Hyper-Lambda Calculi(ハイパーラムダ計算)
byYoichi Hirai
平井洋一

A Doctoral Thesis

Submitted to
the Graduate School of Information Science and Technology,
the University of Tokyoon December 13, 2012
in Partial Fulfillment of the Requirements
for the Degree of Doctor of Information Science andTechnology
in Computer Science
Thesis Supervisor: Masami Hagiya 萩谷昌己
Professor of Computer ScienceABSTRACT
We propose hyper-lambda calculi, the typed lambda calculi based on hypersequent calculi. A hyper-lambda term is a finite sequence of lambda terms, which represent concurrent
processes. We give three concrete hyper-lambda calculi: one synchronous and the other two
asynchronous. All employ a pair of communication primitives exchanging their inputs. In
the synchronous case, both sides succeed. In the asynchronous cases, at least one side obtains
the other side’s input. The synchronous calculus implements message-passing communicationand session types; the asynchronous calculus characterizes shared-memory waitfree communication. Among processes of a typed hyper-lambda term, all succeed in the synchronouscase while at least one succeeds in the asynchronous case. Logically, the processes are interpreted conjunctively in the synchronous case but disjunctively in the asynchronous case. The
synchronous calculus is based on Abelian logic: (φ ⊸ ψ) ⊗ (ψ ⊸ φ) on top of multiplicative
additive fragment of intuitionistic linear logic (without some units); one of the asynchronous
calculi is based on Gödel-Dummett logic: (φ ⊃ ψ) ∨ (ψ ⊃ φ) on top of intuitionistic logic.
The hyper-lambda calculi are in Curry-Howard correspondence with the deduction systems
for these logics. We also give a similar development for monoidal t-norm logic and implement
the Gödel-Dummett case using Haskell.

ハイパーラムダ計算すなわちハイパー推件計算に基づく型付きラムダ計算を提案する．ハイパー
ラムダ項はラムダ項の有限列で，並列プロセスを表す．同期と非同期と二つのハイパーラムダ計算を与える．両者ともに，互いに入力を交換する通信子の対を用いる．同期ハイパーラムダ計算では，通信子双方が成功する．非同期ハイパーラムダ計算では，通信子の少なくとも片方がもう片方の入力を獲得する．同期ハイパーラムダ計算はメッセージパッシング通信とセッション型を実装し，非同期ハイパーラムダ計算は共有メモリの無待機計算を特徴づける．型付きハイパーラムダ項のプロセスどものうち，同期ハイパーラムダ計算では全てが成功するが，非同期ハイパーラムダ計算
では少なくとも一つが成功する．論理的にプロセスどもは，同期ハイパーラムダ計算では連言で，非同期ハイパーラムダ計算では選言で解釈される．同期ハイパーラムダ計算はアーベル論理に基づ
く: 直観主義線形論理の乗法的加法的断片 (除いくつかの単位論理式) に公理 (φ ⊸ ψ) ⊗ (ψ ⊸ φ)を加えた論理である．非同期ハイパーラムダ計算はゲーデル・ダメット論理に基づく: 直観主義論
理に公理 (φ ⊃ ψ) ∨ (ψ ⊃ φ) を加えた論理である．これらのハイパーラムダ計算は，それぞれの論理の演繹体系とカリー・ハワード対応にある．Monoidal t-norm 論理に基づく変種と，Haskell
を用いた実装も扱う．

Acknowledgements

The author thanks my adviser Masami Hagiya for his patience and some decisivecomments at important moments. Even before composing this thesis, the author became indebted to many of the juries and their colleagues. In an MLG (mathematical
logic group) meeting, Hiroakira Ono asked the author about the constructive content
of Dummett axiom; an attempt to answer that question eventually became Chapter 3.
Naoki Kobayashi’s request for a stronger communication primitive resulted in Chapter 2. Ichiro Hasuo gave the author some chances of talks and indispensable advice on
visiting the Netherlands and studying there. During the defense procedure, the author
merited from interests and advice from Shinichi Honiden and Andrzej Murawski aswell as from other juries.
The work about hyper-lambda calculus is encouraged by feedbacks from ACAN (Algebraic and Coalgebraic Approaches to Non-Classical Logics Workshop) and OPLSS’11
participants, Pisa Proof Theory Workshop, FLOPS-2012 and numerous other occasions.
Grant-in-Aid for JSPS Fellows 23-6978 supported my second and third years of
PhD, of which almost one year was spent in ILPS, the University of Amsterdam.
The author thanks Maarten Marx, Maarten de Rijke and other members of ILPS for
comfortable environments and stimulating discussions during my stay. Especially, it
was a unique training to work on heavy problems for months with Maarten Marx,
Alessandro Facchini and Evgeny Sherkhonov.
The author thanks Tadeusz Litak for encouragements and information on relevant
research. At the University of Tokyo, discussions with Tatsuya Abe, Yoshihiko Kakutani and Masahiro Hamano nurtured my taste on formalistic, semantic and graphicalapproaches.

Contents

1 Introduction

1

1.1

Our Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

1.2

Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5

1.3

History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6

1.3.1

Birth of Formal Logic . . . . . . . . . . . . . . . . . . . . . . .

6

1.3.2

Intuitionistic Propositional Logic . . . . . . . . . . . . . . . . .

7

1.3.3

The Brouwer-Heyting-Kolmogorov Interpretation of Logical Con-

1.4

nectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11

1.3.4

Natural Deduction and Sequent Calculus . . . . . . . . . . . .

12

1.3.5

Curry-Howard Isomorphism . . . . . . . . . . . . . . . . . . . .

14

1.3.6

Gödel-Dummett Logic . . . . . . . . . . . . . . . . . . . . . . .

17

1.3.7

Waitfreedom . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18

1.3.8

Intermediate (Superintuitionistic) Logics . . . . . . . . . . . . .

18

1.3.9

Substructural Logics . . . . . . . . . . . . . . . . . . . . . . . .

20

To the Next Chapters . . . . . . . . . . . . . . . . . . . . . . . . . . .

23

2 A Synchronous Hyper-Lambda Calculus

24

2.1

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24

2.2

Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

26

2.2.1

Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

26

2.2.2

Terms and Free Variables . . . . . . . . . . . . . . . . . . . . .

26

2.2.3

Typing Derivations . . . . . . . . . . . . . . . . . . . . . . . . .

27

2.2.4

Interaction with Contraction and Weakening . . . . . . . . . .

28

2.2.5

Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32

Type Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32

2.3.1

Lack of Convergence . . . . . . . . . . . . . . . . . . . . . . . .

34

2.3.2

Determinacy . . . . . . . . . . . . . . . . . . . . . . . . . . . .

35

2.3

i

2.4

2.5

2.6

2.7

2.8

2.9

Session Types and Processes as Abbreviations . . . . . . . . . . . . . .

36

2.4.1

Session Types as Abbreviations . . . . . . . . . . . . . . . . . .

36

2.4.2

Processes as Abbreviations . . . . . . . . . . . . . . . . . . . .

37

2.4.3

Process Typing Rules as Abbreviations . . . . . . . . . . . . .

37

2.4.4

Implementing Channels . . . . . . . . . . . . . . . . . . . . . .

38

2.4.5

Copycatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

43

Correctness with Respect to Abelian Logic . . . . . . . . . . . . . . . .

44

2.5.1

Completeness of the Amida Calculus Type System . . . . . . .

44

2.5.2

Soundness of the Amida Calculus Type System . . . . . . . . .

45

Proof Nets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

47

2.6.1

IMLL Essential Nets . . . . . . . . . . . . . . . . . . . . . . . .

47

2.6.2

The Amida Nets . . . . . . . . . . . . . . . . . . . . . . . . . .

50

2.6.3

Soundness and Completeness of Amida nets . . . . . . . . . . .

52

Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

54

2.7.1

Analytic Calculus for Abelian Logic . . . . . . . . . . . . . . .

54

2.7.2

Linear Logic and Session Types . . . . . . . . . . . . . . . . . .

55

2.7.3

Join Calculus . . . . . . . . . . . . . . . . . . . . . . . . . . . .

58

2.7.4

Continuations . . . . . . . . . . . . . . . . . . . . . . . . . . . .

58

2.7.5

Logic Programming . . . . . . . . . . . . . . . . . . . . . . . .

59

Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

59

2.8.1

Adding Agents, Recursions, . . . . . . . . . . . . . . . . . . . . .

59

2.8.2

Cut-Elimination . . . . . . . . . . . . . . . . . . . . . . . . . .

60

2.8.3

The Problem with Excluded Middle . . . . . . . . . . . . . . .

60

2.8.4

Non-Commutative Version of the Amida Axiom . . . . . . . . .

60

2.8.5

Program Specification and Verification . . . . . . . . . . . . . .

61

Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

61

3 An Asynchronous Hyper-Lambda Calculus

62

3.1

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

62

3.2

λ-GD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

63

3.2.1

Logic

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

64

3.2.2

Term Assignment . . . . . . . . . . . . . . . . . . . . . . . . . .

64

3.2.3

Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

67

3.2.4

Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

75

Typed Waitfreedom . . . . . . . . . . . . . . . . . . . . . . . . . . . .

78

3.3.1

79

3.3

Typed Input-Output Problem . . . . . . . . . . . . . . . . . . .

ii

3.3.2

Typed Protocols . . . . . . . . . . . . . . . . . . . . . . . . . .

80

3.3.3

Typed Waitfree Computation . . . . . . . . . . . . . . . . . . .

81

3.4

Characterization of Waitfreedom by λ-GD . . . . . . . . . . . . . . . .

86

3.5

Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

96

3.6

Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

97

3.7

Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

99

4 Prelinearity Axiom as an Asynchronous Communication Scheme

100

4.1

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

100

4.2

Asynchronous Semantics . . . . . . . . . . . . . . . . . . . . . . . . . .

101

4.2.1

Dynamics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

101

4.2.2

Statics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

102

4.3

Synchronous Semantics. . . . . . . . . . . . . . . . . . . . . . . . . .

105

4.4

Characterization of Monoidal t-Norm Logic . . . . . . . . . . . . . . .

116

4.5

Discussion and Future Work . . . . . . . . . . . . . . . . . . . . . . . .

118

4.6

Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

118

5 Hypersequents in the Programming Language Haskell

119

5.1

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

119

5.2

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

119

5.2.1

Waitfreedom . . . . . . . . . . . . . . . . . . . . . . . . . . . .

119

5.2.2

Implementing Hyper-Lambda Calculus . . . . . . . . . . . . . .

120

5.3

An Example Program . . . . . . . . . . . . . . . . . . . . . . . . . . .

121

5.4

Implementation of the Library . . . . . . . . . . . . . . . . . . . . . .

124

5.4.1

What is a Hypersequent . . . . . . . . . . . . . . . . . . . . . .

124

5.4.2

How to Execute a Hypersequent . . . . . . . . . . . . . . . . .

126

5.4.3

How to Construct a Hypersequent . . . . . . . . . . . . . . . .

129

Capturing Waitfreedom . . . . . . . . . . . . . . . . . . . . . . . . . .

133

5.5.1

Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

133

5.5.2

Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . . .

134

Comparison with Gödel-Dummett Logic . . . . . . . . . . . . . . . . .

135

5.6.1

Similarity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

135

5.6.2

Diﬀerence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

136

Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

137

5.7.1

Computational Content of Hypersequents . . . . . . . . . . . .

137

5.7.2

High Level Treatment of Concurrency . . . . . . . . . . . . . .

137

5.5

5.6

5.7

iii

5.8

Future Work and Conclusions . . . . . . . . . . . . . . . . . . . . . . .

6 Conclusions

138
141

6.1

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

141

6.2

From Logical Perspectives . . . . . . . . . . . . . . . . . . . . . . . . .

141

6.2.1

Generalization . . . . . . . . . . . . . . . . . . . . . . . . . . .

141

6.2.2

The Amida Calculus . . . . . . . . . . . . . . . . . . . . . . . .

142

6.2.3

Gödel-Dummett Logic . . . . . . . . . . . . . . . . . . . . . . .

142

6.2.4

More General Fuzzy Logics . . . . . . . . . . . . . . . . . . . .

142

From Computer Science Perspectives . . . . . . . . . . . . . . . . . . .

143

6.3.1

Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . .

143

6.3.2

Further Implementation . . . . . . . . . . . . . . . . . . . . . .

143

6.3.3

Reasoning about Hyper-Lambda Terms . . . . . . . . . . . . .

144

6.3.4

Mixing Synchronous and Asynchronous Communication . . . .

144

6.3.5

Understanding Waitfreedom . . . . . . . . . . . . . . . . . . . .

144

From Philosophical Perspectives . . . . . . . . . . . . . . . . . . . . .

144

6.3

6.4

iv

List of Figures

1.1

The lattice of substructural and intermediate logics, some of which withknown lambda calculi. . . . . . . . . . . . . . . . . . . . . . . . . . . .

4

1.2

An example of the Amida lotteries. . . . . . . . . . . . . . . . . . . . .

23

2.1

The typing rules of the Amida calculus . . . . . . . . . . . . . . . . . .

29

2.2

The definition of evaluation relation of the Amida calculus . . . . . . .

33

2.3

A typed process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

2.4

Proof of Lemma 2.4.7. . . . . . . . . . . . . . . . . . . . . . . . . . . .

42

3.1

A derivation of Dummett’s axiom under modality [0] in λ-GD. . . . .

65

3.2

The underlying logic of λ-GD. . . . . . . . . . . . . . . . . . . . . . . .

66

3.3

The typing rules of λ-GD. . . . . . . . . . . . . . . . . . . . . . . . . .

68

3.4

An example of a typed term in λ-GD that corresponds the derivationin Figure 3.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

69

3.5

An example of a typing derivation. . . . . . . . . . . . . . . . . . . . .

70

3.6

A typed global term that solves the exclusive-or problem. . . . . . . .

87

4.3

A non-confluent example similar to Lafont’s example. . . . . . . . . .

103

4.4

′

Typing derivation rules of NMTL2 . H and H stand for hypersequents.
In EW, H cannot be empty. . . . . . . . . . . . . . . . . . . . . . . . .

4.5

A derivation tree typing an s-term with the prelinearity axiom: the→cs-term (inl(∗→c̄←c ) ∥ inr(∗←c̄ )) has type ∀X∀Y ((X ⊸ Y ) ⊕ (Y ⊸ X)). .

4.6

104
104

The propositional rules in HL∀BCK [13], which characterizes monoidal
t-norm logic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

116

5.1

An example program that provides waitfree communication to two clients.139

5.2

An implementation for participating set problem [23] for three threads. 140v

List of Examples

Example 1.2.1

An example of BNF . . . . . . . . . . . . . . . . . . . . . . .

6

Example 2.2.1

Derivation of the Amida axiom . . . . . . . . . . . . . . . .

28

Example 2.4.2

Typed communicating terms . . . . . . . . . . . . . . . . . .

38

Example 2.4.6

Connecting processes using session realizers. . . . . . . . .

41

Example 2.4.8

Evaluation of communicating processes . . . . . . . . . . . .

41

Example 2.6.1

An essential net of the Amida axiom . . . . . . . . . . . . .

48

Example 2.6.6

A correct Amida net for the Amida axiom . . . . . . . . . .

51

Example 2.7.1

Drink server from Caires and Pfenning [26] in the Amida cal.

56

Example 3.2.2

A typing of a global term. . . . . . . . . . . . . . . . . . . .

67

Example 3.2.8

Reductions of λ-GD . . . . . . . . . . . . . . . . . . . . . . .

74

Example 3.3.1

The addition problem . . . . . . . . . . . . . . . . . . . . . .

79

Example 3.3.2

The exchange problem . . . . . . . . . . . . . . . . . . . . .

79

Example 3.3.3

The addition protocol . . . . . . . . . . . . . . . . . . . . . .

81

Example 3.3.7

An example of schedules . . . . . . . . . . . . . . . . . . . .

82

Example 3.3.9

An example of a run and an execution . . . . . . . . . . . .

83

Example 3.3.12

Permissible inputs and outputs . . . . . . . . . . . . . . . . .

85

Example 3.3.13

An example of a typed protocol solving the addition task . .

85

Example 3.3.14

A waitfreely unsolvable typed input-output problem . . . . .

86

Example 3.4.2

A global term solving the addition problem . . . . . . . . . .

86

Example 3.4.4

Specifying elements of a sequence . . . . . . . . . . . . . . .

88

Example 3.4.5

Translation of a typed term into a typed protocol . . . . . .

91

Example 4.3.7

A term performing information exchange. . . . . . . . . . . .

115

vi

List of Theorems

Remark 2.2.3

Incompatibility of the bang modality . . . . . . . . . . . . . .

30

Corollary 2.2.4

Incompatibility of additive disjunctive unit

. . . . . . . . .

30

Corollary 2.2.5

Incompatibility of the second order universal quantification

30

Theorem 2.3.1

Type Preservation of the Amida calculus . . . . . . . . . . .

32

Theorem 2.3.4

General Determinacy of the Amida calculus . . . . . . . . .

35

Theorem 2.4.1

Process Typing Rules: senders and receivers . . . . . . . . .

37

Corollary 2.4.4

Binding both ends of a channel . . . . . . . . . . . . . . . .

40

Theorem 2.4.5

Process typing rule: name restriction . . . . . . . . . . . . .

40

Theorem 2.5.1

Completeness of the Amida Calculus for Abelian Logic . . .

44

Theorem 2.5.2

Soundness of the Amida Calculus for Abelian Logic . . . . .

46

Corollary 2.5.3

Division by two . . . . . . . . . . . . . . . . . . . . . . . . .

46

Corollary 2.5.4

Excluded Middle in the Amida calculus . . . . . . . . . . .

46

Corollary 2.5.5

Prelinearity in the Amida calculus . . . . . . . . . . . . . .

46

Theorem 2.6.3

Essential nets by Lamarche [92], Murawski and Ong [111] .

49

Theorem 2.6.7

Completeness of Amida nets . . . . . . . . . . . . . . . . . .

52

Theorem 2.6.8

Soundness of Amida nets . . . . . . . . . . . . . . . . . . . .

53

Theorem 3.2.1

Characterization of Gödel-Dummett logic . . . . . . . . . . .

64

Theorem 3.2.9

Non-abortfullness of λ-GD . . . . . . . . . . . . . . . . . . .

75

Theorem 3.2.11

Strong normalization of λ-GD . . . . . . . . . . . . . . . . .

77

Theorem 3.4.3

Soundness of λ-GD with regard to waitfreedom . . . . . . .

86

Theorem 3.4.7

Completeness of λ-GD with regard to waitfreedom . . . . .

95

Corollary 4.2.1

Prelinearity as a communication scheme . . . . . . . . . . .

103

Theorem 4.3.3

Adequacy of NMTL2 . . . . . . . . . . . . . . . . . . . . . .

107

For definitions, see Index at the end of the thesis.

viiChapter 1
Introduction

1.1

Our Contributions

We propose hyper-lambda calculi. Instead of lambda terms in ordinary lambda calculi, we use a finite sequence of lambda terms called hyper-lambda terms. We give
two such examples: one models synchronous send-receive communication (Chapter 2)
and the other models asynchronous waitfree read-write communication (Chapter 3).
The two hyper-lambda calculi are in Curry-Howard correspondence with hypersequent
formulation of logics: Abelian logic and Gödel-Dummett logic. Gödel-Dummett logic
is an intermediate logic. An intermediate logic is a logic between classical and intuitionistic logics, where ‘between’ is defined using the set-theoretic inclusion of valid
logical formulae of each logic. Abelian logic is a substructural logic.
Hosoi and Ono [82] declared that they chose to study intermediate logics in generalrather than studying specific intermediate logics. However, concrete results about specific subjects matter when the results contain new phenomena. This thesis is intended
to contain such concrete discoveries about specific intermediate and substructural logics.
The more famous logic among the two, Gödel-Dummett logic, is a typical intermediate logic known from 1950’s. Our method is the Curry-Howard correspondence,
also known from 1940’s. Our result is characterization of waitfreedom, a concept in
the theory of distributed computation extensively studied in 1990’s. Since both sidesof the correspondence are already known, the discovery is a replay of Curry’s surprise.
After developing a hyper-lambda calculus for Abelian logic, we found that theresulting programming language is similar to a session type systems by Giunti and
Vasconcelos [62] although they were not aware of the underlying logic. The independent discoveries constitute another instance of Curry–Howard correspondence “not by1

design”.
We list our contributions from the most important:
1. developing a lambda calculus using a hypersequent calculus (Chapters 2, 3);
2. identifying the computational ability of Gödel-Dummett logic with waitfreedom(Chapter 3);
3. encoding session types using a seemingly unknown axiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ)(which we call the Amida axiom) on top of the multiplicative additive fragmentof intuitionistic linear logic (Chapter 2),
4. discovery of a new proof system for Abelian logic (Chapter 2);
5. using conjunctive hypersequents for the first time (Chapter 2);
6. giving a typed lambda calculus for monoidal t-norm logic (Chapter 4); and7. implementing a hyper-lambda calculus in Haskell (Chapter 5).
Our first contribution is the technique for our second contribution. We developed
a lambda calculus based on Avron’s hypersequents [8]. Avron [8] himself noted that
it would be important to develop a lambda calculus for hypersequents. The lambda
calculus relies on Avron’s hypersequents [8]. A hypersequent calculus is a variant of
the deduction system called sequent calculus. In sequent calculus, each step of a proof
tree concludes a sequent Γ ⊢ φ that consists of a finite sequence of logical formulae Γand a logical formula φ. The sequent Γ ⊢ φ is interpreted as an implication. In
hypersequent calculus, each step of a proof tree concludes a hypersequent instead of asequent. A hypersequent is a sequence of sequents delimited byψ, e.g., Γ ⊢ φ∆⊢· · · . Also here, each component is interpreted as an implication, and then thewhole hypersequent is interpreted as the disjunction of all those implications. When
we interpret proofs as programs, we take the components as concurrent processes.
Following the original disjunctive interpretation of components, we regard the proof
tree as the guarantee of success of at least one process.
Our second contribution is the new approach of interpreting proofs in GödelDummett logic as concurrently executable programs for waitfree computation. Although Avron [8] noticed his hypersequent calculus has something to do with concurrency (as the title of [8] contains the phrase “intermediate logics for concurrency”), it
was unknown that the computational interpretation of Gödel-Dummett logic coincides

2

with the degree of synchronization called waitfreedom. This discovery constitutes our
second contribution.
According to Sørensen and Urzyczyn [130, p.97], the Curry-Howard isomorphism [130]was first made precise by Curry and Feys [37, 9E and 9F]. The intuitionistic propositional logic and the typed lambda calculus had been independently invented but
Curry discovered them to be the same thing. The “double discovery” (Wadler [146])
is considered to aﬃrm the importance of the typed lambda calculi. In this thesis wewitness a replay of the “double discovery” with diﬀerent casts: Gödel-Dummett logic
and the waitfreedom. Both of these were born in the early eras of their respective
academic disciplines: mathematical logic bore Gödel Dummett logic in 1950’s [43] andthe computer science bore waitfree computation in 1970’s [93]. Chapter 3 is about thepreviously unknown connection between these two.
This is the first such computational interpretation for intermediate logics (Figure 1.1). Another significance of this contribution lies in giving interpretation of
nondeterminism in typed lambda calculi as scheduling of concurrent processes. In thesimply typed lambda calculus for intuitionistic propositional logic, all typed terms
have a unique normal form. However, in typed lambda calculi for classical propositional logic, there can be multiple normal forms unless we employ an evaluation
strategy or limit the set of reductions. The lack of unique normal forms in the classical propositional proofs has puzzled logicians for decades. The most famous example
is Lafont’s example [61, B.1.], which provides a way to equate any two proofs for thesame formula (if we equate proofs before and after cut-elimination). In computer science, such a phenomenon is called nondeterminism caused by scheduling. Dynamic
behavior involves time. One simple notion of time is that of totally ordered events
where one event happens before the other or the other before the one. This sentence
is syntactically similar to Dummett’s axiom that states one proposition implies theother or the other implies the one. We investigate whether this syntactic similarity isreflected in the dynamic semantics of logics: namely, the lambda calculi.
Our third contribution is about encoding of session types into a linear type system.
Although the approach is similar to that of Caires and Pfenning [26] and Wadler [146],
the Amida calculus has an additional axiom so that it can type some processes that
Pfenning or Wadler’s type systems cannot.
Our fourth contribution is a side eﬀect of the third contribution. The type system we developed for our third contribution is an unknown proof system for Abelian
logic [27]. We moreover take the essence of the new proof system and obtain a kindof proof nets called the Amida nets. Syntactically, the correct proof structure can3Inconsistent
Parigot, Filinski, Griﬃn, Ong and
Stewart, Selinger, Krivine, Curien
Cland Herbelin, Wadler, Kakutani,
Kimura, and many others.

ce lo
g

ics

Ł5

GL5

Ł9

fuzzy logics

van
rele

GL3
GL4

logics

Hirai
AbelianΠintermediate

Ł3

GD
Hirai

Ł∞

D. Gabbay
InFLew
R

Int
Curry

BL

lin
ear
log

Hirai
MTL

ics

FLec
Abramsky
MALL
MALL-

FLew
Asperti, Terui
FLe = IMALL
Abramsky

Figure 1.1: The substructural and intermediate logics for which lambda calculi are found.
The underlying Hasse diagram of well-known substructural logics is taken from [57, p. 120]with slight modifications. The names in boxes refer to people who developed lambda calculi
for these logics. GD stands for Gödel-Dummett logic, for which a lambda calculus will begiven in Chapter 3. Abelian stands for Abelian logic [27, 103, 104] discussed in Chapter 2.
MTL is monoidal t-norm logic [46], for which we give a hyper-lambda calculus in Chapter 4.
FLe is for the full Lambek calculus with exchange rule [57, p.86], which is also known as
the intuitionistic multiplicative additive fragment of linear logic (IMALL). MALL stands for
its classical version. For these fragments of linear logic, Abramsky [3] gave lambda calculi.
MALL− [59] is a fragment of MALL without additive units. FLew has weakening on top ofFLe. FLew is also known as intuitionistic aﬃne logic. Aﬃne logics lack contraction, whichcauses exponential size increase during cut-elimination process. Asperti gave light aﬃne
logic [7]. Terui [132] gave an aﬃne typed lambda calculus for polynomial time computation.
R stands for relevance logic [139], for which Gabbay and de Queiroz [55] gave a lambda
calculus. Int stands for the intuitionistic propositional logic. The original Curry-Howard
isomorphism was found for this logic by Curry [36]. Cl stands for the classical propositional
logic. There is intensive research going on for the computational interpretation of classicallogic [35, 49, 66, 85, 115, 117, 127, 144, 145], of which Daisuke Kimura’s thesis [87] provides
an overview. Inconsistent stands for the logic of all logical formulae.

4be characterized with the Amida edges, which is similar to the structure of Amida
lottery. The previous chapters gave the computational interpretations of disjunctive
formulae like (φ ⊃ ψ) ∨ (ψ ⊃ φ) or (φ ⊸ ψ) ⊕ (ψ ⊸ φ). In this chapter, we try
replacing these disjunctions with conjunctions. In the former case, the change renders
the logic inconsistent; if we add the axiom (φ ⊃ ψ) ∧ (ψ ⊃ φ) to the intuitionistic
propositional logic, we can prove any formula. However in the latter case, the change
does not make the system meaningless. In Chapter 2, we introduce the axioms of
the form (φ ⊸ ψ) ⊗ (ψ ⊸ φ) on top of IMALL, intuitionistic multiplicative additive
linear logic. In essence, the axiom allows two processes to wait for one another andthen exchange information.
Our fifth contribution is the use of conjunctive hypersequents. Hypersequents havebeen around since Avron [8], but in all cases, diﬀerent components in a hypersequent
were interpreted disjunctively. In our formalization of Abelian logic in Chapter 2, weuse conjunctive hypersequents, where diﬀerent components are interpreted conjunctively. This is the first application of such conjunctive hypersequents.
Our sixth contribution is a typed lambda calculus for monoidal t-norm logic.
Monoidal t-norm logic (MTL) is the aﬃne version of Gödel-Dummett logic. MTL
is considered by some to be the weakest fuzzy logic. Following our method of interpreting Gödel-Dummett logic proofs as waitfree protocols, we interpret the MTL
proofs in our deduction system as asynchronously communicating processes. There we
employ the second-order formulation and perform parametricity arguments.
Our seventh contribution is implementing a hyper-lambda calculus in Haskell. By
implementing a hyper-lambda calculus for waitfreedom, we obtain a empirical justification of our second contribution.
The content of Chapter 3 appears in a conference paper by the author [77] although
we have applied substantial modifications since then.

1.2

Preliminaries

We use “iﬀ” as an abbreviation for “if and only if.” We use set-theoretic concepts suchas sets, relations and functions. For a set X, 2X denotes the powerset of X. X \ Ydenotes the subset of X that consists of the elements of X that are not elements of Y .
Everywhere, we consider a countably infinite set of logical formulae. A logic is a setof logical formulae, thus, there are at most 2N diﬀerent logics once the set of logicalformulae is fixed. Likewise, we consider at most countably many proofs and lambda
terms.

5

We denote partial maps as graphs. For example, {0 7→ M, 1 7→ N } denotes apartial map that maps 0 to M and 1 to N . We denote by dom(f ) the domain of f ,that is, the set of elements that are mapped to something. We also denote a partial
map as a sequence whose index set is the domain. For example, (yi )i∈I denotes thepartial map that maps i ∈ I to yi . For partial maps whose domains are disjoint, we
use ⊔ to denote the union. In other words, when f and g have disjoint domains, f ⊔ gdenotes the partial map that maps x to f (x) or g(x) when one of these is defined, orotherwise to nothing.
We use BNF (Backus Naur Form) for giving inductive definitions for sets of finite
sequences of symbols.
Example 1.2.1 (An example of BNF) When we say we define formulae φ by BNF:
φ ::= ⊥ | p | (φ ⊃ φ)where p is a propositional variable, we actually define a set Φ which is the smallest set
such that• ⊥ is in Φ
• each propositional variable is in Φ and• if φ and ψ are in Φ, then (φ ⊃ ψ) is in Φ;and then we declare that we call elements of Φ formulae.
We take binary operators of the symbol ⊃ or ⊸, to be right associative. For
example, φ ⊸ ψ ⊸ θ is interpreted as φ ⊸ (ψ ⊸ θ).

1.3

History

We briefly review the history of mathematical logic and computer science to the extent
relevant to this thesis. Especially, we focus on the treatments of Dummett’s axiom (a ⊃b) ∨ (b ⊃ a) using the historical techniques. We confine ourselves to the developments
of propositional logic and ignore anything related to predicate logic or formalizationof mathematics.
1.3.1

Birth of Formal Logic

Implication is an important concept. One treatment of implications is called thematerial implication. The material implication can be traced back at least to Frege’s
6Begriﬀsschrift [54] in 1879. There, in the section called “conditionality,” he begins by
establishing four cases [54, p. 13]:
1. A is aﬃrmed and B is aﬃrmed ;2. A is aﬃrmed and B is denied ;3. A is denied and B is aﬃrmed ;4. A is denied and B is denied.
Then he defines a notation involving A and B
A
B
which “stands for the judgment that the third of these possibilities does not take place,but one of the three other does1 ” [54, p. 14]. In the contemporary common mathematical terminology, this is equivalent to stating B implies A. It was Bertrand Russell whocalled this implication the material implication, according to Edgington [44]. After
Brouwer’s notation, we still use ⊢ for judgments in our formal systems. The view oflogical formulae as graphical objects will be inherited to proof nets (Section 2.6).
1.3.2

Intuitionistic Propositional Logic

The intuitionistic propositional logic is a logic, that is, a set of logical formulae.
Although the name “intuitionistic” comes from Brouwer’s intuitionism, the original
claims of intuitionism are unrelated to this thesis. Brouwer was skeptical about thevalue of formalization of mathematics and considered the studies of formal axiomatized logic as “mathematics of the second and third order” [141, p. 10]. Nonetheless,
Brouwer approved publication of his student Arend Heyting’s work on defining a setof logical formulae as the intuitionistic propositional logic.
In 1930, Heyting [74] developed a deduction system for the intuitionistic propositional logic. The presentation is similar to the contemporary one except some notational diﬀerences. The logical connectives {∧, ∨, ⊃, ¬} are the same as today, thefirst three binary and the last unary2 . Logical formulae are constructed using theseconnectives and the propositional variables. Although he sometimes used parentheses,
he still used more points around outer connectives (e.g. b ⊃· a ⊃ b indicates the left ⊃1 The emphasis is found in the English translation [54, p. 14].
2 Though, in this thesis, we prefer having nullary ⊥ as a primitive and define ¬a as an abbreviation

for a ⊃ ⊥.

7

is outer and the right one is inner). Instead we use parentheses. These formulae areaxioms3 , i.e. assumed to be “correct formulae” [74]:2.1. a ⊃ (a ∧ a)
2.11. (a ∧ b) ⊃ (b ∧ a)
2.12. (a ⊃ b) ⊃ (a ∧ c) ⊃ (b ∧ c)
2.13. ((a ⊃ b) ∧ (b ⊃ c)) ⊃ (a ⊃ c)
2.14. b ⊃ (a ⊃ b)
2.15. (a ∧ (a ⊃ b)) ⊃ b
3.1. a ⊃ (a ∨ b)
3.11. (a ∨ b) ⊃ (b ∨ a)
3.12. ((a ⊃ c) ∧ (b ⊃ c)) ⊃ ((a ∨ b) ⊃ c)
4.1. ¬a ⊃ (a ⊃ b)
4.11. ((a ⊃ b) ∧ (a ⊃ ¬b)) ⊃ ¬a .
There are more formulae given by the following rules [74]:1.2. If a and b are correct formulas4 , then a ∧ b is a correct formula.
1.3. If a and a ⊃ b are correct formulas, then b is a correct formula.
Following the intuitionists’ belief that “it is in principle impossible to set up asystem of formulas that would be equivalent to intuitionistic mathematics, for the
possibilities of thought cannot be reduced to a finite number of rules set up in advance” [74], Heyting did not pursue completeness results for the deduction system
except a remark mentioning Glivenko’s theorem [63, 64]. In other words, he did not
pursue arguing that his system is strong enough. On the contrary, he argued his system is not too strong. He used what would be called algebraic semantics today inorder to show that each axiom is independent from the other axioms and that theexcluded middle is unprovable. For example, in order to refute the excluded middle,
he used the following tables [74]:

3 The axioms with numberings are taken from Heyting [74].
4 In quotes, we do not adjust the plural “formulas” and “formulae.”

8

⊃

0

1

2

∧

0

1

2

∨

0

1

2

0

0

0

0

0

0

1

2

0

0

0

0

1

1

0

1

1

1

1

1

1

0

1

2

2

2

0

0

2

2

1

2

2

0

2

2

¬

0

1

2

1

0

1

.

When we assign one of {0, 1, 2} to each propositional variable, we can extend theassignment to all formulae using these tables. For binary operators, the columns standfor the prearguments (the arguments on the left of the operator) and the rows standfor the postarguments (the arguments on the right of the operator). For example, if weassign 1 to a and 2 to b, a ⊃ b obtains value 0. Under any assignment to propositionalvariables, all of Heyting’s axioms are assigned 0. Moreover, these tables have twodesirable properties:
1. 0 ∧ 0 = 0
2. 0 ⊃ a has the value 0 only when a = 0.
From these, all “correct formulae” in Heyting’s deduction system receive the value 0
under any assignments to propositional variables. However, if we assign 2 to a, (¬¬a) ⊃a is assigned 2. Thus, we can conclude that ¬¬a ⊃ a is not a correct formula in
Heyting’s deduction system. Note that the natural order between natural numbers
plays no role here: it is not relevant that 2 is larger than 1 or 0 is less than 1 (in otherplaces he uses “all positive and negative whole numbers and 0”). Although Heyting
used natural numbers here, he already obtained an equivalent notion of what is called
Heyting algebra today5 .
We can refute Dummett’s axiom (a ⊃ b) ∨ (b ⊃ a) in the same method. Indeed,according to the tables below, when we assign 1 to a and 2 to b, (a ⊃ b) ∨ (b ⊃ a)obtains 4, which is not 0. Since all correct formulae receive 0, (a ⊃ b) ∨ (b ⊃ a) is nota correct formula.
⊃

0

1

2

3

4

∧

0

1

2

3

4

∨

0

1

2

3

4

0

0

0

0

0

0

0

0

1

2

3

4

0

0

0

0

0

0

1

1

0

1

0

1

1

1

1

3

3

1

1

0

1

4

1

4

2

2

2

0

0

2

2

2

3

2

3

2

2

0

4

2

2

4

3

3

3

3

0

3

3

3

3

3

3

3

3

0

1

2

3

4

4

4

0

0

0

0

4

4

1

2

3

4

4

0

4

4

4

4

¬

0

1

2

3

4

3

3

3

0

3

5 Although he did not explicitly say that he can define a partial order using the semantics for ⊃.

9GödelIn 1932, Gödel published a short note [65] on intuitionistic propositional logic, where
he proved two theorems: that the intuitionistic propositional logic cannot be seen as a
many-valued logic and that there are infinitely many propositional logics between theintuitionistic propositional logic and the “ordinary” (in today’s terminology, classical)
propositional logic. The second result is the first contribution to the realm of intermediate logics (according to Troelstra [47, p. 223]). For distinguishing those intermediate
logics and the intuitionistic propositional logic, he uses a formula Fn for each positive
natural number n:Fn =∨((ai ⊃ ak ) ∧ (ak ⊃ ai )) .

1≤i<k≤n

On an n-element chain, Fn+1 is valid while Fn might not be satisfied. As a result, no
Fn is valid in the intuitionistic propositional logic.
Among the formulae Fn , especially, the formula F2 , which is (a1 ⊃ a2 ) ∧ (a2 ⊃ a1 ),brings contradiction into classical or intuitionistic logic. Moreover, any logic (closed
under modus ponens and substitution) having F2 as a theorem is inconsistent. In
Chapter 2 we investigate a logic with an axiom similar to F2 : (φ ⊸ ψ) ⊗ (ψ ⊸ φ),where ⊗ is the multiplicative conjunction and ⊸ is the linear implication. That logic
is consistent because it lacks weakening and contraction rules. Such attempt has been
made possible by the development of linear and substructural logics explained below
in 1.3.9.
In the final sentence, Gödel [65] states what is known as disjunction property
today6 : “besides, the following holds with full generality: a formula of the form A ∨ B
can only be provable in H if either A or B is provable in H,” where H is Heyting’s
calculus. According to this statement, it is obvious that Dummett’s axiom (p ⊃q) ∨ (q ⊃ p) is not provable.
Although Troelstra [47, p. 223] writes “the reasons for studying intermediate logics
are mainly technical,” we find that one typical intermediate logic, Gödel-Dummett
logic, has a computational interpretation that has already been known: waitfreedom.
The connection between Gödel-Dummett logic and waitfreedom will be treated in
Chapter 3.

6 Disjunction property can be proved by soundness and completeness with respect to Kripke models.

There is another, syntactic technique called Aczel’s slash [136, Ch. 3. 5.7.].

10

1.3.3

The Brouwer-Heyting-Kolmogorov Interpretation of Logical Connectives

Kolmogorov’s view of implication as problem reduction
Thanks to Heyting [74], we have a formal characterization of the intuitionistic implication. In 1932, Kolmogorov [91] introduced a “calculus of problems” that coincides
with the intuitionistic propositional logic. In the calculus of problems, the logicalconnectives ∨, ∧, ⊃ connect problems together to form another problem.
If a and b are two problems, then a ∧ b designates the problem “to solve
both problems a and b,” while a ∨ b designates the problem “to solve atleast one of the problems a and b.” Furthermore, a ⊃ b is the problem“to solve b provided that the solution for a is given” or, equivalently, “toreduce the solution of b to the solution of a.” . . . ¬a designates the problem“to obtain a contradiction provided that the solution of a is given.” [91,p. 329]Here, the intuitionistic implication is explained as reduction of problems. He continues
to validate Heyting [74]’s axioms, and the deduction rules with respect to the problem
calculus interpretation.
Furthermore, he finds a reason for not including the law of excluded middle a ∨¬a by saying “one must possess a general method either to prove or to reduce to acontradiction any proposition. If our reader does not consider himself to be omniscient,
he will probably determine that the formula cannot be found on the list of problems
solved by him” [91]. This argument is enough to reject Dummett’s axiom (a ⊃ b)∨(b ⊃a) because one must possess a general method, given any two problems, to determine
whether one problem can be reduced to the other or the other way around. For thecomputational meaning of the law of excluded middle, we have to wait until 1990’s.
And the computational interpretation of Dummett’s axiom is presented in Chapter 3
in this thesis.
Realization as Typed Lambda Terms
One formulation of the Brouwer-Heyting-Kolmogorov (BHK) interpretation reads: “aproof of the implication φ ⊃ ψ is a construction which permits us to transform any
proof of φ into a proof of ψ” [136, Ch. 1, 3.1.]. The BHK interpretation does not
specify what is a proof or what kind of transformation witnesses implication.

111.3.4Natural Deduction and Sequent Calculus

Gentzen’s Deduction Systems
The deduction system of Heyting [74] characterizes what is still called intuitionistic propositional logic today. However, Heyting’s system has one drawback, whichis shared with almost all7 other Hilbert-style derivation systems: in order to prove a
logical formula, sometimes we have to mention a larger, more complicated formula. Actually, there are alternative formulations of intuitionistic (and classical) propositional
logic by Gentzen [58] where we only have to mention subformulae of the formula being proven. The desirable property is called the subformula property. The two proof
systems are called natural deduction and sequent calculus.
In contrast to the system of Heyting [74] where a proof yields a finite set of “correct formulae,” a proof in natural deduction and sequent calculus yields a pair ofassumptions and conclusions. Gentzen [58] used the form
A1 , . . . , Aµ −→ B
as a sequent. We will use ⊢ instead of −→. In any case, a sequent stands for the
implication: the conjunction of Ai ’s implies B.
In natural deduction, the assumptions and conclusions are presented vertically. For
example,A∧B
B
has a single assumption A ∧ B and a conclusion B. The same content can be shownasA∧B ⊢A∧B
A∧B ⊢B.

The horizontal line shows an application of an inference rule8 . The sequent on top of
the inference rule is called the assumption of the rule and the sequent below is called
the conclusion of the rule. Natural deduction has introduction rules and elimination
rules for each logical connectives. An introduction rule of a connective contains theconnective in the conclusion but not in the assumptions (if any). An elimination
rule of a connective contains the connective in one of the assumptions but not in the
conclusion. For example, the introduction and elimination rules for ∧ (conjunction9 )is as follows:
7 Even Hilbert-style deduction systems can avoid this drawback if all theorems are axioms.
8 In [58], an inference rule is called an inference figure schema.
9 Gentzen [58] and Prawitz [119] used &.

12

Γ⊢φ
Γ⊢ψ
Γ⊢φ∧ψ

Γ⊢φ∧ψ
Γ⊢φ

Γ⊢φ∧ψ
Γ⊢ψ

.

These rules are the meaning of conjunction ∧. In sequent calculus, the introduction
rules stay the same but called the right rules because they operate on the right handside of sequents. The elimination rules are rewritten so that they operate on the left
side of sequents and they are called the left rules.
In Chapter 2, we will use a hypersequent calculus for presenting Abelian logic.
In Chapter 3, we will use hypersequent-style natural deduction for presenting GödelDummett logic.
Prawitz’s Analysis of Natural Deduction
Gentzen [58] did not prove the subformula property immediately for natural deduction. He proved the subformula property for sequent calculus first and then afterthat obtained the property of natural deduction as a corollary. On the other hand,
Prawitz [119] studied natural deduction in itself.
Inversion principle states that an occurrence of a logical connective in a proof
can be removed when the connective is introduced by an introduction rule, and then
immediately below, eliminated by an elimination rule. A logical formula occurrencecontaining such a connective is called a maximal formula. For example, for conjunction,a natural deduction derivation [119, p. 36] can be reduced
Σ1
Σ0
A
B to
from ∧I
A∧B
∧E
A

Σ0
A

where Σ0 and Σ1 stand for derivations with conclusions A and B respectively. In the
reduction, the occurrence of ∧ is removed. The same holds for other logical connectives;
thus we can remove maximal formulae.
Further, Prawitz [119, Chapter IV] formulated a weaker notion called maximal
segments. Above, in the definition of maximal formulae, the elimination rule must
be placed immediately below the corresponding introduction rule. Prawitz allowed
other inference lines between the introduction and elimination rules and defined maximal segments10 . A derivation without maximal segments is called normal. Prawitz
proved the existence of a normal derivation of Γ ⊢ A given any derivation of Γ ⊢ A.

