Paul-André Alois

Pierre, Kévin Rémi Valentin

Keywords: Théorie des Types, Forcing, Equivalence Contextuelle, Relation Logique, Sémantique des Jeux, Logique Temporelle Type Theory, Forcing, Contextual Equivalence, Kripke Logical Relation, Game Semantics, Temporal Logic

Cette thèse doit énormément à l'encadrement remarquable de Nicolas et à sa disponibilité constante. Sa capacité à comprendre en quelques instants des idées sur lesquelles j'ai pu passer des journées, permettant très souvent de me débloquer, continue de m'impressionner. Je pense que je me souviendrai longtemps de nos heures passées derrière un tableau (parfois avec un peu de Jazz comme accompagnement :) à démêler l'écheveau des faisceaux ou le dépliage de la biorthogonalité. Qu'il en soit ici grandement remercié ! Les cours d'Alexandre m'ont conduit à aimer la logique, sa manière toujours claire de présenter des notions ô combien profondes, de nous en faire comprendre la substantifique moelle, est un modèle pour moi. C'est donc un honneur qu'il ait accepté de diriger cette thèse.

Je remercie considérablement Lars Birkedal et Martin Hofmann d'avoir accepté de rapporter cette thèse dans un délai aussi court, Merci à eux pour leurs précieux commentaires sur ce manuscrit. Merci également à Lars pour son accueil chaleureux lors de mes séjours à Copenhague.

Merci beaucoup à Nick Benton pour le séjour très enrichissant que j'ai pu effectuer à Cambridge sous sa direction, et pour sa présence dans ce jury.

Résumé

Alors que les programmes informatiques jouent un rôle de plus en plus important au sein de systèmes critiques, dans les avions ou les équipements médicaux, le besoin de méthodes formelles pour s'assurer de leur correction devient inévitable. Parmi ces méthodes formelles, les preuves mathématiques de correction de programmes donnent le plus haut degrés de confiance que l'on peut espérer. Mais de telles preuves peuvent être excessivement complexe, s'assurer qu'elles sont correctes requière donc une vérification automatique. C'est le but des assistants de preuves, qui sont eux-mêmes des programmes informatiques conçus pour vérifier si une preuve d'un théorème est correcte. Par ailleurs, pour résonner sur des programmes, il est nécessaire de leur donner un sens précis, ce qui peut être fait en définissant une sémantique pour le langage de programmation dans lequel ils sont écrit. Dans cette thèse, à la fois le langage de l'assistant de preuve et le langage de programmation proviennent de la même notion centrale: le λ-calcul.

Fonctions et Types

Le λ-calcul a été introduit par A. Church en tant que modèle de calcul dans lequel "tout est fonction", où par fonction on entend un objet syntaxique pour lequel la liaison de variable est gérée explicitement. L'application d'une fonction à un argument est ensuite mise en oeuvre par la substitution de variables. De telles fonctions, appelées λ-abstractions, peuvent être annotées par des types pour s'abstraire de leur calcul. Plus précisément, on donne à une fonction un type A → B pour exprimer qu'elle prends en argument un élément de type A et retourne un élément de type B. C'est ainsi qu'est défini le λ-calcul simplement typé. Ce langage joue un rôle crucial à la fois dans le domaine de la théorie 10 CHAPTER 1. R ÉSUM É de la démonstration et des langage des programmation. En effet, dans la théorie de la démonstration, ce langage est utilisé pour représenter preuves et formules via la fameuse correspondance de Curry-Howard. L'idée de base est qu'un terme de type A → B représente une preuve de l'implication A ⇒ B. Ainsi, vérifier la correction d'une preuve revient à vérifier le type du terme correspondant. Suivant cette idée, les travaux de P. Martin-Löf sont d'une importance capitale, en étendant cette correspondance au calcul des prédicats. Ainsi, on représente une formule quantifiée universellement ∀x ∈ A.P (x) par un type dépendant Πx : A.P . Pour définir de tels types dépendants, on doit autoriser les termes à apparaître dans les types. Par exemple, on peut définir le type M m,n des matrices rectangulaires de taille m * n, de telle manière que la multiplication de matrices sera de type M m,l → M l,n → M m,n . Ici, on utiles les entiers l, m, n (qui sont des termes) pour affiner le type des matrices, leur donnant un un pouvoir de spécification plus précis.

Ce système, appelé la théorie des types de Martin-Löf, est à la base d'assistants de preuve comme Coq ou Agda. Ces systèmes satisfont le fameux critère de De Bruijn, c'est à dire qu'elles génère un témoin de preuve, à savoir un λ-terme, qui peut être ensuite vérifier indépendamment, sans avoir à se fier aveuglément à l'assistant de preuves.

Le λ-calcul est également à l'origine des langages fonctionnels. Ils reposent sur le concept originel du λ-calcul, à savoir un modèle de calcul, pour obtenir un langage de programmation. Ce fut tout d'abord fait dans une version non typé par J. McCarthy avec LISP, puis ensuite des langages fonctionnels typés furent conçus, comme ML ou Haskell. Les types sont particulièrement utiles pour spécifier les programmes, suivant le fameux slogan de R. Milner: "Les programmes bien typés ne peuvent pas se tromper."

Il s'agit la de la fameuse propriété de sûreté de typage. Elle peut être prouvée de deux manières différentes, soit de manière purement syntaxique, via la méthode de "progrès et préservation", ou alors en associant à chaque type τ un ensemble de termes τ qui sont sûrs, ce qui donne lieu à la méthode des types sémantiques, aussi appelée méthode de réalisabilité.

Le λ-calcul sera ainsi utilisé pour construire l'objet d'étude de cette thèse-les programmes fonctionnels-mais également pour représenter les preuves, sur ces objets, via la correspondance de Curry-Howard, en utilisant une théorie des types dépendants. Cependant, alors que les programmes que l'on considère sont impurs-c'est à dire qu'ils peuvent effectuer des effets de bord tels la divergence ou l'utilisation d'une mémoire persistanteles preuves sont elles représentées par des λ-termes purs, qui vérifient entre autres la propriété de terminaison 1 .

Comme expliqué précédemment, on peut spécifier un programme fonctionnel via son type. Mais le système de types doit être suffisamment expressif pour permettre d'énoncer une spécification précise. Cela peut par exemple être fait en utilisant des "refinement types" [START_REF] Freeman | Refinement types for ml[END_REF] ou même des types dépendants [START_REF] Nanevski | Hoare type theory, polymorphism and separation[END_REF].

Dans cette thèse, on défendra plutôt l'idée que dans beaucoup de cas, le meilleur langage pour écrire la spécification d'un programme est le langage de programmation en lui-même. En effet, lorsque l'on écrit un programme, on a souvent tendance à d'abord écrire une version naïve en laquelle on a toute confiance, que l'on va ensuite optimiser. Dans ce cas, prouver que la version naïve est équivalente à la version optimisée nous donnerait un résultat de correction pour la version optimisée.

Bien sûr, pour des programmes plus complexes, cette alternative n'est pas toujours possible. Les compilateurs sont une classe d'exemples particulièrement intéressante. Leur correction est cruciale, puisqu'ils produisent le code de bas-niveau qui sera exécuté en pratique sur les ordinateurs. Ainsi, un bug dans un compilateur pourra anéantir tous les efforts effectués pour prouver qu'un programme satisfait sa spécification, en générant un code bas-niveau incorrect. Il ne s'agit pas la d'une vue de l'esprit, comme le montre les travaux dans [START_REF] Yang | Finding and understanding bugs in c compilers[END_REF], où des dizaines de bugs furent trouvés dans GCC ou LLVM. Ainsi, de nombreux travaux sur la formalisation de la correction de compilateurs ont été effectués. Parmi ceux-ci, les travaux de X. Leroy et al. avec CompCert [START_REF] Leroy | Formal verification of a realistic compiler[END_REF] sont sûrement les plus impressionnants. Dans cette formalisation, la spécification du compilateur correspond à une simulation entre les sémantique des langages haut-et bas-niveau. Cependant, on peut imaginer des spécifications de compilateurs plus "modulaires", qui permettraient l'interaction entre du code bas-niveau provenant de deux compilateurs différents, ou même écrit à la main. Suivant les travaux de N. Benton et al. [START_REF] Benton | Compiling functional types to relational specifications for low level imperative code[END_REF][START_REF] Benton | Biorthogonality, step-indexing and compiler correctness[END_REF], il est possible de définir une telle spécification modulaire en utilisation la conservation de l'équivalence de programmes vers le code bas-niveau. Cela est particulièrement intéressant pour prouver la correction d'optimisations effectuées par les compilateurs. Tout en travaillant sur cette idée [START_REF] Jaber | Krivine realizability for compiler correctness[END_REF][START_REF] Jaber | The journey of biorthogonal logical relations to the realm of assembly code[END_REF], la nécessité d'un bon cadre logique pour formaliser les preuves d'équivalences de programmes nous est paru évidente. Ce fut le point de départ de cette thèse.

Équivalence Contextuelle

Nous avons choisi de nous concentrer sur la notion d'équivalence contextuelle, aussi appelée équivalence observationnelle, pour les langages fonctionnels impurs. Dans ce cadre, deux programmes sont dit équivalents si aucun contexte ne peut les distinguer. Au delà de son intérêt pratique, qui a été présenté précédemment, cette notion est fondamentale en sémantique dénotationnelle qui a pour but de construire des modèles pleinement abstraits. Dans de tels modèles, les dénotations de deux termes sont égales si et seulement si les deux termes sont contextuellement équivalents.

Comme on peut l'imaginer, le pouvoir expressif des contextes, vu comme des programmes "à trous", joue un rôle majeur dans l'étude de l'équivalence contextuelle. Dans le cas dégénéré où les contextes peuvent inspecter le code source des programmes, comme CHAPTER 1. R ÉSUM É c'est le cas pour les langages de programmation bas-niveau ou du code assembleur, cette notion d'équivalence contextuelle s'effondre complètement vers l'égalité syntaxique: un programme ne peut être équivalent qu'à lui-même. Dans la direction opposée, lorsque les contextes sont supposés être "purs", l'étude de l'équivalence contextuelle devient rapidement indécidable (même sans aucune forme de récursion ou de types de donnés infinis), comme l'a prouvé Loader dans [START_REF] Loader | Finitary pcf is not decidable[END_REF]. D'une certaine manière, cela expliqué pourquoi la quête d'une sémantique dénotationnelle pleinement abstraite pour PCF2 fut beaucoup plus dur que pour PCF avec effets de bord.

Ici, nous nous intéressons à des contextes et des programme qui disposent d'une notion de mémoire mutable. Plus précisément, nous considérons la notion de références, qui est la manière standard d'implémenter les cellules mémoires dans des langages dérivés de ML, comme OCaml. Une référence est définie via le constructeur ref v, pour stocker une valeur v dans le tas (alors que les arguments fournis aux fonctions sont, de manière standard, stockés dans la pile). Ces références sont ensuite réduites vers des locations, qui peuvent être vues comme des adresses mémoires. Cependant, comparé aux langages bas-niveau comme C, on ne peut effectuer aucune forme d'arithmétique de pointeurs sur les locations: elles doivent être vues comme des noms abstraits pour les cellules mémoires. Les valeurs stockées dans les références peuvent être d'ordre supérieur, c'est à dire des clôtures. Cela permet d'encoder la récursion.

En utilisant les références pour disposer d'une mémoire globale (donc persistante), une fonction peut alors compter combien de fois elle est appelée. Ainsi, lorsqu'elle est appelée deux fois avec le même argument, elle peut potentiellement retourner deux résultats différents. Mais de la même manière les contextes peuvent utiliser les références, ainsi deux termes sont équivalents s'ils effectuent des appels de fonctions, fournies par les contextes, d'une manière équivalente, et avec des arguments équivalents. C'est l'idée de la synchronisation des callbacks, qui est fausse lorsque les contextes sont purs.

Relations logiques à la Kripke

En général, il est difficile de raisonner sur l'équivalence contextuelle à cause de la quantification sur tous les contextes présente dans sa définition. Certaines techniques ont été introduites pour éviter cette quantification, et ainsi prouver l'équivalence contextuelle d'une manière plus simple. Les relations logiques sont un des cadres de travail les plus utilisés pour cela, qui sont également d'une importance fondamendale pour définir la notion de paramétricité, suivant en cela les travaux fondateurs de J. Reynolds [START_REF] Reynolds | Types, abstraction and parametric polymorphism[END_REF]. Les relations logiques sont une généralisation des types sémantiques, utilisés pour prouver la sûreté de typage, à un cadre relationnel (plutôt que prédicatif). Ce sont des relations binaires V τ et E τ définies respectivement sur les valeurs et les termes de type τ . La relation V τ est définie par induction sur τ .

Sur les types de base, la relation impose directement l'égalité des valeurs. Sur les types fonctionnels τ → σ, un couple de valeurs λx 1 .M 1 , λx 2 .M 2 est dans V τ → σ lorsque :

∀(v 1 , v 2 ) ∈ V τ , ((λx 1 .M 1 )v 1 , (λx 2 .M 2 )v 2 ) ∈ E σ
Par ailleurs, deux termes sont dans E τ lorsqu'ils se réduisent vers deux valeurs qui sont dans V τ . En utilisant ces définitions, on peut montrer que deux termes de type τ sont contextuellement équivalents lorsqu'ils sont dans E τ .

Cependant, on ne peut étendre directement cette définition à un langage avec références. En effet, dans ce cas, la réduction d'un terme M dépend des valeurs stockées par les références, c'est à dire dans le tas. Ainsi, A. Pitts et I. Stark [START_REF] Pitts | Operational reasoning for functions with local state[END_REF] ont proposé de paramétrer la définition de E τ et de V τ par des invariants sur les tas. De tels invariants sont appelés mondes, suivant en cela l'intuition des modèles de Kripke. La notion de mondes a ensuite été développé par A. Ahmed [START_REF] Ahmed | State-dependent representation independence[END_REF], puis par D. Dreyer et al. [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF] en utilisant des systèmes de transitions d'états, où chaque état représente les invariants sur le tas, permettant ainsi de prouver des équivalences qui étaient hors de portées des travaux de Pitts et Stark.

La Technique du Step-Indexing

Les relations logiques à la Kripke définies par Pitts et Stark le furent sur un langage avec "références de base", c'est à dire des références qui peuvent stocker uniquement des valeurs de base mais pas des fonctions. Dans sa thèse [START_REF] Ahmed | Semantics of types for mutable state[END_REF], A. Ahmed a étendu ces définitions aux types récursifs et aux références d'ordre supérieur. Pour cela, elle a du gérer un problème de circularité dans la définition des mondes et des relations logiques. Appel et McAllester [START_REF] Appel | An indexed model of recursive types for foundational proof-carrying code[END_REF] avaient déjà rencontré le même genre de problème de circularité dans leurs travaux sur la sûreté de typage pour du code bas-niveau avec types récursifs. Ainsi, la définition des types sémantiques TypeSem, qui sont des ensemble de valeurs "bien élevées", dépend de la définition des mondes World qui sont des invariants sémantiques sur ce que les locations peuvent stocker. Écrites sous forme d'équations récursives, cela donne World

def = Loc → TypeSem et TypeSem def = World → Value
Mais alors, en dépliant la définition de TypeSem, on obtient que TypeSem est égal à (Loc → TypeSem) → Value. On souhaite donc définir TypeSem sous la forme d'un point fixe µX.(Loc → X) → Value. Cependant, X se trouve en position négative dans cette définition, donc en général un tel point fixe n'existe pas. En effet, on ne peut pas appliquer le théorème de Knaster-Tarski.

Ce genre de définition récursive peut être résolu en passant d'un cadre ensembliste à un cadre catégorique. C'est ce qui est usuellement fait en sémantique dénotationnelle [START_REF] Scott | Toward A Mathematical Semantics for Computer Languages[END_REF]. Plus précisément, en théorie des domaines [START_REF] Scott | Domains for denotational semantics[END_REF], on travaille dans la catégorie des CHAPTER 1. R ÉSUM É ordres partiels complets, où de tels équations peuvent être résolues. Ainsi, on peut traiter l'équation D = D → D correspondant au λ-calcul pur.

Cependant, dans cette thèse on souhaite raisonner de manière operationelle sur les programmes, alors que la sémantique dénotationnelle interprète les programmes sous la forme d'objets mathématiques abstraits. Pour rester dans un monde opérationnel, Appel et McAllester [START_REF] Appel | An indexed model of recursive types for foundational proof-carrying code[END_REF] ont introduit la notion de "step-index" pour résoudre ces problèmes de circularité. L'idée de base est de stratifier la définition des types sémantiques avec un entier naturel représentant, en première approche, le nombre d'étapes de réduction pour lesquelles le programme en question se comporte correctement. Ainsi, la définition de TypeSem et de World est maintenant indexée par un entier n, comme le montre la définition suivante:

World n+1 def = Loc → TypeSem n et TypeSem n def = World n → Value n
Cette idée a été utilisée par Ahmed pour définir les relations logiques, tout d'abord pour les langages avec types récursifs [START_REF] Ahmed | Step-indexed syntactic logical relations for recursive and quantified types[END_REF] puis pour les langages avec références d'ordre superieur, dans un travail fait en collaboration avec Dreyer et Rossberg [START_REF] Ahmed | State-dependent representation independence[END_REF]. Dans tous ces travaux, la technique du step-indexing utilisée dans les définitions des relations logiques représente le nombre d'étapes de réduction pour lesquelles les deux programmes en question sont équivalents. De cette manière, il devient possible de prouver l'équivalence de nombreux programmes qui utilise des traits récursifs, en effectuant une simple induction sur les step-indexes.

Mais la gestion des step-indexes dans une preuve est en pratique -pour citer N. Benton-"laide" ("ugly"). Dans leurs travaux sur un "modèle très modal" (a "very modal model") [START_REF] Appel | A very modal model of a modern, major, general type system[END_REF], Appel, Melliès, Richard et Vouillon ont proposé un cadre pour raisonner de manière abstraite sur les step-indexes en utilisant la logique de Gödel-Löb. Pour cela, ils ont introduit une modalité "later", notée ⊲, dont le sens, (défini à l'aide d'une sémantique de Kripke) est "vrai dans le futur". Ainsi donc, la règle de Löb (⊲P → P ) → P , qui peut être vue comme un principe d'induction, est valide dans cette logique. On peut alors l'utiliser pour raisonner de manière aisée sur des programmes récursifs, comme on l'aurait fait avec des step-indexes explicites.

Cette modalité fut en fait utilisée antérieurement par Nakano [START_REF] Nakano | A modality for recursion[END_REF][START_REF] Nakano | Fixed-point logic with the approximation modality and its kripke completeness[END_REF] pour définir un λ-calcul avec des types récursifs généraux tout en étant fortement normalisant. Pour garantir cette propriété de normalisation, la modalité ⊲ (qui est notée • dans ces travaux) est utilisée pour "garder" les types récursifs.

Traduction de Forcing

Travaillant sur le step-indexing et sa reformulation via la logique de Gödel-Löb, il nous a alors semblé clair que l'on pouvait voir ces techniques comme des instances de forcing. Par forcing, on entend une méthode générale, introduite à l'origine par P. Cohen [START_REF] Cohen | Set theory and the continuum hypothesis[END_REF], pour prouver l'indépendance de l'hypothèse du continu. Cette méthode a ensuite été reformulée sous de nombreuses autres formes. La présentation qui s'intègre le mieux dans notre cadre de travail est celle utilisant les topos de faisceaux ou de prefaisceaux, issue des travaux effectués par Lawvere et Tierney [START_REF] Tierney | Sheaf theory and the continuum hypothesis[END_REF].

Cette intuition d'un lien entre step-indexing et forcing fut ensuite confirmé par les travaux de Birkedal et al. sur le topos des arbres [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF], où ils construisent un modèle d'une théorie des types avec types récursifs gardés en utilisant des prefaisceaux sur les entiers naturels. Par ailleurs, la manière de définir les relations logiques à la Kripke comme étant des relations logiques indexées par des mondes est aussi, comme on peut si attendre, un exemple de forcing, en utilisant la sémantique de Kripke pour les logiques modales. Cette idée a été explorée par Dreyer et al. in [START_REF] Dreyer | A relational modal logic for higher-order stateful ADTs[END_REF], où ils définissent une logique modale pour raisonner sur les relations logiques à la Kripke.

Notre but fut donc d'être capable d'étendre une théorie des types de manière modulaireplus précisément la théorie des types sous-jacente à l'assistant de preuves Coq-en utilisant cette notion de construction de forcing. Cela nous a conduit à construire une méthode générale pour définir une traduction de forcing sur l'ensemble de la théorie des types considérée, en utilisant une internalisation de la construction de préfaisceaux, paramétrée par un ensemble de conditions de forcing. Une telle construction nous permet de définir des couches de forcing, c'est à dire des extensions de la théorie de base avec de nouveaux principes logiques, tout en conservant les propriétés cruciales suivantes:

-la consistance de la théorie, -la decidabilité du type-checking, -la propriété de canonicité, c'est à dire le fait que les termes clos se réduisent sur des valeurs. Une conservation des deux derniers résultats ne peut en général être obtenu via des méthodes sémantiques.

En instanciant l'ensemble des conditions de forcing par les entiers naturels, nous pouvons ainsi définir ce que nous appelons la couche de step-indexing, où la construction des types récursifs gardés issus de [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF] devient possible. En travaillant avec une théorie des types munies d'univers, nous avons en outre pu définir un opérateur de point fixe sur les types, qui permet de définir de manière interne de tels types récursifs gardés.

Définition directe et par biorthogonalité

Une autre technique essentielle dans la définition des relations logiques est la biorthogonalité, aussi appelé ⊤⊤-clôture. La biorthogonalité a une longue histoire en théorie de la démonstration. Ainsi, elle a été utilisée par J.-Y. Girard pour prouver l'élimination des coupures de la logique linéaire, et par J.-L. Krivine dans ses travaux sur la réalisabilité classique, pour étendre la correspondance de Curry-Howard à la logique classique avec l'axiome du choix.

CHAPTER 1. R ÉSUM É

Dans le cadre des relations logiques, elle est utilisée pour définir E τ non pas directement par rapport à V τ , mais plutôt comme clôture de V τ via une relation auxiliaire K τ sur les contextes d'évaluations.

Cette définition sous forme de clôture est utile pour trois différentes raisons:

-pour raisonner sur des langages disposant de primitives dont la réduction est dépendante du contexte, comme call/cc ou l'instruction jump en assembleur, -pour construire des modèles opérationnels de langages combinant polymorphisme et récursion [START_REF] Pitts | Parametric polymorphism and operational equivalence[END_REF], de manière à garantir l'admissibilité des relations logiques, -pour obtenir la complétude des relations logiques, c'est à dire que deux termes de type τ qui sont contextuellement équivalents sont dans E τ . Dans cette thèse, nous ne considérerons pas d'opérateurs de contrôle tel que call/cc, ainsi le flot de contrôle sera supposé séquentiel. Pour gérer la présence de récursion dans le langage, nous avons vu que le step-indexing est en pratique suffisant, ainsi nous n'aurons pas besoin de la notion d'admissibilité. Ainsi, seul l'obtention de la complétude des relations logiques par rapport à l'équivalence contextuelle pourrait justifier l'utilisation de la biorthogonalité ici.

Cependant, lorsque l'on travaille avec des relations logiques définies par biorthogonalité, on s'appuie sur le principe d'invariance locale [START_REF] Pitts | Operational reasoning for functions with local state[END_REF] qui permet de déplier la biorthogonalité vers une définition directe.

Mais la complétude obtenue par biorthogonalité est un peu trompeuse, puisqu'elle ne signifie pas que l'on peut en pratique prouver n'importe quelle équivalence correcte en utilisant ces relations logiques. C'est ce qu'illustre le fameux "awkward example" :

M awk 1 = let x = ref 0 in λf.x := 1; f(); !x M awk 2 = λf.f(); 1
Pour prouver que ces deux termes sont équivalents, l'invariant qui contraint x à pointer soit vers 0 ou vers 1 n'est pas suffisant pour déduire que le premier programme retourne 1. Ainsi, le modèle de Pitts et Stark, qui utilise des invariants comme mondes, ne peut pas prouver cette équivalence, ce qui peut sembler étrange à première vue puisque ces relations logiques sont complètes. Cela vient du fait qu'utiliser la clôture par biorthogonalité pour prouver une équivalence est aussi dur que de raisonner directement sur l'équivalence contextuelle, lorsque l'on ne peut utiliser le principe d'invariance locale. En fait, l'impossibilité de prouver cette équivalence avec les définitions de Pitts et Stark a mené Ahmed à raffiner leur modèle, pour permettre aux invariants sur les tas d'évoluer durant l'exécution [START_REF] Ahmed | State-dependent representation independence[END_REF]. En utilisant les travaux ultérieurs de Dreyer et al. [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF], le monde utilisé pour prouver cette équivalence est le système de transitions d'états suivant:

x ֒→ 0

x ֒→ 1 qui s'assure que lorsque x pointe vers 1, il ne pointera plus jamais vers 0. En utilisant ce principe plus précis, il devient ensuite possible de prouver que M 1 est équivalent à M 2 . De tels systèmes de transitions peuvent en pratique être vue sous la forme d'une abstraction du flot de contrôle du programme, ne prenant en compte que la modification du tas.

Sémantique des jeux nominale opérationnelle

En absence de la biorthogonalité, prouver la complétude des relations logiques pour un langage avec références est un problème ouvert. En effet, on doit alors raisonner sur la forme des contextes, ce qui peut être très complexe. Pour traiter ce problème, nous avons choisi d'établir un lien entre les relations logiques et le modèle dénotationnel de notre langage. La sémantique des jeux est alors apparue comme étant le choix le plus évident pour cela, plus précisément le modèle développé par A. Murawski et N. Tzevelekos pour des "bonnes références générales" [START_REF] Murawski | Game semantics for good general references[END_REF] 3 qui est en effet pleinement abstrait pour RefML. Ce modèle utilise des ensembles nominaux [START_REF] Pitts | Nominal Sets: Names and Symmetry in Computer Science[END_REF] pour abstraire le raisonnement sur les "noms" des locations. Nous utiliserons également cette idée tout au long de cette thèse.

Ce modèle ne s'intègre cependant pas facilement avec les relations logiques, comme on peut le voir sur l'exemple suivant, représenté par le terme M : λ f.let x = ref0 in f(λ .x := 1) in M 1 Ce terme conserve la référence x privée, et fournit au contexte la possibilité de la modifier à 1 à l'aide d'une fonction "setter". Mais ensuite, il n'est plus possible de relier M 1 à M pour deux raisons :

-x est gardée privée par le terme, mais la dénotation de M 1 est défini comme si toutes ses locations étaient divulguées au contexte, -le contexte a accès au setter λ .x := 1 lorsque M 1 est évalué, mais il n'y a pas de manière facile de le spécifier avec la sémantique des jeux. Pour dépasser ces limitations de la sémantique des jeux, nous avons choisi de définir un nouveau modèle, inspiré par les travaux antérieurs de J. Laird [START_REF] Laird | A fully abstract trace semantics for general references[END_REF]. Cette sémantique dispose des propriétés dénotationnelles (ou catégoriques) de la sémantique des jeux, tout en ayant des bonnes propriétés opérationnelles. L'idée de base de cette sémantique est d'interpréter les termes comme des ensembles de traces, représentant les interaction entre un terme et n'importe quel contexte, comme en sémantique des jeux, mais ici cette interprétation peut être calculée opérationnellement grâce à une réduction interactive.

En raffinant ensuite ce modèle avec des mondes pour contraindre la forme des tas, on peut définir une sémantique des traces à la Kripke. Cela nous permet d'établir un lien forme avec les relations logiques à la Kripke et ainsi de prouver leur correction et complétude.

Une logique temporelle pour l'équivalence de programmes

Des logiques ont été conçues pour raisonner sur la corrections de programmes, fournissant des principes généraux pour prouver de tels résultats. La plus utilisée est certainement la logique de Hoare, qui fut ensuite étendue avec la logique de séparation [START_REF] Reynolds | Separation logic: A logic for shared mutable data structures[END_REF] pour raisonner aisément sur les propriétés du tas.

Dans cette thèse, nous nous intéressons particulièrement à des logiques pour raisonner directement sur l'équivalence de programmes. La logique de Plotkin et Abadi pour le polymorphisme paramétrique [START_REF] Plotkin | A logic for parametric polymorphism[END_REF] fut la première logique introduite dans ce but, pour le Système F. Puis Dreyer et al. ont introduit LSLR [START_REF] Dreyer | Logical step-indexed logical relations[END_REF] et LADR [START_REF] Dreyer | A relational modal logic for higher-order stateful ADTs[END_REF], deux logiques pour des langages plus complexes, avec types récursifs et références d'ordre supérieur. Cependant, toutes ces logiques utilisent le λ-calcul comme objet de base, ce qui leur permet ensuite d'y définir les relations logiques. Si ces logiques conviennent parfaitement pour formaliser des preuves d'équivalence, il semble très difficile de les utiliser pour prouver automatiquement l'équivalence de programmes. Dans cette thèse, nous suivons une approche différente, en définissant une logique beaucoup plus simple qui satisfait de bonnes propriétés de "model-checking" pour abstraite le raisonnement sur les mondes utilisés dans notre définition des relations logiques à la Kripke. Cependant, comparé au step-indexing, cette abstraction ne rentre pas aisément dans le cadre de la traduction de préfaisceaux, car certaines des constructions utilisées pour définir les relations logiques à la Kripke ne sont pas monotones par rapport aux mondes.

Ainsi, on définit plutôt une logique temporelle pour raisonner sur les systèmes de transitions des mondes. La sémantique des différents connecteurs de cette logique temporelle est alors définie de manière usuelle à l'aide d'une sémantique de Kripke. Comparé à [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF], nous utilisons des systèmes de transition étiquetées (Labeled Transition Systems) plutôt que des systèmes de transitions d'états. Les invariants sont alors spécifiés directement sur les transitions, en utilisant une notion de pre-et post-condition dans l'esprit de la logique de Hoare. Cella est particulièrement utile pour garder les systèmes de transitions finis.

Dans les travaux antérieurs [PS98, ADR09, DNB10], un monde futur w ′ de w pouvait être étendu avec de nouveaux invariants (ou de nouveaux systèmes de transitions d'invariants) sur la partie des tas qui sont disjoints de ceux spécifiés par w. Ainsi, les mondes étaient partitionnés en îles, chacune correspondant à une partie du tas disjointe des autres. Cependant, cela nécessite une trop grande liberté pour être définissable dans notre logique restreinte, où l'on ne peut quantifier sur des objets complexes comme des invariants. Ainsi; on interdit ici cet usage, le système de transitions étant fixé au départ, et ne peut changer au fur et à mesure que le monde évolue. Cela veut dire qu'il doit prévoir les création de locations futures effectuées par le terme: on appelle un tel comportement omniscient.

Pour raisonner de manière abstraite sur les variables libres de base, on introduit une exécution symbolique pour notre langage qui génère toutes les réductions possibles des termes. Il génère également un ensemble de prédicats qui contraignent les valeurs des vari-ables de base, de telle manière que l'ensemble des prédicats est satisfiable si et seulement si la réduction est effectivement possible. Ensuite, on définit les relations logiques temporelles E τ , qui sont des formules de notre logique temporelle. A partir de deux termes M 1 , M 2 , la formule E τ (M 1 , M 2 ) est générée automatiquement en utilisant l'exécution symbolique. On montre ensuite qu'il existe un monde qui valide cette formule si et seulement si les deux termes appartiennent à la relation logique "concrète" vu précédemment. De la correction et la complétude des relations logiques concrètes, on réduit le problème de l'équivalence contextuelle de deux termes M 1 , M 2 au model-checking de E τ (M 1 , M 2 ), c'est à dire:

M 1 , M 2 sont contextuellement équivalents si et seulement si il existe un monde w tel que

w |= E τ (M 1 , M 2 )
Notre logique temporelle combine l'arithmétique de Presburger, utilisée pour énoncer des contraintes arithmétiques sur les valeurs de base, avec des modalités temporelles inspirées de la Computational Tree Logic pour contrôler l'évolution de ces contraintes. Par conséquent, elle n'a pas de bonne propriétés de décidabilité du model-checking que les logiques temporelles ont usuellement, à cause de l'interaction avec l'arithmétique.

Cependant, sous certaines hypothèses raisonnable sur la forme des mondes, on obtient la décidabilité du model-checking, c'est à dire que l'on peut vérifier automatiquement si un monde valide une formule temporelle. Pour ce faire, on traduit la formule temporelle vers une formule plus simple, qui ne contient pas de modalité temporelle, et qui peut ensuite être vérifiée par un solveur SMT.

Il semble être possible, sous une hypothèse de borne de la taille du tas, de construire automatiquement un monde qui valide la formule temporelle si et seulement si les deux programmes sont effectivement contextuellement équivalent. Cela nous permettrait d'obtenir un résultat de décidabilité4 pour l'équivalence contextuelle pour des termes satisfaisant cette hypothèse. Nous pensons que cela permettrait d'obtenir un fragment décidable qui inclut celui de la sémantique des jeux algorithmique [START_REF] Murawski | Algorithmic nominal game semantics[END_REF], qui est lui caractérisé par une restriction sur les types.

A la suite de ces résultats théoriques, une implémentation d'un prototype a été réalisée en Haskell, qui permet de:

-générer la formule temporelle correspondant à l'équivalence de deux termes, -traduire cette formule en une formule plus simple, qu'un solveur SMT peut valider, une fois que le monde est fourni. -générer, sous une hypothèse de borne de la taille du tas, un monde qui valide la formule si et seulement si les deux termes sont équivalents.

Chapitre 3: Préliminaires

Dans ce chapitre, on introduit les prérequis utilisés tout au long de cette thèse.

Théorie des Types de Martin-Löf

Tout d'abord, nous introduisons dans la section 3.1 la théorie des types qui est utilisée comme "métathéorie" pour représenter nos preuves: la théorie des types de Martin-Löf.

Suivant l'idée sous-jacente de la correspondance de Curry-Howard, les preuves peuvent être représentées comme des termes du λ-calcul, et les formules comme des types. Cette idée fut développée par P. Martin-Löf pour construire un formalisme constructif aux mathématiques. Comme nous l'avons expliqué précédemment, il a introduit les types dépendants comme représentation des quantificateurs existentiels et universels.

Cette section introduit MLTT U , la théorie des types de Martin-Löf avec une hiérarchie d'univers, inspirée par [START_REF] Hofmann | Syntax and semantics of dependent types[END_REF] pour la théorie générale et par [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF] pour la présentation des univers et du type identité.

La figure 3.1 de la section 3.1.1 définit les règles de typage de base de MLTT U , correspondant à la bonne formation des contextes wf (Γ), aux univers U (à la Russell) et aux produits dépendants Πx : T.U . L'égalité jugementale (aussi appelée conversion) est introduite ensuite. Dans la section 3.1.2, on introduit le type identité M 1 = T M 2 dont les termes sont les "preuves" d'égalité de M 1 et M 2 . Ces règles de typage se trouvent dans la figure 3.2. Ce type permet ensuite de formaliser la notion de d'"irrelevance" des preuves, introduite dans la section 3.1.3. Les sections 3.1.4,3.1.5,3.1.6 étendent MLTT U avec de nouveaux constructeurs, les sommes dépendantes et les types sous-ensemble, le type vide et singleton, et les coproduits et les entiers naturels.

Enfin, la section 3.1.7 se concentre sur l'unicité des preuves de typage, en coerçant explicitement l'utilisation de la règle de conversion. On compare alors dans la section 3.1.8 les différences entre le système de types présenté et celui derrière l'assistant de preuve Coq, qui est utilisé pour implémenter les techniques du chapitre 4.

Langages en Appel par Valeur avec Références

On introduit ensuite dans la section 3.2 les langages de programmation qui sont les objets d'études de cette thèse. Il s'agit de fragments de ML, c'est à dire des langages fonctionnels typés avec une réduction en appel par valeur et des références nominales.

Dans sa forme la plus générale, le langage que l'on considère dispose de références d'ordre supérieur, c'est à dire qu'il peut stocker des fonctions dans les références. On appelle ce langage RefML. Sa syntaxe est introduite en section 3.2.1, avec notamment la définition de sa sémantique opérationnelle dans la figure 3.8. Les règles de typage de RefML sont introduite en section 3.2.2 dans la figure 3.9. L'équivalence contextuelle entre deux programmes, qui est la notion centrale de cette thèse, est alors introduite dans la sec-tion 3.2.3. Finalement, GroundML, une restriction du langage où les références ne peuvent stocker que des valeurs de types de base (Int ou ref τ ) est introduite en section 3.2.4.

Raisonnement Nominal

Lorsque l'on formalise des preuves sur le λ-calcul, on a souvent à raisonner à αéquivalence près. C'est à dire, deux termes qui ne diffèrent que par rapport au nom de leurs variables liées sont considérés comme étant équivalents. La même idée s'applique au locations, puisque l'arithmétique de pointeurs est interdite dans notre cadre. Pour formaliser cette situation, la logique nominale a été introduite par A. Pitts [START_REF] Pitts | Nominal logic, a first order theory of names and binding[END_REF]. L'idée de base est de voir les objets dont la définition utilise des variables ou des locations uniquement à permutation près de ces éléments. Cela peut être formalisé en utilisant la notion d'ensemble de Fraenkel-Mostowski, appelés ensembles nominaux dans la section 3.3.1, qui sont des ensembles équipés d'une action de permutation sur un ensemble de noms (qui sont l'ensemble des variables ou des locations ici).

On a parfois besoin de raisonner explicitement sur les permutations lorsqu'on considère deux éléments nominalement équivalents t, u d'un ensemble nominal X. Cependant, lorsque c'est le cas, il est plus aisé de travailler avec une notion de span qui sont introduits dans la section 3.3.2.

Chapitre 4: Forcing en Théorie des Types

Le forcing est une méthode conçu à l'origine par P. Cohen pour prouver l'indépendance de l'hypothèse du continu par rapport à la théorie des ensemble axiomatique (ZFC) [START_REF] Cohen | Set theory and the continuum hypothesis[END_REF]. L'intuition derrière cette méthode est d'ajouter de nouveaux objets à la théorie, qui peuvent être approximés dans le système de base, en utilisant ce qu'on appelle des conditions de forcing. Plus précisément, un modèle de base M est étendu vers un nouveau modèle M[G] en ajoutant un nouvel élément générique G à M. Alors que M[G] est en général très complexe à étudier directement, P. Cohen a proposé de contrôler les propositions vraies de M[G] en les traduisants vers M. Pour ce faire, il a donc utilisé les conditions de forcing, qui peuvent être vues comme des approximations de l'ensemble G. Ces conditions sont des éléments de M, ce qui n'est pas en général le cas de l'élément générique G. Ainsi, à partir d'une formule ϕ de M[G], on peut construire syntaxiquement une formule p φ-qui s'exprime comme "p forces φ"-qui appartient à M, et qui est telle que ϕ est vraie lorsqu'il existe une approximation "correcte" p de G telle que p φ dans M. Une des propriétés essentielles de l'ensemble des conditions de forcing est d'être ordonnée. Intuitivement, on a p ≤ q lorsque p est une approximation plus précise de G que q, c'est à dire qu'il contient plus d'information, de telle manière que la relation doit être monotone par rapport à cette relation d'ordre.

Ces dernières années, le forcing a reçu une attention accrue, dans le but d'étendre la correspondance de Curry-Howard à divers raisonnements classiques. Ainsi, le forcing a été généralisé par Krivine dans ses travaux sur la réalisabilité classique [START_REF] Krivine | Realizability in classical logic[END_REF], où les conditions de forcing deviennent des λ-termes. Il a ensuite combiné cette approche avec la technique usuelle de forcing dans [START_REF] Krivine | Realizability algebras: a program to well order R[END_REF] pour donner un contenu calculatoire à des formes faibles de l'axiome du choix, tel l'existence d'un ultrafiltre sur N ou d'un bon ordre sur R. À la suite de ces travaux, A. Miquel [START_REF] Miquel | Forcing as a program transformation[END_REF] a étudiée la transformation de preuve induite par le forcing, dans la théorie de l'arithmétique d'ordre supérieur vu comme une extension de System F ω . C'est à dire, il a étudié comme une preuve d'une proposition P est transformée en une preuve de p P .

Dans un cadre constructif, nous avons utilisé le forcing, en collaboration avec T. Coquand [START_REF] Coquand | A Note on Forcing and Type Theory[END_REF][START_REF] Coquand | A computational interpretation of forcing in type theory[END_REF], pour donner un contenu calculatoire à un résultat de continuité uniforme à certaines fonctionnelles définissables dans la théorie des types de Martin-Löf. Dans ces travaux, nous avons étendu MLTT avec un jugement de typage indexé par une condition de forcing. Pour cela, nous avons développé un traduction simple de MLTT, qui ne s'intègre bien qu'avec les termes que l'on souhaitait ajouter à notre théorie. Cela laisse ouvert la question d'une traduction sur l'ensemble des termes de MLTT.

Pour adapter les idées "ensemblistes" du forcing et les adapter à une théorie des types dépendante, nous avons utilisé sa reformulation catégorique que Lawvere et Tierney [START_REF] Tierney | Sheaf theory and the continuum hypothesis[END_REF] ont développée en utilisant les topos de faisceaux. Dans ce cadre, le forcing intuitionniste se définit à l'aide de la notion de préfaisceaux en théorie des catégories.

Le point de départ de ce chapitre est de connecter ces deux observations:

"Le forcing intuitionniste pour la théorie des types est une internalisation de la construction de préfaisceaux dans la théorie des types."

Plus précisément, on cherche donc à étendre une théorie des types initiale-que l'on appelle système de base-avec de nouveaux principes, pour obtenir une nouvelle théorie des types-que l'on appelle la couche de forcing. Termes et types de cette couche de forcing peuvent alors être traduits dans le système de base en utilisation la traduction de forcing.

De cette manière, on peut développer une nouvelle génération de logiques, qui peuvent être définie de manière modulaire en utilisant des couches de forcing. La traduction de forcing s'appuie sur l'internalisation dans MLTT U de la construction de préfaisceaux sur un type particulier P-représentant les conditions de forcing. Il devient alors possible d'exhiber de nouveaux principes de raisonnement dans la couche de forcing en utilisant la structure du type des conditions de forcing choisi. Mais, quel que soit les nouveaux principes logiques qui sont définis, leur consistance peut être déduite directement:

"La consistance de la logique définie dans une couche de forcing résulte de la consistance de la logique de base."

