This means ?; |Ġ| = hĠi?/t .
k−1•
In the inductive case, where k > 0, there exists a state Ġ0 such that ?; |Ġ| →

•
•
Ġ0 →
Ġ. The proof here is by case analysis on the interaction rule used in Ġ0 →Ġ.

• When the interaction rule (1a), (1b), (2) or (5b) is used, ?; |Ġ| = hĠi?/t .
• Because Ġ does not have a search token, the interaction rules (3) and (4) can•be never used in Ġ0 →Ġ.

• When the interaction rule (5a) is used, Ġ0 has a value token, which is a (k + 1)th outgoing edge of an operation edge e, for some k ∈ N. The operation edgee becomes the outgoing edge of the token in Ġ. By induction hypothesis onĠ0 , we have
∗

+

•
•
•
?; |Ġ| →hĠ0 i?/X →
Ġ0 →
Ġ.

(A)

If k = 0, in Ġ0 , the token is the only outgoing edge of the operation edge e.
Because hĠ0 i?/X is not an initial state, it must be a result of the interaction

188

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

rule (3), which means the search sequence (A) is factored through as:
∗

+

•
•
•
•
?; |Ġ| →hĠi?/t →hĠ0 i?/X →
Ġ0 →
Ġ.

If k > 0, for each m ∈ {0, . . . , k}, let N˙m be a state with a search token, suchthat |N˙m | = |Ġ0 | and the token is an (m + 1)-th outgoing edge of the operationedge e. This means Ṅk = hĠ0 i?/X . The proof concludes by combining thefollowing internal lemma with (A), taking k as m.

Lemma A.3.6. For any m ∈ {0, . . . , k}, if there exists h < k such that
• h ˙
• ∗
• + ˙
?; |Ġ| →Nm , then it is factored through as ?; |Ġ| →hĠi?/t →Nm .

Proof. By induction on m. In the base case, when m = 0, the token of N˙m isthe first outgoing edge of the operation edge e. This state is not initial, andtherefore must be a result of the interaction rule (3), which means
•
• ∗
N˙m .
?; |Ġ| →hĠi?/t →In the inductive case, when m > 0, the state N˙m is not an initial state andmust be a result of the interaction rule (4), which means• ∗•˙ iX/? →?; |Ġ| →
hNm−1
N˙m .
• ∗
˙ iX/? , consists of
The first half of this search sequence, namely ?; |Ġ| →hNm−1

h − 1 < k transitions. Therefore, by (outer) induction hypothesis on h − 1, we
have
• ∗
• +
•
˙ →
˙ iX/? →?; |Ġ| →
Nm−1
hNm−1
N˙m .
∗

•
˙ , consists of less than k transitions.
The first part, namely ?; |Ġ| →Nm−1

A.3. ROOTED STATES

189

Therefore, by (inner) induction hypothesis on m − 1, we have
∗

+

+

•
•
•
•
˙ →
˙ iX/? →?; |Ġ| →hĠi?/t →
Nm−1
hNm−1
N˙m .

Lemma A.3.7.
1. For any state Ṅ , if it has a path to the token source that is not an operation
path, then it is not rooted.
˙
2. For any focus-free hypernet H and any focussed context C[χ]with one hole˙edge, such that C[H]is a state, if the hypernet H is one-way and the context
C˙ has a path to the token source that is not an operation path, then the state˙C[H]is not rooted.
˙ χ]; G;
~ H)
~ of an output-closed pre-tepmlate C, if the
3. For any C-specimen (C[~˙ χ] has a path to the token source that is not an operation path, thencontext C[~
˙ G]~ and C[˙ H]
~ is not rooted.
at least one of the states C[
Proof of the point (1). Let P be the path in Ṅ to the token source that is not an
operation path. The proof is by contradiction; we assume that Ṅ is a rooted state.
Because of P , the token source is not an input. Therefore by Lem. A.3.4, thestate Ṅ has an operation path from its unique input to the token source. This
operation path contradicts the path P , which is not an operation path, because
each operation edge has only one source and each vertex has at most one incomingedge.
Proof of the point (2). Let P be the path in C˙ to the token source that is not an
operation path.

190

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

˙
If the path P contains no hole edge, it gives a path in the state C[H]to the token
source that is not an operation path. By the point (1), the state is not rooted.
Otherwise, i.e. if the path P contains a hole edge, we give a proof by contradic˙tion; we assume that the state C[H]is rooted. We can take a suffix of the path P ,˙ andso that it gives a path from a target of a hole edge to the token source in C,
moreover, gives a path P 0 from a source of an edge from H to the token source in˙
C[H].
This implies the token source is not an input, and therefore by Lem. A.3.4,
˙
the state C[H]has an operation path from its unique input to the token source.
This operation path must have P 0 has a suffix, meaning P 0 is also an operation
path, because each operation edge has only one source and each vertex has at mostone incoming edge. Moreover, H must have an operation path from an input to an
output, such that the input and the output have type ? and the path ends with thefirst edge of the path P 0 . This contradicts H being one-way.
Proof of the point (3). Let P be the path in C˙ to the token source that is not an
operation path.
˙ G]~ and C[˙ H]~
If the path P contains no hole edge, it gives a path in the states C[
to the token source that is not an operation path. By the point (1), the states are
not rooted.
Otherwise, i.e. if the path P contains a hole edge, we can take a suffix of P that˙ so thatgives a path P 0 from a source of a hole edge e to the token source in C,
the path P 0 does not contain any hole edge. We can assume that the hole edge e islabelled with χ1 , without loss of generality. The path P 0 gives paths PG0 and PH0 to
˙ 1 , G\{G~˙~
the token source, in contexts C[χ1 }] and C[χ1 , H\{H1 }], respectively. The
paths PG0 and PH0 are not an operation path, because they start with the hole edgee labelled with χ1 .
Because C is output-closed, G1 or H1 is one-way. By the point (2), at least one
˙ G]~ and C[˙ H]
~ is not rooted.
of the states C[

A.3. ROOTED STATES

191

Lemma A.3.8. If a rewrite transition Ġ → Ġ0 is stationary, it preserves the rooted
property, i.e. Ġ being rooted implies Ġ0 is also rooted.
Proof. The stationary rewrite transition Ġ → Ġ0 is in the form of C[ ;i H] →C[?;i H 0 ], where C is a focus-free simple context, H is a focus-free one-way hypernet,
H 0 is a focus-free hypernet and i ∈ N. We assume C[ ;i H] is rooted, and prove that∗•
C[?;i H 0 ] is rooted, i.e. ?; C[H 0 ] →C[?;i H 0 ]. By Lem. A.3.5, there exists a numberk ∈ N such that:
k

+

•
•
?; C[H] →C[?;i H] →C[ ;i H].

The rest of the proof is by case analysis on the number k.
• When k = 0, i.e. ?; C[H] = C[?;i H], the unique input and the i-th source of thehole coincide in the simple context C. Therefore, ?; C[H 0 ] = C[?;i H 0 ], whichmeans C[?;i H 0 ] is rooted.
k−1•• When k > 0, there exists a state Ṅ such that ?; C[H] →•Ṅ →C[?;i H].