10 A maximal segment can contain many occurrences of the same formula without being influenced

by any inference rules. Such “syntactic bureaucracy” can be removed by proof nets. See Section 2.6
for an example.

13

Prawitz [119] treated first-order, second-order and modal logics but we do not elaborate.
The reductions and the normal form coincide with the β-reduction and the normal
form in the typed lambda calculi under Curry-Howard isomorphism.
Prior’s Tonk
Prior [120] invented a logical connective called tonk.
φφ tonk ψψφ tonk ψ

φ tonk ψφφ tonk ψψFrom this, inversion principle requires this reduction:fromφφ tonk ψ to
ψ

φ
ψ

.

The reduct is considered nonsense because if there are any theorems all formulae must
be theorems. This is an argument refuting the tonk operator. However, in Chapter 2,
we pursue the possibility of compensating the nonsense by the dual nonsense, namely:
φ
ψ

ψ
φ

.

Prior’s paper is titled “the runabout inference-ticket.” In Chapter 2, we are going toconsider the round-trip inference-ticket.
1.3.5

Curry-Howard Isomorphism

At the core of computer science lies the interplay of static formalism and dynamic
behavior. We can find examples in typed lambda calculi, where static formalism oftype derivations interacts with dynamic behavior of lambda terms. Type derivations
are static objects associating lambda terms to types. The reduction relation on terms
gives dynamics, defining which term reduces to which. Static type derivations canguarantee dynamic properties of programs such as strong normalization [61] and more
specific properties using parametricity arguments [124].
The Curry-Howard isomorphism is originally a correspondence between intuitionistic propositional logic proofs and typed lambda terms, but the name combination
Curry-Howard has obtained a more general meaning spanning over the correspondence
between proofs and programs in general. The phrase “computational interpretation”
is most often used for the Curry-Howard isomorphism [3, 18, 99, 118]. Sørensen and
Urzyczyn [130] recently presented a comprehensive reference book on the topic, containing lots of historical and bibliographical remarks.
14Curry’s Discovery
The Curry-Howard isomorphism is originally the correspondence of the typed lambda
terms and the proofs of the implicational fragment11 of the intuitionistic propositional
logic. According to [130], the first explicit statement of the correspondence appears
in the retiring presidential address to the Association for Symbolic Logic titled “thecombinatory foundations of mathematical logic” [36]. The footnote 28 of [36] reads:
Note the similarity of the postulates for F and those for P . If in any of
the former postulates we change F to P and drop the combinator we havethe corresponding postulate for P
where a postulate for F is something like ⊢ F XY f which represents the statement thatf belongs to the class of functions from X to Y ; and P is the implicational fragmentof the intuitionistic propositional logic. On the same page, there is Postulate (PC):⊢ (β ⊃ (α ⊃ γ)) ⊃ (α ⊃ (β ⊃ γ))
and the corresponding Postulate (FC):⊢ F (F β(F αγ))(F α(F βγ))C
where C is λ3 xyz · xzy and the notation F αβ shows the functional character of afunction from α to β. The postulate (FC) is said to state the functional characterof C. In this thesis, we use sequent style natural deduction system so that these
postulates can be derived asx : β ⊃ (α ⊃ γ) ⊢ x : β ⊃ (α ⊃ γ)z:β ⊢ z:βx : β ⊃ (α ⊃ γ), z : β ⊢ xz : α ⊃ γy:α ⊢ y:αx : β ⊃ (α ⊃ γ), z : β, y : α ⊢ xzy : γ.
x : β ⊃ (α ⊃ γ), y : α ⊢ λz.xzy : β ⊃ γ
x : β ⊃ (α ⊃ γ) ⊢ λy.λz.xzy : α ⊃ (β ⊃ γ)
⊢ λx.λy.λz.xzy : (β ⊃ (α ⊃ γ)) ⊃ (α ⊃ (β ⊃ γ))
Indeed, the last sequent associates the term λx.λy.λz.xzy, which is the combinator C,
to the logical formula (β ⊃ (α ⊃ γ)) ⊃ (α ⊃ (β ⊃ γ)). Throughout this thesis, we usecolons : to combine terms with types.
Henceforth, we do not give deduction systems of a logic and typing rules for a typed
lambda calculi separately because the former can be obtained from the latter by this11 The implicational fragment of a logic can be defined by taking formulae only containing implica-

tions but no other connectives.

15

correspondence. The precise statements for the correspondence appear in Curry andFeys [37, 9E], a section titled “analogies with propositional algebra.”
Curry-Howard isomorphism provides one realization of BHK interpretation: proofs
as lambda terms where the introduction rule of implication is realized as the lambda
abstraction and the elimination rule of implication is realized as the application oflambda terms. This encoding has a desirable property: the reductions in the lambda
calculus correspond to the reductions of proofs that remove detours. For example,
suppose a natural deduction proof introduces an implication and then immediately
eliminates the implication. This proof can be encoded as a lambda term whose outermost structure is a β-redex: (λx.M )N . The result of the β-reduction M [N/x] encodesa proof tree using the same assumptions as the original and concluding the same formula as the original, yet without the aforementioned detour. A proof of implication
allows transformation of proofs by means of substitution. The encoding of proofs aslambda terms is traditionally called the Curry-Howard isomorphism.
The material implications are justified in classical propositional logic. The latterview on implication, provided by BHK-interpretation, is most naturally embodied in
the situation of intuitionistic propositional logic. The last century saw their generalization called intermediate logics [137] (or superintuitionistic logics), of which a typicalexample is Gödel-Dummett logic. In this thesis we investigate the Curry-Howard isomorphism for Gödel-Dummett logic. The Gödel-Dummett logic validates formulae ofthe form (φ ⊃ ψ) ∨ (ψ ⊃ φ), which is known as Dummett’s axiom. We add a construct to the simply typed lambda calculus that witnesses Dummett’s axiom. Afterthe intermediate logics, the generalization went further to substructural logics [57],which contains all the intermediate logics as well as the (intuitionistic) multiplicative
additive fragment of linear logic. In the later chapters, we make a typing system thatlacks contraction and weakening in Chapters 2 and 4.
Application to Programming Languages
Landin [94] noticed some similarities between ALGOL 60 syntax and the untyped
lambda calculus. Since then, many programming languages came out of the CurryHoward isomorphism: most notably so-called the ML family languages like Standard
ML [108], OCaml [109], SML# [114], Haskell [98], F# [105] and so on.
However, none has employed Dummett axiom (φ ⊃ ψ) ∨ (ψ ⊃ φ) or the Amidaaxiom12 (φ ⊸ ψ) ⊗ (ψ ⊸ φ) as a type for a language primitive.
12 For explanation of ⊗ and ⊸, see 1.3.9.

16

1.3.6Gödel-Dummett Logic

Dummett’s Axiomatization
Dummett [43] considers a semantics on {0, 1, 2, . . . , ω} where ∧ is interpreted as maxˆ where13
imum, ∨ as minimum, ⊥ as ω and implication as a function ⊃0 if x ≥ y
ˆ
x⊃y =
.

y if x < yHe axiomatized the logic by adding (p ⊃ q) ∨ (q ⊃ p) on top of the axioms for theintuitionistic propositional logic. Thomas [133] axiomatized the logic on n-element
chains using Dummett’s axiom and the formula Fn+1 that appeared in Gödel [65],which is rewritten using only implications but no disjunction or conjunction.
Sonobe’s Gentzen-Style Calculus
Sonobe [129] presented a sequent calculus for Gödel-Dummett logic and proved cutelimination theorem for it. On top of intuitionistic propositional logic, there is only
one rule. However, the number of assumptions of the rule is not constantly bounded.
The rule can have assumptions as many as any natural number. After looking at
a hyper-lambda calculus λ-GD in Chapter 3, we can translate a proof in Sonobe’s
system into a λ-GD typing derivation and then find the computational content of theoriginal proof. However, the author has never seen an attempt of determining thecomputational interpretation of Sonobe’s cut-elimination.
Avron’s Hypersequents
Avron [8] invented the hypersequent calculus. A hypersequent is a finite sequence ofsequents:Γ0 ⊢ φ0Γ 1 ⊢ φ1···

Γ n ⊢ φn(n ≥ 0) .

We use metavariable H for a hypersequent. For Gödel-Dummett logic, Avron [8]formulated the communication ruleH0

Γ′0 , Γ0 ⊢ φ0H1

Γ′1 , Γ1 ⊢ φ1

H0H1

Γ′1 , Γ0 ⊢ φ0

Γ′0 , Γ1 ⊢ φ1.

The rule contains no logical connectives. That means in order to apply the rule, we
do not have to pattern-match formulae except comparing whether two formulae are
identical or not. Such a rule is called a structural rule as opposed to a logical rule.
13 To be precise, Dummett did not use absurdity ⊥ but negation ¬ although they are interdefinable

in existence of implication ⊃ and conjunction ∧.

17

For the hypersequent calculus with the communication rule, Avron [8] showed cutelimination theorem. He asked what is the computational content of Gödel-Dummettand other intermediate logics (see the beginning of Chapter 3 for quotation).
1.3.7

Waitfreedom

A waitfree protocol over shared memory [71] assigns a program to each process within
the restriction that no process waits for another process. Some tasks can be solved bya well-chosen waitfree protocol while the others cannot. For example, it is waitfreely
impossible for each processes to attain the input values of the other processes. On theother hand, it is waitfreely possible for at least one of the processes to attain the input
values of the other processes.
Herlihy and Shavit [72] characterized waitfree computation using simplicial topology. Using their characterization, Gafni and Koutsoupias [56] showed that it is undecidable whether a task is waitfreely solvable or not.
1.3.8

Intermediate (Superintuitionistic) Logics

In this thesis, a logic is a set of logical formulae that is closed under substitution andmodus ponens14 . Elements of a logic are called theorems. The substitution-closedness
means that if φ is a theorem, φ[ψ/X] (i.e. the logical formula obtained by replacing all
occurrences of X with ψ) is also a theorem. By modus ponens closedness, if φ ⊃ ψ (orφ ⊸ ψ) and φ are theorems, ψ is also a theorem. An intermediate logic is a consistentlogic that contains the intuitionistic propositional logic. A logic is consistent when it
does not contain all logical formulae.
Early intermediate logicians seem to have focused on algebraic aspects on intermediate logics in general. Troelstra [47, p. 223] writes “the reasons for studying
intermediate logics are mainly technical.” In a survey paper, Hosoi and Ono [82] say:
The study of intermediate logics seems to have two aspects: One is to study
particularities of a certain logic, and the other is to take the intermediate
logics as a whole and to study the relations between the logics or somestructures recognized in that system. We think that an intermediate logic
is simply an algebraic system bearing some structural resemblance to thelogic in the usual sense and that it is not a logic on which some kind ofmathematics can or must be constructed. So, the second approach seems to
14 There are, however, logics not closed for substitution such as dynamic epistemic logic [140] andinquisitive logic [32]. Thus in general it would be fair to say that a logic is a set of logical formulae.

18

be reasonable for us, and we have been mostly working with the intensionof grasping the algebraic structure of the whole system of the intermediate
logic15 .
Their approach has been successful. One spectacular result by Maksimova [96] statesthat there are only seven consistent superintuitionistic logics with the Craig interpolation property. The Craig interpolation property holds for a logic L iﬀ α ⊃ β ∈ Limplies existence of a formula χ such that α ⊃ χ, χ ⊃ β ∈ L and χ only contains
propositional variables that appear in both α and β. The seven logics include the intuitionistic propositional logic, the logic of the weak excluded middle, Gödel-Dummett
logic and classical logic. Although the Craig interpolation property is useful for program verification [45, 100, 138], the above result itself is only of theoretical interest.
We take the first approach described by Hosoi and Ono: namely, studying particular logics instead of intermediate logics in general. This thesis is about particular
logics: Gödel-Dummett logic and Abelian logic. We claim that these logics can beused for developing programming languages. The Curry-Howard isomorphism justifies our investigation of these particular logics. Gödel-Dummett logic is one typicalintermediate logic. Abelian logic, on the other hand, is not an intermediate logic because it lacks structural rules called weakening and contraction. Such logics are called
substructural logics, whose history will be followed in 1.3.9.
We have to note that there have been attempts to apply some intermediate logics
for mathematical reasoning, especially the truth theory. Hájek et al. [68] tried to use
Lukasiewicz logic in order to resolve the liar’s paradox. The idea is to assign the truth
value 0.5 to the sentence “this sentence is false.” When a sentence has the truth value x,
a sentence that claims falsehood of the first sentence should have the truth value 1 − x.
When the first and second sentences are identical, it should have the truth value 0.5.
Using Lukasiewicz logic, Hájek et al. [68] worked in Peano arithmetic and found aconsistent formulation (in the sense there exists a model to each finite subtheory).
However, in the case of axiomatic set theory with comprehension, Hájek [67] showedthat having induction over natural numbers is contradictory16 .
Computationally inclined research on intermediate logics can be found in proof
searching. The most typical intermediate logic, Gödel-Dummett logic has many proof
searching implementations. Currently, the fastest solver the author is aware of isFiorino’s EPDL [50]. Fiorino benchmarked his and other implementations on a problem set for intuitionistic logic called ILTP library [121]. Related to proof searching,
15 Emphases by the authors of the original paper.
16 Yatabe [148] found an easier proof of this.

19Fermüller [48] gave a game semantics for Gödel-Dummett logic, which is based on
Lorenzen game [130] and essentially proof searching bottom-to-up. The game contains concurrent subgames but he gave no explicit mentions on waitfree computation.
On the other approach of proof reduction, there have been no lambda calculi or
programming languages based on intermediate logics, despite the fact cut-elimination
results are obtained by Sonobe [129] and Avron [8].
1.3.9

Substructural Logics

In sequent calculus or the sequent style natural deduction, when we apply most rules,
we need to make pattern matching on the logical formulae. For example, in order toapply this ∧L rule of sequent calculus for classical logic,∧LΓ, φ, ψ ⊢ ∆Γ, φ ∧ ψ ⊢ ∆we have to find a formula on the left hand side sequent whose top connective is ∧.
Today, the logics without some structural rules are called substructural logics, thesmallest of which is called the full Lambek calculus (FL). There have been intensive
studies on substructural logics mainly from the algebraic approach [57].
Throughout this thesis, we consider only logics with the structural rule calledexchange. The exchange rule allows permutation of formulae in contexts. The wellknown substructural logics with the exchange rule are shown in Figure 1.1.
BCI and BCK Logics
When we add exchange rule to FL, we obtain BCI logic. Further, when we add
weakening to BCI logic, we obtain BCK logic [116]. BCK logic has three axioms
named after well-known combinators. Indeed, the logic can be characterized as thesmallest set closed under modus ponens and substitution that contains(B) (φ ⊃ ψ) ⊃ ((χ ⊃ φ) ⊃ (χ ⊃ ψ))(C) (φ ⊃ (ψ ⊃ χ)) ⊃ (ψ ⊃ (φ ⊃ χ)) and(K) φ ⊃ (ψ ⊃ φ) .
From these, by modus ponens and substitution, (I) φ ⊃ φ follows, but (W) (ψ ⊃ (ψ ⊃φ)) ⊃ (ψ ⊃ φ) does not follow17 . Thus, the left hand side contraction is not admissible
in the sequent calculus for the BCK logic. A rule
17 Here, the capital alphabet W is a name of a combinator.

rule weakening.

20

Elsewhere, W stands for a structuralS
S′
is admissible iﬀ E ′ is derivable whenever E is.
Linear Logics
Girard found the linear logic [59]. To explain this logic, let us present two formulationsof the ∧-right rule in the sequent calculus of intuitionistic propositional logic:
Γ⊢φ
Γ⊢ψ
Γ⊢φ∧ψ

Γ⊢φ
∆⊢ψ
Γ, ∆ ⊢ φ ∧ ψUsing one of these rule, the other can be defined as a macro (an abbreviation fora longer construction) because, from bottom to top, we can copy (contraction) or
remove (weakening) formulae in contexts. However if we do not allow such structural
rules, the two diﬀerent formulations characterize diﬀerent conjunctions. The left one
is called multiplicative conjunction and the right one is called additive conjunction.
Γ⊢φ
Γ⊢ψ
Γ⊢φ&ψ

Γ⊢φ
∆⊢ψ
Γ, ∆ ⊢ φ ⊗ ψIn general, a binary operator is called multiplicative (resp. additive) when the rightrule in sequent calculus (or introduction rule in natural deduction) for the operator
splits the context (resp. copies the whole context in all branches). The example aboveshows how the additive and multiplicative conjunctions are diﬀerent. The words multiplicative and additive are originally adjectives but we sometimes use them as nouns:“multiplicatives” for the multiplicative operators and “additives” for the additive operators.
Additive implication can be defined [135, Ch. 4] using additive disjunction, but themultiplicative implication ⊸ has a more important role because our interpretation of⊢ symbol in a sequent is the multiplicative implication. This is shown by the following
invertible18 rule:Γ, φ ⊢ ψΓ⊢φ⊸ψ

.

In the intuitionistic linear logic, the right side of a sequent can only contain at mostone formula. Abramsky [3] gave computational interpretations for the intuitionistic
linear logic and the classical linear logic. Since we will extend his linear lambda calculus
in Chapter 2, we are going to elaborate on Abramsky’s lambda calculus there.

18 When a rule is changed upside-down and stay admissible, the rule is called invertible.

21

Abelian Logic
Meyer and Slaney [104] and Casari [27] found Abelian logic independently. Meyer
and Slaney’s motivation was bringing the theory of relevant logics closer to grouptheory. Casari [27] mentions arguments about comparative propositions in treated in
Aristotle’s Topics:
x is more (less, as much as) A than yand so on [27, p. 161]. One semantics of Abelian logic interprets a logical formula
as an element of a lattice-ordered Abelian group [57, 3.4.2.]. There, the interpretation of 1 is the unit; the interpretation of ⊗ is the operation of the group; and theinterpretation of · ⊸ 1 is the inverse element. Abelian logic is an important example in algebraic semantics of logics because Abelian logic is complete with respect tothe lattice-ordered group Z of integers [57, pp. 107-108]. Metcalfe et al. [103] gave a
deduction system for Abelian logic, which “almost” [103, after Definition 8] has the
subformula property. Metcalfe [102] gave a hypersequent calculus for Abelian logic andproves cut-elimination [102, Theorem 5] for the hypersequent calculus. In Chapter 2,
we provide a lambda-calculus based on another hypersequent calculus. Our formulation use conjunctive hypersequents, which allow us to encode a process calculus in ourhyper-lambda calculus in a straightforward way (Section 2.4).
Proof Nets and the Amida Lotteries
Proof nets are graphical representation of proofs. Some diﬀerent sequent calculus
proofs are translated into the same proof net because the original proofs are only
diﬀerent in cosmetic ways (like which rule to apply first and exchanges of elements
in a sequent). The succinct representation comes with the cost of specifying thecorrectness condition for such graphical structures. There have been intensive studies
on proof nets, which started with Girard [59] and Danos and Regnier [39].
We are going to treat the intuitionistic version of multiplicative linear logic, andits proof nets are based on the Amida lotteries. The Amida lottery is a traditional
way to generate permutations on a set in an obfuscated way. Japanese schoolchildren
use the Amida lotteries for assigning seats, jobs, teams and so on to classmates. The
diagram defines a permutation. From a top end, one can find the counterpart byfollowing the vertical line, but one has to cross the bridge whenever one finds one andthen after crossing the bridge, one has to go down the vertical line. An example isgiven in Figure 1.2.

22

Nozomiwatering
ﬂowers

Ken

Yuko

Taro

clearing
blackboards

feeding
Hamsters

chairing
meetings

Figure 1.2: An example of Amida lotteries. Nozomi clears blackboards; Ken waters
flowers; Yuko chairs meetings; and Taro feeds Hamsters.

1.4

To the Next Chapters

Each chapter can be read independently. Chapter 2 treats a synchronous hyper-lambda
calculus and Chapter 3 deals with an asynchronous one. The operational semantics is
simpler in the synchronous case while the type system is more exotic in the synchronouscase. The asynchronous one is apt for shared-memory implementation. Chapter 4
treats another asynchronous hyper-lambda calculus based on monoidal t-norm logic.
In this chapter, we analyze the prelinearity axiom (φ ⊸ ψ) ⊕ (ψ ⊸ φ) using theparametricity argument. Chapter 5 implements a hyper-lambda calculus similar tothat in Chapter 3 using Haskell.

23

Chapter 2
A Synchronous Hyper-Lambda Calculus

2.1

Introduction

There is a PhD student who says:
I bought a pair of wooden shoes in Amsterdam. I put a coin in the left
and a key in the right. Next morning, I found those objects in the opposite
shoes: the key in the left and the coin in the right. The same experiments
succeeded even if the shoes were put in distance, one in university and one
at home. After every night, I found arbitrary objects swapped in the pairof wooden shoes. This fast transfer method might have helped merchantsof the Dutch East India Company (VOC) to swap objects between Asia
and Europe.
We do not claim existence of such shoes, but propose a similar programming abstraction in the context of typed lambda calculi.
We propose a way to unify ML-style programming languages [98, 108] and πcalculus [107]. “Well-typed expressions do not go wrong,” said Milner [106]. However,when communication is involved, how to maintain the principle is not yet settled. For
example, Haskell, which is an ML-style programming language, allows diﬀerent threads
to communicate using a kind of shared data store called an MVar mv of type MVar a,with commands putMVar mv of type a -> IO () and takeMVar mv of type IO a1 .
The former command consumes an argument of type a and the consumed argument
appears from the latter command. However, if programmers make mistakes, thesecommands can cause a deadlock during execution even after the program passes type
1 The arrow -> shows implication ⊃ and the tuple () shows the unit type 1. In Haskell, a commandof type type a -> IO b takes an input of type a and produces a result of type b during execution.

24

checking. This is because the type system of Haskell allows programmers to use only
one of the sender and the receiver. Fundamentally, this is because the type system of
Haskell is based on intuitionistic logic, which allows throwing away proofs.
As a remedy, we invent a typed lambda calculus where the user is forced to use
both sending and receiving primitives. For that we use the technique of linear types.
Linear types are refinements of intuitionistic types. Diﬀerently from intuitionistic
types, linear types can specify a portion of program to be used just once.
Linear types are used by Wadler [146] and Caires and Pfenning [26] to encode
session types, but our type system can type processes that Wadler and Pfenning’s
system cannot.
As intuitionistic types are based on intuitionistic propositional logic, linear types
are based on linear logic. From the intuitionistic linear logic, the only addition is the
Amida axiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ). We will see that the resulting logic is identical
to Abelian logic [27] up to provability of formulae. In the Amida calculus, we can
express π-calculus-like processes as macros. Our initial motivation was just studying
the axiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ)2 . From the viewpoint of typed lambda calculi, anatural way to add the axiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ) is to add a pair of primitives c
and c̄ so that · · · ct · · · c̄u · · · reduces to · · · u · · · t · · · : in words, c returns c̄’s argument
and vice versa. We can obtain the send-receive communication when we specialize
the axiom as (φ ⊸ 1) ⊗ (1 ⊸ φ); the left hand side c of type φ ⊸ 1 is the sending
primitive and the right hand side c̄ of type 1 ⊸ φ is the receiving primitive. The
sending primitive consumes a data of type φ and produces a meaningless3 data of unit
type 1. The receiving primitive takes the meaningless data of type 1 and produces adata of type φ.
Later in this chapter, we address some questions.
• Due to addition of the Amida axiom, is it the case that every type is inhabited4 ?
In other words, is the resulting type system inconsistent? Our answer is no(Theorem 2.5.2).
• Can we generalize the channels to serve more complicated protocols than oneshot send-receive communication? Our answer is yes (Section 2.4).

2 Takeuti Izumi asked about conjunctions after the author talked about (φ ⊸ ψ) ⊕ (ψ ⊸ φ).
3 As we will see, since 1 is a provable formula in Abelian logic, the Amida calculus is equippedwith a way to obtain a data of type 1 for free.
4 A type φ is inhabited iﬀ there is a closed term t with ⊢ t : φ derivable using the derivation rulesin Figure 2.1.

25

• Can we implement process calculi and session types using these communication
primitives? Our answer is yes (Section 2.4).
After following these practical questions, we proceed to developing a proof net
structure for the multiplicative fragment of the resulting logic (Section 2.6). Our
solution involves the structure of “the Amida lottery,” which is a traditional Japanese
way of making arbitrary permutations.

2.2

Definitions

2.2.1

Types

We assume a countably infinite set of propositional variables, for which we use letters
X, Y and so on. We define a type φ by BNF:
φ ::= 1 | X | φ ⊗ φ | φ ⊸ φ | φ ⊕ φ | φ & φ .
A formula is a type. As the typing rules (Figure 2.1) reveal, ⊗ is the multiplicative
conjunction, ⊸ is the multiplicative implication, ⊕ is the additive disjunction and &is the additive conjunction.
2.2.2

Terms and Free Variables

We assume countably infinitely many variables x, y, z, . . .. Before defining terms, following Abramsky’s linear lambda calculus LF [3], we define patterns binding sets ofvariables:• ∗ is a pattern binding ∅,• ⟨x, ⟩ and ⟨ , x⟩ are patterns binding {x},• x ⊗ y is a pattern binding {x, y}.
All patterns are from Abramsky’s LF [3]. Using patterns, we inductively define aterm t with free variables S. We assume countably infinitely many channels withinvolution satisfying c̄ ̸= c and c̄¯ = c.
• ∗ is a term with free variables ∅,• a variable x is a term with free variables {x},• if t is a term with free variables S, u is a term with free variables S ′ , and moreover
S and S ′ are disjoint, then t ⊗ u and tu are terms with free variables S ∪ S ′ ,26• if t and u are terms with free variables S, then ⟨t, u⟩ is a term with free variables S,• if t is a term with free variables S, then inl(t) and inr(t) are terms with freevariables S,• if t is a term with free variables S ∪ {x} and x is not in S, then λx.t is a termwith free variables S,• if t is a term with free variables S, p is a pattern binding S ′ , u is a term withfree variables S ′ ∪ S ′′ and equalities S ∩ S ′′ = S ′ ∩ S ′′ = ∅ hold, then, let t be p in u
is a term with free variables S ∪ S ′′ ,• if t is a term with free variables S, u is a term with free variables S ′′ ∪ {x}, v isa term with free variables S ′′ ∪ {y}, x, y ∈/ S ′′ and S ∩ S ′′ = ∅ hold, thenmatch t of inl(x).u/inr(y).v
is a term with free variables S ∪ S ′′ , and• if t is a term with free variables S, then ct is also a term with free variables S
for any channel c.
Only the last clause is original, introducing channels, which are our communication
primitives. Note that a term with free variables S is not a term with free variables S ′when S and S ′ are diﬀerent (even if S is a subset of S ′ ). In other words, the set offree variables F V (t) is uniquely defined for a term t. We introduce an abbreviation
ign ϵ in t ≡ t→−
ign s0 , −s in t ≡ let s0 be ∗ in (ign →s in t)→inductively for a sequence of terms −s . Here ϵ stands for the empty sequence. The
symbol ign is intended to be pronounced “ignore.”
2.2.3

Typing Derivations

On top of Abramsky’s linear lambda calculus LF [3], we add a rule to make a closed
term of type (φ ⊸ ψ) ⊗ (ψ ⊸ φ). A context Γ is a possibly empty sequence of variables associated with types where the same variable appears at most once. A context
x : X, y : Y is allowed, but x : X, x : Y or x : X, x : X is not a context. A hypersequent is
inductively defined as
O ::= ϵ | (Γ ⊢ t : φ27O)where Γ is a context. Each Γ ⊢ t : φ is called a component of a hypersequent. In
this chapter, we interpret the components conjunctively. Diﬀerently from the previous
papers [8–10, 12], here, the hypersequent Γ ⊢ φ∆ ⊢ ψ is interpreted as the⊗⊗⊗
conjunction of components: ( Γ ⊸ φ) ⊗ ( ∆ ⊸ ψ) whereΓ stands for the⊗-conjunction of elements of Γ. The conjunctive treatment is our original invention,and finding an application of such a treatment is one of our contributions5 . We namethis technique the conjunctive hypersequent.
The typing rules of the Amida calculus are in Figure 2.1. When ⊢ t : φ is derivable,
the type φ is inhabited .
Example 2.2.1 (Derivation of the Amida axiom) The type (φ ⊸ ψ) ⊗ (ψ ⊸ φ)is inhabited by the following derivation.
Ax
Ax
x:φ ⊢ x:φy:ψ ⊢ y:ψMerge
x:φ ⊢ x:φy:ψ ⊢ y:ψSync
x : φ ⊢ cx : ψ
y : ψ ⊢ c̄y : φ⊸R⊢ λx.cx : φ ⊸ ψ
y : ψ ⊢ c̄y : φ⊸R⊢ λx.cx : φ ⊸ ψ⊢ λy.c̄y : φ ⊸ φ⊗R⊢ (λx.cx) ⊗ (λy.c̄y) : (φ ⊸ ψ) ⊗ (φ ⊸ φ)
Another example shows how we can type the term c̄(cx).
Ax
Ax
x:φ ⊢ x:φy:ψ ⊢ y:ψMerge
x:φ ⊢ x:φy:ψ ⊢ y:ψSync
x : φ ⊢ cx : ψ
y : ψ ⊢ c̄y : φ
Cutx : φ ⊢ c̄(cx) : φ
2.2.4

Interaction with Contraction and Weakening

The Amida calculus has two strong properties about the missing structural rules:
weakening and contraction. We first state the property about specialized contraction
rules. Informally, if one can duplicate a proof of φ into two, then, one can obtain a
proof of φ from nothing by first borrowing a proof of φ, second duplicating the proof
into two and finally returning one of the two proofs.
Proposition 2.2.2 For any formula φ, if the specialized contraction rule (here, weomit variables and terms)
CφOφ, φ, Γ ⊢ ψOφ, Γ ⊢ ψ

5 We have to note however, for Abelian logic, there is an ordinary disjunctive hypersequent systemthat enjoys cut-elimination. The conjunctive hypersequents reflect some computational intuition.

28

Ax

IE

O

Γ, x : φ, y : ψ, ∆ ⊢ t : θOΓ, y : ψ, x : φ, ∆ ⊢ t : θ

1R

⊢ ∗:1

1L

Sync

O

O
O

∆ ⊢ u:ψOΓ ⊢ ct : ψ∆ ⊢ c̄u : φ
O

O

O
O

⊸L

O′

O

∆ ⊢ u:ψΓ ⊢ t:φO′⊗ROΓ ⊢ t:φ∆ ⊢ u:ψOΓ, ∆ ⊢ t ⊗ u : φ ⊗ ψOOΓ ⊢ t:φx : ψ, ∆ ⊢ u : θΓ, f : φ ⊸ ψ, ∆ ⊢ u[(f t)/x] : θΓ, x : φ ⊢ t : θΓ, z : φ & ψ ⊢ let z be ⟨x, ⟩ in t : θOOOΓ ⊢ t:φΓ ⊢ u:ψΓ ⊢ ⟨t, u⟩ : φ & ψΓ, y : ψ ⊢ t : θΓ, z : φ & ψ ⊢ let z be ⟨ , y⟩ in t : θΓ ⊢ t:φ⊕R1

Γ ⊢ inl(t) : φ ⊕ ψ⊕L∆ ⊢ u:ψΓ, z : φ ⊗ ψ ⊢ let z be x ⊗ y in t : θ

&R

⊕R0

Γ ⊢ t:φΓ, x : φ, y : ψ ⊢ t : θΓ ⊢ λx.t : φ ⊸ ψ&L1Γ, ∆ ⊢ u[t/x] : ψ(c and c̄ uniquely introduced here)Γ, x : φ ⊢ t : ψOx : φ, ∆ ⊢ u : ψOΓ, z : 1 ⊢ ign z in t : φΓ ⊢ t:φΓ ⊢ t:φOΓ ⊢ t:φ

O

&L0

O

Cut

EE

O

⊗L

⊸R

O′
O′

Merge OO

x:φ ⊢ x:φOOΓ ⊢ u:ψΓ ⊢ inr(u) : φ ⊕ ψΓ, x : φ ⊢ u : θΓ, y : ψ ⊢ v : θΓ, z : φ ⊕ ψ ⊢ match z of inl(x).u/inr(y).v : θ

Figure 2.1: The typing rules of the Amida calculus. O and O′ stand for hypersequents.
Most rules are straightforward modification of Abramsky’s rules [3]. The Sync rule isoriginal. Rules &R and ⊕L are only applicable to singleton hypersequents.

29

is admissible for any hypersequent O, context Γ and formula ψ, then, φ is inhabitedin the Amida calculus.
Proof By the following derivation.
1R
Ax
⊢ ∗:1
x:φ ⊢ x:φ
Merge
⊢ ∗:1
x:φ ⊢ x:φSync
Ax
⊢ c∗ : φx : φ ⊢ c̄x : 1
y:φ ⊢ y:φMerge
⊢ c∗ : φx : φ ⊢ c̄x : 1
y:φ ⊢ y:φ⊗R
Ax
⊢ c∗ : φx : φ, y : φ ⊢ c̄ ∗ ⊗y : 1 ⊗ φ
z :φ ⊢ z :φCφ1L
⊢ c∗ : φx : φ ⊢ c̄x ⊗ x : 1 ⊗ φ
k : 1, z : φ ⊢ ign k in z : φCut⊗L⊢ (c̄(c∗)) ⊗ (c∗) : 1 ⊗ φz : 1 ⊗ φ ⊢ let z be k ⊗ z in ign k in z : φMerge⊢ (c̄(c∗)) ⊗ (c∗) : 1 ⊗ φz : 1 ⊗ φ ⊢ let z be k ⊗ z in ign k in z : φCut⊢ let (c̄(c∗)) ⊗ (c∗) be k ⊗ z in ign k in z : φwhere Cφ marks the step where the specialized contraction is used.

■

The admissibility of contraction rule Cφ is equivalent to derivability of φ ⊢ φ ⊗ φ,
thanks to ⊗R rule and ⊗L rule.
Remark 2.2.3 (Incompatibility of the bang modality) By this proposition, if weare to introduce the bang modality [59] of linear logic, then any formula of the form
!φ is a theorem. This is because !φ ⊸!φ⊗!φ is a theorem in intuitionistic linear logic.
We state another fact, which is known to Casari [27] who wrote “in the ℓ-logic
there are no ‘additive extrema.’”Corollary 2.2.4 (Incompatibility of additive disjunctive unit) If there is a formula 0 such that 0 ⊢ φ is derivable for any formula φ, then 0 is provable. As aconsequence, any formula is provable i.e. the resulting logic is inconsistent.
Further, this implies that the Amida calculus is incompatible with the second orderuniversal quantification. The second order universal quantification adds a form oftype ∀Xφ and two type derivation rules:∀ROOΓ ⊢ t:φΓ ⊢ t : ∀X.φ

∀L

(X not free in O or Γ)O

x : ψ[θ/X], Γ ⊢ t : φO

x : ∀X.ψ, Γ ⊢ t : φ.

Corollary 2.2.5 (Incompatibility of the second order universal quantification)
If we add the second order universal quantification to the Amida calculus, the resulting
logic is inconsistent.
30

Proof Corollary 2.2.4 is applicable because x : ∀X.X ⊢ x : φ is derivable for any φ. ■Next we state the incompatibility of the weakening rule and Abelian logic. Afterseeing that the Amida calculus characterizes Abelian logic, the fact is an immediate
consequence of completeness of Abelian logic with respect to Z [104, p. 272], but we
can now give a computational interpretation: of the communicating pair c : φ ⊸ ψand c̄ : ψ ⊸ φ, with the help of weakening, we can throw away one primitive c̄ andstill use the other primitive c.
Proposition 2.2.6 (Incompatibility of weakening with Abelian logic) If we add
the weakening rule
W

H

Γ⊢ψ

H

φ, Γ ⊢ ψ

to Abelian logic (where we omit variables and terms), the resulting logic is inconsistent.
Proof Any formula φ is provable by the following derivation tree.
Ax
Ax
⊢ ∗:1
x:φ ⊢ x:φ
Merge
⊢ ∗:1
x:φ ⊢ x:φSync
⊢ c∗ : φx : φ ⊢ c̄x : 1⊸R⊢ c∗ : φ⊢ λx.c̄x : φ ⊸ 1
W
f : φ ⊸ 1 ⊢ c∗ : φ⊢ λx.c̄x : φ ⊸ 1
Cut⊢ c∗ : φwhere W marks the usage of weakening. The resulting term c∗ sends ∗ somewhere
and waits for a response that is never sent back.

■To summarize, anything below is inconsistent with the Amida calculus:• a formula 0 such that ⊢ 0 ⊸ φ is derivable for all φ,• the second order universal quantification,• contraction rule, or• weakening rule.
Although various extensions to the Amida calculus yield inconsistency, we will see that
the Amida calculus itself is consistent because it characterizes Abelian logic (Theorem 2.5.1, Theorem 2.5.2).

31

2.2.5

Evaluation

As a programming language, the Amida calculus is equipped with an operationalsemantics that evaluates some closed hyper-terms into a sequence of canonical forms.
The canonical forms are the same as those of Abramsky’s LF [3]:⟨t, u⟩

∗

v⊗w

λx.t

inl(v)

inr(w)

where v and w are canonical forms and t and u are terms.
An evaluation sequence E is defined by the following grammar:
E ::= ϵ | (t ⇓ v

E)where v is a canonical form.
Now we define evaluation as a set of evaluation sequences (Figure 2.2). Thoughmost rules are similar to those of Abramsky’s LF [3], we add the semantics for channels.

2.3

Type Safety

When we can evaluate a derivable hypersequent, the result is also derivable. Especially,
this shows that, whenever a communicating term is used, the communicating term
is used according to the types shown in the Sync rule occurrence introducing thecommunicating term.
Theorem 2.3.1 (Type Preservation of the Amida calculus) If terms t0 , . . . , tn
have a hypersequent ⊢ t0 : φ0
v0

···

···

⊢ tn : φn and an evaluation sequence t0 ⇓tn ⇓ vn derivable, then
⊢ v0 : φ 0···⊢ vn : φnis also derivable.
Proof By induction on evaluation using the propositions below. We classify thesituation by the last rule used.
(Merge) By Proposition 2.3.2, we can use the induction hypothesis.
(let t be ⟨x, ⟩ in u) By Proposition 2.3.3, we can use the induction hypothesis.
(Other cases) Similar to above.

■

Two hypersequents O and O′ are channel-disjoint iﬀ it is not the case that O
contains c and O′ contains c̄ for any channel c.
32

∗⇓∗

E

t⇓∗

u⇓v

E

t⇓v

E

ign t in u ⇓ v

Et⊗u⇓v⊗w

Eu⇓w

u[v/x, w/y] ⇓ v ′t⇓v⊗w

let t be x ⊗ y in u ⇓ v ′E

E′
Merge E
E
E′
(For any channel c, it is not the case that E contains c and E ′ contains c̄.)E

λx.t ⇓ λx.t

E
E

t⇓v

u⇓w

E

ct ⇓ wc̄u ⇓ v

Et ⇓ t′s ⇓ s′E′Es ⇓ s′t ⇓ t′E′

E

E

u[t0 /x] ⇓ w

let t be ⟨x, ⟩ in u ⇓ w
t ⇓ ⟨t0 , t1 ⟩E

u[t1 /y] ⇓ w

let t be ⟨ , y⟩ in u ⇓ wt⇓v

Einl(t) ⇓ inl(v)Etu ⇓ w(E, t and u do not contain c or c̄.)t ⇓ ⟨t0 , t1 ⟩EE

t ⇓ inl(v)t′ [v/x] ⇓ wu⇓v⟨t, u⟩ ⇓ ⟨t, u⟩EEt ⇓ λx.t′Eu[v/x] ⇓ w

Ematch t of inl(x).u/inr(y).u′ ⇓ w

Et ⇓ inr(v)u⇓w

inr(u) ⇓ inr(w)u′ [v/y] ⇓ wmatch t of inl(x).u/inr(y).u′ ⇓ w

Figure 2.2: The definition of evaluation relation of the Amida calculus. E is possibly
the empty evaluation sequence. The whole system is based on Abramsky’s LF. Notethat the results of evaluation are always canonical forms.
Proposition 2.3.2 (Split) If a type derivation leading to O

O′ exists for twochannel-disjoint hypersequents, both O and O′ are derivable separately.
Proof By induction on the type derivation. Notice that all typing rules except Sync
touches only one component. Notice also that all typing rules preserve channels from
top-to-bottom, i.e., if a component in the assumption of a rule contains a channel, thenthere is a unique corresponding component in the conclusion of the rule containing
the same channel.

■

33

Proposition 2.3.3 (Inversion on &L) If OΓ ⊢ let t be ⟨x, ⟩ in u : θ is derivable,

then there is a partition of Γ into Γ0 and Γ1 (up to exchange) such that O
t:φ & ψ

Γ1 , x : φ ⊢ u : θ is derivable.

Proof By induction on the original derivation.
2.3.1

Γ0 ⊢

■

Lack of Convergence

Convergence states that whenever a closed term t is typed ⊢ t : φ, then an evaluationt ⇓ v is also derivable for some canonical form v. It is a desirable property so that
Abramsky [3] proves it for LF, but there are at least two kinds of counter examples
for convergence of the Amida calculus.
Nested Channel Pairs
Consider a typed term:
1R
⊢ ∗:1
⊕R
Ax
x:1 ⊢ x:1
⊢ inl(∗) : 1 ⊕ 1
Merge
x:1 ⊢ x:1
⊢ inl(∗) : 1 ⊕ 1
Sync
x : 1 ⊢ cx : 1 ⊕ 1⊢ c̄(inl(∗)) : 1
Cut⊢ c(c̄(inl(∗))) : 1 ⊕ 1with no evaluation. When we think about why this process does not have an evaluation,
one explanation is this process is deadlocked. In order to evaluate this closed term,
we can add the following eval-subst rule:eval-subst

E

t⇓v
E

u[v/x] ⇓ wu[t/x] ⇓ w

so that the following evaluation is possibleeval-subst

∗⇓∗

∗⇓∗
inl(∗) ⇓ inl(∗)∗⇓∗

inl(∗) ⇓ inl(∗).

c∗ ⇓ inl(∗)
c̄(inl(∗)) ⇓ ∗c(c̄(inl(∗))) ⇓ inl(∗)

However, adding the eval-subst rule breaks the current proof of Theorem 2.3.1 (safety),
but with some modifications, the safety property can possibly be proved. Even if wetry that, we must face the real diﬃculty for finding an operational semantics withconvergence.

34

Channels Sending Bound Variables
Consider a typed term:
Ax
1R
⊢ ∗:1
Merge x : X ⊢ x : X
x:X ⊢ x:X
⊢ ∗:1
Sync
x : X ⊢ cx : 1⊢ c̄∗ : X⊸R
⊢ λx.cx : X ⊸ 1⊢ c̄∗ : X.

If convergence holds, there must be an evaluation
λx.cx ⇓ λx.cxc̄∗ ⇓ v .