En effet, on est capable d'étendre la théorie des types avec de nouveaux principes de raisonnement et de nouveaux objets, sans les définir comme axiomes. Au delà des problèmes de consistance, éviter l'approche axiomatique nous permet de donner un contenu calculatoire à ces nouveaux principes: des programmes leurs sont associés. Cette définition du forcing pour la théorie des types est liée aux travaux sur la sémantique de Kripke qu'Appel, Melliès, Richards et Vouillon [START_REF] Appel | A very modal model of a modern, major, general type system[END_REF] ont proposé pour voir le step-indexing-une technique pour gérer différentes formes de récursions dans la sémantique des langages de programmation-comme forcing (à la Kripke) sur l'ensemble des entiers naturels. Ces entiers peuvent être utilisés pour définir (ou forcer) une modalité de la logique, une idée auparavant introduite par Nakano in [START_REF] Nakano | A modality for recursion[END_REF], avec un principe d'induction obtenu directement des entiers naturels. Plus récemment, Birkedal, Møgelberg, Schwinghammer, et Støvring [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF] ont montré que cette construction correspond sémantiquement à travailler à l'intérieur du topos des arbres, qui fournit une méthode générique pour définir des types récursifs généraux dans le modèle sémantique. De manière similaire, on utilise le forcing sur l'ensemble des entiers naturels pour fournir des types récursifs généraux dans MLTT U , sans s'appuyer sur un critère de positivité. Cette construction permet de définir un type universel D pour les termes du λ-calcul pur qui induit un plongement superficiel du λ-calcul pur dans MLTT U . Le fait que l'on peut utiliser la règle de conversion qui est normalisante pour décrire la β-reduction du λ-calcul pur n'est pas contradictoire. Le dépliage du type récursif D est géré par une égalité propositionnel et non pas par la règle de conversion, et doit donc être explicite dans le terme. Pour illustrer l'utilisation du forcing dans notre cadre, nous proposons également une reformulation de la construction de Cohen d'un modèle validant la négation de l'hypothèse du continu, en utilisant les sous-ensembles finis de P(P(Nat)) × Nat comme ensemble de conditions de forcing.

Plan du Chapitre Dans la section 4.1, on explique les intuitions de la traduction de forcing à l'aide de la construction de préfaisceaux. On la définit ensuite formellement dans la section 4.2, en traitant les différents problèmes de cohérence posés par la règle de conversion. La section 4.3 présente une manière systématique d'introduire de nouveaux principes de raisonnement dans une couche de forcing. On illustre ensuite dans la section 4.4 cette traduction en choisissant comme ensemble de conditions de forcing les entiers naturels, pour fournir un cadre aux types récursifs gardés. Cela fournit une présentation syntaxique au topos des arbres [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF]. Ensuite, en section 4.5, nous illustrons la traduction de forcing avec un autre ensemble de conditions de forcing, dans le le but de forcer la négation de l'hypothèse du continu. Finalement, les travaux reliés et de possibles extensions sont présentés en section 4.6.

Chapitre 5: Sémantique des Jeux Nominale Opérationnelle

Pour atteindre notre objectif de prouver la complétude de relations logiques à la Kripke, définies de manière directe, pour RefML, nous devons les relier à un modèle dénotationnel pleinement abstrait, pour lequel les dénotation de deux termes sont égales si et seulement si ils sont contextuellement équivalents. La recherche de longue date d'un tel modèle pleinement abstrait a abouti avec la sémantique des jeux.

La sémantique des jeux [HO00, AJM00] est une théorie puissante pour construire des modèles dénotationnel pleinement abstrait de différents langages de programmation. La dénotation d'un terme est représentée par une strategie, c'est à dire un ensemble de parties entre un terme et n'importe quel contexte, qui se jouent dans une arène, qui définie les règles que les parties doivent suivre. Une des contribution les plus importante de la sémantique des jeux, le fameux "cube d'Abramsky", est la caractérisation de l'absence de divers effets dans le langage en termes de conditions supplémentaires sur la dénotation des termes. Ainsi, le bon parenthésage correspond à l'absence d'opérateurs de contrôle, la visibilité à l'absence de références d'ordre supérieur, l'innocence aux termes purs. Ces dernières années, la sémantique des jeux a été étendue à des langages avec des aspects nominaux, du ν-calcul [AGM + 04], puis à une extension avec cellules mémoires [START_REF] Laird | A game semantics of names and pointers[END_REF], jusqu'à une variante de ML avec références nominales d'ordre supérieur [START_REF] Murawski | Game semantics for good general references[END_REF].

Le point de départ de cette section est la sémantique nominale des jeux de Murawski et Tzevelekos [START_REF] Murawski | Game semantics for good general references[END_REF], présentée dans la section 5.1, qui est pleinement abstraite pour RefML, mais aussi pour GroundML dès lors qu'on ajoute une condition de visibilité aux stratégies [START_REF] Murawski | Algorithmic games for full ground references[END_REF]. Au contraire des précédents modèles de jeux pour des langages avec mémoire, initiés par les travaux de Abramsky, Honda et McCusker [START_REF] Abramsky | A fully abstract game semantics for general references[END_REF], ce modèle utilise des techniques nominales [START_REF] Pitts | Nominal logic, a first order theory of names and binding[END_REF], auparavant présente dans [START_REF] Tzevelekos | Full abstraction for nominal general references[END_REF], pour éviter le problème des "bad variables". Dans un cadre plus opérationnel, Laird [START_REF] Laird | A fully abstract trace semantics for general references[END_REF] a introduit une sémantique de trace pour une variante de RefML, et a prouvé sa pleine adéquation. Son modèle marie une représentation sous forme de traces inspirées de la sémantique des jeux avec une définition opérationnelle, c'est à dire que la dénotation des termes est calculée à l'aide d'un système de réécriture plutôt que définie par induction sur leur jugement de typage.

Dans cette section, nous introduisons une sémantique de trace pour RefML, dont la définition est une variante typée de celle introduite par Laird. Les traces sont générée par une réduction interactive, qui peut être vue comme une extension de la sémantique opérationnelle usuelle à des termes ouverts ayant des variables fonctionnelles libres. Ainsi, cette réduction peut être utilisée sur des termes comme λx.M or K[f v]. Ainsi, la dénotations des termes est définie via des stratégies de traces, c'est à dire des ensembles de traces que les termes génèrent en utilisant cette réduction.

La sémantique de traces permet, par rapport à la sémantique des jeux, une étude plus fine de l'interaction en suivant le processus de divulgation des valeurs (que ce soit des locations ou des fonctions) entre le terme et les contextes. En effet, en sémantique des jeux, on ne peut en général décomposer les parties en "sous-parties", puisque l'on obtient alors une suite de coups où certains ne seraient plus justifiés, et ainsi laissés sans contrôle. Avec la sémantique de traces, de tels coups non justifiés sont simplement vue comme des valeurs divulguées, qui peuvent être prises en charge par la réduction interactive. En utilisant cette décomposition plus fine, on peut prouver un résultat de décidabilité de l'équivalence contextuelle pour des termes "purs" de RefML, c'est à dire des termes qui n'utilisent pas de possibilité de stockage dans le tas (mais avec des contextes non restreints). Ce résultat utilise de manière cruciale le contrôle des fonctions divulguées pour effectuée une "chirurgie" sur les traces. Dans le prochain chapitre, nous verrons comment effectuer cette chirurgie sur des termes "impurs", en définissant de nouvelles techniques pour raisonner sur la divulgation de locations.

Les traces peuvent en fait être vues comme une représentation des parties utilisée en sémantique des jeux, où la structure de pointeurs, qui représente la relation de causalité entre les différents coups, est encodé via des variables. De telles variables, qui sont de type fonctionnel, sont appelées noms de pointers.

Suivant cette idée, nous prouvons une correspondance entre cette dénotation des termes, définie comme ensemble de traces, et la dénotation issue de la sémantique des jeux, définie par des ensembles de parties. Pour ce faire, nous imposons sur les stratégies de traces une structure catégorique qui correspond aux langages en appel par valeur, c'est à dire une catégorie Freyd-fermée [START_REF] Power | Premonoidal categories and notions of computation[END_REF][START_REF] Power | Closed freyd-and kappa-categories[END_REF]. Elle consiste en:

-une catégorie symétrique prémonoidale (C, I, ⊗), -une catégorie "luff" C ′ de C, pour laquelle ⊗ est un produit cartésien, -un foncteur prémonoidal strict (.) † entre C ′ et C, qui est l'idéntité sur les objets, tel que pour tout objet A de C, le foncteur ( ⊗ A) † : C ′ → C dispose d'un adjoint à droite. Pour construire une telle structures sur les traces, on reformule les définitions de la sémantique des jeux de issues de [START_REF] Laird | A game semantics of names and pointers[END_REF][START_REF] Murawski | Game semantics for good general references[END_REF] dans le cadre de la sémantique de traces. La difficulté principale vient de l'absence d'une définition explicite de la structure de pointeurs, qui doit être reconstruire à partir d'une étude de la fraicheur des noms de pointeurs (i.e. c'est à dire des variables fonctionnelles).

On relie ensuite la notion usuelle de vue de la sémantique des jeux à des ensembles de noms de pointeurs de joueur disponibles, de telle manière que l'on puisse importer la condition de visibilité qui capture le comportement des termes de GroundML directement sur les traces. En modifiant finalement la réduction interactive pour restreindre les questions d'Opposant à être effectuées sur de tels noms de pointeurs de joueur disponibles, on peut capturer l'équivalence contextuelle de GroundML avec l'équivalence de traces.

Plan du Chapitre Les notions de base de la sémantique des jeux (dans un cadre en appel par valeur) et sa structure catégorie sont introduite en section 5.1. La section 5.1.7 rappelle les principales caractéristiques de la sémantique des jeux nominale.

La notion de trace est définie formellement dans la section 5.2.1 et sa correspondance avec les parties de la sémantique des jeux est esquissée dans la section 5.2.2. La réduction interactive est introduite en section 5.2.3 et l'interprétation des termes comme ensembles de traces est définie en section 5.2.4. Une des principales contributions de ce chapitre, présentée en section 5.3, est la comparaison de ce modèle de traces avec le modèle de jeux de Murawski et Tzevelekos [START_REF] Murawski | Game semantics for good general references[END_REF], et la preuve que les deux sont en fait équivalents. On répond également à une question posée par Laird à la fin de [START_REF] Laird | A fully abstract trace semantics for general references[END_REF] sur une possible sémantique de traces pour un langage avec références restreintes aux types de base, en reformulant la notion usuelle de visibilité dans le cadre de la sémantique de traces. Ceci est fait en section 6.7.2. Finalement, en section 5.5, on montre l'utilité de la sémantique de traces en prouvant que l'équivalence contextuelle de termes purs de RefML (et également de GroundML) est décidable. Cela donne un premier exemple des idées introduites dans les deux prochains chapitres pour raisonner sur l'équivalence contextuelle.

Chapitre 6: Relations Logiques Concrètes

Dans le chapitre 5, nous avons introduit la sémantique de traces, un modèle pleinement abstrait de RefML, comme variation du modèle standard de la sémantique des jeux. Cependant, ces deux modèles sont difficilement utilisable directement pour raisonner sur l'équivalence de termes de RefML. En effet, dans ces modèles la dénotations des termesc'est à dire les stratégies-sont des objets infinis pour lesquels raisonner sur l'égalité est difficile.

D'autre part, il y a eu de très nombreux travaux pour développer des techniques et modèles opérationnels pour prouver l'équivalence de programmes écrits dans des langages avec références. Deux des plus importantes techniques sont les bisimulations et les relations logiques. Les bisimulations environnementales [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF][START_REF] Sumii | A complete characterization of observational equivalence in polymorphic λ-calculus with general references[END_REF] étendent les bisimulations définies pour les langages du premier ordre (tel les calculs de processus) à des langages d'ordre supérieur. Elles sont pour cela définies comme des ensembles de relations, de telle manière à représenter l'évolution de l'information divulguée par le terme au contexte. La coinduction est ensuite utilisée pour raisonner sur l'équivalence résultante. Cette utilisation de la coinduction est particulièrement utile pour raisonner sur la récursion dans les termes, évitant ainsi l'utilisation du step-indexing.

Les relations logiques à la Kripke, qui ont été présentées dans l'introduction de cette thèse, sont une autre approche pour prouver l'équivalence contextuelle de deux termes. Dans un cadre en appel par valeur, elles sont définies par les relations V τ w et E τ w respectivement sur les valeurs et les termes, via une induction mutuelle sur le type τ . Elles utilisent une notion de monde w pour contraindre les tas utilisés pour réduire les termes M 1 , M 2 vers des valeurs dans la définition de E τ w. Dans un article récent [HDNV12], Hur et al. ont proposé de marier les relations logiques à la Kripke et les bisimulations environnementales pour définir les bisimulations paramétriques.

Cependant, tous ces travaux sont soit incomplet par rapport à l'équivalence observationnelle, où alors ils nécessitent une forme de clôture qui introduit une quantification (infinie) sur les contextes. C'est notamment le cas des relations logiques, qui utilisent une définition par biorthogonalité pour obtenir la complétude:

E τ def = {(M 1 , M 2 ) | ∀(K 1 , K 2 ) ∈ K τ .(K 1 [M 1 ], K 2 [M 2 ]) ∈ O et K τ def = {(v 1 , v 2 ) | ∀(v 1 , v 2 ) ∈ V τ .(K 1 [v 1 ], K 2 [v 2 ]) ∈ O} où O est l'
ensemble des couples de termes equi-divergents. On pourrait imaginer relier directement une définition direct à une définition par biorthogonalité d'une relation logique. Mais cela semble hors de porté pour un langage comme RefML. Plus précisément, considérons deux termes (M 1 , M 2 ) ∈ E τ w où E τ w est défini par biorthogonalité, essayons alors de déplier cette définition vers un style direct: soit h 1 , h 2 deux tas satisfaisant les contraintes induites par w, supposons qu'à la fois

(M 1 , h 1 ) → (v 1 , h ′ 1 ) et (M 2 , h 2 ) → (v 2 , h ′ 2 )
. Alors il est très dur de construire un monde w ′ future de w tel que (v 1 , v 2 ) ∈ E τ w et h ′ 1 , h ′ 2 satisfassent les contraintes induites par w ′ . On repose en effet sur le pouvoir discriminant des contextes dans K τ w, mais en essayant cela, on arrive à étudier précisément l'interaction entre termes et contextes, ce qui nous amène à utiliser la sémantiques des jeux et de traces.

Dans cette thèse, nous proposons la première preuve de complétude des relations logiques à la Kripke, définies sans aucune forme de clôture, pour des termes sans divergence de GroundML, avec des contextes dans RefML. Pour cela, nous nous appuyons de manière cruciale sur la sémantique de traces introduite dans le chapitre précédent. En pratique, nous raffinons ce modèle pour définir la sémantique de traces à la Kripke.

Pour aboutir à ce résultat, nous avons modifier la définition usuelle des relations logiques à la Kripke, pour la rapprocher de la sémantique de traces. Tout d'abord, nos relations logiques sont définies sur des termes ouverts, avec des variables libres fonctionnelles5 (c'est à dire des noms de pointeur d'Opposant), qui sont reliés à l'aide d'un environnement relationnel e qui correspond à un span, comme introduit en section 3.3. Ainsi, nos relations logiques E τ e sont indexées par ce span, de telle manière que:

-deux λ-abstractions λx

1 .M 1 , λx 2 .M 2 sont dans V τ → σ e , avec τ un type fonc- tionnel, lorsque (M 1 , M 2 ) ∈ E σ e•(x 1 ,x 2 ,τ ) , -deux variables (fonctionnelles) (x 1 , x 2 ) sont dans V τ → σ e lorsqu'elles sont dans
e. Cela est particulièrement utile pour raisonner de manière abstraite sur les callbacks. On peut ensuite gérer globalement les contraintes sur les locations divulguées. En effet, considérons les deux termes suivants:

M 1 = let x = ref0 in λf.fx; x := 1 M 2 = let x = ref0 in λf.fx; x := 2
Ils ne sont pas équivalents car la location liée à x, divulguée via le callback fx, ne stocke pas la même valeur à la fin de l'exécution de M 1 et M 2 . Habituellement, de tels invariants sur les locations divulguées sont imposées par le monde w (de la même manière que les invariants sur les locations privées) et la définition de V ref τ w. Ici, on choisit une approche différence, en imposant globalement ces invariants sur les valeurs stockées dans le tas.

Pour ce faire, on doit suivre l'évolution de la divulgation des locations. On utilise donc une notion de span D entre locations divulguées locations pour cela, suivant les travaux de Stark [START_REF] Stark | Names, equations, relations: Practical ways to reason about new[END_REF]. Ainsi, les mondes contiennent un tel span D, qui évolue au cours de l'execution des termes, en étant étendu avec les nouvelles locations divulguées. Par exemple, considérons maintenant les deux termes suivants:

M 1 = let x = ref0 in let y = ref0 in λf.fx; fy M 2 = let x = ref0 in λf.fx; fx
Ils ne sont pas équivalents car M 1 divulgue deux locations différentes via deux callbacks à f, alors que M 2 divulgue la même location. Si l'on essaye de prouver cette équivalence en utilisant nos relations logiques, on se retrouve à construire un span qui contient à la fois (l x , l x ) et (l x , l y ) (où l x , l y représentent les locations liées à x, y), ce qui n'est pas possible de part la définition des spans comme bijections partielles. Cette idée d'utiliser des spans pour relier les locations divulguées est déjà présent dans les travaux de Dreyer et al. [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF] mais quelque peu caché. En effet, dans leur approche, chaque état du système de transitions encode une bijection partielle entre les locations, qui peut alors être utilisée dans le même but. Cependant, cette bijection partielle y est utilisée localement dans la définition de V ref τ w, plutôt que globalement dans la définition des contraintes déduites de w sur les tas, notée (h 1 , h 2 ) : w.

Pour obtenir des résultats de model-checking pour nos relations logiques, qui sont introduites dans le chapitre 7, nous devons contraindre la notion de mondes futures induite par le système de transitions. Dans les travaux précédents [PS98, ADR09, DNB10], un monde futur w ′ de w peut être étendu avec de nouveaux invariants (ou de nouveaux systèmes de transitions d'invariants) sur la partie des tas qui est disjointes des tas décrits par w. Cela découle de l'idée que les mondes sont partitionnés en îles, chacune correspondant à une partie du tas disjointe des autres. Ici, nous interdisons cette possibilité. Ainsi, le système de transitions doit rester fixe dès le départ. Cela suppose que l'on doit prévoir la création des locations futures effectuée par le terme: on appelle de systèmes de transitions omniscient, qui sont donc entièrement défini dès le départ. Ainsi, on établit une distinction claire entre les mondes w, qui sont de simples invariants, et le système de transitions A, qui contraint l'évolution de ces mondes. La définition de nos relations logiques E A τ w dépend alors à la fois du système de transitions A, qui est fixe de manière globale dans la définition inductive des relations logiques, et le monde w qui évolue au sein de la définition.

Par ailleurs, nous avons choisi pour représenter l'évolution des mondes de travailler avec des systèmes de transitions étiquetées (Labeled Transition Systems, abrégé en LTS) plutôt que des systèmes de transitions d'états. Cela permet de garder les systèmes de transitions finis dans de nombreux exemples, ce qui sera explicité dans le chapitre 7. Ces systèmes de transitions sont principalement utilisés pour représenter les contraintes sur les tas a l'aide de couples de pair of pre-et post-conditions entre les tas pris en entrée et les tas obtenus en sortie.

Comme nous allons le voir dans la définition de l'équivalence Σ; Γ ⊢ M 1 ≃ clog M 2 : τ induite par nos relations logiques, deux termes sont équivalents s'il existe un LTS A contraignant les mondes tel que le couple (M 1 , M 2 ) est dans E A τ w pour w "initial" (c'est à dire pour lequel toutes les locations apparaissant dans M 1 , M 2 sont divulguées). Dans le but de prouver la complétude, nous devons alors construire un tel LTS lorsque deux termes M 1 , M 2 ont leur dénotation, issue de la sémantique de traces, égale.

Ainsi, nous définissons une notion plus fine, la sémantique de traces à la Kripke, qui utilise également les mondes pour contraindre les tas apparaissant dans les configurations de la réduction interactive. Cela est particulièrement utile pour contrôler la divulgation des locations, puisque la définition de [Σ; Γ ⊢ M : τ ] présuppose que toutes les locations sont divulgués initialement, ce qui n'est pas préservé par réduction. Cependant, cette utilisation de mondes pour affiner la sémantique de traces est indépendante des LTS. Cela veut dire que nous devons caracteriser les mondes w et les LTSs A ayant les propriétés suffisantes pour s'assurer, à partir du fait que M 1 , M 2 ont des dénotations de traces équivalentes pour le monde w, que (M 1 , M 2 ) ∈ E A τ w. Nous appelons de tels mondes adéquats, dont la définition peut être vue, en première approximation, comme le dual des relations logiques. Plus précisément, nous définissons l'ensemble des mondes adéquats pour deux termes M 1 , M 2 via un prédicat sur les mondes, noté E A τ (M 1 , M 2 ). Ce prédicat impose essentiellement l'existence de tous les mondes futurs de w nécessaires (par rapport à A) pour décrire les évolutions possibles des tas que l'on obtient au cours de la réduction interactive de M 1 , M 2 . Ainsi, à partir de deux termes M 1 , M 2 , on construit un LTS A, que l'on appelle LTS exhaustif, pour lequel le monde initial est effectivement dans

E A τ (M 1 , M 2 ).
Il est construit en utilisant l'ensemble des traces générées par la réduction interactive, en ajoutant un nouvel état pour chaque action de ces traces.

Notons finalement que l'on appelle ici nos relations logiques concrètes pour les distinguer des relations logiques temporelle qui sont introduite dans le prochain chapitre.

Plan du Chapitre Nous commençons par introduire dans la section 6.1 la notion de LTS et de mondes. Ensuite, les relations logiques concrètes pour le fragment formé des termes sans divergence de GroundML, considéré avec l'équivalence contextuelle de RefML, sont définies en section 6.2. Dans la section 6.3, nous introduisons la sémantique de traces à la Kripke, un raffinement du chapitre précédent où les mondes sont utilisés pour contraindre les tas dans la définition de la sémantique interactive. Cette notion est utilisée en section 6.4 pour prouver la la correction des relations logiques concrètes par rapport à la sémantique de traces.

Pour s'attaquer au problème de la complétude, nous introduisons la notion de mondes adéquats dans la section ??, définie de manière duale aux relations logiques, pour contraindre la forme des LTSs à suivre le flot de contrôle des termes. Cette notion est centrale dans la preuve de complétude de la section 6.6, où on utilise un LTS exhaustif, défini en utilisant la réduction interactive, et qui est bien adéquat.

Dans la section 6.7.1, nous esquissons une définition possible des relations logiques concrètes pour l'ensemble de RefML, en utilisant une définition coinductive qui peut être formalisée en utilisant les types récursifs gardés. Il est intéressant de noté que, en travaillant avec une notion fixe de LTS, la circularité usuelle entre la définition des mondes et des relations logiques disparaît. Nous esquissons également dans la section 6.7.2 la définition des relations logiques concrètes pour GroundML, où la notion de backtracking entre états introduite dans [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF], pour relacher la définition des monde futurs, apparait.

Chapitre 7: Relations Logiques Temporelles

Disposant de relations logiques complètes définies de manière directe, on peut imaginer être maintenant capable de les utiliser pour prouver n'importe quelle équivalence. Cependant, en examinant avec attention la preuve de complétude, on peut se rendre compte qu'elle nécessite une notion de LTS exhaustif qui n'est clairement pas calculable.

Cependant, il est souvent possible de définir soi-même des mondes en inspectant la forme de mondes, cherchant ainsi à définir de judicieux invariants sur les tas. Cela ouvre la possibilité de model-checker l'appartenance de deux termes M 1 , M 2 de type τ à la relation logique E τ . Cela signifie que, une fois équipée d'un A representant l'évolution des invariants sur les tas pour M 1 et M 2 , on pourrait decider si M 1 , M 2 sont effectivement dans E A τ w, avec w le monde initial.

En effet, de nombreux choix suivis dans le chapitre 6 pour définir E A τ w étaient faits dans ce but. Le plus important étant de travailler avec un LTS fixe A. Cela ouvre effectivement la possibilité de travailler dans une logique simple dont la sémantique est définie par un modèle de Kripke. L'utilisation d'une telle logique équipée d'un modèle de Kripke a également été utilisé par Dreyer et al. dans [START_REF] Dreyer | A relational modal logic for higher-order stateful ADTs[END_REF], cependant, leur logique est plutôt complexe, à la fois car elle permet de quantifier directement sur les λ-termes, et car l'évolution des mondes y est peu contrainte.

Dans ce chapitre, nous travaillons plutôt dans une logique qui mélange l'arithmétique de Presburger, pour définir les contraintes sur les tas, et la logique temporelle, pour raisonner sur l'évolution des LTS, c'est à dure sur le flot de contrôle. La logique temporelle est d'une grande importance dans le domaine du model-checking, pour prouver des propriétés de sûreté et de vivacité, suivant les travaux précurseurs de A. Pnuely [START_REF] Pnueli | The temporal logic of programs[END_REF]. À notre connaissance, le cadre présenté dans ce chapitre est le le premier à utiliser la logique temporelle pour raisonner sur le flot de contrôle d'un langage fonctionnel impur, dans le but de prouver l'équivalence de programmes.

On définit ensuite les relations logiques temporelle dans cette logique. Pour ce faire, nous commençons par introduire une notion d'exécution symbolique, qui est utilisée pour réduire les termes ayant des variables libres de bases. En pratique, elle effectue simplement une réduction exhaustive, en générant des prédicats qui contraignent les valeurs de valeurs de bases, de telle manière que ces prédicats soient satisfiables tous ensembles si et seulement la réduction est effectivement possible opérationnellement. Grâce à elle, on peut définir les relations logiques temporelles, et établir une correspondance exacte avec les relations logiques concrètes du chapitre précédent.

En toute généralité, le problème du model-checking reste indécidable pour notre logique, et ce pour deux raisons:

-la présence de quantifications sur les tas, qui peuvent être vus comme des listes de taille non bornée, -le mélange entre arithmétique de Presburger et logique temporelle. Cependant, sous des hypothèses réalistes sur l'arité des fonctions de transitions, qui per-mettent de contrôler la quantification sur les tas et les locations, et en supposant que la cloture transitive du LTS est fournie et s'exprime dans l'arithmétique de Presburger, on obtient un model-checking décidable.

Ce travail a donné lieu à une implémentation réalisée dans le langage Haskell. Ce prototype calcule la relation logique temporelle E τ (M 1 , M 2 ) associée à deux termes, mais est également capable, dans certains cas, de générer un LTS qui potentiellement valide cette formule. Il effectue ensuite un traduction de la validité de la formule temporelle par rapport à ce LTS vers SMT-LIB2, le langage commun aux SMT-solveurs. En utilisant le solveur Z3 (http://z3.codeplex.com/), nous avons ainsi été capable de décider de nombreux exemples issus de la littérature. Nous laissons ouvert la possibilité de résultats théoriques sur la génération de LTS. Si nous réussissons à prouver que l'implémentation génère un LTS qui, sous certaines hypothèses sur les termes, est adéquat (comme défini en section 6.5), cela fournirait des résultats de décidabilité pour des fragments de RefML et GroundML.

De tels résultats de décidabilité ont auparavant été obtenus en sémantique des jeux algorithmique, qui se base sur les résultats de pleine adéquation des modèles de jeux. En théorie n'importe quelle équivalence de programme peut être prouvée en regardant simplement l'égalité des stratégies. Cependant, raisonner sur l'égalité des stratégies dans le cadre fonctionnel est non trivial (voir même indécidable [START_REF] Loader | Finitary pcf is not decidable[END_REF]) car le modèle est quotienté par une relation complexe. Pour un langage avec références, il existe une bonne caractérisation du quotient, en utilisant les stratégies complètes, comme nous l'avons vu au chapitre 5.

La sémantique des jeux algorithmique se base sur ce résultat, et utilise la théorie des automates pour représenter les stratégies. Dans un cadre en appel par valeur, un classification complète de la décidabilité de l'équivalence de programmes a été réalisée par Ghica and McCusker [GM00] pour le langage Idealized Algol du premier order. En appel par valeur, une étude récente d'un fragment de ML avec "bad variables" a été développé en utilisant une variante des automates à piles [START_REF] Hopkins | A fragment of ML decidable by visibly pushdown automata[END_REF]. Et en utilisant des automates à registres frais [START_REF] Tzevelekos | Fresh-register automata[END_REF], cette méthode a été étendue aux "bonnes" references [START_REF] Murawski | Algorithmic nominal game semantics[END_REF][START_REF] Murawski | Algorithmic games for full ground references[END_REF]. La principale difficulté à laquelle la sémantique des jeux algorithmique fait face est l'encodage de la structure de pointeurs, dont les parties disposent, vers un langage reconnaissable par des automates. Pour ce faire, le type des termes considérés doit être restreint pour obtenir des résultats de décidabilité. Il serait intéressant de comparer ces résultats à ceux obtenus avec notre méthode, qui nécessite elle un contrôle sur la création des locations plutôt qu'une restriction sur les types.

Plan du Chapitre Nous commençons par définir dans la section 7.1 notre logique HeapTL, qui marie l'arithmétique de Presburger et la logique temporelle. Elle utilise les LTS introduits dans le chapitre 6 pour définir la sémantique des modalités temporelles, et les mondes pour la sémantique des prédicats sur le tas. L'exécution symbolique est introduite en section 7.2, qui joue un rôle crucial dans la possibilité de générer automatiquement

Introduction

While computer programs play an ever broader role in critical systems, from airplanes to medical equipments, the need for formal methods to ensure their correctness becomes unavoidable. Among all formal methods, mathematical proofs of correctness of programs give the highest level of trust we can hope for. But such proofs can be really complex, requiring an automatic check to be performed. This can be done using proof assistants, which are themselves computer programs designed to automatically check if a proof of a theorem is correct. But, to reason on programs, it is necessary to first give them a precise meaning, which is achieved by defining the semantics of the programming language in which they are written. In this thesis, both the language of the proof assistant and the language of the programs to be analyzed come from the same central notion: the λ-calculus.

Functions and Types

The λ-calculus has been introduced by Alonzo Church as a computational model in which "everything is a function", where by functions we mean a syntactical object where the binding of a variable is handled explicitly. Application is then handled by substitution of variables. Such functions, called λ-abstractions, can be annotated with types to abstract over their computation. More precisely, a function is given a type A → B to say that it takes as argument elements of type A and returns elements of type B. This is the so called simply-typed λ-calculus. This language has taken a crucial importance in the field of both proof theory and programming languages.

Indeed, in proof theory, this language is used to represent proofs and formulas via the famous Curry-Howard correspondence . The idea is that a term of type A → B represents a proof of the implication A ⇒ B. Thus, checking the correctness of a proof amounts to typechecking the corresponding term. Of particular importance is the work of P. Martin-Löf, who has extended this correspondence to predicate logic. His idea was to represent a universally quantified formula ∀x ∈ A.P (x) as a dependent type Πx : A.P . To define such dependent types, we must allow terms to appear in types. For example, one can define a type M m,n of rectangular matrix of size m * n, such that the multiplication of matrices would be of type M m,l → M l,n → M m,n . Here, we used numbers l, m, n (which are terms) to refine the type of matrices. This system, called Martin-Löf Type Theory, is the basis of proof assistants such as Coq or Agda. These systems satisfy the so called De Bruijn criterion, i.e. they generate a witness of the proof, namely a λ-term, which can be checked by others means, so that we do not blindly rely on the proof assistant.

λ-calculus also had been at the origin of functional languages. The idea was to come back to the original concept of λ-calculus as a computational model, in order to derive a programming language. This was done firstly in its untyped version by J. McCarthy with LISP and later typed functional languages were conceived, like ML or Haskell. Types are particularly useful to specify programs, following the well-known slogan of R. Milner: "Well-typed programs can't go wrong." This is the so called type-safety property. It can be proven in two different ways, either purely syntactically via the "progress and preservation" method, or by associating to each types τ a set of terms τ which are "safe", the so called semantic types (or realizability) approach.

The λ-calculus will thus be used to build the objects of study of this thesis-functional programs-but also to represent proofs on these objects, via the Curry-Howard correspondence, using a rich (dependent) type theory. However, while the programs we consider are impure-in that they can perform side-effects like divergence or use a persistent memorythe proofs are represented by pure λ-terms which are among others terminating 1 .

As previoulsy explained, a way to specify a functional program is via its type. But the type system must be rich enough if we want to be able to give a precise specification. For instance, this can be achieved by using refinement types [START_REF] Freeman | Refinement types for ml[END_REF] or even dependent type [START_REF] Nanevski | Hoare type theory, polymorphism and separation[END_REF].

Here, we argue that in many cases, the best language to write the specification of a program is its programming language itself. Indeed, when writing a program, it is often the case that we first design a simple version that we trust, then we optimize it. In this case, proving that the simple version is equivalent to the optimized one would give a correctness result for the optimized version.

Of course, for more complex programs, this alternative is not always possible. Particularly interesting examples are compilers. Their correctness is crucial, since they produce low-level code that will be actually run on computers. Indeed, a bug in a compiler could unravel all the efforts done to prove that a program satisfies its specification, by generating incorrect low-level code. This is not a figment of the imagination, as shown in [START_REF] Yang | Finding and understanding bugs in c compilers[END_REF], where dozens of bugs have been found in GCC or LLVM. There have been many works on formalization of correctness of compilers. One of the most impressive is the work of X. Leroy et al. with CompCert [Ler09]. In this formalization, the specification of the compiler corresponds to a simulation between the semantics of the high and the low-level language. However, one can imagine more "modular" specifications for compilers, which allow the interaction of low-level codes produced by two different compilers, or even hand-written. Following ideas from N. Benton et al. [START_REF] Benton | Compiling functional types to relational specifications for low level imperative code[END_REF][START_REF] Benton | Biorthogonality, step-indexing and compiler correctness[END_REF], a possible specification satisfying this modular property can be the conservation of the equivalence of high-level programs into low-level code. This is particularly interesting in order to prove correctness of optimization performed by compilers. While working on this idea [START_REF] Jaber | Krivine realizability for compiler correctness[END_REF][START_REF] Jaber | The journey of biorthogonal logical relations to the realm of assembly code[END_REF], it appeared clear to us that we need a good logical framework to formalize proof of equivalence of programs. This was the starting point of this thesis.

Contextual Equivalence

We have chosen to focus on the notion of contextual equivalence, also called observational equivalence, for impure functional languages. In this setting, two programs are said to be equivalent if no context can distinguish them. Besides its practical interest presented before, this notion is fundamental in denotational semantics, where the goal is to build fully-abstract models. In such models, the denotation of two terms are equal if and only if the two terms are contextually equivalent.

As one can imagine, the expressive power of contexts, seen as programs with "holes", plays a major role in the study of contextual equivalence. In the degenerate case where contexts can inspect the source code of programs, as with low-level programming languages or assembly code, this notion of contextual equivalence completely collapses to syntactical equality: a program can only be equivalent to itself.

In the opposite direction, when contexts are suppose to be "pure", the study of contextual equivalence become quickly undecidable (even without any kind of recursion or infinite types), as shown by Loader in [START_REF] Loader | Finitary pcf is not decidable[END_REF]. In a way, this explains why the quest for a fully-abstract denotational model for PCF2 was a lot harder than for PCF with some side effects.

Here, we are interested in contexts and programs which have a notion of mutable memory. More precisely, we consider the notion of references, which are the standard way to implement memory cells in ML-derived languages such as OCaml. A reference is defined via the constructor ref v, to store the value v in the heap (whereas the arguments given to functions are, as usual, stored in the stack). These references are then reduced to locations, which can be seen as memory addresses. However, compared to low-level languages like C, one cannot perform any pointer arithmetic on locations: they have to be seen as abstract names for memory cells. Values stored in references can be of a higher-order kind, i.e. closures. This allows the performance of recursion.

Using references as a global -persistent-memory, a function can track how many times it is called. Hence, when calling it two times with the same argument, it can possibly return two different results. But contexts can also use references, so that two terms are equivalent only if they perform calls of functions, provided by contexts, in an equivalent way, and with equivalent arguments. This is the idea of synchronization of callbacks, which is false when contexts are pure.

Kripke Logical Relations

In general, contextual equivalence is hard to reason on due to the quantification over all contexts. Some tools have been introduced to avoid this quantification and so to prove contextual equivalence in a simpler way. One of the most used frameworks is that of logical relations, which are of particular importance to define the notion of parametricity following the seminal work of Reynolds [START_REF] Reynolds | Types, abstraction and parametric polymorphism[END_REF]. Logical Relations are a generalization of semantic types, used to prove type safety, to a relational (as opposed to predicate) setting. They are binary relations on values V τ and on terms E τ of type τ . The relation V τ is defined by induction over τ . On ground types, it simply imposes equality of value. On functional types τ → σ, two values λx 1 .M 1 , λx 2 .M 2 are in V τ → σ when :

∀(v 1 , v 2 ) ∈ V τ , ((λx 1 .M 1 )v 1 , (λx 2 .M 2 )v 2 ) ∈ E σ
Then, two terms are in E τ when they reduce to two values which are in V τ . Using these definitions, one can show that two terms of type τ are contextually equivalent when they are in E τ .

However, one cannot extend this definition directly to a language with references. Indeed, in this case, the reduction of a term M depends on the values stored by its references, i.e. in the heap. Thus, A. Pitts and I. Stark [START_REF] Pitts | Operational reasoning for functions with local state[END_REF] have proposed to parametrized the definition of E τ and V τ by invariants on heaps. Such invariants are called worlds, following the intuition of Kripke models. The notion of worlds has later been refined by A. Ahmed [START_REF] Ahmed | State-dependent representation independence[END_REF], and then by D. Dreyer et al. [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF] to state transition systems of heap invariants, to be able to prove equivalences which was out of reach of the definitions of Pitts and Stark.

The Step-Indexing Technique

Kripke Logical Relations given by Pitts and Stark were defined for a language with "ground references", that is references which can store ground values but not functions.

In her PhD thesis [START_REF] Ahmed | Semantics of types for mutable state[END_REF], A. Ahmed extends these definitions to recursive types and higher-order references. To do so, she had to deal with a circularity problem between the definition of worlds and logical relations. Appel Then, unwinding the definition of TypeSem, we get that it is equal to (Loc → TypeSem) → Value. So we would like to define TypeSem as a fixpoint µX.(Loc → X) → Value. However, X appears in a negative occurence in this definition, so in general such fixpoints does not exists. Indeed, one cannot apply the Knaster-Tarski theorem.

This kind of recursive equation can be solved while switching from set-definition to categorical definition. This is what is usually done while working in denotational semantics [START_REF] Scott | Toward A Mathematical Semantics for Computer Languages[END_REF]. More precisely, in Domain theory [START_REF] Scott | Domains for denotational semantics[END_REF], we work in the category of complete partial orders where such equations can be solved. One of the most famous one being D = D → D for pure λ-calculus.

But in this thesis we want to reason operationally on programs, while denotational semantics interprets programs as mathematical objects. So staying in the operational world, Appel and McAllester [START_REF] Appel | An indexed model of recursive types for foundational proof-carrying code[END_REF] have introduced step-indexes to solve this circularity issue. The idea is to stratify the definition of semantic types with a natural number representing roughly the number of steps for which the programs in question behave properly. Thus, the definition of TypeSem and World is now indexed by an integer n, with the following definition :

World n+1 def = Loc → TypeSem n and TypeSem n def = World n → Value n
This was then used by Ahmed to define logical relations first for languages with recursive types [START_REF] Ahmed | Step-indexed syntactic logical relations for recursive and quantified types[END_REF] then for languages with higher-order references, in a work in collaboration with Dreyer and Rossberg [START_REF] Ahmed | State-dependent representation independence[END_REF]. In these works, step-indexes used in the definition of logical relations represent the number of steps for which the two programs in question are equivalent. In this way, it becomes possible to prove the equivalence of many programs that make use of recursive features by performing a simple induction on step-indexes.

But the management of step indexes during a proof appears to be-borrowing a word from Benton-"ugly". In their work on a "very modal model" [AMRV07], Appel, Melliès, Richard and Vouillon have proposed to reason abstractly on step-indexing using Gödel-Löb logic. To do so, they introduce a modality "later", written ⊲, whose meaning (defined via a Kripke semantics) is roughly "true in the future". Then, the so called Löb rule (⊲P → P ) → P , which can be seen as an induction principle, is valid in this logic. It is then used to reason smoothly on recursive programs, as it would be done with explicit step-indexes.

This modality was in fact already used by Nakano [START_REF] Nakano | A modality for recursion[END_REF][START_REF] Nakano | Fixed-point logic with the approximation modality and its kripke completeness[END_REF] to define a λ-calculus with general recursive types which is strongly normalizing. To enforce this normalization property, this modality ⊲ (which is written • in these works) is used to "guard" recursive types.

Forcing Translation

While working on step-indexing and its rephrasing in terms of Gödel-Löb logic, it appeared clear to us that this was a special instance of forcing. By forcing, we mean a general method, originally introduce by P. Cohen [START_REF] Cohen | Set theory and the continuum hypothesis[END_REF], to prove the independence of the continuum hypothesis. This technique has later been restated in many different forms. The most interesting presentation for our purpose is in terms of topos of sheaves or presheaves done by Lawvere and Tierney [START_REF] Tierney | Sheaf theory and the continuum hypothesis[END_REF].

This intuition was then confirmed by the work of Birkedal et al. on the topos of tree [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF], where they have built a model of a type theory with guarded recursive types in terms of presheaves over natural numbers. The way to define Kripke Logical Relations as Logical Relations indexed by a world is also, as we can expect, an example of forcing, via the so called Kripke semantics of modal logic. This idea was explored by Dreyer et al. in [START_REF] Dreyer | A relational modal logic for higher-order stateful ADTs[END_REF], where they define a modal logic to reason on Kripke Logical Relations.

Our goal was then to be able to extend a type theory modularly-more precisely the type theory behind the Coq proof assistant-using this kind of forcing constructions. This has led us to build a general method to define a forcing translation of the whole type theory using an internalization of the presheaf construction, parametrized by a set of forcing conditions. Such a construction allows us to define forcing layers, that is an extension of the ground theory with new logical principle, while keeping the following important properties:

-the consistency of the theory, -the decidability of the type-checking, -the canonicity property, i.e. the fact that closed terms reduce to closed values. Such conservation results are not in general available from semantics methods.