By the following internal lemma (Lem. A.3.9), there exists a focussed simple
context C˙N , whose token is not entering nor exiting, and we have two searchsequences:k−1•
C˙N [H] →C[?;i H],k−1

C˙N [H 0 ].

•?; C[H] →•?; C[H 0 ] →•The last search transition C˙N [H] →C[?;i H], which yields a search token, must

use the interaction rule (3) or (4). Because the token is not entering nor exitingin the simple context C˙N , either of the two interaction rules acts on the token
and an edge of the context. This means that the same interaction is possible
in the state C˙N [H 0 ], yielding:k−1•?; C[H 0 ] →•C˙N [H 0 ] →C[?;i H 0 ],

192

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

which means C[?;i H 0 ] is rooted.
Lemma A.3.9. For any m ∈ {0, . . . , k − 1} and any state Ṅ such that
m

k−m

•
•
?; C[H] →Ṅ →C[?;i H], the following holds.

(A) If there exists a focussed simple context C˙N such that Ṅ = C˙N [H], thetoken of the context C˙N is not entering.
(B) If there exists a focussed simple context C˙N such that Ṅ = C˙N [H], thetoken of the context C˙N is not exiting.
(C) There exists a focussed simple context C˙N such that Ṅ = C˙N [H], and• m ˙?; C[H 0 ] →CN [H 0 ] holds.

Proof. Firstly, because search transitions do not change an underlying hypernet, if there exists a focussed simple context C˙N such that Ṅ = C˙N [H], |C˙N | = C
necessarily holds.
The point (A) is proved by contradiction; we assume that the context C˙N has
an entering token. This means that there exist a number p ∈ N and a token
label t ∈ {?, X, } such that C˙N = C[t;p H]. By Lem. A.3.5, there exists a
number h such that h ≤ m and:h••?; C[H] →C[?;p H] →k−hC[?;i H].

($)

We derive a contradiction by case analysis on the numbers p and h.
– If p = i and h = 0, the state C[?;i H] must be initial, but it is a result ofa search transition because k − h > 0. This is a contradiction.
– If p = i and h > 0, two different transitions in the search sequence ($)
result in the same state, because of h > 0 and k−h > 0, which contradicts
Lem. A.3.2.

A.3. ROOTED STATES

193– If p 6= i, by Def. 4.3.2, there exists a state Ṅ 0 with a rewrite token such•that C[?;p H] →Ṅ 0 . This contradicts the search sequence ($), becausek − h > 0 and search transitions are deterministic.
The point (B) follows from the contraposition of Lem. A.3.7(2), because H isone-way and Ṅ is rooted. The rooted property of Ṅ follows from the fact thatsearch transitions do not change underlying hypernets.
The point (C) is proved by induction on m ∈ {0, . . . , k − 1}. In the base case,when m = 0, we have ?; C[H] = Ṅ , and therefore the context ?; C can be taken
as C˙N . This means ?; C[H 0 ] = C˙N [H 0 ].
In the inductive case, when m > 0, there exists a state Ṅ 0 such that•?; C[H] →

m−1

k−m

•
•
Ṅ 0 →Ṅ →C[?;i H].

˙ 0 such
By the induction hypothesis, there exists a focussed simple context CN
˙ 0 [H] andthat Ṅ 0 = CNm−1••
˙ 0 [H] →
CN
Ṅ →

m−1

˙ 0 [H 0 ].
CN•?; C[H] →•?; C[H 0 ] →k−m

C[?;i H],Our goal here is to find a focussed simple context C˙N , such that Ṅ = C˙N [H]•
˙ 0 [H 0 ] →and CNC˙N [H 0 ].
•˙ 0 [H] →In the search transition CN
Ṅ , the only change happens to the token

˙ 0 [H]. By the points (A)and its incoming or outgoing edge e in the state CN
˙ 0 , which meansand (B), the token is not entering nor exiting in the context CN
the edge e must be from the context, not from H.
•
˙ 0 [H] →Now that no edge from H is changed in CN
Ṅ , there exists a focussed•
˙ 0 [H 0 ] →simple context C˙N such that Ṅ = C˙N [H], and moreover, CNC˙N [H 0 ].

194

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

A.4

Accessible paths and stable hypernets

A stable hypernet always has at least one edge, and any non-output vertex is labelledwith ?. It has a tree-like shape.
Lemma A.4.1 (Shape of Stable Hypernets).
1. In any stable hypernet, if a vertex v 0 is reachable from another vertex v suchthat v 6= v 0 , there exists a unique path from the vertex v to the vertex v 0 .
2. Any stable hypernet has no cyclic path, i.e. a path from a vertex to itself.
3. Let C : ? ⇒ ⊗m
i=1 `i be a simple context such that: its hole has one source andat least one outgoing edge; and its unique input is the hole’s source. There areno two stable hypernets G and G0 that satisfy G = C[G0 ].
Proof. To prove the point (1), assume there are two different paths from the vertex
v to the vertex v 0 . These paths, i.e. non-empty sequences of edges, have to involve anedge with more than one source, or two different edges that share the same target.
However, neither of these is possible in a stable hypernet, because both a passive
operation edge and an instance edge have only one source and vertices can have at
most one incoming edge. The point (1) follows from this by contradiction.
If a stable hypernet has a cyclic path from a vertex v to itself, there must be
infinitely many paths from the input to the vertex v, depending on how many times
the cycle is included. This contradicts the point (1).
The point (3) is also proved by contradiction. Assume that there exist two stablehypernets G and G0 that satisfy G = C[G0 ] for the simple context C. In the stablehypernet G, a vertex is always labelled with ? if it is not an output. However, in thesimple context C, there exists at least one target of the hole that is not an output

A.4. ACCESSIBLE PATHS AND STABLE HYPERNETS

195

of the context but not labelled with ? either. This contradicts C[G0 ] being a stablehypernet.
A stable hypernet can be found as a part of representation of a value.
Lemma A.4.2. Let ~x be a sequence of k variables and ~a be a sequence of h atoms.
For any derivable type judgement ~x | ~a ` v : ? where v is a value, its representation
can be decomposed as (~x | ~a ` v : ?)† = C[G] using a stable hypernet G : ? ⇒ ⊗m
i=1 `iand a simple context C : ? ⇒ ?⊗k ⊗⊗h whose unique input coincides with a (unique)source of its hole.
Proof. By induction on the definition of value.
When the value v is an atom, in the representation (~x | ~a ` v : ?)† , only an
instance edge can comprise a stable hypernet.
When the value is v ≡ φX (v1 , . . . , vm ; ~s), by induction hypothesis, a stable hypernet Gi can be extracted from (a bottom part of) representation of each eager argument vi . The stable hypernet G that decomposes the representation (~x | ~a ` v : ?)†can be given by all these stable hypernets G1 , . . . , Gm together with the passive
operation edge φX that is introduced in the representation.
When the value is v ≡ bind x → t in v 0 , or v ≡ new a ( t in v 0 , by induction
hypothesis, representation of the value v 0 includes a stable hypernet G0 . The stablehypernet itself decomposes the representation (~x | ~a ` v : ?)† in the required way.
Lemma A.4.3. For any state Ṅ , and its vertex v, such that the vertex v is not atarget of an instance edge or a passive operation edge, if an accessible path from thevertex v is stable or active, then the path has no multiple occurences of a single edge.
Proof. Any stable or active path consists of edges that has only one source. As aconsequence, except for the first edge, no edge appears twice in the stable path. If
the stable path is from the vertex v, its first edge also does not appear twice, because
v is not a target of an instance edge or a passive operation edge.