When the right component c̄∗ ⇓ v is introduced, the introduction must use an assumption of the form x ⇓ v. However, open terms have no evaluation. Explicit
substitutions [1] might be helpful here. Note that, although the above example posesa diﬃculty for convergence, the above example does not witness a deadlock.
Regaining Convergence
Since any thunk6 can be evaluated, we can enclose any typed term t of type φ withina thunk λx.t of type 1 ⊸ φ so that λx.t ⇓ λx.t is derivable.
2.3.2

Determinacy

Determinacy states that if t ⇓ v and t ⇓ w hold, then v and w are identical. Since ourevaluation is given to possibly multiple terms at the same time, it is easier to prove amore general version.
Theorem 2.3.4 (General Determinacy of the Amida calculus) If
t 0 ⇓ v0t 1 ⇓ v1···tn ⇓ vnt0 ⇓ w0t1 ⇓ w1···

tn ⇓ wnandhold, then each vi is identical to wi .
Proof By induction on the height of evaluation derivation. Each component in the
conclusion has only one applicable rule. Also, the order of decomposing diﬀerent
components is irrelevant (the crucial condition is freshness of c and c̄ in Figure 2.2).■

6 A thunk is a lambda abstraction λx.t whose type is 1 ⊸ φ.

35

2.4

Session Types and Processes as Abbreviations

In order to see the usefulness of the communication primitives, we try implementing
a process calculus and a session type system using the Amida calculus.
2.4.1

Session Types as Abbreviations

As an abbreviation, we introduce session types. Session types [78, 131] can specify acommunication protocol over a channel. The following definitions and the descriptions
are modification from Wadler’s translations and descriptions of session types [146].
The notation here is diﬀerent from the original notation by Takeuchi, Honda andKubo [131].
!φ ψ ≡ φ ⊸ ψoutput a value of φ then behave as ψ?φ ψ ≡ φ ⊗ ψ

input a value of φ then behave as ψ⊕{li : φi }i∈I ≡ φ0 & · · · & φn ,I = {0, . . . , n}select from φi with label li&{li : φi }i∈I ≡ φ0 ⊕ · · · ⊕ φn ,I = {0, . . . , n}oﬀer choice of φi with label li

end ≡ 1terminator

where I is a finite downward-closed set of natural numbers like {0, 1, 2, 3}. As Wadler [146]notes, the encoding looks opposite of what some would expect, but as Wadler [146]explains, we are typing channels instead of processes.
The grammarφ, ψ ::= end | X | !φ ψ | ?φ ψ | ⊕{li : φi }i∈I | &{li : φi }i∈I
covers all types.
A linear type (φ∼ possibly with subscript) is generated by this grammar:∼φ∼ ::= end | !ψ φ∼ | ?ψ φ∼ | ⊕{li : φ∼i }i∈I | &{li : φi }i∈I

We define duals of linear types. Again the definition is almost the same as Wadler [146]’s
except that end is self-dual.
!ψ φ∼ = ?ψ φ∼?ψ φ∼ = !ψ φ∼∼⊕{li : φ∼i }i∈I = &{li : φi }i∈I∼&{li : φ∼i }i∈I = ⊕{li : φi }i∈I

end = end .

36

2.4.2

Processes as Abbreviations

We define the sending and receiving constructs of process calculi as abbreviations:x⟨u⟩. t ≡ t[(xu)/x]

send u through channel x and then use x in tx(y). t ≡ let x be y ⊗ x in t

receive y through channel x and use x and y in t

0≡∗

do nothing

We have to be careful about substitution combined with process abbreviations. For
example, (x⟨u⟩. t)[s/x] is not s⟨u⟩. t because the latter is not defined. Following thedefinition, (x⟨u⟩. t)[s/x] is actually (t[xu/x])[s/x] = t[su/x]. We are going to introduce
the name restriction νx.t after implementing channels.
Below, we are going to justify these abbreviations statically and dynamically. The
static justification comes from typing rules (Figure 2.4.3) and the dynamic justification
comes from evaluation (Figure 2.4.4).
2.4.3

Process Typing Rules as Abbreviations

The session type abbreviation and the processes abbreviation allow us to use the typing
rules in the next proposition.
Theorem 2.4.1 (Process Typing Rules: senders and receivers) These rules areadmissible.
O

recv

end

O

y : ψ, x : χ ⊢ t : φ
x : ?ψ χ ⊢ x(y). t : φ
O

O

send

Γ ⊢ t:φOΓ, x : χ ⊢ t : φ∆ ⊢ u:ψOΓ, ∆, x : !ψ χ ⊢ x⟨u⟩. t : φ⊢ 0:1

Γ, x : end ⊢ ign x in t : φBefore presenting the proof, we note that the types of variable x change in the rules.
This reflects the intuition of session types: the session type of a channel changes aftersome communication occurs through the channel.
Proof After expanding abbreviations, the first rule is actually one of the original
rules:⊗LOO

y : ψ, x : χ ⊢ t : φ

x : ψ ⊗ χ ⊢ let x be y ⊗ x in t : φ.

After expanding abbreviations, the second rule is also one of the original rules:⊸LOO

Γ, x : χ ⊢ t : φ∆ ⊢ u:ψΓ, ∆, x : ψ ⊸ χ ⊢ t[(xu)/x] : φ
37.

The third and the fourth rule are more evidently one of the original rules 1L and 1R.■
Example 2.4.2 (Typed communicating terms) Using Theorem 2.4.1, we can typeprocesses. Figure 2.3 contains one process, which sends a channel y through x and thenwaits for input in a channel y ′ . Here is another process that takes an input w′ fromchannel x′ , where the input w′ itself is expected to be a channel. After receiving w′ ,the process puts inl(∗) in w′ .
1R
1R
⊢ ∗:1
⊢ ∗:1
⊕R
end ′
w : end ⊢ ign w′ in ∗ : 1⊢ inl(∗) : 1 ⊕ 1
send
w′ : !(1 ⊕ 1) end ⊢ w′ ⟨inl(∗)⟩. ign w′ in ∗ : 1
end ′w : !(1 ⊕ 1) end, x′ : end ⊢ ign x′ in w′ ⟨inl(∗)⟩. ign w′ in ∗ : 1
recv ′
x : ?(!(1 ⊕ 1) end) end ⊢ x′ (w′ ). ign x′ in w′ ⟨inl(∗)⟩. ign w′ in ∗ : 1
We intend these two processes to communicate when we connect the channels x and x′ .
For that, we have to implement complicated channels as in the following subsection.
2.4.4

Implementing Channels

We introduced primitives c and c̄ implementing (1 ⊸ φ) ⊗ (φ ⊸ 1). These can beseen as channels of session types ?φ end and !φ end. Indeed, ?φ end is φ ⊗ 1 (which isinter-derivable with 1 ⊸ φ) and !φ end is φ ⊸ 1. We can generalize this phenomenon
to the more complicated session types7 .
Proposition 2.4.3 (Session realizers) For any linear type φ∼, the hypersequent⊢ t : φ∼⊢ u : φ∼is derivable for some terms t and u.
Proof Induction on φ∼ .
Ax
Ax
⊢ ∗ : 1 is what we seek.
(end) Merge ⊢ ∗ : 1
⊢ ∗:1
⊢ ∗:1
⊢ u′ : φ∼ is derivable. Using this,(!ψ φ∼ ) By the induction hypothesis, ⊢ t′ : φ∼we can make the following derivation:

IH

Ax
x:ψ ⊢ x:ψMerge
x:ψ ⊢ x:ψSync
cx : φ∼ ⊢ x : ψ⊗R
x : ψ ⊢ cx : φ∼⊢ t′ : φ∼⊢ u ′ : φ∼⊢ t′ : φ∼⊢ u′ : φ∼⊢ c̄t′ : ψ⊢ u′ : φ∼⊢ (c̄t′ ) ⊗ u′ : ψ ⊗ φ∼

⊢ λx.cx : ψ ⊸ φ∼
7 This is impossible using the ordinary linear types.

38⊢ (c̄t′ ) ⊗ u′ : ψ ⊗ φ∼

.

39

Ax

Figure 2.3: A typed process.

z:1 ⊕ 1 ⊢ z:1 ⊕ 1
z : 1 ⊕ 1, y : end ⊢ ign y in z : 1 ⊕ 1
endz : 1 ⊕ 1, x : end, y : end ⊢ ign x, y in z : 1 ⊕ 1
recv
Ax ′
x : end, y : ?(1 ⊕ 1) end ⊢ y(z). ign x, y in z : 1 ⊕ 1
y : !(1 ⊕ 1) end ⊢ y ′ : !(1 ⊕ 1) end
sendy : ?(1 ⊕ 1) end, x : !(!(1 ⊕ 1) end) end, y ′ : !(1 ⊕ 1) end ⊢ x⟨y⟩. y ′ (z). ign x, y in z : 1 ⊕ 1
end

(?ψ φ) Symmetric to the above.
(⊕{li : φi }) By the induction hypothesis, for each i ∈ I, we have⊢ ti : φi⊢ ui : φiderived. Hence derivable is⊢ ti : φi⊢ i(ui ) : ⊕j∈I φjwhere i(ui ) is an appropriate nesting of inl(·), inr(·) and ui . Combining |I| suchderivations, we can derive⊢ ⟨ti ⟩i∈I : &i∈I φi⟨⊢ i(ui ) : ⊕j∈I φj ⟩i∈I

for a fresh natural number n.
(&{li : φi }) Symmetric to above.

■

We call the above pair t, u in the statement the session realizers of φ∼ and denotethem by ▷(φ∼ ), ◁(φ∼ ). Moreover, we use ▷◁(φ∼ ) to denote the pair ▷(φ∼ ) ⊗ ◁(φ∼ ). So
far, a free variable with a linear type represented a channel serving the corresponding
session type. Now, we can substitute the free variables with the session realizers sothat the typed processes can actually communicate. If we have two terms that use freevariables of type φ∼ and φ∼ , we can replace those free variables by session realizers.
Corollary 2.4.4 (Binding both ends of a channel) IfOΓ, x : φ∼ ⊢ t : ψ∆, y : φ∼ ⊢ u : θΓ ⊢ t[▷(φ∼ )/x] : ψ∆ ⊢ u[◁(φ∼ )/y] : θ

is derivable,O
is also derivable.
Now we can define the name restriction operator as an abbreviation:
νx : φ∼ .t ≡ let ▷◁(φ∼ ) be xL ⊗ xR in t
where we assume injections x 7→ xL and x 7→ xR whose images are disjoint.
Then, in addition to Theorem 2.4.1, more typing rules are available.
Theorem 2.4.5 (Process typing rule: name restriction) The following typing rule
is admissible.
40

Γ, x : φ∼ , y : φ∼ ⊢ t : ψOOΓ ⊢ νx : φ∼ .t[xL /x][xR /y] : ψ

Example 2.4.6 (Connecting processes using session realizers) Using the session realizers, we can connect the processes typed in Example 2.4.2. Indeed,⊢ν(x : ?(!(1 ⊕ 1) end) end).ν(y : !(1 ⊕ 1) end).
(xR ⟨yL ⟩. yR (z). ign xR , yR in z) ⊗ (xL (w′ ). ign xL in w′ ⟨inl(∗)⟩. ign w′ in ∗): (1 ⊕ 1) ⊗ 1
is derivable.
Now we have to check the evaluation of the term in this example. For that we preparea lemma.
Process Evaluation as Abbreviation
The intention of defining x⟨u⟩. t0 and y(z). t1 is mimicking communication in process
calculi. When we substitute x and y with session type realizers, these terms canactually communicate.
The next lemma can help us evaluate session realizers.
Lemma 2.4.7 Let t0 be a term containing a free variable x and t1 be a term containing
free variables y and z. The rule▷(φ∼ ) ⇓ v ′EE◁(φ∼ ) ⇓ w′

t0 [v ′ /x] ⇓ v▷(!ψ φ∼ ) ⇓ λx.cx(x⟨u⟩. t0 )[λx.cx/x] ⇓ v

u ⇓ u′

t1 [u′ /z][w′ /y] ⇓ w◁(!ψ φ∼ ) ⇓ u′ ⊗ w′
(y(z). t1 )[u′ ⊗ w′ /y] ⇓ w

is admissible under presence of the eval-subst rule.
Proof By the derivation in Figure 2.4.
Example 2.4.8 (Evaluation of communicating processes) Here is an example
of evaluation using the eval-subst rule.

▷(end) ⇓ ∗♢▷(end) ⇓ ∗∗⇓∗inl(∗) ⇓ inl(∗)∗⇓∗

inl(∗) ⇓ inl(∗)∗⇓∗

inl(∗) ⇓ inl(∗)∗⇓∗◁(end) ⇓ ∗◁(end) ⇓ ∗▷(!(1 ⊕ 1) end) ⇓ λx.cx(xL ⟨inl(∗)⟩. ign xL in ∗)[λx.cx/xL ] ⇓ ∗∗⇓∗inl(∗) ⇓ inl(∗)
inl(∗) ⇓ inl(∗)◁(!(1 ⊕ 1) end) ⇓ inl(∗) ⊗ ∗(xR (z). ign xR in z)[inl(∗) ⊗ ∗/xR ] ⇓ inl(∗)▷◁(!(1 ⊕ 1) end) ⇓ λx.cx ⊗ (inl(∗) ⊗ ∗)(xL ⟨inl(∗)⟩. ign xL in ∗)[λx.cx/xL ] ⊗ (xR (z). ign xR in z)[inl(∗) ⊗ ∗/xR ] ⇓ ∗ ⊗ inl(∗)ν(x : !(1 ⊕ 1) end). (xL ⟨inl(∗)⟩. ign xL in ∗) ⊗ (xR (z). ign xR in z) ⇓ ∗ ⊗ inl(∗)
41

42

E

λx.cx ⇓ λx.cx
t0 [(λx.cx)u/x] ⇓ v

let u′ ⊗ w′ be z ⊗ y in t1 ⇓ w

let u′ ⊗ w′ be z ⊗ y in t1 ⇓ w

let u′ ⊗ w′ be z ⊗ y in t1 ⇓ w

t0 [(λx.cx)u/x] ⇓ vc̄(▷(φ∼ )) ⊗ ◁(φ∼ ) ⇓ u′ ⊗ w′c̄(▷(φ∼ )) ⇓ u′

let u′ ⊗ w′ be z ⊗ y in t1 ⇓ w

let u′ ⊗ w′ be z ⊗ y in t1 ⇓ w

let u′ ⊗ w′ be z ⊗ y in t1 ⇓ w

cu ⇓ v ′u ⇓ u′

t1 [u′ /z][w′ /y] ⇓ w

let u′ ⊗ w′ be z ⊗ y in t1 ⇓ w

u ⇓ u′u ⇓ u′(λx.cx)u ⇓ v ′t0 [(λx.cx)u/x] ⇓ v

t0 [v ′ /x] ⇓ v

λx.cx ⇓ λx.cx

λx.cx ⇓ λx.cx

t0 [v ′ /x] ⇓ v

t0 [v ′ /x] ⇓ v◁(φ∼ ) ⇓ w′◁(φ∼ ) ⇓ w′c̄(▷(φ∼ )) ⊗ ◁(φ∼ ) ⇓ u′ ⊗ w′

EEc̄(▷(φ∼ )) ⇓ u′t0 [v ′ /x] ⇓ v◁(φ∼ ) ⇓ w′c̄(▷(φ∼ )) ⇓ u′Et0 [v ′ /x] ⇓ v◁(φ∼ ) ⇓ w′◁(φ∼ ) ⇓ w′▷(φ∼ ) ⇓ v ′◁(φ∼ ) ⇓ w′▷(φ∼ ) ⇓ v ′E▷(φ∼ ) ⇓ v ′Figure 2.4: Proof of Lemma 2.4.7. The conclusion is identical to our goal up to abbreviations.

λx.cx ⇓ λx.cx

eval-subst

EE

λx.cx ⇓ λx.cx

EThe step ♢ uses Lemma 2.4.7.
2.4.5

Copycatting

Proposition 2.4.9 For any linear type φ∼ , we can derive x : φ∼ , y : φ∼ ⊢ t : 1 for someterm t.
Proof By induction on φ∼ .
(end) Since end = end, the derivation⊢ ∗:1
y : end ⊢ ign y in ∗ : 1
x : end, y : end ⊢ ign x, y in ∗ : 1
suﬃces.
(!ψ φ∼ ) Using the induction hypothesis (IH.), we obtain a derivation:..
. (IH.)∼
x : φ , y : φ∼ ⊢ t : 1
z:ψ ⊢ z:ψx : !ψ φ∼ , y : φ∼ , z : ψ ⊢ x⟨z⟩. t : 1
x : !ψ φ∼ , y : ?ψ φ∼ ⊢ y(z). x⟨z⟩. t : 1(?ψ φ∼ ) Symmetric to above.
(⊕{li : φ∼i }) For brevity, we only consider a binary disjunction of the form ⊕{Left :∼φ∼
0 , Right : φ1 }.

∼By the induction hypotheses, x0 : φ∼
0 , y0 : φ0 ⊢ t0 : 1 and∼x1 : φ∼1 , y1 : φ1 ⊢ t1 : 1 are derivable. Thus,∼∼
x0 : φ∼0 , y : φ0 ⊕ φ1 ⊢ let y be ⟨y0 , ⟩ in t0 : 1

and∼∼x1 : φ∼1 , y : φ0 ⊕ φ1 ⊢ let y be ⟨ , y1 ⟩ in t1 : 1

are derivable. Using these, we can conclude a derivation of∼∼∼x : φ∼
0 ⊕ φ1 , y : φ0 ⊕ φ1 ⊢match x of inl(x0 ).let y be ⟨y0 , ⟩ in t0 /inr(x1 ).let y be ⟨ , y1 ⟩ in t1 : 1 .
(&{li : φ∼i }) Symmetric to above.

■

43

2.5

Correctness with Respect to Abelian Logic

In this section, we compare the Amida calculus and Abelian logic and discover thefact that they are identical. This characterization provides a straightforward counterexample for cut-elimination. First, we show that all Abelian logic theorems are inhabited in the Amida calculus (completeness of the Amida calculus). After that, we showthat all types inhabited in the Amida calculus are theorems of Abelian logic.
2.5.1

Completeness of the Amida Calculus Type System

According to Metcalfe et al. [103], Abelian logic is axiomatized by the following axioms
A1 to A10 and deduction rules mp and &I. An abbreviation φ ˛ ψ is defined todenote (φ ⊸ ψ) & (ψ ⊸ φ).
A1 ((φ ⊕ ψ) ⊸ θ) ˛ ((φ ⊸ θ) & (ψ ⊸ θ))
A2 ((φ ⊗ ψ) ⊸ θ) ˛ (φ ⊸ (ψ ⊸ θ))
A3 (φ ⊸ ψ) ⊸ ((ψ ⊸ θ) ⊸ (φ ⊸ θ))
A4 ((φ ⊸ ψ) & (φ ⊸ θ)) ⊸ (φ ⊸ (ψ & θ))
A5 (φ & (ψ ⊕ θ)) ⊸ ((φ & ψ) ⊕ (φ & θ))
A6 φ ˛ (1 ⊸ φ)
A7 (φ & ψ) ⊸ φ
A8 (φ & ψ) ⊸ ψ
A9 φ ⊸ ((φ ⊸ ψ) ⊸ ψ)
A10 ((φ ⊸ ψ) ⊸ ψ) ⊸ φ
mp if φ ⊸ ψ and φ are theorems, ψ is also a theorem&I if φ and ψ are theorems, φ & ψ is also a theorem.
The most peculiar of these axioms is A10, which is called the relativisation axiom.
Theorem 2.5.1 (Completeness of the Amida Calculus for Abelian Logic) A
theorem of Abelian logic is inhabited in the Amida calculus.
Proof All axioms A1 to A10 are inhabited in the Amida calculus and the Amida
calculus rules satisfy the properties mp and &I. In particular, a term with type A10
can be derived as
44

Ax
Ax
x:φ ⊢ x:φy:ψ ⊢ y:ψMerge
x:φ ⊢ x:φy:ψ ⊢ y:ψSync
x : φ ⊢ cx : ψ
y : ψ ⊢ c̄y : φ⊸R⊢ λx.cx : φ ⊸ ψ
y : ψ ⊢ c̄y : φ⊸Lz : (φ ⊸ ψ) ⊸ ψ ⊢ c̄(z(λx.cx)) : φ⊸R⊢ λz.c̄(z(λx.cx)) : ((φ ⊸ ψ) ⊸ ψ) ⊸ φ
2.5.2

.

■

Soundness of the Amida Calculus Type System

For soundness, a diﬀerent axiomatization of Abelian logic in [102] is more useful.
L1 φ ⊸ φ
L2 (φ ⊸ ψ) ⊸ ((ψ ⊸ θ) ⊸ (φ ⊸ θ))
L3 (φ ⊸ (ψ ⊸ θ)) ⊸ (ψ ⊸ (φ ⊸ θ))
L4 ((φ ⊗ ψ) ⊸ θ) ˛ (φ ⊸ (ψ ⊸ θ))
L5 (φ & ψ) ⊸ φ
L6 (φ & ψ) ⊸ ψ
L7 ((φ ⊸ ψ) & (φ ⊸ θ)) ⊸ (φ ⊸ (ψ & θ))L8 φ ⊸ (φ ⊕ ψ)
L9 ψ ⊸ (φ ⊕ ψ)
L10 ((φ ⊸ θ) & (ψ ⊸ θ)) ⊸ ((φ ⊕ ψ) ⊸ θ)
L11 φ ˛ (1 ⊸ φ)
L12 ((φ ⊸ 1) ⊸ 1) ⊸ φ
C1 1 ˛ (1 ⊗ 1)
C2 (φ ⊸ φ) ⊸ 1
mp If φ ⊸ ψ and φ are theorems, ψ is also a theorem&I If φ and ψ are theorems, φ & ψ is also a theorem.
These axioms and rules are enough to prove all inhabited types of the Amida
calculus.

45

Theorem 2.5.2 (Soundness of the Amida Calculus for Abelian Logic) An inhabited type in the Amida calculus is a theorem of Abelian logic.
Proof The IMALL deduction rules are straightforwardly obtained by combining L1–
L12, &I and mp. The Amida axiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ) is a theorem in Abelian
logic by the following argument.
1. By C2, ((φ ⊸ 1) ⊸ (φ ⊸ 1)) ⊸ 1 is a theorem of Abelian logic.
2. By L4, L5 and mp, (((φ ⊸ 1) ⊗ φ) ⊸ 1) ⊸ ((φ ⊸ 1) ⊸ (φ ⊸ 1)) is atheorem of Abelian logic.
3. By 1., 2., L2 and mp, (((φ ⊸ 1) ⊗ φ) ⊸ 1) ⊸ 1 is a theorem of Abelian logic.
4. By 3., L12 and mp, (φ ⊸ 1) ⊗ φ is a theorem of Abelian logic.
5. By a symmetric argument, (ψ ⊸ 1) ⊗ ψ is also a theorem of Abelian logic.
6. By 4., 5., L1, L4 and mp, ((φ ⊸ 1) ⊗ φ) ⊗ ((ψ ⊸ 1) ⊗ ψ) is a theorem of
Abelian logic.
7. Since Abelian logic contains IMALL without additive units, ((φ ⊸ 1) ⊗ ψ) ⊸(φ ⊸ ψ) is a theorem of Abelian logic.
8. By a symmetric argument, ((ψ ⊸ 1) ⊗ φ) ⊸ (ψ ⊸ φ) is also a theorem of
Abelian logic.
9. Combining 6., 7., 8., a theorem (φ ⊸ ψ) ⊸ (θ ⊸ τ ) ⊸ (φ ⊗ θ) ⊸ (ψ ⊗ τ ) andmp, we obtain (φ ⊸ ψ) ⊗ (ψ ⊸ φ) as a theorem of Abelian logic.

■

As a corollary of soundness and completeness, some previous literature (Casari [27],Meyer and Slaney [104]) on Abelian logic provides some facts.
Corollary 2.5.3 (Division by two) If φ ⊗ φ is inhabited, so is φ.
Corollary 2.5.4 (Excluded Middle in the Amida calculus) The law of excluded
middle φ ⊗ (φ ⊸ 1) is inhabited in the Amida calculus.
Corollary 2.5.5 (Prelinearity in the Amida calculus) Prelinearity (φ ⊸ ψ) ⊕(ψ ⊸ φ) is inhabited in the Amida calculus.

46

2.6

Proof Nets

Toward better understanding the Amida calculus, a technique called proof nets seems
promising. Generally, proof nets are straightforward for the multiplicative fragments
but complicated when additive and exponential connectives are involved. Since theAmida axiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ) does not contain additives (&, ⊕) or exponentials(!, ?), we can focus on the multiplicative connectives (⊸ and ⊗). The fragment is called
IMLL (intuitionistic multiplicative fragment of linear logic). We also use the unit 1 fortechnical reasons. We first describe the IMLL proof nets and their properties. Then
we add a new kind of edges called the Amida edges and see it characterizes Abelian
logic.
The Amida links are named after the Amida lottery (see Subsection 1.3.9).
2.6.1

IMLL Essential Nets

Proof nets for intuitionistic linear logics are called essential nets. This subsection reviews some known results about the essential nets for intuitionistic multiplicative linear
logic (IMLL). The exposition here is strongly influenced by Murawski and Ong [111].
We can translate a polarity p ∈ {+, −} and an IMLL formula φ into a polarized
MLL formula _φ^p following Lamarche [92] and Murawski and Ong [111]. We omit thedefinition of polarized MLL formulae because the whole grammar is exposed in thetranslation below:_1^+ = 1+_1^− = ⊥−_X^+ = X +_X^− = X −_φ ⊸ ψ^+ = _φ^− `+ _ψ^+_φ ⊸ ψ^− = _φ^+ ⊗− _ψ^−_φ ⊗ ψ^+ = _φ^+ ⊗+ _ψ^+_φ ⊗ ψ^− = _φ^− `− _ψ^− .

For example, the Amida axiom can be translated into a polarized MLL formula_(X ⊸ Y ) ⊗ (Y ⊸ X)^+
= _X ⊸ Y ^+ ⊗+ _Y ⊸ X^+()()= _X^− `+ _Y ^+ ⊗+ _Y ^− `+ _X^+()()
= X − `+ Y + ⊗+ Y − `+ X + .
The symbol ` is pronounced “parr.”
Any polarized MLL formula can be translated further into a finite rooted tree
containing these branches and polarized atomic formulae (X − , X + , 1+ , ⊥− ) at the47

leaves.

ϕ− ψ +ϕ− ψ −ϕ− `+ ψ +ϕ− `− ψ −ϕ+

ϕ+ ψ −

ψ+ϕ+ ⊗ − ψ −ϕ+ ⊗ + ψ +For brevity, we sometimes write only the top connectives of labeling formulae. In thatcase, these branching nodes above are denoted like this.

−

+

−

`+

+

−

+

+

⊗+

`−

−
⊗−

We call arrows with upward (resp. downward) signs up-edges (resp. down-edges). The
dashed child of a `+ node p is the node which the dashed line from p reaches. The
branching nodes labeled by `+ , `− , ⊗+ and ⊗− are called operator nodes.
When we add axiom edges and ⊥-branches (shown below) to the other operator
nodes (shown above) we obtain an essential net of φ. Due to the arbitrariness ofchoosing axiom edges and ⊥-branches, there are possibly multiple essential nets for a
formula8 .

X+

X−
⊥−

axiom edge⊥-branch

Example 2.6.1 (An essential net of the Amida axiom) Here is one of the essential nets of the Amida axiom (X − `+ Y + ) ⊗+ (Y − `+ X + ).

Y+

X−

Y−

`+

X+

`+
⊗+

8 Murawski and Ong [111] restricts the class of formulae to linearly balanced formulae so that theessential net is uniquely determined.

48However, the essential net in Example 2.6.1 is rejected by the following correctness
criterion.
Definition 2.6.2 (Correct essential nets) A correct essential net is an essential
net satisfying all these conditions:
1. Any node labeled with X + (resp. Y − ) is connected to a unique node labeled withX − (resp. Y + ). Any leaf labeled with ⊥− is connected to a ⊥-branch. 1+ is notconnected to anything above itself;
2. the directed graph formed by up-edge, down-edge, axiom edges and ⊥-branches isacyclic;
3. for every `+ -node p, every path9 from the root that reaches p’s dashed child also
passes through p.
The essential net in Example 2.6.1 is not correct for condition 3. Actually, the Amidaaxiom does not have any correct essential net. IMLL sequent calculus has the subformula property so that we can confirm that the Amida axiom is not provable in
IMLL.
Theorem 2.6.3 (Essential nets by Lamarche [92], Murawski and Ong [111])
An IMLL formula φ is provable in IMLL iﬀ there exists a correct essential net of φ.
Proof The left to right is relatively easy. For the other way around, Lamarche [92]uses a common technique of decomposing an essential net from the bottom. Murawski
and Ong [111] chose to reduce the problem to sequents of special forms called regular.■
Actually, Lamarche [92] also considers the cut rule10 in essential nets, thus we can
include the following general axioms (as macros) and cuts (as primitives) and still use
Theorem 2.6.3:

ϕ+

ϕ+

ϕ−

general axiom

ϕ−cut

9 A path must follow solid edges according to the direction.

they are not contained in paths.
10 As well as additive operators and exponentials.

49.

Dashed edges are not directed and2.6.2The Amida Nets

Definition 2.6.4 (The Amida nets) For a hypersequent H, Amida nets of H are
inductively defined by the following three clauses:• an essential net of H is an Amida net of H;• for an Amida net of H with two diﬀerent11 up-edges,

e0

e1

replacing these with

e1u

e0u
ea

e1d

e0d

yields an Amida net of H, where the above component has two paths e0d ea e1u
and e1d ea e0u ;• for an Amida net of H with an up-edge,ereplacing this with

11 The two edges can be connected by a new edge as long as they are diﬀerent; their relative positions

do not matter.

50

eu
ea

em
ed

yields an Amida net of H, where the above component has one finite path ed ea eu
and one infinite path · · · em ea em ea · · · .
In these clauses, we call the edges labeled ea the Amida edges.
Definition 2.6.5 (Correct Amida nets) A correct Amida net is an Amida net satisfying the three conditions in Definition 2.6.4.
The Amida edge is not merely a crossing of up-edges. See the diﬀerence between

ϕ+

ψ+

ϕ+

ψ+

ϕ+

ψ+

ψ+

ϕ+ .

and

The diﬀerence is the labels at the bottom. Although Amida edges cross the paths,
they do not transfer labels. This diﬀerence of labels makes Amida nets validate theAmida axiom.
Example 2.6.6 (A correct Amida net for the Amida axiom) Here is a correct
Amida net for the Amida axiom (X ⊸ Y ) ⊗ (Y ⊸ X).
51

Y+

X−

Y−

`+

X+

`+
⊗+

In terms of the set of paths, the above Amida net is equivalent to the following correctessential net for (X ⊸ X) ⊗ (Y ⊸ Y ).

Y+

X−

Y−

`+

X+

`+
⊗+

2.6.3

Soundness and Completeness of Amida nets

Theorem 2.6.7 (Completeness of Amida nets) If a hypersequent H is derivable,
there is a correct Amida net for H.
Proof Inductively on hypersequent derivations. The Sync rule is translated into acrossing with an Amida edge:

Γ⊢φ

∆⊢ψ

Γ⊢ψ

∆⊢φ

ϕ

ψ

ψ

ϕ

7→

where the crossing exchanges the formulae and the Amida edge keeps the path connections vertically straight.

■

52

Theorem 2.6.8 (Soundness of Amida nets) If there is a correct Amida net for a
hypersequent H, then H is derivable.
Proof From a correct Amida net, first we move the Amida edges upwards until they
are just below axiom edges12 . The moves are as follows.

ϕ

ψ

ψχ

ϕ

χ

1+
⊗+
⊗+

⊗+

ϕ⊗1 ψ⊗χ

ψ⊗χ

ϕ

ϕ+

ψ − `− ⊥−
1+

+

1

χ+

−
ϕ+ ψ

⊗

χ+

+

`+

⊗+
⊥−

ϕ+ ψ − `+ χ+

ψ−

`+

`+

⊥− `+ (ϕ+ ⊗+ 1+ )

ψ − `+ χ+

These translations have two properties.
12 The idea is similar to the most popular syntactic cut-elimination proofs.

53

1. When the original (contained in a larger picture) is a correct Amida net, thetranslation (contained in the same larger picture) is also a correct Amida net.
2. The end nodes of the translation correspond to the end nodes of the original,
and the corresponding end nodes have the same label (up to logical equivalencein IMLL). In case of ⊗ translation, φ and φ ⊗ 1 are logically equivalent because
1 is the unit of ⊗. In case of ` translation, φ and ⊥ ` φ are logically equivalentbecause ⊥ is the unit of `.
For checking the first condition, it is enough to follow the paths (crossing all Amidaedges). For the second condition, it is enough to follow the vertical edges ignoring theAmida edges and ⊥-branches.
The ⊗ move introduces Amida edges only above the branching rules. Althoughthe ` move introduces an Amida edge below a branching rule, that branching rule isof ⊗ nature. Also, the ` move introduces an Amida edge below ψ-axiom link, whichis actually a macro. So we have to continue applying the translation moves in themacro. However, since ψ is a strictly smaller subformula of ψ ` χ, this does not cause
infinite recursion.
Then, by these translation moves, the whole Amida net is decomposed verticallyinto three layers. At the top, there is a layer with only axiom edges. In the middle,
there is a layer with only vertical edges and Amida edges. At the bottom, there is alayer that contains only ordinary essential net nodes.
Since the middle layer is an Amida lottery, it defines a permutation. That permutation can be expressed as a product of transpositions, so that the original Amida
lottery is equivalent to an encoding of a hypersequent derivation that consists of only
Sync rules.
After we encode the top and the middle layer into a hypersequent derivation,
encoding the bottom layer can be done in the same way as Lamarche’s approach [92].■
We wonder whether it is possible to add Amida edges to the IMALL− essential
nets following Lamarche [92]. The additives are notoriously diﬃcult for proof nets and
we do not expect the combination of additive connectives and Amida edges can betreated in a straightforward way.

2.7

Related Work

2.7.1

Analytic Calculus for Abelian Logic

Metcalfe et al. [103] gave a labeled sequent calculus for Abelian logic. Some years
54later, Metcalfe [102] gave a hypersequent calculus for Abelian logic and proved cutelimination theorem for the hypersequent calculus. His formulation is diﬀerent fromours because Metcalfe’s system does not use conjunctive hypersequents. He sticks to
the traditional hypersequent formulation where components are interpreted disjunctively. The paper [102] is informative about some logics weaker than Abelian logic sothat there might be a hint of getting a hyper-lambda calculi for these weaker logics.
Before Metcalfe et al. [103], Shirahata [128] studied the multiplicative fragment ofAbelian logic, which he called CMLL (compact multiplicative linear logic). He gave acategorical semantics for the proofs of a sequent calculus presentation of CMLL andthen proved that the cut-elimination procedure of the sequent calculus preserves thesemantics. Since our Amida net presentation also gives a non-degenerate semantics
for the same logic, we speculate that Amida nets provide a suitable presentation formorphisms of compact closed categories. Remarkably, Shirahata [128] also noted that
addition of infinite additives yields inconsistency although he did not notice his CMLL
is identical to the multiplicative fragment of Abelian logic13 . He also noted that
addition of finite additives yields a counter-example of cut-elimination, which we willnote in Subsection 2.8.2.
2.7.2

Linear Logic and Session Types

Session types [78, 131] appeared in this chapter. Session types aim at typing channels
and processes in π-calculus so that the process execution is deterministic and not
ending in deadlock. In general, session type systems are not based on a well-known
logic. However, there are recent developments on encoding session types into linear
type systems.
Kobayashi-Pierce-Turner’s Type System
Kobayashi et al. [90] developed a type system for the π-calculus processes. Similarly tothe type system presented here, their type system can specify types of communication
contents through a name and how many times a name can be used. In some sense,that type system is more flexible than the one shown in this chapter. First, their typesystem allows a liberal typing on a channel so that the channel can be used for any
number of times. Second, their type system can type replicated processes. Third, their
type system allows weakening [90, Lemma 3.2]. In other respects, the type system in
13 Ciabattoni et al. [31] already pointed out the fact that Shirahata [128] and Metcalfe et al. [103]studied the same logic.

55

[90] is less expressible. That type system does not have lambda abstractions. Also,in contrast to our type system, it is impossible to substitute a free variable with aprocess in that type system. This is related to the fact that in their type system, asequent contains types on the left side but not on the right side. Since there are notypes on the right side, their sequent is hard to interpret logically.
Caires and Pfenning’s Typing System
Caires and Pfenning [26] provide a type system for a fragment of π-calculus. Theirtype system imposes a discipline stronger than necessary to provide deadlock freedom.
For example, this escrowing process P below is not typable in their type system:
P = x⟨y⟩. x(a). y(b). x⟨b⟩. y⟨a⟩. 0 .
The process first emits a channel y through channel x and then takes inputs from x
and y and outputs them respectively to y and x. Following the informal descriptionof types by Caires and Pfenning [26], the process P should be typable as⊢ P :: x : (A ⊸ B) ⊗ (B ⊸ A) .
However, such typing is not possible because (A ⊸ B) ⊗ (B ⊸ A) is not a theoremof dual intuitionistic linear logic (DILL), which their type system is based on. In ourtype system, the following sequent is derivable
x : !(!B ?A end) ?B !A end ⊢ν(y : !B ?A end).x⟨yL ⟩. x(a). yR (b). x⟨b⟩. yR ⟨a⟩. ign x, y in 0 : 1
The resulting sequent indicates that the process is typable with one open channel xthat first emits a channel that one can send B to and receive A from, second receives
a value of B and finally sends a value of A. This example shows that our type system
can type some terms that the type system in Caires and Pfenning [26] cannot.
The most complicated example in Caires and Pfenning [26] involves a drink server.
Example 2.7.1 (Drink server from Caires and Pfenning [26] in the Amida cal.)ServerP roto = (N ⊸ I ⊸ (N ⊗ 1)) & (N ⊸ (I ⊗ 1))= (!N !I ?N end) & (!N ?I 1)
N stands for the type of strings and I stands for the type of integers, but following
Caires and Pfenning [26], we identify both N and I with 1. Below, SP abbreviates
56

ServerP roto. Here is the process of the server, which serves one client and terminates.
Serv = ⟨s(pn). s(cn). s⟨rc⟩. ign pn, cn, s in 0,s(pn). s⟨pr⟩. ign s, pn in 0⟩

We can derive a sequent s : SP ⊢ Serv : 1.
Here is one client:⊢ 0:1
s : end ⊢ ign s in 0 : 1
s : end, pr : I ⊢ ign pr, s in 0 : 1
s : ?I end ⊢ s(pr). ign pr, s in 0 : 1⊢ tea : Ns : !N ?I end ⊢ s⟨tea⟩. s(pr). ign pr, s in 0 : 1
s : ServerP roto ⊢ let s be ⟨ , s⟩ in s⟨tea⟩. s(pr). ign pr, s in 0 : 1
In words, the client first chooses the server’s second protocol, which is price quoting,and asks the price of the tea, receives the price and terminates.
We can combine the server with this client. However, since the Amida calculus lacks
the exponential modality, Amida calculus cannot type any term with !ServerP roto,
which the type system of Caires and Pfenning can [26]. In order to do that, we mightwant to tolerate inconsistency and add µ and ν operators from the modal µ-calculus,
like Baelde [14] did, and express !ServerP roto as νX.(SeverP roto ⊗ X).
Wadler’s Encoding
Wadler [146] gave a type system for a process calculus based on classical linear logic.
Although the setting is classical, the idea is more or less the same as Caires andPfenning [26]. Wadler’s type system cannot type the escrowing process above. Worse,the definition of processes by Wadler [146] does not recognize the escrowing processx⟨y⟩. x(a). y(b). x⟨b⟩. y⟨a⟩. 0
as a process at all. His grammar requires the output construction to be used in theformx⟨y⟩. (P | Q)
where x is bound in Q but not in P and y is bound in P but not in Q. Of course,
there is a way to escape the above restriction by making P and Q communicate, butthat option is prohibited by the typing rules.
Wadler [146] uses classical linear logic rather than intuitionistic linear logic. He
justifies the choice for “greater simplicity and symmetry.” In terms of provability, theshift from intuitionistic to classical linear logic will not make any diﬀerence. However,57

in terms of proof nets, one diﬃculty looms. In classical multiplicative linear logic,
adding the Amida edges to proof nets seems harder than the intuitionistic case because
classical MLL proof nets have no direction on edges. After a path crosses an Amidaedge, the author has no idea which direction the path should continue; one plausible
solution is allowing multiple processes to track the paths in parallel and making theseprocesses synchronize on Amida edges.
That said, Wadler’s type system is similar to ours; our abbreviations are largely
taken from Wadler’s translations.
Giunti and Vasconcelos’s Type System
Giunti and Vasconcelos [62] give a type system for the pi calculus with the typepreservation theorem. Their type system is extremely similar to our type system.
They say “the goal of this work is to equip types with a constructor able to denotethe two ends of a same channel” [62, Introduction]. One of their typing rules
Γ, x : (S, S) ⊢ P
Γ ⊢ (νx)Pis similar to a rule in Theorem 2.4.5OOΓ, x : φ∼ , y : φ∼ ⊢ t : ψΓ ⊢ νx : φ∼ .t[xL /x][xR /y] : ψ.

In many cases, the Curry-Howard correspondence is followed from the logical world
to the programming world: for already known logics, new lambda calculi are invented(e.g. [2, 117, 142]). However, in our case, it seems that we have just found a connection
between an already known logic called Abelian logic and an already known typing
discipline invented by Giunti and Vasconcelos [62]. It will be worthwhile to compare
their system with our type system closely.
2.7.3

Join Calculus

The join calculus [51] is a process calculus, which is used as a basis for a language
JoCaml [53]. An implicit typing system [52] allowed the join calculus to be successfully
merged with an ML family language OCaml, but the type system does not guarantee
determinacy or ensure that all messages are consumed.
2.7.4

Continuations

The eval-subst rule enables an evaluation c̄[C[cv]] ⇓ v, which reminds us of the callwith-current-continuation primitive [122] and shift/reset primitives [6, 40]. The appearance of these classical type system primitives is not surprising because Abelian58

logic validates ((p ⊸ q) ⊸ q) ⊸ p, which is a stronger form of the double negation
elimination. Possibly we could use the technique of Asai and Kameyama [6] to analyze
the Amida calculus with eval-subst rule.
2.7.5

Logic Programming

There are at least two ways to interpret logics computationally. One is proof reduction,
which is represented by λ-calculi. The other is proof searching. We have investigatedthe Amida calculus, which embodies the proof reduction approach to the Amida axiom.
Then what implication does The Amida axiom have in the proof searching approach?
Let us cite an example from Kobayashi and Yonezawa [89, A.2]:
Consumption of a message m by a process m ⊸ B is represented by thefollowing deduction:(m ⊗ (m ⊸ B) ⊗ C) ⊸ (B ⊗ C)
where C can be considered as other processes and messages, or an environment.
Using the Amida axiom, the inverse(B ⊗ C) ⊸ (m ⊗ (m ⊸ B)) ⊗ C
is derivable. This suggests that the Amida axiom states that some computation isreversible in the context of proof searching. We suspect that this can be useful within
the realm of reversible computation [134].

2.8

Discussion

2.8.1

Adding Agents, Recursions, . . .

Our type system has a drawback of having only finitely many processes. We expect itstraightforward to overcome this weak point by adding recursions in our type system.
As a guidance we can take µMALL of Baelde [14].
It is tempting to add modalities representing agents and then study the relationshipwith the multiparty session types [17, 81]. For that, intuitionistic epistemic logic
by Hirai [75, 76] will be useful.
In order to implement this lambda calculus as a programming language, we needlinear types. If we seek a quick way of implementing our hyper-lambda calculus on

59

top of an existing ML family programming language, we have to choose the existinglanguage carefully. For example, OCaml and Haskell uses intuitionistic type system so
if we use these languages naively, the Amida axiom makes the type system inconsistentand some communication primitives can be thrown away, leaving the peer deadlocked.
The uniqueness type of the programming language Clean [113] does not allow contraction, but the uniqueness type is still not special enough because their type systemallows weakening.
2.8.2

Cut-Elimination

In the Amida calculus, there is a hypersequent that can be derived with the cut rule
but not without cut rules. For example, X, Y ⊢ X⊢ Y can be derived with a cut

rule application:
Ax
X⊢X
Ax
⊸R
Ax
Ax
Y
⊢
Y
⊢
X⊸X
X⊢X
Merge
Merge X ⊢ X
Y ⊢Y
⊢X⊸X
X
⊢
X
X
⊢X
Sync
⊸L
Y ⊢X⊸X⊢Y
X ⊸ X, X ⊢ X
Cut
X, Y ⊢ X⊢Y
However, the conclusion is not derivable without the cut rule (as confirmed by a simple
proof searching).
Worse, it is easy to see that the prelinearity (φ ⊸ ψ) ⊕ (ψ ⊸ φ) does not havea cut-free proof. However, since there is a cut-free deduction system for Abelian
logic [102], we consider it natural to expect the same property for a suitable extensionof the Amida calculus, which would contain terms and reductions corresponding to
proof rules and proof reductions in the system of Metcalfe [102].
2.8.3

The Problem with Excluded Middle

Since the Amida calculus characterizes Abelian logic, there is a closed term t withthe sequent ⊢ t : (X ⊸ 1) ⊕ X derivable. We tried looking at one such term t, but it
involved channels contained in lambda abstraction bodies and additive pairs. Unfortunately, the closed lambda term does not choose left or right so that it does not give a
constructive justification to the excluded middle. Since the closed term t uses additive
constructs, we expect the multiplicative fragment to be much more explainable.
2.8.4

Non-Commutative Version of the Amida Axiom

Including the the non-commutative version of the Amida axiom (φ/ψ) ⊗ (ψ/φ) to thefull Lambek calculus turns out to be equivalent to adding (ψ\φ)⊗(φ\ψ). Algebraically60speaking, the set of equations of the form (x/y)·(y/x) = 1 forms an equational basis for
LG, the variety of lattice-ordered groups. In a lattice-ordered group, (x/y) · (y/x) =(x · y −1 ) · (y · x−1 ) = 1. On the other hand, assuming (x/y) · (y/x) = 1, when we
substitute 1 for x, we obtain (1/y) · (y/1) = 1. By the definition of residuation andthe unit 1 of ·, we have (1/y) · y = 1, which forms an equational basis for the varietyof lattice-ordered groups [57, Lemma 3.25].
2.8.5

Program Specification and Verification

Since the typing derivations of the Amida calculus can be interpreted as proofs ofAbelian logic, there is a possibility of specifying properties of processes using (firstorder) Abelian logic formulae and then proving those properties using conjunctive
hypersequents14 . If that succeeds, the technique would be the first application of
Abelian logic in program verification.