Instantiating the set of forcing conditions, we are then able to build what we call the step-indexed layer, where the construction of guarded recursive types from [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF] can be defined. Working with a type theory with universes, we are additionally able to define a fixpoint operator on functions over types, which allows an internal way of defining guarded recursive types.

Biorthogonal versus Direct Definitions

An other main technique to define logical relations is biorthogonality, or ⊤⊤-closure. Biorthogonality has a long history in proof theory. Indeed, it has been used by J.-Y. Girard to prove cut-elimination of linear logic, and by J.-L. Krivine in his work on classical realizability, to extend the Curry-Howard correspondence to classical logic with the axiom of choice.

It is used with logical relations to define E τ not directly in terms of V τ , but rather as an indirect closure of V τ via an auxilliary relation K τ on contexts.

This definition as a closure is used for three different purposes:

-to reason on languages with context-dependent control-flow features, like the call/cc or jump instructions in assembly code, -to build operational models of both polymorphism and recursion [START_REF] Pitts | Parametric polymorphism and operational equivalence[END_REF], enforcing the admissibility of logical relations, -to get completeness of logical relations, i.e. two terms of type τ which are contextually equivalent are in E τ . In this thesis, we do not consider control operators like call/cc, so that control flow is always sequential. To deal with recursive features of the language, we have seen that stepindexing is in practice enough, so we do not need any admissible condition. So the only remaining reason to use biorthogonality would be to get completeness of logical relations with respect to contextual equivalence.

However, when working with biorthogonal logical relations, we rely in fact on a principle of local invariance [START_REF] Pitts | Operational reasoning for functions with local state[END_REF] which amounts to unwinding the biorthogonality to a direct definition. In fact, the completeness result obtained using biorthogonality is a bit spurious, since it does not mean that we are able to prove in practice any equivalence using these logical relations. This is exemplified by the so called "awkward example" :

M awk 1 = let x = ref 0 in λf.x := 1; f(); !x M awk 2 = λf.f(); 1
To prove that these two terms are equivalent, the state invariant which constrains x to point either to 0 or to 1 is not enough to deduce that the first program returns 1. Thus, the model of Pitts and Stark, which uses worlds as invariants, cannot prove this equivalence, which can seem strange at first sight since it is complete. This is because using the biorthogonality closure to prove equivalence is as hard as reasoning directly on contextual equivalence, when one cannot use the principle of local invariance. Actually, the impossibility to prove this equivalence with the definitions of Pitts and Stark led Ahmed to refine their model, to allow heaps invariants to evolve during the execution [START_REF] Ahmed | State-dependent representation independence[END_REF]. Using the subsequent work of Dreyer et al. [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF], the world used to prove this equivalence is the following state transition system:

x ֒→ 0

x ֒→ 1 which states that once x points to 1, it will never points to 0 again. Using this refined principle, it is then possible to show that M 1 is equivalent to M 2 . Such STSs can in fact be seen as an abstraction of the control flow of the program, only taking into account the modification of the heap.

Operational Nominal Game Semantics

Without biorthogonality, proving completeness of logical relations for a language with references is an open problem. Indeed, one has to reason on the shape of contexts, which is a priori very hard. To tackle this problem, we choose to link logical relation to a denotational model of our language. The obvious choice is game semantics, and more precisely the model developed by A. Murawski and N. Tzevelekos for "good general references" [START_REF] Murawski | Game semantics for good general references[END_REF] 3 which is indeed fully-abstract for RefML. This model uses nominal sets [START_REF] Pitts | Nominal Sets: Names and Symmetry in Computer Science[END_REF] to abstract reasoning on "names" of locations. This idea will also be used throughout this thesis.

This game semantics model does not however fit well with logical relations, as we can see with the following term M :

λ f.let x = ref0 in f(λ .x := 1) in M 1
This term keeps the reference x private, and gives to the context the possibility to change it to 1 via a setter function. But then, it is not possible to relate M 1 to M for two reasons :

-x is private to the term, but the denotation of M 1 is defined as if all its locations were disclosed to the context, -the context has access to the setter λ .x := 1 when M 1 is evaluated, but there is no easy way to specify this with game semantics. To solve these limitations of game semantics, we need to define a new model, following previous work of J. Laird [START_REF] Laird | A fully abstract trace semantics for general references[END_REF]. It shares the good denotational (i.e. categorical) properties of game semantics. with operational ones. The idea is to interpret terms as sets of traces, which represent interactions between a term and any contexts, as in game semantics, but which can be computed operationally via an interactive reduction.

Then, refining this model with worlds to constrain the shape of heaps, we define a notion of Kripke trace semantics. This allows us to make a formal link with Kripke logical relations and therefore to prove their soundness and completeness.

3. "good" as opposed to the so called "bad-variables" which arise from the "object"-representation of references inspired by the work on Idealized Algol by Reynolds.

A TEMPORAL LOGIC TO REASON ON EQUIVALENCE OF PROGRAMS 43

A Temporal Logic to Reason on Equivalence of Programs

To reason on correctness of programs, some logics have been designed, which provide general principles to prove such correctness results. The most famous one is Hoare Logic, which has then be refined with separation logic [START_REF] Reynolds | Separation logic: A logic for shared mutable data structures[END_REF].

Here, we are interested in program logics to reason directly on the equivalence of programs. Plotkin and Abadi logic for parametric polymorphism [START_REF] Plotkin | A logic for parametric polymorphism[END_REF] was the first logic introduced to this end, for System F. Then, Dreyer et al. introduced LSLR [START_REF] Dreyer | Logical step-indexed logical relations[END_REF] and LADR [START_REF] Dreyer | A relational modal logic for higher-order stateful ADTs[END_REF], two logics for richer languages with recursive types and higherorder references. However, all of these logics used λ-calculus as built-in object, and then defined logical relations inside it. If they are well-suited to formalize proof of equivalence, it seems hard to use them to automatically prove equivalence of programs.

In this thesis, we follow a different approach, by defining a simpler logic with good model-checking properties to abstract reasoning on worlds used in our definition of Kripke logical relations. However, compared to step-indexing, this abstraction does not fit well within the framework of the presheaf translation, because some of the constructions used to define Kripke logical relations are not monotonic w.r.t. worlds.

So we define rather a temporal logic to reason on the transition system of worlds. The meaning of the various connectives of this temporal logic are defined via a usual Kripke modal semantics. Compared to [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF], we switch from state transition systems to labeled transition systems, where invariants are specified on transitions using a notion of pre-and post-condition in the spirit of Hoare logic. This is particularly useful to keep transition systems finite.

In previous works [PS98, ADR09, DNB10], a future world w ′ of w could have been extended with new invariants (or new STSs of invariants) on the part of heaps which are disjoint from the one w was specifying. This follows the idea that worlds were partitioned into islands, each one corresponding to a part of the heap disjoint from the others. However, this gives too much freedom to be definable in our restricted logic, where we can quantify only in simple objects. So here, we forbid this usage: the transition system stays fixed from the beginning, which does not change while worlds are evolving. This means that it must have foreseen the creation of future locations made by the term: we call such behavior omniscient.

To reason abstractly on free ground variables, we introduce a symbolic execution for our language which generates all the possible reductions of terms. It also generates a set of predicates which constrain values of ground variables, such that this set of predicates is satisfiable if and only if the reduction is indeed possible. Then, we define temporal logical relations E τ , which are formulas of our temporal logic. From two terms M 1 , M 2 , E τ (M 1 , M 2 ) can be generated automatically using the symbolic execution. One then shows that there exists a world which validate this formula if and only if the two terms are in the usual, "concrete" logical relations. From the soundness and completeness of the concrete logical relation, we reduce the problem of the contextual equivalence of two terms M 1 , M 2 to the model checking of E τ (M 1 , M 2 ), that is: M 1 , M 2 are contextually equivalent if and only if there exists a world w such that

w |= E τ (M 1 , M 2 )
Our temporal logic mixes Presburger arithmetic, used to write arithmetic constrains on stored values, with temporal modalities inspired by the Computational Tree Logic to control the evolution of these constrains. Therefore It does not have in general the good properties of decidability of model checking that temporal logic usually has, due to the interaction with arithmetic.

However, under some reasonable hypothesis on the shape of worlds, we get the decidability of the model checking, that is we can automatically check if a world validates a temporal formula. This is done via translating the formula to a simpler one, which does not contain any temporal modality, which can then be checked by a SMT solver.

It seems possible, under a bounded heap hypothesis, to build automatically a world which validates the temporal formula if and only if the two programs are indeed contextually equivalent. This would give a decidability result 4 for the contextual equivalence for terms satisfying this hypothesis. We believe that this would encompass the decidability fragment of algorithmic game semantics [START_REF] Murawski | Algorithmic nominal game semantics[END_REF], which is characterize by a restriction on types.

Following these theoretical results, a prototype has been implemented in Haskell which:

-generate the temporal formula corresponding to the equivalence of two terms, -translate this formula to a simpler one that a SMT-solver can validate, once a world is provided -under a bounded heap hypothesis, generates a world which validates the formula if and only if the two terms are equivalent.

Overwiew of the Manuscript

In Chapter 3, we present the basic notions used throughout this thesis. We begin in section 3.1 by defining Martin-Löf Type Theory with a hierarchy of universes. Section 3.1.2 introduces identity types following ideas from Homotopy Type Theory. Section 3.1.7 focus on how to get uniqueness of proofs of typing judgments, by explicitly coercing uses of the conversion rule. Section 3.1.8 presents the difference between the type system we have presented and the one behind the proof assistant Coq, which has been used to implement techniques from Chapter 4. Then, section 3.2 presents RefML, a call-byvalue language with higher-order references, which is our object of study. This Chapter ends with section 3.3 which introduces nominal logic, that we use to study RefML, more precisely to reason abstractly on names of variables and locations.

4. As proven in [START_REF] Murawski | Functions with local state: regularity and undecidability[END_REF][START_REF] Murawski | Algorithmic games for full ground references[END_REF], contextual equivalence is in general undecidable for a language with references, even in absence of recursion or infinite types Chapter 4 introduces a new modular way to extend type theory using ideas from forcing, while keeping the decidability of type checking and the consistency of the theory. It uses a presheaf translation of type theory presented in section 4.1, whose formal study is performed in section 4.2. The notion of forcing layer, where the theory can be extended with new principles, is defined in section 4.3 Then section 4.4 introduces guarded recursive types, which are built in the forcing layer using step-indexing.

Chapter 5 defines operational nominal game semantics, a semantics which marries the good denotational properties of game semantics with an operational representation of terms using traces, to be able to perform modular reasoning. In section 5.1, we briefly recall notions of game semantics for RefML. Then, in section 5.2 we introduce trace semantics, firstly with definitions imported from game semantics, then by introducing the interactive reduction which allows us to generate traces from configurations. Section 5.3 provides a formal correspondence between trace semantics and game semantics, and show that the two models gives the same denotation to terms of RefML. We show in section 5.4 that a tweaked version of the interactive reduction, with an explicit management of scopes, captures exactly GroundML. This proof is again done via a correspondence with the game model of RefML, i.e. visibility. Finally, we exemplify in section 5.5 the use of trace semantics for operational reasoning by studying the equivalence of pure terms of RefML (with contexts in RefML).

We introduce concrete logical relations in Chapter 6. They are parametrized over a notion of worlds, whose evolution is governed by a notion of Labeled Transition Systems, introduced in section 6.1. The definition of concrete logical relations is given in section 6.2. To relate these concrete logical relations with trace semantics, we also parametrized traces with world, via a notion of Kripke trace semantics defined in section 6.3. This notion is crucial in section 6.4 to prove soundness of concrete logical relations. To prove completeness we first introduce in section 6.5 a notion of adequate worlds, which are worlds which respect the callback structure. Then, the proof of completeness is done in section 6.6. Finally, we briefly sketch in section 6.7.1 how to extend this work to full RefML, i.e. with higher-order references, and in section 6.7.2 how to restrict it to GroundML.

Finally in Chapter 7 we introduce a temporal logic in section 7.1 to build temporal logical relations. Its definition relies on a symbolic execution for RefML, defined in section 7.2. The definition of temporal logical relations is given in section 7.3, and we present some examples in section 7.4. Its model-checking properties are studied in section 7.5. We prove the soundness and the completeness of these relations with respect to concrete logical relations respectively in section 7.6 and 7.7. In this chapter, we introduce the technical background used throughout this thesis. Firstly, we introduce the type theory used as a metatheory to represent our proofs, namely Martin-Löf Type Theory. Then, we present RefML, a call-by-value language with higherorder references. This is the object of studies of this thesis. We also define a restriction of it, namely GroundML, where references can only store ground values, i.e. natural numbers, booleans or locations. Finally, we introduce the basic ideas of Nominal Logic, to abstract the reasoning on locations and variables of RefML.

Preliminaries

Martin-Löf Type Theory

Following the idea of the Curry-Howard correspondence, proofs can be represented as terms of λ-calculus, and formulas as types. This idea was pursue by Martin-Löf to give a constructive formalism to mathematics. As we have explained in the introduction, he has introduced dependent types to be able to represent existential and universal quantifiers.

This section introduces Martin-Löf Type Theory. Our presentation is highly inspired by [START_REF] Hofmann | Syntax and semantics of dependent types[END_REF] for the general theory and [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF] for the presentation of universes and identity types.

Dependent Type Theory

The fragment of MLTT U restricted to dependent products is given by the following grammar

T, U, M, N := U i | Πx :: .T.U | x | λx : T.M | App (x:T )U (M, N )
with i ∈ N, x ∈ Var where Var is a fixed (infinite) set of variables. This set of terms will be expanded as we introduce new type constructions in our theory.

In MLTT U , there is no syntactical distinction between terms and types, since terms can be used in dependent types. The term App (x:T )U (M, N ), which represent the usual application, is usually written M N , omitting the typing informations (x:T )U . It is used to keep the proof of a typing judgment unique.

A typing context Γ is an ordered list (x 1 : T 1 ), . . . , (x n : T n ) of pairs of distinct variables and types. The empty context is written ⋄. Adding a new element (x : T ) to a context Γ is written Γ, (x : T ), assuming implicitly that x is not already in Γ.

We introduce two judgments :

-Γ ⊢ M : T , which states that M is of type T w.r.t. the typing context Γ of its free variables. wf (Γ), the fact that Γ is well-founded, i.e. writing Γ as Γ 1 , (x : T ), Γ 2 , T is a type in the context Γ. They are defined using inference rules in Figure 3.1, by a mutual induction. The rules for other constructors of MLTT U will be introduced in the next sections.

Even if there is no syntactic distinction between terms and types, when considering the typing judgment Γ ⊢ M : T , we say that M is a term and T is a type. So types always live in some universe U i .

To stress the fact that contexts are ordered lists of pairs of terms and contexts, they are sometimes called telescopes. Indeed, considering Γ = (x 1 : T 1 ) . . . (x n : T n ), we have The usual presentation of MLTT is done with only two universes, U 0 being written as Set, and U 1 as Type. Having no universe U such that Type : U, we cannot write any types Πx : Type.U . This means that this theory is predicative.

WF-Empty wf (⋄) WF-Ctx Γ ⊢ T : U i wf (Γ, (x : T )) Var wf (Γ) (x : T ) ∈ Γ Γ ⊢ x : T Univ wf (Γ) Γ ⊢ U i : U i+1 Univ-Cumul Γ ⊢ M : U i j > i Γ ⊢ M : U j Π-Univ Γ ⊢ T : U i Γ, x : T ⊢ U : U j Γ ⊢ Πx : T.U : U max(i,j) Π-Intro Γ, x : T ⊢ M : U Γ ⊢ λx : T.M : Πx : T.U Π-Elim Γ ⊢ M : Πx : T.U Γ ⊢ N : T Γ ⊢ App (x:T )U (M, N ) : U {N/x}
As in [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF] (and contrary to [START_REF] Hofmann | Syntax and semantics of dependent types[END_REF]), we used Russell-style universes, as opposed to Tarski-style (using the terminology of [START_REF] Martin-Löf | Intuitionistic type theory[END_REF]) where from Γ ⊢ T : U, we cannot directly consider terms M such that Γ ⊢ M : T , but we rather have a new constructor Elem T so that we can have Γ ⊢ M : Elem T . We can see Elem T as an explicit coercion, which is left implicit when working with Russell-style universes.

Tarski-style universes are well-suited when working on categorical models of dependent type theory, since it makes a distinction between the term T of type U, which is interpreted as a morphism of the category, and the type Elem T which is interpreted as an object of the category. However, in the following we are interested only in the syntactic approach, so that Russell-style universes are convenient and more simple to work with.

The hierarchy of universes is cumulative, as shown by the rule Univ-Cumul which states that a term M of type U i can be seen as of type U j for j > i.

There are three typing rules for the dependent product: -Π-Univ, which states in which universe Πx : T.U lives.

-Π-Intro, which is the usual (dependent) rule for typing λ-abstraction. It is used to introduce elements of type Πx : T.U . -Π-Elim, which is the usual rule for typing applications. It is used to eliminate elements of type Πx : T.U .

This schemata with three kind of typing rules will be used when introducing new type constructors to the type system. As explained in the introduction, taking the Curry-Howard glasses, Πx : T.U can be seen as the proposition ∀x : T.U (x). When U does not contains the variable x, the type Πx : T.U corresponds to the usual functional type T → U .

Suppose that we are able to define the type List(n) of list of length n, which can be done using inductive types (or W-types) as present in Coq (Section 3.1.8). Then, List(1 + 2) and List(3) would not be equal. To solve this problem, we introduce a notion of judgmental equality (also called conversion) between terms M, N sharing the same type T , written Γ ⊢ M ≡ N : T . Using it, we can state that if two types T, U are judgmentally equal and M is of type T , then M can be considered as of type U :

Conv Γ ⊢ M : T : Γ ⊢ T ≡ U : U Γ ⊢ M : U
The judgmental equality identifies two β-equivalent terms, as stated with the following rule:

Π-Conv Γ, x : T ⊢ M : U : Γ ⊢ N : U Γ ⊢ App (x:T )U (λx.M, N ) ≡ M {N/x} : U {N/x}
where M {N/x} represent the capture-free substitution of x by N in M . Every new construction introduced in our language comes with a new rule for judgmental equality representing the computational content of the construction.

The judgmental equality is an equivalence relation, but we omit the typing rules which enforce it (cf. [START_REF] Hofmann | Syntax and semantics of dependent types[END_REF][START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF]). It is also a congruence, meaning that from Γ, x : T ⊢ M ≡ M ′ : U and Γ ⊢ T ≡ T ′ : U we get that λx : T.M ≡ λx : T ′ .M ′ : U . Once again, we omit these rules, which can also be found in [START_REF] Hofmann | Syntax and semantics of dependent types[END_REF][START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF]. Notice that each time we add a new construction in the type system, we need to add a rule enforcing that ≡ stays a congruence for this new construction. We will come back to this conversion rules in section 3.1.7, since it allows different proofs of the same typing judgment.

Notice that we work here with a typed judgmental equality. An other possible presentation is to used an untyped conversion T ≡ U with a rule

Γ ⊢ M : T Γ ⊢ M : U T ≡ U
where T ≡ U can be seen as a judgment at a meta-level. In practice, the two presentation are essentially equivalent, as proven by Siles and Herbelin in [START_REF] Siles | Pure type system conversion is always typable[END_REF].

One of the crucial property of MLTT U is the decidability of the typing checking.

Theorem 1 ([ML73, Hof95a]): It is decidable in MLTT U whether a judgment Γ ⊢ M : T is derivable.

Id-Univ Γ ⊢ T : U i Γ ⊢ M, N : T Γ ⊢ M = T N : U i Id-Intro Γ ⊢ T : U i Γ ⊢ M : T Γ ⊢ refl M : M = T M Id-Elim Γ, x, y : T, z : x = T y ⊢ V : U i Γ, w : T ⊢ M : V {w/x} {w/y} {refl w /z} Γ ⊢ N 1 , N 2 : T Γ ⊢ p : N 1 = T N 2 Γ ⊢ ind = ((x,y:T,z:x= T y)V, (w:T )M, N 1 , N 2 , p) : V {N 1 /x} {N 2 /y} {p/z} Id-Conv Γ, x, y : T, z : x = T y ⊢ V : U i Γ, w : T ⊢ M : V {w/x} {w/y} {refl w /z} Γ ⊢ N : T Γ ⊢ ind = ((x,y:T,z:x= T y)V, (w:T )M, N, N, refl M ) ≡ M {N/z} : V {M/x} {M/y} {refl M /z}

Identity Type

We now present the Identity Type, as introduced by Per Martin-Löf [START_REF] Martin-Löf | An intuitionistic theory of types: predicative part[END_REF]. For every pair of terms M 1 , M 2 of type T , we introduce a new type M 1 = T M 2 whose terms are "proofs" that M 1 is equal to M 2 . When M 1 = T M 2 is inhabited, we say that they are propositionally equal, as opposed to judgmentally equal. This notion of propositional equality has been widely studied but it has gain recent tractions through the advent of Homotopy Type Theory [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF]. In that setting, the identity type has been shown to satisfy all the law of a groupoid (actually a weak ∞groupoid) [START_REF] Hofmann | The groupoid interpretation of type theory[END_REF][START_REF] Lumsdaine | Weak ω-categories from intensional type theory[END_REF][START_REF] Garner | Types are weak ω-groupoid[END_REF]. This new insight will be used in Chapter 4 in which we need a careful management of equality.

The typing rules for the Identity Type are given in Figure 3.2. The introduction rule Id-Intro says that two terms that are judgmentally equal are propositionally equal. The elimination rule Id-Elim can be seen as a generalization of Leibniz's principle which states the indiscernability of identicals. Notice that V has x, y, z and T has w as free variables. So ind = ((x,y:T,z:x= T y)V, (w:T )M, N 1 , N 2 , p) has to bound x, y and z in V and w in M . This is represented respectively by the notation (x,y:T,z:x= T y)V and (w:T )M .

The rule Id-Conv just state that we can reduce ind = ((x,y:T,z:x= T y)V, (w:T )M, N 1 , N 2 , p) when N 1 and N 2 are convertible (i.e. judgmentally equal) and p, their proof of equality, is in fact refl M .

Notice that for closed terms M 1 , M 2 , propositional and judgment equality coincide. We can impose that they coincide on any pair of terms with the following reflection rule

Ext Γ ⊢ N : M 1 = T M 2 Γ ⊢ M 1 ≡ M 2 : T
Such a theory is called extensional [START_REF] Martin-Löf | Intuitionistic type theory[END_REF], as opposed to intentional. The problem with this rule is that checking the correctness of a judgment Γ ⊢ M : T , i.e. the type-checking, becomes undecidable. This is why, in the following, we only consider the intentional version of MLTT U , i.e. without the reflection rule.

We now introduce some basic constructions on Identity types that are used in Chapter 4. First, as mentioned above, the Identity Type has the structure of an ∞-groupoid and as such, their exists an inverse for p -1 of type N = T M for every equality proof p of type M = T N , defined as ind = ((x,y:T)y = T x, (w:T )refl w , N 1 , N 2 , p). Similarly, propositional equalities can be composed, and satisfies various laws. We refer the reader to [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF] for details.

Taking V : T → U i a type family over T , we can build a function transport V T of type Πu, v :

T.(u = T v) → V u → V v as λu, v : T.λp : (u = T v).ind = ((x,y:T)(V x → V y), (w:T )λx : (V w).x, u, v, p)
This is useful to rewrite in V an element M into an element N as soon as we have a element of M = T N .

An other interesting construction is ap f which take a function f : T → U , two elements u, v of T and an element of u = T v and return an element of f u = U f v. It is defined as λu, v : T.λp : (u = T v).ind = ((x,y:T).(f x = U f y), (w:T ).refl f w , u, v, p)

Proof Irrelevance

Type Theory is used to formalize mathematics, by formalizing objects of a theory and properties between those objects. Following the Curry-Howard correspondence, elements which inhabit properties on objects represent proofs. However, in mathematics, the proof of a property does not depend in general on the proof of others properties, but just on the fact that they are true, i.e. inhabited. This idea is called proof-irrelevance. Thus, when we have Γ ⊢ M : P where P represents a property (for example that the set of prime numbers is infinite), the only important fact is that P seen as a type is inhabited. This means that if we have an other term N such that Γ ⊢ N : P , we would like to get that M and N are propositionally equal. To do so, we define the predicate isProp U as λP : U.Πx, y : P. x = P y so that when Γ ⊢ P : U, we have isProp U (P ) which represents exactly this idea. The types P which satisfies isProp U (P ) are called mere propositions.

Using this predicate, we can define the notion of sets, as type whose equality on elements is a proposition, i.e. which satisfies the so-called Uniqueness of Identity Proofs (UIP). It is represented by the predicate isSet U defined as Notice that isProp U (P ) and isSet U (A) are themselves mere propositions, as proven in [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF].

λA : U.Πa, b : A. isProp U (a = A b). Γ ⊢ M, N (x:T )U : Σx : T.U Γ ⊢ π 1 M, N (x:T )U ≡ M : T Γ ⊢ M, N (x:T )U : Σx : T.U Γ ⊢ π 2 M, N (x:T )U ≡ N : U {N/x} Conv-Proj2
Homotopy Type Theory [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF] is interested in studying higher-order generalization of this idea, called n-Types. For example, we could consider the predicate is1-Type U defined as λA : U.Πa, b : A. isSet U (a = A b). The study of such higher types, and more particularly the status of the axiom of univalence, goes beyond the scope of this thesis.

The goal of this work is to reason on Programming Language, for which the notion of sets seems enough for the formalization. In particular, in Chapter 4, we work with MLTT U + UIP and thus is incompatible with univalence and implies that all types can be seen as sets. Nevertheless, we have tried to be as independent from UIP as possible, so that the work could be generalized to MLTT U .

Dependent Sums and Subset Types

We now introduce the notion of product between two types, such that the second component of the product can depend on the first component. Such a type is called a Dependent Sum.

Taking a type T : U i and a type family U : T → U i , we can form a new type, called a dependent sum and written Σx : T.U . The inhabitants of this types are pairs M, N (x:T )U with M : T and N : T {N/x}. Moreover, from a pair M, N (x:T )U , we wish to retrieve M and N . This is done using the usual projections π 1 , π 2 , such that if M : Σx : T.U then π 1 M : T and π 2 M : U {π 1 M/x}. And since we want to compute with pairs, we need the conversion rules π 1 M, N (x:T )U ≡ T M and π 2 M, N (x:T )U ≡ U {π 1 M/x} N . All of this is summed up in Figure 3.1.4.

When the type family U : T → U i is constant, i.e. it does not depend on T , the dependent sum Σx : T.U correspond to the usual Cartesian product, and is written T × U . Then, taking M : T × U we have π 2 M : U since there is no more dependency of U over T .

The projections π 1 and π 2 provide a too weak elimination form because M is not convertible to π 1 M, π 2 M (x:T )U in general. So the general elimination of a dependent sum can not be deduced from π 1 and π 2 . That is, we need to introduce a stronger rule Elim-Σ for elimination of dependent sums:

Γ, z : Σx : T.U ⊢ V : U Γ, x : T ; y : U ⊢ N : V x, y (x:T )U /z Γ ⊢ M : Σx : T.U Γ ⊢ ind Σ ((z:Σx:T.U)V, (x:T,y:U )N, M ) : V {M/z}
Notice that N has x and y as free variables, which do not appear in Γ, so we need to bound them using the special notation (x:T,y:U ). This means that ind Σ actually binds z in V and x, y in M . This rule is similar to the usual elimination of existential quantification in Sequent Calculus. This is not a surprise since under the Curry-Howard correspondence, Σx : T.P is seen as the usual quantification ∃x : T.P (x).

The conversion rule of ind Σ is given by the following rule Conv-ind Σ :

Γ, z : Σx : T.U ⊢ V : U Γ, x : T ; y : U ⊢ N : V x, y (x:T )U /z Γ ⊢ M 1 : T Γ ⊢ M 2 : U {M 1 /x} Γ ⊢ ind Σ ((z:Σx:T.U)V, (x:T,y:U )N, M 1 , M 2 (x:T )U ) ≡ N {M 1 /x} {M 2 /y} : V M 1 , M 2 (x:T )U /z
The two projections can in fact be defined using ind Σ as π 1 = ind Σ ((z:Σx:T.U)T, (x:T,y:U )x, M ) π 2 = ind Σ ((z:Σx:T.U)U, (x:T,y:U )y, M )

We easily check that the rules Conv-Proj1 and Conv-Proj1 are then just special instances of Conv-ind Σ . Taking M : T , it can exist different N : U {M/x} such that M, N (x:T )U : Σx : T.U . However, when U is a family of mere proposition, there is unicity of such N . So taking Γ, x : T ⊢ P :→ U a family of types such that Γ, x : T ⊢ isProp U (P ) (i.e. for all x : T , P is a mere proposition), the dependent sum Σx : T.P is called a subset type, and is written {x : T | P }. By an abuse of notation, we write Γ ⊢ M : {x : T | P } when there exist N such that Γ ⊢ M, N (x:T )U : Σx : T.P . We call P a proof obligation of M , and we refer to N as M.P . We also write Σx : T.P, Q for Σx : T.P ∧ Q.

Using subset types, we can define types Prop U i and Set U i as {P :

U i | isProp U i P } and {X : U i | isSet U i X},
since isProp and isSet are mere propositions.

Empty and Unit Types

We now introduce two new types: Seen as propositions, they correspond respectively to True and False. A proof of the non-existence of an inhabitant of 0 corresponds thus to the consistency of our system. Indeed, for any type T : U i , we can define the following term λx : 0.ind 0 (T, x) which is of type 0 → T . So if 0 is inhabited, then any type is!

0-Univ wf (Γ) Γ ⊢ 0 : U i 0-Elim Γ, x : 0 ⊢ V : U i Γ ⊢ N : 0 Γ ⊢ ind 0 ((x:1)V, N ) : V {N/x} 1-Univ wf (Γ) Γ ⊢ 1 : U i 1-Intro wf (Γ) Γ ⊢ ⋆ : 1 1-Elim Γ, x : 1 ⊢ V : U i Γ ⊢ M : V {⋆/x} Γ ⊢ N : 1 Γ ⊢ ind 1 ((x:1)V, M, N ) : V {N/x} 1-Conv Γ, x : 1 ⊢ V : U i Γ ⊢ M : V {⋆/x} Γ ⊢ ind 1 ((x:1)V, M, ⋆) ≡ M : V {⋆/x}

Coproduct and Natural Number Type

We are still missing some important basic objects in our theory, like disjoint union and natural numbers. We now introduce new types and type constructors to build them.

First, we construct coproduct types, which are a way to build a disjoint union of two types. Its typing rules are defined in Figure 3.5. Taking two terms M l :

T 1 → U 1 and M r : T 2 → U 2 , we define lift + (T 1 +T 2 ,U 1 +U 2 ) (M 1 , M 2 ) of type T 1 +T 2 → U 1 +U 2 as λz : T 1 +T 2 .ind + (U 1 +U 2 , (x:T )(M l x), (y:U )(M r y), z).
Using coproducts, we can define the type of Booleans, written Bool, simply as 1+1. Then, defining true as inl(⋆) and false as inr(⋆), we can use the non-dependent version of ind + to perform case analysis (Figure 3.6).

Finally, we define the type Nat of natural numbers. It is inhabited by a term 0, and a successor function S take a natural number as argument to build a new one. Thus the Compare to the eliminator for coproducts, the one for Nat has one main difference, namely the fact that M S has en extra free variable y of type V . This variable allows the induction hypothesis to build the term which inhabit V .

Bool-ConvR Γ ⊢ V : U i Γ ⊢ M 1 : V Γ ⊢ M 2 : V Γ ⊢ ind + (V, M 1 , M 2 , false) ≡ M 2 : V Figure 3.6: MLTT U Type System: Booleans Nat-Univ wf (Γ) Γ ⊢ Nat : U i Nat-Intro0 wf (Γ) Γ ⊢ 0 : Nat Nat-IntroS Γ ⊢ M : Nat Γ ⊢ S(M ) : Nat Nat-Elim Γ, x : Nat ⊢ V : U i Γ ⊢ M 0 : V {0/x} Γ, x : Nat, y : V ⊢ M S : V {S(x)/x} Γ ⊢ N : Nat Γ ⊢ ind Nat ((x:Nat)V, M 0 , (x:Nat,y:V )M S , N ) : V {N/x} Nat-Conv0 Γ, x : Nat ⊢ V : U i Γ ⊢ M 0 : V {0/x} Γ, x : Nat, y : V ⊢ M S : V {S(x)/x} Γ ⊢ ind Nat ((x:Nat)V, M 0 , (x:Nat,y:V )M S , 0) ≡ M 0 : V {0/z} Nat-ConvS Γ, x : Nat ⊢ V : U i Γ ⊢ M 0 : V {0/x} Γ, x : Nat, y : V ⊢ M S : V {0/x} Γ ⊢ N : Nat Γ ⊢ ind Nat ((x:Nat)V, M 0 , (x:Nat,y:V )M S , S(N )) ≡ M S {S(N )/x} {M ′ /y} : V {S(N )/x} with M ′ = ind Nat ((x:Nat)V, M 0 , (x:Nat,y:V )M S , N )
Using ind Nat , we can define the addition function plus of type Nat → Nat → Nat as λn : Nat.λm : Nat.ind Nat ((x:Nat)Nat, n, (x:Nat,y:Nat)S(y), m).

In practice, it is often easier to define new functions via pattern-matching rather than using ind Nat . For example, the addition function plus can be defined as

λn : Nat.λm : Nat.match n with | 0 => m | Sn ′ => S(plus n ′ m)
Defining such recursive terms with pattern-matching instead of the eliminator on Nat is not always possible. Here, it is possible because plus is recursively called on n ′ which is strictly smaller than n = Sn. However, when it is clear how to define such terms with pattern-matching with ind Nat , we will allow us to use them.

Type Theory with Explicit Coercions

A proof of Γ ⊢ M : T is not unique in general, because the conversion rule can be applied silently at various places. This is usually not problematic but in the forcing translation defined in Chapter 4, we need to make explicit the conversion rule. This rises two issues: (i) the translation may depend on the actual choice of the application of the conversion rule, (ii) the existence of a typing judgment with explicit is not guarantee.

The problem of making the conversion explicit already has already been considered by Curien et al. when defining a categorical interpretation of Martin-Löf Type Theory [START_REF] Curien | Substitution up to isomorphism[END_REF][START_REF] Curien | Revisiting the categorical interpretation of dependent type theory[END_REF]. It has also been studied by Geuvers et al. in [START_REF] Geuvers | A logical framework with explicit conversions[END_REF][START_REF] Van Doorn | Explicit convertibility proofs in pure type systems[END_REF], for Martin-Löf Logical Framework and more generally for any Pure Type System.

They both propose to introduce a new typing judgment Γ ⊢ e M : T , which is defined in the same way than Γ ⊢ M : T but for the rule Conv, which uses an explicit coercion c T,U (M ):

Conv Γ ⊢ e M : T : Γ ⊢ T ≡ U : U Γ ⊢ e c T,U (M ) : U
The introduction of this explicit coercion can be seen as a way to transform an extentional theory to an intentional one, as presented in [START_REF] Hofmann | Extensional concepts in intensional type theory[END_REF][START_REF] Oury | Extensionality in the calculus of constructions[END_REF].

In [START_REF] Curien | Substitution up to isomorphism[END_REF][START_REF] Curien | Revisiting the categorical interpretation of dependent type theory[END_REF], this explicit coercion is handled by adding new judgmental equalities in the system. To be even more explicit, those new equalities should also appear explicitly in a term. So a complete language for describing coercions should be developed, as done for instance in a simpler setting in [START_REF] Curien | Theoretical aspects of object-oriented programming[END_REF]. However, they have refrained to do so, invoking "a heavy notational apparatus".

In [START_REF] Geuvers | A logical framework with explicit conversions[END_REF], the explicit coercion is handled using an heterogeneous notion of equality (a.k.a. JMEq, as introduced by Conor McBride [START_REF] Mcbride | Dependently typed functional programs and their proofs[END_REF]). Using such an heterogeneous equality only makes sense in presence of UIP.

In both work, it is possible to define a function | | which transforms a term of MLTT e U to a term of MLTT U by simply removing all the explicit conversion coercions, so that c T,U (M ) is transformed into M . This function is extended straightforwardly to contexts.

Their system satisfy the two following theorems. Unfortunately, we can not reuse the work of Curien et al. out of the box because the type theory we consider is intentional and without explicit substitutions. However, a formal study of this system goes beyond the scope of this thesis and we assume that an operation | | satisfying Theorems 2 and 3 also exists for MLTT e U . That is, we leave the expression of judgmental equality on c T,U (M ) and the proofs of the corresponding theorems as future work.

Nevertheless, we will use in Chapter 4 the fact that those equalities correspond to equality satisfies by transport λT,T U because c T,U (M ) is a rewriting using the judgemental equality on types in the same transport λT,T U is a rewriting using the propositional equality.

The Type System of Coq

A variant of the type system we have presented have been implemented in the proof assistant Coq. It is based on the Calculus of Inductive Constructions (CIC), which differs in some points to MLTT U . We briefly review the differences because Coq is the proof assistant in which the forcing translation of Chapter 4 has been implemented.

First, CIC has a special universe, Prop, to represent propositions, rather than being define internally in the theory using a predicate isProp as we have done in Section 3.1.3. This universe is impredicative in the sense that the dependent product ΠP : Prop.Q is of type Prop, when Q is of type Prop. Prop can in fact be identified with Prop U as defined in 3.1.4, and impredicativity can be recovered from a propositional resizing axiom [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF], which states that there exists an equivalence between Prop U i+1 and Prop U i . In Coq, propositions do not automatically satisfies proof-irrelevance, but we can suppose it using an axiom. The other universe U i are noted Type i , but for U 0 , which is noted Set.

CIC has inductive types as built-in features, which are used to define Dependent Sums, Coproducts, Empty and Unit Type, Natural numbers and more importantly, the Identity Type. The Identity Type is usually defined in Coq as going into the universe Prop, i.e. taking T : Type and M, N : T we have T = N M : Prop. This is coherent with the fact that T = N M is indeed seen as a proposition, however, when working with a proof-irrelevant universe Prop, this imposes Uniqueness of Identity Proof, so that every type is a set.

Call-By-Value Languages with References

We now introduce the programming languages which are the objects of study of this thesis. They are fragments of ML, namely typed functional languages with a call-by-value reduction and nominal references.

In its unrestricted form, the language that we consider has higher-order references i.e. it can store functions into references. We call this language RefML.

Syntax and Operational Semantics of RefML

The grammar of types of RefML is

τ, σ def = Unit | Bool | Int | ref τ | τ → σ.
We write Types for the set of types generated by this grammar. A type is said to be ground (or non-functional

) if is not equal to τ → σ. So ref (τ → σ) is among others ground.
The syntax of values, terms and applicative contexts of RefML is given by

v def = () | true | false | n | x | l | λx : τ.M | Ω τ (where n ∈ Z, l ∈ Loc) M, N def = v | M N | M + N | if M 1 then M 2 else M 3 | M == N | ref M | !M | M := N C def = • | λx : τ.C | CM | M C | C + M | M + C | if C then M else M ′ | ref C | !C | C := M | M := C | C == M | M == C K def = • | KM | vK | K + M | v + K | if K then M else M ′ | ref K | !K | K := M | v := K | K == M | v == K
where v denotes values, M denotes terms, C denotes contexts and K denotes applicative contexts. Applicative contexts are particular kinds of contexts, the ones which reduce directly terms that fill their hole •. We use special terms Ω τ for each type τ that always diverge. As usual, let x = N in M is defined as (λx.M )N and M ; N is defined as (λx.M )N with x fresh in M .

Locations live in sets Loc τ where τ is the type of values they are storing. We define Loc as ∪ τ Loc τ and Loc φ as ∪ σ,τ Loc σ→τ . There is no way to perform any arithmetic on locations. That is, taking l ∈ Loc, l + 1 is not a valid term (it is not well-typed as we will see). However, it is possible to compare locations, i.e. taking l 1 , l 2 ∈ Loc τ , l 1 == l 2 is a valid term.

Heaps h are defined as finite partial maps Loc ⇀ Val respecting types, i.e. h(l) is a closed value of type τ when l ∈ Loc τ . The empty heap is written ε. Adding a new element to a partial map h is written h • [l ֒→ v], and is defined only if l / ∈ dom(h). We

(K[(λx.M )v], h) → (K[M {v/x}], h) (K[ n + m], h) → (K[ n + m], h) (K[ n == m], h) → (K[true], h) (n = m) (K[ n == m], h) → (K[false], h) (n = m) (K[Ω τ ], h) → (K[Ω τ ], h) (K[l == l], h) → (K[true], h) (l = l ′ ) (K[l == l ′ ], h) → (K[false], h) (l = l ′ ) (K[!l], h) → (K[v], h) (h(l) = v) (K[ref v], h) → (K[l], h • [l ֒→ v]) (l / ∈ dom(()h)) (K[l := v], h) → (K[()], h[l ֒→ v]) (l ∈ dom(h)) (K[if true then M 1 else M 2 ], h) → (K[M 1 ], h) (K[if false then M 1 else M 2 ], h) → (K[M 2 ], h) Figure 3.8: Operational Semantics of RefML also define h[l ֒→ v], for l ∈ dom(h), as the partial function h ′ which satisfies h ′ (l ′ ) = h(l ′ ) when l ′ = l, and h ′ (l) = v. The restriction of a heap h to a set of locations L is written h |L . A heap is said to be closed when, for all l ∈ dom(h), if h(l) is itself a location l ′ then l ′ ∈ dom(h). Taking a set L of locations and h a heap, we define the image of L by h, written h * (L) as h * (L) def = j≤0 h j (L) and h 0 (L) = L, h j+1 (L) = h(h j (L)) ∩ Loc.
Using it, we define Cl(L), the set of minimal closed heaps whose domain contains L, as

Cl(L) def = {h | dom(h) = h * (L), ∀l ∈ dom(h), ν L (h(l)) ⊆ dom(h)}.
The small step operational semantics of RefML, written (M, h) → (M ′ , h ′ ), is defined in Figure 3.8. We write M {v/x} to represent the (capture-free) substitution of x by v in M.

This reduction is deterministic, so we suppose that the reduction

(K[ref v], h) → (K[l], h • [l ֒→ v]) chooses a location l / ∈ dom(h).
We also consider the non-deterministic reduction → nd , defined in the same way but for the rule of allocation, which is such that

(K[ref v], h) → nd (K[l], h • [l ֒→ v]) for any l /
∈ dom(h). For example, the term ref 1 == ref 1 reduces to false. Note that, when working with references which can only store integers (or booleans), the equality on locations can be encoded using the following term (as shown for example in [START_REF] Pitts | Operational reasoning for functions with local state[END_REF]):

λx : ref Int.λy : ref Int.let v =!x in ((x :=!y + 1); let b = (!x ==!y) in (x := v; b))
The idea is simply to test if x and y are aliased, by modifying x and checking if y has also been modified. However, it seems impossible to encode the equality on locations of type ref Unit, as we cannot use the modification x :=!y + 1 or any other modifications (since () is the only inhabitant of Unit) to test if x, y are indeed aliased.