196

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

Lemma A.4.4. For any state Ṅ , and its vertex v, such that the vertex v is not atarget of an instance edge or a passive operation edge, the following are equivalent.
˙ and a stable hypernet G, such that(A) There exist a focussed simple context C[χ]˙Ṅ = C[G],
where the vertex v of Ṅ corresponds to a unique source of the hole edge
˙in C.
(B) Any accessible path from the vertex v in Ṅ is a stable path.
Proof of (A) ⇒ (B). Because no output of a stable hypernet has type ?, any path˙from the vertex v in C[G]gives a path from the unique input in G. In the stablehypernet G, any path from the unique input is a stable path.
Proof of (B) ⇒ (A). In the state Ṅ , the token target has to be a source of an edge,
which forms an accessible path itself. By Lem. A.4.3, in the state Ṅ , we can takemaximal stable paths from the vertex v, in the sense that appending any edge tothese paths, if possible, does not give a stable path.
If any of these maximal stable paths is to some vertex, the vertex does not havetype ?; this can be confirmed as follows. If the vertex has type ?, it is not an output,
so it is a source of an instance, token, operation or contraction edge. The case of
an instance or passive operation edge contradicts the maximality. The other caseyields a non-stable accessible path that contradicts the assumption (B).
Collecting all edges contained by the maximal stable paths, therefore, gives thedesired hypernet G. These edges are necessarily all shallow, because of the vertex v
˙of Ṅ . The focussed context C[χ],whose hole is shallow, can be made of all the otheredges (at any depth) of the state Ṅ .
Lemma A.4.5. Let Ṅ be a state, where the token is an incoming edge of an operation edge e, whose label φ takes at least one eager arguments. Let k denote thenumber of eager arguments of φ.
For each i ∈ {1, . . . , k}, let sw i (Ṅ ) be a state such that: both states sw i (Ṅ ) andṄ have the same token label and the same underlying hypernet, and the token inA.4. ACCESSIBLE PATHS AND STABLE HYPERNETS

197

sw i (Ṅ ) is the i-th outgoing edge of the operation edge e.
For each i ∈ {1, . . . , k}, the following are equivalent.
(A) In Ṅ , any accessible path from an i-th target of the operation edge e is astable (resp. active) path.
(B) In sw i (Ṅ ), any accessible path from the token target is a stable (resp. active)
path.
Proof. The only difference between Ṅ and sw i (Ṅ ) is the swap of the token withthe operation edge e, and these two edges form an accessible path in the states Ṅ
and sw i (Ṅ ), individually or together (in an appropriate order). Therefore, there is
one-to-one correspondence between accessible paths from an i-th target of the edge
e in Ṅ , and accessible paths from the token target in sw i (Ṅ ).
When (A) is the case, in Ṅ , any accessible paths from an i-th target of theedge e does not contain the token nor the edge e; otherwise there would be anaccessible path that contains the token and hence not stable nor active, which isa contradiction. This means that, in sw i (Ṅ ), any accessible path from the token
target also does not contain the token nor the edge e, and the path must be a stable(resp. active) path.
When (B) is the case, the proof takes the same reasoning in the reverse way.
Lemma A.4.6. Let Ṅ be a rooted state with a search token, such that the token is
not an incoming edge of a contraction edge.
+•
1. Ṅ →
hṄ iX/? , if and only if any accessible path from the token target in Ṅ isa stable path.
+•
2. Ṅ →
hṄ i /? , if and only if any accessible path from the token target in Ṅ isan active path.
∗•
Proof of the forward direction. Let t be either ‘X’ or ‘ ’. The assumption is Ṅ →hṄ it/? . We prove the following, by induction on the length n of this search sequence:

198

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3• any accessible path from the token target in Ṅ is a stable path, when t = X,and• any accessible path from the token target in Ṅ is an active path, when t = .
In the base case, where n = 1, because the token is not an incoming edge of acontraction edge, the token target is a source of an instance edge, or an operationedge labelled with φ ∈ Ot that takes no eager argument. In either situation, theoutgoing edge of the token gives the only possible accessible path from the token
target. The path is stable when t = X, and active when t = .
In the inductive case, where n > 1, the token target is a source of an operationedge eφ labelled with an operation φ ∈ Ot that takes at least one eager argument.
Let k denote the number of eager arguments of φt , and i be an arbitrary numberin {1, . . . , k}. Let sw i (Ṅ ) be the state as defined in Lem. A.4.5. Because Ṅ isrooted, by Lem. A.3.5, the given search sequence gives the following search sequence(proof by induction on k − i):
∗

+

+

+

•
•
•
•
?; |Ṅ | →Ṅ →sw i (Ṅ ) →hsw i (Ṅ )iX/? →hṄ it/? .

+•By induction hypothesis on the intermediate sequence sw i (Ṅ ) →hsw i (Ṅ )iX/? , anyaccessible path from the token target in sw i (Ṅ ) is a stable path. By Lem. A.4.5,
any accessible path from an i-th target of the operation edge eφ in Ṅ is a stablepath.
In Ṅ , any accessible path from the token target is given by the operation edge
eφ followed by an accessible path, which is proved to be stable above, from a targetof eφ . Any accessible path from the token target is therefore stable when t = X, andactive when t = .
Proof of the backward direction. Let t be either ‘X’ or ‘ ’. The assumption is thefollowing:A.4. ACCESSIBLE PATHS AND STABLE HYPERNETS

199• any accessible path from the token target in Ṅ is a stable path, when t = X,and• any accessible path from the token target in Ṅ is an active path, when t = .
∗•Our goal is to show Ṅ →hṄ it/? .

In the state Ṅ , the token target has to be a source of an edge, which forms anaccessible path itself. By Lem. A.4.3, we can define r(Ṅ ) by the maximum length ofstable paths from the token target. This number r(Ṅ ) is well-defined and positive.
∗•
We prove Ṅ →hṄ it/? by induction on r(Ṅ ).

In the base case, where r(Ṅ ) = 1, the outgoing edge of the token is the only
possible accessible path from the token target. The outgoing edge is not a contractionedge by the assumption, and hence it is an instance edge, or an operation edge•
labelled with φ ∈ Ot that takes no eager argument. We have Ṅ →hṄ it/? .