2.9

Conclusions

We found a new axiomatization of Abelian logic: the Amida axiom (φ ⊸ ψ)⊗(ψ ⊸ φ)on top of IMALL− . The axiomatization has an application for encoding process calculi
and session type systems. As a technique, we used conjunctive hypersequents for the
first time, where components in a hypersequent are interpreted conjunctively rather
than disjunctively. The resulting hyper-lambda calculus is somewhat hard to treat
theoretically. If we need convergence or deadlock-freedom, we need the eval-subst rulein the evaluation rule (Subsection 2.3.1), which poses a threat to type safety. Moreover,there are some inhabited types like φ ⊕ (φ ⊸ 1) and (φ ⊸ ψ) ⊕ (ψ ⊸ φ), whose
constructive justification is hard to see. Plausibly, the situation can be remedied byextending the Amida net approach treated in Section 2.6.

14 When the author applied for Grant-in-Aid for JSPS Fellows 23-6978, the proposal included sucha plan. According to the proposal, this research would proceed from finding a typed lambda calculus
then to developing a logic for proving properties of the obtained programming language.

61

Chapter 3
An Asynchronous Hyper-Lambda Calculus

3.1

Summary

We define a typed lambda calculus based on Avron’s hypersequent calculus [8] forGödel-Dummett logic. We show that this calculus models waitfree computation [70,125]. Besides strong normalization and non-abortfullness, we give soundness and completeness of the calculus against the typed version of waitfree protocols. The calculus
is not only proof-theoretically interesting, but also valuable as a basis for distributed
programming languages. In other words, we extend Curry-Howard isomorphism [130]to Gödel-Dummett logic and waitfreedom. The content of this chapter appeared ina conference paper by Hirai [77] although substantial modification has been applied
since.
On one hand, Gödel-Dummett logic [43] is one of the intermediate logics between
classical and intuitionistic logics. On the other hand, waitfreedom [70, 125] is a classof distributed computation without synchronization among processes.
We connect Gödel-Dummett logic and waitfreedom using Avron’s hypersequentcalculus [8]. In doing that, we respond to his suggestion:
it seems to us extremely important to determine the exact computational
content of them [intermediate logics]—and to develop corresponding ‘λcalculi’ —Avron [8].
Diﬀerently from intuitionistic logic, Gödel-Dummett logic validates all formulae of theform (φ ⊃ ψ) ∨ (ψ ⊃ φ). We aim at building a typed lambda calculus with someterms witnessing those formulae. Such a term M : (φ ⊃ ψ) ∨ (ψ ⊃ φ) must choose
M ⇝∗ inl (· · ·) or M ⇝∗ inr (· · ·). We devise a nondeterministic lambda calculus in
Section 3.2. In this lambda calculus, terms can contain operators that read from62

and write to the store, or memory. In essence, the nondeterminism arises from thescheduling of concurrent processes: which process writes to the store before which
process reads from the store.
Waitfreedom is a class of distributed computation where processes cannot wait forother processes. When two processes try to exchange information, the faster process
can pass information to the slower one, but not always vice versa because the slower
process might start after the faster one finishes. In this situation, computation is
nondeterministic in general.
The contribution of this chapter lies in capturing the nondeterminism of waitfreedom using the nondeterministic λ-calculus for Gödel-Dummett logic. In Section 3.2,
we define a lambda calculus and prove some of its properties. In Section 3.3, we define
typed waitfreedom. Finally in Section 3.4, we prove that the lambda calculus characterizes typed waitfreedom. In other words, we show that the λ-terms in the lambda
calculus can solve a typed input-output problem if and only if it is waitfreely solvable.

3.2

λ-GD

In this section, we define a typed lambda calculus λ-GD based on hypersequents. This
constitutes the second contribution of this thesis. Moreover, the lambda calculus isone side of the Curry-Howard isomorphism that will be matched against the waitfree
computation.
We first present a proof system for Gödel-Dummett logic. Then we turn the proof
system into typing rules for λ-terms of λ-GD, give a set of reductions and prove strongnormalization and non-abortfullness. We show that the proof system using the hypersequent style [8]. In the usual sequent calculi, each reasoning step concludes a sequentΓ ⊢ φ where Γ is a possibly empty sequence of formulae. By contrast, in the hypersequent calculi, each reasoning step concludes a hypersequent, which is a finite, nonempty sequence of sequents. Of the hypersequent Γ0 ⊢ φ0

Γ 1 ⊢ φ1···

Γ n ⊢ φn ,each sequent Γi ⊢ φi is called a component. Each component Γi ⊢ φi is interpreted
as an implication: the conjunction of Γi implies φi . The whole hypersequent is interpreted as disjunction of implications: ⊢ is interpreted as implication andas

disjunction. In other words, Γi implies φi for at least one i ∈ {0, 1, . . . , n}. When we
give computational interpretation to proofs, we still interpret the components disjunctively: namely, a derivation tree concluding a hypersequent represents a sequence ofconcurrent processes at least one of which is guaranteed to succeed.

633.2.1

Logic

Let us assume a countably infinite set PVar of propositional variables. We define local
formulae φ, ψ (also called local types) by the following BNF, where I is a propositionalvariable1 :φ, ψ ::= ⊥ | I | (φ ⊃ ψ) | (φ ∧ ψ) | (φ ∨ ψ) .
We omit parentheses when no ambiguity occurs. We assume a countably infinite
number of processes. A global formula (also called a global type) is a non-empty partial
map from processes to local formulae. We use φ+ and ψ + for global formulae. For aprocess i, as a notation, [i]φ is a global formula that maps i to φ but does not map
any other processes to local formulae. We name such global formulae that map only
one process as singleton global formulae. The unary operators [0], [1], . . . are called
modalities. Informally, the local formulae describe datatypes used by each process.
The global formulae describe inputs or outputs of possibly multiple processes.
A context (denoted by Γ and ∆ possibly subscripted) is a potentially empty finite
sequence of singleton global formulae. A sequent Γ ⊢ φ+ is a pair of a context and a
global formula. A hypersequent is a finite sequence of sequents.
The underlying logic has the derivation rules in Figure 3.2. If we omit all themodalities, these rules characterize Gödel-Dummett logic.
Theorem 3.2.1 (Characterization of Gödel-Dummett logic) For any local formula φ, φ is a theorem in Gödel-Dummett logic iﬀ [0]φ is provable.
Proof We consider a translation of a global formula φ+ to a local formula. Let I∧∧
be the domain of φ+ . The translation is i∈I φ+ (i). After translating all rules in
Figure 3.2, both directions of the statement can be shown by induction on derivations.■
Indeed, [0]((φ ⊃ ψ) ∨ (ψ ⊃ φ)) is provable (Figure 3.1).
3.2.2

Term Assignment

We assume distinct, countably infinite sets of variables and locations. Locations aredenoted by c, d, . . .; process i, j, . . . and variables x, y, . . .. Later, locations will be used
to specify a location in a store. A location in a store can hold a term or be empty. Likein the λ-calculus, some terms reduce to other terms, but in this calculus, terms may
interact with stores (like a program written in Haskell or OCaml does with i-vars).
This behavior will be shown later in the definition of reductions.
1 We include ⊥ in the definition of local formulae because Gödel-Dummett logic has ⊥ although ⊥is not necessary to encode waitfree computation.

64

[0]Ax00-com[0] ⊃ I[0] ⊃ I[0] ∨ I[0] ∨ IEC[0]Ax[0]P ⊢ [0]P

[0]Q ⊢ [0]Q

[0]P ⊢ [0]Q

[0]Q ⊢ [0]P

⊢ [0](P ⊃ Q)

[0]Q ⊢ [0]P

⊢ [0](P ⊃ Q)

⊢ [0](Q ⊃ P )⊢ [0]((P ⊃ Q) ∨ (Q ⊃ P ))⊢ [0]((P ⊃ Q) ∨ (Q ⊃ P ))⊢ [0](Q ⊃ P )⊢ [0](P ⊃ Q) ∨ (Q ⊃ P )⊢ [0]((P ⊃ Q) ∨ (Q ⊃ P ))Figure 3.1: A derivation of Dummett’s axiom under modality [0] in λ-GD.
We define local terms M by BNF:
M ::= x | (∗→c←c )M | ∗←c | [M, M ] | abort | πl (M ) | πr (M ) | ⟨M, M ⟩ |inl (M ) | inr (M ) || match M of inl(x).M/inr(y).M λx.M | (M M )where x is a variable and c is a location. All variable occurrences except the first clauseare binding. The set of free variables of a local term FV(M ) is defined inductively on
M:
FV(x) = {x}FV(∗→c←c )M = FV(M )FV(∗←c ) = ∅FV([M, N ]) = FV(M ) ∪ FV(N )FV(abort ) = ∅FV(πl (M )) = FV(M )FV(πr (N )) = FV(N )FV(⟨M, N ⟩) = FV(M ) ∪ FV(N )FV(inl(M )) = FV(M )FV(inr(M )) = FV(M )FV(λx.M ) = FV(M ) \ {x}FV((M N )) = FV(M ) ∪ FV(N )FV(match M of inl(x).N/inr(y).O) = FV(M ) ∪ (FV(N ) \ {x}) ∪ (FV(O) \ {y}) .
A closed local term is a local term that has no free variables.
A global term is a partial map from processes to local terms. For example, a global
term {0 7→ λx.x, 1 7→ y} maps process 0 to local term λx.x and process 1 to local termy. We can substitute a local term for a variable in a global term. The substitution is65External Rules
ij-comEC

H0Γ ⊢ [i]φ

H0

H1

H

Γ ⊢ φ+
H

H1∆ ⊢ [j]ψ

Γ ⊢ [i]ψ

∆ ⊢ [j]φEWΓ ⊢ φ+EEΓ ⊢ φ+H+Γ ⊢ φ+H+HΓ ⊢ φ+∆ ⊢ ψ+

H′H∆ ⊢ ψ+Γ ⊢ φ+

H′

H[i]ψ, [i]ψ, Γ ⊢ φ+

Inner Global Rules
IEHΓ, [i]φ, [j]ψ, ∆ ⊢ θ+HΓ, [j]ψ, [i]φ, ∆ ⊢ θ+
∧I

H0

H

IW

Γ ⊢ φ+

HIC[i]ψ, Γ ⊢ φ+[i]ψ, Γ ⊢ φ+H0

Γ, ∆0 ⊢ (φi )i∈I

H1Γ, ∆0 , ∆1 ⊢ (φk ∧ ψk )k∈I∩J ⊔ (φi )i∈I\J ⊔ (ψj )j∈J\I∧EHΓ ⊢ (φi )i∈IHΓ ⊢ (φi )i∈J

H1HΓ, ∆1 ⊢ (ψj )j∈J

where J is a subset of I.

Inner Local Rules[i]Ax[i]φ, Γ ⊢ [i]φ[i] ⊃ I[i] ∧ E0[i] ∨ I0[i] ∨ EH[i]φ, Γ ⊢ [i]ψHΓ ⊢ [i](φ ⊃ ψ)

H

[i]⊥E

[i] ⊃ EH0

Γ, ∆0 ⊢ [i](φ ⊃ ψ)H0H1

Γ ⊢ [i](φ ∧ ψ)HΓ ⊢ [i]φHΓ ⊢ [i]φH
H0[i] ∨ I1

Γ, ∆0 ⊢ [i](φ ∨ ψ)
H0

H1
H1

[i]φ, Γ, ∆1 ⊢ [i]θH2Γ ⊢ [i]⊥HΓ ⊢ [i]φΓ, ∆1 ⊢ [i]φΓ, ∆0 , ∆1 ⊢ [i]ψ[i] ∧ E1

Γ ⊢ [i](φ ∨ ψ)

H1

H

H2

H

H

Γ ⊢ [i](φ ∧ ψ)HΓ ⊢ [i]ψ

HΓ ⊢ [i]ψ
Γ ⊢ [i](φ ∨ ψ)[i]ψ, Γ, ∆2 ⊢ [i]θΓ, ∆0 , ∆1 , ∆2 ⊢ [i]θFigure 3.2: The underlying logic. Metavariables φ+ and ψ + stand for global formulae.
Metavariables i and j stand for processes. For the use of ⊔, see Section 1.2. Hstands for a possibly empty hypersequent. H+ stands for a nonempty hypersequent.
Γ and ∆ stand for possibly empty contexts. In the names of the rules, I at the end
stands for introduction and E for elimination. For the structural rules, E stands forexchange, W for weakening and C for contraction. The I’s in front stand for internaland E for external. A rule [i] ∧ I is omitted because the inner global rule ∧I is moregeneral. There is no disjunction elimination in the inner global rules lest it is diﬃcult(if possible) to translate the rule into waitfree computation.
66

defined elementwise: i.e., the result of the substitution M + [N/x] maps a process i to
(M + (i))[N/x]. A closed global term is a global term whose image only contains closed
local terms. Informally, the local terms represent parts of programs executed by theprocesses. Especially, (∗→c←c )t and ∗←c cause processes to communicate.
Using these terms, we annotate the hypersequent system in Figure 3.2. We extend
a sequent to Γ ⊢ M + : φ+, where Γ is a sequence like x : [i]ψ, y : [j]θ and M + is a global
term. In a sequent Γ ⊢ M + : φ+, we require the variables in Γ to be distinct fromeach other. We do not allow a context to contain both x : [0]I and x : [1]I, or evenx : [0]I twice. An (extended) hypersequent is a finite sequence of sequents (each called
a component) where the same variable has the same type even if it appears in diﬀerent
components. The typing rules for the terms are given in Figure 3.3. For example, theproof in Figure 3.1 can be annotated as in Figure 3.4. Each derivation has a unique
hypersequent at the bottom, which is called the endhypersequent of the derivation. A
hypersequent is derivable when there is a derivation whose endsequent is identical tothe hypersequent.
Example 3.2.2 (A typing of a global term.) The global term→c{0 7→ [⟨(∗→d←c )x, x⟩, x], 1 7→ [⟨(∗←d )y, y⟩, y]}can be typed (Figure 3.5).

3.2.3

Reduction

A hyperterm O is a nonempty sequence of global terms. From a hypersequent Γ0 ⊢M0 + : φ0 +···Γn ⊢ Mn + : φn + , we can construct a hyperterm (Mi + )0≤i≤n . The

hyperterm (Mi + )0≤i≤n is typable when the aforementioned hypersequent is derivablefor some Γi ’s and φi + ’s.
A store maps a location to a pure, closed term or ϵ, where a pure term is a term
without ∗→c←c or ∗←c . For a store S, the updated store S[c 7→ x] maps c to x and dto S(d) if d is diﬀerent from c. A configuration is a pair (S, O) of a store S and a
hyperterm O. A typed configuration is a configuration (ϵ, O) where ϵ is the empty
store and O is a typable hypersequent.
To complete the definition of λ-GD, we define the reductions ⇝♠ of configurationsfor ♠ ∈ {B, W, R, A, P}, where B stands for basic, W for write, R for read, A for
abort and P for permutative reductions. We consider terms up to α-equivalence andimplicitly require all instances of ⇝♠ to avoid free variable captures.

67

O0

com

Γ ⊢ {i 7→ M } : [i]φO1

∆ ⊢ {j 7→ N } : [j]ψΓ ⊢ {i 7→ (∗→d←c )M } : [i]ψO0O1
∆ ⊢ {j 7→ (∗→c←d )N } : [j]φwhere locations c and d are fresh and no location is contained in both of the two branches.
O

EC

EW

IW

Γ ⊢ (Mi )i∈I : (φi )i∈IOO+Γ ⊢ {} : φ+

O+
O
O

EE

O

Γ ⊢ M + : φ+∆ ⊢ N + : ψ+O′O

∆ ⊢ N + : ψ+Γ ⊢ M + : φ+O′Γ ⊢ M + : φ+ICx : [i]ψ, Γ ⊢ M + : φ+IE∧IΓ ⊢ (Ni )i∈I : (φi )i∈IΓ ⊢ ([Mi , Ni ])i∈I : (φi )i∈Ix : [i]φ, y : [i]φ, Γ ⊢ M + : ψ +Ox : [i]φ, Γ ⊢ M + [x/y] : ψ +OΓ, x : [i]φ, y : [j]ψ, ∆ ⊢ M + : θ+OΓ, y : [j]ψ, x : [i]φ, ∆ ⊢ M + : θ+O0

Γ, ∆0 ⊢ (Mi )i∈I : (φi )i∈I

O1Γ, ∆0 , ∆1 ⊢

O0

O

O1

Γ, ∆1 ⊢ (Nj )j∈J : (ψj )j∈J(⟨Mk , Nk ⟩)k∈I∩J ⊔ (Mi )i∈I\J ⊔ (Nj )j∈J\I : (φk ∧ ψk )k∈I∩J ⊔ (φi )i∈I\J ⊔ (ψj )j∈J\I
∧E

[i]Ax

O

Γ ⊢ (Mi )i∈I : (φi )i∈IOΓ ⊢ (Mj )j∈J : (φj )j∈Jx : [i]φ, Γ ⊢ {i 7→ x} : [i]φ[i]⊥E[i] ⊃ IO0[i] ⊃ E[i] ∧ E0[i] ∨ I0

where J is a subset of I.

Γ ⊢ {i 7→ λx.M } : [i](φ ⊃ ψ)Γ, ∆0 ⊢ {i 7→ M } : [i](φ ⊃ ψ)O1O

Γ ⊢ {i 7→ πl (M )} : [i]φO2Γ, ∆1 ⊢ {i 7→ N } : [i]φ[i] ∧ E1Γ ⊢ {i 7→ M } : [i]φO1O1Γ, ∆0 , ∆1 ⊢ {i 7→ M N } : [i]ψΓ ⊢ {i 7→ inl (M )} : [i](φ ∨ ψ)O0

Γ ⊢ {i 7→ abort } : [i]φOΓ ⊢ {i 7→ M } : [i](φ ∧ ψ)[i] ∨ EO

x : [i]φ, Γ ⊢ {i 7→ M } : [i]ψOOΓ ⊢ {i 7→ M } : [i]⊥

O

O0

O

O

[i] ∨ I1OOΓ ⊢ {i 7→ M } : [i](φ ∧ ψ)OΓ ⊢ {i 7→ πr (M )} : [i]ψOΓ ⊢ {i 7→ M } : [i]ψΓ ⊢ {i 7→ inr (M )} : [i](φ ∨ ψ)O0

Γ, ∆0 ⊢ {i 7→ M } : [i](φ ∨ ψ)O1

x : [i]φ, Γ, ∆1 ⊢ {i 7→ N0 } : [i]θO2y : [i]ψ, Γ, ∆2 ⊢ {i 7→ N1 } : [i]θΓ, ∆0 , ∆1 , ∆2 ⊢ {i 7→ match M of inl(x).N0 /inr(y).N1 } : [i]θFigure 3.3: Term assignment on the λ-GD type system. Metavariable M + stands for
global terms. O stands for a possibly empty hypersequent (with possible subscripts).
O+ stands for a non-empty hypersequent.
68

69

[0]Ax
y : [0]Q ⊢ y : [0]Q

Figure 3.4: An example of a typed term in λ-GD that corresponds the derivation in Figure 3.1.

EC[0] ∨ Ix : [0]P ⊢ x : [0]P

x : [0]P ⊢ (∗→dy : [0]Q ⊢ (∗→c←c )x : [0]Q←d )y : [0]P[0] ⊃ I→d⊢ λx.(∗←c )x : [0](P ⊃ Q)
y : [0]Q ⊢ (∗→c←d )y : [0]P[0] ⊃ I→d→c
⊢ λx.(∗←c )x : [0](P ⊃ Q)
⊢ λy.(∗←d )y : [0](Q ⊃ P )[0] ∨ I→d⊢ inl(λx.(∗←c )x) : [0]((P ⊃ Q) ∨ (Q ⊃ P ))⊢ λy.(∗→c←d )y : [0](Q ⊃ P )→d→c⊢ inl(λx.(∗←c )x) : [0]((P ⊃ Q) ∨ (Q ⊃ P ))⊢ inr(λy.(∗←d )y) : [0]((P ⊃ Q) ∨ (Q ⊃ P ))
[
]
→d
→c
⊢ inl(λx.(∗←c )x), inr(λy.(∗←d )y) : [0]((P ⊃ Q) ∨ (Q ⊃ P ))00-com[0]Ax

70[1] ∨ Ix : [0]X ⊢ x : [0]Xy : [1]Y ⊢ {1 7→ (∗→c←d )y} : [1]X..
.

[1] ∨ I

Ax()
x : [0]X ⊢ {0 7→ inl ⟨(∗→d←c )x, x⟩ } : [0](Y ∧ X) ∨ X

ECy : [1]Y ⊢ y : [1]Y[0] ∨ Ix : [0]X ⊢ x : [0]X
inr(x) : [0]X ⊢ x : [0]((Y ∧ X) ∨ X)

x : [0]X ⊢ {0 7→ x} : [0]X

x : [0]X ⊢ {0 7→ (∗→d←c )x} : [0]YAx

y : [1]Y ⊢ {1 7→ y} : [1]Yy : [1]Y ⊢ {1 7→ inl(⟨(∗→c←d )y, y⟩)} : [1]((X ∧ Y ) ∨ Y )y : [1]Y ⊢ {1 7→ (∗→c←d )y} : [1]XAx

x : [0]X, y : [1]Y ⊢ {0 7→ inr(x), 1 7→ inl(⟨(∗→c←d )y, y⟩)} : {0 7→ (Y ∧ X) ∨ X, 1 7→ (X ∧ Y ) ∨ Y }x : [0]X, y : [1]Y ⊢ {0 7→ inl(⟨(∗→d←c )x, x⟩), 1 7→ inr(y)} : {0 7→ (Y ∧ X) ∨ X, 1 7→ (X ∧ Y ) ∨ Y }x : [0]X ⊢ {0 7→ inl(⟨(∗→d←c )x, x⟩)} : [0]((Y ∧ X) ∨ X)

01-comx : [0]X, y : [1]Y ⊢ {0 7→ inr(x), 1 7→ inl(⟨(∗→c←d )y, y⟩)} : {0 7→ (Y ∧ X) ∨ X, 1 7→ (X ∧ Y ) ∨ Y }x : [0]X, y : [1]Y ⊢ {0 7→ inl(⟨(∗→d←c )x, x⟩), 1 7→ inr(y)} : {0 7→ (Y ∧ X) ∨ X, 1 7→ (X ∧ Y ) ∨ Y }y : [1]Y ⊢ {1 7→ inr(⟨(∗→c←d )y, y⟩)} : [1](X ∧ Y ) ∨ Y

Axy : [1]Y ⊢ {1 7→ inr(⟨(∗→c←d )y, y⟩)} : [1](X ∧ Y ) ∨ Y

Figure 3.5: An example of a typing derivation.

→cx : [0]X, y : [1]Y ⊢ {0 7→ [inl(⟨(∗→d←c )x, x⟩), inr(x)], 1 7→ [inl(⟨(∗←d )y, y⟩), inr(y)]} : {0 7→ ((Y ∧ X) ∨ X), 1 7→ ((X ∧ Y ) ∨ Y )}Part B

Part A

Whole Derivation∧IAx

x : [0]X ⊢ {0 7→ ⟨(∗→dy : [1]Y ⊢ {1 7→ ⟨(∗→c←c )x, x⟩} : [0](Y ∧ X)←d )y, y⟩} : [1](X ∧ Y )( →d)
x : [0]X ⊢ {0 7→ inl ⟨(∗←c )x, x⟩ } : [0](Y ∧ X) ∨ X
y : [1]Y ⊢ {1 7→ ⟨(∗→c←d )y, y⟩} : [1](X ∧ Y )x : [0]X ⊢ {0 7→ ⟨(∗→d←c )x, x⟩} : [0](Y ∧ X)[0] ∨ I

∧I

∧I

Ax

y : [1]Y ⊢ y : [1]Y..
y : [1]Y ⊢ inr(y) : [1]((X ∧ Y ) ∨ Y )
.
( →d
)
∧I
x : [0]X ⊢ {0 7→ inl ⟨(∗←c )x, x⟩ , 1 7→ inr(y)} : {0 7→ (Y ∧ X) ∨ X, 1 7→ (X ∧ Y ) ∨ Y }Part B

Part AWe require all reductions to be congruences. A binary relation R on configurations
is a congruence when
• (S0 , O0 )R(S1 , O1 ) implies(S0 , O0O)R(S1 , O1

• (S0 , O0

M0 + )R(S1 , O1

(S0 , O0O),
M1 + ) implies

M0 + ⊔ N + )R(S1 , O1

M1 + ⊔ N + )• (S0 , O0

{i 7→ M0 } ⊔ M0 + )R(S1 , O1

(S0 , O0{i 7→ C[M0 ]} ⊔ M0 + )R(S1 , O1

{i 7→ M1 } ⊔ M1 + ) implies{i 7→ C[M1 ]} ⊔ M1 + ) for any con-text C• (S, O0M+

N+O1 )R(S ′ , O′ ) implies(S, O0N+

M+O1 )R(S ′ , O′ ) and• (S, O)R(S ′ , O0

M+

N+

+

+

′

(S, O)R(S , O0N

MO1 ) implies
O1 ).

Although only singleton terms appear in these clauses, by congruence, these rules areapplicable to more complicated global terms.
The first kind of reductions, basic reductions, are what one would expect from typed
lambda calculi based on intuitionistic propositional logic with implication, conjunction
and disjunction.
Definition 3.2.3 (Basic reduction) The basic reduction ⇝B is the smallest congruence containing the followings:• (S, {i 7→ (λx.M )N }) ⇝B (S, {i 7→ M [N/x]})• (S, {i 7→ πl (⟨M, N ⟩)}) ⇝B (S, {i 7→ M })• (S, {i 7→ πr (⟨M, N ⟩)}) ⇝B (S, {i 7→ N })• (S, {i 7→ match (inl (M )) of inl(x).N/inr(y).O}) ⇝B (S, {i 7→ N [M/x]})• (S, {i 7→ match (inr (M )) of inl(x).N/inr(y).O}) ⇝B (S, {i 7→ O[M/y]})There are two sorts of reductions that interact with the store. In summary, ∗→d←ctries to write to d and read from c in the store of the configuration. If a term writes
to an empty location, the location is filled with the local term written by the term.
If a term writes to a full location of a store, it does not abort but the store is not
updated. In fact, the contents of locations are never updated after being written.
71This property will be used in the proof of Theorem 3.2.11 (Strong normalization).
The formal definition of the reductions follows.
Definition 3.2.4 (Write reduction) The write reduction ⇝W is the smallest congruence containing the followings:• (S[c 7→ ϵ], {i 7→ (∗→c←d )M }) ⇝W (S[c 7→ M ], {i 7→ ∗←d }) where M is a pure, closedterm• (S[c 7→ N ], {i 7→ (∗→c←d )M }) ⇝W (S[c 7→ N ], {i 7→ ∗←d }) where M is a pure, closedterm.
In the first clause of this definition of write reductions, we require M to be a pure,closed term because a store can only contain pure, closed terms. This restriction on
store contents comes from our aim of modeling asynchronous communication. If weallow stores to contain terms with free variables, the term (λx.(∗→d←c x))M can store x
in the store and another process can read x from the store. After that, if (λx. · · · )M
reduces, then, x becomes M suddenly in the other process. We want to avoid suchsynchronous communication.
We require the same condition in the second clause as well although the store
contents are not changed in the second clause. Otherwise, in order to judge whether aconfiguration admits a write reduction or not, we have to inspect the contents of thestore. This would make the implementation more complicated. More technically, thedefinition of normal forms would depend on the store contents, which we avoided.
After the communicating term (∗→d←c ) writes to the memory, the term changes intoa reader ∗←c . When the reader ∗←c tries to read when c is full, the reader is replacedwith the content of the location c. If a reader tries to read from an empty location ofa store, the reader changes into abort .
Definition 3.2.5 (Read reduction) The read reduction ⇝R is the smallest congruence containing the followings:• (S[c 7→ M ], {i 7→ ∗←c }) ⇝R (S[c 7→ M ], {i 7→ M })• (S[c 7→ ϵ], {i 7→ ∗←c }) ⇝R (S[c 7→ ϵ], {i 7→ abort })The special term abort means failure, so, a term containing abort , except [M, N ],also reduces to abort . The concurrent construction [M, N ] runs M and N concurrently
and throws away those subterms that reduce to abort . To be specific, the term [M, N ]reduces to M or N . The reduction rules are not symmetric with regard to the left72

component and the right component of the concurrent construct [M, N ] because whenboth components succeed, the whole construct reduces to the left component.
Definition 3.2.6 (Abort propagation reduction) The abort propagation reduction ⇝A is the smallest congruence containing the followings:• (S, {i 7→ [abort , M ]}) ⇝A (S, {i 7→ M });• (S, {i 7→ [M, abort ]}) ⇝A (S, {i 7→ M });• (S, {i 7→ [M, N ]}) ⇝A (S, {i 7→ M }) where M and N do not contain abort , ∗→d←cor ∗←c for any locations c, d;• (S, {i 7→ C[abort ]}) ⇝A (S, {i 7→ abort }) where C[•] is defined by BNF:
C[•] ::=• | C[•]N | M C[•] | (∗→c←c )C[•] | inl (C[•]) | inr (C[•]) | ⟨C[•], N ⟩ |⟨M, C[•]⟩ | πi□ C[•] | match M of inl(x).N/inr(y).C[•] |match C[•] of inl(x).N/inr(y).O | match M of inl(x).C[•]/inr(y).O
For example, the configuration (S, [abort , abort ]) reduces to (S, abort ).
In order to avoid the situation where computation is blocked by a syntactic barricade, we add yet another kind of reduction rules called permutative reductions2 .
Definition 3.2.7 (Permutative reduction) The permutative reduction ⇝P is thesmallest congruence containing the followings:• (S, {i 7→ (match M of inl(x).N/inr(y).O) P }) ⇝P(S, {i 7→ match M of inl(x).N P /inr(y).OP })• (S, {i 7→ πd (match M of inl(x).N/inr(y).O)}) ⇝P(S, {i 7→ match M of inl(x).πd N /inr(y).πd O})• (S, {i 7→ match (match M of inl(x).N/inr(y).O) of inl(u).P/inr(v).Q}) ⇝P(S, {i 7→ match M of inl (x) .(match N of inl(u).P/inr(v).Q)/
inr (y) .(match O of inl(u).P/inr(v).Q)})• (S, {i 7→ [M, N ]P }) ⇝P (S, {i 7→ [M P, N P ]})• (S, {i 7→ πd [M, N ]}) ⇝P (S, {i 7→ [πd M, πd N ]})• (S, {i 7→ match [M, N ] of inl(x).P/inr(y).Q}) ⇝P(S, {i 7→ [match M of inl(x).P/inr(y).Q, match N of inl(x).P/inr(y).Q]})
2 The “permutative” conversions can be found in Prawitz [119].

73

We define ⇝ to be the union of ⇝B , ⇝W , ⇝R , ⇝A and ⇝P . The reflexive
transitive closure of ⇝ is written as ⇝∗ . A redex is a subterm that can be rewritten
by a reduction. A configuration C is normal when there is no configuration D withC ⇝ D. A term M is normal when the configuration (S, M ) is a normal configuration(the choice of S is irrelevant).
Example 3.2.8 (Reductions of λ-GD) We take the term shown in Figure 3.5 andreplace x and y with pure, closed terms v and w. Below, an underlined subterm is aredex:(→c{}, {0 7→ [⟨(∗→d←c )v, v⟩, v], 1 7→ [⟨(∗←d )w, w⟩, w])()⇝W {d 7→ v}, {0 7→ [⟨∗←c , v⟩, v], 1 7→ [⟨(∗→c←d )w, w⟩, w]}()⇝R {d 7→ v}, {0 7→ [⟨abort , v⟩, v], 1 7→ [⟨(∗→c
)w,
w⟩,
w]}
←d
(
)
⇝A {d 7→ v}, {0 7→ [abort , v], 1 7→ [⟨(∗→d←c )w, w⟩, w]}()⇝A {d 7→ v}, {0 7→ v, 1 7→ [⟨(∗→c
)w,
w⟩,
w]}
←d
(
)
⇝W {c 7→ w, d 7→ v}, {0 7→ v, 1 7→ [⟨∗←d , w⟩, w]})(⇝R {c 7→ w, d 7→ v}, {0 7→ v, 1 7→ [⟨v, w⟩, w]}⇝A ({c 7→ w, d 7→ v}, {0 7→ v, 1 7→ ⟨v, w⟩}).

The overall eﬀect is the transfer of term v from process 0 to process 1. In the beginning,v only appears in process 0’s local term but not in process 1’s local term. In the end,
the term v appears in both processes’ local terms. From the first line to the second
line, process 0’s communication term succeeds in writing term v to location d. Fromthe second line to the third line, process 0 fails to read from location c so that areader construct is turned into an abort . This failure occurs because process 0 tries toread before process 1 writes. In a diﬀerent scheduling (or, evaluation strategy) sucha failure can be avoided. This kind of nondeterminism is essential to characterize
waitfreedom later. From the third line to the fourth line, the abort in process 0’s
subterm is propagated so that the whole pair containing abort is turned into abort .
From the fourth line to the fifth line, the aborted subterm in process 0 is thrown away:
this is the main functionality of the concurrent construction [M, N ]. From the fifthline to the sixth line, process 1 writes to location c. From the sixth line to the seventhline, process 1 reads what process 0 wrote. In this case, the reader in process 1 does notyield abort but outputs a previous content of the store. From the seventh line to thelast line, the right side component w of [⟨v, w⟩, w] is thrown away: we chose to throw
away the right hand side component when both sides of [M, N ] contain no abort . When74

we view the concurrent construction [M, N ] as a representation of external contraction
rule, this asymmetry is strange, but the asymmetry plays a significant role in encoding
waitfree computation in our calculus.
3.2.4

Properties

An important property of λ-GD is strong normalization: every typed hyperterm has afinite, maximum number of ensuing reductions. Another property is non-abortfullness:
although some reductions yield abort terms, a typed hyperterm never reduces to a
hyperterm that only contains abort ’s. We show the second property first because its
proof is simpler.
Theorem 3.2.9 (Non-abortfullness of λ-GD) All normal forms of a typed configuration contain at least one term that is not abort .
Proof When a reduction sequence is fixed, for any locations c and d, depending onwhether c or d is filled first, either: (i) no ∗←d ⇝ abort occurs, or (ii) no ∗←c ⇝ abort
occurs.
In case (i), we can rewrite a communication rule occurrenceΓ, ∆ ⊢ {i 7→ M } : [i]ψ

O0
O0

O1

O1

Γ ⊢ {i 7→ (∗→d←c )M } : [i]τΓ, ∆ ⊢ {j 7→ N } : [j]τ∆ ⊢ {j 7→ (∗→c←d )N } : [j]ψinto a weakening occurrence (using Proposition 3.2.10 proved below)
O0O0Γj , ∆j ⊢ {j 7→ M } : [j]ψ⊢ {i 7→ abort } : [i]τΓj , ∆j ⊢ {j 7→ M } : [j]ψwhere Γj denotes the context obtained by replacing every modality in Γ with j. Incase (ii), we can do the symmetric.
After these rewritings for all appearing locations, we obtain a derivation not containing any locations. Moreover, the endhypersequent of the rewritten derivation has
a component not containing abort . The reductions of the original hyperterm canbe simulated by the rewritten hyperterm. And, even after reductions, the resulting
hyperterm has a component not containing abort .

■In order to justify the renaming operation appearing in the proof of Theorem 3.2.9,
we first define the renaming operation on global types. Of a global type φ+ = (φi )i∈I∧
(the global type that maps i to φi ), the j-replacement φ+j is {j 7→ i∈I (φi )}. For
example, the 1-replacement of [0]⊥ is [0]⊥1 = [1]⊥.
For a context Γ = x0 : [i0 ]φ0 , x1 : [i1 ]φ1 , x2 : [i2 ]φ2 , . . . , xn : [in ]φn , the j-replacementjΓ is x0 : [j]φ0 , x1 : [j]φ1 , x2 : [j]φ2 , . . . , xn : [j]φn .
75

Proposition 3.2.10 (Process renaming) When O

Γ0 , ∆0 ⊢ M + : φ+ is deriv-

able,
O

m
′
+m
Γm
0 , ∆0 ⊢ {m 7→ M } : φis also derivable for some local term M ′ .
Proof By induction on the height of derivation. All rules except com and EC are
trivial because they do not interact with the modalities. For the EC rule, we have toapply the induction hypothesis twice to change modalities in two components. For thecom rule, let us assume the derivation ends in the com rule as:
O0Γ ⊢ M : [i]φO1Γ ⊢ (∗→d←c )M : [i]ψO0O1

∆ ⊢ N : [j]ψ∆ ⊢ (∗→c←d )N : [j]φ.

We have to consider three cases: first, when Γ0 , ∆0 ⊢ M + : φ+ in the statement isin [O0 , O1 ]; second, when Γ0 , ∆0 ⊢ M + : φ+ in the statement is identical to Γ ⊢++(∗→din the statement is identical to←c )M : [i]ψ; and third, when Γ0 , ∆0 ⊢ M : φ+∆ ⊢ (∗→cis←d )N : [j]φ. The second and third cases are symmetric. In the first case, M

actually a concurrent construct ([Pi , Qi ])i∈I . We can apply the induction hypothesis
to P and Q and combine them again {m 7→ [P ′ , Q′ ]}. In the second case, we can use
the induction hypothesis on the left branch3 .

■Strong Normalization
For proving strong normalization, we use an auxiliary relation, which is similar to the
reduction ⇝. We denote the relation by ;. The ; relation (symmetric reduction)is also a congruence. All reductions are symmetric reductions. In addition to reductions, symmetric reductions contain pairs like [M, N ] ; N when N does not containany abort , ∗→d←c or ∗←c . Ordinary reductions are not symmetric because it allows(S, {i 7→ [M, N ]}) ⇝A (S, {i 7→ M }) but not (S, {i 7→ [M, N ]}) ⇝A (S, {i 7→ N }).
This asymmetry allows us to encode waitfree computation in our calculus. However,
it is easier to prove strong normalization for the symmetric reductions. When strong
normalization for the symmetric reductions holds, the same property holds for the
reductions because there are less pairs in reductions than in symmetric reductions.
3 One crucial thing is our choice of the form of the com rule. If we use the com’ rule by Avron [8],the proof does not proceed because the contexts Γ and ∆ are duplicated asO0O0Γ, ∆ ⊢ M : [i]φO1O1Γ ⊢ (∗→d←c )M : [i]ψΓ, ∆ ⊢ N : [j]ψ∆ ⊢ (∗→c←d )N : [j]φ.

There, if we want to change the modalities in the rightmost component naively, we also have to change
the modalities in the second rightmost component.

76

Theorem 3.2.11 (Strong normalization of λ-GD) λ-GD is strongly normalizing.
Proof For proving this, we consider the pure fragment that does not contain (∗→d←c )M ,(∗→c←d )N . We first reduce the strong normalization of the λ-GD to that of the purefragment, and ultimately to that of de Groote’s natural deduction with permutationconversion [41]4 .
We assume an infinitely long sequence of reductions, namely, (S 0 , O0 ) ⇝ (S 1 , O1 ) ⇝(S 2 , O2 ) ⇝ · · · . From this, we are going to construct an infinitely long sequence ofsymmetric reductions in the pure fragment.
For that, we first build an infinite reduction sequence with constant stores. Using
the original infinite sequence, we define a store called the store prophecy S∞ where
S∞ (c) is defined to be ϵ if Sk (c) = ϵ holds for all k ∈ ω and S∞ (c) is defined to be M
if Sk (c) = M holds for some k ∈ ω. Since store contents are never overwritten, S∞ iswell defined. Moreover, Si (c) and S∞ (c) coincide unless Si (c) = ϵ.
We build another reduction sequence (S ∞ , O0 ) ⇝∗ (S ∞ , O1′ ) ⇝∗ (S ∞ , O2′ ) ⇝∗ · · ·with the following invariant: Oi′ can be obtained by replacing some abort occurrencesin Oi with some terms. More specifically, we translate each reduction as follows,
keeping the invariant inductively on the number of steps (the base case is satisfied by
O0′ = O0 immediately):• a read reduction (S k , C [∗←c ]) ⇝R (S k+1 , C [O]) is translated into (S ∞ , C ′ [∗←c ]) ⇝R(S k+1 , C ′ [O′ ]) for a context C ′ . If Si (c) is a term, S∞ (c) and O′ are also identicalto the term. Otherwise, O′ must be abort . Thus, the invariant holds for k + 1.
• a write reduction (S[c 7→ ϵ], C [(∗→c←d )M ]) ⇝W (S[c 7→ M ], C [∗←d ]) is translated′
into (S ∞ , C ′ [(∗→c←d )M ]) ⇝W (S ∞ , C [∗←d ]);• an abort reduction of the form (S k , C [C[abort ]]) ⇝A (S k+1 , C [abort ]) can betranslated either to a similar reduction or no reduction if the abort in the redex
is replaced by another term in the O′ k . Note that even in that case, the result
O′ k+1 can be obtained by replacing some abort occurrences in Ok+1 with otherterms;• any other reduction (S k , C [M ]) ⇝B/P (S k+1 , C [N ]) is translated into one similar
reduction (S ∞ , C ′ [M ′ ]) ⇝B/P (S ∞ , C ′ [N ′ ]).
4 To the same eﬀect, we might be able to use other strong normalization results for lambda calculi

with commutative conversions, like Balat, Di Cosmo and Fiore [15].

77Here, we have to show that the translated sequence of symmetric reductions is infinite.
For that, we can use the facts that there are only finite number of mentioned locations
and that each location allows only one write, and that an abort propagation always
strictly shortens the term under operation.
After that, we can replace every ∗←c with S∞ (c). Since ∗←c either reduces to
S∞ (c) or abort , replacing it with S∞ (c) will only “shorten” the reduction sequence
for at most one read step. Replacing all readers makes an infinite reduction sequencein the pure fragment. Moreover, the result of the translation is also well typed5 . A
typing derivation of the resulting hyperterm can be obtained by replacing com ruleswith EW rules and changing the process number in global types of some variables (c.f.
the proof of Theorem 3.2.9).
We are aiming at reducing the problem to the strong normalization result by de→cGroote [41]. Since we have eliminated (∗→d←c )M and (∗←d )N occurrences, the remain-

ing diﬀerence from de Groote’s lambda calculus [41] is small: some abort propagation
reductions and some permutative reductions involving [M, N ]. We just have to makesure that there are no infinite reduction sequences that consist of only these two kindsof reductions. We can deal with the permutative reductions following de Groote [41]’s
strategy for introducing ⊥. There are no infinite sequence of abort propagation reductions keeping the number of [M, N ] constructions; and an abort propagation reduction
cannot increase the number of [M, N ] constructions in a configuration. Combined,
there are no infinite sequence of abort propagation reductions.

■

Strong normalization and non-abortfullness hold even for reductions where ∗→d←coperators are copied or discarded. This is diﬀerent from the situation in Chapter 2
where discarding term c causes the peer c̄ to deadlock. This is the reason why we canuse intuitionistic propositional logic rather than linear (or aﬃne) logics in this chapter.

3.3

Typed Waitfreedom

Waitfree protocols [70, 125] are a class of protocols that can solve some of the inputoutput problems [19, 110]. If a waitfree protocol solves an input-output problem,
then we call the protocol to be in the waitfreedom. We define the typed version of
waitfreedom. Since these definitions are involved, we supply many examples.