With higher-order references, usual fixpoints fix f(x).M of type τ → σ can be defined using the so-called Landin's Knot :

let y = ref (λx.Ω τ →σ ) in y := (λx.let f =!y in M); !y
where Ω τ →σ is a term of type τ → σ which always diverges (like undefined in Haskell or Obj.Magic in OCaml).

One has

(fix f(x).M, h) → (λx.let f =!l y in M, h • [l y ֒→ λx.let f =!y in M]
). So taking a value of type τ , we get the following reduction

((fixf(x).M)v, h) → * (M {v/x} {l y /f}, h • [l y ֒→ λx.let f =!y in M])
As we see, the term M accesses to the recursive call f via the heap.

In the following, we write E for terms which are either values or of the form K[f v] with f a free variable and v a value. These last terms are called callbacks. One cannot reduce these two kinds of terms.

Typing Rules

We now introduce the typing judgments of RefML. To deal with creation of locations, we use a special context Σ which assign a type to the values a location can store. This is because locations, in contrast to variables, can have only one fixed type. So typing judgments are of the form Σ; Γ ⊢ M : τ , where Γ is a variable context and Σ = (l 1 , . . . , l n ) is a location context. Notice that we do not need to indicate the types of locations of l in Σ, since the membership l ∈ Loc τ already gives its type. The typing rules of RefML are given in Figure 3.9. When Σ is empty, we simply write Γ ⊢ M : τ

We write FV(M ) for the set of free variables appearing in M . In the following, we make a clear distinction between variables of ground types and variables of functional types. Indeed, we deal abstractly with variables of functional types in most of this thesis, beginning with Chapter 5. So we are particularly interested in terms for which all its free variables are of functional types. Such terms are called ground-closed. Abstract reasoning on variables of ground types will be introduced in Chapter 7 by using symbolic execution.

In the following, we write Σ; Γ g , Γ f ⊢ M : τ to distinguish between typing contexts Γ g , Γ f containing respectively ground type variables and functional type variables.

The relational environment associated to Γ, i.e. the set of (x, x, τ ) such that (x, τ ) ∈ Γ, is written Γ. The relational environment Σ is defined in the same way. From a typing context Γ and a function γ : Var ⇀ Val, we say that γ is a substitution on Γ-written γ : Γ-if γ is defined exactly on all the variables occurring in Γ, and γ(x) is a value of type τ whenever (x, τ ) ∈ Γ. Then, the action of the substitution γ on a term M , defined as M -------→ {γ(x i )/x i } with x i ranging over Γ, is written γ(M ).

Contextual Equivalence

We now define contextual (or observational) equivalence.

Σ; Γ ⊢ M : ref τ Σ; Γ ⊢ N : τ Σ; Γ ⊢ M := N : Unit
; Γ ⊢ M 1 ≃ ctx M 2 : τ , when ∀h ∈ Cl(Σ). ∀C s.t. Σ; • ⊢ C[M i ] : Unit. (C[M 1 ], h) ⇓⇔ (C[M 2 ], h) ⇓).
where we write (C[M 1 ], h) ⇓ for the fact that this term reduces to ().

Using closed heaps containing Σ enforce the reduction of (C[M i ], h) to not being stuck, i.e. either to always reduce to () or to diverge. This is equivalent to the usual definition, which quantifies over extended location context Σ ′ ⊆ Σ and (closed) heaps h ′ : Σ. We prefer here to with Cl(Σ) since it allows us to remove the quantification over Σ ′ ⊆ Σ.

When studying contextual equivalence of two terms, the notion of disclosure is central. Let consider the term

M 1 = let x 1 = ref0 in let x 2 = ref0 in λf : (ref Int → Unit).f x 1 ; x 1 := 1)
then we say that M 1 discloses the location associated to x 1 to the context. Notice that M 1 is not equivalent to

M 2 = let x 1 = ref0 in let x 2 = ref0 in λf : (ref Int → Unit).f x 2 ; x 1 := 1)
even if the two terms reduces to Unit if the callback f does not diverge. This is because M 2 discloses the location associated to x 2 , and that the context can check if the location disclosed via f stores 0 or 1. Such a context which discriminates the two terms is

let g = • in g (λy : ref Int.g (λ .if !y == 0 then Ω Unit else Unit))
One can also consider indirect disclosures, when terms provide functions to callbacks which allows the context to modify the heap. For example, the following term

let x = ref0 in λf : ((Int → Unit) → Unit)ref Int → Unit).f (λn : Int.x := n)
which disclose to the context the setter λn : Int.x := n. Using it, the context can modify as it wants the location linked to x even if it has not been directly disclosed.

GroundML

In this thesis, we also consider GroundML, a restriction of RefML with only full ground references, i.e. references which can store integers or other full ground references. It is formally defined as the set of terms of RefML whose type do not contain any subtypes ref (τ → σ), and which do not contain any subterms of the form ref M with M functional.

In GroundML, we cannot define diverging terms anymore via higher-order references, so we rely on the terms Ω τ for each type τ that always diverge. It is particularly important to have such diverging terms when studying contextual equivalence. Indeed, without it, one cannot define the contextual equivalence of M 1 , M 2 as equi-termination of C[M 1 ] and C[M 2 ] for all (well-type) contexts C, since contexts cannot diverge anymore. We sometimes need to consider divergent-free terms of GroundML, i.e. terms where no Ω τ appear, but their contextual equivalence is still defined with possibly diverging contexts.

The contextual equivalence for GroundML is coarser than the one for RefML. Indeed, contexts of GroundML have less power than the one of GroundML. This is due to the fact that contexts cannot store higher-order values, like setter or getter, disclosed by the term. So they can only used such disclosed functions in their scope. This intuition is formally expressed by the so-called "differed divergence" example, taken from [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF], which exhibits two terms which are equivalent in GroundML, but not in RefML:

   let y = ref false in λf.f(λ .y := true); if !y then Ω Unit else () λf.f(λ . Ω Unit ).

Nominal Reasoning

When formalizing proofs on λ-calculus, one always reasons up-to α-equivalence. That is, two terms which differ only w.r.t. the name of their bound variables are considered to be equivalent. The same is true for name of locations, since no pointer-arithmetic is allowed on them. To formalize the logic behind this situation, Nominal Logic has been introduced by A. Pitts [START_REF] Pitts | Nominal logic, a first order theory of names and binding[END_REF]. The idea is to see objects which are defined using variables or locations only up-to permutation. This is formalized using the notion of Fraenkel-Mostowski sets, called nominal sets here, which are sets equipped with a permutation actions over a set of names (which will be the set of variables or locations here).

Nominal Sets

Let fix a set of names A and consider the group of finite permutation Perm(A) of A, i.e. the bijections π of A such that the set {a ∈ A | π(a) = a} is finite. We write id A for the unit of this group, i.e. the identity permutation.

Definition 2. A (A-)nominal set is a set X equipped with a group action of Perm(A), that is an application * : X × Perm(A) → X which satisfies ∀t ∈ X, ∀π 1 , π 2 ∈ Perm(A), π 1 * (π 2 * t) = (π 1 • π 2 ) * t and id A * t = t.
We omit to indicate A when it is clear from the context. A subset S of A is said to support an element t of a nominal set X when

∀π ∈ Perm(A).(∀a ∈ S.π(a) = a) ⇒ π * t = t.
The smallest subset of A which support t is called the support of t, written ν A (t). Terms of RefML can be seen as a nominal set over both Loc and Var. Then, the support of a term is -its set of locations if it is seen as nominal over Loc, -its set of free variables if it is seen as nominal over Var. Two elements t, u of a (A-) nominal set X are said to be nominally-equivalent, written

t ∼ A u if there exists π ∈ Perm(A) such that t = π * u holds. A subset Y of a nominal set X is A-nominal closed if for all t ∈ Y and t ′ ∼ A t, t ′ ∈ Y .
The set of names we consider, like Loc or Var, are in fact decomposed with respect to types. That is, we can write A as τ A τ . So, we restrict our attention to finite permutations which conserve types. It means that taking π ∈ Perm(A) and a ∈ A τ , we impose that π(a) ∈ A τ . We can easily check that type-preserving finite permutations still form a group. Such type-preserving finite permutations can in fact be decomposed as finite permutations over each A τ , as done in the PhD thesis of Nikos Tzevelekos [START_REF] Tzevelekos | Nominal game semantics[END_REF].

Spans

We sometimes need to be explicit in the permutation when working with two nominally equivalent elements t, u of a nominal set X. However, when this is the case, it is more convenient to work with (typed) spans rather than (typed) permutations because they are easier to extend than permutations. Spans have indeed already been used by Stark to reason on locations, when defining logical relations for the ν-calculus [START_REF] Stark | Names, equations, relations: Practical ways to reason about new[END_REF].

Definition 3. A typed span S : A ⇋ A is a collection of pairs of partial finite injections A τ ←֓ S τ ֒→ A τ for each type τ .
Thus, a span is a particular kind of relation on names; it is a partial finite bijection on A. As a set, one can see it in two ways:

-as a collection of sets

S τ ⊆ A τ × A τ s.t. for all (a 1 , a 2 ), (a ′ 1 , a ′ 2 ) ∈ S τ . ((a 1 = a ′ 1 ) ⇒ (a 2 = a ′ 2 )) and ((a 2 = a ′ 2 ) ⇒ (a 1 = a ′ 1 )) -or as a set S ⊆ A × A × Types s.t. for all (a 1 , a 2 , τ ), (a ′ 1 , a ′ 2 , τ ′ ) ∈ S τ . ((a 1 = a ′ 1 ) ⇒ ((a 2 = a ′ 2 ) ∧ (τ = τ ′ )) and ((a 2 = a ′ 2 ) ⇒ (a 1 = a ′ 1 ) ∧ (τ = τ ′ )).
We often naviguates between these two representations.

We write ε for the empty span (i.e. the empty set). The image of a span S by the left (resp. right) injection is written S 1 (resp. S 2 ). Then, we write the extension of a span S at type τ with (a 1 , a 2 ) ∈ A τ , as S • (a 1 , a 2 , τ ) (the type τ could in fact be omitted in this notation), when a 1 / ∈ S 1,τ and a 2 / ∈ S 2,τ . We say that S ′ extends S, written S ′ ⊒ S, when S ′ is a span which includes S as a set.

A span S induces a finite permutation π S : A → A, using the so-called "Homogeneity Lemma" of [START_REF] Pitts | Nominal logic, a first order theory of names and binding[END_REF] (Lemma 1.14). Then, we define a restriction of the nominal equivalence ∼ A with respect to a span S, written X ∼ S Y , if there exists a permutation π extending π S such that X = π * Y .

Reciprocally; from a finite permutation π S : A → A, one can define a span formed by the (a, π(a), τ ) for all τ and a ∈ A s.t. a = π(a). Forcing is a method originally designed by Cohen to prove the independence of the Continuum Hypothesis from the axiomatic set theory ZFC [START_REF] Cohen | Set theory and the continuum hypothesis[END_REF]. The main idea is to add new objects which can be approximated in the ground system, using what is called forcing conditions. More precisely, a ground model

M is extended to a new model M[G] by adding a new generic element G to M. As M[G] is in general really complicated, P.
Cohen has proposed to control the true propositions in M[G] by translating them into M. To do so, he has used forcing conditions, which have to be seen as approximations of G. Such forcing conditions live in M while it is not the case for the generic element G. Thus, from a formula ϕ of M[G], the idea is to build syntactically a formula p φpronounced "p forces φ"-that lives in M, and such that ϕ will be true when there is a "correct" approximation p of G such that p φ in M. One key property of the set of forcing conditions is that they are ordered. Intuitively, we have p ≤ q when p is a more precise approximation of G than q, i.e. contains more information, so the relation has to be monotonic for this order.

During the past few years, forcing has received increasing attention as a way to extend the Curry-Howard correspondence to various classical reasoning. Indeed, forcing was generalized by Krivine in his work on classical realizability [START_REF] Krivine | Realizability in classical logic[END_REF], where forcing conditions where taken as λ-terms. He has then combined this approach with usual forcing in [START_REF] Krivine | Realizability algebras: a program to well order R[END_REF] to give a computational content of various weak form of the axiom of choice, like the existence of an ultrafilter over N or of a well-order on R. Following this work, A. Miquel [START_REF] Miquel | Forcing as a program transformation[END_REF] has studied the proof transformation induced by the forcing, in the theory of higher-order arithmetic seen as an extension of System F ω . That is, he has investigated how a proof of a proposition P is transformed into a proof of p P .

In a constructive setting, we have used forcing in collaboration with T. Coquand [START_REF] Coquand | A Note on Forcing and Type Theory[END_REF][START_REF] Coquand | A computational interpretation of forcing in type theory[END_REF], to give a computational content to a result of uniform continuity of definable functionals in Martin-Löf Type Theory. In this work, we have extended MLTT with a typing judgment indexed by a forcing condition. To do so, we have developed a simple forcing translation for MLTT, fitted only for the terms we wanted to add to our theory. This leaves open the question of how to perform a complete translation for all the terms of MLTT.

To adapt the "set-theoretic" ideas of forcing to a dependant type theory, we have use its categorical restatement that Lawvere and Tierney [START_REF] Tierney | Sheaf theory and the continuum hypothesis[END_REF] have pursued using sheaves topos. In this setting, intuitionistic forcing is defined using the notion presheaves in category theory.

The starting point of this chapter is to connect these two observations:

"Intuitionistic forcing for type theory is an internalization of the presheaf construction in type theory."

The idea is to extend an initial type theory-called the ground system-with new principles, getting a new type theory-called the forcing layer. Terms and types of the forcing layer can be translated to the ground system using the forcing translation. In this way, we can develop a new generation of logics, that can be defined modularly using forcing layers. The forcing translation relies on an internalization inside MLTT U of the presheaf construction on a particular type P-representing forcing conditions. Then, it becomes possible to exhibit new reasoning principles inside a forcing layer by using the structure of the chosen forcing conditions. But, no matter what new logical principles have been defined, their consistency can be deduced for free:

"The consistency of a logic defined in a forcing layer ensues from the consistency of the ground logic."

Indeed, we are able to extend a type theory with new reasoning principles and new objects, without defining them as axioms. Besides consistency problems, avoiding the axiomatic approach enables us to give a computational content to these new principles: programs can be associated to them. On a connected line of work on Kripke semantics, Appel, Melliès, Richards and Vouillon [START_REF] Appel | A very modal model of a modern, major, general type system[END_REF] have proposed to understand step-indexing-a technique to handle general recursion in programing language semantics-as (Kripke) forcing on the set of natural numbers. Those natural numbers can be used to define (or force) a particular modality in the logic, an idea already seen by Nakano in [START_REF] Nakano | A modality for recursion[END_REF], with an induction principle directly lifted from natural numbers. More recently, Birkedal, Møgelberg, Schwinghammer, and Støvring [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF] have shown that this construction can be understood semantically as a mean to work inside the topos of trees, which provide a generic way to define general recursive types in a semantical model. Similarly, we use forcing on the set of natural numbers to provide general recursive types in MLTT U , without relying on a positivity condition. This construction makes it possible to define a universal type D for terms of the pure λ-calculus that induces a shallow embedding of the pure λ-calculus into MLTT U . The fact that we can use a conversion rule that is normalizing to describe the β-reduction of the pure λ-calculus should not appear as a contradiction. Unfolding of the recursive type D is handled by a propositional equality and not by the conversion rule and so has to be explicit in the term. As another example, we rephrase Cohen's construction of a model negating the continuum hypothesis in our framework, using the finite subsets of P(P(Nat)) × Nat as the set of forcing conditions.

Plan of the Chapter In Section 4.1, we explain the forcing translation in terms of the presheaf construction. Then, we define it formally in Section 4.2, dealing with various coherence problems caused by the conversion rule. In Section 4.3, we present a systematic way to introduce new reasoning principles in a forcing layer. In Section 4.4, we illustrate this translation by choosing the natural numbers as the poset of forcing conditions, providing a framework for guarded recursive types, which can be seen as a syntactic presentation of the topos of tree [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF]. Then, in Section 4.5, we illustrate the forcing translation with another poset of forcing conditions to force the negation of the continuum hypothesis. Finally, we discuss related works and possible future works in Section 4.6.

Internalizing the Presheaf Construction in MLTT e

U

In this section, we explain the intuitionistic forcing translation [-] of the forcing layer for a poset (P, ) of forcing conditions. The full definition is given in Section 4.2. This translation can be seen as an internalization inside MLTT U of the presheaf construction on P. We refer the reader to [START_REF] Shepherdson | Sheaves in geometry and logic: A first introduction to topos theory[END_REF] for the definition of the presheaf construction.

Actually, we do not interpret MLTT U , but rather the version with explicit coercions MLTT e U + UIP (Section 3.1.7). This is due to the fact that the forcing translation does not preserve substitution on the nose but only up-to a propositional equality. The fact that we use UIP is not crucial in our translation but it simplifies it a lot, for instance enabling the use of subset types. A discussion on the points where UIP is used is given in Section 4.2.6.

Forcing conditions

The forcing translation is defined on a poset P of forcing condition of type Set U equipped with the preorder relation P .

More precisely, we first define a type PreOrder X as

{f : X → X → Prop U | ReflBinRel X,f , TransBinRel X,f }
where ReflBinRel X,f is defined as Πx : X.f x x and TransBinRel X,f is defined as Πx, y, z : X.f x y ∧ f y z → f x z. So we can consider P, P of type ΣX : U i .PreOrder X . We refer to the proof of transitivity of P as ( P ).TransBinRel. When P is clear from the context, we write for P .

The structure of preorder enables us to define the poset P p of forcing conditions that are below p as P p = {q : P | q p}

Because P is a poset, there is an injection ι p,q from P q to P p as soon as there is a proof M p,q : q p. This injection is defined formally, when P p and P q are seen as depedent sum, as ι p,q = λr : P q . π 1 r, ( ).TransBinRel p q r M p,q (π 2 r) .

This chain of preorders enables us to construct presheaves on P by approximation. For the sake of simplicity, these injections are used implicitly in the rest of the chapter. They can be made explicit but it complicates a lot the reading of the translation.

Presheaf approximations as dependent sums

In Category Theory, a presheaf P on P in Set is given by a family (P p ) p∈P of sets together with restriction maps P q θp,q ← --P p for all q p, satisfying the usual commutative diagrams ensuring the naturality of those maps. In the special setting of a preorder, the naturality corresponds to the reflexivity and transitivity of restriction maps. This restriction maps can be formalized using a dependent sum and the naturality conditions can be imposed using a subset type rejecting ill-formed restriction maps. Thus, the type PSh(p, U) of a presheaf at level p on a universe U can be defined as Σf : P p → s.{θ : Πq : P p .Πr :

P q .f q → f r | trans θ (f, p), refl θ (f, p)}
where trans θ (f, p) and refl θ (f, p) are defined as refl θ (f, p) def = Πq : P p .Πx : (f q).(θ q q x) = (T q) x trans θ (f, p) def = Πq : P p .Πr : P q .Πs : P r .Πx : (f q).(θ r s)(θ q r x) = (f s) θ q s x Given a (closed) type T : U, we introduce two notations to extract the support and the restriction maps of the associated presheaf [T ] p :

T p def = (π 1 [T ] p )p θ T p→q def = (π 2 [T ] p )pq

Presheaf approximation of variables

As we internalize the presheaf construction directly in MLTT U , we have to translate variables of the calculus, which is not the case for purely semantic definitions. The problem with variables is that they can be used for a presheaf approximation that is smaller than the presheaf approximation for which they have been defined. For instance, this situation typically amounts to derive the following judgment, for q p, [Γ], x : T p ⊢ x : T q which differs from the usual Var rule. This means that the translation of a variable must introduce the right restriction map to go from the presheaf approximation at level p to the presheaf approximation at level q. For that purpose, we need to parametrize the translation of a term T with a forcing environment σ that associates the type and level of approximation to every free variable occurring in T . More precisely, in what follow, σ denotes an ordered list of triples (x 1 , T 1 , p 1 ), . . . , (x n , T n , p n ) where x i is a variable of type T i , whose associate forcing condition is p i . We write σ 1 (x) (resp. σ 2 (x)) for the type (resp. forcing condition) assigned to x by σ. Given a context Γ, we say that σ is a adequate environment of Γ if it assigns the same variable to the same type, and all conditions appearing in σ are either fresh, are equal to the previous one. The translation of Γ will then enforce that the underlying set of forcing conditions is ordered. So taking Γ = (x 1 : T 1 ), . . . , (x n : T n ), an adequate environment σ for Γ is defined as (x 1 , T 1 , p 1 ), . . . , (x n , T n , p n ) such that p i is fresh or p i = p i-1 . This notion of forcing environment is formally defined in Section 4.2.1 Given a adequate environment σ, the translation of a variable is given by

[x] σ p def = θ σ,σ 1 (x)
σ 2 (x)→p x and the translation of rule Var becomes

[Γ] σ , x : T σ p ⊢ θ σ,T p→q x : T σ q
which is now derivable from the rules Var and App. Note that, inductively, the definitions of the support and restriction maps of the presheaf approximation are also annotated with the environment σ.

Presheaf approximation of dependent products

The category of presheaves is cartesian closed. This suggests that dependent products can be translated as presheaf approximations. In category theory, the internal hom [-, -] is described by

[T, U ] p ∼ = Hom PSh (y(p) × T, U )
where y denotes the Yoneda embedding. This means that [T, U ] p is itself a presheaf that associates to any forcing condition q a morphism f q : P(q, p) × T q → U q .

But in our case, P is a preorder so f q exists only when q p. A dependent product will thus be translated at level p as a family of dependent product indexed by forcing conditions that are below p. As it is the case for morphisms of presheaves, dependent functions between presheaf approximations also have to commute with restriction maps as given by the following categorical commutative diagram

T σ p fp / / θ σ,T p→q U σ p θ σ,U p→q T σ q fq / / U σ q (4.1)
To this end, the support of the presheaf approximation at level p is given by the following subset type

Πx : T.U σ p def = {f : Πq : P p .Πx : T σ q . U σ•(x,T,q) q | comm σ Π (T, U, p, f )}
where the first component is a family of dependent product indexed by a forcing condition below p and where

comm σ Π (T, U, p, f ) def = Πq : P p .Πr : P q .Πx : T σ q .(f r(θ σ,T q→r x)) = θ σ•(x,T,q),U q→r (f qx)
reflects the categorical commutative diagram (4.1). The restriction maps are simply given by identity coercions θ σ,Πx:T.U p→q def = λf : Πx : T.U σ p .λr : P q .f r The translation of a function is given by

[λx : T.M ] σ p def = λq : P p .λx : T σ q .[M ] σ•(x,T,q) q
The proof that [λx : T.M ] σ p validates the commutation condition is deduced from the set of equalities on restriction maps.

The translation of an application is more complicated. Because substitution does not commute with the translation on the nose. That is, the following term

↓ σ,p x,N : U σ•(x,T,p) p [N ] σ p /x → U {N/x} σ p
is not given by the identity function but by an explicit transport of a propositional equality. Thus, the translation of an application is obtained by applying the translated argument

[N ] σ p to the translated function [M ] σ p taken at level p, and then applying ↓ σ,p x,N to get the expected type:

[App (x:T )U (M, N )] σ p def = ↓ σ,p x,N (App (x: T σ p ) U σ p ([M ] σ p p, [N ] σ p )). Indeed, without ↓ σ,p
x,N (which is defined in Section 4.2.2), the naive translation of the application as App (x:

T σ p ) U σ p ([M ] σ p p, [N ] σ p
) would be of type U {N/x} σ p , which would be problematic for the soundness of the forcing translation.

Note that the fact that we need an explicit rewriting in the definition of application corresponds to the fact that, in MLTT e U , the rule for application makes use of a coercion in the type of the application, as shown in [START_REF] Curien | Revisiting the categorical interpretation of dependent type theory[END_REF]. Also this coercion can be considered to be the identity in MLTT e U , it is no longer the case in the forcing translation.

Presheaf approximation of universes

MLTT U has a hierarchy of universes. This means that the U i have to be themselves translated as presheaf approximation at level p. This is done by defining a term PShC(p, U i ) that encodes the restriction map available on PSh(p, U i ).

[U i ] σ p def = (λq : P p .PSh(q, U i ), PShC(p, U i ))
PShC(p, U i ) def = λq : P p .λr : P q .λf : PSh(q, U i ).

(λs : P r .(π 1 f )s, λs : P r .λt :

P s .λx : (π 1 f )s.(π 2 f )stx)

Presheaf approximation of dependent sums

The category of presheaves has products defined pointwise. This suggests that dependent sums (whose categorical interpretations is a product) can be translated as presheaf approximation pointwisely, and likely for the associated operators.

Σx : T.U σ p def = Σx : T σ p . U σ•(x,T,p) p [ M, N (x:T )U ] σ p def = [M ] σ p , ↓ σ,p x,M [N ] σ p (x: T σ p ) U σ p [π 1 M ] σ p def = π 1 [M ] σ p [π 2 M ] σ p def = ↑ σ,p x,π 1 M (π 2 [M ] σ p )
Here, we need to use ↑ σ,p x,M , the inverse of ↓ σ,p x,M , of type U {M/x} σ p → U σ•(x,T,p) p

[M ] σ p /x in the translation of M, N (x:T )U to ensure that the translation of the second component has the right type. This term is given by a transport of the inverse propositional equality as the one used for ↓ σ,p

x,M (again, all this is defined in Section 4.2.2). Note again that the fact that we need an explicit rewriting corresponds to the fact in MLTT e U , the rule for dependent sums makes use of coercion in [START_REF] Curien | Revisiting the categorical interpretation of dependent type theory[END_REF].

To translate the strong elimination of dependent sum ind Σ ((z:Σx:T.U)V, (x:T,y:U )N, M ), we need to be careful about the bounded terms z in V and x, y in M . Thus, the translation [ind Σ ((z:Σx:T.U)V, (x:T,y:U )N, M )] σ p is defined as

↑ σ,p z,M ind Σ ((z: Σx:T.U σ p )[V ] σ•(z,Σx:T.U,p) p , (b 1 ) ↓ σ 2 ,p z, x,y [N ] σ 2 r , [M ] σ p )
where

σ 1 = σ • (x, T, p), σ 2 = σ 1 • (y, U, p) and (b 1 ) = (x: T σ p ,y: U σ 1 p ).

The Forcing Translation

In this section, we present the formal definition of the forcing translation and prove its soundness. But before that, let us see an example of the translation following the presentation of the previous section. Let consider id the polymorphic identity function λα : U.λx : α.x. Then taking p : P, we have

[id] ε p = λq : P p .λα : U ε q .λr : P q .λx : α (α,U,q) q .

[x] (α,U,q)•(x,α,r) r = λq : P p .λα : U ε q .λr : P q .λx : α (α,U,q) q .θ α,(α,U,q)•(x,α,r) r→r x = λq : P p .λα : U ε q .λr : P q .λx : ((π

1 (θ U,ε p→q α))r).((π 2 (θ U,ε q→r α))r r)x
Then, suppose we have a variable β of type U ε p β , the translation of id β is:

[id β] σ p = [id] ε p p [β] σ p = [id] ε p p (θ U,σ p β →p β) = λr : P p .λx : ((π 1 (θ U ,ε p→r (θ U,σ p β →p β)))r).((π 2 (θ U,ε p→r (θ U,σ p β →p β)))r r)x
But β is convertible to λx : β.x, whose translation is :

[λx : β.x] σ p = λr : P p .λx : β σ r .[x] σ•(x,β,r) r = λr : P p .λx : ((π 1 [β] σ r )r).θ β,σ r→r x = λr : P p .λx : ((π 1 (θ U ,ε p β →r β)r).((π 2 [β] σ r )r r)x = λr : P p .λx : ((π 1 (θ U,ε p β →r β)r).((π 2 θ U,ε p β →r β)r r)x
As we can see, the two are equal only up-to the transitivity of θ U ,ε . This means that in general, from

M 1 ≡ M 2 : T , there is no reason that [M 1 ] σ p ≡ [M 2 ] σ p : T σ p , but rather that we can define a term convEq σ,p T,U of type [M 1 ] σ p = T σ p [M 2 ] σ p .
Notice also that the definition of the forcing translation presented before makes use of the coercions ↑ σ,p

x,N and ↓ σ,p

x,N which are, as we will see in Section 4.2.2, defined on proofs of typing judgment and not only on the structure of terms. So even if the presentation of the translation could give the feeling that it is defined on the structure of terms, this is a not actually the case. It is rather defined on typing judgment derivations. All of this justifies the use of explicit conversion coercions, as presented in Section 3.1.7.

Definition of the Translation

A forcing environment σ is defined as an ordered list of triples (x, T, p) formed by a variable x, a type T and a variable forcing condition p. The empty environment is written ε, and the addition of a triple (x, T, p) at the end of σ is written σ • (x, T, p). We say that σ is valid if :

-σ = ε, -or σ = σ ′ • (x, T, p) s.t. σ ′ is a valid environment, x does not appear in σ, the free variables of T appears in σ and either p does not appear in σ or p is equal to the last forcing condition of σ ′ . Taking a context Γ = (x 1 : T 1 ), . . . , (x n : T n ), σ is said to be adequate for Γ if it is valid and is equal to (x 1 , T 1 , p 1 ) . . . (x n , T n , p n ), where the forcing condition variables p 1 , . . . , p n can be possibly equal. When they are all distinct, we say that σ is canonical for Γ.

T σ p def = (π 1 [T ] σ p )p θ σ,T p→q def = (π 2 [T ] σ p )pq [x] σ p def = θ σ,σ 1 (x) σ 2 (x)→p x [c T,U (M )] σ p def = transport λT.T U convEq σ,p T,U [M ] σ p refl θ (T, p) def = Πq : P p .Πx : (T q).(θ q q x) = (T q) x
trans θ (T, p) def = Πq : P p .Πr : P q .Πs : P r .Πx : (T q).(θ r s)(θ q r x) = (T s) θ q s x PSh(p, U i ) def = Σf : P p → U i .{θ : Πq : P p .Πr :

P q .f q → f r | trans θ (f, p), refl θ (f, p)} PShC(p, U i ) def
= λq : P p .λr : P q .λf : PSh(q, U i ).

(λs : P r .(π 1 f )s, λs : P r .λt :

P s .λx : (π 1 f )s.(π 2 f )stx) [U i ] σ p def = (λq : P p .PSh(q, U i ), PShC(p, U i )) comm σ Π (T, U, p, f ) def = Πq : P p .Πr : P q .Πa : T σ q .(f r)(θ σ,T q→r a) = θ σ•(a,T,q),U {a/x} q→r (f qa) [Πx : T.U ] σ p def
= (λq : P p .{f : Πr : P q .Πx : T σ r . U σ•(x,T,r) r | comm σ Π (T, U, q, f )}, λq : P p .λr : P q .λf : Πx : T.U σ q .λs :

P r .f s) [λx : T.M ] σ p def = λq : P p .λx : T σ q .[M ] σ•(x,T,q) q [App (x:T )U (M, N )] σ p def = ↑ σ,p x,N (App (x: T σ p ) U σ p ([M ] σ p p, [N ] σ p ))
[Σx : T.U ] σ p def = (λq : P p .Σx : T σ q . U σ•(x,T,q) q , λq : P p .λr : P q .λf : Σx :

T σ q . U σ•(x,T,q) q .(θ σ,T q→r (π 1 f ), θ σ•(x,T,q),U q→r (π 2 f ))) [ M, N (x:T )U ] σ p def = [M ] σ p , ↓ σ,p x,M [N ] σ p (x: T σ p ) U σ p [π 1 M ] σ p def = π 1 [M ] σ p [π 2 M ] σ p def = ↑ σ,p x,(π 1 M ) (π 2 [M ] σ p ) [ind Σ ((z:Σx:T.U)V, (x:T,y:U )N, M )] σ p def = ↑ σ,p z,M ind Σ ((b 1 )[V ] σ•(z,Σx:T.U,p) p , (b 2 ) ↓ σ 2 ,p z, x,y [N ] σ 2 p , [M ] σ p ) where (b 1 ) = (z:Σx: T σ p . U σ 1 p ), (b 2 ) = (x: T σ p ,y: U σ 1 p ) and σ 1 = σ • (x, T, p), σ 2 = σ 1 • (y, U, p)
[M = T N ] σ p def = λq : P p .[M ] σ q = T σ q [N ] σ q , λq : P p .λr : P q .λu : ([M ] σ q = T σ q [N ] σ q ).ap θ σ,T q→r [M ] σ q [N ] σ q u [refl M ] σ p def = refl [M ] σ p [ind = ((b)V, (w:T )M, N 1 , N 2 , u)] σ p def = ↑ σ,p w,u ↑ σ,p y,N 2 ↑ σ,p x,N 1 ind = ((b ′ )[V ] σ 1 s , ↓ σ,p w,u ↓ σ,p y,N 2 ↓ σ,p x,N 1 (w: T σ p )[M ] σ•(w,T,p) p , [N 1 ] σ p , [N 2 ] σ p , [u] σ p ) where (b) = (x,y:T,z:x= T y), (b ′ ) = (x: T σ p ,y: T σ p z:[x] σ p = T σ s [y] σ p )
[0] σ p def = (λq : P p .0, λq : P p .λr : P q .λu : 0.u)

[ind 0 ((z:0)V, N )] σ p def = ↑ σ,p z,N ind 0 ((z:0)[V ] σ•(z,0,p) p , [N ] σ p )
[1] σ p def = (λq : P p .1, λq : P p .λr : P q .λu : 1.u)

[⋆] σ p def = ⋆ [ind 1 ((z:0)V, M, N )] σ p def = ↑ σ,p z,N ind 1 ((z:1)[V ] σ•(z,1,p) p , [N ] σ p , [M ] σ p ) [T +U ] σ p def
= (λq : P p .[T ] σ q +[U ] σ q , λq : P p .λr : Given an adequate environment σ for Γ, we define the translation of Γ at σ, written [Γ] σ , as the context p :

P q .lift + ( T σ q , U σ q ) (θ σ,T q→r , θ σ,U q→r )) [inl(M )] σ p def = inl([M ] σ p ) [inr(M )] σ p def = inr([M ] σ p ) [ind + ((z:T+U)V, (x:T )M l , (y:U )M r , N )] σ p def = ↑ σ,p z,N ind + ((z: T σ p + U σ p )[V ] σ 1 p , M ′ l , M ′ r , [N ] σ p ) where M ′ l = (x: T σ p ) ↓ σ l ,p z,inl(x) [M l ] σ l p and σ l = σ • (x, T, p) M ′ r = (y: U σ p ) ↓ σ r ,p z,inl(y) [M r ] σ r p and σ r = σ • (y, U, p)
P, Γ[σ] p , where Γ[σ] p is defined as -⋄[σ] p def = ⋄ -(x : T ), Γ[σ] p def
= (q : P p ), (x :

T σ q ), [Γ] σ q if (x, T, q) is in σ and p = q, -(x : T ), Γ[σ] p def = (x : T σ p ), [Γ] σ p if (x, T, p
) is in σ. Note that when (x, T, p) is in σ, we do not want to reassign p in the context, since it has already been declared.

Figure 4.1 presents the forcing translation of MLTT e U . This translation has largely been explained in Section 4.1. The only remaining point concerns the special translation of explicit coercions (see Section 4.2.2) and the management of rewriting for substitutions (see Section 4.2.2).

Figure 4.2 presents the translation for the Identity Type, the Empty type, the Unit type and coproducts. The translation is simply given by considering them as constant presheaves. One only has to be careful in the use of explicit coercions in the translation of elimination rules.

Substitution as a propositional equality

As we have seen in Section 4.1, we need some coercions ↑ σ,p

x,N and ↓ σ,p x,N to make the translation commute with substitutions. Those coercions are syntactic sugar for the following terms subst σ,p (x:T )U,N and subst σ,p (x:T )U,N . So for every terms N and types T, U s.t. Γ, x : T ⊢ e U : U i and Γ ⊢ e N : T , we have to define the two following terms :

subst σ,p

(x:T )U,N of type U {N/x} σ p → U σ•(x,T,p) p [N ] σ p /x -subst σ,p (x:T )U,N of type U σ•(x,T,p) p [N ] σ p /x → U {N/x} σ p
Their definitions follows from the existence of a general term substEq σ,p (x:T )U,N,U i of type Πq :

P p .[U {N/x}] σ q = U i σ p [U ] σ•(x,T,p) q [N ] σ p /x
We can then define them as rewriting with this equality: subst σ,p

(x:T )U,N def = transport λT.T U (ap λT.(π 1 T )p substEq σ,p (x:T )U,N,U i ), -subst σ,p (x:T )U,N def = transport λT.T U (ap λT.(π 1 T )p (substEq σ,p (x:T )U,N,U i ) -1
), Before defining them, we can first state the following lemma, which allows us to rewrite

↑ σ,p x,N ↓ σ,p x,N M into M .
Lemma 1: The identity type subst σ,p (x:T )U,N (subst σ,p

(x:T )U,N [M ] σ p ) = U {N/x} σ p [M ] σ p is inhab- ited.
The term substEq σ,p (x:T )U,N,U i is defined by induction on the two typing derivations Γ, x : T ⊢ e U : U i and Γ ⊢ e N : T . One of the most interesting case is when U = x, Then the equality is [N ] σ q = θ σ,T p→q [N ] σ p , i.e. the monotonicity of the translation. As we have said before, this monotonicity comes from the transitivity of θ σ,T p→q when N is a variable, and from the commutation property when N is a function.

Another, more problematic, case is when U = U ′ M is an application such that Γ, x : T ⊢ e U ′ : T ′ → U i and Γ, x : T ⊢ e M : T ′ . Then, we want to use the induction hypothesis on Γ, x : T ⊢ e M : T ′ , however, a priori T ′ = U. This means that we have to generalize the construction of subst to terms M whose type is not necessarily equal to an universe U. A first try would be the following term substEq σ,p (x:T )M,N,U of type

Πq : P p .[M {N/x}] σ q = U σ p [M ] σ•(x,T,p) q [N ] σ p /x with Γ, x : T ⊢ e M : U, x / ∈ FV(U ) and Γ ⊢ e N : T . The hypothesis x / ∈ FV(U ) is neces- sary so that [M {N/x}] σ q and [M ] σ•(x,T,p) q
[N ] σ p /x have the same type U σ p . However, here again, when trying to build these terms by induction on the proof of Γ, x : T ⊢ e M : U , when M is an application, we have again to generalize the construction to cases where x ∈ FV(U ).

To do so, the type of substEq σ,p (x:T )M,N,U uses substEq σ,p (x:T )U,N,U i via subst σ,p (x:T )U,N , i.e. it is defined as

Πq : P p .[M {N/x}] σ q = U {N/x} σ q subst σ,q (x:T )U,N [M ] σ•(x,T,p) q [N ] σ p /x
when Γ, x : T ⊢ e U : U i and Γ ⊢ e N : T . The definition of substEq σ,p (x:T )M,N,U is even more complicated as it involves properties on the restriction maps that also need to be defined inductively on the typing derivation. To formalize those mutually recursive definitions, we will proceed as in the Coq proof assistant by first stating the type of the defined terms and the given the meaning of the term by a proof, by induction on typing derivations.

Definition 4. Suppose that -Γ, x : T ⊢ e U : U i , -Γ, x : T ⊢ e M : U , -Γ ⊢ e N : T ,
-and σ is a adequate environment for Γ. Then, we can define the following terms :

-monoTrad σ,p N,T of type

Πq : P p .θ σ,T p→q [N ] σ p = T σ q [N ] σ q -substEq σ,p (x:T )U i ,U,N of type Πq : P p .[U {N/x}] σ q = U i σ p [U ] σ•(x,T,p) q [N ] σ p /x
-substEq σ,p (x:T )U,M,N of type

Πq : P p .[M {N/x}] σ q = U {N/x} σ q subst σ,q (x:T )U,N [M ] σ•(x,T,p) q [N ] σ p /x -commute σ,p (x:T )U,M,N of type Πq : P p . θ σ,T p→q (subst σ,p (x:T )U,N ([M ] σ•(x,T,p) p [N ] σ p /x )) = U {N/x} σ q subst σ,q (x:T )U,N ([M ] σ•(x,T,q) q θ σ,T p→q [N ] σ p /x )
Proof We reason by induction on the proofs of Γ, x : T ⊢ e U : U i , Γ, x : T ⊢ e M : U . and Γ ⊢ e N : T . First, we build substEq σ,p (x:T )U,M,N and commute σ,p (x:T )U,M,N .

Univ:

If M = U k , then U = U j and k < j < i. Moreover, x / ∈ FV(U ) so substEq σ,p (x:T )U i ,U,N = λq : P P .refl [U ] σ p . This means that: -subst σ,p (x:T )U,N [M ] σ•(x,T,p) q [N ] σ p /x is convertible to [M ] σ•(x,T,p) q [N ] σ p /x -subst σ,q (x:T )U,N ([M ] σ•(x,T,p) q θ σ,T p→q [N ] σ p /x ) is convertible to [M ] σ•(x,T,p) q θ σ,T p→q [N ] σ p /x and since x /
∈ FV(M ), they are both convertible to [M ] σ q . Then, we can define -substEq σ,p

(x:T )U j ,U k ,N def = λq : P P .refl [U ] σ p .
commute σ,p

(x:T )U j ,U k ,N def = monoTrad σ,p
U k ,U j 0-Univ, 1-Univ, Nat-Univ: The same reasoning applies when M is equal to the types 0, 1 or Nat.

Π-Univ:

If M = Πy : T 1 .T 2 , then U = U j with j < i. Then again x / ∈ FV(U ) so substEq σ,p (x:T )U i ,U,N = λq : P P .refl [U ] σ p . so -subst σ,p (x:T )U,N [M ] σ•(x,T,p) q [N ] σ p /x is convertible to [M ] σ•(x,T,p) q [N ] σ p /x -subst σ,q (x:T )U,N ([M ] σ•(x,T,p) q θ σ,T p→q [N ] σ p /x ) is convertible to [M ] σ•(x,T,p) q θ σ,T p→q [N ] σ p /x but now x is possibly free in M .
However, we have Γ, x : T ⊢ e T 1 : U j 1 and Γ, x : T, y : T 1 ⊢ e T 2 : U j 2 with j = max(j 1 , j 2 ). Thus, by induction hypothesis, we get the existence of substEq σ,p

(x:T )U j 1 ,T 1 ,N
and substEq σ•(y,T 1 ,p),p (x:T )U j 2 ,T 2 ,N , such that, transporting these equalities, we can build substEq σ,p (x:T )U j ,Πy:T 1 .T 2 ,N . The same reasoning applies for commute σ,p (x:T )U j ,Πy:T 1 .T 2 ,N .