In the inductive case, where r(Ṅ ) > 1, the outgoing edge of the token is anoperation edge eφ labelled with φ ∈ Ot that takes at least one eager argument. Any
accessible path from the token target in Ṅ is given by the edge eφ followed by astable path from a target of eφ .
Let k denote the number of eager arguments of φt , and i be an arbitrary numberin {1, . . . , k}. Let sw i (Ṅ ) be the state as defined in Lem. A.4.5.
By the assumption, any accessible path from an i-th target of the operation edge
eφ in Ṅ is a stable path. Therefore by Lem. A.4.5, in sw i (Ṅ ), any accessible pathfrom the token target is a stable path. Moreover, these paths in Ṅ and sw i (Ṅ )correspond to each other. By Lem. A.4.3, we can define r(sw i (Ṅ )) by the maximum
length of stable paths from the token target. This number r(sw i (Ṅ )) is well-defined,
and satisfies r(sw i (Ṅ )) < r(Ṅ ). By induction hypothesis on this number, we have:∗•sw i (Ṅ ) →hsw i (Ṅ )iX/? .

Combining this search sequence with the following possible search transitions con-

200

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

cludes the proof:•Ṅ →sw 1 (Ṅ ),•hsw i (Ṅ )iX/? →sw i+1 (Ṅ ),(when k 6= 1 and i < k)•hsw k (Ṅ )iX/? →hṄ it/? .

A.5

Parametrised (contextual) refinement andequivalence~0 , χ, χ~00 ] and C2 such that C1 [χ~0 , C2 , χ~00 ]Lemma A.5.1. For any focus-free contexts C1 [χ~0 , C2 , χ~00 ] is also binding-free.
is defined, if both C1 and C2 are binding-free, then C1 [χ~0 , C2 , χ~00 ], and eχ denote the hole edge of C1 labelled with χ.
Proof. Let C denote C1 [χThe proof is by contradiction. We assume that there exists a path P in C, froma source of a contraction, atom, box or hole edge e, to a source of a hole edge e0 .
We derive a contradiction by case analysis on the path P .
• When e0 comes from C1 , and the path P consists of edges from C1 only, thepath P gives a path in C1 that contradicts C1 being binding-free.
• When e0 comes from C1 , and the path P contains an edge from C2 , by finding
the last edge from C2 in P , we can take a suffix of P that gives a path froma target of the hole edge eχ to a source of a hole edge, in C1 . Adding thehole edge eχ at the beginning yields a path in C1 that contradicts C1 being
binding-free.
• When both e and e0 come from C2 , and the path P gives a path in C2 , thiscontradicts C2 being binding-free.

A.5. PARAMETRISED (CONTEXTUAL) REFINEMENT ANDEQUIVALENCE201• When both e and e0 come from C2 , and the path P does not give a single pathin C2 , there exists a path from a source of the hole edge eχ to a source of thehole edge eχ , in C1 . This path contradicts C1 being binding-free.
• When e comes from C1 and e0 comes from C2 , by finding the first edge from C2 in
P , we can take a prefix of P that gives a path from a source of a contraction,
atom, box or hole edge to a source of the hole edge eχ , in C1 . This pathcontradicts C1 being binding-free.

Lemma A.5.2. For any set C of contexts that is closed under plugging, and any
preorder Q on natural numbers, the following holds.
˙ Q and CQ are reflexive.
• ˙ Q and CQ are transitive.
• 
˙ Q and 'CQ are equivalences.
• '˙ Q and CQ , re˙ Q and 'CQ are defined as a symmetric subset of 
Proof. Because '˙ Q and CQ are preorders.
˙ Q and 'CQ are equivalences if 
spectively, '˙ Q is a direct consequence of those of the preorder
Reflexivity and transitivity of Q.
For any focus-free hypernet H, and any focus-free context C[χ] ∈ C such that˙ Q ?; C[H] because of reflexivity of ˙ Q.
?; C[H] is a state, ?; C[H] For any focus-free hypernets H1 , H2 and H3 , and any focus-free context C[χ] ∈ C,
such that H1 CQ H2 , H2 CQ H3 , and both ?; C[H1 ] and ?; C[H3 ] are states, our goal is˙ Q ?; C[H3 ]. Because H1 CQ H2 and H2 CQ H3 , all three hypernets
to show ?; C[H1 ] 
H1 , H2 and H3 have the same type, and hence ?; C[H2 ] is also a state. Therefore,˙ Q ?; C[H2 ] and ?; C[H2 ] ˙ Q ?; C[H3 ], and the transitivity of ˙Q
we have ?; C[H1 ] ˙ Q ?; C[H3 ].
implies ?; C[H1 ] 202

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

Lemma A.5.3. For any set C of contexts that is closed under plugging, and any
preorder Q on natural numbers, the following holds.
1. For any hypernets H1 and H2 , H1 'CQ∩Q−1 H2 implies H1 'CQ H2 .
2. If all compute transitions are deterministic, for any hypernets H1 and H2 ,H1 'CQ H2 implies H1 'CQ∩Q−1 H2 .
Proof. Because (Q ∩ Q−1 ) ⊆ Q, the point (1) follows from the monotonicity ofcontextual equivalence.
For the point (2), H1 'CQ H2 means that any focus-free context C[χ] ∈ C, such
˙ Q ?; C[H2 ] and ?; C[H2 ] ˙Qthat ?; C[H1 ] and ?; C[H2 ] are states, yields ?; C[H1 ] ?; C[H1 ]. If the state ?; C[H1 ] terminates at a final state after k1 transitions, there
exists k2 such that k1 Q k2 and the state ?; C[H2 ] terminates at a final state after
k2 transitions. Moreover, there exists k3 such that k2 Q k3 and the state ?; C[H1 ]terminates at a final state after k3 transitions.
Because search transitions and copy transitions are deterministic, if all computetransitions are deterministic, states and transitions comprise a deterministic abstract
rewriting system, in which final states are normal forms. By Lem. A.3.1, k1 = k3
˙ Q∩Q−1 ?; C[H2 ]. Similarly, wemust hold. This means k1 Q ∩ Q−1 k2 , and ?; C[H1 ] ˙ Q∩Q−1 ?; C[H1 ], and hence H1 'C −1 H2 .
can infer ?; C[H2 ] 
Q∩Q

A.6

Proof for Sec. 4.3.3

Lemma A.6.1. Let C be a set of contexts, and Q0 be a binary relation on N suchthat, for any k0 , k1 , k2 ∈ N, (k0 + k1 ) Q0 (k0 + k2 ) implies k1 Q0 k2 . Let C be a
pre-template that is a trigger and implies contextual refinement CQ0 . For any single
˙
C-specimen (C[χ];H 1 ; H 2 ) of C, the following holds.
• k ˙
• k ˙
˙ 1] →
˙ 2] →
1. For any k ∈ N, ?; |C|[HC[H 1 ] if and only if ?; |C|[HC[H 2 ].

A.6. PROOF FOR SEC. 4.3.3

203

˙ 1 ] and C[H˙ 2]
2. If compute transitions are all deterministic, and one of states C[H˙ 1] 
˙ 2 ].
˙ Q0 C[His rooted, then the other state is also rooted, and moreover, C[HProof of the point (1). Let (p, q) be an arbitrary element of a set {(1, 2), (2, 1)}. We
• k ˙
• k ˙
˙ p] →
˙ q] →
prove that, for any k ∈ N, ?; |C|[HC[H p ] implies ?; |C|[HC[H q ]. The

proof is by case analysis on the number k.
˙ p ] is initial, and by Lem. 4.4.5(1), C[H˙ q ] is also initial. Note
• When k = 0, C[Hthat C is a trigger and hence output-closed.
• k ˙˙ q] →• When k > 0, by the following internal lemma, ?; |C|[HC[H q ] follows from• k ˙
˙ p] →?; |C|[HC[H p ].