5 Because each channel c is uniquely associated with a type φ in the original derivation and S (c)∞is a closed term of type φ.

78

3.3.1

Typed Input-Output Problem

Saks and Zaharoglou [125] formulated waitfreedom as a class of input-output problems.
Given inputs for all processes and outputs of all processes, an input-output problem
decides whether the processes have succeeded or not. We change the standard definition and have typed terms as inputs and outputs. This change is necessary because
according to the original definition of waitfreedom, a single process waitfree protocol
can solve any undecidable problem because a waitfree protocol can contain arbitrary
functions.
In order to define the set of inputs and outputs, we let T − (φ) denote the set ofclosed, pure terms of type φ, and V − (φ) denote the set of normal terms in T − (φ).
For a finite set of processes P, a typed input-output problem consists of each process’s∏
input type (ιi )i∈P , each process’s output type (oi )i∈P , and a task R ⊆ i∈P (T − (ιi )) ×∏−i∈P (V (oi )). In words, a task R decides whether a pair of inputs and outputs isgood or not.
Example 3.3.1 (The addition problem) Let the set P be {0, 1}, the types ι0 , ι1 ,o0 and o1 be natural numbers6 . Now we can define a task requiring at least one of theprocesses outputs the addition of the inputs. Specifically,R+ ={⟨{0 7→ x, 1 7→ y}, {0 7→ (x + y), 1 7→ z}⟩ | x, y, z ∈ N}
∪ {⟨{0 7→ x, 1 7→ y}, {0 7→ z, 1 7→ (x + y)}⟩ | x, y, z ∈ N} .
The equation above says the task R+ allows two diﬀerent kinds of behavior. The firstclause says if process 0 receives x and process 1 receives y as their inputs, and process 0
outputs x+y; then whatever process 1 outputs, the two processes are considered to have
solved the task. The second clause poses a symmetric condition where the two processes
are swapped. In order to solve the task R+ , it is enough for one of the two processes
to give the correct answer.
Example 3.3.2 (The exchange problem) There is another problem that requires
two processes to exchange their inputs. Namely,
Rexch ={⟨{0 7→ x, 1 7→ y}, {0 7→ y, 1 7→ x}⟩ | x, y ∈ {tt, ff}} .

6 Actually, the type of natural numbers is not definable in our language.

However, since we candefine a three-valued type, we can make the same argument below using Z/3 instead of natural
numbers.

79

3.3.2

Typed Protocols

We assume a finite set P of processes and a countably infinite set of program variables
ProV = {x, y, z, . . .}. Program variables are typeset in the typewriter font. We assume
an injection from variables to program variables x 7→ xx , whose image leaves infinitely
many unused program variables.
A program is defined by BNF:
p ::= ϵ | x ← E; p | c ← E; p
where c is a location and an expression E is
E ::= x | x | c | (EE) | λx.E | ⟨E, E⟩ | inl (E) | inr (E) |πl (E) | πr (E) | match E of inl(x).E/inr(y).E | ϵ .
Here, the expression ϵ is used as the initial placeholder of the shared memory.
A program is well formed when any program variable x (resp. location c) first
appears in a x ← E (resp. c ← E) sentence where E does not contain x (resp. c), andafter that, only appears in expressions. In other words, a well-formed program is in
the single assignment form.
A contexted type Γ ⊢ φ+ is a sequent without a term but with variables in Γ. For
a contexted type (Γ ⊢ φ+ ), we write M : (Γ ⊢ φ+ ) for Γ ⊢ M : φ+ . For input types(ιi )i∈P and output types (oi )i∈P , a typed protocol 7 has:
• two program variables ii and oi for each process i;• a finite set of locations C;• two functions w : C → P and r : C → P (specifying the writer and the reader of
each location);• W : maps a location in C to a contexted type;• V : a finite set of program variables that contains ii ’s and oi ’s;• a function ti for each i ∈ P that maps a program variable in V to a contexted
type (xk : [i]φk )k ⊢ [i]φ with a special condition ti (ii ) = ιi ;• a typed program pi for each i ∈ P, where a typed program is a well-formed
program where all sentences are typed according to the rules below. A sentence
7 We formulated this definition as close as we can to the definition of waitfree protocols in Saks

and Zaharoglou [126, 2.3.].

80

x ← E is typed iﬀ ⊢ E : [i]ti (x) is derivable with assumptions of the form ⊢y : [i]ti (y) and ⊢ c : W (c). A sentence c ← E is typed iﬀ ⊢ E : [i]W (c) is derivablewith assumptions of the form ⊢ y : [i]t(y) and ⊢ c : [i]W (c).
Example 3.3.3 (The addition protocol) We give a concrete typed protocol thatsolves the addition task (Example 3.3.1). The set C of locations contains two elementsc and d. The locations c and d will be used as follows: process 0 writes to d and reads
from c, and process 1 writes to c and reads from d. Formally, w(c) = 1, w(d) = 0,r(c) = 0 and r(d) = 1. Both locations will contain natural numbers. Formally,
W (c) = W (d) = N. The set of program variables V is just {i0 , i1 , o0 , o1 }. The
typed programs are
p0 = d ← i0 ; o0 ← add(c, i0 ); o0 ← i0 and
p1 = c ← i1 ; o1 ← add(d, i1 ); o1 ← i1
where add(M, N ) is a specially introduced8 term that reduce to the sum. The last two
sentences of each program write to the same variable. Although a variable is never
updated after being filled, the second write is still meaningful because the first write
may fail. We omit the type assignments t0 , t1 and typing derivations.
3.3.3

Typed Waitfree Computation

We define when a typed protocol solves a typed input-output problem. This definition is obtained by modifying Saks and Zaharoglou’s definition of input-output
problems [125].
A closed local term M is of type φ iﬀ there is a derivation of ⊢ {0 7→ M } : [0]φ. Let
P be {0, . . . , n − 1} and fix a typed protocol. We are going to define a virtual machinefor executing the typed protocol. In order to do that, we first define snapshots of thevirtual machine. After this, we will define the transition from snapshots to snapshots.
Definition 3.3.4 A program variable content for i ∈ P is a partial function that maps
a program variable to a closed local term of ti (x). A global term M + is of a contexted
type Γ ⊢ φ+ when Γ ⊢ M + : φ+ is derivable. A process snapshot of i ∈ P is a tuple⟨p, m⟩ where p is either a program or abort and m is a program variable content for i.
→→
We let S denote the set of process snapshots for i. A system snapshot is a pair ⟨−
s ,−
v⟩
i

−
of process snapshots and a shared memory snapshot, where →s = ⟨s0 , s1 , . . . , sn−1 ⟩ ∈∏∏−→i∈P (Si ) and v = (vc )c∈C ∈c∈C (V(W (c)) ∪ {ϵ}).
8 If we choose Z/3, we do not need to introduce a special term, but we can define addition using

nested match constructs.

81Definition 3.3.5 For a nonempty subset J of P, we define an operator ◁ J thattakes a system snapshot and produces a system snapshot. This operator depicts a
computational step where the processes in J are fired.
→→→→
We define (−s ,−v ) ◁ J = (−u,−m) by defining ui and mc for i ∈ P and c ∈ C. Let
si be ⟨p, x⟩: when i is not in J, ui is identical to si ; otherwise, when i is in J:


′

−
(if p = c ← E; p′ and JEKx,→⟨p , x⟩v = ϵ)
′⟨p′ , x[x 7→ JEK →−x(x) = ϵ and JEKx,→x,−v ]⟩ (if p = x ← E; p ,v ̸= ϵ)ui =−⟨p′ , x⟩
(if p = x ← E; p′ but x(x) ̸= ϵ or JEKx,→v = ϵ)⟨ϵ, x⟩(if p = ϵ)JEK →(if p = c ← E; p′ , w(c) = i and vc = ϵ)
x,−
v
mc =

vc
(otherwise)−with the following notations. The term JEKx,→v is defined as the unique normal form of
−
→
−
→
−
→
−
→
the local term E[x( y )/ y ][ v / c ], where every program variable y is replaced by x(y)c−and every location c is replaced by vc . If any of the substitutes is ϵ, JEKx,→v is defined

to be ϵ.
Definition 3.3.6 A block is a nonempty subset of P. A schedule is an infinite sequenceof blocks, which looks like σ = σ0 σ1 σ2 · · · . We say i is non-faulty (resp. faulty) in σ if
it appears infinitely (resp. only finitely many) often. When every process is non-faulty,
the schedule is fair.
Example 3.3.7 (An example of schedules) When P is a singleton {0}, there is
only one schedule ({0}, {0}, {0}, . . .) where “. . .” contains only {0}’s. Since 0 is the
only process and 0 is non-faulty, this schedule is fair.
Assume P = {0, 1}. There is a schedule which is not fair: ({0}, {0}, {0}, . . .) where“. . .” contains only {0}’s. Even when we add a finite prefix to an unfair schedule, theschedule is still not fair because no process can appear infinitely often in that finite
prefix.
Obviously, when a schedule contains infinitely many {0, 1}’s, then the schedule isfair. Not only that, but when a schedule contains infinitely many {0}’s and infinitely
many {1}’s, then the schedule is fair. In the other direction, a fair schedule mustsatisfy one of these conditions.

82

→
−
Definition 3.3.8 A run is a triple ⟨Π, −x , σ⟩, where Π is a typed protocol, →x ∈∏−i∈P T (ιi ) is the input, and σ is a schedule. The execution associated to the run is−→ −→defined as the infinite sequence of system snapshots C0 C1 C2 · · · , where C0 = ⟨ s0 , v 0 ⟩→−is defined by s0i = ⟨pi , [ii 7→ xi ]⟩ and vc = ϵ, and Ck+1 is defined to be Ck ◁ σk . Since
all programs are finite, the system snapshot will stay constant after initial finite steps.
We call that constant system snapshot the final system snapshot of an execution.
Example 3.3.9 (An example of a run and an execution) Let P be {0, 1} and Π
be the typed protocol given in Example 3.3.3. let us take x0 = 3 and x1 = 4. Also
we choose a schedule σ as {0}, {0}, {0, 1}, {1}, {1}, followed by an infinite sequence of−{0, 1}’s. The triple ⟨Π, →x , σ⟩ constitutes a run.
We can associate an execution with this run. The initial system snapshot C0 =−→0 −→⟨ s , v 0 ⟩ contains process snapshots
s00 = ⟨p0 , {i0 7→ 3}⟩ and s01 = ⟨p1 , {i1 7→ 4}⟩−→
where p0 and p1 are defined in Example 3.3.3. In the system snapshot, v 0 maps both locations c and d to ϵ. The next system snapshot C1 is defined to be C0 ◁ σ0 . Since σ0 ={0}, it does not contain 1. So, s11 is the same as s01 . On the other hand, since p0 is d ←i0 ; o0 ← add(c, i0 ); o0 ← i0 , s10 is defined to be ⟨o0 ← add(c, i0 ); o0 ← i0 , {i0 7→ 3}⟩
and vd1 is defined to be 3. However, vc1 is the same as vc0 and thus remains to be ϵ. We
conclude that C1 = ⟨{0 7→ s10 , 1 7→ s11 }, {c 7→ ϵ, d 7→ 3}⟩. Again, the next snapshot C2
is defined to be C1 ◁ σ1 . Since σ1 = {0}, process 1’s state is not changed so that s20 =s10 = ⟨p1 , {i1 7→ 4}⟩. On the other hand, since s10 = ⟨o0 ← add(c, i0 ); o0 ← i0 , {i0 7→ 3}⟩
and 0 is in σ1 , process 0’s state is updated to s20 = ⟨o0 ← i0 , {i0 7→ 3}⟩ where theprocess failed to read from the location c because vc1 is ϵ. As a result, the program
variable oi obtained no assignments. The store contents are not updated either so thatvc2 = vc1 = ϵ and vd2 = vd1 = 3. After four more rounds (including i = 6 to confirm
C5 = C6 ), we obtain an execution shown in Table 3.1. Since Ci = C5 for i > 5, thesystem snapshot C5 is the final system snapshot of this execution.
Definition 3.3.10 Process i’s output oˆk at step k is M if the i-th process snapshot of
Ck is (p, x) and the x[oi ] = M , which might be ϵ. The decision value of i on the run→⟨Π, −x , σ⟩, denoted di ∈ V − (oi ) ∪ {ϵ} is the first non-ϵ output in the sequence (oˆk )k∈ω ,−→or ϵ if such an output does not exist. The decision vector of the run is the n-tuple dconsists of decision value di ’s.

83

84

⟨c ← i1 ; o1 ← add(d, i1 ); o1 ← i1 , {i1 7→ 4}⟩⟨c ← i1 ; o1 ← add(d, i1 ); o1 ← i1 , {i1 7→ 4}⟩⟨c ← i1 ; o1 ← add(d, i1 ); o1 ← i1 , {i1 7→ 4}⟩⟨o1 ← add(d, i1 ); o1 ← i1 , {i1 7→ 4}⟩⟨o1 ← i1 , {i1 7→ 4, o1 7→ 7}⟩⟨d ← i0 ; o0 ← add(c, i0 ); o0 ← i0 , {i0 7→ 3}⟩⟨o0 ← add(c, i0 ); o0 ← i0 , {i0 7→ 3}⟩⟨o0 ← i0 , {i0 7→ 3}⟩⟨ϵ, {i0 7→ 3, o0 7→ 3}⟩⟨ϵ, {i0 7→ 3, o0 7→ 3}⟩⟨ϵ, {i0 7→ 3, o0 7→ 3}⟩

0

1

2

3

4

≥5

⟨ϵ, {i1 7→ 4, o1 7→ 7}⟩

si1

si0

i

Table 3.1: An example of execution of a typed protocol defined in Example 3.3.3.

4

4

4

ϵ

ϵ

ϵ

vci

3

3

3

3

3

ϵ

vdi

{0, 1}

{1}

{1}

{0,1}

{0}

{0}

σi

→
− ∏
→
− ∏
A vector b ∈ i∈P (V − (oi )) is compatible with d ∈ i∈P (V − (oi ) ∪ {ϵ}) iﬀ di = bi∏−or di = ϵ holds for any process i. For a task R, an input →x ∈ i∈P T − (ιi ) is
−
→ ∏
−
→
→
R-permissible iﬀ there is at least one vector b ∈ i∈P (V − (oi )) with (−x , b ) ∈ R.
Definition 3.3.11 A typed protocol Π solves the typed input-output problem ⟨(ιi )i∈P , (oi )i∈P , R⟩→
on schedule σ iﬀ for all R-permissible inputs −x and a schedule σ, the decision value of−→ ∏every non-faulty process i is a term M not ϵ, and there is a vector b ∈ i∈P (V − (oi ))
→
−
→
−
→
→
with ⟨−
x , b ⟩ ∈ R which is compatible with the decision vector d of the run ⟨Π, −x , σ⟩.
A typed protocol is waitfree iﬀ it solves the problem on every schedule σ. In that case,the typed input-output problem is waitfreely solvable.
Example 3.3.12 (Permissible inputs and outputs) The compatible inputs for the
addition problem in Example 3.3.1 are pairs of natural numbers. For the input (3, 4),
the addition of the inputs is 7, but the addition problem requires at least one process
to output the sum. Moreover, when process 0 is faulty, process 0 is allowed to output
ϵ. In that case, whatever natural number process 1 outputs, the addition problem is−→solved because any (ϵ, n)(n ∈ N) is compatible with some vector b in R+ . In short, inthe addition problem, if one process outputs ϵ, the other process is allowed to output
whatever.
Example 3.3.13 (An example of a typed protocol solving the addition task)
In the execution in Table 3.1, we can replace 3 and 4 with any natural numbers and 7with the sum. This shows that the typed protocol in Example 3.3.3 solves the addition
problem in Example 3.3.1 on the schedule
σ = ({0}, {0}, {0, 1}, {1}, {1}, {0, 1}, {0, 1}, . . .)where the last “. . .” represents an infinite sequence consisting of {0, 1}’s. On theschedule σ, both processes 0 and 1 are non-faulty. In Table 3.1, the decision valueof process 0 is d0 = 3 and the decision value of process 1 is d1 = 7. The tuple⟨(x0 , x1 ), (d0 , d1 )⟩ is in R+ . The same argument goes for diﬀerent (x0 , x1 )’s. Thus, thetyped protocol solves the addition problem on schedule σ. Actually, the typed protocol
solves the problem for all schedules. To see why, we can do case analysis on anarbitrarily taken schedule: one case where all processes produce non-ϵ outputs and theother case where one of the prcesses produces a non-ϵ output. There is no possibility
where no processes produce non-ϵ outputs because there are infinitely many blocks ina schedule and each block contains at least one process (by definition of a block). In
the first case, when the first block contains 0, the execution proceeds like in Table 3.1.
85

Otherwise, the first block must contain 1 so that the execution proceeds like Table 3.1
with 0 and 1 swapped. In either case, the typed protocol solves the task. In the second
case, the output producing process can produce whatever output to meet the task because
the other process produces ϵ.
Example 3.3.14 (A waitfreely unsolvable typed input-output problem) On theother hand, there is no typed protocol that solves the exchange problem (Example 3.3.2).
To see the reason, take any typed protocol. There exist natural numbers m and n sothat the typed protocol contains m commands for process 0 and n commands for process 1. Consider a schedule that consists of the first m blocks {0} and the following n
blocks {1} and the rest {0, 1}. Thus process 0 finishes before process 1 starts so thatprocess 0 cannot learn process 1’s input. Because of the infinitely many {0, 1}’s at thetail, under the schedule, both processes are non-faulty so that they must produce thecorrect outputs. However, since process 0 finishes before process 1 starts, there is noway process 0 can output process 1’s input, not by chance. Even when process 0 produces the correct output by chance, when we change process 1’s input, then, process 0’s
output is wrong with regard to process 1’s new input.

3.4

Characterization of Waitfreedom by λ-GD

In this section, we show that the ability of the waitfree protocols and λ-GD are thesame.
Definition 3.4.1 A typed input-output problem ⟨(ιi )i∈P , (oi )i∈P , R⟩ is solvable by aglobal term M + of contexted type (xi : [i]ιi )i∈P ⊢ (oi )i∈P iﬀ for any closed (Ni )i∈P of ιi ,−→ −all normal forms of M + [N /→x ] are in the form (V )where ⟨(N ) , (V ) ⟩ ∈ R.
i

i

i i∈P

i i∈P

i i∈P

Example 3.4.2 (A global term solving the addition problem) For the exclusiveor problem (defined in Example 3.3.1), there is a global term {0 7→ [add((∗→d←c )x0 , x0 ), x0 ], 1 7→
[add((∗→c←d )x1 , x1 ), x1 ]} that solves the problem. The global term can be typed as in Figure 3.6.
Now we can state the most important results in this chapter.
Theorem 3.4.3 (Soundness of λ-GD with regard to waitfreedom) If a typed
input-output problem is solvable by a global term, there exists a typed protocol thatsolves the problem.
In order to prove this theorem, we are going to translate a typed hyperterm intoa typed protocol inductively on the type derivations. To make induction work, we86

87

Whole Derivation

Part B

Part Aadd

add

x : [0]N ⊢ x : [0]N..
.

x : [0]N ⊢ {0 7→ x} : [0]N

x : [0]N ⊢ {0 7→ (∗→d←c )x} : [0]NAx

y : [1]N ⊢ {1 7→ y} : [1]NFigure 3.6: A typed global term that solves the exclusive-or problem (Example 3.3.1).

→cx : [0]N, y : [1]N ⊢ {0 7→ [add((∗→d←c )x, x), x], 1 7→ [add((∗←d )y, y), y]} : {0 7→ N, 1 7→ N}

x : [0]N, y : [1]N ⊢ {0 7→ x, 1 7→ add((∗→c←d )y, y)} : {0 7→ N, 1 7→ N}

x : [0]N, y : [1]N ⊢ {0 7→ add((∗→d←c )x, x), 1 7→ y} : {0 7→ N, 1 7→ N}

y : [1]N ⊢ {1 7→ add((∗→c←d )y, y)} : [1]Ny : [1]N ⊢ {1 7→ (∗→c←d )y} : [1]NAx

x : [0]N, y : [1]N ⊢ {0 7→ x, 1 7→ add((∗→c←d )y, y)} : {0 7→ N, 1 7→ N}

x : [0]N ⊢ {0 7→ add((∗→d←c )x, x)} : [0]N

01-comPart BECy : [1]N ⊢ y : [1]Ny : [1]N ⊢ y : [1]Nx : [0]N ⊢ {0 7→ add((∗→d←c )x, x), 1 7→ y} : {0 7→ N, 1 7→ N}
Axy : [1]N ⊢ {1 7→ add((∗→cx : [0]N ⊢ x : [0]N←d )y, y)} : [1]N∧I→dx : [0]N, y : [1]N ⊢ {0 7→ add((∗←c )x, x), 1 7→ y} : {0 7→ N, 1 7→ N}

Part A∧I

Ax

Ax

y : [1]N ⊢ {1 7→ add((∗→c←d )y, y)} : [1]Ny : [1]N ⊢ {1 7→ (∗→c←d )y} : [1]N..
.

x : [0]N ⊢ {0 7→ add((∗→d←c )x, x)} : [0]N

x : [0]N ⊢ {0 7→ add((∗→d←c )x, x)} : [0]NAx

use the following auxiliary notion. An investigator is a partial map from processes toprogram variables.
For a typed hyperterm O, we will give JOK, which is a tuple of programs indexedby P. Also, we define LOM at the same time as JOK, where LOM is a sequence ofinvestigators. The length of LOM is the same as that of O. We refer to the lastelement of LOLOM

M M as LO

M M, the second to last element of LO

N M asN M and so on.

Example 3.4.4 (Specifying elements of a sequence) Suppose LM +x, 1 7→ y}M{0 7→ z}. Then, LM +N + M = {0 7→ z} and thus LM +N + M = {0 7→
N + M(0) = z.

We let ϵ denote (pi = ϵ)i∈P . Also, (pi )i∈P ; (qi )i∈P denotes (pi ; qi )i∈P . And (p)jdenotes (qi )i∈P where qj = p and qi = ϵ for all i ̸= j. The definition is inductive over
the type derivations. What we do below is essentially compilation from lambda terms
to imperative programs9 . After three pages, there is an example showing compilationof a concrete λ-GD global term.
ij-com
JO0
=JO0

O1

{i 7→ (∗→d←c )M }

{i 7→ M }K; JO1{j 7→ (∗→c←d )N }K

{j 7→ N }K;(d ← LO0{i 7→ M }M(i); x ← c)i ;(c ← LO1{j 7→ N }M(j); y ← d)j ,LO0{i 7→ (∗→d←c )M }

=LO0

O1

{i 7→ M }M

{j 7→ y}LO1

{j 7→ (∗→c←d )N }M

{j 7→ N }M

{i 7→ x}where x and y are new variables not used in induction hypotheses (we omit
writing this restriction on each case below),
EW
JO

abort K = JOK ,LO

abort M =LOM

∅ ,9 That is one reason to try implementing it using Haskell in Chapter 5 because the Haskell compiler

takes care of lambda-to-imperative translation.

88

EC
JO

([Mi , Ni ])i∈I K

=JO
(Mi )
(Ni )K;(ki ← LO(Mi )(Ni )M(i); ki ← LO

LO([Mi , Ni ])i∈I M = LO

(Mi )([Mi , Ni ])i∈I M)(Ni )M(i),i∈I{i 7→ ki }i∈I

EE
JO

LO

N+

N+

M+

M+

O′ K =JO

N+

M+

O′ K

JO

N+

M+

O′ K

JO

N+

M+

O′ K

JO

N+

M+

O′ K ,O′ M =LO

N+

M+

O′ M

LO

N+

M+

O′ M

LO

N+

M+

O′ M

LO

N+

M+

O′ M ,ICJO

M + [x/y]K = JO

M +K

JO

M + K[xx /xy ]LO

M + [x/y]M = LO

M +M

LO

M + M[xx /xy ][i]Ax
JxK =ϵ ,LxM ={i 7→ ix } ,
[i]⊥E
JO

{i 7→ abort }K =JO{i 7→ M }K; (x ← ϵ)i ,LO{i 7→ abort }M =LO{i 7→ M }M[i] ⊃ IJO

{i 7→ λx.M }K =JO({i 7→ M }K; z ← λx.LO

LO{i 7→ λx.M }M =LO{i 7→ M }M89

{i 7→ z} ,{i 7→ x} ,{i 7→ M }M(i)),
i[i] ⊃ E
JO0

O1{i 7→ M N }K =JO0{i 7→ M }K; JO1{i 7→ N }K;()
M M(i) LO1
N M(i) i ,z ← LO0LO0O1{i 7→ M N }M =LO0{i 7→ M }M

LO1

{i 7→ N }M

{i 7→ z} ,[i] ∧ E0JO

{i 7→ πl (M )}K =JO(({i 7→ M }K; z ← πl LO

LO{i 7→ πl (M )}M =LO{i 7→ M }MJO

{i 7→ πr (M )}K =JO(({i 7→ M }K; z ← πr LO

LO{i 7→ πr (M )}M =LO{i 7→ M }MJO

{i 7→ inl (M )}K =JO(({i 7→ M }K; z ← inl LO

LO{i 7→ inl (M )}M =LO{i 7→ M }MJO

{i 7→ inr (M )}K =JO(({i 7→ M }K; z ← inr LO

LO{i 7→ inr (M )}M =LO{i 7→ M }M

{i 7→ M }M(i))),
i{i 7→ z} ,[i] ∧ E1)){i 7→ M }M(i),i{i 7→ z} ,[i] ∨ I0{i 7→ M }M(i))),
i{i 7→ z} ,[i] ∨ I1))
{i 7→ M }M(i),i{i 7→ z} ,[i] ∨ E
JO0

O1

O2

{i 7→ match M of inl(x).N0 /inr(y).N1 }K=JO0{i 7→ M }K;)(
xx ← match LO0{i 7→ M }M(i) of inl(z).z/inr(w).ϵ ; JO1{i 7→ N0 }K;()ixy ← match LO0{i 7→ M }M(i) of inl(z).ϵ/inr(w).w ; JO2{i 7→ N1 }K;i(k ← matchLO0{i 7→ M }M(i)of)
inl(z).LO1{i 7→ N0 }M(i)/inr(w).LO2{i 7→ N1 }M(i) ,
i

LO0
=LO0

O1

O2

{i 7→ M }M

{i 7→ match M of inl(x).N0 /inr(y).N1 }M
LO1{i 7→ N0 }M
90LO2{i 7→ N1 }M{i 7→ k} .

The rules IE and IW do not appear above because these rules do not change the form∧∧of global terms. When (xi : [i]ιi )i∈P ⊢ M : ( i∈P [i]oi ) is derivable, we can define a
typed protocol using the above translation. We set ii to be xxi , oi to be arbitrarily
chosen fresh program variables, L to be the set of locations occurring in the derivation,
we set the family of programs to be JM K; (oi ← πi (LM M(i)))i∈P , where πi is obtainedby composing i times πr to πl . We set g, d, ti accordingly so that the program is typed.
This concludes the translation.
Example 3.4.5 (Translation of a typed term into a typed protocol) The typing derivation in Figure 3.6 can be translated as follows. We follow the derivation from
top to bottom. First we look at the top sequents and translate the typed terms:
J{0 7→ x}K = ϵ
L{0 7→ x}M = {0 7→ ix }J{1 7→ y}K = ϵ
L{1 7→ y}M = {1 7→ iy } .
Next we look one step10 below:J{0 7→ (∗→d←c )x}{1 7→ (∗→c←d )y}K = (d ← ix ; y ← c)0 ; (c ← iy ; x ← d)1

L{0 7→ (∗→d←c )x}{1 7→ (∗→c←d )y}M ={0 7→ y}{1 7→ x} .

And so on:J{0 7→ add((∗→d←c )x, x)}{1 7→ add((∗→c←d )y, y)}K

= (d ← ix ; y ← c)0 ; (c ← iy ; x ← d)1 ; (z ← add(y, ix ))0 ; (w ← add(x, iy ))1L{0 7→ add((∗→d←c )x, x)}= {0 7→ z}{1 7→ add((∗→c←d )y, y)}M

{1 7→ x} .

→dJ{0 7→ add((∗←c)x, x), 1 7→ y}{0 7→ x, 1 7→ add((∗→c←d )y, y)}K

= (d ← ix ; y ← c)0 ; (c ← iy ; x ← d)1 ; (z ← add(y, ix ))0 ; (w ← add(x, iy ))1 ;(x’ ← ix )0 ; (y’ ← iy )1
L{0 7→ add((∗→d←c )x, x), 1 7→ y}={0 7→ z, 1 7→ y’}{0 7→ x, 1 7→ add((∗→c←d )y, y)}M

{0 7→ x’, 1 7→ w} .

10 A step in the type derivation is translated into a pair of equalities with diﬀerent kinds of paren-theses.

91

→c
J{0 7→ [add((∗→d←c )x, x), x], 1 7→ [add((∗←d )y, y), y]}K

= (d ← ix ; y ← c)0 ; (c ← iy ; x ← d)1 ; (z ← add(y, ix ))0 ; (w ← add(x, iy ))1 ;(x’ ← ix )0 ; (y’ ← iy )1 ; (u ← z; u ← x’)0 ; (v ← w; v ← y’)1→c
L{0 7→ [add((∗→d←c )x, x), x], 1 7→ [add((∗←d )y, y), y]}M={0 7→ u, 1 7→ v} .
The last two clauses result in a typed protocol that solves the exclusive-or problem(Example 3.3.1) for the same reason as the typed protocol in Example 3.3.13.
Given that the translation solves a typed input-output problem, we have to makesure that the original global term solves the same problem. Otherwise, the translation
incorrectly produced a working typed protocol from not-working a global term. We
have to show that the translation is correct in the following sense.
Proposition 3.4.6 For a derivable typed hypersequent O, let LOM = f0

f1

···

fn

so that each fj is a partial map from processes in P to program variables. Assume that−−
there is an execution of JOK whose final system snapshot ⟨→s ,→v ⟩ satisfies s=V
fj (i)

ji

for each i ∈ dom(fj ). Then, there exists a reduction relation({}, O) ⇝∗ (S, {i 7→ V0i }i∈dom(f0 )···{i 7→ Vni }i∈dom(fn ) )for some store S.
Proof By induction on the typing derivation for O. All cases are more or less straightforward, of which the most complicated cases are ij-com rule and the EC rule.
ij-com Assume that there is an execution of
JO0{i 7→ M }K; JO1{j 7→ N }K;(d ← LO0{i 7→ M }M(i); x ← c)i ;(c ← LO1{j 7→ N }M(j); y ← d)jwhose final system snapshot contains process snapshots sl for each process l ∈ P
that map program variables as:
LO0{i 7→ M }M 7→ (Vkl )0≤k<|O0 |LO1{j 7→ N }M 7→ (Vkl )|O0 |≤k<|O0 |+|O1 | .

Moreover, we assume si (x) = V|O0 |+|O1 |+1,i and sj (y) = V|O0 |+|O1 |,j . In order
to use the induction hypotheses, we have to transform our assumptions to theassumptions needed by the induction hypotheses on the branches of ij-com rule.
92

By the form of the programs, there exists an execution of JO0{i 7→ M }K whose

final system snapshot contains a process snapshot s′p for each process p ∈ P thatmaps program variables as:
LO0
and moreover s′i maps LO0{i 7→ M }M 7→ (Vkp )0≤k<|O0 |{i 7→ M }M to V where V is equal to V|O0 |+|O1 |+1,iunless V|O0 |+|O1 |+1,i is ϵ. Similarly, there exists an execution of JO1{j 7→ N }K

whose final system snapshot contains a process snapshot s′′p for each p ∈ P thatmaps program variables as:
LO1{j 7→ N }M 7→ (Vkp )|O0 |≤k<|O0 |+|O1 |and moreover s′′j maps LO1{j 7→ N }M to W where W is equal to V|O0 |+|O1 |,junless V|O0 |+|O1 |,j is ϵ.
{i 7→ M }, there exists a reduction relation

By the induction hypothesis on O0({}, O0⇝(S ′ ,

{i 7→ M })( +)Mk
{i 7→ V })0≤k<|O0 |for some store S ′ and Mk+ (p) = Vkp for each p ∈ P. Also, by the induction
hypothesis on O1{j 7→ N }, there exists a reduction relation({}, O1⇝(S ′′ ,{j 7→ N })|O0 |≤k<|O0 |+|O1 |

( +)
Mk

{j 7→ W })for some store S ′′ and Mk+ (p) = Vkp for each p ∈ P.
When we combine these induction hypotheses, we obtain({}, O0O1{i 7→ (∗→d←c )M }⇝∗ (S ′ ⊔ S ′′ , (Mk+ )0≤k<|O0 |+|O1 |⇝∗ (S, (Mk+ )0≤k<|O0 |+|O1 |{j 7→ (∗→c←d )N })

{i 7→ (∗→d←c )V }

{i 7→ V|O0 |+|O1 |+1,i }{j 7→ (∗→c←d )W })
{j 7→ V|O0 |+|O1 |,j }) .

for some S.
EC Assume that there exists an execution ofJO(Mi )i∈I(Ni )i∈I K;(
ki ← LO(Mi )(Ni )M(i); ki ← LO

93

(Mi )

)
(Ni )M(i)

i∈I

−
→
whose final system snapshot is ⟨→s ,−v ⟩ where for each process p ∈ P, sp maps([Mi′ , Ni′ ])i∈I M 7→ (Vkp )0≤k<|O|LO

and moreover si (ki ) is V|O|,i for each i ∈ I.
By the form of the programs, there exists an execution of JO−→ −→whose final system snapshot ⟨ s′ , v ′ ⟩ satisfies(Mi )i∈I(Ni )i∈I K• for any i ∈ I with ⟨Mi , Ni ⟩ = ⟨Mi′ , Ni′ ⟩, the process snapshot s′i maps
LO(Mi )i∈I(Ni )i∈I M to Vi and LO(Mi )i∈I(Ni )i∈I M to Wi where

Vi is identical to V|O|,i or ϵ and Wi is identical to V|O|,i ;• for any i ∈ I with ⟨Mi , Ni ⟩ = ⟨Ni′ , Mi′ ⟩, the process snapshot s′i maps
LO(Mi )i∈I(Ni )i∈I M to Vi and LO(Mi )i∈I(Ni )i∈I M to Wi where

Wi is identical to V|O|,i or ϵ and Vi is identical to V|O|,i ; and• for any p ∈ P, s′p maps LO(Mi )i∈I(Ni )i∈I M to (Vkp )0≤p<|O| .

By the induction hypothesis, there exists a reduction relation({}, O(Mi )i∈I(Ni )i∈I )(Mk + )(Vi )i∈I⇝∗ (S,(Wi )i∈I )0≤k<|O|for some store S, global terms Mk + satisfying Mk + (p) = Vkp for each p ∈ P.
Thus, there is also a reduction relation({}, O([Mi′ , Ni′ ])i∈I )⇝∗ (S,(Mk + )
0≤k<|O|(V|O|,i )i∈I ) .

■Proof (of Theorem 3.4.3) Assume that a global term M + solves a typed inputoutput problem R. We claim that the typed protocol JM + K; (oi ← LM + M(i))i∈P solves
R. By Proposition 3.4.6, if there is an execution of JM + K[Ni /ii ] that yields thecontent of LM + M(i) to be Vi for each i ∈ P, the reduction relation ({}, M + [Ni /xi ]) ⇝(S, {i 7→ Vi }i∈P ) holds for some store S. Since the global term M + solves R, the pair⟨(Ni )i∈P , (Vi )i∈P ⟩ is compatible with R.

■

For the other direction, we can use a universal waitfree problem called the participating set problem. Since the class of waitfreely solvable problems is generated by
the participating set problem and problem compositions. We just have to solve theuniversal problem using λ-GD.
94

Theorem 3.4.7 (Completeness of λ-GD with regard to waitfreedom) If there
exists a typed protocol that solves a typed input-output problem, the problem is solvable
by a typed global term of λ-GD.
Proof Herlihy and Shavit [72] showed that a solution to a finite repetition of theparticipating set problem solves any waitfreely solvable problem. Also, n-party participating problem can be solved by a tournament of the two-party participating set
problem11 . Since λ-GD can express problem composition, it suﬃces to show a λ-GD
term solving the two-party participating set problem.
In the participating set problem [22], each process i receives an id ci and returns
a set of ids Si . The outputs must satisfy (i) ci ∈ Si ; (ii) either Si ⊆ Sj or Sj ⊆ Si ;and (iii) Si ⊆ Sj if ci ∈ Sj for any i, j ∈ P. For two processes, ⟨S0 , S1 ⟩ can be⟨{c0 }, {c0 , c1 }⟩, ⟨{c0 , c1 }, {c1 }⟩ or ⟨{c0 , c1 }, {c0 , c1 }⟩. The point is that the processes
do not know their own ids in advance but receive their own ids as inputs. This is why
just hardcoding processes’ outputs does not work.
We are going to encode the participating set problem in λ-GD. For this, we introduce a base type called Id for process id’s. Let there be an injection that maps anatural number i to a constant ci : Id. The additional typing rules involving Id are as
follows, where N = (⊥ ⊃ ⊥) ∨ (⊥ ⊃ ⊥):Γ ⊢ M0 : [i]IdΓ ⊢ M1 : [i]IdΓ ⊢ M0 == M1 : [i]N⊢ cn : [i]Id
The additional reduction is
cm == cn ⇝inl (λx.x).

(if m = n)inr (λx.x) (otherwise) .

Also, If M then N0 else N1 is an abbreviation for match M of inl(x).N0 /inr(y).N1 .
We represent a finite set of id’s as a typed lambda term, whose type is [i](Id ⊃ B).
Intuitively, a set takes an id and decides whether it is in or out. The emptyset isrepresented by a term λx.inr (•). When a finite set S is represented by a term M ,the set S ∪ {c} is represented by a term λx. (If x == c then inl (•) else M x). With theabove construction, we define abbreviations like {c0 , c1 , c2 } although we do not equate{c0 , c1 , c2 } and {c0 , c2 , c1 }.
Now, we are ready to construct a hyperterm solving the two-party participating

11 To be exact, the construction for solving the n-party participating set problem using 2-party

participating set problem is the same as a sorting network [16] for sorting n elements.

95

set problem. We can obtain a derivation of→cx : [0]Id, y : [1]Id ⊢{0 7→ [{(∗→d←c )x, x}, {x}], 1 7→ [{(∗←d )y, y}, {y}]} :0 7→ Id ⊃ B, 1 7→ Id ⊃ B .
One possible reduction sequence is as follows:→c({}, {0 7→ [{(∗→d←c )x, x}, {x}], 1 7→ [{(∗←d )y, y}, {y}]})⇝W ({d 7→ x}, {0 7→ [{∗←c , x}, {x}], 1 7→ [{(∗→c←d )y, y}, {y}]})⇝R ({d 7→ x}, {0 7→ [{abort , x}, {x}], 1 7→ [{(∗→c←d )y, y}, {y}]})⇝W ({c 7→ y, d 7→ x}, {0 7→ [{abort , x}, {x}], 1 7→ [{∗←d , y}, y], {y}})⇝R ({c 7→ y, d 7→ x}, {0 7→ [{abort , x}, {x}], 1 7→ [{x, y}, {y}]})⇝A ({c 7→ y, d 7→ x}, {0 7→ [abort , {x}], 1 7→ [{x, y}, {y}]})⇝A ({c 7→ y, d 7→ x}, {0 7→ {x}, 1 7→ [{x, y}, {y}]})⇝A ({c 7→ y, d 7→ x}, {0 7→ {x}, 1 7→ {x, y}})Moreover, the same initial configuration can reduce to({c 7→ y, d 7→ x}, {0 7→ {y, x}, 1 7→ {y}})and({c 7→ y, d 7→ x}, {0 7→ {y, x}, 1 7→ {x, y}}) .
There are no other normal forms. These three normal forms correspond to the threeallowed answers of the two-party participating set problem.

3.5■

Related Work

Sonobe [129] gives sequent calculi for intermediate logics Si and proved cut-elimination
theorem for them. As a special case he gives Sω , which coincides with Gödel-Dummett
logic. The proof of cut-elimination is similar to that of Gentzen [58], involving themix rule. No lambda calculi has been developed based on Sonobe’s deduction system,
probably because the deduction system involves a rule having unlimited number ofassumptions.
Avron [8] formulates a hypersequent calculus for Gödel-Dummett logic and proves
cut-elimination theorem using a method similar to Gentzen [58]. Also, he explains
the intuition behind the communication rule as “the inputs through the ports in Γ′2
are transmitted to the component with output of type A1 . The inputs through Γ′1 are96

treated similarly.” He did not mention the possibility of any transmission failures,
which we exploited in order to characterize waitfreedom. Ciabattoni, Galatos andTerui [30] give a class of logics that have hypersequent calculi with cut-elimination.
Their cut-elimination proof is general but it does not obviously reveal the computational content.
Baaz, Ciabattoni and Fermüller [11] propose a hypersequent-style natural deduction for Gödel-Dummett logic, but did not define reductions. Fermüller [48] gives agame semantics for Gödel-Dummett logic, which is based on Lorenzen game [130] andessentially proof searching bottom-to-up. Of course, there is a possibility of employing waitfree communication for proof searching. Indeed, Fermüller’s dialogue game issometimes forked and proceeds concurrently. However, he gives no explicit mention
on waitfree computation.
Among numerous typed programming languages with parallelism, to our knowledge, none models waitfreedom. Abramsky [3]’s calculus PE2 for classical linear logic
is deterministic [3, Theorem 7.9] so that it is impossible to model waitfreedom using
PE2 . The π-calculus [107], Join calculus [51], and even asynchronous π-calculus [80]have too strong synchronization abilities to model waitfreedom because a process can
wait for an input.
Hirai [75, 76] compares the temporal order of waitfree computation and the Kripke
models of a modal logic similar to Gödel-Dummett logic. The current work witnesses
the constructive content of his model theoretic comparison.

3.6

Discussion

As a programming language, λ-GD allows eﬃcient execution because it requires no
synchronization among processes. Possibly, this calculus can be extended by synchronization primitives. It would be interesting to compare diﬀerent synchronization primitives and diﬀerent intermediate logics, generalizing waitfreedom and Gödel-Dummett
logic. For example, it would be tedious but straightforward to adapt the hyper-lambda
calculi here to the logics characterized by the Kripke frames of bounded width [29]because λ-GD is a special case of width 1. However, the author has no immediate
idea on developing a general hyper-lambda calculi encompassing all logics with cuteliminatable hypersequent calculi [30]. Some high-performance computation peoplesuggested to study a weaker shared memory consistency than sequential consistency;that is, to remove the assumption that all read and write operations on shared memory
are lined up in a temporal total order. In their realm, sequential consistency is con-97

sidered too strong to assume everywhere. If we are to study a weaker shared memory
consistency in the same approach as here, we have to study a weaker logic.
It will be worthwhile to develop a waitfree protocol verification mechanism in
Coq because it is valuable to remove unnecessary synchronization while keeping the
program correct in high performance computing.
An anonymous referee of FLOPS 2012 pointed out that the introduction of modalities [i] is interesting on its own. We have not investigated the logical meaning ofthese modalities. We suspect these modalities are similar to nominals in the hybrid
logic [21].
In λ-GD, the source of nondeterminism can be explicitly expressed as the store
prophecy. If we can find a semantic counterpart Sch of the store prophecy, possibly,
we can obtain a denotation DSch of terms using a denotation D for normal forms. If
that succeeds for classical logic, it will be interesting12 .
Nonetheless there is some more immediate future work. It would be better if we
explicitly implement n-party participating set problem using λ-GD. Another remaining task is to formalize the strong normalization theorem formally in a proof assistant like Coq or Isabelle. Lindley and Stark [95] provided a concise proof of strong
normalization of the natural deduction for intuitionistic propositional logic, containing disjunction. Lindley’s proof was formalized in Nominal Isabelle by Doczkal andSchwinghammer [42].
Developing a second order formulation and performing the parametricity argument
is another piece of future work. In Chapter 2, we studied an axiom (φ ⊸ ψ)⊗(ψ ⊸ φ).
Apart from this, we also tried developing a lambda calculus for (φ ⊸ ψ) ⊕ (ψ ⊸ φ)on top of a second-order formulation of intuitionistic linear logic in Chapter 4. While
doing that, we noticed that adequacy of parametricity argument can be carried out
using induction on just two type derivations; if we did the same for the second-ordervariant of λ-GD, it would require induction over many derivations.
Another immediate task is to verify cut-elimination theorem for the new communication rule presented here. Our com rule does not duplicate any contexts while thecom’ rule by Avron [8] duplicates the contexts Γ and ∆ asO0O0Γ, ∆ ⊢ M : [i]φO1O1Γ ⊢ (∗→d←c )M : [i]ψΓ, ∆ ⊢ N : [j]ψ∆ ⊢ (∗→c←d )N : [j]φ.