Id-Univ,Σ-Univ, +-Univ: The same reasoning applies when M is equal to the types

M 1 = T M 2 , Σy : T 1 .T 2 or T 1 +T 2 .
Π-Intro: If M is an abstraction λy : T 1 .M 1 and U = Πy : T 1 .T 2 , then we first build substEq σ,p (x:T )Πy:T 1 .T 2 ,(λy:T 1 .M 1 ),N of type Πq : P p .λr : P q .λy : (

T 1 {N/x} σ r ).[M 1 {N/x}] σ r = U σ q subst σ,q
(x:T )Πy:T 1 .T 2 ,N λr : P q .λy :

( T 1 σ r {[N ] σ r /x}).[M 1 ] σ ′ r {[N ] σ r /x}
Then, we have Γ, x : T ⊢ e T 1 : U j and Γ, x : T, y : T 1 ⊢ e M 1 : T 2 so by induction hypothesis we get -substEq σ,p (x:T )U j ,T 1 ,N of type

Πq : P p .[T 1 {N/x}] σ q = U j σ q [T 1 ] σ•(x,T,p) q [N ] σ p /x -substEq σ•(y,T 1 ,p),p (x:T )T 2 ,M 1 ,N of type Πq : P p .[M 1 {N/x}] σ q = T 2 {N/x} σ q subst σ,q (x:T )T 2 ,N [M 1 ] σ ′ •(x,T,p) q [N ] σ p /x Π-Elim: If M is an application App (y:T 1 )T 2 (M 1 , M 2 ) with U = T 2 {M 2 /y} then we first build substEq σ,p (x:T )U,App (y:T 1 )T 2 (M 1 ,M 2 ),N of type Πq : P p . [(App (y:T 1 )T 2 (M 1 , M 2 )) {N/x}] σ q = U {N/x} σ q subst σ,q (x:T )U,N [App (y:T 1 )T 2 (M 1 , M 2 )] σ ′ •(x,T,p) q [N ] σ p /x
We have [(App (y:

T 1 )T 2 (M 1 , M 2 )) {N/x}] σ q equal to subst σ,q (y:(T 1 {N/x}))(T 2 {N/x}),(M 2 {N/x}) [(M 1 {N/x})] σ q q [M 2 {N/x}] σ q and [App (y:T 1 )T 2 (M 1 , M 2 )] σ ′ •(x,T,p) q [N ] σ p /x equal to (subst σ•(x,T,p),q (y:T 1 )T 2 ,M 2 ) [N ] σ q /x ([M 1 ] σ•(y,T 1 ,q) q ) [N ] σ q /x q ([M 2 ] σ•(y,T 1 ,q) q ) [N ] σ q /x
Using the induction hypothesis we get a proof of equality between:

-

[(M 1 {N/x})] σ q and [M 1 ] σ•(y,T 1 ,q) q ) [N ] σ q /x , -[M 2 {N/x}] σ q and [M 2 ] σ•(y,T 1 ,q) q )
[N ] σ q /x . And using UIP, we have a proof of equality between subst σ,q (y:(T 1 {N/x}))(T 2 {N/x}),(M 2 {N/x}) and subst σ•(x,T,p),q (y:T 1 )T 2 ,M 2

[N ] σ q /x .

Var: If M is a variable y, then -either y = x in which case substEq σ,p (x:T )U,y,N and commute σ,p (x:T )U,y,N are simply defined as λq : P P .refl [y] σ q , -or y = x and T = U , such that x / ∈ FV(U ). Then, subst σ,p (x:T )U,N disappears, so substEq σ,p (x:T )U,x,N is of type

Πq : P p .[N ] σ q = U σ q θ σ,T p→q [N ] σ p
which is exactly monoTrad σ,p N,T . Moreover, commute σ,p (x:T )U,x,N is of type

Πq : P p .θ σ,T p→q (θ σ,T p→p [N ] σ p ) = U σ q θ σ,T q→q (θ σ,T p→q [N ] σ p )
so we build it using reflexivity of θ σ,T q→q and θ σ,T p→p . Second, we build monoTrad σ,p N,T by induction on Γ ⊢ e N : T .

Var: If N is a variable x such that σ 2 (x) = p x , then we have to prove

Πq : P p .θ σ,T p→q (θ σ,T px→p x) = T σ q θ σ,T px→q x
which directly comes from transitivity of θ σ,T .

Π-Intro:

If N is a function λx : T ′ .M and T = Πx : T ′ .U , we have to prove Πq : P p .θ σ,Πx:T ′ .U p→q (λr : P p .λx : T ′ σ r .M ) = Πx:T ′ .U σ q (λs : P q .λx : T ′ σ s .M ).

But θ σ,Πx:T ′ .U p→q is equal to λf : (Πr : P p .Πx :

T σ r . U σ•(x,T,r) r
).λs : P q .f s so these terms are directly convertible.

Π-Elim: If N is an application App (y:T 1 )T 2 (M 1 , M 2 ) then we have Γ, x : T ⊢ e M 1 : Πy : T 1 .T 2 and Γ, x : T ⊢ e M 1 : T 1 s.t. T = T 2 {M 2 /y}. We have to prove

Πq : P p .θ σ,T p→q (subst σ,p (y:T 1 )T 2 ,M 2 ([M 1 ] σ p p[M 2 ] σ p )) = T σ q subst σ,q (y:T 1 )T 2 ,M 2 ([M 1 ] σ q q[M 2 ] σ q ).
Taking q : P q , by induction, we have monoTrad σ,p M 2 ,T 1 of type Πq :

P p : θ σ,T 1 p→q [M 2 ] σ p = T 1 σ q [M 2 ] σ
q . so transporting this equality to the one we want to prove, we still have to show that

θ σ,T p→q (subst σ,p (y:T 1 )T 2 ,M 2 ([M 1 ] σ p p [M 2 ] σ p )) = T σ q subst σ,q (y:T 1 )T 2 ,M 2 ([M 1 ] σ q q θ σ,T 1 p→q [M 2 ] σ p ).
Then, we reason by induction on Γ, x : T ⊢ e M 1 : Πy :

T 1 .T 2 . -If M 1 = λy : T 1 .M ′ 1 , then we have to prove θ σ,T p→q (subst σ,p (y:T 1 )T 2 ,M 2 ([M ′ 1 ] σ p [M 2 ] σ p /y )) = T σ q subst σ,q (y:T 1 )T 2 ,M 2 ([M ′ 1 ] σ q θ σ,T 1 p→q [M 2 ] σ p /y ).
which is exactly commute σ,p

(x:T )U,M ′ 1 ,N .
-If M 1 = z such that (z, Πy : T 1 .T 2 , p z ) is in σ, we have to prove

θ σ,T p→q (subst σ,p (y:T 1 )T 2 ,M 2 ((θ σ,Πy:T 1 .T 2 pz→p z) p [M 2 ] σ p )) = T σ q subst σ,q (y:T 1 )T 2 ,M 2 ((θ σ,Πy:T 1 .T 2 pz→q z) q θ σ,T 1 p→q [M 2 ] σ p ).
Then, due to the definition of θ σ,Πy:T 1 .T 2 , we just have to prove

θ σ,T p→q (subst σ,p (y:T 1 )T 2 ,M 2 (z p [M 2 ] σ p )) = T σ q subst σ,q (y:T 1 )T 2 ,M 2 (z q θ σ,T 1 p→q [M 2 ] σ p ).
But this come from the fact that z is of type Πy :

T 1 .T 2 σ pz so that comm σ Π (T 1 , T 2 , p z , z) is inhabited.

Translation of explicit coercions

Let M, N two terms such that Γ ⊢ e M ≡ N : T , and σ the adequate environment for Γ. Then in general, as we said before we cannot prove that

[Γ] σ ⊢ [M ] σ p ≡ [N ] σ p : T σ p
, that is that the translated term are judgmentally equal. However, we can build a term convEq σ,p M,N that corresponds to the proof that they are propositionally equal. Using it, we define [c T,U (M )] σ p as transport λT.T U convEq σ,p T,U [M ] σ p (as defined in Figure 4.1). As the definition is done by induction on the proof of conversion, we proceed as in Section 4.2.2 and provide the explicit term as a proof. Definition 5. Given M, N two terms such that Γ ⊢ e M ≡ N : T , and σ the adequate environment for Γ, we can define a term convEq σ,p M,N of type

[Γ] σ ⊢ convEq σ,p M,N : [M ] σ p = T σ p [N ] σ p .
Proof It is build by induction on the proof of Γ ⊢ e M ≡ N : T .

Π-Conv

Suppose that M = (λx :

T.M 1 )M 2 and N = M 1 {M 2 /x}. Then, [(λx : T.M 1 )M 2 ] σ p is defined as ↑ p,σ x,M 2 ((λq : P p .λx : T σ p .[M 1 ] σ•(x,T,p) p )p [M 2 ] σ p ) which is convertible to ↑ p,σ x,M 2 ([M 1 ] σ•(x,T,p) p ) [M 2 ] σ p /x Then using substEq p,σ (x:T )U,M 1 ,M 2 one can prove that it is indeed equal to [M 1 {M 2 /x}] σ p . So convEq σ,p (λx:T.M 1 )N 2 ,M 1 {M 2 /x} is defined as substEq p,σ (x:T )U,M 1 ,M 2 p.

Conv-Proj1

Suppose that

M = π 1 M 1 , M 2 and N = M 1 . Then [π 1 M 1 , M 2 ] σ p is equal to π 1 [M 1 ] σ p , ↓ σ,p x,M 1 [M 2 ] σ p which is indeed convertible to [M 1 ] σ p . So convEq σ,p π 1 M 1 ,M 2 ,M 1 is defined as refl M 1 .

Conv-Proj2

Suppose that

M = π 2 M 1 , M 2 and N = M 2 Then [π 2 M 1 , M 2 ] σ p is equal to ↑ σ,p x,(π 1 M 1 ,M 2 ) (π 2 [M 1 ] σ p , ↓ σ,p x,M 1 [M 2 ] σ p ) which is convertible to ↑ σ,p x,(π 1 M 1 ,M 2 ) (↓ σ,p x,M 1 [M 2 ] σ p ) Then using UIP, we can prove that it is equal to ↑ σ,p x,M 1 (↓ σ,p x,M 1 [M 2 ] σ p ).
And we conclude the construction using lemma 1.

Conv-ind Σ [ind Σ ((z:Σx:T.U)V, (x:T,y:U )N, M 1 , M 2 )] σ p is defined as ↑ σ,p z, M 1 ,M 2 ind Σ ((b 1 )[V ] σ•(z,Σx:T.U,p) p , (b 2 ) ↓ σ 2 ,p z, x,y [N ] σ 2 p , [M 1 ] σ p , ↓ σ,p x,M 1 [M 2 ] σ p )
where (b 1 ) = (z:Σx:

T σ p . U σ 1 p ), (b 2 ) = (x: T σ p ,y: U σ 1 p ) and σ 1 = σ • (x, T, p), σ 2 = σ 1 • (y, U, p). It converts to ↑ σ,p z, M 1 ,M 2 (↓ σ 2 ,p z, x,y [N ] σ 2 p ) [M 1 ] σ p /x (↓ σ,p x,M 1 [M 2 ] σ p )/y It has to be equal to [N {M 1 /x} {M 2 /y}] σ p If it is equal to ↑ σ,p z, M 1 ,M 2 (↓ σ,p z, M 1 ,M 2 [N {M 1 /x} {M 2 /y}] σ 2 p ) .

Soundness of the Translation

Before stating the soundness of the translation, we need a weakening lemma for adequate environments.

Lemma 2: If Γ ⊢ T : U and σ is a canonical environment of Γ, then for every forcing condition p and every interpretation σ

′ disjoint of σ, [T ] σ•σ ′ p = [T ] σ p .
Proof The proof is done by induction on T . The only interesting case is when T is a variable x. Then from Γ ⊢ T : U we know that (x, U) ∈ Γ, and since σ is canonical for Γ, there exists a forcing condition q such that (x, T, q) ∈ σ. So we just have to prove that θ σ•σ ′ ,U p→q = θ σ,U p→q , which follows from the definition of PSh(p, U).

Lemma 3: Let Γ a context and σ a canonical environment of Γ. Suppose that

[Γ] σ , q : P p , x 1 : T 1 σ 1 q , . . . , x n : T n σn q ⊢ [M ] σn q : [T ] σn q with σ 1 = σ, σ i+1 = σ i • (x i , T i , q). Then [Γ] σ , x 1 : T 1 σ ′ 1 p , . . . , x n : T n σ ′ n p ⊢ [M ] σ ′ n p : T σ ′ n p where σ ′ i = σ i {p/q}. Theorem 4 (Typing Soundness): If Γ ⊢ e M : T and σ is a canonical environment of Γ then [Γ] σ ⊢ e [M ] σ p : T σ p
where p is the last forcing condition occurring in σ.

Proof The proof is done by induction on the proof of Γ ⊢ e M : T .

Univ : To prove [Γ] σ ⊢ (λq : P p .PSh(q, U i ), PShC(p, U i )) : PSh(p, U i+1 ) we use the rule Σ-Intro with the two following proof trees :

Π-Intro Σ-Univ Π-Univ [Γ] σ , q : P p ⊢ P q : U 0 [Γ] σ , q : P p ⊢ U i : U i+1 Univ [Γ] σ , q : P p ⊢ P q → U i : U i+1 [Γ] σ , q : P p ⊢ Σf : P q → U i .{θ : Πr : P q .Πs : P r .f r → f s | trans θ (f, q) ∧ refl θ (f, q)} : U i+1 [Γ] σ ⊢ λq : P p .PSh(q, U i ) M : P p → U i+1 Σ-Intro Conv Π-Intro Σ-Intro Γ ′ ⊢ (λs : P r .(π 1 f )s, λs : P r .λt : P s .λx : (π 1 f )s.(π 2 f )stx) : PSh(r, U i ) [Γ] σ ⊢ PShC(p, U i ) : Πq : P p .Πr : P q .PSh(q, U i ) → PSh(r, U i ) [Γ] σ ⊢ PShC(p, U i ) : Πq : P p .Πr : P q .M q → M r. [Γ] σ ⊢ PShC(p, U i ) : {θ : Πq : P p .Πr : P q .M q → M r | trans θ (M, p) ∧ refl θ (M, p)}
where Γ ′ = [Γ] σ , q : P p , r : P q , f : PSh(q, U i ) with proof obligations :

-trans PShC(p,U i ) (M, p) -refl PShC(p,U i ) (M, p)
Conv : We want to show that the following rule is derivable:

[Γ] σ ⊢ [M ] σ p : T σ p T ⊢ U ≡ U : [Γ] σ ⊢ [c T,U (M )] σ p : U σ p which simply comes from Π-Elim [Γ] σ ⊢ [M ] σ p : T σ p [Γ] σ ⊢ transport λT.T U convEq σ,p T,U [M ] σ p : U σ p Var : Var ⊢ wf (x : A σ σ 2 (x) , [Γ] σ ) x : A σ σ 2 (x) , [Γ] σ ⊢ e x : A σ σ 2 (x) x : A σ σ 2 (x) , [Γ] σ ⊢ e θ σ,A σ 2 (x)→p x : A σ p Π-Univ : To prove [Γ] σ ⊢ e [Πx : T.U ] σ p : PSh(p, U max(i,j) )
we use the rule Σ-Intro :

Π-Intro Σ-Univ Π-Univ Proj-1 q : P p , r : P q , Γ, x : T σ•(x,T,r) ⊢ e [U ] σ•(x,T,r) r : PSh(r, U i )
[Γ] σ , q : P p , r : P q , x :

T σ r ⊢ e U σ•(x,T,r) r : U j
[Γ] σ , q : P p ⊢ e Πr : P q .Πx :

T σ r . U σ•(x,T,r) r U i :
[Γ] σ , q : P p ⊢ e {f : Πr : P q .Πx :

T σ r . U σ•(x,T,r) r | comm f Π (T, U, q, )} : U i [Γ] σ ⊢ e λq : P p . {f : Πr : P q .Πx : T σ r . U σ•(x,T,r) r | comm f Π (T, U, q, )} M : P p → U i
Then, we have to prove that

[Γ] σ ⊢ e λq : P p .λr : P q .λf : Πx : T.U σ q .λs : P r .f s : Πq : P p .Πr : P q .M q → M r which is straightforward from the fact that M r is of type Πx : T.U σ r :

Π-Intro Π-Elim Γ ′ ⊢ e f : Πs : P r . Πx : T.U σ q Γ ′ ⊢ e s : P r Γ ′ ⊢ e f s : Πx : T σ r . U σ•(x,T,r) r
[Γ] σ ⊢ e λq : P p .λr : P q .λf : Πx : T.U σ q .λs : P r .f s : Πq : P p .Πr : P q .M q → M r where Γ ′ = [Γ] σ , q : P p , r : P q , f : Πx : T.U σ q , s : P r with the proof obligations trans θ (λq : P p .λr : P q .λf : Πx : T.U σ q .λs : P r .f s, p) and refl θ (λq : P p .λr : P q .λf : Πx : T.U σ q .λs : P r .f s, p)

Π-Intro : Σ-Intro Π-Intro Hyp. Ind. [Γ, x : A] σ•(x,T,q) ⊢ e [M ] σ•(x,T,q) q : U σ•(x,T,q) q [Γ] σ ⊢ e λq : P p .λx : T σ q .[M ] σ•(x,T,q) q : Πq : P p .Πx : T σ q . U σ•(x,T,q) q [Γ] σ ⊢ e λq : P p .λx : T σ q .[M ] σ•(x,T,q) q : {f : Πq : P p .Πx : T σ q . U σ•(x,T,q) q | comm f Π (T, U, q, })
with the proof obligation comm λq:Pp.λx: T σ q .

[M ] σ•(x,T,q) q Π (T, U, q, ) which is proved using commute σ,p (x:T )U,M,N .

Π-Elim :

Π-Elim Π-Elim [Γ] σ ⊢ [M ] σ p p : Πx : T σ p . U σ•(x,T,p) p [Γ] σ ⊢ [N ] σ p : T σ p [Γ] σ ⊢ App (x: T σ p ) U σ•(x,T,p) p ([M ] σ p p, [N ] σ p ) : U σ•(x,T,p) p [N ] σ p /x [Γ] σ ⊢ subst σ,p (x:T )U,N App (x: T σ p ) U σ•(x,T,p) p ([M ] σ p p, [N ] σ p ) : U {N/x} σ p Σ-Univ :
We want to prove that the following rule is derivable :

[Γ] σ ⊢ e [T ] σ p : U i σ p [Γ, x : T ] σ ′ ⊢ e [U ] σ ′ q : U i σ ′ q [Γ] ⊢ e [Σx : T.U ] σ p : U i σ p
where σ ′ = σ •(x, T, q). Since U i σ p = PSh(p, U) which is a dependent sum, we decompose the proof in two.

Π-Intro Σ-Univ Weak [Γ] σ ⊢ e T σ p : U i [Γ] σ , q : P p ⊢ e T σ q : U i [Γ] σ , q : P p , x : T σ ′ q ⊢ e U σ ′ q : U i [Γ] σ , q : P p ⊢ e Σx : T σ q . U σ•(x,T,q) q : U i [Γ] σ ⊢ e λq : P p .Σx : T σ q . U σ•(x,T,q) q M : P p → U i
Then, we prove that

[Γ] σ ⊢ e λq : P p .λr : P q .λf : Σx : T.U σ q .(θ σ,T q→r (π 1 f ), θ σ ′ ,U q→r (π 2 f )) : Πq : P p .Πr : P q .M q → M r the proof is similar to the one done in Π-Univ. Finally, we deal with the proof obligations trans θ (λq : P p .λr : P q .λf : Σx :

T.U σ q .(θ σ,T q→r (π 1 f ), θ σ ′ ,U q→r (π 2 f )), p)
and refl θ (λq : P p .λr : P q .λf : Σx :

T.U σ q .(θ σ,T q→r (π 1 f ), θ σ ′ ,U q→r (π 2 f )), p)
Σ-Intro : We want to prove that the following rule is derivable :

[Γ] σ ⊢ e [M ] σ p : T σ p [Γ] σ ⊢ e [N ] σ p : U {M/x} σ p [Γ] σ ⊢ e [ M, N (x:T )U ] σ p : Σx : T.U σ p Σ-Intro [Γ] σ ⊢ e [M ] σ p : T σ p [Γ] σ ⊢ e [N ] σ p : U {M/x} σ p [Γ] σ ⊢ e subst σ,p (x:T )U,M [N ] σ p : U σ p [M ] σ p /x Π-Elim [Γ] σ ⊢ e [M ] σ p ,subst σ,p (x:T )U,M [N ] σ p (x: T σ p ) U σ ′ p : Σx : T σ p . U σ ′ p
StrongElim-Σ : We want to prove that the following rule is derivable :

[Γ, z : Σx : T.U ] σ 1 ⊢ [V ] σ 1 q : U σ 1 q [Γ, x : T, y : U ] σ 2 ⊢ [N ] σ 2 r : V { x, y /z} σ 2 r [Γ] σ ⊢ [M ] σ p : Σx : T.U σ p [Γ] σ ⊢ [ind Σ ((z:Σx:T.U)V, (x:T,y:U )N, M )] σ p : V {M/z} σ p
where σ 1 def = σ • (z, Σx : T.U, q) and σ 2 def = σ • (x, T, q) • (y, U, r). Then, using Lemma 3 we get the following hypothesis -

[Γ] σ , z : Σx : T σ p . U σ•(x,T,p) p [V ] σ 1 p U σ 1 p -[Γ] σ , x : T σ p , y : U σ•(x,T,p p ⊢ [N ] σ•(x,T,p)•(y,U,p) p : V { x, y /z} σ p
Then, we get

[Γ] σ , x : T σ p , y : U σ•(x,T,p p ⊢ subst σ 2 ,r (z:Σx:U.)V, x,y [N ] σ•(x,T,p)•(y,U,p) p N ′ : V σ 1 q {[ x, y ] σ 2 r /z} So, we can StrongElim-Σ to prove [Γ] σ ⊢ ind Σ ((z: Σx:T.U σ p )[V ] σ 1 p , (x: T σ p ,y: U σ•(x,T,p) p )N ′ , [M ] σ p ) : V σ p [M ] σ p /z
Let consider P a mere proposition. Then, the translation P σ p can be seen as what is usually written p P in forcing. Then, using the previous theorem, a proof M of P (i.e.. M is of type P ) is translated into [M ] σ p . This explain why our work can be seen as a study of the forcing translation of proofs, i.e. as an extension of the work of Miquel [START_REF] Miquel | Forcing as a program transformation[END_REF].

Extending the internalization to MLTT U

Up-to now, we have defined the translation in MLTT e U because we need an explicit management of coercions. This section discusses what need to be done to extend it to MLTT U .

As we have explained in Section 3.1.7, we assume that a judgment Γ ⊢ M : T in MLTT U can be annotated with explicit coercions Γ e , M e , T e as given by Theorem 3. Thus, the translation of a term of M for an environment |σ e |, where σ e is a canonical environment for Γ e and p is its last forcing condition, could be defined as

[M ] |σe| p def = |[M e ] σe p |.
But as our translation-and in particular the terms substEq σ,p (x:T )U,M,N -is built by induction on the proof of typing judgments, the definition may depend on the chosen Γ e , M e , T e . So to get a correct definition of the translation of derivation of MLTT U , we need to prove its independence with respect to the chosen corresponding derivation in MLTT e U . That is, given

Γ 1 ⊢ e M 1 : T 1 and Γ 2 ⊢ e M 2 : T 2 such that |Γ 1 | = |Γ 2 |, |M 1 | = |M 2 |, |T 1 | = |T 2 |, and given σ 1 (resp. σ 2 ) a canonical environment for Γ 1 (resp. Γ 2 ) s.t. |σ 1 | = |σ 2 |, we need to show that [M 1 ] |σ 1 | p = [M 2 ] |σ 2 |
p . This property is related to the so-called coherence problems of categorical models of dependent type theory [Cur93, Hof95b, CGH14], i.e. the fact that substitution, which is interpreted as pullbacks in these models, is only "pseudo-functorial", i.e. up-to isomorphism.

First, notice that when working in the extensional MLTT U , i.e. with the reflection rule which identify judgmental and propositional equality, we get this uniqueness of the translation. Indeed, in such case, we do not have to introduce the various coercions ↑ σ,p x,N , ↓ σ,p x,N since we can directly use the proofs of substEq σ,p (x:T )U,M,N to convert them. In the intentional case, it is a lot more difficult. First, notice that the fact that we our working with UIP does not really help here, because we get the uniqueness of terms substEq σ,p (x:T )U,M,N up to propositional equality, but one cannot conclude from that fact, since the conversion rule can be used at different stage of the proof of the typing judgment.

To achieve the proof of uniqueness of the translation of this setting, it should be possible to adapt the reasoning done in [START_REF] Curien | Substitution up to isomorphism[END_REF][START_REF] Curien | Revisiting the categorical interpretation of dependent type theory[END_REF], by going to a setting with explicit substitution.

About the use of UIP and the poset restriction

The use of UIP is made at two crucial points:

1. in the use of subset types in the definitions of PSh(p, U i ) and [Πx : T.U ] σ p , 2. to simply the definition of substEq σ,p (x:T )U,N,U i in Section 4.2.2 and convEq σ,p T,U in Section 4.2.3.

While we think that the second use could be avoided by a more careful management of equalities between equalities (as done in Homotopy Type Theory [START_REF]Homotopy Type Theory: Univalent Foundations of Mathematics[END_REF]), the first use seems more difficult to overcome. Indeed, if we remove the UIP axiom, then the computational content of the proofs of transitivity and reflexivity of restriction maps of a presheaf type can not be ignored. It is the same for the functoriality condition in the translation of a dependent product. The consequence of that is that the terms substEq σ,p (x:T )U,N,U i in Section 4.2.2 and convEq σ,p T,U will be more involved. We do not see any theoretical reason why it should not be possible but we have left this investigation for future work.

Regarding the poset restriction, we could have also consider categories instead of just pre-orders. However, this implies that the set of forcing conditions below a forcing condition p becomes couples (q, f ) of type

P p = Σq : P.q → p
The explicit management of the morphism f hardens the definition, although, from categorical considerations, it should be feasible.

Implemeting the translation in Coq

So far, we have presented the translation for set elements of MLTT e U . This translation can also be implemented for CIC, the type system behind Coq, with proof irrelevance and explicit coercions. To do so, we first have to introduce the translation PSh(p, Prop) of the universe Prop. It is defined in the same way than U, with the simplication that, because of Proof-Irrelevance, the restriction maps are in that case proofs of monotonicity and thus, transitivity and reflexivity of restriction maps are automatic :

PSh(p, Prop) def = {f : P p → Prop | θ : Πq : P p .Πr : P q .f q → f r}
We also have to translate Inductive Types, following the same idea as the translation of Nat we have presented. Their constructor is simply translated as constant presheaves, while their destructors, i.e. their induction principles, have first to be η-expanded before being translated also as constant presheaves.

A prototype implementation of the translation as been implemented by Matthieu Sozeau, available at https://github.com/mattam82/Forcing. It is built on top of (an old version of) Coq, with a patch that introduces proof irrelevance in the conversion, translating terms of a forcing layer so that they can be verified by the typechecker of Coq. The fact that we need proof-irrelevance in the conversion and not only propositionally is because we have not considered the coercions ι p,q from P q to P p when q ≤ p in the translation. But using proof-irrelevance in the conversion makes all those coercions judgmentally equal to the identity. Using it, the Forcing Layer presented in Section 4.4 has been defined in Coq allowing to use guarded recursive types in this proof assistant.

Reasoning in the Forcing Layer

The goal of this section is to show how to extend safely our type theory with new elements, so that well-formed terms still typecheck and the layer stays consistent (i.e. the empty type is not inhabited). To do so, we define the notion of Forcing Layers. To simplify the presentation, we suppose that forcing has been defined not only on MLTT e U but also on MLTT U .

Defining new constructors in the Forcing Layer

To extend the logical power of the type theory of a forcing layer, we follow a general mechanism. We first add new symbols corresponding to the objects we want to reason on. For example, in the next section we will introduce a new fixpoint combinator. We then define their translation, which is a way to give them a meaning in the original layer.

Finally, we add properties about these new elements whose translations are proven in the original layer.

More precisely, after adding a new symbol f of type T to the forcing layer, we define its translation [f ] σ p . Then, we can add a proof-term symbol π of a lemma P about f as soon as we are able to define a proof [π] σ p of P σ p in the ground logic. This has to be compared to the axiomatic approach in Coq, which introduce a new symbol using Parameter f:T and then properties about it using Axiom π:P. In this approach, f and π have no computational content.

So, we define a forcing layer F as a list of new symbols (C 1 , . . . , C n ). The terms of F are generated by the grammar of MLTT U extended by the new symbols C 1 , . . . , C n . We suppose that each symbol C i is typable in the empty context with the type T i , which is a term of F such that T i does not contains any C j for j < i. We define a new typing judgment Γ ⊢ F e M : T for contexts, terms and types of F, defined with the same typing rules of MLTT U plus the axioms ⊢ F e C i : T i . This forcing layer comes with a translation

F[C i ] ε p of each element C i , which is defined in MLTT U .
We can now state when a forcing layer is well-defined. Definition 6. A forcing layer is well defined when

p : P p ⊢ F[C i ] ε p : F T i ε p
in the original layer and when T i is a dependent product for every i.

Given a well defined forcing layer, it is possible to extend the definition of F[M ] σ p for terms of F by induction on the structure of M , using the standard translation [ ] for the constructions of MLTT U .

The only subtle point is for the extension of the definition of terms dealing with substitution, in particular the monotonicity of the translation, captured by the term monoTrad σ,p N,T . Here, we use the fact that every new symbol C i inhabits dependent product T i , which imposes by construction that the interpretation is monotone (because of the presence of Πq : P p . . . . at the beginning of the translation of a dependent product). Note that it would not be the case on other types, for instance on Bool.

Soundness and Consistency of the Forcing Layer

We now want to extend the soundness of the translation to the forcing layer.

Theorem 5: Given a well-defined forcing layer F, if Γ ⊢ F e M : T , then

F[Γ] σ ⊢ F[M ] σ p : F T σ p .
Proof This is a straightforward consequence of the soundness for MLTT U , since we just have extended it with new axioms which are sound by definition of the forcing layer.

We can also prove the consistency of the forcing layer.

Theorem 6: There is no term M such that ⋄ ⊢ F e M : 0 Proof Suppose there exists such a term. Then, p :

P p ⊢ e F[M ] ε p : F 0 ε p . But F 0 ε p = 0 ε p which is equal to 0, so F[M ] ε p , which is defined in MLTT U
, is an inhabitant of 0, which is not possible by consistency of MLTT U .

Iterating the forcing translation

For now, we have defined a forcing layer on top of MLTT U , but it is in fact possible to define a forcing layer on top of another forcing layer:

MLTT U [.] F 1 ←--F 1 [.] F 2 ←--F 2
As F 1 contains MLTT U , the translation [.] F 2 is well-defined. Then, the poset of forcing conditions P 2 used by F 2 has to be defined in F 1 . This means in particular that we can use terms of MLTT U but also new logical principles provided by F 1 .

This construction is reminiscent of the iterated forcing construction as presented for example in [START_REF] Jech | Set theory[END_REF]. In terms of topos, this means to build the category of presheaves valuated in another category of presheaves.

Sheaf construction and excluded middle

We have seen how to import a theorem proved in MLTT U in a forcing layer, simply by using its proof-term. However, this method does not work with axioms, for good reasons: there is no reason it stays true in the forcing layer, since we do not have a proof of it.

One simple example is the excluded-middle

EM def = ΠQ : Prop.Q+(Q → 0)
Its translation [EM] σ p is equal to Πq : P p .ΠQ : (P q → Prop).Qq+(Πr : P q .Qr → 0).

It is thus possible to build a set of forcing conditions which negate this formula, simply adapting the construction of the usual Kripke model which negates EM.

If we want to keep this axiom true, a standard way is to add a negative translation to the forcing translation. This is done in Topos theory by the sheafification process on the dense topology (usually noted ¬¬). Indeed, it is well known [START_REF] Shepherdson | Sheaves in geometry and logic: A first introduction to topos theory[END_REF] that the topos Sh(P ¬¬ , E) is a Boolean topos while this is not true for P Sh(P, E).

Adapting the same technique to Type Theory is the subject of ongoing research. The sheafification process is understood as the notion of left exact modalities recently defined in homotopy type theory ([Uni13], §7.7).

The Step-Indexed Layer

As a first illustration of the power of the forcing translation, we study the forcing layer SI obtained when P is (Nat, ≤), the set of natural numbers ordered as usual. This layer (without universes) has already been semantically studied in [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF] as it corresponds to the topos of trees. We have then developed in [START_REF] Jaber | Extending Type Theory with Forcing[END_REF] a syntactic presentation of it using our forcing translation. The main novelty of our approach is to define a later modality ⊲ U as an endofunction on the universe U, inside the forcing layer. This modality is used to interpret guarded recursive types as guarded recursive functions on a universe. Interestingly, when restricted to the universe of mere proposition Prop U , we get the Löb rule that provides a general inductive principle in the logic. As the Löb rule is interpreted directly as a special instance of the fixpoint construction, our construction gives a computational meaning to the Löb rule inside MLTT U . The semantic work of [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF] has later been extended to universes [START_REF] Birkedal | Intensional type theory with guarded recursive types qua fixed points on universes[END_REF] using the same techniques.

It could seem surprising to allow such general recursive definitions, without endanger the consistency of the logic. Indeed, the usual guard condition of fixpoints in type theory, namely the strict positivity, is here to avoid to build terms which could inhabit the empty type 0. However, such strict positivity condition is needed because fixpoints can be unwound with the conversion, the so-called ι-rule. Here, our unwinding of fixpoints are only defined propositionally rather than judgmentally. This is why the consistency result of any forcing layer proved in Section 4.3.2 applied to SI is not contradictory with the usual way inductive types are defined in MLTT U . Moreover, we keep the decidability of the type-checking for the extended type theory of SI, while we are able to formalize for example the pure λ-calculus in it.

Definition of SI

As explained in Section 4.3.1, a forcing layer is defined as a poset of forcing conditions, a list of new symbols together with their types and their translation. Here, SI is defined as the forcing layer whose forcing conditions is (Nat, ≤) as defined in Section 3.1.6, with the following new symbols :

-⊲ U : U → U, the later modality which is used as a guard on types, fix T : (⊲ U T → T ) → T , the fixpoint combinator on guarded types, -

next T : (T → ⊲ U T ) -switch U : ⊲ U U → U together with a proof of [switch U (next U T )] σ p = [⊲ U T ] σ
p which allows us to transfer the modality ⊲ from a universe to a type, comlater T,U Π :

⊲ U j (Πx : T.U ) → (Πx : ⊲ U i T. ⊲ U j U ) and comlater T,U Σ : ⊲ U j (Σx : T.U ) → Σx : ⊲ U i T. ⊲ U j U
which allows us to propagate the guard ⊲ into dependent products and sums.

-

rec µ U : Πf : U → U.µ U f = U f (⊲ U µ U f ) a proof
of equality between a term and its unwinding, where µ U f is a notation for fix U λx.f (switch U x).

We now present the translation SI[ ] of these new symbols, defined as terms of MLTT U .

The later modality We first introduce in the SI layer a later modality

⊲ U : U → U
for any universe U. This modality amounts to shift a presheaf on U one step on the right. Its translation SI[⊲ U ] σ p is defined by λq : Nat p .λT : U σ q . (λr : Nat q .match r with

| 0 => 1 | Sr ′ => (π 1 T )r ′ , λr : Nat q .λt : Nat r .λx : U r .match t with | 0 => ⋆ | St ′ => (π 2 T ) (Pred r) t ′ x) with U r def = match r with | 0 => 1 | Sr ′ => (π 1 T )r ′ .
Recall the 1 is the unit type presented in Section 3.1.5, and ⋆ is its unique element. Here, Nat p stands for {q : Nat | q ≤ p}. In the following, we write ⊲ for ⊲ U when the universe can be inferred easily.

Unwinding the definition of ⊲ U applied to a type T : U of MLTT U , we have -SI ⊲T σ 0 = 1 and SI ⊲T σ Sp = T σ p , -θ σ,⊲T 0→0 = λx : 1.⋆, and θ σ,⊲T (Sp)→0 = λx : T σ p .⋆, -θ σ,⊲T (Sp)→(Sq) = θ σ,T p→q . So for example SI ⊲Bool σ 0 = 1 and SI ⊲Bool σ Sp = Bool. Notice that there are no monotonicity problems with θ σ,⊲T (Sp)→0 since so far we have not define any term M such that ⋄ ⊢ SI e M : ⊲T

The fixpoint operator Then, we introduce a fixpoint operator

fix T : (⊲ U T → T ) → T
for every term T of type U. The meaning of fix T is given by its approximation at level p, computed by induction. At level 0, the fixpoint of f : ⊲ U T → T is given by the value of f on the unique inhabitant of ⊲ U T at level 0. And at level p + 1, the value is given by f applied to the approximation at level p. Formally, the translation SI[fix T ] σ p is defined by λq : Nat p .λf : ⊲ U T → T σ q .nat rect s,q (λr : Nat q . T σ r ) (f 0 ⋆) (λr : Pred q .λa :

T σ r .f (Sr)a) q
where Pred p def = {q : Nat | q < p} and nat rect s,p is defined as a restriction of nat rect U on the set Nat p .

The later modality and fixpoint operator on Prop U When T is a proposition P , fix P M computes a proof of P from a proof M of ⊲ Prop P → P , This is exactly what the Löb rule Löb ⊲ Prop P ⊢ P ⊢ P does, so fix P gives the computational content of this rule. Thus, applying the Löb rule on a proof π of ⊲ Prop P → P simply amounts to consider the proof term fix P (π) : P .

The lifting of the later modality For every term T of type U, there exists a lifting

next T : (T → ⊲ U T )
that transports elements of the presheaf T into elements of the presheaf ⊲ U T This morphism simply amounts to use the retractions θ σ,T Sp→p to lift elements of the presheaf accordingly. The translation [next T ] σ p is given by λq : Nat p .λu :

T σ q .match q with | 0 => ⋆ | Sq ′ => θ σ,T q→q ′ u
Internalizing the later modality for universes For every universe U, we can internalize the shifting induced by the later modality directly in the presheaf. This is done by introducing a morphism switch U : (⊲ U U → U)

whose translation [switch U ] σ p is defined by

λq : Nat p .λf : ⊲ U s σ q . (λr : Nat q .match r with | 0 => 1 | Sr ′ => (π 1 f )r ′ , λr : Nat q .λs : Nat r .λM : T r .match s with | 0 => ⋆ | Ss ′ => (π 2 f )(Pred r)s ′ M ) with T r def = match r with | 0 => 1 | Sr ′ => (π 1 f )r ′ .
The lifting and switching of the later modality are connected by the following lemma.

Lemma 4: For every T : U and every forcing condition p,

[switch U (next U T )] σ p = [⊲ U T ] σ p .

Forcing equalities on the new constructors

To make the later modality, the lifting and the switching usable in practice, we introduce proof-terms that make naturality and commutativity properties explicit in the SI layer.

For for any T : U i and U : U i , we add two terms comlater T,U Π : ⊲ U j (Πx :

T.U ) → (Πx : ⊲ U i T. ⊲ U j U ) and comlater T,U Σ : ⊲ U j (Σx : T.U ) → Σx : ⊲ U i T. ⊲ U j U in the SI layer. Its translation comlater T,U Π σ
p is given by λq : Nat p .λf : ⊲Πx : T.U σ q . match q with | 0 => (λ .λ .⋆, . . .)

| Sq ′ => (λr : Nat q ′ λu : U σ r .f ru, . . .) We also add proof-terms that state the naturality of next T with respect to T .

General recursive types

Before providing a definition of recursive types for any general recursive definition, we study the property of the translation of fix.

Theorem 7: For every f : ⊲U → U and every forcing condition p,

[fix U f ] σ p ≡ [f (next U (fix U f ))] σ p .
The theorem above is induced by the following (conversion) equalities.

Lemma 5: For every natural number p, the following holds: 1. for every T :

U, ⊲ U T σ Sp ≡ T σ p 2. for every M : T , [next T M ] σ Sp ≡ [M ] σ p 3. for every f : ⊲U → U, [fix U f ] σ Sp ≡ [f ] σ Sp (Sp)[fix U f ] σ p
Now, given a recursive definition f : U → U for any universe U, we can define

µ U f = fix U λx.f (switch U x).
Then, using Theorem 7 and Lemma 4, we can add a proof term

rec µ U : µ U f = f (⊲ U µ U f )
which is just translated in the original layer using refl :

SI[rec µ U ] σ p = refl [µ U f ] σ p .
Finally, using eq rect, we can define two morphisms fold U : Πf :

(U → U).µ U f → f (⊲ U µ U f ) and unfold U : Πf : (U → U).f (⊲ U µ U f ) → µ U f together with two proof terms π fold U : Πf : .Πx : .unfold U f (fold U f x) = x π unfold U : Πf : .Πx : ..fold U f (unfold U f x) = x translated using refl.
Note that compared to [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF], we do not require contractiveness of the recursive definition to compute a recursive type. But the unfolding of a recursive type introduces uniformly a later modality in front of any use of the recursive variable.

Our definition of recursive types introduces a later modality ⊲ on the recursive type at each unfolding. But in the particular case of recursive types satisfying the strictly positive condition, we can automatically erase the introduced ⊲.

Simple Examples

The Natural Numbers Let first define a type Nat SI of natural number in the forcing layer SI, without using Nat. We first define Nat SI as µ U (λT : U.1+T ). Then, writing

0 SI def = unfold U (λT : U.1+T )(inl(⋆)),
we can check that 0 SI : Nat SI . Similarly, we can define the successor function as

S SI def = λn : Nat SI . unfold U (λT : U.1+T )(inr(n)).
Note that the translation of S SI (in the empty environment) provides a term of MLTT U which is already quite complex.