Lemma A.6.2. For any m ∈ {0, . . . , k}, there exists a focussed context Ċ 0 [χ]˙ and the following holds:
such that |Ċ 0 | = |C|• m 0• k−m ˙˙ p] →?; |C|[HĊ [H p ] →C[H p ],• m 0
˙ q] →?; |C|[HĊ [H q ].

˙Proof. By induction on m. In the base case, when m = 0, we can take ?; |C|as Ċ 0 .
In the inductive case, when m > 0, by induction hypothesis, there exists a
˙ and the following holds:
focussed context Ċ 0 [χ] such that |Ċ 0 | = |C|• m−1 0• k−m+1 ˙
˙ p] →?; |C|[HĊ [H p ] →C[H p ],
• m−1 0˙ q] →Ċ [H q ].
?; |C|[H˙ ∈ C, (Ċ 0 ; H 1 ; H 2 ) is a single C-specimen of C, which yields
Because |Ċ 0 | = |C|rooted states. Because k − m + 1 > 0, Ċ 0 cannot have a rewrite token. The
rest of the proof is by case analysis on the token of Ċ 0 .

204

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3– When Ċ 0 has an entering search token, because C is a trigger, Ċ 0 [H r ] →hĊ 0 [H r ]i /? for each r ∈ {p, q}. Because hĊ 0 [H r ]i /? = hĊ 0 i /? [H r ], andsearch transitions are deterministic, we have the following:•
˙ p] →?; |C|[H

m−1

k−m

•
•
Ċ 0 [H p ] →hĊ 0 i /? [H p ] →˙ p ],
C[H• m−1 0•˙ q] →?; |C|[HĊ [H q ] →hĊ 0 i /? [H q ].

˙
We also have |hĊ 0 i /? | = |Ċ 0 | = |C|.
– When Ċ 0 has a value token, or a non-entering search token, because C is
output-closed, by Lem. 4.4.5(3), there exists a focussed context C˙00 suchthat |C˙00 | = |Ċ 0 | and Ċ 0 [H r ] → C˙00 [H r ] for each r ∈ {p, q}. The transitionĊ 0 [H r ] → C˙00 [H r ], for each r ∈ {p, q}, is a search transition, and by thedeterminism of search transitions, we have the following:• m−1 0•• k−m ˙˙ p] →?; |C|[HĊ [H p ] →C˙00 [H p ] →C[H p ],
• m−1 0•˙ q] →?; |C|[HĊ [H q ] →C˙00 [H q ].

˙ 1 ] and C[H˙ 2 ] is rooted, by the point (1),Proof of the point (2). If one of states C[H• k˙ r] →
the other state is also rooted, and moreover, there exists k ∈ N such that ?; |C|[H˙ r ] for each r ∈ {1, 2}.
C[HOur goal is to prove that, for any k1 ∈ N and any final state Ṅ1 such that˙ 1 ] →k1 Ṅ1 , there exist k2 ∈ N and a final state Ṅ2 such that k1 Q0 k2 andC[HA.6. PROOF FOR SEC. 4.3.3

205

˙ 2 ] →k2 Ṅ2 . Assuming C[H˙ 1 ] →k1 Ṅ1 , we have the following:
C[H
• k ˙
˙ 1] →?; |C|[HC[H 1 ] →k1 Ṅ1 ,• k ˙
˙ 2] →?; |C|[HC[H 2 ].

˙ ∈ C, we have state refineBecause C implies contextual refinement CQ0 , and |C|˙ 1] 
˙ 2 ]. Therefore, there exist l2 ∈ N and a final state Ṅ2 such
˙ Q0 ?; |C|[H
ment ?; |C|[H˙ 2 ] →l2 Ṅ2 .
that (k + k1 ) Q0 l2 and ?; |C|[H
The assumption that compute transitions are all deterministic implies that alltransitions, including intrinsic ones, are deterministic. Following from this are l2 ≥ k
and the following:• k ˙
˙ 1] →?; |C|[HC[H 1 ] →k1 Ṅ1 ,• k ˙
˙ 2] →?; |C|[HC[H 2 ] →l2 −k Ṅ2 .

By the assumption on Q0 , (k + k1 ) Q0 l2 implies k1 Q0 (l2 − k).

206

APPENDIX A. TECHNICAL APPENDIX FOR CHAP. 3

Bibliography
S. Abramsky. The lazy lambda-calculus, page 65–117. Addison Wesley, 1990. ISBN
0-201-17236-4. (pages 6 and 8).
S. Abramsky and G. McCusker. Call-by-value games. In CSL 1997, volume 1414
of Lect. Notes Comp. Sci., pages 1–17. Springer, 1998. doi: 10.1007/BFb0028004.
(pages 8 and 9).
S. Abramsky, K. Honda, and G. McCusker. A fully abstract game semantics forgeneral references. In LICS 1998, pages 334–344. IEEE Computer Society, 1998.
doi: 10.1109/LICS.1998.705669. (pages 8 and 9).
S. Abramsky, R. Jagadeesan, and P. Malacaria. Full abstraction for PCF. Inf.
Comput., 163(2):409–470, 2000. doi: 10.1006/inco.2000.2930. (pages 6 and 8).
B. Accattoli. The complexity of abstract machines. In WPTE 2016, volume 235
of EPTCS, pages 1–15, 2017. doi: 10.4204/EPTCS.235.1. (pages 4, 11, 20, 47,
and 51).
B. Accattoli and B. Barras. Environments and the complexity of abstract machines. In PPDP 2017, pages 4–16. ACM, 2017. doi: 10.1145/3131851.3131855.
(page 171).
B. Accattoli and U. Dal Lago. (Leftmost-outermost) beta reduction is invariant,indeed. Logical Methods in Comp. Sci., 12(1), 2016. doi: 10.2168/LMCS-12(1:4)2016. (page 4).
207