Although Avron [8] showed cut-elimination theorem for com’ rule, it is not clear
whether the same theorem holds in our case.
12 Kazushige Terui suggested the potential impact for classical logic.

98

3.7

Conclusions

We proposed λ-GD, a lambda calculus based on Avron’s hypersequent calculus forGödel-Dummett logic [8]. We proved normalization and non-abortfullness. The calculus characterizes the typed version of waitfree computation. Our result hints broader
correspondence between proof theory and distributed computation.

99

Chapter 4
Prelinearity Axiom as an Asynchronous
Communication Scheme

4.1

Summary

Danos and Krivine [38] state that disjunctive tautologies1 such as the excluded middle φ ∨ (φ ⊃ ⊥) and the symmetric excluded middle (φ ⊃ ψ) ∨ (ψ ⊃ φ) represent
synchronization schemes. Indeed in their formalism, reduction of one term can wait
for another term, thus making synchronization. However, one can find no communication among diﬀerent concurrent elements of an executable. In this chapter, weshow that logical axioms can specify how concurrent processes exchange information
asynchronously.
We investigate the computational behavior of the prelinearity axiom (φ ⊸ ψ) ⊕(ψ ⊸ φ) and left weakening on top of IMALL2, which is the fragment of second
order intuitionistic linear logic with connectives {∀, ⊸, ⊕}. In other words, our typesystem is based on the second-order monoidal t-norm logic (MTL) [46]. We interpretthe disjunction ⊕ in the prelinearity axiom nondeterministically: whether one process
can give information to the other or vice versa. In Section 4.2, where processes do
not make synchronization, nondeterminism appears automatically as a slower process
cannot pass information to a faster one. In Section 4.3, where processes make synchronization, we externally specify the nondeterministic choice. We adapt Danos andKrivine [38]’s realizability argument to our synchronous case and give simulation fromthe synchronous case to the asynchronous case.
The asynchronous semantics here is closely related to the hyper-lambda calculus
for Gödel-Dummett logic presented in Hirai [75]. On top of intuitionistic logic, Gödel1 A tautology is a theorem of classical propositional logic.

100Dummett logic is axiomatized by Dummett axiom (φ ⊃ ψ) ∨ (ψ ⊃ φ), which is similar
to the prelinearity axiom.
Our aim in this chapter is to reason about asynchronous communication on sharedmemory using parametricity argument. However, since processes can write into andread from shared memory, a straightforward approach would lead us to solving mixedvariant domain equations or using the step-index technique [4]. Although dealing
with general references and parametricity is manageable [20], we choose a simpler, indirect approach. In Section 4.2 we deal with the operational semantics involving asynchronous communication using stores. In Section 4.3 we apply the classical realizability
argument to an operational semantics where communication is made synchronously.
In Sections 4.5 and 4.6, we discuss and conclude.

4.2

Asynchronous Semantics

We apply Danos and Krivine’s classical realizability argument [38] to a lambda calculus
involving communicating processes. Although the formulation is similar to [38], ourformulation allows diﬀerent processes to pass around lambda terms.
In this section, we give an abstract machine involving asynchronous shared memorycommunication, which is similar to the hyper-lambda calculus for Gödel-Dummett
logic (Hirai [75]). We consider a programming language, which is a modification of
Danos and Krivine [38]’s.
4.2.1

Dynamics

We assume a set PVar of propositional variables whose cardinality is countably infinite.
We also assume countably infinitely many locations with involution c 7→ c̄ satisfyingc̄ ̸= c and c̄¯ = c. Metavariable c runs over locations. An a-term (asynchronous term) t
is defined by BNF:
t ::= x | (t)t | λx.t | match t of inl(x).t/inr(x).t | inl(t) | inr(t) |(t ∥ t) | ∗→c←c | ∗←c | abort
where x is a variable and c is a location. The variable occurrences except in the firstclause are binding. An a-stack (asynchronous stack) π is defined by a BNF:
π ::= ϵ | t · π | ⟨inl(x).(t, π)/inr(x).(t, π)⟩ .
We write the set of a-terms as Λa and a-stacks Πa . A store maps a location to an
a-term, ⊥ or ⊤. The empty store Sϵ maps any location to ⊥. For a store S, we define101the updated store S[c 7→ x] to be the same as S except that S[c 7→ x](c) is x whateverS(c) is. An a-executable (asynchronous executable) is a finite multiset on Λa × Πa ,paired with a store.
We define a binary relation ≻a on a-executables to be the smallest binary preordersthat satisfy:(cong) if [t, π], S ≻a [t′ , π ′ ], S ′ then [t, π ∥ e], S ≻a [t′ , π ′ ∥ e], S ′ ;(abort) [abort , π] ≻a ∅ ;(push) [(t)u, π], S ≻a [t, u · π], S;(store) [λx.t, u · π], S ≻a [t[u/x], π], S ;(ask) [match t of inl(x).u/inr(y).v, π], S ≻a [t, ⟨inl(x).(u, π)/inr(y).(v, π)⟩], S ;(ansL) [inl(v), ⟨inl(x).(t, π)/inr(y).(u, σ)⟩], S ≻a [t[v/x], π], S ;(ansR) [inr(w), ⟨inl(x).(t, π)/inr(y).(u, σ)⟩], S ≻a [u[w/y], σ], S ;(write) [∗→c̄←c , t · π], S[c̄ 7→ ⊥] ≻a [∗←c , π], S[c̄ 7→ t] ;(write’) [∗→c̄←c , t · π], S[c̄ 7→ ⊤] ≻a [∗←c , π], S[c̄ 7→ ⊥] ;(read) [∗←c , π], S[c 7→ u] ≻a [u, π], S[c 7→ u] ;(fail) [∗←c , π], S[c 7→ ⊥] ≻a ∅, S[c 7→ ⊤] ;(local-global) if e0 , S0 ≻a e1 , S1 then e0 , S0 ≻a e1 , S1 ; and(dist) [(t ∥ u), π ∥ e], S ≻a [t, π ∥ u, π ∥ e ∥ e], S .
Diﬀerently from the synchronous case in Section 4.3, we do not use an external schedule
relation on locations. Instead, nondeterminism appears spontaneously. Indeed, we canimplement something similar to Lafont’s example [61, B.1]. Suppose ⊢ t : φ and ⊢ u : φ→c→c̄are both derivable. Then, ⊢ (∗→c̄←c )t ∥ (∗←c̄ )u : φ is derivable. From there [((∗←c )t ∥(∗→c←c̄ )u), π], Sϵ can reduce both to [t, π], Sϵ and to [u, π], Sϵ (Figure 4.3).
4.2.2

Statics

For a set S, form(S) is the set of S-formulae φ:
φ ::= s | X | φ ⊸ φ | φ ⊕ φ | ∀Xφ

102

→c
[((∗→c̄←c )t ∥ (∗←c̄ )u), π], Sϵ→c[((∗→c̄←c )t ∥ (∗←c̄ )u), π], Sϵ→c≻a [(∗→c̄←c )t, π ∥ (∗←c̄ )u, π], Sϵ→c≻a [(∗→c̄←c )t, π ∥ (∗←c̄ )u, π], Sϵ≻a [∗←c , π ∥ (∗→c←c̄ )u, π], Sϵ [d 7→ t]≻a [(∗→c̄←c )t, π ∥ ∗←c̄ , π], Sϵ [c 7→ u]≻a [(∗→c←c̄ )u, π], Sϵ [c 7→ ⊤, c̄ 7→ t]≻a [(∗→c̄←c )t, π], Sϵ [c 7→ u, c̄ 7→ ⊤]≻a [∗←c̄ , π], Sϵ [c 7→ ⊥, c̄ 7→ t]≻a [∗←c , π], Sϵ [c 7→ u, c̄ 7→ ⊥]≻a [t, π], Sϵ [c 7→ ⊥, c̄ 7→ ⊥] .

≻a [u, π], Sϵ [c 7→ ⊥, c̄ 7→ ⊥] .

Figure 4.3: A non-confluent example similar to Lafont’s example [61, B.1]. Both sides
start from the same configuration but reduce to diﬀerent configurations. Moreover,since terms t and u can be taken arbitrarily, if we equate the terms related by ≻a , wehave to conclude that arbitrary two terms of the same type are equal.
where s ∈ S and X ∈ PVar. The X in the last clause is binding. The connective ∀connects stronger than ⊕, which is stronger than ⊸. Repeated ⊸’s, φ0 ⊸ φ1 ⊸· · · ⊸ φn , are defined inductively on n as φ0 ⊸ (φ1 ⊸ · · · ⊸ φn ). A type is anelement of form(∅).
A sequent Γ ⊢ t : φ consists of a context Γ and an s-term t associated with atype φ. The context is a finite sequence of variables associated with types where thesame variable does not appear more than once. When we write a concatenation ofcontexts Γ, ∆, we assume no variables appear in both Γ and ∆. A hypersequent is a
finite sequence of sequents. In a hypersequent, we also assume that no variable appears
more than once in the contexts.
An NMTL2 derivation is a tree composed of the derivation rules in Figure 4.4
whose top rules are Ax. A hypersequent is derivable in NMTL2 when there is an
NMTL2 derivation ending at the hypersequent. An s-term t has type φ when ⊢ t : φ isderivable. A type φ is provable when there is an s-term t with type φ. There is a wellknown substructural logic called the monoidal t-norm logic (MTL), which validates
the prelinearity axiom (φ ⊸ ψ) ⊕ (ψ ⊸ φ). Actually, NMTL2 characterizes MTL.
For example, there is an s-term typed with the prelinearity axiom (Figure 4.5).
Corollary 4.2.1 (Prelinearity as a communication scheme) Assume that an aterm g has type ∀X∀Y ((X ⊸ Y ) ⊕ (Y ⊸ X)). Then, the s-executable[g, ⟨inl(z).(z, x · πY )/inr(w).(w, y · πX )⟩]reduces to a multiset containing an element of {(x, πX ), (y, πY )}.
103

EW

H
Γ ⊢ abort : φ

H

EE

EC

Ax

⊸I

⊕I

x:φ ⊢ x:φHH

∆ ⊢ u:ψH′H∆ ⊢ u:ψΓ ⊢ t:φH′⊢ u:φ⊢ (t ∥ u) : φ

Γ, x : φ, y : ψ, ∆ ⊢ t : θHΓ, y : ψ, x : φ, ∆ ⊢ t : θ
⊸E

H

IW

H

H′

Γ ⊢ t:φ ⊕ ψHΓ ⊢ t:φΓ ⊢ t : ∀Xφ
Com

H

H

′

∆, x : φ ⊢ u0 : θ

x : φ ⊸ ψ, Γ ⊢ t : θHΓ ⊢ t:φHx : ψ, Γ ⊢ t : φH′∆ ⊢ u:φΓ, ∆ ⊢ (t)u : ψΓ ⊢ t:ψH
HH′Γ ⊢ inr(t) : φ ⊕ ψ∆, y : ψ ⊢ u1 : θΓ, ∆ ⊢ match t of inl(x).u0 /inr(y).u1 : θ(no free X in H or Γ)

H

H′
⊕I

Γ ⊢ inl(t) : φ ⊕ ψHHΓ ⊢ t:φ ⊸ ψΓ ⊢ t:φHHΓ ⊢ t:φHΓ ⊢ λx.t : φ ⊸ ψ

H

⊢ t:φ
H

x : φ, Γ ⊢ t : ψ

H

⊕E

∀I

IE

H

H

′

∀E
H′

Γ ⊢ t[∗→c̄←c /x] : θHΓ ⊢ t : ∀XφHΓ ⊢ t : φ[ψ/X]y : ψ ⊸ φ, ∆ ⊢ u : τ∆ ⊢ u[∗→c←c̄ /y] : τ

Figure 4.4: Typing derivation rules of NMTL2 . H and H′ stand for hypersequents. In
EW, H cannot be empty.

⊕I
EC

Ax
Ax
x:X ⊸ Y ⊢ x:X ⊸ Y
y:Y ⊸ X ⊢ y:Y ⊸ X
Com→c̄
⊢ ∗←c : X ⊸ Y⊢ ∗→c←c̄ : Y ⊸ X⊕I→c̄⊢ inl(∗←c ) : (X ⊸ Y ) ⊕ (Y ⊸ X)
⊢ ∗→c←c̄ : Y ⊸ X⊢ inl(∗→c̄⊢ inr(∗→c←c ) : (X ⊸ Y ) ⊕ (Y ⊸ X)←c̄ ) : (X ⊸ Y ) ⊕ (Y ⊸ X)→c̄→c
⊢ (inl(∗←c ) ∥ inr(∗←c̄ )) : (X ⊸ Y ) ⊕ (Y ⊸ X)∀I→c
⊢ (inl(∗→c̄←c ) ∥ inr(∗←c̄ )) : ∀Y ((X ⊸ Y ) ⊕ (Y ⊸ X))
∀I
→c̄
→c
⊢ (inl(∗←c ) ∥ inr(∗←c̄ )) : ∀X∀Y ((X ⊸ Y ) ⊕ (Y ⊸ X))

Figure 4.5: A derivation tree typing an s-term with the prelinearity axiom: the s-term→c(inl(∗→c̄←c ) ∥ inr(∗←c̄ )) has type ∀X∀Y ((X ⊸ Y ) ⊕ (Y ⊸ X)).

104

Proof By Props. 4.3.5 and 4.3.6 below.

4.3■

Synchronous Semantics

We consider a programming language, which is a modification of Danos and Krivine [38]’s. We assume a set PVar of propositional variables whose cardinality is countably infinite. We also assume countably infinitely many locations with involution satisfying c̄ ̸= c and c̄¯ = c. Metavariable c runs over locations. An s-term (synchronousterm) t is defined by a BNF:
t ::= x | (t)t | λx.t | match t of inl(x).t/inr(x).t | inl(t) | inr(t) |(t ∥ t) | ∗→c←c | abort
where x is a variable and c is a location. The variable occurrences except in the firstclause are binding. An s-stack (synchronous stack) π is defined by a BNF:
π ::= ϵ | t · π | ⟨inl(x).(t, π)/inr(x).(t, π)⟩ .
We write the set of s-terms as Λs and s-stacks Πs . For s-terms s, t and a variable x,s[t/x] denotes the result of substitution of t for free occurrences of x in s. When
more than one substitutions are concatenated, e.g. s[t/x][t′ /y], the substitutions areapplied at the same time not one after another. When we use this kind of simultaneous
substitution, we always make sure that the same variable x does not appear more thanonce after the /’s, e.g. s[t/x][t′ /x] never happens.
A process is an element of Λs × Πs . An s-executable (synchronous executable)
is a multiset of processes. We ruthlessly use ∥ both for delimiting elements in ans-executable and for addition of multisets. We denote the empty multiset by ∅.
A schedule is a total preorder on locations. Given a fixed schedule ⊑, we definebinary relations ≻′s and ≻s on s-executables to be the smallest preorders that satisfy:(cong) if e0 ≻′s e1 then e0 ∥ e ≻′s e1 ∥ e ;(abort) [abort , π] ≻′s ∅ ;(push) [(t)u, π] ≻′s [t, u · π] ;(store) [λx.t, u · π] ≻′s [t[u/x], π] ;(ask) [match t of inl(x).u/inr(y).v, π] ≻′s [t, ⟨inl(x).(u, π)/inr(y).(v, π)⟩] ;(ansL) [inl(v), ⟨inl(x).(t, π)/inr(y).(u, σ)⟩] ≻′s [t[v/x], π] ;105

(ansR) [inr(w), ⟨inl(x).(t, π)/inr(y).(u, σ)⟩] ≻′s [u[w/y], σ] ;→c′(com0) [∗→c̄←c , t · π ∥ ∗←c̄ , u · σ] ≻s [u, π] (if c̄ ⊑ c but c ̸⊑ c̄) ;→c′(com1) [∗→c̄←c , t · π ∥ ∗←c̄ , u · σ] ≻s [t, σ] (if c ⊑ c̄ but c̄ ̸⊑ c) ;→c′(com2) [∗→c̄←c , t · π ∥ ∗←c̄ , u · σ] ≻s [u, π ∥ t, σ] (if c ⊑ c̄ and c̄ ⊑ c) ;(local-global) If e0 ≻′s e1 then e0 ≻s e1 ; and(dist) [(t ∥ u), π ∥ e] ≻s [(t, π) ∥ e ∥ (u, π) ∥ e] .
We say e reduces to e′ when e ≻s e′ holds. Below, we sometimes omit the outermost
parentheses (i.e. [ and ]) for multisets. Rules (cong), (push) and (store) come from
Danos and Krivine [38]. (dist) also appears there but we changed it so that the proof
for adequacy (Theorem 4.3.3) goes through in the case (EC, −).

if e ≻s e′ and e′ ∈=|=|2. e ∥ f is in

is a set of s-executables which satisfies=|=|

1. e is in=|

Definition 4.3.1 A pole

if e or f is in

; and

.

In the definition of poles, condition 2. is diﬀerent from that of Danos and Krivine’s [38].
=|, then e ∥ f is in=|

There, the condition says if e and f are in. Our disjunctive

choice here is influenced by hypersequents [8] and hyper-lambda calculi (Chapter 3),
where components are interpreted disjunctively. Computationally, we only guaranteethat at least one process of an s-executable [t0 , π0 ∥ · · · ∥ tn , πn ] succeeds.
An environment is a pair of an s-stack and an s-executable. The set of environments is written as E. A program is a pair of an s-term and an s-executable. For a=|set Z of environments, Z →denotes the set of programs (t, e) such that for any

environment (π, e ) ∈ Z, the s-executable [t, π ∥ e ∥ e′ ] is in=|′. We use programsand environments because if we continued using s-terms and s-stacks, the proof of
adequacy (Theorem 4.3.3) would fail in the case (⊸E, −), (2).

106

E
−
E
For φ ∈ form(2E ) and | · |−0 : PVar → 2 , we define |φ| ∈ 2 inductively on φ:|Z|− =Z for Z ∈ 2E
|X|− =|X|−0=||φ ⊸ ψ|− ={(t · π, e0 ∥ e1 ) | (t, e0 ) ∈ |φ|− →and (π, e1 ) ∈ |ψ|− }|φ ⊕ ψ|− ={(⟨inl(x).(t, π)/inr(y).(u, σ)⟩, f ) |for all (w, f ′ ) ∈ |ψ|− →

and
}

=|

=|

u[w/y], σ ∥ f ∥ f ′ ∈∪|∀Xφ|− =|φ[Z/X]|− .

for all (v, f ′ ) ∈ |φ|− →=|=|t[v/x], π ∥ f ∥ f ′ ∈Z∈2Πs. We have an equality |φ ⊸ ψ|− = {(t · π, e0 ∥=|Using this, we define |φ| = |φ|− →e1 ) | (t, e0 ) ∈ |φ| and (π, e1 ) ∈ |ψ|− }. Moreover, for types φ and ψ, we define |(φ, ψ)|as the set of triples (t, u, e) of s-terms t and u and an s-executable e such that [t, π ∥=|u, σ ∥ e ∥ e0 ∥ e1 ] ∈for any (π, e0 ) ∈ |φ|− and (σ, e1 ) ∈ |ψ|− .

→c
Proposition 4.3.2 (∗→c̄←c , ∗←c̄ , ∅) ∈ |(φ ⊸ ψ, ψ ⊸ φ)| for any types φ and ψ.

Proof Take any (t · σ, e0 ∥ e1 ) ∈ |φ ⊸ ψ|− and (u · π, f0 ∥ f1 ) ∈ |ψ ⊸ φ|− suchthat (t, e0 ) ∈ |φ|, (σ, e1 ) ∈ |ψ|− , (u, f0 ) ∈ |ψ| and (π, f1 ) ∈ |φ|− hold. We claim. Depending on the=|→cthat e = [∗→c̄←c , t · σ ∥ ∗←c̄ , u · π ∥ e0 ∥ e1 ∥ f0 ∥ f1 ] is inschedule, e might reduce to [t, π ∥ e0 ∥ e1 ∥ f0 ∥ f1 ], [u, σ ∥ e0 ∥ e1 ∥ f0 ∥ f1 ] or=|[t, π ∥ u, σ ∥ e0 ∥ e1 ∥ f0 ∥ f1 ], all of which are in=|. Sinceis closed for ≻−1
s , we=|have e ∈=|because [t, π ∥ e0 ∥ f1 ] and [u, σ ∥ e1 ∥ f0 ] are inby condition 2. of Definition 4.3.1

.

■

−
→
−
→
For Γ = x1 : φ1 , . . . , xn : φn , we denote by |Γ| the set of pairs ( t , e) where t =
f
−
→ →
−
(t1 , . . . , tn ), e = 1≤i≤n ei and each pair (ti , ei ) is in |φi |. For that t , [ t /Γ] denotes
the simultaneous substitution [ti /xi ]0≤i≤n . For a hypersequent, we define a set of sexecutables JΓ0 ⊢ t0 : φ0···Γn ⊢ tn : φn K to be the set of executables of the formf→−→(t [ g /Γ ], π ∥ e ∥ f ) where (−g , e ) ∈ |Γ | and (π , f ) ∈ |φ |− .
0≤i≤n

i

i

i

i

i

i

i

i

i

i

i

i

Here we state adequacy. What we will use later is statement (1). However, when
we try to prove (1) by induction on derivations, the case for Com rule cannot be
proved due to insuﬃcient induction hypotheses. Thus we deal with two derivations at
the same time.
Theorem 4.3.3 (Adequacy of NMTL2) Let hypersequents H and I be derivable.
We state:107

; and=|(1) any s-executable in JHK is also in(2) when H and I are respectively equal to Ĥ

x : θ, Γ̂ ⊢ t : φ and Îˆ ⊢ u:ψy : τ, ∆up to exchange, the following triple is in |(φ, ψ)|:
(
)
→
− ˆ
−
t[v/x][→g /Γ̂], u[w/y][ d /∆],e ∥ f ∥ e′ ∥ eĤ ∥ eÎ→−−ˆgiven eĤ ∈ JĤK, eÎ ∈ JÎK, (v, w, e′ ) ∈ |(θ, τ )|, (→g , e) ∈ |Γ̂| and ( d , f ) ∈ |∆|.
Proof We prove both statements at the same time by induction on the sum of theheights of the derivations of H and I. Here we identify hypersequents up to exchange.
(Ax, Ax) When both derivations consist of only axiom rules, the statements follow
from the definitions of |φ| and |(φ, ψ)|.
(IW, −) The derivation for t ends asΓ′ ⊢ t : φ

H′

W

H′

x̂ : φ̂, Γ′ ⊢ t : φ.

−→(1) Take any eH′ ∈ JH′ K, ( g ′ , e) ∈ |Γ′ | and (t̂, ê) ∈ |φ̂|. Since x̂ does not appear−→−→
freely in t, the term in question t[t̂/x̂][ g ′ /Γ′ ] is equal to t[ g ′ /Γ′ ]. By the−→
induction hypothesis (1), (t[ g ′ /Γ′ ], e ∥ eH′ ) is in |φ|. By condition 2. of−→Definition 4.3.1, the program in question (t[t̂/x̂][ g ′ /Γ′ ], e ∥ ê ∥ eH′ ) is also
in |φ|.
(2) When x and x̂ are diﬀerent, we can do the same as for (1). Otherwise, x
is equal to x̂ and θ is equal to φ̂. Take any eĤ ∈ JĤK, eÎ ∈ JÎK, (v, w, e′ ) ∈−→→ˆ (π, e′′ ) ∈ |φ|− and (σ, f ′′ ) ∈ |ψ|− . We|(θ, τ )|, (−g , e) ∈ |Γ̂|, ( d , f ) ∈ |∆|,:=|

have to show that the following executable is in−→ ˆ→ē = t[v/x̂][−g /Γ̂], π ∥ u[w/y][ d /∆],σ ∥ e ∥ f ∥ e′ ∥ e′′ ∥ f ′′ ∥ eĤ ∥ eÎ .
=|−By the induction hypothesis (1), [t[→g /Γ̂], π ∥ e ∥ e′′ ∥ eĤ ] is in . More−over, since x̂ does not appear in t, [t[v/x̂][→g /Γ̂], π ∥ e ∥ e′′ ∥ e ] is in .
=|By condition 2. of Definition 4.3.1, ē is also in

=|

Ĥ

.

(EW, −) (1) By (abort) reduction.
(2) Also by (abort) reduction, but when x appears in the context for abort , wehave to do the same argument as in (W, −), (2).
(EC, −) The derivation for t ends asH′
H⊢ t0 : φ′⊢ t1 : φ⊢ (t0 ∥ t1 ) : φ
108.

(1) Take any eH′ ∈ JH′ K and (π, f ) ∈ |φ|− . We have to show that this exe=|

cutable is in:[eH′ ∥ (t0 ∥ t1 ), π ∥ f ] .

By (dist), this executable reduces to[eH′ ∥ eH′ ∥ t0 , π ∥ t1 , π ∥ f ∥ f ] ,because, by the induction hypothesis, the following executable

=|

is in

=|

which is in:[eH′ ∥ (t0 ∥ t1 ), π ∥ f ∥ f ] .
(2) Similar to (1).
(⊸I, −) The derivation for t ends asH′x̂ : φ0 , Γ ⊢ t1 : φ1′

Γ ⊢ λx̂.t1 : φ0 ⊸ φ1

H.

→(1) Take any eH′ ∈ JH′ K, (−g , e) ∈ |Γ| and (t0 · π, e0 ∥ e1 ) ∈ |φ0 ⊸ φ1 |− so that(t0 , e0 ) ∈ |φ0 | and (π, e1 ) ∈ |φ1 |− hold. We have to show that the following=|

s-executable is in:→(λx̂.t1 )[−g /Γ], t0 · π ∥ e ∥ e0 ∥ e1 ∥ eH′ .
By (store) and (cong), the s-executable reduces to→t1 [t0 /x̂][−g /Γ], π ∥ e ∥ e0 ∥ e1 ∥ eH′ .
We have (t0 , e0 ) ∈ |φ0 | so, by the induction hypothesis (1), the reduct is in
is closed for ≻s −1 , the original s-executable is in

=|

=|

=|

. Since, too.
−→−
ˆ(2) Take any eĤ ∈ JĤK, eÎ ∈ JÎK, (v, w, e′ ) ∈ |(θ, τ )|, (→g , e) ∈ |Γ̂|, ( d , f ) ∈ |∆|,
(t0 · π, e′0 ∥ e′1 ) ∈ |φ0 ⊸ φ1 |− and (σ, f ′′ ) ∈ |ψ|− so that (t0 , e′0 ) ∈ |φ0 | and=|(π, e′1 ) ∈ |φ1 |− . We have to show that this s-executable is in

:

→
−
→
(λx̂.t1 )[v/x][−g /Γ], t0 π ∥ u[w/y][ d /∆], σ ∥ e′ ∥ e ∥ f ∥ e′0 ∥ e′1 ∥ eĤ ∥ eÎ .
By (store) and (cong), the s-executable reduces to−→−t1 [v/x][→g /Γ][t0 /x̂], π ∥ u[w/y][ d /∆], σ ∥ e′ ∥ e ∥ f ∥ e′0 ∥ e′1 ∥ eĤ ∥ eÎ .

is closed for ≻s −1 , the original s-executable is also in
109

=|

=|

Since

.

.

=|

Since (t0 , e′0 ) is in |φ0 |, by the induction hypothesis (2), the reduct is in(⊸E, −) The derivation for t ends asΓ 0 ⊢ t0 : φ′ ⊸ φ

H0

H0

H1

H1

Γ 1 ⊢ t1 : φ′

Γ0 , Γ1 ⊢ (t0 )t1 : φ.

→−(1) Take any eH0 ∈ JH0 K, eH1 ∈ JH1 K, (−g0 , e0 ) ∈ |Γ0 |, (→g1 , e1 ) ∈ |Γ1 | and=|(π, e′′ ) ∈ |φ|− . We have to show that this s-executable is in:→→((t0 )t1 )[−g0 /Γ0 ][−g1 /Γ1 ], π ∥ e0 ∥ e1 ∥ e′′ ∥ eH0 ∥ eH1 .
By (push) and (cong), this s-executable reduces to−−t 0 [→
g0 /Γ0 ], t1 [→g1 /Γ1 ] · π ∥ e0 ∥ e1 ∥ e′′ ∥ eH0 ∥ eH1 .
−By the induction hypothesis (1) on both branches, we have (t0 [→g0 /Γ0 ], e0 ∥ eH0 ) ∈
→
−
→
′
′
|φ ⊸ φ| and (t [ g /Γ ], e ∥ e ) ∈ |φ |. By the latter, we have (t [−g /Γ ] ·
1

1

1

1

H1

1

1

1

π, e1 ∥ e′′ ) ∈ |φ′ ⊸ φ|− . By definition of |φ′ ⊸ φ|, we have shown that the=|. Sinceis closed for ≻−1
s , the original s-executable is also

.

=|

in

=|

reduct is in(2) Variable x might be contained in Γ0 , Γ1 , H0 or H1 . In the last two cases,
the proof is similar to that of (1).
(case Γ0 = x : θ, Γ̂0 ) Take any eH0 ∈ JH0 K, eH1 ∈ JH1 K, (v, w, e′ ) ∈ |(θ, τ )|,−→→→ˆ (π, e′′ ) ∈ |φ|− and(−g0 , e0 ) ∈ |Γ̂0 |, (−g1 , e1 ) ∈ |Γ1 |, ( d , f ) ∈ |∆|,
(σ, f ′′ ) ∈ |ψ|− . We have to show that the following s-executable is
:

=|

in

→
→
((t0 )t1 )[v/x][−g0 /Γ̂0 ][−g1 /Γ1 ], π ∥ u′ , σ ∥ ê ∥ e1 ∥ e′′ ∥ f ′′ ∥ eH1 .
−→ ˆ
where u′ = u[w/y][ d /∆]and ê = e′ ∥ e0 ∥ eH0 ∥ f . By (push) and(cong), this s-executable reduces to→→t0 [v/x][−g0 /Γ̂0 ], t1 [−g1 /Γ1 ] · π ∥ u′ , σ ∥ ê ∥ e1 ∥ e′′ ∥ f ′′ ∥ eH1 .
−By the induction hypothesis (1), (t1 [→g1 /Γ1 ], e1 ∥ eH1 ) is in |φ′ |. In→
addition to this, (π, e′′ ) is in |φ|− , making (t [−g /Γ ] · π, e ∥ e ∥ e′′ )
1

1

1

1

H1

−
in |φ ⊸ φ| . By the induction hypothesis (2), (t0 [v/x][→g0 /Γ̂0 ], u′ , ê)
′

−

=|

. Since=|is closed for ≻s −1 , the original s-executable is also in=|

is in |(φ′ ⊸ φ, ψ)|. These make the reduct a member of.

(case Γ1 = x : θ, Γ̂1 ) Take any eH0 ∈ JH0 K, eH1 ∈ JH1 K, (v, w, e′ ) ∈ |(θ, τ )|,−→→→ˆ (π, e′′ ) ∈ |φ|− and(−g , e ) ∈ |Γ |, (−g , e ) ∈ |Γ̂ |, ( d , f ) ∈ |∆|,
0

0

0

1

1

1

110

(σ, f ′′ ) ∈ |ψ|− . We have to show that the following s-executable is
:

=|

in

→
→
((t0 )t1 )[v/x][−g0 /Γ0 ][−g1 /Γ̂1 ], π ∥ e0 ∥ eH0 ∥ fˆ ∥ e′′−→ ˆ
where fˆ = u[w/y][ d /∆],σ ∥ f ∥ f ′′ ∥ e1 ∥ eH1 ∥ e′ . By (push) and(cong), this s-executable reduces to
→
→
t0 [−
g0 /Γ0 ], t1 [v/x][−
g1 /Γ̂1 ] · π ∥ e0 ∥ eH0 ∥ fˆ ∥ e′′ .
→− ˆ→
By the induction hypothesis (2), (t1 [v/x][−
g1 /Γ̂1 ], u[w/y][ d /∆],
e1 ∥ eH1 ∥
−
→
′
′
′′
−
f ∥ e ) is in |(φ , ψ)|. So, since (σ, f ) is in |ψ| , (t1 [v/x][ g1 /Γ̂1 ], fˆ) is in→|φ′ |. Moreover we have (π, e′′ ) ∈ |φ|− . Combined, (t1 [v/x][−
g1 /Γ̂1 ]·π, fˆ ∥−e′′ ) is in |φ′ ⊸ φ|−. By the induction hypothesis (1), (t [→g /Γ ], ê) is00, making the original s-executable a.

=|member of0=|

in |φ′ ⊸ φ|. So, the reduct is in(⊕I, −) Without loss of generality, we assume that the derivation for t ends asH′H′Γ ⊢ t′ : φ0

Γ ⊢ inl(t′ ) : φ0 ⊕ φ1.

−
(1) Take any eH′ ∈ JH′ K, (→g , e) ∈ |Γ| and (⟨inl(x̂).(v, π0 )/inr(ŷ).(w, π1 )⟩, e′′ ) in→|φ ⊕ φ |− . By the induction hypothesis (1), (t′ [−g /Γ], e ∥ e ′ ) is in |φ |.
0

1

→
′ −

−

H

0

By definition of |φ0 ⊕ φ1 | , the s-executable [v[t [ g /Γ]/x̂], π0 ∥ e ∥ eH′ ∥. Since=|=|e′′ ] is in

is closed for ≻s −1 , the s-executable→inl(t′ )[−g /Γ], ⟨inl(x̂).(v, π0 )/inr(ŷ).(w, π1 )⟩ ∥ e ∥ eH ∥ e′′. This shows the statement because we chose an arbitrary=|

is also inelement of |φ0 ⊕ φ1 |− .
(2) If x is in H, the same argument as (1) suﬃces. Otherwise, take any eH ∈−→−
ˆ
JHK (v, w, e′ ) ∈ |(θ, τ )|, (→g , e) ∈ |Γ̂|, ( d , f ) ∈ |∆|,(⟨inl(x̂).(v̂, π0 )/inr(ŷ).(w, π1 )⟩, e′′ ) ∈ |φ0 ⊕ φ1 |−and (σ, f ′′ ) ∈ |ψ|− . We have to show that the following s-executable is in=|:→(inl(t))[v/x][−g /Γ̂], ⟨inl(x̂).(v̂, π0 )/inr(ŷ).(w, π1 )⟩ ∥ u′ , σ ∥ ê ∥ e′′ ∥ f ′′−→ ˆ
where u′ = u[w/y][ d /∆]and ê = e′ ∥ e ∥∥ eH ∥ f . By (ansL), the s→
executable reduces to v̂[t′ [v/x][−g /Γ̂]/x̂], π ∥ u′ , σ ∥ ê ∥ e′′ ∥ f ′′ . By the in0−→
duction hypothesis (2), (t [v/x][→g /Γ̂], u′ , ê) is in |(φ0 , ψ)|. So, (t′ [v/x][−g /Γ̂], [u′ , σ ∥
′

111

=|

. Since=|is closed for ≻s −1 , the original s-executable is also in=|ê ∥ f ′′ ]) is in |φ0 |. By definition of |φ0 ⊕ φ1 |− , the reduct is in.

(⊕E, −) The derivation for t ends in
H0Γ0 ⊢ t′ : φ0 ⊕ φ1
H0H1

Γ1 , x̂ : φ0 ⊢ t0 : φ

H1

Γ1 , ŷ : φ1 ⊢ t1 : φ′

H1

Γ0 , Γ1 ⊢ match t of inl(x̂).t0 /inr(ŷ).t1 : φ.

−→(1) Take any eH0 ∈ JH0 K, eH1 ∈ JH1 K, (→g0 , e0 ) ∈ |Γ0 |, (−g1 , e1 ) ∈ |Γ1 | and(π, e′ ) ∈ |φ|− . We have to show that the s-executable→→(match t′ of inl(x̂).t0 /inr(ŷ).t1 )[−g0 /Γ0 ][−g1 /Γ1 ], π ∥ e0 ∥ eH0 ∥ e′ ∥ e1 ∥ eH1
=|

is in

. By (ask), the s-executable reduces to

→
→
→
t′ [−
g0 /Γ0 ], ⟨inl(x̂).(t0 [−g1 /Γ1 ], π)/inr(ŷ).(t1 [−g1 /Γ1 ], π)⟩ ∥ e0 ∥ eH0 ∥ e′ ∥ e1 ∥ eH1 .
−−−→We claim that (⟨inl(x̂).(t0 [g0 /Γ0 ], π)/inr(ŷ).(t1 , π)⟩, e1 ∥ eH1 ∥ e′ ) is in |φ ⊕ ψ|−→and that (t′ [−g /Γ ], e ∥ e ) is in |φ ⊕ ψ|. The first claim is shown by the
0

0

0

H0

→
induction hypothesis (1) stating that (t0 [v/x̂][−
g1 /Γ1 ], e1 ∥ eH1 ∥ e′′ ) is in |φ|for any (v, e′′ ) ∈ |φ0 | and similarly to t1 . The second claim follows frominduction hypothesis (1) on t′ . By the two claims and by the definition ofand thence that the original=|s-executable is in=||φ ⊕ ψ|, we have shown that the reduct is in.

(2) Variable x might be in Γ0 , Γ1 , H0 or H1 . In the last two cases, the proof issimilar to that of (1).
(case Γ0 = x : θ, Γ̂0 ) Take any eH0 ∈ JH0 K, eH1 ∈ JH1 K, (v, w, e′ ) ∈ |(θ, τ )|,−→→→ˆ (π, e′′ ) ∈ |φ|− and(−g , e ) ∈ |Γ̂ |, (−g , e ) ∈ |Γ |, ( d , f ) ∈ |∆|,
0

0

0

′′

−

1

1

1

(σ, f ) ∈ |ψ| . We have to show that the following s-executable is
:

=|

in

→
→
(match t′ of inl(x̂).t0 /inr(ŷ).t1 )[v/x][−g0 /Γ̂0 ][−g1 /Γ1 ], π ∥−→ ˆu[w/y][ d /∆], σ ∥ e′ ∥ e0 ∥ eH0 ∥ e1 ∥ eH1 ∥ f ∥ e′′ ∥ f ′′ .
By (ask) and (cong), this s-executable reduces to→−→(t′ [v/x][−g0 /Γ̂0 ], ⟨inl(x̂).(t0 [→g1 /Γ1 ], π)/inr(ŷ).(t1 [−g1 /Γ1 ], π)⟩ ∥→− ˆu[w/y][ d /∆],σ ∥ e′ ∥ e0 ∥ eH0 ∥ e1 ∥ eH1 ∥ f ∥ e′′ ∥ f ′′ .
By the induction hypothesis (2), we have
−
→ ˆ ′
→
(t′ [v/x][−g0 /Γ̂0 ], u[w/y][ d /∆],e ∥ e0 ∥ eH0 ∥ f ) ∈ |(φ0 ⊕ φ1 , ψ)| .
112

Also, we defined (σ, f ′′ ) to be an element of |ψ|− . By definition of=|is closed for ≻s −1 , the=|original s-executable is also in. Since=||(φ0 ⊕ φ1 , ψ)|, the reduct is in.

(case Γ1 = x : θ, Γ̂1 ) Take any eH0 ∈ JH0 K, eH1 ∈ JH1 K, (v, w, e′ ) ∈ |(θ, τ )|,−→→→ˆ (π, e′′ ) ∈ |φ|− and(−g0 , e0 ) ∈ |Γ0 |, (−g1 , e1 ) ∈ |Γ̂1 |, ( d , f ) ∈ |∆|,
(σ, f ′′ ) ∈ |ψ|− . We have to show that the following s-executable is
:

=|

in

−
→
(match t′ of inl(x̂).t0 /inr(ŷ).t1 )[→g0 /Γ0 ][v/x][−
g1 /Γ1 ], π ∥→− ˆu[w/y][ d /∆],σ ∥ e′ ∥ e0 ∥ eH0 ∥ e1 ∥ eH1 ∥ f ∥ e′′ ∥ f ′′ .
By (ask) and (cong), this s-executable reduces to→
er =t′ [−g0 /Γ0 ], ⟨inl(x̂).(t′0 , π)/inr(ŷ).(t′1 , π)⟩ ∥→− ˆu[w/y][ d /∆],σ ∥ e′ ∥ e0 ∥ eH0 ∥ e1 ∥ eH1 ∥ f ∥ e′′ ∥ f ′′→→g1 /Γ1 ]. By the induction
g1 /Γ1 ] and t′1 = t′1 [v/x][−
where t′0 = t0 [v/x][−−→′ ′ˆ e′ ∥ e1 ∥ eH1 ∥ e′ ∥ f )hypothesis (2), the triple (t0 [v0 /x̂], u[w/y][ d /∆],
0−→is in |(φ, ψ)| for any (v0′ , e′0 ) ∈ |φ0 | so that (t′0 [v0′ /x̂], [u[w/y][ d /D̂], σ ∥e′ ∥ e1 ∥ eH1 ∥ e′0 ∥ f ∥ f ′′ ]) is in |φ|. We have a symmetric fact for t1 .
Thus, the environment(⟨inl(x̂).(t′0 , π)/inr(ŷ).(t′1 , π)⟩,−→ ˆ[u[w/y][ d /∆],σ ∥ e′ ∥ e1 ∥ eH1 ∥ f ∥ e′′ ∥ f ′′ ])→is in |φ0 ⊕ φ1 |−. By the induction hypothesis (1), (t′ [−g0 /Γ0 ], e0 ∥ eH0 ). Since=|=|is closed for ≻s −1 , the original s-executable is also in=|

is in |φ0 ⊕ φ1 |. By definition of |φ0 ⊕ φ1 |, the reduct er is in.

(Com, −) The derivation for t ends in
H0x̂ : φ0 ⊸ φ1 , Γ0 ⊢ t0 : φ
H0

H1

H1

Γ0 ⊢ t0 [∗→c̄←c /x̂] : φŷ : φ1 ⊸ φ0 , Γ1 ⊢ t1 : φ′′
Γ1 ⊢ t1 [∗→c←c̄ /ŷ] : φ.

→→(1) Take any eH0 ∈ JH0 K, eH1 ∈ JH1 K, (−g0 , e0 ) ∈ |Γ0 | and (−g1 , e1 ) ∈ |Γ1 |.
→c
By Proposition 4.3.2, we have (∗→c̄←c , ∗←c̄ , ∅) ∈ |(φ0 ⊸ φ1 , φ1 ⊸ φ0 )|. By→
the induction hypothesis (2), the s-terms t′ = t [∗→c̄ /x̂][−g /Γ ] and t′ =
0

0

←c

0

−
→
′ ′
′
t1 [∗→c←c̄ /ŷ][ g1 /Γ1 ] satisfy (t0 , t1 , e0 ∥ eH0 ∥ e1 ∥ eH1 ) ∈ |(φ, φ )|.

01(2) If x : θ is in H0 or H1 , we can apply the same argument as (1). Otherwise,
without loss of generality, we can assume Γ0 = x : θ, Γ̂0 up to exchange.
113

−
→
−
→
ˆ
Take any (v, w, e′ ) ∈ |(θ, τ )|, (→g0 , e0 ) ∈ |Γ̂0 |, (−g1 , e1 ) ∈ |Γ1 |, ( d , f ) ∈ |∆|,
(π, e′′ ) ∈ |φ|− , (π ′ , e′′′ ) ∈ |φ′ |− and (σ, f ′′ ) ∈ |ψ|− . After defining t′0 =
−
→ ˆ
→
−
−
→
′
→c
′
t0 [∗→c̄←c /x̂][ g0 /Γ̂0 ][v/x], t = t1 [∗←c̄ /ŷ][ g1 /Γ1 ] and u = u[w/y][ d /∆], we1=|have to show that this s-executable is in:

t′0 , π ∥ t′1 , π ′ ∥ u′ , σ ∥ e′ ∥ e0 ∥ eH0 ∥ e1 ∥ eH1 ∥ f ∥ e′′ ∥ e′′′ ∥ f ′′ .
Consider the derivation consisting of an axiom x̂ : φ0 ⊸ φ1 ⊢ x̂ : φ0 ⊸ φ1 .
This derivation is shorter than the derivation for H. We can use the induction hypothesis (2) on this derivation and the derivation of u. By this′and Proposition 4.3.2, (∗→c̄←c , t1 , e1 ∥ eH1 ) is in |(φ0 ⊸ φ1 , φ)|. So, program′′′′′p = (∗→c̄←c , [t1 , π ∥ e1 ∥ eH1 ∥ e ]) is in |φ0 ⊸ φ1 |. By the induction hypoth-esis (2) for the derivations for t0 and u, especially using the program p for
substituting x̂, we can show that (t′0 , u′ , (t′1 , π ′ ∥ e1 ∥ eH1 ∥ e′′′ ∥ e0 ∥ eH0 ∥H′=|(∀I, −) The derivation for t ends in. Sinceis closed for ≻s −1 ,=|the original s-executable is also in=|e′ ∥ f )) is in |(φ, ψ)|. Thus, the reduct is in.