Binary Trees

As another example, we define binary trees on natural numbers in the SI layer :

Tree = µ U (λT : U.(ε : 1) + (node : Nat × T × T )).
The properties of µ U gives an induction principle annotated with the ⊲ modality.

D def = µ U (λT : U.T → T ).
This amounts to add in MLTT U a type satisfying the usual domain equation for the pure lambda calculus

D = D → D.
The idea is that, although this object does not exists in MLTT U , we can manipulate it directly in the forcing layer, and only its approximations at level n will be considered by MLTT U 's type checker.

For simplicity, we suppose that the function next T is declared as a coercion and thus we do not write it explicitly in the rest of this section. We pose We can introduce an analogous of switch U for D defined as

↓: ⊲D → D def = λt : ⊲D.fun(λ : ⊲D.t)
Thus, we can define application in D as

f @s def = ↓ (funf )s
Intuitively, the operator ↓ tags each β-reduction in the term, thus we get a pure lambda calculus where we can keep track of places where a reduction has occurred. For example, we can construct the usual looping term

Ω def = fun(λx : ⊲D.x@x)
and prove that for all integers n,

Ω@Ω = ↓ n (Ω@Ω)
where ↓ n denotes n applications of ↓. Note that even Ω@Ω reduces to itself (plus a lift), there is no problem of termination because we have here an equality but the two terms are not convertible. Indeed, each β-redex is "guarded" by defun • fun that has to be explicitly rewritten into id to enable MLTT U 's conversion.

In the same way, we can define the Y fixpoint combinator as

Y def = fun(λf.(Y ′ f )@(Y ′ f )) with Y ′ f def = fun(λx.f @(x@x))
Since β-reductions are tagged, we do not have the usual equation Y g = g(Y g). Indeed, those terms are β-equivalent, but the places where β-reductions have to be done are different. Thus, we only get a weaker version of the unfolding lemma.

Lemma 6: For all terms g : D,

Y @g = ↓ 2 (g@((Y ′ g)@(Y ′ g))).

Forcing the Negation of the Continuum Hypothesis

We now build a forcing layer where we can prove the negation of the Continuum Hypothesis, assuming the excluded middle in the original layer (notice that, as explained in Section 4.3.4, the excluded middle is not preserved in the forcing layer). We adapt the usual construction of Cohen, using its reformulation in terms of topos of sheaves, as presented in [START_REF] Shepherdson | Sheaves in geometry and logic: A first introduction to topos theory[END_REF]. As we will see, the proof is much simpler than the usual one in classical forcing. Indeed, we do not need any hypothesis like the countable chain condition [START_REF] Jech | Set theory[END_REF] on the set of forcing conditions P. This is due to the fact that we are working with constant presheaves to translate types like Nat, so that, as we will see, conservation of cardinals is straightforward. This would not be the case if we were working with constant sheaves (a constant presheaf is not a sheaf in general).

In the following, P(T ) denotes the type T → Prop corresponding to the "power set" of T . We suppose to work with resizing axiom, as defined in Section 3.1.8, so that the definition of Prop does not need to be indexed by a universe. We build a forcing layer where we can add a type A with injections

Nat ֒→ i 1 A ֒→ i 1 P(Nat)
and such that there is no surjection from Nat to A and from A to P(Nat), thus negating the Continuum Hypothesis. The set of forcing conditions is given by

P def = (P(P(Nat)) × Nat) → f in Prop
where → f in denotes the type of function with finite support. This type can be defined in MLTT U using dependent sums. The order is the usual inclusion order on functions: q ⊆ p if the domain of p is smaller than the domain of q and the two functions coincide on their common domain.

For a closed type T : U, we write T for the constant presheaf defined as T σ p = (λq : P p .T, λq : P p .λr : P q .id).

The set A that will negate the continuum hypothesis is P(Nat). The idea is to collapse P(P(Nat)) to P(Nat) in the forcing layer. Then, using the injection from P(Nat) to P(P(Nat)), this gives us the wanted injection i 2 : P(Nat) to P(Nat). To sum up, we will build injection

Nat ֒→ i 1 P(Nat) ֒→ i 2 P(Nat)
with the proofs of non-existence of surjections

Nat A P(Nat)
We insist on the fact that P(Nat) is not equal to P( Nat) = P(Nat) since P(Nat) σ

Building the injection i 2

We add a new symbol f of type P(P(Nat)) → P(Nat) whose translation is defined as

[f ] σ p def
= λq : P p .λb : P(P(Nat)).λr : P q .λn : Nat.λs : P r .

(s r ∧ s(b, n) = true)

Theorem 8: For every forcing condition p, [f ] σ p is an injection, which means that the proposition Πb 1 , b 2 :

P(P(Nat)).f (b 1 ) = f (b 2 ) ⇒ b 1 = b 2 p is provable in MLTT U plus excluded middle.
Proof Since p is a partial map from (P(P(Nat)) × Nat) to Prop whose domain is finite, we can find an m such that p(b 1 , m) and p(b 2 , m) are undefined. If b 1 = b 2 , we can define a new forcing condition q that extend p such that q(b 1 , m) = true and q(b 2 , m) = false. But then we can easily check that

[f ] σ p (p)(b 1 )(p)(m)(q) = true and [f ] σ p (p)(b 2 )(p)(m)(q) = false Using the excluded middle, we can conclude that b 1 = b 2 .
Finally, i 2 is built from f as:

i 2 def = P(Nat) ֒→ P(P(Nat)) f -→ P(Nat)
The injection i 1 is just obtained as the lifting of the injection from Nat to P(Nat).

Absence of surjections

We now prove that if there is no surjection between S and T in the ground system, then there is no surjection between S and T in the forcing layer. This is usually called the "conservation of cardinals".

Assume the formula

NS(T, S)

def = (ΣF : T → S.Πs : S.Σt : T.F (t) = s) → false

We will prove in the forcing layer the formula NS( T , S).

As the restriction map on T and S are equal to the identity, NS( T , S) ε p just enforces that there is no F : P q → (T → S) such that F (q) is a surjection between T and S, which is given by NS(T, S).

Discussion and Future Work

We have introduce a modular way to extend type theory while keeping its good properties. However, some theoretical problems remain, concerning the notion of explicit coercions of conversions and the unicity of the translation.

Indeed, if we impose equations between explicit conversions they must be taken into accounts when defining convEq σ,p M,N . But as explained in Section 3.1.7, all those equality should be based on properties on transport λT.T U . Therefore, as [c T,U (M )] σ p is defined using transport λT.T U , all equations between explicit conversions would probably trivially hold in the translation.

Topos of trees

In [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF], Birkedal et al. have studied the internal logic of the topos of presheaves on ω. They show that this logic admits general recursive types as soon as the considered recursive definitions are contractive. In Section 4.4, we have presented a syntactic translation of this logical layer using forcing.

Our presentation presents several advantages: -Since we have access to the universe U, we are able to define an automatic translation from any recursive definition to a contractive recursive definition. -General recursive types are translated into MLTT U terms, and can thus be given computational content.

-The type-checking of the Step-Indexed forcing Layer is decidable. This semantics model was later extended by Birkedal and Mogelberg to intentional Martin-Löf Type Theory with one universe in [START_REF] Birkedal | Intensional type theory with guarded recursive types qua fixed points on universes[END_REF]. It should be possible to show that their model, a presheaf category C ω op , where C is a model of Martin-Löf Type Theory with one universe is a model of this forcing layer. Indeed, the main difference with our work is that they are using Tarksi-style notion of universes.

Of particularly interest in their work is a result relating fixpoint on universes with guarded recursive types. It should be possible to import it in our setting. This would be particularly useful because guarded recursive types as defined in [START_REF] Birkedal | First steps in synthetic guarded domain theory: step-indexing in the topos of trees[END_REF] are easier, in certain circumstances, to work with compared to fixpoints on universes. Indeed, they satisfies a Banach fixpoint theorem which give unicity of fixpoints. These has to be compared to usual fixpoints theorems, like Knaster-Tarski, where we have unicity of lowest and greatest fixpoints. With Banach fixpoint theorem, this means that these two notions coincide, so we can use guarded recursive types to define coinductive types. Such coinductive definitions has recently been studied by McBride and Atkey [START_REF] Atkey | Productive coprogramming with guarded recursion[END_REF], and Mogelberg [Møg] 4.6.2 Higher-Order Abstract Syntax

In Section 4.4.5, we have sketched a formalization of the untyped λ-calculus with guarded recursive types. It would be interesting to link this idea to the litterature on Higher-Order Abstract Syntax [START_REF] Pfenning | Higher-order abstract syntax[END_REF] (HOAS). The basic idea of HOAS is to use the binder of the theory to represent the binder of the formalized language1 . In general, there are two problems for doing this in type theory. First, it requires to define an inductive type for D, the domain of the language, which does not satisfy the usual strictly positive condition. Second, there can be terms in D that do not correspond to "real" λ-terms.

Despeyroux, Felty and Hirschowitz [START_REF] Despeyroux | Higher-order abstract syntax in coq[END_REF] have proposed a way to define a weaker version of HOAS in Coq, where they use an auxiliary type Var of variables, so that D is then defined as (Var → T ) → T . With this workaround, function abstraction is still defined using the abstraction of the type theory, but this is no more the case for substitution. Then, they define a predicate to restrict inhabitants of this types to the one which are extensionally equal to effective λ-terms. It would be interesting to adapt their work to the new possibility of using guarded recursive types to define a general type D without any workaround.

Maybe more interestingly, various models of HOAS has been built using a presheaf construction over categories. One can cite the work of Fiore, Plotkin and Turi [START_REF] Fiore | Abstract syntax and variable binding[END_REF], the work of Hofmann [START_REF] Hofmann | Semantical analysis of higher-order abstract syntax[END_REF] and the work of Gabbay and Pitts [START_REF] Gabbay | A new approach to abstract syntax involving binders[END_REF]. In fact, this last article was the origin of nominal logic. It would be interesting to see if these constructions could be imported in our setting, but this would necessitate first to extend our presheaf translation with categories as forcing conditions.

Presheaves models of HoTT

In recent works [Shu12, Shu13], Shulman has built presheaves model of Intentional Type Theory which conserve the Univalence Axiom. That is, from a model of Type Theory C which validates the univalence axiom (namely sSet, the category of simplicial sets), he has shown that the category of presheaves C D op over a category D still validates the univalence axiom, when D has special property (Inverse diagrams, Elegant Reedy Category). This was then used by Lars Birkedal and Rasmus Mogelberg [START_REF] Birkedal | Intensional type theory with guarded recursive types qua fixed points on universes[END_REF] to show that the category of presheaves C ω op validates univalence when C already validates it.

It would be interesting, once extending our work to a presheaf translation over a category (rather than a poset), to deduce from the work of Shulman what must imposed on the set of forcing condition to preserve the univalence axiom.

Forcing as a program transformation

Krivine has been one of the first to study the computational content of the forcing translation [START_REF] Krivine | Realizability algebras: a program to well order R[END_REF]. This work has been rephrased by Miquel in [START_REF] Miquel | Forcing as a program transformation[END_REF], where the forcing translation of proofs is interpreted as a program transformation on λ-terms. They focus on classical logic while we only study an intuitionistic translation. Moreover, since they are working in a logical system with a syntactic stratification between proofs and propositions (PAω in [START_REF] Miquel | Forcing as a program transformation[END_REF]), proof-terms and formulas are not translated uniformly, contrary to our work.

From presheaves to sheaves

As we have seen in 4.3.4, our forcing translation is intuitionistic. A solution to conserve the excluded middle would be to use sheaves instead of presheaves, for a well suited topology (the dense or double negation topology) [START_REF] Shepherdson | Sheaves in geometry and logic: A first introduction to topos theory[END_REF]. Sheaves restrict presheaves with gluing conditions, so we need to introduce a notion of topology on P, formalized inside MLTT U , to define them. The best way to do it seems to use the notion of Lawvere-Tierney topology, which provides a categorical definition of sheaves where the topology is induced by particular function j : Prop → Prop satisfying some commutative diagrams. The idea is then to instantiate j by ¬¬ to get the dense topology.

Constructive Mathematics

As we said in the introduction, one of the starting point of this forcing translation was our previous work with Thierry Coquand [CJ10,[START_REF] Coquand | A computational interpretation of forcing in type theory[END_REF] to give a computational content to a result of uniform continuity of definable functionals. It would be interested to recast it using the translation presented in this chapter. However, the translation used in this work was not purely intuitionistic, but it was rather inspired by Beth semantics [START_REF] Beth | The Foundations of Mathematics[END_REF]. That is, a notion of covering on forcing conditions-similar to what is used in sheaves theorywas used. Indeed, our work was even later generalized by Escardo and Xu [START_REF] Xu | A constructive model of uniform continuity[END_REF][START_REF] Escardó | Continuity of gödel's system t definable functionals via effectful forcing[END_REF] by using sheaves models. This means that the presheaf translation presented here would not be enough to restate these works, and we would need a sheaf translation.

An other interesting example of forcing translation in constructive mathematics we wish to adapt is the proof of Levin [START_REF] Levin | One conservative extension of formal mathematic analysis with a scheme of dependent choice[END_REF] of conservativity of the existence of an ultrafilter on N with respect to higher-order Peano Arithmetic with the axiom of dependent choice. This proof uses partial functions from Nat to Bool (with an infinite domain) as forcing conditions. Defining a forcing layer on this set could allow us to give a computational content to proofs which use an ultrafilter, like Gödel's completeness theorem or the Ramsey theorem. It would then be interesting to compare this interpretation with the interpretation of Krivine [START_REF] Krivine | Realizability algebras: a program to well order R[END_REF].

To achieve our goal of proving the completeness of Kripke logical relations, defined in a direct way, for RefML, we need to link them to a fully abstract denotational model i.e. such that the denotations of two terms are equal iff they are contextually equivalent. The long-standing quest of such fully abstract models has seen its achievement with game semantics.

Game Semantics [HO00, AJM00] is a powerful theory to build fully abstract denotational models of various programming languages. The denotation of a term is represented as a strategy, a set of plays between that term and any context in a game arena, which sets the rules the plays have to satisfy. One of its most important contributions, the so-called "Abramsky Cube", is the characterization of the absence of various impure effects in terms of extra conditions on the denotation of terms, namely well-bracketing for the absence of control operators, visibility for the absence of higher-order store, innocence for pure terms. In recent years, game semantics has been developed to deal with languages with nominal aspects, from the ν-calculus [AGM + 04], an extension with storage cells [START_REF] Laird | A game semantics of names and pointers[END_REF], to ML-like languages with higher-order nominal references [START_REF] Murawski | Game semantics for good general references[END_REF].

The starting point of this section is the nominal game semantics of Murawski and Tzevelekos [START_REF] Murawski | Game semantics for good general references[END_REF], presented in Section 5.1, which is fully abstract for RefML, but also for GroundML as soon as one adds a visibility condition to strategies [START_REF] Murawski | Algorithmic games for full ground references[END_REF]. As opposed to previous games models for languages with stores, initiated by Abramsky, Honda and McCusker [START_REF] Abramsky | A fully abstract game semantics for general references[END_REF], it uses nominal techniques [START_REF] Pitts | Nominal logic, a first order theory of names and binding[END_REF], already used in [START_REF] Tzevelekos | Full abstraction for nominal general references[END_REF], to avoid the problem of bad variables. In a more operational setting, Laird [START_REF] Laird | A fully abstract trace semantics for general references[END_REF] has introduced a trace semantics for a variant of RefML, and has proven its full abstraction. This model marries a trace representation inspired by game semantics with an operational definition, i.e. denotations of terms are computed via a rewriting system rather than defined by induction on their typing judgment.

In this section, we introduce a trace semantics for RefML, whose definition is a typed variant to the one introduced by Laird. Traces are generated by an interactive reduction, which can be seen as an extension of the usual operational semantics to open terms with free functional variables. So this reduction can be performed on terms like λx.M or K[f v]. Then, the denotation of terms is defined via trace-strategies, i.e. sets of traces that terms generate using this reduction.

Trace semantics allows a finer study of the interaction compared to game semantics, by keeping track of the disclosure process of values (either locations or functions) between the term and contexts. Indeed, in game semantics, one cannot generally decompose plays into "subplays", since we get sequences of moves where some of these moves are no more justified, and thus left uncontrolled. With trace semantics, such unjustified moves are simply seen as disclosed values, which can be taken care of by the interactive reduction. Using this finer decomposition, we can prove a decidability result for the contextual equivalence of "pure" terms of RefML, that is terms which do not use any storage possibilities (but with unrestricted contexts). It uses crucially the control of disclosed functions to perform surgery on traces. In the next chapter, we will see how to perform such surgery for "impure" terms, by defining new techniques to reason on disclosure of locations.

In fact, traces can be seen as a representation of plays used in game semantics where the usual pointer structure, which represents the causality between the different moves, is encoded with variables. Such variables that are of functional type are called name pointers.

Following this idea, we prove a correspondence between this denotation of terms, defined as set of traces, and the denotation of game semantics defined using sets of plays. To do so, we impose on trace-strategies a categorical apparatus that capture call-by-value languages, namely a closed-Freyd category [START_REF] Power | Premonoidal categories and notions of computation[END_REF][START_REF] Power | Closed freyd-and kappa-categories[END_REF]. It consist in -a symmetric premonoidal category (C, I, ⊗), -a luff category C ′ of C, for which ⊗ is a cartesian product, -a strict premonoidal functor (.) † between C ′ and C, which is the identity on objects, such that for every object A of C, the functor ( ⊗ A) † : C ′ → C has a right adjoint. To build such a structure on traces, we recast the definitions of game semantics from [START_REF] Laird | A game semantics of names and pointers[END_REF][START_REF] Murawski | Game semantics for good general references[END_REF] in the setting of trace semantics. The main difficulty is that the pointer structure of traces is no more defined explicitly, but need to be rebuilt from a study of freshness of name pointers (i.e. functional variables).

Then, we relate the usual notion of view from game semantics to sets of available player name pointers, so that we can import the visibility condition which capture the behavior of terms of GroundML directly on traces. Finally, modifying the interactive reduction to restrict the opponent questions to be performed on such available player name pointers, we can capture the contextual equivalence of GroundML with trace equivalence.

Plan of the Chapter

The basic notions of game semantics (in a call-by-value setting) and its categorical structure are introduced in Section 5.1. Section 5.1.7 recall the basic facts of nominal game semantics.

The notion of trace is formally defined in Section 5.2.1 and its correspondence with plays in game semantics is drawn in Section 5.2.2. The interactive reduction is introduced in Section 5.2.3 and the interpretation of terms as sets of traces is defined in Section 5.2.4. Then, one of the main contribution in this chapter, presented in Section 5.3, is the comparison of this trace model to the game semantics model of Murawski and Tzevelekos [START_REF] Murawski | Game semantics for good general references[END_REF], and the proof that the two are in fact equivalent. We also answer a question asked by Laird at the end of [Lai07] about a possible trace semantics for a language with restricted references, rephrasing the usual notion of visibility in the setting of trace semantics. This is done in Section 6.7.2. Finally, in Section 5.5, we exemplify the usefulness of trace semantics by proving that contextual equivalence of pure terms in RefML (and also GroundML) is decidable. This gives a first example of the ideas introduced in the next two chapters to reason on contextual equivalence.

Call-By-Value Game Semantics

Let us begin by introducing standard definitions from game semantics. The main idea is to interpret terms as strategies, which are well-behaved sets of plays, representing their interactions between any possible contexts (also called environments) in terms of questions/answers. These plays are formed by moves, which are either ground values (integer, booleans, locations), or a special move ⋆ representing a functional value. Such moves also indicates in which arena they belong, using a notion of tag introduced subsequently, which is useful to build disjoint union of arenas. Then, plays are defined as lists of moves with a pointer structure.

Here, we focus on call-by-value game semantics. Its main difference, compared to the usual call-by-name game semantics, is that it uses two different arenas, depending on whether we represent terms or values. Then, initial moves of arenas used to represent values are player answers. Our presentation follows the work of Honda and Yoshida [START_REF] Honda | Game-theoretic analysis of call-by-value computation[END_REF], in that we give a direct presentation of the semantics of terms, using a structure of closed-Freyd category [PR97, PT99] while Abramsky and McCusker [START_REF] Abramsky | Call-by-value games[END_REF] rather build a model of call-by-value using the work of Moggi [START_REF] Moggi | Notions of computation and monads[END_REF], i.e. via a strong monad. The two presentations are equivalent, however, our trace semantics is defined in a direct way, being more operational. This justifies the choice of closed-Freyd categories.

Arenas

Plays are formed by moves, which represent actions performed by the term or the context. They are elements of arenas.

Definition 7 (Arena). An arena A is defined as a tuple (M

A , I A , λ A , ⊢ A ) such that -M A is the set of moves, -I A ⊆ M A is the set of initial moves,
-λ A : M A → {O, P } × {Q, A} is the labeling function which associates the polarity {O, P } and the statute {Q, A} of a move, -⊢ A is the justification relation between M A and M A \I A , which satisfies:

-

If m ⊢ A m ′ then λ OP A (m) = λ OP A (m ′ ) (i.e. Player and Opponent alternate). -If m ⊢ A m ′ and λ QA A (m ′ ) = A then λ QA A (m) = Q (i.
e. an answer is necessarily justified by a question).

In the following, we write i, a, q, o, p respectively for initial, answers, questions, opponent or player moves. Unusually, moves comes with a tag, which are words ξ from the alphabet {l , r }, where the concatenation is written ξ • ξ ′ and the empty tag (i.e. the empty word) is written ε. Such tags are used to indicate to which arena a move belongs to, which is useful when we build arenas from other ones. It avoids to use disjoint union (seen as coproduct) with the usual injections in l , in r . So moves m are defined as pairs (a, ξ) of an atom (which can be a ground value, a special symbol ⋆ or a tuple of moves), and a tag ξ We extend the concatenation of tags ξ to act on moves m = (a, ξ), written ξ ′ • m, and defined as (a, ξ ′ • ξ). Such concatenation operation is then extended to act pointwisely on set and relations of moves.

In call-by-value game semantics, we have to introduce two kinds of arenas, depending on whether we want to interpret terms or values. Such distinction is not present in usual call-by-name game semantics.

Definition 8 (Term-Arena). A Term-Arena A is an arena (M A , λ A , ⊢ A ) which also satisfies that for all i A ∈ I A , λ A (m) = (O, Q).

Definition 9 (Value-Arena). A Value-Arena

A is an arena (M A , λ A , ⊢ A ) which also satisfies that for all i A ∈ I A , λ A (m) = (P, A).

Notice that we have changed the names usually used in the literature on call-by-value games, where a term-arena is called prearena and value-arena is simply called an arena. We use this new terminology to insist on the fact that the interaction of a term with a context will take place in a term-arena. Indeed, before reducing to a value, a (nonclosed) term can interact with its contexts. This is for example the case of the term let x = f 3 in λg.g x, where f is a function of type Int → Int. In a call-by-value setting, an interaction of this term can be seen as:

-Player ask the value of f to the context with the value 3, -Opponent answers a value n, -Player answers λg.g x (we will see that it is represented by a move ⋆), -then Opponent can interrogate this function. Let us now illustrate those definitionsby introducing some Value-arenas and constructions on Values-arenas.

Definition 10 (Ground-Type Value-Arenas). We associate to each ground type ι the Value-arena

ι def = (M ι , I ι , λ ι , ⊢ ι ) defined as -M ι def = {(v, ε | v a closed value of type ι} and I ι def = M ι , -λ ι def = m → (P, A), -⊢ ι = ∅.
So for example, the arena Int associated to the type Int is defined as the set of moves

M Int def = { n | n ∈ Z}, I Int = M Int with the labeling function λ Int def = n → (P, A) with n ∈ Z.
Even if we do not consider type products in our language, we need to define the product of two value-arenas to interpret contexts.

• I A × r • I B )) -M A⊗B def = I A⊗B ⊎ l • (M A \I A ) ⊎ r • (M B \I B ) -λ A⊗B def = [(l • i A , r • i B ) → OQ] ⊎ l • λ A ⊎ r • λ B -⊢ A⊗B def = {((l • i A , r • i B ), l • m) | i A ⊢ A m} ⊎ {((l • i A , r • i B ), r • m) | i B ⊢ B m} ⊎ (l • ⊢ A|(M A \I A ) 2 ) ⊎ (r • ⊢ B|(M B \I B ) 2 )
Definition 12 (Arrow Value-Arena). Let A, B two Value-Arenas, we define the Value-arena A ⇒ B as the triple (M A⇒B , I A⇒B , λ A⇒B , ⊢ A⇒B ) where -

I A⇒B def = {⋆} -M A⇒B def = I A⇒B ⊎ (l • M A ) ⊎ (r • M B ) -λ A⇒B def = [⋆ → P A] ⊎ l • (λ A [i A → OQ]) ⊎ r • λ B -⊢ A⇒B def = {(⋆, l • i A )} ⊎ {(l • i A , r • i B )} ⊎ (l • ⊢ A ) ⊎ (r • ⊢ B )
Definition 13 (Arrow Term-Arena). Let A, B two Value-Arenas, we define the Term-arena A → B as the triple (M A→B , I A→B , λ A→B , ⊢ A→B ) where -

I A→B = I A -M A→B def = (l • M A ) ⊎ (r • M B ) -λ A→B def = l • (λ A [i A → OQ]) ⊎ r • λ B -⊢ A→B def = {(l • i A , r • i B )} ⊎ (l • ⊢ A ) ⊎ (r • ⊢ B )

Plays

We now consider finite sequences of moves s = m 1 . . . m n of an arena A equipped with a pointer structure, that is, for every move m i (i ∈ {2, . . . , n}) which is not in I A , a justification pointer to a move m j such that j < i and m j ⊢ A m i . Such sequences of moves are called justified sequences when additionally only m 1 ∈ I A . When a move m of a justified sequence s points to an other move m ′ , we say that m ′ justifies m. If moreover m ′ is a question and m an answer, we say that m answers m ′ . Taking a justified sequence s, we write s ′ ⊑ s when s ′ is a prefix of s. If moreover s ′ is of even-length (resp. odd-length), we write s ′ ⊑ even s (resp. s ′ ⊑ odd s). When m is a move of s, we write s ≤m for the prefix of s whose last element is m. Considering a justified sequence of moves s on an arena A → B, we often need to consider the subsequences s |A (resp. s |B ) on the arena A (resp. B), defined as the subsequences of s formed by moves m = (a, ξ) such that (a, l • ξ) (resp. (a, r • ξ)) is a move of s.

We now introduce the notion of plays, which are justified sequences satisfying the constraints of alternation and well-bracketing. Definition 14 (Play). A play s on an arena A is a justified sequence on A such that -each answer a of s is justified (i.e. answers) by the last unanswered question of s ≤a (Well-Bracketing), -for every adjacent moves mn of s,

λ OP A (m) = λ OP A (n) (Alternation).
The set of plays on an arena A is written P A . When working on GroundML, we need to restrict plays with the usual notion of P-visibility and O-visibility, defined using the view of a justified sequence.

Definition 15 (P-View). The view s of an odd-length justified sequence s on A is the subsequence of s defined by induction:

-ε = ε, -i A = i A -s ′ • m • s ′′ • n = s ′ • m • n if n points to m.
Definition 16 (P-Visibility). A justified sequence s on A satisfies the P-visibility condition iff for all s ′ p ⊑ even s, p points to a move in s ′ . P-visibility restricts the possibilities of interactions terms have, so that they correspond to terms of GroundML. However, contexts can still use higher-order references in this setting. To forbid it, we need to introduce the dual notion of O-visibility.

Definition 17 (O-Visibility). A justified sequence s on A satisfies the O-visibility condition iff for all s

′ o ⊑ odd s, o points to a move in s ′ .
Then a justified sequence is said to be visible when it is both P -and O-visible. This characterization captures exactly GroundML.

Strategies

We now introduce the notion of strategies, which are sets of plays on an arena A which represent the denotation of terms.

Definition 18 (Strategy).

A strategy υ on an arena A, written υ : A is a set of evenlength plays on A which is downward-closed, i.e. for all sop ∈ υ, we have then s ∈ υ.

One of the most important strategy is the so-called copycat, which represents the identity function. Taking an arena A, we define id A : A → A as the set of plays

{s ∈ P A→A | s even ∧ s |A l = s |Ar }
where A l (resp. A r ) represents the left (resp. the right) occurence of A in the arena A → A. More generally, we can define the projections π i : A 1 ⊗ A 2 → A i for i ∈ {1, 2} in the same way.

To get a denotational model, we still have to define a way to compose the denotation of two terms of type A → B and B → C. This is done in two steps, called parallel composition and hiding. More precisely, the parallel composition of a strategy υ : A → B and a strategy κ : B → C, written υ||κ is a set of legal sequence of moves of M A , M B , M C . Then, the hiding simply removes the moves of M B , and update the pointer structure, so that to get a new strategy, written υ; κ : A → C.

Let us first introduce the term-arena A → B → C associated to three value-arenas A, B, C 1 :

-

I A→B→C def = (l • l ) • I A -M A→B→C def = (l • l ) • M A ⊎ (l • r ) • M B ⊎ (r • r ) • M C , -λ A→B→C def = (l • l ) • (λ A [i A → OQ]) ⊎ (l • r ) • (λ B [i B → P Q] ⊎ (r • r ) • (λ C ) -⊢ A→B→C def = {(l •l •i A , l •r •i B )}⊎{(l •r •i B , r •r •i C )}⊎(l •l • ⊢ A )⊎(l •r • ⊢ B )⊎(r •r • ⊢ C )
Then, taking a justified sequence s ∈ A → B → C, we define the following restricted justified sequences:

-s |AB is the justified subsequence of s formed by all moves (a, ξ)

s.t. (a, l • ξ) is a move of s, -s |BC is the justified subsequence of s formed by all moves (a, l • ξ) s.t. (a, l • r • ξ)
is a move of s, and all moves (a, ξ)

s.t. (a, r • ξ) is a moves of s -s |AC is the justified subsequence of s formed by all moves (a, l • ξ) s.t. (a, l • l • ξ)
is a move of s, and all moves (a, ξ) s. This composition can be shown to be associative. This means that we can build a category G, whose objects are value-arenas A, B and morphisms are strategies on A → B. However, a problem appears: the product ⊗ is not cartesian-it is not even monoidal. This is due to the fact that we could have defined in the same way a right pairing, as (A ⊗ κ); (υ ⊗ D), and there is no reason for left and right pairings to coincide. This is related to the fact that to define an operational semantics for the pairing M 1 , M 2 in RefML, one need to fix the order of evaluation: either we begin with evaluating M 1 , or with evaluating M 2 . This problem does not appear in call-by-name languages. Notice that ⊗ is still a premonoidal product, i.e. it is functorial in each of its component.

Pairing

Single-Threaded Strategies

To solve this lack of a cartesian product, we now define a luff category2 G ST T of G, formed by single-threaded strategies. This category G ST T is better behaved, since it is a cartesian closed category. Here, we follow the presentation of Laird [START_REF] Laird | A game semantics of names and pointers[END_REF]. Definition 21. A strategy υ : A is said to be total if for all every initial move i ∈ M A , there exists a player answer a such that ia ∈ υ. Definition 22. A strategy υ : A is said to be single-threaded if it is total and for all ias ∈ υ, there exists at most one move of s which is justified by a.

Then, taking a play s = ias ′ , we define its current thread in the following way:

-

thr(ias ′ m) = iam if m is justified by a, -thr(ias ′ m) = thr(ias ′ )m if m is justified by i, -thr(ias ′ m) = thr(ias ′′ )m if m is justified in s ′ .
Then, s ′′ is defined as the longest prefix of s ′ such that the move which justifies m is in thr(ias ′′ ). This definition extends to strategies: thr(υ) is the set of the current threads of plays s ∈ υ. It is in fact the largest single-threaded strategy contained in υ.

A play s = ias ′ over a term-arena is said to be thread-independent if for all s ′′ p ⊑ even s, thr(s ′′ p) = thr(s ′′ )p. The set of thread-independent plays on an arena A is written P ti A . Once again, the definition of thread-independent plays extends straightforwardly to strategies.

Then, we can define a "shuffle" operation (•) † which transforms a single-threaded strategy υ on A into a thread-independent strategy υ † , defined as {s ∈ υ | |s| ≤ 2} ∪ {s ∈ P ti A | ∀s ′ ⊑ even s.γ(thr(s ′ )) ∈ υ}. This operation satisfies the following equality: Lemma 7: For any thread-independent strategy s, thr(s) † = s.

We can now formally define the category G ST T whose objects are value-arenas and whose morphisms are single-threaded strategies. The composition of two single threaded strategies υ, κ is then defined as υ † ; κ.

Then, one can easily see that ⊗ is a cartesian product in G ST T . Indeed, taking two single-threaded strategies υ : A → B and κ : A → C, one can define their pairing υ ⊗ κ : A → B ⊗ C as the set of single-threaded plays s such that s |A,B ∈ υ and s |A,C ∈ κ. From s single-threaded, we can write it as iaos ′ , where a is a player answer and o and opponent question. Then, o is either in the arena B or C, and there is no other opponent questions justified by a in s. Thus υ ⊗ κ is indeed well-defined. Moreover, the operation (•) † is indeed a premonoidal functor between G ST T and G, as proven in [START_REF] Laird | A game semantics of names and pointers[END_REF].

Interpretation of Terms

Let A, B, C three value-arenas. Then there exists a bijection Λ B A,C between strategies on (A ⊗ B) → C and single-threaded strategies on A → (B ⇒ C), defined as

υ → {ε} ∪ {m ⋆ | m ∈ I A } ∪ {m ⋆ ns | m, n s ∈ υ}
Using it, we introduce the evaluation function, ev A,B : ((A ⇒ B) ⊗ A) → B defined as

ev A,B def = (Λ A A⇒B,B ) -1 (id A⇒B ).
One can check that for every strategies υ : (A ⊗ B) → C, we have

((Λ B A,C (υ)) † ⊗ B); ev B,C = υ.
This justifies the use of ev B,C to interpret applications of terms. Taking a value-arena A, we thus have an adjunction (A ⇒ ) and (•) † ⊗ A between G and G ST T . As explained in [START_REF] Laird | A game semantics of names and pointers[END_REF], the categories G, G ST T together with the premonoidal functor (•) † is a closed-Freyd category [START_REF] Power | Closed freyd-and kappa-categories[END_REF]. We now have all the ingredients to define the interpretation of basic terms of a call-by-value λ-calculus:

x 1 : τ 1 . . . x n : τ n ⊢ x i : τ i def = π i Γ ⊢ λx.M : σ → τ def = Λ σ Γ , τ ( Γ, x : σ ⊢ M : τ ) † Γ ⊢ M N : τ def = δ † Γ ; ( Γ ⊢ M : σ → τ ⊗ l Σ; Γ ⊢ N : σ ) ; ev σ , τ where δ A : A → A ⊗ A is the usual diagonal coming from the cartesian product of G ST T .

Game Semantics for RefML

We now briefly sketch the game semantics model of RefML developed by Murawski and Tzevelekos in [START_REF] Murawski | Game semantics for good general references[END_REF]. Previous works have studied references in game semantics, however they generally represent them in an indirect way, using two methods to read and write them. However, such presentations suffer from the problem of "bad variables", a problem first identified by Reynolds [START_REF] John | Syntactic control of interference[END_REF]. Indeed, using this representation, there is inhabitants of reference types which are not "real" locations of the heap. This forbid to perform any test of equality of locations.

To build a model of"good"references only, nominal sets are used to represent strategies. In their model, plays are formed by moves-with-heap 3 , that is a pair formed by a move m and a heap h, written m h . Elements stored in theses heaps are not standard values, but rather moves. For ground types, this makes no difference, but for functional types τ , this means they can only store initial moves ⋆ of M τ . The domain of these heaps contain all the locations that both the term and the context are aware of.

To define a play over an arena A, one must allow extra moves which are not from A, but from the set of moves M φ def = τ,σ M τ →σ . That is, plays over an arena A are formed by moves in M A ⊎s •M φ , where s is a new tag used to distinguish these moves. Such moves represent callbacks generated from higher-order references. This forces us to extend the notion of justification pointers, such that a move-with-heap m h of a justification sequence s can be justified by a location l which appears in the heap h ′ of a previous move n h ′ . Such moves are said to be l-justified.

To control the domain of heaps which can appears in move-with-heaps of a play, we define the set of available names of a justified sequence s, noted Av(s), in the following way:

-

Av(ε) = ∅ -Av(sm h ) = h * (Av(s) ∪ ν(m))
3. Heaps are called stores in [START_REF] Murawski | Game semantics for good general references[END_REF].

where h * (S) def = j≤0 h j (S) and h 0 (S) = S, h j+1 (S) = h(h j (S)) ∩ Loc.

Every play must satisfy the frugality condition: for any prefix s ′ m h of s, dom(h) = Av(s ′ m h ). Then, we enforce the definition of strategies to be nominally closed:

Definition 23 (Strategy). A strategy υ on an arena A is a set of even-length plays on A satisfying:

-if

so h p h ′ ∈ υ then s ∈ υ, -if s 1 p h 1 1 , s 2 p h 2 2 ∈ υ and s 1 ∼ s 2 then s 1 p h 1 1 ∼ s 2 p h 2 2 , -if s 1 ∈ υ and s 1 ∼ s 2 then s 2 ∈ υ.
The definition of the composition of strategies has to be modified, to control the way these extra moves from M φ are used. This is done via the notion of copycat triple, that will be directly introduced in the setting of trace semantics later.

Finally, an important fact to notice is that there is no circularity issue with the definition of this model, unlike what happened for other operational or denotational model of higher-order references. For example, this was not the case of the previous nominal game model developed by Tzevelekos [START_REF] Tzevelekos | Full abstraction for nominal general references[END_REF][START_REF] Tzevelekos | Nominal game semantics[END_REF], where the circularity was resolved using tools from domain theory. Here, the circularity is avoided by cutting it, i.e. by representing strategies of higher-order functions stored in the heap just with their first moves, namely ⋆. Then, global conditions are imposed when composing strategies to control the way callbacks performed via these higher order references are done. The circularity would have appeared if heaps had stored plays rather than initial moves.

Full Abstraction of Game Semantics

We now state that the game semantics model for RefML presented in [START_REF] Murawski | Game semantics for good general references[END_REF] is fully abstract, namely that it captures exactly the contextual equivalence. Due to the presence of divergence, one must restrict the strategies we consider so that only complete plays are taking into account.

Definition 24. A play s is said to be complete if every questions of s are answered. The set of complete plays of a strategy υ is written comp(υ).

Then, one can state the wanted theorem.

Theorem 9 (Full Abstraction of the Game Semantics):

Let M 1 , M 2 two terms such that Σ; Γ ⊢ M 1 , M 2 : τ . Then Σ; Γ ⊢ M 1 ≃ ctx M 1 : τ iff comp( Σ; Γ ⊢ M 1 : τ ) = comp( Σ; Γ ⊢ M 2 : τ ).

Trace Semantics

We now introduce a semantics for RefML where denotations of terms are sets of traces. It is a variant of the work of Laird [START_REF] Laird | A fully abstract trace semantics for general references[END_REF] more amenable to a comparison with game semantics by taking track of type informations. Traces are used to represent all possible interactions of terms with contexts, and are generated by an interactive reduction which generalizes the small-step reduction of Figure 3.8 in two ways. First, it allows us to reduce open terms, and more specifically terms with free functional variables. That is, it becomes possible to reduce a term K[f u], where f is a free variable of type σ → τ , either to K [v] for any value v of type τ , if τ is a ground type; or to K[f ′ ] for any variable f ′ free in K if τ is a functional type. This is used to reduce λx.M when x is of functional type, so that we can deal with x symbolically.

Second, to be able to generate all possible executions, we need to keep track of values disclosed to contexts, namely location-so that a context can set arbitrary values in it-or λ-abstraction-so that a context can call it at any time when it takes control back.

Notice that this reduction is history-independent, i.e. the reduction of a callback K[f v] does not depend on the possible previous occurrences of K ′ [f v] in the reduction. This is due to the fact that our language has references, so that contexts can keep track of the number of times their functional arguments provided to the term are called, and thus give each time a different answer. This corresponds to the fact that strategies for RefML are not innocent. Due to this last point, the definition of a similar interactive reduction for a pure language would be definitely more tedious.

Game-like Definitions

We start introducing traces following the usual presentation of game semantics, mimicking the definitions of the previous section. The notion corresponding to a game move is called here an action. Actions are formed over ground values and variables, used to represent higher-order values. These variables, of functional type, are called opponent and player name pointers. opponent name pointers represent higher-order values provided by contexts (i.e. opponent) to terms (i.e. player), while it is the opposite for player name pointers. The set of name pointers, which is a subset of Var is written P, and the set of free name pointers (i.e. its supports) of an element X is written ν P (X). There are four kinds of basic actions:

-a question of the term (here named Player) via a name pointer x with argument v, represented by the action x v , -a question of the context (here named Opponent) via a name pointer x with argument v, represented by the action x v , -an answer by Player of the value v, represented by the action v , -an answer by Opponent of the value v, represented by the action v . A name pointer y appearing as an argument of a player question x y or in a player answer ȳ is called a player name pointer. In the same way, a name pointer y appearing as an argument of an opponent question x y or in an opponent answer y is thus called an opponent name pointer. This means that being an opponent or a player name pointer depends on the action, and is not inherent to the name pointer. The set of free player and opponent name pointers (i.e. their supports) of an element X formed by actions is respectively written ν P P (X) and ν O P (X). We also consider special opponent questions ? v where the name-pointer which is questioned is omitted, which represent initial moves.

Actions a are defined as pairs (a, ξ) of a basic action a and a tag ξ, which is a word over the alphabet {l , r , s}, where the concatenation is written ξ • ξ ′ and the empty word is written ε. Such tags are used to indicate to which set (i.e. trace-arena) an basic action belongs to. This is useful to avoid the use of disjoint unions (as coproduct) and the corresponding injections in l , in r which are usually used in game semantics. In our setting, such injections are represented respectively by tags beginning with l and r , while s is used to represent actions corresponding to functions stored in heaps.

Player, Opponent and initial actions are respectively written p, o and i. The labeling of actions (i.e. the fact they are player or opponent and question or answer actions) is hard-wired, while labeling of moves in game semantics depends on the underlying arena the moves belong to (via the function λ). As we will see, this complicates some definitions (arrow arenas and restrictions of traces to a given arena) where we need to change the labeling of actions.

We define the operation a ⊥ as the operation which simply transform an opponent action into the corresponding player action, and vice-versa (leaving the tag unchanged). It is extended to sets and relations of actions. Then, we introduce the notion of trace arenas, which are simply pairs (M, I, ⊢) of a set of actions M, a set of initial actions I ⊆ M and a justification relation ⊢⊆ M × M\I. Following the correspondence with game semantics, we define: value-arenas (resp. term-arenas) as arenas whose initial actions are player answers (resp. opponent question).