208

BIBLIOGRAPHY

B. Accattoli and S. Guerrini. Jumping boxes. In CSL 2009, volume 5771 of Lect.
Notes Comp. Sci., pages 55–70. Springer, 2009. doi: 10.1007/978-3-642-04027-6 7.
(pages 28 and 173).
B. Accattoli and D. Kesner. The structural lambda-calculus. In CSL 2010, volume6247 of Lect. Notes Comp. Sci., pages 381–395. Springer, 2010. doi: 10.1007/
978-3-642-15205-4\ 30. (pages 21 and 52).
B. Accattoli and C. Sacerdoti Coen. On the value of variables. In WoLLIC 2014,
volume 8652 of Lect. Notes Comp. Sci., pages 36–50. Springer, 2014. doi: 10.
1007/978-3-662-44145-9 3. (pages 47 and 52).
B. Accattoli, P. Barenbaum, and D. Mazza. Distilling abstract machines. In ICFP
2014, pages 363–376. ACM, 2014. doi: 10.1145/2628136.2628154. (pages 4, 20,
47, and 52).
A. Ahmed. Step-indexed syntactic logical relations for recursive and quantified types.
In ESOP 2006, volume 3924 of Lect. Notes Comp. Sci., pages 69–83. Springer,
2006. doi: 10.1007/11693024\ 6. (page 8).
A. Ahmed, D. Dreyer, and A. Rossberg. State-dependent representation independence. In POPL 2009, pages 340–353. ACM, 2009. doi: 10.1145/1480881.1480925.
(pages 8 and 90).
A. W. Appel and D. A. McAllester. An indexed model of recursive types for foundational proof-carrying code. ACM Trans. Program. Lang. Syst., 23(5):657–683,
2001. doi: 10.1145/504709.504712. (page 8).
F. Bonchi, F. Gadducci, A. Kissinger, P. Soboci’nski, and F. Zanasi. Rewriting
modulo symmetric monoidal structure. In LICS 2016, pages 710–719. ACM, 2016.
doi: 10.1145/2933575.2935316. (page 174).

BIBLIOGRAPHY

209

F. Bonchi, D. Petrisan, D. Pous, and J. Rot. A general account of coinduction up-to.
Acta Inf., 54(2):127–190, 2017. doi: 10.1007/s00236-016-0271-4. (page 117).
S. W. T. Cheung, V. Darvariu, D. R. Ghica, K. Muroya, and R. N. S. Rowe. A
functional perspective on machine learning via programmable induction and abduction. In FLOPS 2018, volume 10818 of Lect. Notes Comp. Sci., pages 84–98.
Springer, 2018. doi: 10.1007/978-3-319-90686-7\ 6. (pages 18, 163, and 165).
B. Coecke and R. Duncan. Interacting quantum observables: categorical algebra
and diagrammatics. New Journal of Physics, 13(4):043016, 2011. doi: 10.1088/
1367-2630/13/4/043016. (page 93).
P. Crégut. Strongly reducing variants of the Krivine abstract machine. Higher-Orderand Symbolic Computation, 20(3):209–230, 2007. doi: 10.1007/s10990-007-9015-z.
(page 172).
U. Dal Lago and M. Gaboardi. Linear dependent types and relative completeness.
In LICS 2011, pages 133–142. IEEE Computer Society, 2011. doi: 10.1109/LICS.
2011.22. (page 12).
U. Dal Lago and B. Petit. Linear dependent types in a call-by-value scenario.
In PPDP 2012, pages 115–126. ACM, 2012.

doi: 10.1145/2370776.2370792.

(page 12).
U. Dal Lago and U. Schöpp. Computation by interaction for space-bounded functional programming. Inf. Comput., 248:150–194, 2016. doi: 10.1016/j.ic.2015.04.
006. (page 12).
U. Dal Lago, C. Faggian, B. Valiron, and A. Yoshimizu. Parallelism and synchronization in an infinitary context. In LICS 2015, pages 559–572. IEEE Computer
Society, 2015. doi: 10.1109/LICS.2015.58. (page 60).

210

BIBLIOGRAPHY

U. Dal Lago, C. Faggian, B. Valiron, and A. Yoshimizu. The geometry of parallelism:
classical, probabilistic, and quantum effects. In POPL 2017, pages 833–845. ACM,
2017. doi: 10.1145/3009837. (pages 60 and 175).
V. Danos and L. Regnier. Reversible, irreversible and optimal lambda-machines.
Elect. Notes in Theor. Comp. Sci., 3:40–60, 1996. doi: 10.1016/S1571-0661(05)80402-5. (pages xi, 12, 58, 59, 61, and 62).
O. Danvy and A. Filinski. Abstracting control. In LISP and Functional Programming, pages 151–160, 1990. doi: 10.1145/91556.91622. (page 72).
O. Danvy and I. Zerny. A synthetic operational account of call-by-need evaluation. In
PPDP 2013, pages 97–108. ACM, 2013. doi: 10.1145/2505879.2505898. (pages 20,
50, and 172).
O. Danvy, K. Millikin, J. Munk, and I. Zerny. On inter-deriving small-step and bigstep semantics: a case study for storeless call-by-need evaluation. Theor. Comp.
Sci., 435:21–42, 2012. doi: 10.1016/j.tcs.2012.02.023. (pages 21 and 106).
F. Drewes, B. Hoffmann, and D. Plump. Hierarchical graph transformation. J.
Comput. Syst. Sci., 64(2):249–283, 2002. doi: 10.1006/jcss.2001.1790. (page 174).
D. Dreyer, G. Neis, and L. Birkedal. The impact of higher-order state and control
effects on local relational reasoning. J. Funct. Program., 22(4-5):477–528, 2012.
doi: 10.1017/S095679681200024X. (pages 8 and 9).
M. Felleisen and R. Hieb.

The revised report on the syntactic theories of se-quential control and state.

Theor. Comp. Sci., 103(2):235–271, 1992.

doi:

10.1016/0304-3975(92)90014-7. (page 81).
M. Fernández and I. Mackie. Call-by-value lambda-graph rewriting without rewriting. In ICGT 2002, volume 2505 of LNCS, pages 75–89. Springer, 2002. doi:
10.1007/3-540-45832-8 8. (pages 60, 61, and 172).

BIBLIOGRAPHY

211

M. Fernández and N. Siafakas. New developments in environment machines. Elect.
Notes in Theor. Comp. Sci., 237:57–73, 2009. doi: 10.1016/j.entcs.2009.03.035.
(page 172).
M. Fernández, I. Mackie, and F. Sinot. Closed reduction: explicit substitutions
without alpha-conversion. Math. Struct. in Comp. Sci., 15(2):343–381, 2005. doi:
10.1017/S0960129504004633. (page 172).
D. R. Ghica. Slot games: a quantitative model of computation. In POPL 2005,
pages 85–97. ACM, 2005. doi: 10.1145/1040305.1040313. (page 10).
D. R. Ghica. Geometry of synthesis: a structured approach to VLSI design. In POPL
2007, pages 363–375. ACM, 2007. doi: 10.1145/1190216.1190269. (page 12).
D. R. Ghica and A. I. Smith. Geometry of synthesis III: resource management
through type inference. In POPL 2011, pages 345–356. ACM, 2011. doi: 10.1145/
1926385.1926425. (page 12).
D. R. Ghica, A. I. Smith, and S. Singh. Geometry of synthesis IV: compiling affine
recursion into static hardware. In ICFP 2011, pages 221–233. ACM, 2011. doi:
10.1145/2034773.2034805. (page 12).
J.-Y. Girard. Linear logic. Theor. Comp. Sci., 50:1–102, 1987. doi: 10.1016/
0304-3975(87)90045-4. (pages 25, 27, 159, 160, and 173).
J.-Y. Girard. Geometry of Interaction I: interpretation of system F. In Logic Colloquium 1988, volume 127 of Studies in Logic & Found. Math., pages 221–260.
Elsevier, 1989. doi: 10.1016/S0049-237X(08)70271-4. (page 11).
G. Gonthier, M. Abadi, and J. Lévy. The geometry of optimal lambda reduction.
In POPL 1992, pages 15–26. ACM Press, 1992. doi: 10.1145/143165.143172.
(page 177).