Γ ⊢ t:φ.
HΓ ⊢ t : ∀Xφ→(1) Take any e ′ ∈ JH′ K and (−g , e) ∈ |Γ|. Since Γ does not contain X freely,
′

H

=|

|Γ| does not change whatever |X|−
0 is. By induction hypothesis (1) for∩−→−
arbitrary |X|0 , the program (t[ g /Γ], e ∥ eH′ ) is in Z∈2Πs |φ[Z/X]|, which)(∪|φ[Z/X]|− → .
is a subset ofZ∈2Πs(2) We can replace X in the derivation of t with a propositional variable X ′that does not occur in the derivation of u. We are going to use the induction hypothesis on the renamed derivation with the s-terms and s-stacks
taken above. Since θ and Γ̂ do not contain X freely, we have (v, w, e′ ) ∈→|θ[X ′ /X], τ |, (−g , e ∥ e ) ∈ |Γ̂[X ′ /X]| and (π, e′′ ) ∈ |∀X ′ φ[X ′ /X]|− . By
H

the induction hypothesis (2) on the renamed derivation, the s-terms t′ =−→→t[v/x][−g /Γ] and u′ = u[w/y][ d /∆] satisfy (t′ , u′ , e ∥ f ∥ eH ) ∈ |φ[X ′ /X], ψ ′ |
E
′′
′
′ −
for any |X ′ |−0 . That is, for Z ∈ 2 that makes (π, e ) ∈ |φ[X /X][Z/X ]|=|an element of, making t′ , π ∥ u′ , σ=|and (σ, f ′′ ) ∈ |ψ[Z/X ′ ]|− , t′ π ∥ u′ , σ ∥ e′′ ∥ f ′′ is in..

(∀E, −) Both statements follow from the induction hypotheses because |φ[ψ/X]|− isa subset of |∀Xφ|− .
(Other cases) We can swap t and u and find a symmetric case above.

114■

Note that (1) uses (2) in (Com, −) and (2) uses (1) in (⊸E, −) and (IW, −) in the
proof of Theorem 4.3.3.
Proposition 4.3.4 Given a set P of processes, the following set is a pole: the set ofs-executables that reduces to an s-executable containing an element of P .
Proposition 4.3.5 (Prelinearity as a communication scheme) Assume that ans-term g has type ∀X∀Y ((X ⊸ Y ) ⊕ (Y ⊸ X)). Then, the s-executable[g, ⟨inl(z).(z, x · πY )/inr(w).(w, y · πX )⟩]reduces to a multiset containing an element of {(x, πX ), (y, πY )}.
=|Proof We denote by

the set of s-executables that reduce to a multiset containing=|

an element of {(x, πX ), (y, πY )}. By Proposition 4.3.4,

is a pole. Take |X|−
0 ={(πX , ∅)} and |Y |−0 = {(πY , ∅)}. We have x ∈ |X| and y ∈ |Y |. By definition of|·|− , ⟨inl(z).(z, x · πY )/inr(w).(w, y · πX )⟩ is in |(X ⊸ Y ) ⊕ (Y ⊸ X)|−. By adequacy=|(Theorem 4.3.3), [g, ⟨inl(z).(z, x · πY )/inr(w).(w, y · πX )⟩] is in.

■

Proposition 4.3.6 Let e be an s-executable. If e ≻s e′ then e, Sϵ ≻a e′ , Sϵ .
Proof Most reduction rules are common. Rules (com0) and (com1) are simulated in
Figure 4.3. Rule (com2) can be simulated similarly.

■

This transfers the semantics of prelinearity (Proposition 4.3.5) to the asynchronous
case.
Example 4.3.7 (A term performing information exchange.) Since g = (inl(∗→c̄←c ) ∥
inr(∗→c←c̄ )) has the type ∀X∀Y ((X ⊸ Y ) ⊕ (Y ⊸ X)) (Figure 4.5), g satisfies the condition of Proposition 4.3.5. Indeed, by (dist), [g, ⟨inl(z).(z, x · πY )/inr(w).(w, y · πX )⟩]reduces to[()
inl(∗→c̄←c ), ⟨inl(z).(z, x · πY )/inr(w).(w, y · πX )⟩]∥ (inr(∗→c←c̄ ), ⟨inl(z).(z, x · πY )/inr(w).(w, y · πX )⟩) .
→c
By (ansL), (ansR) and (cong), the s-term above reduces to [∗→c̄←c , x · πY ∥ ∗←c̄ , y · πX ].

Depending on the schedule, the s-term above reduces to either [x, πX ] or [y, πY ] or[x, πX ∥ y, πY ].

115

4.4

Characterization of Monoidal t-Norm Logic

There is a well-known substructural logic called monoidal t-norm logic (MTL), which
validates the prelinearity axiom (φ ⊸ ψ) ⊕ (ψ ⊸ φ). Actually, NMTL2 characterizes
MTL (Propositions. 4.4.2 and 4.4.3).
The MTL formulae can be defined as2 :φ ::= 0 | X | φ ⊸ ψ | φ ⊗ ψ | φ ⊕ ψ .
As an abbreviation, we can introduce φ ∧ ψ = (φ ⊗ (φ ⊸ ψ)) ⊕ (ψ ⊗ (ψ ⊸ φ))3 . We
take a hypersequent formulation of MTL by Baaz et al. [13], whose rules we show in
Figure 4.6.
(ax)

(cut)

(w,r)

(⊗, l)(⊸,l)(⊕, l)

(ax)

X⊢X
H

Γ⊢φ

H

H

Γ, ∆ ⊢ ψ

H

Γ⊢0

H

Γ⊢φ

H

Γ, φ, ψ ⊢ χHΓ, φ ⊗ ψ ⊢ χ

H

Γ⊢φ
H

H

0⊢φ

(com)

H

∆0 , Γ0 ⊢ φ
H∆0 , ∆1 ⊢ φ

φ, ∆ ⊢ ψH∆, ψ ⊢ χΓ, φ ⊢ χ
H

H

H

Γ⊢φ

H

Γ, ψ ⊢ φ

(EW)

H

H
Γ⊢φ

H

∆⊢ψ

Γ⊢φ
H
(⊸, r)Γ, ∆, φ ⊸ ψ ⊢ χΓ, ψ ⊢ χ(⊕, r)

Γ, φ ⊕ ψ ⊢ χ∆1 , Γ1 ⊢ ψ
Γ0 , Γ1 ⊢ ψ(w,l)(⊗, r)

HHΓ, ∆ ⊢ φ ⊗ ψHΓ, φ ⊢ ψ

H

Γ⊢φ⊸ψ

H
H

Γ ⊢ φiΓ ⊢ φ0 ⊕ φ1

Figure 4.6: The propositional rules in HL∀BCK [13], which characterizes monoidal tnorm logic. Axioms are not shown in Baaz et al. [13] so we took them from Ono andKomori [116]. Exchange rules are implicit: the contexts and hypersequents are treatedas finite sets rather than sequences. If a formula is provable with the (cut) rule, theformula is also provable without the (cut) rule by Baaz et al. [13, Theorem 3.2].

2 From the literature [34], the connectives are translated as & into ⊗ and → into ⊸.
3 The translation of ∧ is a tailor-made one for MTL, which is taken from [34, p. 48]. The origin of

the translation can be traced back to Cintula et al. [33, Lemma 6.5].

116

We translate MTL formulae to MTL2 formulae by induction on φ:0• = ∀XX
X• = X(φ ⊸ ψ)• = φ• ⊸ ψ •(φ ⊗ ψ)• = ∀X((φ• ⊸ ψ • ⊸ X) ⊸ X) where X does not appear in φ ⊗ ψ(φ ⊕ ψ)• = φ• ⊕ ψ •.

We state that any MTL formula φ is a theorem in HL∀BCK iﬀ φ• is a theorem in
NMTL2 . In order to reason inductively on hypersequent derivations, we extend thetranslation (·)• to sequents and hypersequents. We define (Γ ⊢ φ)• to be Γ• ⊸φ• where Γ• is the ⊗-conjunction of translations of the elements of Γ. We define)•(···Γn ⊢ φn to be (Γ0 ⊢ φ0 )•···(Γn ⊢ φn )• . A substitution
Γ 0 ⊢ φ0instance of an MTL2 formula φ is an MTL formula obtained by substituting an MTL
formula for each bound propositional variable in φ.
Proposition 4.4.1 If a hypersequent is derivable in NMTL2 , all substitution instancesof the hypersequent are derivable in HL∀BCK .
Proof By induction on NMTL2 derivations.

■

Proposition 4.4.2 (Soundness) When the translation φ• is provable in NMTL2 ,the original φ is provable in HL∀BCK .
Proof We define an MTL formula φ◦ inductively on an MTL formula φ so that φ◦is a substitution instance of φ• and φ◦ ⊸ φ is provable in HL∀BCK . The definition ofφ◦ follows:0◦ = 0X◦ = X(φ ⊸ ψ)◦ = φ◦ ⊸ ψ ◦(φ ⊗ ψ)◦ = (φ◦ ⊸ ψ ◦ ⊸ (φ◦ ⊗ ψ ◦ )) ⊸ (φ◦ ⊗ ψ ◦ )(φ ⊕ ψ)◦ = φ◦ ⊕ ψ ◦ .
Both claims are immediate. Assume φ• is provable in NMTL2 . By the first claim and
Proposition 4.4.1, φ◦ is provable in HL∀BCK . By the second claim, φ is provable in
HL∀BCK .

■117

Proposition 4.4.3 (Completeness) If a hypersequent H is derivable in HL∀BCK
without using (cut), then the translation H• is derivable in NMTL2 .
Proof By induction on derivations of the cut-free fragment of HL∀BCK . All cases
are straightforward. For branching rules, we have to apply (EC) because in HL∀BCK ,the components in a hypersequent are distributed additively while in NMTL2 multiplicatively. And above and below (EC), we have to use (⊸I) and (⊸E) so that the
restricted form of (EC) rule in NMTL2 is applicable.

4.5■

Discussion and Future Work

This work is technically similar to Danos and Krivine’s [38]. One large diﬀerenceis the existence of (comi), (read) and (write) reductions, where terms are passed
from processes to other processes. In [38], the only reduction rule involving multiple
processes is (dist), which spawns processes that never communicate. Sharing their
purpose “interpretation of logical rules as programming instructions” [38], we continue
to seek generalization to other substructural logics.
The asynchronous semantics given here is similar to that of a hyper-lambda calculus
λ-GD by Hirai [77]. We conjecture that our classical realizability argument here isapplicable to λ-GD as well, but for that, due to contraction rule, we have to generalize
the statement of adequacy to involve arbitrarily many derivations.
There are recent developments [26, 146] over Curry-Howard correspondence between the linear logic and process calculi. Since their type systems do not incorporate
the prelinearity axiom (without modalities ! or ?), we conjecture that we can extend
their type systems and their process calculi with the prelinearity axiom representing
the same kind of communication schemes as we have shown4 .
Hájek’s basic fuzzy logic (BL) is very similar to MTL [28]. Actually from MTL,
BL can be obtained by adding (φ ⊗ (φ ⊸ ψ)) ⊸ (ψ ⊗ (ψ ⊸ φ)) (or a symmetricaxiom). Thus, we have to find the computational meaning of the additional axiom inorder to find a lambda calculus for BL.

4.6

Conclusion

We developed a lambda calculus for MTL2 and analyzed the prelinearity axiom using the classical realizability. The terms typed with prelinearity are asynchronous
communication schemes.
4 Although it is not clear how to implement shared memory in the target process calculi.

118

Chapter 5Hypersequents in the Programming
Language Haskell

5.1

Summary

We investigate the computational meaning of hypersequents and realize it as a Haskell
library. The hypersequent calculus is introduced by mathematical logicians [8, 30, 102]in order to obtain cut-free deduction systems for more logics. In the previous chapters, we proposed using hypersequents for representing asynchronous or synchronous
communication. In this chapter, we try implementing hypersequents within a programming language Haskell [98]. Logically, a hypersequent means every model satisfies atleast one component. Computationally, a hypersequent means every execution makes
at least one component successful. We use this analogy for waitfreely communicating
threads. This is useful because typical waitfree protocols use the fact that at least
one thread can successfully read other thread’s information. Throughout this chapter,
Haskell syntax is assumed1 . Another purpose of this chapter is confirmation of theproof of Theorem 3.4.3 and Theorem 3.4.7 by implementing it.

5.2

Introduction

5.2.1

Waitfreedom

Waitfreedom is a notion born in the theory of asynchronous communication [72, 93,125]. Since waitfreedom provides no synchronization among processes, it has served
as a basis for comparing diﬀerent synchronization primitives. The intuition of waitfreedom is simple: a thread cannot wait for another thread. Suppose there are a finite
1 Under Haskell platform, cabal

install waitfree will install this library.

119number of threads and they can communicate using a store. They can visit the store,
put and take things on the store and then leave the store. The problem is that thethread’s movements can be arbitrarily slow: they can delay for unspecified amount oftime and the threads have no control over the delay. Waitfreedom prohibits a threadfrom waiting for another; that is, a thread cannot choose to stay at the store until another thread comes to the store; nor can a thread keep visiting the store until anotherthread comes to the store2 . The latter restriction can be formalized as existence of aconstant natural number k so that no thread visits the store more than k-times in any
execution. So, when a thread consumes all permitted visits to the store, the thread
has to give up receiving anything yet to come from other threads. We can enforce
this restriction by prohibiting looping so that each thread can make steps at most the
number of lines in its program.
This notion of waitfreedom is originally imperative: involving reads from and writes
to the memory and the ordering of events. In other words, this description is about
how waitfree computation works but it is hard to deduce from this notion what waitfree computation computes. The merit of using a functional programming language,especially a pure one like Haskell, is emphasized if the program describes what rather
than how it computes.
Concrete examples give a useful intuition for modeling what waitfree protocols cancompute. Suppose a thread has a value v and another has w. It is waitfreely impossible
for the two threads to exchange their possessions. Instead, there is a waitfree protocol
for them to ensure that either w is passed to the second thread or v is passed to thefirst thread. In other words, only one-way communication is guaranteed. We are going
to exploit this property when formulating waitfree computation with hypersequents.
5.2.2

Implementing Hyper-Lambda Calculus

In waitfree protocol, two threads can communicate in one-way fashion, and it is decided
at execution time which one can send information to the other. This phenomenon canbe understood as a set of computations of which at least one is guaranteed to be
successful. Such a set of computations can be represented as a hypersequent. K s a
represents thread s’s computation yielding a value of type a and K t b represents
thread t’s computation yielding a value of type b. The waitfree protocol described at
the end of Subsection 5.2.1 witnesses the following derivation because either t obtains
b or s obtains a after executing the protocol.
2 Thus a thread cannot busy-wait for the shared memory to be filled.

120

K t a
K t b

K s b
K s a

However, this derivation only contains types but not programs. In this chapter, weare going to propose how to write a program belonging to this type in Haskell.
From this perspective, the merit of this chapter exists in showing the hyper-lambda
calculi are implementable. Hypersequents are roughly sequences of typed terms. At
first, they were introduced as an apparatus for obtaining cut-elimination theorems formore logics. However, as we have seen in Chapters 2, 3 and 4, we can obtain programming languages out of hypersequent calculi. Thus it is natural to try implementing
the programming languages.

5.3

An Example Program

We show an example program written using our library (Figure 5.1). This is aconcrete realization of the simplest nontrivial waitfree computation described at theend of Subsection 5.2.1.
The external behavior of the example program. This program can be compiled
and executed as:% ghc --make -threaded waitfree_test.hs[1 of 1] Compiling Main
Linking waitfree_test ...
% ./waitfree_test
Then, it spawns two threads listening on port 6000 and 6001. If we connect to the firstthread on port 6000 and give input apple, the first thread tries to obtain the input
given to the other thread but since the first thread cannot wait for the second, fails to
do so and aborts. Below, we omit the outputs of telnet for clarity.
% telnet localhost 6000
0 requiring input: apple
Thread 0 failed to read peer’s input.
When we connect to the second thread on port 6001 and give another input orange,
the second thread obtains the input apple given to the first thread and displays both
inputs.
% telnet localhost 6001

121

1 requiring input: orange
Thread 1 got: ("orange\r","apple\r")
The internal behavior of the example program.

Each of threads 0 and 1 writes

its input into the shared memory and then tries to read the other thread’s input fromthe shared memory. When a thread tries to read what the other thread has not
written, the reader aborts. The reading thread cannot wait for the other thread’s
write operation.
We assume sequential consistency. Sequential consistency is an illusion sustainedby shared memory mechanism that pretends to align all memory operations in a totallyordered sequence. In this case, there are six possible such ordered sequences.
• 0 writes, 0 reads, 1 writes and 1 reads. Then, 1 reads 0’s write.
• 0 writes, 1 writes, 0 reads and 1 reads. Both read each other’s write.
• 0 writes, 1 writes, 1 reads and 0 reads. Both read each other’s write.
• 1 writes, 0 writes, 0 reads and 1 reads. Both read each other’s write.
• 1 writes, 0 writes, 1 reads and 0 reads. Both read each other’s write.
• 1 writes, 1 reads, 0 writes and 0 reads. Then, 0 reads 1’s write.
In any of these six cases, either thread 0 obtains thread 1’s input or 1 obtains 0’s
input.
The source code of the example program. We look at the source code of thissample program in Figure 5.1.
For implementing the above-described external behavior, an obvious thing to do isto establish a TCP connection. This is done by a function called handle. The inputof handle is a PortID, which is the port number. The output of handle is a Handle,
which is a TCP connection.
handle :: PortID -> IO Handle
handle p = withSocketsDo $ dos <- listenOn p(h,_,_) <- accept s
hSetBuffering h NoBuffering
return h122Since this connection establishment should be done by a thread, we prepare a hypersequent containing this computation. For that, we can use our library function single
that creates a hypersequent containing a single component.
prepareHandle :: Thread t =>PortID -> IO (K t Handle :*: HNil)
prepareHandle p = single $ handle p

Next the program asks the user to provide an input. In doing that, showing thename of the current thread is useful. When a type t is of the type class Thread, we
can obtain the thread’s number via atid function (atid stands for Abstract ThreadID).
readLine :: Thread t =>t -> Handle -> IO ((Handle, String), String)
readLine th h = do
hPutStr h $ (show $ atid th) ++ " requiring input: "str <- hGetLine hreturn ((h, str), str)

The result of this interaction is stored in a tuple ((h, str), str), whose left partcontains things to be used locally, and whose right part contains things to be used
remotely in the other thread. The handle h is kept locally at the thread while theobtained input str is duplicated.
This distinction of local and remote usage is apparent in the type of comm function,
which provides the simplest waitfree communication.
comm :: (Thread s, Thread t, HAppend l l’ l’’) =>IO (K t (b,a) :*: l)-> IO (K s (d,c) :*: l’)-> IO (K t (b,c) :*: K s (d,a) :*: l’’)The comm function assumes that the types s and t are Threads and that a hypersequentl’’ is the concatenation of l and l’. Under these assumptions, the function takes
two hypersequents in IO monad and returns a hypersequent in IO monad. The firstargument says either t’s computation of a value of type (b,a) or one of the componentsof the hypersequent l succeeds. The second argument says the same thing for s’s(d,c) and l’. If any component in l or l’ is successful, that component witnesses
the resulting hypersequent. Otherwise, when thread t computes (b,a) value and scomputes (d,c) value successfully, the comm function guarantees either t obtains the123c value or s obtains the a value. The b value and the d value are only used locally.
Without this distinction of local and remote usage, the TCP connections would becommunicated together with the inputs so that the connections are not closed until
all threads terminates.
When we draw the type of comm in the hypersequent style,
IO (K t (b,a) :*: l)IO (K t (b,c) :*:IO (K s (d,c) :*: l’)K s (d,a) :*: l’’)we see some similarities and diﬀerences from the hyper-lambda calculus in Chapter 3.
When we ignore b and d, then the rule is the same as ij-com rule in Figure 3.2 exceptthat the type of comm does not have contexts.
The final agenda is to output the obtained inputs. This is done by the printTaken
function. Similarly to readLine function, the printTaken function takes the thread
and the result of the last computation.
Everything is wrapped up into a hypersequent content of the typeIO (K ZeroT () :*: K (SucT ZeroT) () :*: HNil)and it is executed. Here, ZeroT means thread 0 and SucT ZeroT means thread 1.
The content of execute function is explained in the next section.

5.4

Implementation of the Library

5.4.1

What is a Hypersequent

We implemented hypersequents as heterogeneous collections by Kiselyov et al. [88] witha slight modification. We required each element of such a heterogeneous collection to
be a thread’s computation. We expressed threads as type level natural numbers, which
is obtained by simplifying heterogeneous lists. Each thread is expressed as a singleton
type containing a single value. When that value is passed to the atid function, thefunction returns an AbstractThreadId, which is tentatively defined to be Int.
A type t can be of type class Thread only if there is a constant called t of type t.
class Thread t wheret :: tatid :: t -> AbstractThreadId

We declare a type called ZeroT, which have a single value called ZeroT (it is a customof the Haskell community to use the same name for a type and its unique constructor).
The type ZeroT is of type class Thread after defining constant t to be the single value
ZeroT. The type ZeroT is going to be used as the label for thread 0.
124

data ZeroT = ZeroT
instance Thread ZeroT wheret = ZeroT
atid ZeroT = 0

We are going to allow users to use as many threads as they want. After ZeroT, we
inductively define infinitely many types of type class Thread. For type t, we define atype SucT t. A value of SucT t is of the form SucT t where t is a value of type t.
Especially, when type t is of type class Thread, the new type SucT t is also of typeclass Thread. The type class Thread requires a constant t of SucT t, which we define
to be SucT t where value t of type t is the constant provided by our assumption thattype t is of type class Thread.
data SucT t = SucT t
instance Thread t => Thread (SucT t) wheret = SucT t
atid (SucT x) = succ $ atid x

type AbstractThreadId = Int

Using these, we have many types of type class Thread: ZeroT, SucT ZeroT and so on.
This technique is called type level natural numbers.
Thread t’s computation of type a is represented as K t a. Internally, it is apair of thread and a computation of JobStatus a. A JobStatus can be Having a,
Done TryAnotherJob or Done Finished. Having a shows the thread’s computation
is not yet finished and as the intermediate result the thread have a value of type a.
Done TryAnotherJob shows that the thread has stopped after failing to read sharedmemory content. Done Finished shows that the thread has stopped.
newtype K t a = K (t, IO (JobStatus a))data JobStatus a = Having a | Done ThreadStatus
data ThreadStatus = TryAnotherJob | FinishedA hypersequent is either HNil or HCons (K t e) l where l is a hypersequent.
This inductive definition realizes the idea of a heterogeneous list of threads’ computations. This construction is an adaptation of [88]. First we declare a type class called
HyperSequent.
class HyperSequent l

125

Second, we define the empty hypersequent called HNil of type HNil of type class
HyperSequent.
data HNil = HNil
instance HyperSequent HNil

Third, we define the cons operation of hypersequent. HCons e l is of type HCons e lwhen e is of type e and l is of type l. Especially, when type l is of type class
HyperSequent, the type HCons (K\,t\,e) l is also of type class HyperSequent whatever the type e is.
data HCons e l = HCons e linstance HyperSequent l =>HyperSequent (HCons (K t e) l)Finally, we define an abbreviation for type HCons e l.
infixr 5 :*:type e :*: l = HCons e l

In our framework, every hypersequent is going to be contained in IO monad so that
hypersequent derivations can contain MVar cells. The MVar cells are used for implementing the communication rule. Although we use MVar cells, which are capable ofsupporting full synchronization among threads, we only use a limited set of functions
that only allows waitfree communication. For instance, we do not use takeMVar or
putMVar because they are blocking operations.
5.4.2

How to Execute a Hypersequent

Of course we can execute a hypersequent after we construct it. The execution takes
three steps: preparing computations, spawning threads and waiting for them.
After a hypersequent derivation is constructed, it is turned into a list of local
computations. A value of type L is internally used to represent a piece of local computation. Each piece of computation results in either TryAnotherJob or Finished.
These decide whether the thread continues to operate or stops.
type L = (AbstractThreadId, IO ThreadStatus)

Local computations are then transformed into a finite map from thread identifiers
to channels containing computations. Each thread reads the list for its own identifier
and executes the computations in the list one by one. A type l can be of type class
Lconvertible only if a value of type l can be converted into a list of L values.
126

class Lconvertible l where
htol :: l -> [L]Any value of type HNil is converted into an empty list of L values.
instance Lconvertible HNil where
htol _ = []A longer hypersequent is also convertible into a list of L values.
instance (Thread t, Lconvertible l) =>Lconvertible (HCons (K t ThreadStatus) l) where
htol (HCons (K (th, result)) rest) =(atid th, fmap jth2th result) : htol rest

jth2th :: JobStatus ThreadStatus -> ThreadStatus
jth2th (Having x) = x
jth2th (Done x) = x

Since a list of type [L] contains pieces of computation for possibly multiple threads,
the next thing is demultiplexing the list into many lists each of which serves jobs to
one thread. We construct a list of computations for each thread. The lists have type
JobChannel. The JobChannels are put in a finite map called JobPool. The JobPool
maps each AbstractThreadId to a JobChannel. Later, the worker threads look at
this map to take jobs.
type JobChannel = [IO ThreadStatus]

type JobPool =Map.Map AbstractThreadId JobChannel

The actual conversion is done by constructJobPool, which acts inductively on a listof type [L].
constructJobPool :: [L] -> JobPool
constructJobPool [] = Map.empty
constructJobPool ((aid, action) : tl) =Map.insertWith (++) aid [action] rest
where rest = constructJobPool tl

At last, threads are spawned. Each thread’s operation is defined in worker function.
It takes two arguments. The first argument is a channel containing jobs. The other127

argument is an MVar cell for telling termination to the main thread. Although theworker threads do not wait for any other worker thread, the main thread waits for theworker threads. The worker tries consuming jobs in the provided JobChannel one by
one until one succeeds or all fails. After the worker consumes all jobs in the provided
JobChannel, the worker puts () into the provided MVar cell so that the main thread
can notice that the worker is idling.
worker :: JobChannel -> MVar () -> IO ()worker [] fin = tryPutMVar fin () >>= \_ -> return ()worker (hd : tl) fin = doresult <- hd
case result of
TryAnotherJob -> worker tl fin
Finished -> tryPutMVar fin () >>= \_ -> return ()When the main thread spawns the worker threads, it has their ThreadIds andthe termination MVar cells in a finite map. After spawning the worker threads, themain thread waits for each worker thread to fill the MVar and then kills the worker
thread. A value of type ThreadPool maps a value of AbstractThreadId into a valueof ThreadId and an MVar. A value of type ThreadId is provided by the Haskell
Concurrent library and a value of ThreadId can be used to kill a thread. The MVar isfilled when the worker thread finishes the computation and then the main thread cansee the worker thread has finished.
type ThreadPool = Map.Map AbstractThreadId (ThreadId, MVar ())

The main thread uses threadSpawn to register a new thread in the thread pool using
an AbstractThreadId and a JobChannel.
threadSpawn :: AbstractThreadId -> JobChannel -> IO ThreadPool -> IO ThreadPool
threadSpawn aid ch p = dop’ <- pfin <- newEmptyMVar
thid <- forkIO $ worker ch fin
return $ Map.insert aid (thid, fin) p’

Then, the main thread waits for all worker threads and kills them.
waitThread :: ThreadPool -> IO ()waitThread = Map.fold threadWait $ return ()128

threadWait :: (ThreadId, MVar ()) -> IO () -> IO ()threadWait (thid, fin) w = doreadMVar fin
killThread thidw

At last, everything is wrapped up into a function called execute.
execute :: Lconvertible l => IO l -> IO ()execute ls = dols >>= run . constructJobPool . htol >>= waitThread

run :: JobPool -> IO ThreadPool
run = Map.foldrWithKey threadSpawn $ return Map.empty

Since all hypersequents are of types belonging to type class Lconvertible, they canbe executed.
5.4.3

How to Construct a Hypersequent

Since a hypersequent represents a finite multiset of computations of which at least one
succeeds, there cannot be an empty hypersequent. Thus, the simplest hypersequentis a hypersequent consisting of a single component. This can be built with single
function. The ingredient computation is not of type IO a but of type t -> IO a sothat the computation can display the thread t’s AbstractThreadId.
single :: Thread t => (t -> IO a) -> IO (K t a :*: HNil)
single f = return $ HCons (remote $ f t) HNil
where remote y = K (t, fmap Having y)

As we want to regard a hypersequent as a multiset of components, we allow permutation and concatenation of hypersequents. First, exchange function changes the
positions of the first two components:
exchange :: K t a :*: K s b :*: l -> IO (K s b :*: K t a :*: l)exchange (HCons x (HCons y rest)) = return $ HCons y $ HCons x rest

Second, cycling functions puts the last component in the first position. In order toimplement this function, we defined a type class called HLast. The type class instance
HLast l a heads means that the hypersequent l is a concatenation of heads anda singleton list made of a. In other words, the last element of l is a and the rest129

is heads. This tactic of defining a type class is taken from the paper of heterogeneous collections [88]. By exchange and cycling, we can perform all permutations ofhypersequents3 .
First, we declare the type class HLast. Here we use functional dependencies [84]to specify that the choice of type l uniquely determines the types a and heads thatsatisfies HLast l a heads (if there exists such a and heads at all). In other words,
HLast is actually a partial function that takes type l and returns types a and heads.
class HLast l a heads | l -> a, l -> heads
where hLast :: l -> (a, heads)

The HLast is defined on hypersequents inductively.
instance HLast (HCons a HNil) a HNil
where hLast (HCons x HNil) = (x, HNil)

instance (HLast (HCons lh ll) a heads) =>(HLast (HCons b (HCons lh ll)) a (HCons b heads))
where hLast (HCons y rest) =case hLast rest of(x, oldheads) -> (x, HCons y oldheads)

Using this type class HLast, we can define cycling function, which moves the lastelement of a hypersequent to the first position.
cycling_ :: HLast l a heads => l -> HCons a heads
cycling_ lst = case hLast lst of(last_, heads) -> HCons last_ heads

cycling :: HLast l last heads => IO l -> IO (HCons last heads)
cycling = fmap cycling_

Finally, we provide concatenation of hypersequents with follows function. Again,
we prepare a type class called HAppend for this. This technique is also from Kiselyov
et al. [88].
follows :: HAppend l l’ l’’ => IO l -> IO l’ -> IO l’’follows l0 l1 = doh0 <- l0
3 Thisimplementation of permutations comes from Tatsuya Abe’s implementation of a typed

lambda calculus for modal logic K. Tatsuya Abe showed the Agda [24] implementation to the author
in Tokyo.

130h1 <- l1
return $ hAppend h0 h1

class HAppend l l’ l’’ | l l’ -> l’’where hAppend :: l -> l’ -> l’’instance HyperSequent l => HAppend HNil l lwhere hAppend HNil = id

instance (HyperSequent l, HAppend l l’ l’’)=> HAppend (HCons x l) l’ (HCons x l’’)where hAppend (HCons x l) = HCons x. hAppend l

In addition to simple permutations of hypersequents, we have another structuralrule called external contraction. When a hypersequent begins with two componentsof the same type, they can be merged into one. The resulting component represents
the computation of trying the two original components one by one until one of them issuccessful or all components fail. The type of choice reveals that the two componentsof the same type K t a are squashed into a single component.
choice :: Thread t => K t a :*: K t a :*: l -> IO (K t a :*: l)choice (HCons (K (_, comp0))(HCons (K (_, comp1)) rest)) =return $ HCons (K (t, result)) rest
whereresult = dor0 <- comp0case r0 of
Having a -> return $ Having a
Done TryAnotherJob -> comp1
Done Finished -> return $ Done Finished

It is possible to compose a piece of local computation with another piece of computation and obtain a new piece of local computation. For that purpose, we prepare
extend function.
extend :: Thread t => (K t a -> IO (JobStatus b)) -> K t a -> K t b
extend trans r = K (t, trans r)

Such transformations of local computation can be changed into transformations ofhypersequents.
131

infixr 4 -*-(-*-) :: (Thread t, HyperSequent l, HyperSequent l’) =>(t -> a -> IO b) -> (l -> IO l’) ->HCons (K t a) l -> IO (HCons (K t b) l’)(-*-) = progress_ . extend . peek . lmaybe
wherelmaybe _ _(Done x) = return (Done x)

lmaybe f th (Having x) =doy <- f th x
return $ Having y

progress_ :: (HyperSequent l, HyperSequent l’) =>(a -> b) -> (l -> IO l’) -> HCons a l ->IO (HCons b l’)progress_ hdf tlf (HCons ax bl) = donewtl <- tlf bl
return $ HCons (hdf ax) newtl

In such transformations, the extending function must receive the result of theprevious function. This is achieved with the help of peek function.
peek :: Thread t => (t -> JobStatus a -> IO b) -> K t a -> IO b
peek f (K (th, content)) = content >>= f th

The most interesting library function comm makes two threads compute something,write it to the shared memory, reads peer’s write if possible and then continue computation. We split a thread’s computation into two parts: one part up to the write andthe other from the read operation. The former part is hidden in the local computation
whereas the latter part is stored in the hypersequent so that the types of the latest
computation are visible to the user of the library. comm stands for communication.
comm combines two hypersequents each containing a communicating component. It
can be used in the form comm hypersequent1 error1 hypersequent2 error2 where
error1 and error2 specifies what to do in case of read failure.
comm :: (Thread s, Thread t, HAppend l l’ l’’) =>IO (HCons (K t (b,a)) l)-> (t -> b -> IO ThreadStatus)-> IO (HCons (K s (d,c)) l’)-> (s -> d -> IO ThreadStatus)132

-> IO (K t (b, c) :*: (K s (d, a) :*: l’’))comm x terror y serror = doHCons (K (taT, tba)) l <- x
HCons (K (scT, sdc)) l’ <- yabox <- newEmptyMVar
cbox <- newEmptyMVar
return $ let
tbc = comm_part tba abox cbox terror taT
sda = comm_part sdc cbox abox serror scT
inHCons (K (taT, tbc))(HCons (K (scT, sda)) (hAppend l l’))wherecomm_part tba wbox rbox err th = domaybeba <- tba
case maybeba ofDone thStatus -> return $ Done thStatus
Having (tb, ta) -> do_ <- tryPutMVar wbox ta-- writing

cval <- tryTakeMVar rbox-- readingcase cval of
Nothing -> doterror_result <- err th tb
return $ Done terror_result
Just cva -> return $ Having (tb, cva)

In the sixth and seventh lines counted from the bottom, both threads perform write
and then read so that at least one direction of communication is successful.

5.5

Capturing Waitfreedom

Since this chapter presents a library for waitfree computation, it is desirable that
only waitfree computation can be implemented using this library (soundness), and all
waitfree computation can be implemented using this library (completeness).
5.5.1

Soundness

In the library code, the worker threads only use non-blocking MVar operations (ablocking operation readMVar is used but by the main thread). This ensures that only133

waitfree computation can be implemented using this library unless the user explicitly
uses other communication primitives from outside of this library.
5.5.2

CompletenessWe show the completeness by solving a problem called the participating set problem
appearing in Borowsky and Gafni [23]. In the participating set problem, threads obtainno input except their own id’s. Each thread i outputs a set Si of thread id’s satisfying
the following conditions:
1. i ∈ Si ,2. Si ⊆ Sj or Sj ⊆ Si for any i, j
3. i ∈ Sj implies Si ⊆ Sj .
We can solve any waitfree protocol by repeating solving a finite number of the participating set problem instances.
Intuitively, this can be achieved by making every thread write its id to the sharedmemory and then read others’ writes from the shared memory. The results are determined by the speed competition among the threads. Thread i’s output Si contains
those threads that has already written by the time i reads. However, we have to decompose this intuitive solution into pieces of two-thread communication in order toimplement the solution using our library.
As an example, we treat the three-thread case. The three threads are named ZeroT,FirstT and SecondT.
First, each thread computes its own id and stores it in a tuple.
hOwnId :: Thread t => IO (K t (t, t) :*: HNil)

Then, ZeroT and FirstT compete. This results in the following hypersequent, whichmeans that either ZeroT obtains FirstT’s id or FirstT obtains ZeroT’s id.
IO (K ZeroT (ZeroT, FirstT) :*: K FirstT (FirstT, ZeroT) :*: HNil)

Before SecondT is put in consideration, we make the first two threads to duplicate their possessions so that they can retain the possessions and communicate thepossessions at the same time.
twoBeforeComm :: IO ( K ZeroT ((ZeroT, FirstT), (ZeroT, FirstT)) :*:K FirstT ((FirstT, ZeroT), (FirstT, ZeroT)) :*:
HNil)

134

After SecondT competes with ZeroT, we obtain the following hypersequent. FirstT’s
possessions are not changed, but ZeroT and SecondT tries to exchange their possessions.
three__ :: IO(K FirstT ((FirstT, ZeroT), (FirstT, ZeroT)) :*:K ZeroT ((ZeroT, FirstT), SecondT) :*:K SecondT (SecondT, (ZeroT, FirstT)) :*: HNil)

Finally, SecondT competes with FirstT. This makes a hypersequent with any component containing all thread’s ids. Since at least one component succeeds, at least one
thread obtains all threads’ ids.
However, the participating set problem requires more. The following output does
not conform to the problem although one thread has obtained all threads’ ids. Either
S0 ⊆ S2 or S2 ⊆ S0 is required but neither is satisfied.
Thread 1: obtained [1,0,2]
Thread 0: obtained [0]Thread 2: obtained [2]In this case threads 0 and 2 have to compete in order to decide which is slower. In
general, either ZeroT–SecondT or FirstT–SecondT competition is required so we doboth and concatenate the three competitions as one derivation. Both of the two-threadcompetitions are similar to the simplest nontrivial waitfree protocol already explained
so we omit the details. The whole program is shown in Figure 5.2.
main :: IO ()main = execute $three ‘follows‘ twoMid ‘follows‘ twoLast

5.6

Comparison with Gödel-Dummett Logic

5.6.1

Similarity

There are many functional programming languages (OCaml, Haskell, Clean etc.) that
employ intuitionistic logic for their type systems. The hypersequent formulation that
we employ is very similar to that of Gödel-Dummett logic, which is among intermediate
logics [137] between intuitionistic and classical logics.
Gödel-Dummett logic [43] was originally introduced as a logic obtained by adding
axioms of the form (φ → ψ) ∨ (ψ → φ) to intuitionistic propositional logic.

135

Avron [8] proposed an alternative formulation of the same logic. Instead of theaxioms (φ → ψ) ∨ (ψ → φ), he included the “communication rule” on hypersequent
derivations:H0Γ0 , ∆0 ⊢ φ0

H1

Γ1 , ∆1 ⊢ φ1

H0H1

Γ0 , ∆1 ⊢ φ0

Γ1 , ∆0 ⊢ φ1

where Γi and ∆i are finite sets of formulae. This communication rule inspired theauthor to model waitfree computation using hypersequents by using a rule
H0

Kta

H1

Ksb

H0

H1

Ktb

Ksa

Avron [8] has proved that a sequent derivable with cut rules is also provable without
cuts (Gentzen’s proof adopted). However, he still wanted to see what the corresponding typed lambda calculus looks like, saying “it seems to us extremely important todetermine the exact computational content of them [intermediate logics]—and to develop corresponding ‘λ-calculi’ ” [8]. Since we are working on a constructive logic, it isnatural to ask what chooses the left or right for a term of the type (φ ⊃ ψ) ∨ (ψ ⊃ φ).
The answer is actually the execution time scheduling among threads.
5.6.2

DiﬀerenceGödel-Dummett logic does not have modalities. Its formulae are the same as intuitionistic or classical logic. The only diﬀerence of Gödel-Dummett logic from intuitionistic
logic is that more formulae are provable in Gödel-Dummett logic than in intuitionistic
logic. So, if we want to encode Gödel-Dummett logic faithfully, we do not have to
introduce modalities such as K t. Even without such modalities, we can regard eachcomponent of a hypersequent as a thread. However, If we abandon modalities andregard components of a hypersequent as threads, the participating set problem cannot
be solved because the communication rule splits the threads into two separate groups
and any prior inter-group communication is prohibited.
This restriction would be OK if we were only interested in making sure that at least
one thread knows every other thread. However, since the participating set problem
does not allow any two threads to be ignorant of each other, the comm rule cannot
provide enough communication power to solve the participating set problem for thecomponents of a hypersequent if we do not have the modalities.

136

5.7

Related Work

5.7.1

Computational Content of Hypersequents

Fermüller [48] developed a so-called parallel dialogue games. It is based on Lorenzen
dialogue . It is basically proof searching from bottom to up with player supposed toknow the answer proof tree and opponent directing for diﬀerent parts of the proof.
Since the game rules are translation of hypersequent calculus, the global game state
has local parts. And the player can, for example, duplicate a local part into two.
This is essentially diﬀerent from the typed lambda calculi computation because thegames give meanings to only normal form proofs while the typed lambda calculi givemeanings to all proofs.
5.7.2

High Level Treatment of Concurrency

Erlang [5] is a programming language designed for concurrency using the Actor modelby Hewitt et al. [73]. Since the Actor model separates the sender of a message fromthe message itself, it provides some asynchrony. However, in the Actor model andin Erlang, a thread can wait for a message. Thus, these do not provide waitfree
communication.
Asynchronous π-calculus by Honda and Tokoro [79] is a fragment of π-calculus. It
is similar to the Actor Model in that it is impossible to do something after sending amessage. However, asynchronous π-calculus allows a process to wait for a channel todeliver a message. Thus, asynchronous π-calculus is not waitfree.
Concurrent ML [123] “provides a high-level model of concurrency.” However, its
basic communication primitives accept and send are blocking operations so that there
is no fragment of the language capturing waitfreedom.
Brown [25] proposed a combinator library for message-passing programming in
Haskell. However, this work is also for synchronous communication with blocking
operations and there is no way of obtaining a waitfree fragment of this library.
Join patterns (first proposed as the join calculus by Fournet and Gonthier [51])allow consuming messages from a group of channels simultaneously. This involves
waiting for a group of channels so that join patterns do not capture waitfreedom
either.
In multi-core and multi-processor environment, synchronous communication istime-consuming. Compared with synchronous communication, waitfreedom can be
implemented in a less time-consuming manner. Since our library interface captures137

waitfreedom, it is possible to build a less time-consuming implementation for this interface although the current implementation relies on MVar cells, which internally use
spin locks.

5.8

Future Work and Conclusions

Ciabattoni, Galatos, and Terui [30] showed a class of logics can be defined using
hypersequent derivation rules. It will be interesting to see what kind of computationis represented by these logics.
The library presented in this chapter deals with both waitfree communication andthread management. It would be better if we dealt with these diﬀerent tasks separately.
We seek to expand the notion of threads into more complicated processes so that we
can treat dynamic forking and merging threads rather than a finite set of threads
specified at compile-time.
Although we were able to implement the participating set problem, the implementation is not short or symmetric. There seems to be room for more elegant abstraction
for symmetric protocols such as a rule containing more than two threads and a more
direct embedding of the participating set problem. The main challenge is encoding then-party participating set problem in the Haskell type system uniformly with respect
to n.
Moreover, in order to obtain performance, we have to change the runtime system
of Haskell. Since the current implementation uses MVar mechanism that involve spinlocks, it must be unnecessarily slow. In theory, waitfree computation can be implemented without locks. In practice also, with sequential consistency, we can implement
waitfree computation without locks.
One possible extension of our library is addition of an “all-possible-results” mode.
When we execute a program under this mode, the library explores all possible executions and returns what can happen.
Notwithstanding, since we have shown that hypersequent based waitfree computation is implementable. This at least supports the statement of Theorem 3.4.3 in
Chapter 3. Also as a side-eﬀect, we obtained a type-checking implementation of a
hyper-lambda calculus.