From two trace value-arenas A, B we construct the value arenas A ⊗ B and A ⇒ B and the term arena A → B in Figure 5.1. In the definition of A → B, the symbol ? represent the initial opponent question where no name pointer is present. To each type τ , we associate a trace value-arena [τ ] as:

-[Unit] def = (M Unit , M Unit , ∅) where M Unit def = { () }, -[Int] def = (M Int , M Int , ∅) where M Int def = { n | n ∈ Z}, -[ref τ ] def = (M ref τ , M ref τ , ∅) where M ref τ def = { l | l ∈ Loc τ }, -[σ → τ ] def = [σ] ⇒ [τ ].
To relate actions to the evolution of the heap, we introduce actions-with-heap on a trace-arena A, i.e. pairs (a, h) of an action a ∈ M A and a functional-free heap h, that is a heap where stored higher-order values are represented by name pointers. An action-with-heap (a, ξ, h) is said to introduce the name pointer x if either a is of the form ȳ x , y x , x or x , or if x is in the co-domain of h (written codom(h)). In the latter case, we say that x is l-introduced when h(l) = x. Such actions which l-introduce name pointers, called φ-actions, correspond to callbacks coming from disclosed locations storing functions. They are living in the set M φ defined as τ,τ ′ M [τ →τ ′ ] . Using it, we define the set Trace A over a trace-arena A as the set of sequences T of actions-with-heap on M A ⊎ (s • M φ ) such that for each name pointer x in T , x is introduced by at most one action-with-heap in T . Trace A can be seen as a nominal set over Loc and P. We write T ′ ⊑ T when T ′ is a prefix of T , and T ′ ⊑ even T when furthermore T ′ is of even length. Taking an action (a, h) of T , we define T ≤(a,h) as the prefix of T whose last action is (a, h).

I A⊗B def = l • I A × r • I B M A⊗B def = I A⊗B ⊎ l • (M A \I A ) ⊎ r • (M B \I B ) ⊢ A⊗B def = {((l • i A , r • i B ), l • a) | i A ⊢ A a} ⊎ {((l • i A , r • i B ), r • a) | i B ⊢ B a} ⊎(l • ⊢ A|(M A \I A ) 2 ) ⊎ (r • ⊢ B|(M B \I B ) 2 ) I A⇒B def = { x | x ∈ P} M A⇒B def = I A⇒B ⊎ l • (M A \I A ) ⊥ ⊎ {(y u , l • ξ) | ( ū , ξ) ∈ I A , y ∈ P} ⊎ r • M B ⊢ A⇒B def = {( x , (x u , l • ξ)) | x ∈ P, ( ū , ξ) ∈ I A } ⊎{((x u , l • ξ), l • a) | ( ū , ξ) ∈ I A , a ∈ M A , ( ū , ξ) ⊢ A a} ⊎{((x u , l • ξ), r • i B ) | ( ū , ξ) ∈ I A } ⊎ (l • ⊢ A|(M A \I A ) 2 ) ⊥ ⊎ (r • ⊢ B ) I A→B def = {(? u , l • ξ) | ( ū , ξ) ∈ I A } M A→B def = I A→B ⊎ l • (M A \I A ) ⊥ ⊎ r • M B ⊢ A→B def = {((? u , l • ξ), r • i B ) | ( ū , ξ) ∈ I A , i B ∈ I B } ⊎ (l • ⊢ A|(M A \I A ) 2 ) ⊥ ⊎ (r • ⊢ B ) ⊎{((? u , l • ξ), l • a) | ( ū , ξ) ∈ I A , a ∈ M A , ( ū , ξ) ⊢ A a}
We say that a trace T ∈ Trace A is justified if every name pointer x in T is introduced in T . Then, we define the depth of an action (a, h) in a trace T , written depth T (a, h) as the difference between the number of questions and the number of answers of T 1 , where

T = T 1 • (a, h) • T 2 .
Definition 25. Let (a 1 , h 1 ), (a 2 , h 2 ) two actions-with-heap such that (a 1 , h 1 ) appears before (a 2 , h 2 ) in a trace T . We say that (a 1 , h 1 ) justifies (a 2 , h 2 ) when:

-a 2 is an answer and a 1 is the latest question of T appearing before a 1 s.t. depth T (a 2 , h 2 ) = depth T (a 1 , h 1 ) + 1, -or a 2 is a question x u or x u , and (a 1 , h 1 ) is the first action introducing x, so a 1 is either equal to x , x , ȳ x , y x or x ∈ codom(h 1 ). In the latter case, we say that x is l-justified when h 1 (l) = x. A question of T which does not justify any answer is said to be pending. A justified trace over A is said to be legal if only its first action-with-heap is in I A and it alternates between player and opponent actions, and is said to be a play if it is furthermore frugal, i.e. for all T ′ • (a, h) ⊑ T , dom(h) = Av(T ′ • (a, h)). The set of legal traces (resp. plays) on A is written L A (resp. P A ).Using all this definitions, we can finally introduce the notion of trace-strategy used to define the denotation of terms.

Definition 26. A trace-strategy s over a trace arena A as a set of even-length plays on A such that:

-

If T • (o, h) • (p, h ′ ) ∈ σ then T ∈ σ. -If T ∈ σ and T ∼ T ′ then T ′ ∈ σ. -If T 1 • (p 1 , h 1 ) and T 2 • (p 2 , h 2 ) are in σ and T 1 ∼ T 2 , then T 1 • (p 1 , h 1 ) ∼ T 2 • (p 2 , h 2 ).

A correspondence between Traces and Plays

There is a direct correspondence between actions introduced in this section and moves in game semantics as introduced before, where we suppose that injections coming from coproducts are also represented by tags. It is obtained by transforming questions x v and x v into v, transforming answers v and v into v, and then transforming every remaining name pointers into ⋆, the initial move of game arenas for functional types 4 . The function which performs this two-step translation is written θ, which transforms actions from a trace-arena A to moves to the corresponding game-arena A, leaving tags unchanged. The labeling function is then defined straightforwardly.

Then, we extend this correspondence between justified traces and justified sequences of game semantics, with the extra property that justified traces are always well-bracketed. More precisely, we first extend straightforwardly the function θ from actions-with-heaps to move-with-heaps, which transform name pointers stored in heaps into the move ⋆, and then pointwisely from traces to sequences of moves. So we define a function Θ which transforms a justified trace T on an arena A to a sequence of moves θ(T ) on the corresponding arena A, and such that for two actions-with-heaps (a 1 , h 1 ), (a 2 , h 2 ) of T , there is a pointer from θ(a 2 , h 2 ) to θ(a 1 , h 1 ) when (a 2 , h 2 ) is justified by (a 1 , h 1 ). Notice that two traces which are P-nominal equivalent give rise to the same sequence of moves.

Extending Θ to sets of traces, it is direct that Θ(s) is a game-strategy on an arena A when s is a trace-strategy on the corresponding arena A.

4. We do not need to transform the symbol "?" since it is automatically removed, appearing only in ? v .

Interactive Reduction

We now introduce an interactive reduction which generates traces from terms, representing their interactions with any possible applicative contexts K[• τ,ξ ], where the symbol •, representing "hole" (i.e. a pending question), is tagged with a type τ and a tag ξ, representing the type and the arena of the expected answer which will fill the hole. This reduction is defined on "stacks" (M, τ, ξ) • ------→ (K i , τ i , ξ i ) formed by a term M and contexts -→ K i for player configurations, or on stacks ------→ (K i , τ i , ξ i ) for opponent configurations. Such elements of the stacks comes also with a type τ and a tag ξ. The empty stack is simply written ♦, and we write F for the top element of a stack, which can either be a term M , a context K[•] or the empty stack ♦. When Player provides a higher-order value to Opponent, either via a callback (i.e. a question) or directly when reducing to a λ-abstraction (i.e. an answer), they are stored in environments γ, which are partial maps from P to Val. Then Opponent can interrogate what is stored in γ, by asking a question. Opponent only provides opponent name pointers to represent higher-order values. They are stored in a set I ⊆ P. They can also be interrogated by player.

To represent disclosure of locations, we use a set D which grows as the term or the context discloses new locations. To determine which locations are disclosed when a value v is played with a heap h, we define a function discl(v, h, D) as -h * (D ∪ {l}) if v is a location l, -h * (D) otherwise. We simply write discl(h, D) for h * (D). The complement of the set D is written D.

Then, the interactive reduction is defined between player configurations M • -→ K i , γ, I, h, D and opponent configurations K[•] • -→ K i , γ, I, h, D . It is defined in Figure 5.2. Let us explain the different rules: -The rule P-Intern allows us to perform the usual (operational) reduction of terms.

Notice that it uses the non-deterministic reduction → nd rather than the usual →, in order to be exhaustive w.r.t. names of locations created. -The rules P-AnsG and P-Ans represent player answers. If the answer is a ground value, then if it is a location it is put in D ′ , otherwise it is simply forgotten by Opponent since it has no meaning to interrogate it. Otherwise, it is a higher-order value, which is thus stored in γ ′ . Player can also disclose indirectly either new locations or new higher-order values via the already disclosed locations. The new disclosed locations are caught via discl(v, h, D), while disclosed higher-order values live in dom(h fn ) ∩ D ′ (recall that h fn is the subheap of h which stores higher-order values), so that they are replaced by fresh player name pointers in h ′ and γ is updated consequently. -The rules O-AnsG and O-Ans represent opponent answers. When Opponent answers a location, it cannot be one which is private to Player. This explain the condition "v is ground and not in dom(h) ∩ D" in the definition of O-AnsG. And when it should be a higher-order value, it is simply represented by a fresh opponent

P-Intern (M, τ, ξ) • -→ K i , γ, I, h, D ------→ (M ′ , τ, ξ) • -→ K i , γ, I, h ′ , D (when (M, h) → nd (M ′ , h ′ )) P-AnsG (v, ι, ξ) • -→ K i , γ, I, h, D ( v ,r •ξ,h ′ |D ′ ) -------→ -→ K i , γ ′ , I, h ′ , D ′ (v of type ι, γ ′ = γ • -------------→ [x i ֒→ (h(l i ), τ i , s)]) P-Ans (v, τ, ξ) • -→ K i , γ, I, h, D ( x ,r •ξ,h ′ |D ′ ) -------→ -→ K i , γ ′ , I, h ′ , D ′ (x fresh, γ ′ = γ • [x ֒→ (v, τ, r • ξ)] • -------------→ [x i ֒→ (h(l i ), τ i , s)]) P-QuestG (K[x v], τ, ξ) • -→ K i , γ, I, h, D (x v ,l •ξ ′ ,h ′ |D ′ ) --------→ (K[• ι,ξ ′ ], τ, ξ) • -→ K i , γ ′ , I, h ′ , D ′ ((x, ι → σ, ξ ′ ) ∈ I, v of type ι, the x i fresh, γ ′ = γ • -------------→ [x i ֒→ (h(l i ), τ i , s)]) P-Quest (K[x v], τ, ξ) • -→ K i , γ, I, h, D (x y ,l •ξ ′ ,h ′ |D ′ ) --------→ (K[• σ ′ ,ξ ′ ], τ, ξ) • -→ K i , γ ′ , I, h ′ , D ′ ((x, σ → σ ′ , ξ ′ ) ∈ I, y fresh, γ ′ = γ • [y ֒→ (v, σ, l • ξ ′ )] • -------------→ [x i ֒→ (h(l i ), τ i , s)])
in all P-rules: ). An important point here is that the context can also disclose indirectly new locations via the already disclosed ones. This explains the great liberty Opponent has when it extends h to h ′ with new disclosed locations. It must however satisfy the equation D ′ = discl(h ′ , D), so that it cannot add as many new (necessarily disclosed) locations as it wants.

D ′ = discl(v, h, D) and h ′ = h -----→ [l i ֒→ x i ] with the x i fresh where l i ranges over dom(h fn ) ∩ D ′ with l i ∈ Loc τ i ) O-AnsG (K[• ι,ξ ′ ], τ, ξ) • -→ K i , γ, I, h, D ( v ,r •ξ ′ ,h ′ |D ′ ) -------→ (K[v], τ, ξ) • -→ K i , γ, I ′ , h ′ , D ′ (v of type ι, v / ∈ dom(h) ∩ D, I ′ = I • -------→ (h(l i ), τ i , s)) O-Ans (K[• σ,ξ ′ ], τ, ξ) • -→ K i , γ, I, h, D ( x ,r •ξ ′ ,h ′ |D ′ ) -------→ (K[x], τ, ξ) • -→ K i , γ, I ′ , h ′ , D ′ (x fresh, I ′ = I • (x, σ, r • ξ ′ ) • -------→ (h(l i ), τ i , s)) O-QuestG -→ K i , γ, I, h, D (x v ,l •ξ,h ′ |D ′ ) --------→ (u v, τ, ξ) • -→ K i , γ, I ′ , h ′ , D ′ (γ(x) = (u, ι → τ, ξ), v of type ι, v / ∈ dom(h) ∩ D, I ′ = I • -------→ (h(l i ), τ i , s)) O-Quest -→ K i , γ, I, h, D (x y ,l •ξ,h ′ |D ′ ) --------→ (u y, τ, ξ) • -→ K i , γ, I ′ , h ′ , D ′ (γ(x) = (u, σ → τ, ξ), y fresh, I ′ = I • (y, τ, l • ξ)) • -------→ (h(l i ), τ i , s)) in all O-Rules: D ′ = discl(v, h ′ , D), l i ranges over dom(h ′ fn ) ∩ D ′ s.t. l i ∈ Loc τ i , h ′ |D ′ = h |D and
-The rules P-QuestG and P-Quest represent player questions. That is, player interrogates an opponent name pointer of I with a value. We find here the same behavior about indirect disclosure we have encountered for the Player answers. -Finally, the rules O-QuestG and O-Quest represent opponent questions. In that case, Opponent adds to the current execution stack a new thread, corresponding to the higher-order values stored in γ. Here again, we find the same behavior about indirect disclosure we have encountered for the Opponent answers. This reduction is highly non-deterministic, since we consider the interactions with all possible contexts. Moreover, the choice of name pointers and locations is also nondeterministic (even in the rule P-Intern with the use of → nd ) so that the reduction do not perform arbitrary choice. One can easily check that the following properties are preserved by the interactive reductions:

-the stack and the codomain of γ do not contain any player name pointer, -the higher-order values stored in the disclosed part of the heap are name pointers contained in I or dom(γ), -the heap h and its disclosed part are both closed. We say that a trace T is generated by a configuration C if it can be written as a sequence (a 1 , h 1 )

• • • (a n , h n ) of actions-with-heap such that C a 1 ,h 1 ---→ C 1 a 2 ,h 2 ---→ C 2 . . .

an,hn

---→ C n , and we write C T -→ C n . We can see that it is indeed a trace due to the freshness conditions in the rules P-Ans, P-Quest, O-Ans and O-Quest. The set of traces generated by C is written Tr(C). Notice that such traces are not in general justified. This is due to the fact that name-pointers of C are not introduced. As we will see, the initial (opponent question) action is missing. Moreover, Tr(C) is not nominally-closed: if π is a permutation such that π(a) = a for a ∈ ν A (C), then taking T ∈ Tr(C), π * T is not in general in Tr(C). This is useful to distinguish sets Tr x, γ, I, h, D and Tr x ′ , γ, I, h, D for different opponent name pointers x, x ′ ∈ I, or to distinguish Tr l, γ, I, h, D and Tr l ′ , γ, I, h, D for locations l, l ′ ∈ dom(h).

Example 1: let us consider the term M inc defined as

let x = ref 0 in let f = ref (λ .x :=!x + 1) in λg.g f; !f(); !x
The reader can check that one possible trace of this term starting from the initial configuration

M inc , ε, ε, ε, ε is ( ā , ε) • (a b , ε) • ( b l , [l ֒→ c]) • (c () , [l ֒→ c]) • ( () , [l ֒→ c])• ( () , [l ֒→ d]) • (c () , [l ֒→ d]) • ( () , [l ֒→ d]) • ( 1 , [l ֒→ d]).
Intuitively, this trace corresponds to the interaction with the context defined as •(λc.!c(); c := λ .()). Notice that the value stored in x is incremented not by the call to !f() in M inc , but by the call made by the context after the disclosure of f via g. Indeed, the call to !f() corresponds to the call to λ .() since the context has modified the function stored in f .

Traces generated by a configuration are not altered when the stack is extended, as shown by the following lemma:

Lemma 8: Suppose that F • -→ K i , γ, I, h, D T -→ F ′ • -→ K ′ j , γ ′ , I ′ , h ′ , D ′ then F • -→ K i • -→ K ′′ l , γ, I, h, D T -→ F ′ • -→ K ′ i • -→ K ′′ l , γ ′ , I ′ , h ′ , D ′ .
An important point to notice is that the tags of actions of traces generated by the interactive reduction can be infer knowing just the tag of initial actions, as shown by the following lemma:

Lemma 9: Let (a 1 , ξ 1 , h 1 ), (a 2 , ξ 2 , h 2 ) two actions of a trace T , such that (a 2 , ξ 2 , h 2 ) is justified by (a 1 , ξ 1 , h 1 ). Then: -If a 2 is an answers, then ξ 1 = l • ξ and ξ 2 = r • ξ, -If a 2 is a question, then -if a 2 is l-justified by a 1 , ξ 2 = l • s • ξ 1 , -otherwise ξ 2 = l • ξ 1 .
This justifies the fact that in the following, we often omit tags when considering actions and traces.

Interpretation of Terms

Taking a term M s.t. Σ; Γ g , Γ f ⊢ M : τ , we now define a trace strategy associated to this term, which is generated using the interactive reduction. To do so, we first define the list of opponent name pointers

I Γ f ξ as I ⋄ ξ = ε and I (x:τ ),Γ ξ def = (x, τ, l • ξ) • I Γ r •ξ .
Definition 27 (Trace Semantics). Let M a term such that Σ; Γ g , Γ f ⊢ M : τ . We define [Σ; Γ g , Γ f ⊢ M : τ ] as the set of even-length traces belonging to the nominal closure over Loc and P of

     ? Σ, ---→ γ g (x i ), I , l , h • Tr (γ g (M ), τ, ε), ε, I, h, D γ g : Γ g → Val h ∈ Cl(Σ, codom(γ g )) codom(h fn ) ⊆ P     
where -→ x i ranges overs the variables of Γ g , D = dom(h) and

I = I Γ f ξ • -------→ (h(l i ), τ i , s) s.t. l i ranges over dom(h fn ) and l i ∈ Loc τ i .
Recall that h fn is the subheap of h formed by higher-order references. We reason up to nominal equivalence of ν Loc (M ) (i.e. Σ) and ν P (M ) (i.e. Γ f ) so that [Σ; Γ g , Γ f ⊢ M : τ ] is nominally closed. Moreover, the substitution γ g of ground variables of M introduce new locations for variables of type ref τ , so we must consider them in h to have a closed heap. Finally, h is functional-free (i.e. codom(h fn ) ⊆ P), so that for any location l ∈ Loc φ , if h(l) or h ′ (l) is defined, it has to store an opponent name pointer.

Let us define

[Γ] as [τ 1 ] ⊗ . . . ⊗ [τ m ] when Γ = (x 1 : τ 1 ) . . . (x m : τ m ) and [Σ] is defined as [ref τ 1 ] ⊗ . . . ⊗ [ref τ n ] when Σ = (l 1 : τ 1 ) . . . (l n : τ n ). Theorem 10: Let M a term s.t. Σ; Γ g , Γ f ⊢ M : τ , then [Σ; Γ g , Γ f ⊢ M : τ ] is a trace- strategy over the arena [Σ] ⊗ [Γ g , Γ f ] → [τ ]. A trace T ∈ Tr M • -→ K i , γ, I, h, D
is said to be complete if the number of answers occurring in the trace is greater than its number of questions plus the length of the sequence -→ K i . The set of complete traces of a configuration C is written comp(Tr(C)). This is useful to give a correspondence with contextual equivalence via game semantics, as we will see in the next part.

Notice that we introduce [Σ; Γ ⊢ M : τ ] to get an exact correspondence with the denotation of terms in game semantics. However, this notion has many drawbacks, since it is not stable by reduction. More precisely, if Σ; Γ ⊢ M : τ and (M, h) → * (M ′ , h ′ ), then h ′ has possibly new locations which have not been disclosed to the context, so we cannot relate [Σ ′ ; Γ ⊢ M ′ : τ ] to [Σ ′ ; Γ ⊢ M : τ ] since this semantics suppose that all the locations have been disclosed. Moreover, the traces of [Σ ′ ; Γ ⊢ M : τ ] all begin with no (functional) values disclosed to the context, i.e. the environment γ is empty in the starting configuration. So when (M, h) → * (K[f v], h ′ ) we cannot relate easily the denotation of M to the denotation of K[•] and v. This problem will be solved in Section 6.3 where we introduce Kripke trace semantics to distinguish between private and disclosed locations.

Nominal Equivalence of Traces

In practice, one does want to work with Σ; Γ ⊢ M : τ , which does not really use the full possibilities of trace semantics, imposing disclosure of all locations and the absence of disclosed higher-order values. We prefer to work directly on Tr M, γ, I, h, D . However, as we have said before, this set is not nominally closed, since the initial move is missing. So to compare traces, we use spans over disclosed locations, as introduced in Section 3.3.2. They are generally written D in the following. We also use spans on player and opponent name pointers, written e P and e O which can be seen as binary environment relating variables of functional types of two terms. The nominal equivalence on heaps generated by the spans D, e P , e O , written h 1 ∼ D e P ,e O h 2 , can then be characterized as:

∀(l 1 , l 2 ) ∈ D Int . h 1 (l 1 ) = h 2 (l 2 ) ∧ ∀(l 1 , l 2 ) ∈ D τ →σ .(h 1 (l 1 ), h 2 (l 2 )) ∈ e P ⊎ e O ∧ ∀(l 1 , l 2 ) ∈ D ref ι . (h 1 (l 1 ), h 2 (l 2 )) ∈ D ι
Then, actions are compared using spans on locations and names pointers. Given a span e P on player name pointers, a span e O on opponent name pointers and a span D on disclosed locations, we define the equivalence (a 1 , h 1 ) ∼ D e P ,e O (a 2 , h 2 ) on actions when h 1 ∼ D e P ,e O h 2 and:

-either both a i are player answers vi (resp. opponent answers v i ) such that either both v i are name pointers x i with (x 1 , x 2 ) in e P (resp. in e O ), or both v i are locations l i with (l 1 , l 2 ) ∈ D, or both v i are equal ground values, -or both a i are player questions fi v i (resp. opponent questions Proof Suppose that

f i v i ) such that (f 1 , f 2 ) is in e O (
Theorem 11: Let M 1 , M 2 two terms such that Σ; Γ g , Γ f ⊢ M 1 , M 2 : τ . Then [Σ; Γ g , Γ f ⊢ M 1 : τ ] = [Σ; Γ g , Γ f ⊢ M 2 : τ ]
[Σ; Γ g , Γ f ⊢ M 1 : τ ] = [Σ; Γ g , Γ f ⊢ M 2 : τ ] and let T 1 ∈ Tr γ 2 (M 2 ), ε, I, h, D . Then from the nominal-closure of [Σ; Γ g , Γ f ⊢ M 2 : τ ],
we get the existence of two (type-preserving) finite permutation π L on Loc and π P on P such that there exists

T 2 ∈ [Σ; Γ g , Γ f ⊢ M 2 : τ ] with ? Σ, ---→ γ g (x i ), I , h • T 1 = π L * π P * ? Σ, ---→ γ(x i ), I , h T 2
Then, as explain in Section 3.3.2, there exists two spans D ′ and e ′ O corresponding to π L and π P . And from the equality on the initial (opponent questions moves), we get that

D ′ ⊒ D an e ′ O ⊒ e O . Thus Tr γ 1 (M 1 ), ε, I, h, D D ε, Γ f Tr γ 2 (M 2 ), ε, I, h, D
and the reverse inclusion is proven in the same way.

Reciprocally, suppose that Tr γ 1 (M 1 ), ε,

I, h, D ≃ D ε, Γ f Tr γ 2 (M 2 ), ε, I, h, D and let ? Σ, ---→ γ g (x i ), I , h • T 1 ∈ [Σ; Γ g , Γ f ⊢ M 1 : τ ],
then we want to prove that there exists two (type-preserving) finite permutation π L on Loc and π P on P such that

π L * π P * ? Σ, ---→ γ(x i ), I , h T 1 ∈ [Σ; Γ g , Γ f ⊢ M 2 : τ ] .
Using again what have been presented in Section 3.3.2, these permutations are simply the extension of the two spans.

A Correspondence between Trace and Game Semantics

We now prove a formal link between the denotation of a term in trace semantics and in game semantics. The problem is that the definition of [Σ; Γ ⊢ M : τ ] is done operationally, while Σ; Γ ⊢ M : τ -the game interpretation of terms defined in [START_REF] Murawski | Game semantics for good general references[END_REF]-is given denotationally, by induction on the typing judgment Σ; Γ ⊢ M : τ . To fill this gap, we show in this section that [Σ; Γ ⊢ M : τ ] can actually be decomposed by similar induction steps on the typing judgment. In Section 5.2.1 we have introduced the definition of a function Θ which transforms any justified trace on a trace-arena A into a justified sequence of the corresponding game arena A. This correspondence allows us to state the following theorem.

Theorem 12 (Equivalence of the trace and the game semantics): Let M a term of RefML such that Σ; Γ ⊢ M : τ , then Σ; Γ ⊢ M : τ is equal to Θ([Σ; Γ ⊢ M : τ ]).

Denotation of variables

Consider T ∈ [x : τ ⊢ x : τ ] with τ a functional type. We can write T as

(? x , ε) • ( ȳ , ε) • T ′ such that x, •, x, ε, ε ȳ ,ε
--→ ♦, y ֒→ x, x, ε, ε . Then, when opponent questioned y with u in T ′ , player directly interrogates x with either u if it is atomic, or with a fresh name pointer that points to u.

Such behavior is called copycat. More precisely, following [START_REF] Murawski | Game semantics for good general references[END_REF], a pair of actions (a 1 , h 1 ), (a 2 , h 2 ) are a copycat pair in a play-trace T if -they are consecutive in T , -θ((a

1 , h 1 )) = θ((a 2 , h 2 )), -if (a 1 , h 1 ) is justified by (a ′ 1 , h ′ 1 ) then (a 2 , h 2 ) is justified by (a ′ 2 , h ′ 2 ) s.t. (a ′ 2 , h ′ 2 ), (a ′ 1 , h ′ 1 ) are consecutive in T , and moreover if (a 1 , h 1 ) is l-justified with l ∈ dom(h ′ 1 ), then (a 2 , h 2 ) is l-justified so l ∈ dom(h ′
2 ). Notice that a copycat pair ( u 1 , h 1 ) • ( ū2 , h 2 )) will not satisfy u 1 = u 2 nor h 1 = h 2 when the u i are name pointers and when the h i store name pointers, due to the freshness condition of name pointers in the rules of the interactive reduction. This justifies the use of θ in the definition.

Then, taking a trace-arena A we define the identity trace-strategy on A → A, written id A as the set of play-traces T ∈ P A→A such that for all subtraces (o, h) • (p, h ′ ) of length two of T , ((o, h), (p, h ′ )) is a copycat pair of T . We can easily see that Θ(id A ) is equal to id A , the usual identity game-strategy over the corresponding game-arena A → A.

We want to prove that

[x : τ ⊢ x : τ ] is equal to id [τ ] .
To do so, we first need the following lemma, which generalize this equality when τ is functional.

Lemma 10: Let I a set of opponent name pointers, γ a substitution on player name pointers such that codom(γ) ⊆ I, h a functional-free heap such that codom(h fn ) ⊆ I and

D = dom(h). Then a trace T ∈ Tr • • . . . • • n times , γ, I, h, D is formed by copycat pairs.
Proof By induction on the length of T . If T begins with an opponent question, then

T = (x u , h 1 ) • (ȳ u , h 2 ) • T ′ with • • . . . • •, γ, I, h, D x u ,h 1 ----→ yu • • • . . . • •, γ, I 1 , h 1 , D 1 ȳ u ,h 2 ----→ • • • • . . . • •, γ 1 , I 1 , h 2 , D 1
where y = γ(x) and if u is atomic then u = u, otherwise u ∈ I 1 , u is a player name pointer and γ 1 ( u) = u. Moreover, due to conditions of the rules O-Quest and P-Quest, codom(h 1,f n ) ⊆ I 1 and codom(h 2,f n ) ⊆ dom(γ 1 ) with γ 1 (codom(h 2,f n )) ⊆ I 1 . Thus, codom(γ 1 ) ⊆ I 1 , and we can apply the induction hypothesis on T ′ to conclude.

Otherwise, T begins with an opponent answer (so n > 0), so

T = ( u , h 1 )•( ¯ u , h 2 )•T ′ with • • • • . . . • •, γ, I, h, D u ,h 1 ---→ u • • • . . . • •, γ, I 1 , h 1 , D 1 ¯ u ,h 2 ----→ • • . . . • •, γ 1 , I 1 , h 2 , D 1 s.t. if u is atomic then u = u, otherwise u ∈ I 1 ,
u is a player name pointer and γ 1 ( u) = u. Then, using the same argument as before, codom(γ 1 ) ⊆ I 1 , and we can apply the induction hypothesis on T ′ to conclude.

We now prove the wanted theorem. A trace-strategy s on the arena A is said to be total if -for every initial opponent question (? u 1 , h 1 ) ∈ P A , there exists a player answer ( ū2 , h 2 ) such that θ(h 1 ) = θ(h 2 ) and (?

u 1 , h 1 ) • ( ū2 , h 2 ) ∈ s, -for (? u 1 , h 1 ) • ( ū2 , h 2 ) • T ∈ s, and l ∈ dom(h), (? u 1 , h 1 ) • ( ū2 , h 2 ) • T, (? u 1 , h 1 ) • ( ū2 , h 2 ), l is a copycat triple.
This means, among others, that traces of s begin with an opponent question (? u 1 , h 1 ) followed by a player answer ( ū2 , h 2 ), without modifying the heap. Then, we easily see that the trace strategy [Σ; Γ ⊢ λx.M : σ → τ ] is a total trace strategy, due to the fact that the interactive execution of λx.M will update the heap with fresh player name pointers which point to the initial opponent name pointers, just generating copycat triples.

Then, for such total strategies, we define the notion of threads, which are subtraces which are generated by the opponent questions of the player answer ( ū1 , h 1 ). So, taking a total trace T = ( u 1 , h 1 ) • ( ū2 , h 2 ) • T ′ • (a, h 3 ), we define inductively Thread(T ) as:

-

( u 1 , h ′ 1 ) • ( ū2 , h ′ 2 ) • (a, h 3 ) if (a, h 3 ) is justified by ū2 where h ′ i is a heap whose domain equal to h * 3 (ν L (u 1 , u 2 )), h ′ i (l) = h i (l) for all l ∈ dom(h ′ i )∩Loc φ , h ′ i (l) = h 3 (l) elsewhere (i.e. on location storing ground values), -( u 1 , h 1 ) • ( ū2 , h 2 ) if (a, h 3 ) is l-justified by ū2 , -Thread(( u 1 , h 1 ) • ( ū2 , h 2 ) • T ′ ) • (a, h 3 ) if (a, h 3 ) is justified by ( u 1 , h 1 ), -Thread(( u 1 , h 1 ) • ( ū2 , h 2 ) • T ′′ ) • (a, h 3 ) if (a, h 3 ) is justified by an action in T ′ ,
where T ′′ is the longest prefix of T ′ such that the action which justified (a,

h 3 ) is in Thread(( u 1 , h 1 ) • ( ū2 , h 2 ) • T ′′
). This notion is extended straightforwardly to sets of traces, so to trace-strategies. In general, Thread(T ) does not satisfy the frugality condition, so we define a function Frug which removes part of the heap which has not been disclosed:

-

Frug(ε) = ε -Frug(T •(a, h)) =        Frug(T ) if (a, h) is hereditarily l-justified by (a ′ , h ′ ) and l / ∈ Av(T ≤(a ′ ,h ′ ) ) Frug(T ) • (a, h |Av(T •(a,h))
) otherwise. Trace-strategies which are formed by such frugal threads can be characterized, they are called strongly single-threaded trace-strategies 5 5. The case were an action could be l-justified by ( ū2 , h 2 ) was left unclear in this definition and the following in [START_REF] Murawski | Game semantics for good general references[END_REF]. Nikos Tzevelekos has proposed (in a private communication) the solution followed here to forbid them in the definition of strongly single-threaded strategies, and adding them in the definition of (.) † . Definition 30. A trace-strategy s is said strongly single-threaded when it is total and for all (?

u 1 , h 1 ) • ( ū2 , h 2 ) • T ∈ s,
-there is at most one move which is justified by ū2 in T , -there is no move which is l-justified by ( ū2 , h 2 ), and for all (?

u 1 , h 1 ) • ( ū2 , h 2 ) • T, (? u 1 , h ′ 1 ) • ( ū′ 2 , h ′ 2 ) • T ′ ∈ s, θ(u 2 ) = θ(u ′ 2 ).
Then, we define a function L B A,C which maps trace-strategies of (A ⊗ B) → C into trace-strategy of A → (B ⇒ C) as the transformation of the trace (? u, v , h • h B ) • T into the set of traces which can be written as

(? u , h) • ( ȳ , h ′ ) • (y v , h • h B ) where -dom(h) = Frug(? u , h) and dom(h B ) = Frug(? v , h B ),
-dom(h ′ ) = dom(h) and h ′ g = h g , -y and codom(h ′ fn ) are fresh player name pointers. So we get the following theorem:

Theorem 15: The set of traces Frug(Thread([Γ ⊢ λx.M : σ → τ ])) is equal to L [σ] [Γ],[τ ] ([Γ, x : σ ⊢ M : τ ]) Proof The inclusion Frug(Thread([Γ ⊢ λx.M : σ → τ ])) into L [σ] [Γ],[τ ] ([Γ, x : σ ⊢ M : τ ])
comes from the fact that elements of L We write M for γ(M ). Let h a heap such that h * (ν L (codom(γ g ))) = dom(h). We define D as dom(h). For sake of simplicity, we work with I equal to Γ f rather than nominally equivalent. Suppose that x is of functional type. We prove that Frug Thread((? [Γ],[τ ] we get the wanted property. Otherwise, consider the last action a, h ′′ of T . Then the crucial property is that this action cannot be l-justified by a location in dom(h), by definition of the current thread.

---→ γ(x i ), I , h) • Tr λx. M , ε, I, y, h, D ) is included in {L [σ] [Γ],[τ ] (? ---→ γ(x i ), I, y , h) • Tr M {y/x} , ε, I, y, h, D | y ∼ P x} Let T ∈ Tr λx. M , ε, I, y, h, D . Then, T = ( z , h ′ ) • T ′ with -dom(h ′ ) = dom(h), -h ′ g = h g , -
From this, we can define the notion of thread-independent trace plays. They correspond to plays where there is no interaction between their threads. Definition 31. A trace-play T = (? u 1 , h 1 ) • ( ū2 , h 2 ) • T ′ is thread-independent if for all T ′′ • (p, h) ⊑ even T , we have:

-

thr(T ′′ • (p, h)) = thr(T ′′ ) • (p, h), -ν L (γ(thr(T ′′ • (p, h))) ∩ ν L (T ′′ ) ⊆ ν L (γ(thr(T ′′ ))), -if T ′′ ends in (o, h ′ ) and l ∈ dom(h ′ )\ν L (thr(T ′′ )) then θ(h(l)) = θ(h ′ (l)), and if l ∈ Loc φ then (T, T ′′ • (p, h), l
) is a copycat triple. The set of thread-independent trace-play over A is written P ti A .

Thus, following [START_REF] Murawski | Game semantics for good general references[END_REF], we can define a "shuffle" operation (•) † which transforms a strongly single-threaded strategy s on A into a thread-independent strategy s † , defined as

{T ∈ s | |T | ≤ 2} ∪ {T ∈ P ti A | ∀T ′ ⊑ even T.γ(thr(T ′ )) ∈ s or T ′ = (? u 1 , h 1 ) • ( ū2 , h 2 ) • (a, h) • T ′′ with (a, h) l-justified by some l ∈ dom(h 2 ) and (T ′ , ? u 1 , h 1 ) • ( ū2 , h 2 ), l) is a copycat triple.}
Notice that we cannot just enforce that γ(thr(T ′ )) ∈ s otherwise actions which are ljustified with l ∈ dom(h 2 ) would not be in s † since the definition of the current thread removes them. This shuffle operation satisfies the following equality:

Lemma 11: For any thread-independent trace strategy s, (γ(thr(s))) † = s.

Then, we can easily check that [Σ; Γ ⊢ λx.M : σ → τ ] is thread-independent. Using it, we can decompose the denotation of λ-abstraction exactly as it is done in game semantics: - ,C) is defined as the traces formed by the actions (a ⊥ , h) for every actions (a, h) of T such that (a, h) ∈ M B \I B , the actions (. u , h) for every player questions ( ? u , h) of T with ( ū , h) ∈ I B , and the actions (a ⊥ , h) for every actions (a, h) of T such that (a ⊥ , h) ∈ M C , -T |(A,C) is defined as the traces formed by the actions (a, h) of T such that (a ⊥ , h) ∈ M A \I A , the opponent questions (x u , h) of T such that ( ū , h) ∈ I A , and the actions (a ⊥ , h) for every actions (a, h) of T such that (a ⊥ , h) ∈ M C . In the definition of T |(A,C) , the case where an action of C is justified by an action coming from B which itself is justified by an action coming from A is not problematic, contrary to game semantics where we have to add a new pointer. Indeed, since the action from C is an answer and the action from A is a question, the justification is automatic.

Corollary 1: [Σ; Γ ⊢ λx.M : σ → τ ] = (Λ([Σ; Γ, x : σ ⊢ M : τ ])) † .

Composition of Trace Strategies

I A→B→C def = (l • l ) • I A , -M A→B→C def = l • (M A→B \I B ) ⊎ {( ? u , l • r • ξ) | ( ū , ξ) ∈ I B } ⊎ (r • r ) • M C ⊥ , -⊢ A→B→C def = {(l •l •i A , l •r •i B )}⊎{(l •r •i B , r •r •i C )}⊎(l •l • ⊢ A )⊎(l •r • ⊢ B )⊎(r •r • ⊢ C ) Taking a trace T on A → B → C,
Then, for any X ∈ {(A, B), (B, C), (A, C)}, we define T | F X as Frug(T |X ). Using this, we can define the set of interaction traces. To do so, we first characterize the introduction actions of locations of ν L (T ).

Definition 32. An action (a, h) is said to introduce a location l if, writing T as T 1 • (a, h) • T 2 , we have l ∈ ν L (a, h)\ν L (T 1 ). A location is P -introduced (resp. O-introduced) in T if the
action which introduces it is a player action (resp. opponent action).The set of P -introduced (resp. O-introduced) locations of ν L (T ) is written P(T ) (resp. O(T )).

It is straightforward that ν L (T ) = P(T ) ⊎ O(T ).

We can now define the interaction traces, following the definition from game semantics. Interact(A,B,C).

Definition 33. A justified trace T on A → B → C is an interaction trace if -it is frugal, -T |(A,B) , T |(B,C) and T |(A,C) are legal, -P(T | F (A,B) ) ∩ P(T | F (B,C) ) = ∅, -O(T | F (A,C) ) ∩ (P(T | F (A,B) ) ∪ P(T | F (B,C) )) = ∅.

The set of interaction traces over the arenas A, B, C is written

So we define the parallel composition of two trace strategies s, t, written s||t as the set of interaction traces

T ∈ A → B → C s.t. T | F (A,B) ∈ s and T | F (B,C) ∈ t. Lemma 12: Let T ∈ A → B → C, then T | F (A,B) , T | F (B,C) and T | F (A,C) are play traces.
Then, taking s, t two trace-strategies defined respectively on A → B and B → C, we define their composition, written s; t, as the trace-strategy on A → C formed by traces T ∈ P A→C such that there exists T ′ ∈ s||t with T = T ′ | F (A,C) .

Lemma 13: [Γ ⊢ v : σ] ; [x : σ ⊢ M : τ ] = [Γ ⊢ M {v/x} : τ ].
Theorem 16:

[Γ ⊢ N : σ] ; [x : σ ⊢ M : τ ] = [Γ ⊢ let x = N in M : τ ].

Pairing

We now define the pairing of two strategies following the definition of game semantics. Let A a trace-arena and s a trace strategy defined on B → C, we define the left identity pairing strategy A ⊗ s on the trace term-arena

A ⊗ B → A ⊗ C as the set of legal traces T in L A⊗B→A⊗C such that -T |(B,C) ∈ s, -T |(A,A) ∈ id A .
In a dual way, we can also define the right identity pairing strategy s ⊗ A on the trace term-arena B⊗A → C⊗A. Using the two, we can define the pairing of two trace strategies s, t defined respectively on A → B and C → D, written s ⊗ t. It is defined as s ⊗ C; B ⊗ t. Then, we can characterize the pairing of two trace strategies when they represent the denotation of terms.