212

BIBLIOGRAPHY

J. Hackett and G. Hutton. Worker/wrapper/makes it/faster. In ICFP 2014, pages
95–107. ACM, 2014. doi: 10.1145/2628136.2628142. (page 10).
J. Hackett and G. Hutton. Parametric polymorphism and operational improvement.
PACMPL, 2(ICFP):68:1–68:24, 2018. doi: 10.1145/3236763. (page 10).
N. Hoshino, K. Muroya, and I. Hasuo. Memoryful Geometry of Interaction: from
coalgebraic components to algebraic effects. In CSL-LICS 2014, pages 52:1–52:10.
ACM, 2014. doi: 10.1145/2603088.2603124. (page 60).
J. M. E. Hyland and C. L. Ong. On full abstraction for PCF: I, II, and III. Inf.
Comput., 163(2):285–408, 2000. doi: 10.1006/inco.2000.2917. (pages 6 and 8).
P. Johann, A. Simpson, and J. Voigtländer. A generic operational metatheory foralgebraic effects. In LICS 2010, pages 209–218. IEEE Computer Society, 2010.
doi: 10.1109/LICS.2010.29. (page 176).
A. Kissinger. Pictures of processes: automated graph rewriting for monoidal categories and applications to quantum computing. PhD thesis, University of Oxford,
2012. arXiv preprint arXiv:1203.0202. (pages 26, 35, and 174).
V. Koutavas and M. Wand. Small bisimulations for reasoning about higher-orderimperative programs. In POPL 2006, pages 141–152. ACM, 2006. doi: 10.1145/
1111037.1111050. (page 8).
V. Koutavas, P. Levy, and E. Sumii. From applicative to environmental bisimulation.
Elect. Notes in Theor. Comp. Sci., 276:215–235, 2011. doi: 10.1016/j.entcs.2011.
09.023. (page 9).
J. Krivine. A call-by-name lambda-calculus machine. Higher-Order and Symbolic
Computation, 20(3):199–207, 2007. doi: 10.1007/s10990-007-9018-9. (page 61).
Y. Lafont. Interaction nets. In POPL 1990, pages 95–108. ACM Press, 1990. doi:
10.1145/96709.96718. (page 173).

BIBLIOGRAPHY

213

Y. Lafont. From proof nets to interaction nets, page 225–248. London MathematicalSociety Lecture Note Series. Cambridge University Press, 1995. doi: 10.1017/
CBO9780511629150.012. (page 173).
J. Laird. Full abstraction for functional languages with control. In LICS 1997, pages
58–67. IEEE Computer Society, 1997. doi: 10.1109/LICS.1997.614931. (pages 8
and 9).
J. Lamping. An algorithm for optimal lambda calculus reduction. In POPL 1990,
pages 16–30. ACM Press, 1990. doi: 10.1145/96709.96711. (page 177).
P. Landin. The mechanical evaluation of expressions. The Comp. Journ., 6(4):308–320, 1964. doi: 10.1093/comjnl/6.4.308. (pages 2, 172, and 178).
J. Lévy. Optimal reductions in the lambda-calculus, pages 159–191. Academic Press,
1980. ISBN 0123490502. (page 177).
I. Mackie. The Geometry of Interaction machine. In POPL 1995, pages 198–208.
ACM, 1995. doi: 10.1145/199448.199483. (pages xi, 12, 58, and 59).
I. Mackie. Linear logic With boxes. In LICS 1998, pages 309–320. IEEE Computer
Society, 1998. doi: 10.1109/LICS.1998.705667. (page 173).
J. Maraist, M. Odersky, D. N. Turner, and P. Wadler. Call-by-name, call-by-value,call-by-need and the linear lambda calculus. Theor. Comp. Sci., 228(1-2):175–210,
1999. doi: 10.1016/S0304-3975(98)00358-2. (pages 39 and 159).
P. Melliès. Functorial boxes in string diagrams. In CSL 2006, volume 4207 of Lect.
Notes Comp. Sci., pages 1–30. Springer, 2006. doi: 10.1007/11874683 1. (pages 28
and 174).
R. Milner. Communicating and mobile systems: the pi-calculus. Cambridge University Press, 1999. ISBN 978-0-521-65869-0. (page 117).

214

BIBLIOGRAPHY

E. Moggi. Computational lambda-calculus and monads. Technical Report ECSLFCS-88-66, University of Edinburgh, 1988. (page 175).
A. Moran and D. Sands. Improvement in a lazy context: an operational theory
for call-by-need. In POPL 1999, pages 43–56. ACM, 1999. doi: 10.1145/292540.
292547. (pages 6 and 177).
J. H. Morris Jr. Lambda-calculus models of programming languages. PhD thesis,
Massachusetts Institute of Technology, 1969. (page 5).
K. Muroya and D. R. Ghica. The dynamic Geometry of Interaction machine: acall-by-need graph rewriter. In CSL 2017, volume 82 of LIPIcs, pages 32:1–32:15,
2017. doi: 10.4230/LIPIcs.CSL.2017.32. (pages 17 and 25).
K. Muroya and D. R. Ghica. Efficient implementation of evaluation strategies via
token-guided graph rewriting. In WPTE 2017, volume 265 of EPTCS, pages
52–66, 2018a. doi: 10.4204/EPTCS.265.5. (page 17).
K. Muroya and D. R. Ghica. The dynamic Geometry of Interaction machine: atoken-guided graph rewriter. arXiv preprint arXiv:1803.00427, 2018b. (page 17).
K. Muroya, N. Hoshino, and I. Hasuo. Memoryful Geometry of Interaction II:
recursion and adequacy. In POPL 2016, pages 748–760. ACM, 2016. doi: 10.
1145/2837614.2837672. (page 60).
K. Muroya, S. W. T. Cheung, and D. R. Ghica. The geometry of computation-graphabstraction. In LICS 2018, pages 749–758. ACM, 2018. doi: 10.1145/3209108.
3209127. (pages 18, 163, and 165).
F. Nielson and H. R. Nielson. Type and effect systems. In Correct System Design,
Recent Insight and Advances, volume 1710 of Lect. Notes Comp. Sci., pages 114–
136. Springer, 1999. doi: 10.1007/3-540-48092-7\ 6. (page 178).

BIBLIOGRAPHY

215

P. O’Hearn and R. Tennent, editors. Algol-like languages. Progress in theoreticalcomputer science. Birkhauser, 1997. doi: 10.1007/978-1-4612-4118-8. (page 90).
C. Okasaki, P. Lee, and D. Tarditi. Call-by-need and continuation-passing style.
Lisp and Symbolic Computation, 7(1):57–82, 1994. doi: 10.1007/BF01019945.
(page 73).
A. M. Pitts and I. D. B. Stark. Observable properties of higher order functions
that dynamically create local names, or what’s new?