138

handle :: PortID -> IO Handle
handle p = withSocketsDo $ dos <- listenOn p(h,\_,\_) <- accept s
hSetBuffering h NoBuffering
return hprepareHandle :: Thread t => PortID -> IO (K t Handle :*: HNil)
prepareHandle p = single $ handle p

readLine :: Thread t => t -> Handle -> IO ((Handle, String), String)
readLine th h = do
hPutStr h $ (show $ atid th) ++ " requiring input: "str <- hGetLine hreturn ((h, str), str)
readH :: Thread t => PortID -> IO (K t ((Handle, String), String) :*: HNil)
readH p = prepareHandle p >>= (readLine -*- return)printTaken :: Thread t => t -> ((Handle, String), String) -> IO ()printTaken th ((h, selfs), peers) = do
hPutStrLn h $ (show $ atid th) ++ " got: " ++ show (selfs, peers)
return ()twoPrints :: K ZeroT ((Handle, String), String) :*:K (SucT ZeroT) ((Handle, String), String) :*: HNil-> IO (K ZeroT () :*: K (SucT ZeroT) () :*: HNil)
twoPrints = printTaken -*- printTaken -*- returnrerror :: Thread t => t -> (Handle, a) -> IO ()rerror th (h, _) = hPutStrLn h $ "Thread " ++ (show $ atid th) ++" failed to read peer’s input."

content ::IO (K ZeroT () :*: K (SucT ZeroT) () :*: HNil)

content = comm (readH $ PortNumber 6000) rerror (readH $ PortNumber 6001) rerror>>= twoPrints
main :: IO ()main = execute content

Figure 5.1: An example program. :*: delimits components. Library imports areomitted. This program spawns two threads each waiting for a TCP connection. The
two threads do waitfree communication, so the slowest thread obtains the inputs for
all threads.

139

failOut :: t -> a -> IO ThreadStatus
failOut _ _ = return TryAnotherJob
hOwnId = single $ return (t, t)
putWithName :: Thread t => t -> String -> IO ()putWithName th content = putStrLn $ "Thread " ++ (show $ atid th) ++ ": " ++ content
putResult :: Thread t => t -> String -> IO ThreadStatus
putResult th str = do
putWithName th $ "obtained " ++ str
return Finished
putOneResult :: (Thread t, Thread s) => s -> t -> IO ThreadStatus
putOneResult owner content = putResult owner $ show $ [atid content]
putTwoResults :: (Thread s, Thread t, Thread u) => u -> (s,t) -> IO ThreadStatus
putTwoResults owner (c0, c1) = putResult owner $ show $ [atid c0, atid c1]
two :: (Thread s, Thread t) => IO (K s (s, t) :*: (K t (t, s) :*: HNil))
two = comm hOwnId failOut hOwnId failOut
twoBeforeComm :: IO (K ZeroT ((ZeroT, FirstT), (ZeroT, FirstT)) :*:K FirstT ((FirstT, ZeroT), (FirstT, ZeroT)) :*: HNil)
twoBeforeComm = two >>= (duplicateTwo -*- duplicateTwo -*- return)where duplicateTwo _ x = return (x,x)
printThreeResults0 :: (Thread u, Thread s, Thread t, Thread v) =>u -> (s,(t,v)) -> IO ThreadStatus
printThreeResults0 owner (c0, (c1, c2)) = putResult owner $ show $[atid c0, atid c1, atid c2]
printThreeResults1 owner ((c0, c1), c2) = putResult owner $ show $[atid c0, atid c1, atid c2]
three :: IO (K FirstT ThreadStatus :*: K SecondT ThreadStatus :*:K ZeroT

ThreadStatus :*: K SecondT ThreadStatus :*: HNil)

three = comm (cycling $ comm twoBeforeComm putTwoResults hOwnId failOut)
putTwoResults hOwnId failOut>>= (printThreeResults1 -*- printThreeResults0 -*- printThreeResults1-*- printThreeResults0 -*- return)
twoLast :: IO ((K FirstT ThreadStatus) :*: (K SecondT ThreadStatus) :*: HNil)
twoLast = comm hOwnId putOneResult hOwnId putOneResult >>=(putTwoResults -*- putTwoResults -*- return)
twoMid :: IO ((K ZeroT ThreadStatus) :*: (K SecondT ThreadStatus) :*: HNil)
twoMid = comm hOwnId putOneResult hOwnId failOut >>=(putTwoResults -*- putTwoResults -*- return)main = execute (three ‘follows‘ twoMid ‘follows‘ twoLast)

Figure 5.2: An implementation for participating set problem [23] for three threads.
140

Chapter 6
Conclusions

6.1

Overview

We gave mainly two inventions: hyper-lambda calculi and a new axiomatization of
Abelian logic. Since we are just beginning to understand the computational semantics of some concrete examples of substructural logics, the remaining space is vast.
Reflecting the wide applications of substructural and especially intermediate logics,
our conclusions and variety of future work span from mathematical logic, computerscience and philosophy.

6.2

From Logical Perspectives

6.2.1

Generalization

We have seen two particular hyper-lambda calculi for two logics. Ciabattoni et al. [30]classified axioms according to their syntactic complexities and identified classes ofaxioms that can be translated into structural sequent calculus rules and structural
hypersequent calculus rules. According to their classification, the prelinearity axiom(φ ⊸ ψ) ⊕ (ψ ⊸ φ) and the Amida axiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ) belong to P2 , aclass whose elements can be translated into a finite set of hypersequent structural
rules. Other classes N2 and P3 of axioms can also be translated into finite sets ofhypersequent structural rules, thus, we expect the technique of hyper-lambda calculi
applicable to logics with these axioms on top of FLe.
One particular logic worth trying is the logic characterized by Kripke models withbounded width [29]. Since Gödel-Dummett logic is a special case of the bounding
width 1, the generalization of width k will provide waitfree computation on weaker
shared memory consistency. Further, an ambitious goal is to develop a general frame141

work with which we can develop hyper-lambda calculi for all logics characterized byaxioms in class P3 . Another target is the logic with the weak excluded-middle ¬φ∨¬¬φon top of intuitionistic logic. Since the cut-elimination proof in [30] is algebraic, we are
yet to know the computational meaning of the cut-elimination. Aforementioned framework would clarify the computational meaning of the cut-elimination of hypersequentcalculi.
6.2.2

The Amida Calculus

As we saw in Subsection 2.8.2, the deduction system underlying the Amida calculus
does not enjoy cut-elimination in the strict sense. Moreover, since the Amida calculus
characterizes Abelian logic (Theorem 2.5.1), there are some inhabited types that are
hard to justify constructively; for example a linear version of the excluded middle φ ⊕(φ ⊸ 1). The first step would be removing additives and studying the multiplicativefragment of the Amida calculus.
6.2.3

Gödel-Dummett Logic

In logical point of view, the lambda calculus in Chapter 3 is too complicated for GödelDummett logic. For example, the notion of processes are actually not needed to studyGödel-Dummett logic. However, with the help of these additional constructions, wewere able to identify the computational nature of Gödel-Dummett logic as that of
waitfree computation. In order to exploit our discovery, we have to extend the characterization to the realm of proof searching. That is, designing a logic programming
language using waitfree communication during parallel proof searching.
6.2.4

More General Fuzzy Logics

Since we have identified the computational content of the prelinearity axiom and obtained a lambda calculus for monoidal t-norm logic, we are in a good position to
study fuzzy logics in general. After all, monoidal t-norm logic is the weakest fuzzy
logic. Thus, there is a possibility to obtain a lambda calculus for any fuzzy logic byextending the lambda calculus in Chapter 4. The next target is Lukasiewicz logic.
Lukasiewicz logic is so similar to ordinary logics that there have been attempts toformalize mathematics on it [67, 68, 148]. Metcalfe et al. [103, Theorem 9] showedthat a fragment of Abelian logic coincides with Lukasiewicz logic.

142

6.3

From Computer Science Perspectives

6.3.1

Implementation

In Chapter 5, we implemented a hyper-lambda calculus for waitfree computation on
top of Haskell [98]. The implementation is a prototype for showing that the design of
λ-GD is implementable. Internally, the implementation still uses locks but we should
remove locks if we try to put the library to performance sensitive uses. In order toremove locks, we probably have to modify the runtime system of Haskell. Externally,
the implementation lacks primitive support for more than two party communication.
Although we can implement arbitrary n-party waitfree communication using the current two-party primitive, having a primitive serving more parties is desirable. In orderto provide more than two-party primitives, we have to define a more complicated typeclass, which we expect to be achievable.
6.3.2

Further Implementation

Since Abelian logic is incompatible with contraction or weakening, straightforward
implementation the Amida calculus on top of Haskell or OCaml would not be a good
way to exploit the safety of the Amida calculus. Although Clean [113] oﬀers uniquenesstypes, uniqueness types only reject contraction but accept weakening, so Clean is notsuitable either.
One promising framework on which to implement the Amida calculus is linear
ML1 , whose type system is based on linear logic. Another way is using the type level
programming technique of Haskell. Imai et al. [83] implemented session types on top
of Haskell using the type level programming technique using Session monad. Since
Haskell types can contain arbitrary trees of symbols, they were able to encode session type information in Haskell types. Logically, this corresponds to having atomic
formulae with complicated structure so that we can encode session information in
atomic formulae. The advantage would be usability of existing Haskell infrastructure
including the optimizing compilers, execution environments, and libraries. The disadvantage, which the first author of [83] told me personally, is the compiler’s cryptic
error messages. Since the used Haskell compiler is not aware of session types and justreports pattern-matching errors in the encoding of session types, the error messages
are about the encoding but not about the originally intended session types.
1 Although

there

are

no

publications

available,

https://github.com/pikatchu/LinearML .

143

there

is

an

implementation

at6.3.3

Reasoning about Hyper-Lambda Terms

The Amida edges introduced in Section 2.6 can be applied to other methods thanproof nets. For example, in the game semantics of lambda calculi [86], strategies
are represented by Nakajima trees [112]. Then we can expect the Amida edges on
Nakajima trees to represent a strategy of the game semantics for Abelian logic. Also,
the Amida edges works on paths, it should be compatible to the path-based semantics
by Danos and Regnier [39]. Since the Amida edges define permutation on the ends ofedges in a proof net, and hence can be represented as a matrix, it should be compatible
to Geometry of Interaction [60].
6.3.4

Mixing Synchronous and Asynchronous Communication

Our hyper-lambda calculus in Chapter 2 incorporates synchronous communication andanother hyper-lambda calculus in Chapter 3 incorporates asynchronous communication. In order to unify these two paradigm, the most straightforward way is to nest
hypersequents
t0

(t1

t2 )

t3 .

where t1 and t2 are combined conjunctively but other delimiters are interpreted disjunctively. However, this kind of nesting representation has a limitation because of its
tree structure: it is not clear how we can represent three threads t0 , t1 and t2 where
either e0 and e1 succeed or e0 and e2 succeed. If we take the idea of event structure [147], we could make a deduction system where each inference step results in a
coherence space whose elements are sequents.
6.3.5

Understanding Waitfreedom

Although the definition of waitfreedom is operational (Section 3.3), there is a topological characterization [72, 125] of waitfreely solvable problems using contractibility.
Since we have obtained a logical characterization, studying the direct connection between the logical and topological characterizations would be interesting.

6.4

From Philosophical Perspectives

Mathematical logic first succeeded in formalizing mathematics. After that, there havebeen many attempts to investigate analytic philosophy using formal logics: relevancelogic, modal epistemic logics [69], dynamic epistemic logic [140], inquisitive logic [32],deontic logics [143] and so on. Among those investigations, in some cases, substructural144

logics play important roles. For example, relevance logic is a famous substructural logic
lacking weakening and inquisitive logic is a “weak logic” (a logic possibly without
substitution-closedness) between intuitionistic and classical logics [32].
Gödel-Dummett logic [43] was invented for algebraic reasons, but now we founda constructive justification of Dummett’s axiom (φ ⊃ ψ) ∨ (ψ ⊃ φ) as the result of
speed-racing during proof reduction. Since the semantics presented in Chapter 3 seems
somewhat too complicated, there is room for simplification and better understandingof Gödel-Dummett logic.
Abelian logic can provide a way to express exchanges and indebtedness. The Amidaaxiom (φ ⊸ ψ) ⊗ (ψ ⊸ φ) can describe two agents’ exchange of φ and ψ between
two agents or one agent’s borrowing of φ for ψ and returning φ for ψ. Since analysis
of pattern of exchange is an important subject of anthropology [97], Abelian logic canprovide a basis for describing social and cultural phenomena.
Dynamic epistemic logic [140], or its fragment called public announcement logic, isa modal logic that has a modality for agents’ knowledge and announcements. However,in the current formulation of dynamic epistemic logic, we cannot formalize the eﬀectof repetitions2 of announcements or cancels of announcements. In Abelian logic, we
can multiply any formula with any integer, thus there is a possibility of representing
repetition or cancels of announcements using a modal logic based on Abelian logic.
Also, since Abelian logic is modeled by Abelian groups, it can express the senseof indebtedness or obligation in a quantitative way. Deontic logic [101, 143] tried tocapture permission, obligation and so on. Using Abelian logic, we hope to address how
much duty is imposed. Since the Amida calculus can reduce some proofs in Abelian
logic, it could provide a way to analyze a complicated situation where many kinds ofobligations and permissions of diﬀerent significance are interwound.

2 The point is distinguishing a single announcement from repeated announcements of the samecontent. For that, we do not want contraction.

145

References[1] M. Abadi, L. Cardelli, P. L. Curien, and J. J. Levy. Explicit substitutions. In
POPL ’90, pages 31–46, New York, 1990. ACM.
[2] T. Abe. Completeness of modal proofs in first-order predicate logic. Computer
Software, 24(4):165–177, 2007.
[3] S. Abramsky. Computational interpretations of linear logic. Theo. Comp. Sci.,
111(1-2):3–57, 1993.
[4] A. Ahmed. Step-indexed syntactic logical relations for recursive and quantified
types. In P. Sestoft, editor, Programming Languages and Systems, volume 3924
of Lecture Notes in Computer Science, pages 69–83. Springer, 2006.
[5] J. Armstrong. Programming Erlang: Software for Concurrent World. The Pragmatic Bookshelf, 2007.
[6] K. Asai and Y. Kameyama. Polymorphic delimited continuations. In APLAS ’07,
volume 4807 of Lecture Notes in Computer Science, pages 239–254. Springer,
2007.
[7] A. Asperti. and L. Roversi. Intuitionistic light aﬃne logic. ACM Trans. Comput.
Logic, 3(1):137–175, 1 2002.
[8] A. Avron. Hypersequents, logical consequence and intermediate logics for concurrency. Ann. Math. Artif. Intell., 4:225–248, 1991.
[9] A. Avron. The method of hypersequents in the proof theory of propositional
non-classical logics, pages 1–32. Clarendon Press, 1996.
[10] A. Avron. A tableau system for Gödel–Dummett logic based on a hypersequentcalculus. In TABLEAUX ’00, volume 1847 of Lecture Notes in Computer Science,
pages 98–111. Springer, 2000.

146

[11] M. Baaz, A. Ciabattoni, and C. G. Fermüller. A natural deduction system for
intuitionistic fuzzy logic. Lectures on soft computing, 2001.
[12] M. Baaz, A. Ciabattoni, and C. G. Fermüller. Hypersequent calculi for Gödellogics a survey. Journal of Logic and Computation, 13(6):835–861, 2003.
[13] M. Baaz, A. Ciabattoni, and F. Montagna. Analytic calculi for monoidal t-norm
based logic. Fundamenta Informaticae, 59(4):315–332, 2004.
[14] D. Baelde. Least and greatest fixed points in linear logic. ACM Trans. Comput.
Logic, 13(1):2:1–2:44, 1 2012.
[15] V. Balat, R. Di Cosmo, and M. Fiore. Extensional normalisation and typedirected partial evaluation for typed lambda calculus with sums. SIGPLAN
Not., 39(1):64–76, 1 2004.
[16] K. E. Batcher. Sorting networks and their applications. In Proceedings of theApril 30–May 2, 1968, spring joint computer conference, AFIPS ’68 (Spring),
pages 307–314, New York, 1968. ACM.
[17] A. Bejleri and N. Yoshida. Synchronous multiparty session types. Electronic
Notes in Theoretical Computer Science, 241(0):3–33, 2009.
[18] G. M. Bierman. A computational interpretation of the λµ-calculus. In L. Brim,
J. Gruska, and J. Zlatuka, editors, Mathematical Foundations of Computer Science 1998, volume 1450 of Lecture Notes in Computer Science, pages 336–345.
Springer, 1998.
[19] O. Biran, S. Moran, and S. Zaks. A combinatorial characterization of the distributed tasks which are solvable in the presence of one faulty processor. In
PODC ’88, pages 263–275. ACM, 1988.
[20] L. Birkedal, K. Støvring, and J. Thamsborg. Relational parametricity for references and recursive types. In Proceedings of the 4th international workshop on
Types in language design and implementation, pages 91–104. ACM, 2009.
[21] P. Blackburn. Representation, reasoning, and relational structures: a hybrid
logic manifesto. Logic Journal of IGPL, 8(3):339–365, 2000.
[22] E. Borowsky and E. Gafni. Immediate atomic snapshots and fast renaming. In
PODC ’93, pages 41–51. ACM, 1993.

147

[23] E. Borowsky and E. Gafni. Immediate atomic snapshots and fast renaming.
In Proceedings of the 12th annual ACM symposium on principles of distributed
computing, PODC ’93, pages 41–51. ACM, 1993.
[24] A. Bove, P. Dybjer, and U. Norell. A brief overview of Agda–a functional language with dependent types. In S. Berghofer, T. Nipkow, C. Urban, and M. Wenzel, editors, Theorem Proving in Higher Order Logics, volume 5674 of Lecture
Notes in Computer Science, pages 73–78. Springer, 2009.
[25] N. Brown.

Combinators for message-passing in Haskell.

In R. Rocha andJ. Launchbury, editors, Lecture Notes in Computer Science, pages 19–33.
Springer, 2011.
[26] L. Caires and F. Pfenning. Session types as intuitionistic linear propositions. In
P. Gastin and F. Laroussinie, editors, CONCUR 2010, volume 6269 of Lecture
Notes in Computer Science, pages 222–236. Springer, 2010.
[27] E. Casari. Comparative logics and Abelian l-groups. In R. Ferro, C. Bonotto,
S. Valentini, and A. Zanardo, editors, Logic Colloquium ’88, volume 127 of Studies in logic and the foundations of mathematics, pages 161–190. North-Holland,
1989.
[28] K. Chvalovský. On the independence of axioms in BL and MTL. Fuzzy Sets andSystems, 197(0):123–129, 2012.
[29] A. Ciabattoni. Hypersequent calculi for some intermediate logics with bounded
Kripke models. Journal of Logic and Computation, 11(2):283–294, 2001.
[30] A. Ciabattoni, N. Galatos, and K. Terui. From axioms to analytic rules in
nonclassical logics. In LICS’08., pages 229–240. IEEE, 2008.
[31] Agata Ciabattoni, Lutz Straßburger, and Kazushige Terui. Expanding the realmof systematic proof theory. In Erich Grädel and Reinhard Kahle, editors, CSL,
volume 5771 of Lecture Notes in Computer Science, pages 163–178. Springer,
2009. ISBN 978-3-642-04026-9.
[32] I. Ciardelli and F. Roelofsen. Inquisitive logic. Journal of Philosophical Logic,
40(1):55–94, 2 2011.
[33] P. Cintula, P. Hájek, and R. Horčı́k. Formal systems of fuzzy logic and theirfragments. Annals of Pure and Applied Logic, 150(1―3):40–65, 2007.
148

[34] P. Cintula, P. Hájek, and C. Noguera, editors. Handbook of Mathematical Fuzzy
Logic. Studies in Logic. College Publications, 2011.
[35] P.-L. Curien and H. Herbelin. The duality of computation. SIGPLAN Not., 35(9):233–243, 9 2000.
[36] H. B. Curry. The combinatory foundations of mathematical logic. The Journalof Symbolic Logic, 7(2):49–64, 1942.
[37] H. B. Curry and R. Feys. Combinatory logic, volume 1. North-Holland, third
printing edition, 1974.
[38] V. Danos and J.-L. Krivine. Disjunctive tautologies as synchronisation schemes.
In P. Clote and H. Schwichtenberg, editors, Computer Science Logic, volume1862 of Lecture Notes in Computer Science, pages 292–301. Springer, 2000.
[39] V. Danos and L. Regnier. The structure of multiplicatives. Archive for Mathematical Logic, 28(3):181–203, 10 1989.
[40] O. Danvy and A. Filinski. Abstracting control. In Proceedings of the 1990 ACM
conference on LISP and functional programming, LFP ’90, pages 151–160. ACM,
1990.
[41] P. de Groote. On the strong normalisation of intuitionistic natural deduction
with permutation-conversions. Information and Computation, 178(2):441–464,
2002.
[42] C. Doczkal and J. Schwinghammer. Formalizing a strong normalization proof for
Moggi’s computational metalanguage: a case study in Isabelle/HOL-nominal. In
Proceedings of the Fourth International Workshop on Logical Frameworks andMeta-Languages: Theory and Practice, LFMTP ’09, pages 57–63, New York,2009. ACM.
[43] M. Dummett. A propositional calculus with denumerable matrix. The Journalof Symbolic Logic, 24(2):97–106, 1959.
[44] D. Edgington. Conditionals. In Edward N. Z., editor, The Stanford Encyclopediaof Philosophy. Winter 2008 edition, 2008.
[45] J. Esparza, S. Kiefer, and S. Schwoon. Abstraction refinement with Craig interpolation and symbolic pushdown systems. In H. Hermanns and J. Palsberg,
editors, Tools and Algorithms for the Construction and Analysis of Systems,
149

volume 3920 of Lecture Notes in Computer Science, pages 489–503. Springer,
2006.
[46] F. Esteva and L. Godo. Monoidal t-norm based logic: towards a logic for leftcontinuous t-norms. Fuzzy Sets and Systems, 124(3):271–288, 2001.
[47] S. Feferman, J. Dawson Jr, Kleene S., G. Moore, R. Solovay, and J. van Heijenoort, editors. Kurt Gödel Collected Works, volume I. Oxford University Press,
1986.
[48] C. Fermüller. Parallel dialogue games and hypersequents for intermediate logics.
In Automated Reasoning with Analytic Tableaux and Related Methods, volume2796 of Lecture Notes in Computer Science, pages 48–64. Springer, 2003.
[49] A. Filinski. Declarative continuations: An investigation of duality in programming language semantics. In D. Pitt, D. Rydeheard, P. Dybjer, A. Pitts, and
A. Poigné, editors, Category Theory and Computer Science, volume 389 of Lecture Notes in Computer Science, pages 224–249. Springer, 1989.
[50] G. Fiorino. Fast decision procedure for propositional Dummett logic based ona multiple premise tableau calculus. Information Sciences, 180(19):3633–3646,
2010.
[51] C. Fournet and G. Gonthier. The reflexive CHAM and the join-calculus. In
POPL ’96, pages 372–385. ACM, 1996.
[52] C. Fournet, L. Maranget, C. Laneve, and D. Rémy. Implicit typing à la ML forthe join-calculus. In CONCUR ’97, volume 1243 of Lecture Notes in Computer
Science, pages 196–212. Springer, 1997.
[53] C. Fournet, F. L. Fessant, L. Maranget, and A. Schmitt. JoCaml: A language
for concurrent distributed and mobile programming. Advanced Functional Programming, pages 1948–1948, 2002.
[54] G. Frege. Begriﬀsschrift. In J. van Heijenoort, editor, From Frege to Gödel: asource book in mathematical logic, 1879-1931, pages 1–82. Harvard University
Press, 1967. Originally “Begriﬀsschrift: eine der arithmetischen nachgebildete
Formelsprache des reinen Denkens,” Halle, 1879.
[55] D. M. Gabbay and R. J. G. B. de Queiroz. Extending the curry-howard interpretation to linear, relevant and other resource logics. The Journal of Symbolic
Logic, 57(4):1319–1365, 1992.
150

[56] E. Gafni and E. Koutsoupias. Three-processor tasks are undecidable. SIAM
Journal on Computing, 28(3):970–983, 1999.
[57] N. Galatos, P. Jipsen, T. Kowalski, and H. Ono. Residuated Lattices: An Algebraic Glimpse at Substructural Logics, volume 151 of Studies in Logic and The
Foundations of Mathematics. Elsevier, 1st edition, 2007.
[58] G. Gentzen. Investigations into logical deduction. American Philosophical Quarterly, 1(4):288–306, 1964.
[59] J.-Y. Girard. Linear logic. Theoretical Computer Science, 50(1):1–101, 1987.
[60] J.-Y. Girard. Geometry of Interaction 1: Interpretation of System F, volume
127 of Studies in Logic and the Foundations of Mathematics, pages 221–260.
Elsevier, 1989.
[61] J.-Y. Girard, P. Taylor, and Y. Lafont. Proofs and Types. Cambridge University
Press, 1989.
[62] M. Giunti and V. T. Vasconcelos. A linear account of session types in the pi
calculus. In CONCUR 2010, Lecture Notes in Computer Science, pages 432–446.
Springer, 2010.
[63] M. V. Glivenko. Sur la logique de M. Brouwer. Bulletin de la Classe des science,
Académie Royale de Belgique, 5(14):225–228, 1928.
[64] M. V. Glivenko. Sur quelques points de la logique de M. Brouwer. Bulletin dela Classe des science, Académie Royale de Belgique, 5(15):185–188, 1929.
[65] K. Gödel. On the intuitionistic propositional calculus. In S. Feferman, J. Dawson Jr., Kleene S., G. Moore, R. Solovay, and J. van Heijenoort, editors, Kurt
Gödel Collected Works, volume I, pages 222–225. Oxford University Press, 1986.
(Translation of “Zum intuitionistischen Aussagenkalkül,” Anzeiger der Akademie
der Wissenschaften in Wien, 69: pages 65-66. 1932).
[66] T. G. Griﬃn. A formulae-as-type notion of control. In POPL ’90, POPL ’90,
pages 47–58, New York, 1990. ACM.
[67] P. Hájek. On arithmetic in the Cantor-Lukasiewicz fuzzy set theory. Archive forMathematical Logic, 44(6):763–782, 2005.
[68] P. Hájek, Jeﬀ Paris, and John Shepherdson. The liar paradox and fuzzy logic.
The Journal of Symbolic Logic, 65(1):339–346, 2000.
151

[69] V. Hendricks and J. Symons. Epistemic logic. In Edward N. Z., editor, The
Stanford Encyclopedia of Philosophy. Spring 2009 edition, 2009.
[70] M. Herlihy. Impossibility and universality results for wait-free synchronization.
In PODC ’88, pages 276–290. ACM, 1988.
[71] M. Herlihy. Wait-free synchronization. ACM Transactions on Programming
Languages and Systems (TOPLAS), 13(1):124–149, 1991.
[72] M. Herlihy and N. Shavit. The topological structure of asynchronous computability. Journal of the ACM, 46:858–923, 1999.
[73] C. Hewitt, P. Bishop, and R. Steiger. A universal modular ACTOR formalism
for artificial intelligence. In Proceedings of the 3rd international joint conferenceon Artificial intelligence, pages 235–245. Morgan Kaufmann, 1973.
[74] A. Heyting. The formal rules of intuitionistic logic. In Paolo M., editor, From
Brouwer to Hilbert: The Debate on the Foundations of Mathematics in the 1920s,
pages 311–327. Oxford University Press, 1998. Originally “Die formalen Regeln
der intuitionistischen Logik,” Sitzungberichte der Preussischen Akademie derWissenschaften, 1930, pages 42–56.
[75] Y. Hirai. An intuitionistic epistemic logic for sequential consistency on sharedmemory. In LPAR-16, volume 6355 of Lecture Notes in Computer Science, pages
272–289. Springer, 2010.
[76] Y. Hirai. An intuitionistic epistemic logic for asynchronous communication.
Master’s thesis, Department of Computer Science, The University of Tokyo,
2010.
[77] Y. Hirai. A lambda calculus for Gödel-Dummett logic capturing waitfreedom.
In T. Schrijvers and P. Thiemann, editors, Functional and Logic Programming,volume 7294 of Lecture Notes in Computer Science, pages 151–165. Springer,
2012.
[78] K. Honda. Types for dyadic interaction. In CONCUR ’93, volume 715 of Lecture
Notes in Computer Science, pages 509–523. Springer.
[79] K. Honda and M. Tokoro. An object calculus for asynchronous communication.
In P. America, editor, ECOOP’91 European Conference on Object-Oriented Programming, volume 512 of Lecture Notes in Computer Science, pages 133–147.
Springer, 1991.
152

[80] K. Honda and M. Tokoro. An object calculus for asynchronous communication.
In ECOOP ’91, volume 512 of Lecture Notes in Computer Science, pages 133–
147. Springer, 1991.
[81] K. Honda, N. Yoshida, and M. Carbone. Multiparty asynchronous session types.
In POPL ’08, POPL ’08, pages 273–284, New York, 2008. ACM.
[82] T. Hosoi and H. Ono. Intermediate propositional logics (a survey). Journal of
Tsuda College, 5:67–82, 1973.
[83] K. Imai, S. Yuen, and K. Agusa. Session type inference in Haskell. In Kohei H.
and Alan M., editors, PLACES, volume 69 of EPTCS, pages 74–91, 2010.
[84] M. P. Jones. Type classes with functional dependencies. In G. Smolka, editor, ESOP, volume 1782 of Lecture Notes in Computer Science, pages 230–244.
Springer, 2000.
[85] Y. Kakutani. Duality between call-by-name recursion and call-by-value iteration.
In J. Bradfield, editor, Computer Science Logic, volume 2471 of Lecture Notes
in Computer Science, pages 277–308. Springer, 2002.
[86] A. D. Ker, H. Nickau, and C. H. L. Ong. Innocent game models of untyped
l-calculus. Theoretical Computer Science, 272(1―2):247–292, 2002.
[87] D. Kimura. Computation in Classical Logic and Dual Calculus. PhD thesis, The
Graduate University of Advanced Studies, March 2007.
[88] O. Kiselyov, R. Lämmel, and K. Schupke. Strongly typed heterogeneous collections. Haskell ’04, pages 96–107, New York, 2004. ACM.
[89] N. Kobayashi and A. Yonezawa. Higher-order concurrent linear logic programming. In Theory and Practice of Parallel Programming, volume 907 of Lecture
Notes in Computer Science, pages 137–166. Springer, 1995.
[90] N. Kobayashi, B. C. Pierce, and D. N. Turner. Linearity and the pi-calculus.
ACM Trans. Program. Lang. Syst., 21(5):914–947, 9 1999.
[91] A. Kolmogorov. On the interpretation of intuitionistic logic. In P. Mancosu,
editor, From Brouwer to Hilbert: The Debate on the Foundations of Mathematics in the 1920s, pages 328–334. Oxford University Press, 1998. Originally,“Zur Deutung der intuitionistischen Logik,” Mathematische Zeitschrift 35, 1932,
pages 58–65.
153

[92] F. Lamarche. Proof nets for intuitionistic linear logic: essential nets. Technicalreport, Loria & INRIA-Lorraine, 2008.
[93] L. Lamport. How to make a multiprocessor computer that correctly executes
multiprocess progranm.

IEEE transactions on computers, 100(28):690–691,

1979.
[94] P. J. Landin.

Correspondence between ALGOL 60 and Church’s lambda-

notation: part I. Commun. ACM, 8(2):89–101, 2 1965.
[95] S. Lindley and I. Stark. Reducibility and TT-lifting for computation types. In
P. Urzyczyn, editor, Typed Lambda Calculi and Applications, volume 3461 of
Lecture Notes in Computer Science, pages 262–277. Springer, 2005.
[96] L. L. Maksimova. Craig’s theorem in superintuitionistic logics and amalgamablevarieties of pseudo-boolean algebras. Algebra and Logic, 16(6):427–455, 1977.
[97] B. Malinowski. Kula; the circulating exchange of valuables in the archipelagoesof eastern New Guinea. Man, 20:97–105, 1920.
[98] S. Marlow et al.

Haskell 2010 language report.

Available online

http://www.haskell.org/onlinereport/haskell2010, 2010.
[99] S. Martini and A. Masini. A computational interpretation of modal proofs. In
H. Wansing, editor, Proof Theory of Modal Logic, pages 213–241. Kluwer, 1996.
[100] K. L. McMillan. Interpolation and SAT-based model checking. In Jr. Hunt,
W. A. and F. Somenzi, editors, Computer Aided Verification, volume 2725 ofLecture Notes in Computer Science, pages 1–13. Springer, 2003.
[101] P. McNamara. Deontic logic. In E. N. Zalta, editor, The Stanford Encyclopediaof Philosophy. Fall 2010 edition, 2010.
[102] G. Metcalfe. Proof theory for Casari’s comparative logics. Journal of Logic andComputation, 16(4):405–422, 2006.
[103] G. Metcalfe, N. Olivetti, and D. Gabbay. Analytic sequent calculi for Abelian andLukasiewicz logics. In U. Egly and C. Fermüller, editors, Automated Reasoning
with Analytic Tableaux and Related Methods, volume 2381 of Lecture Notes in
Computer Science, pages 191–205. Springer, 2002.

154

[104] R. K. Meyer and J. K. Slaney. Abelian logic (from A to Z). In G. Priest,
R. Richard, and J. Norman, editors, Paraconsistent Logic: Essays on the Inconsistent, chapter IX, pages 245–288. Philosophia Verlag, 1989.
[105] Microsoft.

The F# 3.0 language specification.

Available online

http://fsharp.org/about/files/spec.pdf, 2012.
[106] R. Milner. A theory of type polymorphism in programming. Journal of Computerand System Sciences, 17(3):348–375, 1978.
[107] R. Milner. Communicating and mobile systems: the pi-calculus. Cambridge
University Press, 1999.
[108] R. Milner, M. Tofte, R. Harper, and D. MacQueen. The definition of Standard
ML. MIT press, 1997.
[109] Y. Minsky. OCaml for the masses. Commun. ACM, 54(11):53–58, 11 2011.
[110] S. Moran. Extended impossibility results for asynchronous complete networks.
Information Processing Letters, 26(3):145–151, 1987.
[111] A. S. Murawski and C. H. L. Ong. Exhausting strategies, joker games and fullcompleteness for IMLL with unit. Theoretical Computer Science, 294(1―2):
269–305, 2003.
[112] R. Nakajima. Infinite normal forms for the λ-calculus. In C. Böhm, editor, λCalculus and Computer Science Theory, volume 37 of Lecture Notes in Computer
Science, pages 62–82. Springer, 1975.
[113] E. G. J. M. H. Nöcker, J. E. W. Smetsers, M. C. J. D. van Eekelen, and M. J.
Plasmeijer. Concurrent Clean. In PARLE ’91, volume 506 of Lecture Notes in
Computer Science, pages 202–219. Springer.
[114] A. Ohori and K. Ueno. Making standard ML a practical database programming
language. SIGPLAN Not., 46(9):307–319, 9 2011.
[115] C. H. L. Ong and C. A. Stewart. A curry-howard foundation for functional
computation with control. In POPL ’97, POPL ’97, pages 215–227, New York,1997. ACM.
[116] H. Ono and Y. Komori. Logics without the contraction rule. The Journal of
Symbolic Logic, 50(1):169–201, 1985.

155

[117] M. Parigot. λµ-Calculus: An algorithmic interpretation of classical natural deduction. In Lecture Notes in Computer Science, pages 190–201. Springer, 1992.
[118] M. Parigot. On the computational interpretation of negation. In P. G. Cloteand H. Schwichtenberg, editors, Computer Science Logic, volume 1862 of Lecture
Notes in Computer Science, pages 472–484. Springer, 2000.
[119] D. Prawitz. Natural Deduction: A Proof-Theoretical Study. Almqvist & Wiksell,
1965.
[120] A. N. Prior. The runabout inference-ticket. Analysis, 21(2):38–39, Dec 1960.
[121] T. Raths, J. Otten, and C. Kreitz. The ILTP problem library for intuitionistic
logic. Journal of Automated Reasoning, 38(1):261–271, 2007.
[122] J. Rees and W. Clinger. Revised report on the algorithmic language Scheme.
SIGPLAN Not., 21(12):37–79, 12 1986.
[123] J. Reppy. Concurrent ML: Design, application and semantics. In P. Lauer,
editor, Lecture Notes in Computer Science, pages 165–198. Springer, 1993.
[124] J. C. Reynolds. Types, abstraction and parametric polymorphism. Information
Processing, pages 513–523, 1983.
[125] M. Saks and F. Zaharoglou. Wait-free k-set agreement is impossible: the topology of public knowledge. In STOC ’93, pages 101–110. ACM, 1993.
[126] M. Saks and F. Zaharoglou. Wait-free k-set agreement is impossible: the topology of public knowledge. SIAM journal on computing, 29(5):1449–1483, 2000.
[127] P. Selinger. Control categories and duality: on the categorical semantics ofthe lambda-mu calculus. Mathematical Structures in Computer Science, 11(02):207–260, 4 2001.
[128] M. Shirahata. A sequent calculus for compact closed categories.
[129] O. Sonobe. A Gentzen-type formulation of some intermediate propositional logics. Journal of Tsuda College, 14:7–14, 1975.
[130] M. H. Sørensen and P. Urzyczyn. Lectures on the Curry–Howard isomorphism.
Elsevier, 2007.

156

[131] K. Takeuchi, K. Honda, and M. Kubo. An interaction-based language and its
typing system. PARLE’94 Parallel Architectures and Languages Europe, pages
398–413.
[132] K. Terui. Light aﬃne lambda calculus and polynomial time strong normalization.
Archive for Mathematical Logic, 46(3):253–280, 2007.
[133] I. Thomas. Finite limitations on Dummet’s LC. Notre Dame Journal of Formal
Logic, 3(3):170–174, 1962.
[134] T. Toﬀoli. Reversible computing. In J. Bakker and J. Leeuwen, editors, Automata, Languages and Programming, volume 85 of Lecture Notes in Computer
Science, pages 632–644. Springer, 1980.
[135] A. S. Troelstra. Lectures on Linear Logic. CSLI, 1992.
[136] A. S. Troelstra and D. van Dalen. Constructivism in Mathematics: An Introduction: Vol. 1. North-Holland, 1988.
[137] T. Umezawa. On logics intermediate between intuitionistic and classical predicate logic. The Journal of Symbolic Logic, 24(2):141–153, 1959.
[138] H. Unno and N. Kobayashi. Dependent type inference with interpolants. In
PPDP ’09, pages 277–288, New York, 2009. ACM.
[139] A. Urquhart. Semantics for relevant logics. The Journal of Symbolic Logic, 37(1):159–169, 1972.
[140] H. van Ditmarsch, W. van der Hoek, and B. P. Kooi. Dynamic epistemic logic.
Springer, 2007.
[141] W. P. van Stigt. Brouwer’s intuitionist programme. In Paolo M., editor, From
Brouwer to Hilbert, pages 1–22. Oxford University Press, 1998.
[142] Tom-Murphy VII, K. Crary, and R. Harper. Distributed control flow with classical modal logic. In CSL’05, volume 3634 of Lecture Notes in Computer Science,
pages 51–69. Springer, 2005.
[143] G. H. Von Wright. Deontic logic. Mind, 60(237):1–15, 1951.
[144] P. Wadler. Call-by-value is dual to call-by-name. SIGPLAN Not., 38(9):189–201,
8 2003.

157

[145] P. Wadler. Call-by-value is dual to call-by-name—reloaded. In J. Giesl, editor, Term Rewriting and Applications 2005, volume 3467 of Lecture Notes in
Computer Science, pages 185–203. Springer, 2005.
[146] P. Wadler. Propositions as sessions. In Proceedings of the 17th ACM SIGPLAN
international conference on functional programming, ICFP ’12, pages 273–286,
New York, 2012. ACM.
[147] G. Winskel. Events in Computation. PhD thesis, University of Edinburgh, 1980.
[148] S. Yatabe. Comprehension contradicts to the induction within Lukasiewicz predicate logic. Archive for Mathematical Logic, 48(3-4):265–268, 5 2009.

158

Indexadditive, 20

component, 28, 63, 67

admissible, 20

conclusion, 12

Amida axiom, see axiom

concurrent construction, 72

Amida calculus, 28

configuration, 67

Amida edge, 51

congruence, 71

Amida lotteries, 22

consistent, 18

Amida net

construction

correct, 51

concurrent, 72

Amida nets, 50

context, 27, 64, 103

assumption, 12

contexted type, 80

axiom

contraction, 20

Amida, 25

convergence, 34Dummett’s, 9, 16

correct Amida net, 51

prelinearity, 23

correct essential net, 49
Curry, 14

BHK, see Brouwer-Heyting-Kolmogorov

Curry-Howard isomorphism, 14

interpretation
block, 82

dashed child, 48

Brouwer, 7

decision value, 83

Brouwer-Heyting-Kolmogorov interpre-

derivable, 67, 103

tation, 11

derivation
MTL2, 103

calculus

determinacy, 35

Amida, 28

disjunction property, 10

canonical form, 32

down-edge, 48

channel, 26Dummett’s axiom, see axiom

channel-disjoint, 33
communciation rule, 17

edge

communication rule, 17

Amida, 51

compatible with, 85

elimination rule, 12159

empty store, see store

iﬀ, 5endhypersequent, 67

IMLL, see logic, intuitionistic multiplica-

environment, 106

tive linear

essential net, 47, 48

implication

correct, 49

intuitionistic, 11

evaluation hypersequent, 32

material, 6

executable

inhabited, 28

a-executable, 102

introduction rule, 12s-executable, 105

intuitionism, 7

execution, 83

intuitionistic multiplicative linear logic,

expression, 80

see logic
intuitionistic propositional logic, see logic

fair, 82

invertible, 21

faulty, 82

investigator, 88

final system snapshot, 83
LF, 27

formula, 26
S, 102linear logic, see logic

correct, 7

local formula, see formulaglobal, 64

local type, see type

local, 64

location, 64

polarized MLL, 47

logic, 5, 18
BCK, 20

singleton global, 64Gödel-Dummett, 16

fragment

intermediate, 10

implicational, 14

intuitionistic multiplicative linear,

free variable, 26

47Frege, 6

intuitionistic propositional, 7Gentzen, 11

linear, 20

global formula, see formulamonoidal t-norm, 100

singleton, 64

substructural, 20

global type, see typesuperintuitionistic, 16

Heyting, 7logical rule, 17

hypersequent, 2, 17, 27, 64, 67, 103

modality, 64

conjunctive, 28

modus ponens, 18

evaluation, 32

MTL, see logic, monoidal t-norm

hyperterm, 67

multiplicative, 20
160

natural deduction, 12

singleton global formula, 64

net

snapshotcorrect Amida, 51

final system, 83

essential, 47

solvablenon-faulty, 82— by a global term, 86

normal, 74

solve
typed protocol — typed input-output

output, 83

problem, 85
stackparticipating set problem, 95
pattern, 26

a-stack, 101

permissible, 85s-stack, 105store, 67, 101

polarized MLL formula, see formulapole, 106— prophecy, 77

prelinearity, 23

empty, 101

process, 64

structural rule, 17

process snapshot, 81

subformula property, 12

program, 80, 106

substitution, 18
system snapshot, 81

well formed, 80

final, 83

program variable, 80
program variable content, 81

tautology, 100

propositional variable, 26, see variable

term, 26

pure fragment, 77

a-term, 101

pure term, see term

closed global, 67

redex, 74

closed local, 65

rule

global, 65
communication, 17

local, 65

logical, 17

pure, 67

structural, 17s-term, 105theorem, 18

run, 83

type, 103
schedule, 82, 105

global, 64

sequent, 64, 103

local, 64

sequent calculus, 12session, 36

session realizer, 40

typed configuration, 67

session type, see typetyped input-output problem, 79

161

typed program, 80
typed protocol, 80
up-edge, 48
update, 67
value
decision, 83
variable, 64
free, 26
program, 80
propositional, 26, 64
vectordecision, 83
waitfree, 85
waitfreedom, 78
waitfreely solvable, 85
weakening, 20
well formed program, 80

162