In MFCS 1993, volume

711 of Lect. Notes Comp. Sci., pages 122–141. Springer, 1993. doi: 10.1007/
3-540-57182-5\ 8. (page 90).
G. D. Plotkin. Lambda-definability and logical relations. Memorandum SAI-RM-4,
1973. (pages 6 and 8).
G. D. Plotkin. LCF considered as a programming language. Theor. Comp. Sci., 5(3):223–255, 1977. doi: 10.1016/0304-3975(77)90044-5. (page 7).
G. D. Plotkin. A structural approach to operational semantics. DAIMI FN-19, 1981.
(page 3).
G. D. Plotkin. The origins of structural operational semantics. J. Log. Algebr.
Program., 60-61:3–15, 2004. doi: 10.1016/j.jlap.2004.03.009. (page 3).
G. D. Plotkin and J. Power. Adequacy for algebraic effects. In FoSSaCS 2001,
volume 2030 of Lect. Notes Comp. Sci., pages 1–24. Springer, 2001. doi: 10.1007/
3-540-45315-6\ 1. (page 174).
G. D. Plotkin and J. Power. Algebraic operations and generic effects. Appl. Categorical Struct., 11(1):69–94, 2003. doi: 10.1023/A:1023064908962. (pages 71
and 174).
G. D. Plotkin and M. Pretnar. Handling algebraic effects. Logical Methods in Comp.
Sci., 9(4), 2013. doi: 10.2168/LMCS-9(4:23)2013. (page 71).

216

BIBLIOGRAPHY

G. Rozenberg, editor. Handbook of graph grammars and computing by graph transformations, volume 1: foundations. World Scientific, 1997. ISBN 9810228848.
(page 174).
D. Sangiorgi, N. Kobayashi, and E. Sumii. Environmental bisimulations for higherorder languages. In LICS 2007, pages 293–302. IEEE Computer Society, 2007.
doi: 10.1109/LICS.2007.17. (page 8).
M. Schmidt-Schauß and D. Sabel. Improvements in a call-by-need functional corelanguage: common subexpression elimination and resource preserving translations. Sci. Comput. Program., 147:3–26, 2017. doi: 10.1016/j.scico.2017.01.001.
(page 10).
U. Schöpp. Computation-by-interaction with effects. In APLAS 2011, volume7078 of Lect. Notes Comp. Sci., pages 305–321. Springer, 2011. doi: 10.1007/
978-3-642-25318-8\ 23. (page 60).
U. Schöpp. Organising low-level programs using higher types. In PPDP 2014, pages
199–210. ACM, 2014a. doi: 10.1145/2643135.2643151. (page 12).
U. Schöpp. Call-by-value in a basic logic for interaction. In APLAS 2014, volume8858 of Lect. Notes Comp. Sci., pages 428–448. Springer, 2014b. doi: 10.1007/
978-3-319-12736-1 23. (page 60).
P. Sestoft. Deriving a lazy abstract machine. J. Funct. Program., 7(3):231–264,
1997. doi: 10.1017/S0956796897002712. (page 172).
F. Sinot. Call-by-name and call-by-value as token-passing interaction nets. In TLCA
2005, volume 3461 of Lect. Notes Comp. Sci., pages 386–400. Springer, 2005. doi:
10.1007/11417170 28. (pages 19, 21, 173, and 177).
F. Sinot. Call-by-need in token-passing nets. Math. Struct. in Comp. Sci., 16(4):639–666, 2006. doi: 10.1017/S0960129506005408. (pages 19, 21, and 173).

BIBLIOGRAPHY

217

R. Statman. Logical relations and the typed lambda-calculus. Information andControl, 65(2/3):85–97, 1985. doi: 10.1016/S0019-9958(85)80001-2. (pages 6
and 8).
E. Sumii and B. C. Pierce. A bisimulation for type abstraction and recursion. J.
ACM, 54(5):26, 2007. doi: 10.1145/1284320.1284325. (page 8).
A. K. Wright and M. Felleisen. A syntactic approach to type soundness. Inf. Comput., 115(1):38–94, 1994. doi: 10.1006/inco.1994.1093. (page 81).
T. Yachi and E. Sumii. A sound and complete bisimulation for contextual equivalencein lambda-calculus with call/cc. In APLAS 2016, volume 10017 of Lect. Notes
Comp. Sci., pages 171–186, 2016. doi: 10.1007/978-3-319-47958-3\ 10. (page 9).

218

BIBLIOGRAPHY

Indexaccessible path, 115

binary –, 79

active operation, 68

generalised –, 27

active path, 115

contraction rule, 96

arity, 72

copy transition, 97

atom, 68

copyable hypernet, 93

basic rule, 22

deep edge, 77

behaviour, 97deferred argument, 68

binding-free context, 102, 103

distributor, 79, 92

box hypernet, 93
eager argument, 68
box structureedge!-box, 28
box –, 77
box edge, 77
deep –, 77
compute transition, 97

shallow –, 77

context, 95

enriched term, 21

binding-free –, 102, 103

entering token, 95

simple –, 95

equivalencecontextual equivalence, 101contextual –, 101contextual refinement, 101

state –, 101

contraction

evaluation, 23– tree, 92

execution, 30, 96
219

220

INDEX

exiting token, 96

name, see atom

extrinsic transition, 96

node

final state, 30, 96
focus-free hypernet, 94
focussed hypernet, 94

link –, 25
proper –, 25
non-generative term, 85
one-way hypernet, 93

generative term, 85
operation
hypergraph, 75

active –, 68

hypernet, 77

passive –, 68

box –, 93

operation path, 92

copyable –, 93

output, 25, 76

focus-free –, 94

output-closure, 110

focussed –, 94
pass transition, 30
one-way –, 93
passive operation, 68
stable –, 93
path
underlying –, 94
accessible –, 115
initial state, 30, 96

active –, 115

input, 25, 76

operation –, 92

input-safety, 109

stable –, 115

instance, 79

pre-template, 106

interaction rule, 96

proper node, 25interface, 26, 76

pure term, 23–permutation, 76
quasi-specimen, 107
intrinsic transition, 96
reasonable triple, 113
jumping, 61

refinement

lazy argument, see deferred argument

contextual –, 101

link node, 25

state –, 101

INDEX

221

refocusing machine, 105state refinement, 101

rewrite rule, 97

stationary rewrite transition, 105rewrite transition, 30, 97

stuck state, 96

robustness, 111
root, 26
rooted state, 105
ruletemplate, 110
pre- –, 106
termenriched –, 21

basic –, 22
contraction –, 96interaction –, 96
rewrite –, 97

generative –, 85
non-generative –, 85
pure –, 23
token
entering –, 95

search transition, 96
exiting –, 96
shallow edge, 77
simple context, 95
simulation, 42, 117
specimen, 107
quasi- –, 107
stable hypernet, 93
stable path, 115
state
–, 96
final –, 30, 96
graph –, 28transition
compute –, 97
copy –, 97
extrinsic –, 96
intrinsic –, 96
pass –, 30
rewrite –, 30, 97
search –, 96
stationary rewrite –, 105translation, 38, 79
trigger, 116

initial –, 30, 96
rooted –, 105

underlying hypernet, 94

stuck –, 96

weakening, 79

state equivalence, 101

window, 21