Theorem 17: Let M 1 , M 2 two terms such that Γ 1,g , Γ 1,f Γ 1 ⊢ M 1 : σ and Γ 2,g , Γ 2,f Γ 2 ⊢ M 2 : τ with Γ 1 , Γ 2 disjoints. Then ([Γ 1 ⊢ M 1 : σ] ⊗ [Γ 2 ⊢ M 2 : τ ]
) is equal to the nominal closure of the set of even prefix of traces belonging to

? ----→ γ 1,g (x i ), I 1 , ----→ γ 2,g (x i ), I 2 , h 1 • h 2 • T 1 • T 2 • ( u 1 , u 2 , h ′ |D ′ ) • Tr ♦, γ ′ , I ′ , h ′ , D ′ with γ i,g : Γ i,g → Val and h i ∈ Cl(ν L (codom(γ i,g ))) with h 1 , h 2 disjoint (so necessarily ν L (codom(γ 1,g )), ν L (codom(γ 2,g
)) disjoint too) and functional-free, D i defined as dom(h i ) and I i as ν P (Γ f,i , codom(γ g,i )), x i ranging over Γ i,g and γ 1,g (M 1 ), ε,

I 1 , h 1 , D 1 T 1 -→ u ′ 1 , γ 1 , I ′ 1 , h ′ 1 , D ′ 1 with u ′ 1 a value, and h ′ 1 disjoint of h 2 , I ′ 1 disjoint of I 2 -γ 2,g (M 2 ), γ 1 , I ′ 1 • I 2 , h ′ 1 • h 2 , D ′ 1 ∪ D 2 T 2 -→ u ′ 2 , γ 2 , I ′ , h ′ 2 , D ′ 2 with u ′ 2 a value, -D ′ = discl({u 1 , u 2 }, h ′ , D 2 ), -h ′ = h ′ 2 -----→ [l i ֒→ x i ] with l i ranging over h ′ 2,fn ∩ D ′ and the x i not in γ 2 and distinct from u 1 , u 2 , -γ ′ is the extension of γ 2 with (u i → u ′ i ) if u ′ i is of functional type (otherwise u ′ i = u i ) and with all the (x i → h 2 (l i )) for l i ranging over h 2,f n|D ′ . Proof Let T 3 ∈ Tr ♦, γ ′ , I ′ , h ′ , D ′ , we first prove that ? ----→ γ 1,g (x i ), I 1 , ----→ γ 2,g (x i ), I 2 , h 1 • h 2 • T 1 • T 2 • ( u 1 , u 2 , h ′ |D ′ ) • T 3 belongs to ([Γ 1 ⊢ M 1 : σ] ⊗ [Γ 2 ⊢ M 2 : τ ])
, using the fact that this last set is nominally closed to avoid to reason up-to nominal equivalence on the former trace. For each y j ∈ I 2 , we associate a fresh player name pointer ỹj , which form a new set I 2 nominally equivalent to I 2 . Similarly, for each z k ∈ ν P (codom(h 2 )), we associate a fresh name pointer zk , and we define h ′ 2 as h 2 -----→ {z k / zk }. We consider the trace

T 2 ∈ Tr γ 2,g (M 2 ----→ {y j / ỹj }), γ 1 , I ′ 1 • I 2 • -→ z k , h ′ 1 • h 2 , D ′ 1 ∪ D 2 where γ 1 = γ 1 • ------→ [ ỹj → y j ] • ------→ [ zk → z k ].
In the same way, we define u 1 as u 1 if it is a ground value, and as a fresh name pointer otherwise, in which case we define

γ ′ as γ ′ • [ u 1 ֒→ u 1 ]. Then, let T 3 ∈ Tr ♦, γ ′ , I ′ , h ′ , D ′ ? ----→ γ 1,g (x i ), I 1 , ----→ γ 2,g (x i ), I 2 , h 1 • h 2 • T 1 • ? u ′ 1 , ----→ γ 2,g (x i ), I 2 , h ′ 1|D ′ 1 • h 2 • T 2 ⊥ • ( u 1 , u 2 , h ′ |D ′ ) • T 3 T is in ([Γ 1 ⊢ M 1 : σ] ⊗ [Γ 2 ])||([σ] ⊗ [Γ 2 ⊢ M 2 : τ ]).
To do so, we prove that T it is indeed an interaction trace over

([Γ 1 ] ⊗ [Γ 2 ]) → ([σ] ⊗ [Γ 2 ]) → ([σ] ⊗ [τ ]). First, T |([Γ 1 ]⊗[Γ 2 ]),([σ]⊗[Γ 2 ]) is legal, since it is formed from -? ----→ γ 1,g (x i ), I 1 , ----→ γ 2,g (x i ), I 2 , h 1 • h 2 , -T 1 , - u ′ 1 , ----→ γ 2,g (x i ), I ′ 2 , h ′ 1|D ′ 1
• h 2 (recall that the restriction of T changes the initial action of the middle arena from player question to player answer), -the actions of T 2 which are the copycat pairs on the arena

[Γ 2 ] → [Γ 2 ],
-the actions of T 3 which are the first elements of the copycat pairs on the arena

[σ] → [σ] Moreover, T | F ([Γ 1 ]⊗[Γ 2 ]),([σ]⊗[Γ 2 ]
) removes part of the heaps of the actions coming from T 2 and T 3 , such that this restriction is indeed in

([Γ 1 ⊢ M 1 : σ] ⊗ [Γ 2 ]) since all the actions on [Γ 2 ] → [Γ 2 ] are copycat pairs, thus in id [Γ 2 ] . Then, T | F ([Γ 1 ]⊗[Γ 2 ]),([σ]⊗[τ ]) is indeed equal to ? ----→ γ 1,g (x i ), I 1 , ----→ γ 2,g (x i ), I 2 , h 1 • h 2 • T 1 • T 2 • ( u 1 , u 2 , h ′ |D ′ ) • T 3 , due to the construction of T 2 and T 3 . Finally, P(T | F ([Γ 1 ]⊗[Γ 2 ]),([σ]⊗[Γ 2 ]) ) ∩ P(T | F ([σ]⊗[Γ 2 ]),([σ]⊗[τ ]) ) is equal to ∅, since h ′ 1 , h 2 are disjoint
We now prove the reverse inclusion. We take T an interaction trace over

([Γ 1 ] ⊗ [Γ 2 ]) → ([σ] ⊗ [Γ 2 ]) → ([σ] ⊗ [τ ]) such that -T | F ([Γ 1 ]⊗[Γ 2 ]),([σ]⊗[Γ 2 ]) is in ([Γ 1 ⊢ M 1 : σ] ⊗ [Γ 2 ]), -and T | F ([σ]⊗[Γ 2 ]),([σ]⊗[τ ]) is in ([σ] ⊗ [Γ 2 ⊢ M 2 : τ ])
. Suppose the T is not empty, so the first action a 1 of T is necessarily of the form

(? -→ v 1,j , I 1 , -→ v 2,k , I 2 , h 1 • h 2 )
such that -we can define two functions γ g,1 : Γ g,1 → Val and γ g,1 : Γ g,1 → Val as γ g,1 (x j ) = v 1,j and γ g,2 (x k ) = v 2,k . -h i are in Cl(ν L (codom(γ g,i ))) and are functional-free, and are disjoint, -

I i = I Γ i ∪ I h i with I Γ i ∼ P Γ f,i and I h i = ν P (codom(h i )). We now consider the maximal prefix a 1 • T 1 of T | F ([Γ 1 ]⊗[Γ 2 ]),([σ]⊗[Γ 2 ])
until the player answer to this first opponent question appears to this trace. Then,

T 1 ∈ Tr γ 1,g (M 1 ), ε, I 1 • I 2 , h 1 • h 2 , D 1 ∪ D 2
and a 1 • T 1 is also a prefix of T , since there could have been no actions in any other arena before an answer to the first opponent question appears.

Then, if this player answer a 2 exists, it can be written as

u 1 , -→ v 2,k , I 2 , h ′ 1 • h 2 with h 2 ∼ P h 2 and γ 1,g (M 1 ), ε, I 1 , h 1 , D 1 T 1 -→ u ′ 1 , γ 1 , I ′ 1 , h ′ 1 , D ′ 1 Indeed, by definition of ([Γ 1 ⊢ M 1 : σ] ⊗ [Γ 2 ]), it has to play copycat over [Γ 2 ]. Moreover, h ′ 1 is indeed disjoint from h 2 since P(T | F ([Γ 1 ]⊗[Γ 2 ]),([σ]⊗[Γ 2 ]) ) ∩ P(T | F ([σ]⊗[Γ 2 ]),([σ]⊗[τ ])
) is equal to ∅. The rest of the proof is done in the same way.

Then, since the product of strongly single-threaded trace strategies over a trace termarena A is cartesian, one can define the diagonal morphism d A : A → A ⊗ A. Using it, we get the following corollary of the previous theorem, when M 1 , M 2 share the same typing context Γ.

Corollary 2: Let M 1 , M 2 two terms such that Γ f , Γ g Γ ⊢ M 1 : σ and Γ f , Γ g ⊢ M 2 : τ . Then (d [Γ] ) † ; ([Γ ⊢ M 1 : σ] ⊗ [Γ ⊢ M 2 : τ ]
) is equal to the nominal closure of the set of even-length traces belonging to

T 1 • T 2 • (( ū1 , ū2 ), h ′ |D ′ ) • Tr ♦, γ ′ , I ′ , h ′ , D ′ s.t. there exists γ g : Γ g → Val and h ∈ Cl(ν L (codom(γ g )))
with D defined as dom(h) and I as dom(Γ f ), and we have -

γ g (M 1 ), ε, I, h, D T 1 -→ u ′ 1 , γ 1 , I 1 , h 1 , D 1 with u ′ 1 a value, -γ g (M 2 ), γ 1 , I 1 , h 1 , D 1 T 2 -→ u ′ 2 , γ 2 , I ′ , h 2 , D 2 with u ′ 2 a value, -D ′ = discl({u 1 , u 2 }, h ′ , D 2 ), -h ′ = h 2 -----→ [l i ֒→ x i ] with l i ranging over h 2,fn ∩ D ′ and the x i not in γ 2 and distinct from u 1 , u 2 , -γ ′ is the extension of γ 2 with (u i → u ′ i ) if u ′ i is of functional type-otherwise u ′ i = u i -
and with all the (x i → h 2 (l i )) for l i ranging over h 2,f n|D ′ .

Denotation of Applications

Using this characterization of pairings of trace-strategies representing terms, we can now decompose the trace semantics of application of two terms. To do so, we consider the function ev A,B which transforms a trace of ((A ⇒ B) ⊗ B) ⇒ B into a trace of B, defined as (L B A⇒B,A ) -1 (id A⇒B ). The inverse of L B A⇒B,A is indeed defined here because id A⇒B is strongly single-threaded.

Using the previous characterization of pairings, we can prove the following theorem which decompose traces of applications of two terms.

Theorem 18: Let M 1 , M 2 two terms such that Σ; Γ ⊢ M 1 : σ → τ and Σ; Γ ⊢ M 2 : σ. Then [Σ; Γ ⊢ M 1 M 2 : τ ] = (d [Γ] ) † ; ([Σ; Γ ⊢ M 1 : σ → τ ] ⊗ [Σ; Γ ⊢ M 2 : σ]); ev [σ],[τ ] .

Full Abstraction of Trace Semantics

Using this correspondence with game semantics, we can import the full abstraction result of [START_REF] Murawski | Game semantics for good general references[END_REF] (Theorem 36) to trace semantics. Notice that Laird has already proven this result directly [START_REF] Laird | A fully abstract trace semantics for general references[END_REF], where he needed a complex proof of definability of trace strategy to achieve it.

Theorem 19: For M 1 , M 2 terms of RefML such that Σ; Γ ⊢ M 1 , M 2 : τ , we have Σ; Γ ⊢ M 1 ≃ ctx M 2 : τ iff comp([Σ; Γ ⊢ M 1 : τ ]) = comp([Σ; Γ ⊢ M 2 : τ ]).

Trace Semantics for GroundML

In this section, we refine our trace semantics to handle also GroundML. This is done in two steps:

-we rephrase the notion of visibility defined in Section 5.1.2 for trace strategies in order to characterize trace strategies coming from terms of GroundML. -we refine the interactive reduction of Figure 5.2 to restrict the power of contexts, since they cannot keep track of disclosed λ-abstractions during the whole execution but only inside the current scope, because of the lack of higher-order references. We adapt the characterizations of ground-refererences terms of RefML of [START_REF] Murawski | Algorithmic nominal game semantics[END_REF] into trace semantics, namely the fact that they are represented by visible strategies, which restrict the pointer structure of actions of a trace T to be in the view of T .

Definition 34 (View). The view T of a legal trace T on A is a subsequence of T defined by induction:

-

ε = ε, -(a, h) = (a, h), -T ′ • (a, h) • T ′′ • (a ′ , h ′ ) = T ′ • (a, h) • (a ′ , h ′ ) when (a ′ , h ′ ) is justified by (a, h).
Then, as in game semantics, we say that a trace T is P-visible (resp. O-visible) if for all T ′ • (a, h) ⊑ even T (resp. T ′ • (a, h) ⊑ odd T with (a, h) a player (resp. opponent) action-with-heap, the justifier of (a, h) is in T ′ . A trace strategy is said to be X-visible if all its traces are X-visible, for X ∈ {P, O}.

In our setting, justification is defined using freshness of name pointers in traces, so we introduce the notion of available X-name pointers, for X ∈ {P, O}, to reason on the view: Definition 35 (Available Name-Pointers). We define the set of available opponent (resp. player) name pointers Av O (T ) (resp. Av O (T )) inductively as -Av X (ε)

def = ∅, -Av X ((a, h)) def = ν X P (a), -Av X (T • (a 1 , h 1 ) • T ′ • (a 2 , h 2 )) def = Av X (T ) ∪ ν X P (a 2 ) when (a 1 , h 1 ) is justified by (a 2 , h 2 ). with X ∈ {P, O}.
Notice in the previous definition that we do not need to consider name pointers in heaps, since we consider terms of GroundML, which do not store any functions in heaps, and for which contexts cannot disclose higher-order references. Moreover, in the third clause, we do not need to consider the name pointers of a 1 since its polarity is opposed as the one of a 2 .

We now link the definition of available name pointers to the notion of view:

Lemma 14: Let T a justified trace, then for all name pointers x ∈ Av X (T ) (X ∈ {P, O}), x is introduced by an action (a, h) which appears in T .

Ground-refererences Terms of RefML and P-visible strategies

The characterization of trace-strategies coming from terms of GroundML is given by the following theorem.

Theorem 20: Let M a term of GroundML such that Σ; Γ ⊢ M : τ , then [Σ; Γ ⊢ M : τ ] is a P-visible trace strategy.

Even if the theorem is similar to the one stated in game semantics, the proof is radically different because the definition of the denotation is operational and so the proof can no longer be done by inductively showing that the visibility condition is preserved. To conduct the proof in this operational setting, we need to analyze the structure of traces more closely. We first notice a crucial property of the interactive reduction of such terms,

P-Intern (M, τ, ξ, A) • -→ K i , γ, I, h, D ------→ (M ′ , τ, ξ, A) • -→ K i , γ, I, h ′ , D (when (M, h) → nd (M ′ , h ′ )) P-AnsG (v, ι, ξ, A) • -→ K i , γ, I, h, D ( v ,r •ξ,h ′ |D ) -------→ -→ K i , γ ′ , I, h, D ′ , A (v of type ι, D ′ = discl(v, h, D)) P-Ans (v, τ, ξ, A) • -→ K i , γ, I, h, D ( x ,r •ξ,h |D ) -------→ -→ K i , γ ′ , I, h, D, x • A (x fresh, γ ′ = γ • [x ֒→ (v, τ, r • ξ)]) P-QuestG (K[x v], τ, ξ, A) • -→ K i , γ, I, h, D (x v ,l •ξ ′ ,h |D ′ ) --------→ (K[• ι,ξ ′ ], τ, ξ, A) • -→ K i , γ, I, h, D ′ , A ′ ( (x, ι → σ, ξ ′ , A ′ ) ∈ I, v of type ι, D ′ = discl(v, h, D)) P-Quest (K[x v], τ, ξ, A) • -→ K i , γ, I, h, D (x y ,l •ξ ′ ,h |D ) --------→ (K[• σ ′ ,ξ ′ ], τ, ξ, A) • -→ K i , γ ′ , I, h, D, y • A ′ ((x, σ → σ ′ , ξ ′ , A ′ ) ∈ I, y fresh, γ ′ = γ • [y ֒→ (v, σ, l • ξ ′ )]) O-AnsG (K[• ι,ξ ′ ], τ, ξ, A) • -→ K i , γ, I, h, D, A ′ ( v ,r •ξ ′ ,h ′ |D ′ ) -------→ (K[v], τ, ξ, A) • -→ K i , γ, I, h ′ , D ′ (v of type ι, v / ∈ dom(h) ∩ D) O-Ans (K[• σ,ξ ′ ], τ, ξ, A) • -→ K i , γ, I, h, D, A ′ ( x ,r •ξ ′ ,h ′ |D ′ ) -------→ (K[x], τ, ξ, A) • -→ K i , γ, I ′ , h ′ , D ′ (x fresh, I ′ = I • (x, σ, r • ξ ′ , A ′ )) O-QuestG -→ K i , γ, I, h, D, A (x v ,l •ξ,h ′ |D ′ ) --------→ (u v, τ, ξ, A) • -→ K i , γ, I ′ , h ′ , D ′ (x ∈ A, γ(x) = (u, ι → τ, ξ), v of type ι and not in dom(h) ∩ D) O-Quest -→ K i , γ, I, h, D, A (x y ,l •ξ,h ′ |D ′ ) --------→ (u y, τ, ξ) • -→ K i , γ, I ′ , h ′ , D ′ (x ∈ A, γ(x) = (u, σ → τ, ξ), y fresh, I ′ = I • (y, τ, l • ξ, A)) in all O-Rules: D ′ = discl(v, h ′ , D), h ′ |D ′ = h |D and h ′ |D ′ is closed)
Figure 5.3: Definitions of the interaction semantics for GroundML traces which are not generated by an interaction between contexts and terms of GroundML.

To get full abstraction, we need to constrain traces to be O-visible by modifying the interactive reduction to control the scope of name pointers such that only pointers appearing in the view of an action are available. We present the modified interactive reduction in Figure 5.3. Firstly, notice that since we do not have higher-order references in our language, we do not need to extend I and γ with pointers representing functions stored in the disclosed part of the heap. Then, we keep track of available player name pointers, represented by a set A, in different places of the configuration:

-in opponent configurations -→ K i , γ, I, h, D, A , representing the current available player name pointers, -within each element (M, τ, ξ, A) or (K[• τ,ξ ], σ, ξ ′ , A) of the execution stack, representing the player name pointers available when opponent add this element to the execution stack via a question. -within each opponent name pointers x ∈ I, representing the player name pointers available when x has been introduced by an opponent action. Using this set of available player name pointers, we can control the questions Opponent can ask, as shown by the condition x ∈ A in the rules O-QuestG and O-Quest. This idea is formalized in the following lemma:

Lemma 16: Let (i, h 0 )•T ∈ [Σ; Γ f ⊢ M : τ ] such that (M, τ, ξ, ∅), γ, I, h, D T -→ -→ K i , γ ′ , I ′ , h ′ , D ′ , A then Av O (T ) = A.
Using our restricted interactive reduction, we define the ground interpretation of a judgment [Σ; Γ ⊢ M : τ ] G in the same way than in Definition 27, with the empty set of pointers associate to M in the execution stack. From Lemma 16, we can deduce that the ground interpretation always gives rise to visible strategy.

Theorem 21: Let M a term of GroundML such that Σ; Γ ⊢ M : τ , then [Σ; Γ ⊢ M : τ ] G is a visible strategy (i.e. both P-visible and O-visible).

Proof Let γ g : Γ g → Val a ground-variable substitution, h : Σ and T •a ∈ Tr M, •, Γ f , h, Σ . If a is a player action, the P-visibility of T can be deduce from theorem 20, since we can easily see that

[Σ; Γ ⊢ M : τ ] G ⊆ [Σ; Γ ⊢ M : τ ]. If a is an opponent action (o, h), let us decompose T into T ′ • (p ′ , h ′ ) • T ′′ such that (o, h) is justified by (p, h ′ ). Then we must prove that (p, h ′ ) is in T .
-If o is an opponent answer, then due to the well-bracketing condition, (p, h ′ ) is indeed in T . -If o is an opponent question f x , then the depth associated to f is lower than the depth of the last unanswered player question. Thus using lemma 16, we get that (p, h ′ ), the player action which introduces f , is in the view of T .

It is straightforward to see that the notion of visibility introduced here corresponds exactly to the usual notion of visibility of game semantics. So importing the full abstraction result of [START_REF] Murawski | Algorithmic games for full ground references[END_REF], we get the following theorem:

S V Int I (u) def = ū S V Int → σ I (v) def =   † • n∈Z (( † n ) • S E σ I (v n))   S V τ → σ I (v) def =    † • ( † y ) • S E σ I•(y,τ ) (v y) S    with y / ∈ (I ∪ ν O P (S)) S K Int, τ I (K) def = n∈Z ( n • S E τ I (K[ n])) S K σ, τ I (K) def = ( y • S E τ I•(y,σ) (K[y]) S ) with y / ∈ (I ∪ ν O P (S)) S E τ I (M ) def =        ( f † , S V σ I (v)) • S K σ ′ , τ I (K) if M → * K[f v] and (f, σ → σ ′ ) ∈ I S V τ I (v) if M → * v
Let M 1 , M 2 two terms of GroundML such that Σ; Γ ⊢ M 1 , M 2 : τ . Then Σ; Γ ⊢ M 1 ≃ G ctx M 1 : τ iff comp([Σ; Γ ⊢ M 1 : τ ] G ) = comp([Σ; Γ ⊢ M 2 : τ ] G ).
When M 1 , M 2 are divergent-free terms of GroundML, they cannot possibly diverge, so we do not need the restriction to complete trace plays in the theorem.

Decidability of the Pure Fragment

In this last part, as a preview to the next chapters, we show how to perform surgery on traces to get decidability properties. We consider the pure fragment of RefML, i.e. diverging-free terms M such that Γ ⊢ M : τ with τ not containing any subtype ref τ , and M not containing any subterms ref M ′ (and consequently no subterms M 1 := M 2 and !M 1 ). Thus, in the sequel, configurations are simply written E • -→ K i , γ, I .

Callback Structure

To introspect a pure term, we introduce the notion of callback structure, depicted in Figure 5.4. They are formed as list of trees of partial actions in pAction, where player name pointers are omitted and replaced by a symbol †. Such structure is in fact really closed to abstract Bohm trees [START_REF] Curien | Abstract böhm trees[END_REF], which have been used to represent strategies in a call-by-name setting [START_REF] Curien | Abstract machines for dialogue games[END_REF]. S E τ I and S V τ I are elements of Struct n where n is the maximum of the order of τ and the types of I-with Struct

0 def = Val and Struct n+1 def = List(pAction ∪ (pAction × Struct n ) ∪ (P(Struct n ))). When Int is restricted to bounded integers, S E τ I (M ) is clearly computable.
For example, consider the term

M def = λf.λn.if n = 0 then f(λx.x) else f(λx.n) of type τ def = ((Int → Int) → Unit) → Int → Unit.
The reader can check that its callback structure is

S V τ ∅ (M ) = † • † f • † • † 0 • ( f † , † • † n • ¯ n ) | n ∈ Z ∪ † m • ( f † , † • † n • ¯ m ) | m ∈ Z * , n ∈ Z
To compare callback structures, we use a notion of nominal equivalence, indexed by a span on (opponent) name pointers.

Definition 36. We say that two callback structures S 1 , S 2 of Struct n are equivalent for a span e O , written

S 1 ≃ n e O S 2 , when -k ≃ n e O k - † • S ′ 1 ≃ n e O † • S ′ 2 if S ′ 1 ≃ n e O S ′ 2 -(( f1 † , S ′ 1 ) • S ′′ 1 ) ≃ n+1 e O (( f2 † , S ′ 2 ) • S ′′ 2 ) if (f 1 , f 2 ) is in e O , S ′ 1 ≃ n e O S ′ 2 and S ′′ 1 ≃ n+1 e O S ′′ 2 , -{( j , S j 1 ) | j ∈ Z} ≃ n e O ({( j , S j ) | j ∈ Z} if S j 1 ≃ n e O S j 2 for all j ∈ Z. -( x 1 • S 1 ) ≃ n e O ( x 2 • S 2 ) if S 1 ≃ n e O •(x 1 ,x 2 ) S 2 .
When integers are bounded, this equivalence is again decidable since we reason on finite objects. In the following, we omit the index n when it is clear from the context. We also define an equivalence between two substitutions γ 1 , γ 2 , written γ 1 ≃ e P ,e O γ 2 , as

S V τ e O,1 (γ 1 (x 2 )) ≃ e O S V τ e O,2 (γ 1 (x 2 )) for all (x 1 , x 2 , τ ) ∈ e P .
Notice that callback structures are not closed by nominal equivalence on name pointers (i.e. on variables). Indeed, in the definition of S V τ → σ I (v) and S K σ, τ I (K), the choice of the fresh opponent name pointer y is supposed to be deterministic. But we can prove that the callback structure equivalence is preserved by nominal equivalence: Lemma 17: Let M 1 , M 2 two ground-closed pure terms and e O a span on their free functional variables such that S E τ e O,i (M 1 ) ≃ e O S E τ e O,2 (M 2 ). Let π 1 , π 2 two finitely supported permutations on name pointers, then writing e ′ O for the span formed by the π 1 (x 1 ), π 2 (x 2 ) with (x 1 , x 2 ) ∈ e O (i.e. the span which result from the action of π 1 × π 2 on e O seen as a nominal element on P × P), we have

S E τ π 1 * M 1 (e ′ O,1 )(π 1 * M 1 ) ≃ e ′ O S E τ π 1 * M 1 (e ′ O,2 )(π 2 * M 2 ).
The two following lemmas are used to show that equivalence of callback structures of terms is preserved by reduction.

Lemma 18: Let e P and e O two spans respectively on player and opponent name pointers, and γ 1 , γ 2 two substitutions whose domains are equal respectively to e P,1 , e P,2 , with Proof The two lemmas are proved by a mutual induction on the length of the callback structure of γ i .

γ 1 ≃ e P ,e O γ 2 . Let M 1 , M 2 two terms such that S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ) and T i ∈ Tr M i , γ i , e O,i such that T 1 ≃ e P ,e O T 2 and M i , γ i , e O,i T i -→ v i , γ ′ i ,
Proof (Proof of Lemma 18) From S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ), there is two possibilities: -Both M i → v i with S V τ e O,1 (v 1 ) ≃ e O S V τ e O,2 (v 2 ).
Then we get directly the wanted property.

-Or both M i → K i [f i u 1 i ] such that there exists two types σ, σ ′ with (f 1 , f 2 ) ∈ e O,σ→σ ′ and S V σ e O,1 (u 1 1 ) ≃ e O S V σ e O,2 (u 1 2 ). Then we can decompose T i into fi u 1 i • U 1 i • u 2 i • U 2 i with M i , γ i , e O,i fi u 1 i ----→ K i [•], γ 1 i , e O,i U 1 i -→ K i [•], γ 2 i , e 1 O,i u 2 i -→ K i [u 2 i ], γ 2 i , e 2 O,i such that u 1 i = u 1 i , γ 1 i = γ i and e 1 P = e P if σ is equal to Int, otherwise u 1 i is equal to some fresh name x i , γ 1 i = γ i • (x i → u 1 i
) and e 1 P = e P • (x 1 , x 2 , σ). Using the induction hypothesis from the second lemma, we get the existence of e 2 P ⊒ e 1 P and

e 1 O ⊒ e O such that γ 1 1 ≃ e 2 P ,e 1
O γ 1 2 . Then, we conclude using the induction hypothesis on the first lemma, since This lemma is proven via a mutual induction with the following three theorems which state that the callback structure gives a sound and complete model of the pure fragment of RefML. Lemma 20 is used for the soundness of callback structures, while the completeness is rather straightforward due to the fact that the callback structure of a term M can be seen as a set of subtraces of M .

S E τ e 2 O,1 (K 1 [u 2 1 ]) ≃ e 2 O S E τ e 2 O,2 (K 2 [u 2 2 ]) Proof (Proof of Lemma 19) We can suppose than T i = (f i u i ) • U 1 i • U 2 i with (f 1 , f 2 ) ∈ e O,σ→σ ′ , γ i (f i ) = v i and ♦, γ i , e O,i f i u 1 i ----→ v i u i , γ i , e 1 O,i U 1 i -→ ♦, γ 1 i , e 2 O,i U 2 i -→ ♦, γ ′ i ,
Theorem 23: Let v 1 , v 2 a pair of pure ground-closed values of RefML, e O a span on their name pointers, e P a span on player name pointers and γ i : e P,i → Val two substitutions such that

γ 1 ≃ e P ,e O γ 2 . Then S V τ e O,1 (v 1 ) ≃ e O S E τ e O,2 (v 2 ) iff Tr v 1 , γ 1 , e O,1 ≃ e P ,e O Tr v 2 , γ 2 , e O,2 .
Theorem 24: Let K 1 , K 2 a pair of pure ground-closed contexts of RefML, e O a span on their name pointers, e P a span on player name pointers and γ i : e P,i → Val two substitutions such that γ 1 ≃ e P ,e O γ 2 . Then

S K σ, τ e O,1 (K 1 ) ≃ e O S K σ, τ e O,2 (K 2 ) iff Tr K 1 , γ 1 , e O,1 ≃ e P ,e O Tr K 2 , γ 2 , e O,2 .
Theorem 25: Let M 1 , M 2 a pair of pure ground-closed terms of RefML, e O a span on their name pointers, e P a span on player name pointers and γ i : e P,i → Val two substitutions such that

γ 1 ≃ e P ,e O γ 2 . Then S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ) iff [ M 1 , γ 1 , e O,1 ] ≃ e P ,e O [ M 2 , γ 2 , e O,2 ].
Proof The three theorems and the lemmas are proved by a mutual induction on types and on the length of the callback structures.

Proof (Lemma 20) let T 1 ∈ Tr ♦, γ 1 , e O,1 , we want to build T 2 ∈ Tr ♦, γ 2 , e O,2 such that T 1 ≃ e P ,e O T 2 . We can decompose T 1 into (f 1 u 1 1 ) • U 1 1 • ū2 1 • U 2 1 with γ 1 (f 1 ) = v 1 , U 1 1 • ū2 1 ∈ Tr v 1 u 1 1 , γ 1 1 , e 1 O,1 , U 2 1 ∈ Tr ♦, γ 2 1 , e 2 O,1 and ♦, γ 1 , e O,1 f 1 u 1 1 ----→ v 1 u 1 1 , γ 1 , e 1 O,1 U 1 1 -→ u 2 1 , γ 1 1 , e 2 O,1 ū2 1 --→ ♦, γ 2 1 , e 2 O,1
Let f 2 such that (f 1 , f 2 ) ∈ e P , i.e. there exists σ, σ such that (f 1 , f 2 ) ∈ e P,σ→σ ′ . We reason by case analysis on σ:

-If σ is equal to Int, then e 1 O,1 = e O,1 so we define u 1 2 as u 1 1 and e 1 O as e O , -Otherwise, u 1 1 is equal to some opponent name pointer y 1 and e 1 O,1 = e O,1 •y 1 . So we define u 1 2 as y 2 , a fresh opponent name pointer not in e O,2 , and

e 1 O = e O • (y 1 , y 2 , σ) Then, from γ 1 ≃ e P ,e O γ 2 we get S V σ → σ ′ e O,1 (v 1 ) ≃ e O S V σ → σ ′ e O,2 (v 2 ), so S E σ ′ e 1 O,1 (v 1 u 1 1 ) ≃ e 1 O S E σ ′ e 1 O,2 (v 2 u 1 2 ).
Then by induction hypothesis on Terms, we get the existence of

U 1 2 • ū2 2 ∈ Tr v 1 u 1 2 , γ 1 , e 1 O,1 such that U 1 1 • ū2 1 ≃ e P ,e 1 O U 1 2 • ū2 2 . Finally,
U 2 2 ∈ Tr ♦, γ 2 2 , e 2 O,2 such that U 2 1 ≃ e 2 P ,e 2 O U 2 2 . Thus, defining T 2 as (f 2 u 1 2 ) • U 1 2 • ū2 2 • U 2 2 we get that T 1 ≃ e P ,e O T 2 .
Proof (Full Abstraction on Values) We have

Tr v i , γ i , e O,i = ¯ v i •Tr ♦, γ 1 1 , e O,1 with v i = v i and γ 1 i = γ i if τ is equal to Int, otherwise v i is equal to a player name pointer f i not in e P,i and γ 1 i = γ i •(f i → v i ).
Then we get the direct implication using the induction hypothesis on lemma 20. To prove the reverse implication, we reason by case analysis on τ :

-

If τ is equal to Int, then Tr v 1 , γ 1 , e O,1 ≃ e P ,e O Tr v 2 , γ 2 , e O,2 gives us that v 1 = v 2 . -Otherwise, defining e 1 P = e P •(f 1 , f 2 , τ ), we have Tr ♦, γ 1 1 , e O,1 ≃ e 1 P ,e O Tr ♦, γ 1 2 , e O,2 . If τ = Int → σ, then let n ∈ Z, we have Tr v 1 n, γ 1 1 , e O,1 ≃ e 1 P ,e O Tr v 2 n, γ 1
2 , e O,2 so we conclude using the induction hypothesis on terms. Otherwise, we have τ = σ → σ ′ , and defining e 1 O = e O • (y 1 , y 2 , σ) we get

Tr v 1 y 1 , γ 1 1 , e 1 O,1 ≃ e 1 P ,e 1 O Tr v 2 y 2 , γ 1 2 , e 1 O,2
and we conclude using again the induction hypothesis on terms.

Proof (Full Abstraction on Context) We first prove the direct implication. Suppose that

S K σ, τ e O,1 (K 1 ) ≃ e O S K σ, τ e O,2 (K 2 ) then taking T 1 ∈ Tr K 1 , γ 1 , e O,1 , we have T 1 = U 1 1 • u 1 • U 2 1 with K 1 , γ 1 , e O,1 U 1 1 -→ K 1 , γ 1 1 , e 1 O,1 u 1 -→ K 1 [u 1 ], γ 2 1 , e 2 O,1
We want to build T 2 ∈ Tr K 2 , γ 2 , e O,2 such that T 1 ≃ e P ,e O T 2 . Using the induction hypothesis on the first lemma, we get the existence of

U 1 2 ∈ ♦, γ 1 , e O,1 such that U 1 1 ≃ e P ,e O U 1 2 and K 2 , γ 2 , e O,2 U 1 2 -→ K 2 , γ 1 2 , e 1 O,
O • (x 1 , x 2 , σ). So from S K σ, τ e 1 O,1 (K 1 ) ≃ e 1 O S K σ, τ e 1 O,2 (K 2 ) we get that S E τ e 2 O,1 (K 1 [u 1 ]) ≃ e 2 O S E τ e 2 O,2 (K 2 [u 2 ])
and the induction hypothesis on terms gives us the existence of -If σ is of type Int, then for all n ∈ Z and

U 2 2 ∈ Tr K 2 [u 2 ], γ 1 2 , e 2 O,2 such that U 2 1 ≃ e 1 P ,e 2 O U 2 2 . Then defining T 2 as U 1 2 • u 2 • U 2 2 ,
T 1 ∈ Tr K 1 [n], γ 1 , e O,1 , we have n • T 1 ∈ Tr K i , γ i ,
S E τ e O,1 (K 1 [n]) ≃ e O S E τ e O,2 (K 2 [n])
and since this is true for all n ∈ Z, we get

S K σ, τ e O,1 (K 1 ) ≃ e O S K σ, τ e O,2 (K 2 ).
-If σ is functional, then taking x i a fresh player name pointer not in e P,i , we define

e 1 P = e P • (x 1 , x 2 , σ). Then taking T 1 ∈ Tr K 1 [x 1 ], γ 1 1 , e O,1 we have x1 • T 1 ∈ Tr K i , γ i , e O,i . Thus there exists T 2 ∈ Tr K 2 [x 2 ], γ 1
2 , e O,2 such that T 1 ≃ e 1 P ,e O T 2 . Using a symmetric reasoning, we get that Tr K

1 [x 1 ], γ 1 1 , e O,1 ≃ e 1 P ,e O Tr K 2 [x 2 ], γ 1 2 , e O,2
. So using the induction hypothesis on terms, we get that

S E τ e 1 O,1 (K 1 [x 2 ]) ≃ e 1 O S E τ e O,2 (K 2 [x 2 ]), i.e. S K σ, τ e O,1 (K 1 ) ≃ e O S K σ, τ e O,2 (K 2 ).
Proof (Full Abstraction on Terms) Suppose that both

M i → v i , then Tr M i , γ i , e O,i = Tr v i , γ i , e O,i and S E τ e O,1 (M i ) = S V τ e O,1 (v i
) and we conclude using the induction hypothesis on values.

If both M i → K i [f i u i ], then Tr M i , γ i , e O,i = ( fi u i ) • Tr K i , γ 1 i , e O,i with u i = u i and γ 1 i = γ i if σ = Int
, otherwise u i is equal to some fresh player name pointer x i and

γ 1 i = γ i • (x i ֒→ u i ). Moreover S E τ e O,i (M i ) = (f i , S V τ e O,i (u 1 )) • S K σ ′ , τ e O,i (K i )
And we conclude easily using the induction hypothesis on contexts.

Finally, using the full abstraction of trace semantics, we get a complete characterization of contextual equivalence in term of equivalence of the callback structure of terms. Notice that the same definition of S E τ (M ) can be used to deal with pure terms of GroundML, and the same proof of full abstraction goes through. This means that the notion of contextual equivalence of RefML and GroundML is the same on pure terms, which is to our knowledge a new result.

Corollary 4: Let (M 1 , M 2 ) a pair of pure terms of RefML such that Γ g , Γ f ⊢ M 1 , M 2 : τ . Then •; Γ g , Γ f ⊢ M 1 ≃ ctx M 2 : τ iff S E τ Γ f (γ(M 1 )) ≃ Γ f S E τ Γ f (γ(M 2 )) for all substitutions γ : Γ g → Val. (K[M ], C) → s (K[M ′ ], C) when (M, ∅) → (M ′ , ∅) (K[x == x ′ ], C) → s (K[true], C ∧ (x = x ′ )) or (K[false], C ∧ (x = x ′ )) (K[x == n], C) → s (K[true], C ∧ (x = n)) or (K[false], C ∧ (x = n)) (K[ n == x], C) → s (K[true], C ∧ (x = n)) or (K[false], C ∧ (x = n)) (K[x + n], C) → s (K[z], C ∧ (z = x + n)) with z fresh in C (K[ n + x], C) → s (K[z], C ∧ (z = x + n)) with z fresh in C (K[x + x ′ ], C) → s (K[z], C ∧ (z = x + x ′ )) with z fresh in C (K[if b then M 1 → s (K[M 1 ], C ∧ (b = 0)) or (K[M 2 ], C ∧ (b = 1)) else M 2 ], C)
Finally, to decide the equivalence of two pure terms, we simply have to compute their callback structures and then check if they are equivalent-which is always possible when the type Int is bounded.

Symbolic Execution and Decidability of the unbounded fragment

S E τ (M ) is in general an infinite object when we do not bound the type Int. However, due to the fact that terms cannot have infinite branching, it is possible to represent S E τ (M ) in a finite way.

To do so, we introduce a symbolic execution in Figure 5.5, which reason logically on integer variables with arithmetic constraints. Those constraints are collected in a set C, so that the reduction is defined on pairs (M, C). A more general symbolic execution, defined for GroundML, will be presented in Chapter 7.

Then, this symbolic execution is used to define the symbolic callback structure of terms in Figure 5.6. Notice that S E τ I (M ) is now defined as a set.

The equivalence of two symbolic callback structures is then defined as a logical formula of Presburger Arithmetic. Definition 37. Two symbolic callback structures S 1 , S 2 of Struct n are symbolically equivalent for a span e O , written

S 1 ≃ n e O S 2 , as -t1 ≃ n e O t2 def = t 1 = t 2 , -(( f1 † , S 1 ) • S ′ 1 ) ≃ n+1 e O (( f2 † , S 2 ) • S ′ 2 ) def =    (S ′ 1 ≃ n e O S ′ 2 ∧ S ′′ 1 ≃ n e ′ O S ′′ 2 ) if (f 1 , f 2 ) ∈ e O , False otherwise. S V Int I (t) def = t S V Int → σ I (v) def = ( † , † z , S E σ I (v z)) S V τ → σ I (v) def = ( † , † y , S E σ I•(y,τ ) (v y)) with y / ∈ I S K Int, τ I (K) def = ( z , S E τ I (K[z])) S K σ, τ I (K) def = ( x , S E τ I•(x,σ) (K[x])) S E τ I (M ) def = {(( f † , S V σ I (v)), C) • S K σ ′ , τ I (K) | (M, ∅) → * s (K[f v], C) and (f, σ → σ ′ ) ∈ I} ∪ {(S V τ I (v), C) | (M, ∅) → * s (v, C)}
-{(S j 1 , C j 1 ) | j 1 ∈ J 1 } ≃ n+1 e O {(S j 2 , C j 2 ) | j 2 ∈ J 2 } def = (j 1 ,j 2 )∈J 1 ×J 2 (C j 1 ∧ C j 2 ) ⇒ (S j 1 ≃ n e O S j 2 ) -( x 1 , S 1 ) ≃ n e O ( x 2 , S 1 ) def = ∀x 1 , x 2 .(x 1 = x 2 ) =⇒ S 1 ≃ n e O S 2 -( † x 1 • S 1 ) ≃ n e O ( † x 2 • S 2 ) if S 1 ≃ n e O •(x 1 ,x 2 ) S 2 .
To get the decidability result, we have to prove that this symbolic equivalence coincide with the equivalence on callback structures introduce in the previous section.

Theorem 26: Let M 1 , M 2 two ground-closed terms of type τ and e O a span on their free functional variables. Then

S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ) iff S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ).
To prove this theorem, we must relate the symbolic execution of

(C) → Int such that -α(C) is true, -(M, ∅) → * s (M ′′ , C), -α(M ′′ ) = M ′ .
Lemma 22: Let M a term such that (M, ∅) → * s (M ′′ , C) and there exists a substitution α : FV(C) → Int such that α(C) is true. Then there exists

M ′ such that M → * s M ′ and α(M ′′ ) = M ′ .
Then, it is clear that free logical variables of the formula S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ) are the free logical variables of M 1 and M 2 . So we can show that substitutions of logical variables go throught the symbolic equivalence, via the following three lemmas.

Lemma 23: α(S V τ e O,1 (v 1 ) ≃ e O S V τ e O,2 (v 2 )) iff S V σ e O,1 (α(v 1 )) ≃ e O S V τ e O,2 (α(v 2 )) Lemma 24: α(S K σ, τ e O,1 (K 1 ) ≃ e O S K σ, τ e O,2 (K 2 )) iff S K σ, τ e O,1 (α(K 1 )) ≃ e O S K σ, τ e O,2 (α(K 2 )) Lemma 25: α(S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 )) iff S E τ e O,1 (α(M 1 )) ≃ e O S E τ e O,2 (α(M 2 ))
Finally, using these lemmas (which will be proved in a more general setting in Chapter 7), we can prove Theorem 26 and the two following theorems on contexts and values, by mutual induction.

Theorem 27: Let v 1 , v 2 two ground-closed terms of type τ and e O a span on their free functional variables. Then

S V τ e O,1 (v 1 ) ≃ e O S V τ e O,2 (v 2 ) iff S E τ e O,1 (v 1 ) ≃ e O S E τ e O,2 (v 2 ).
Theorem 28: Let K 1 , K 2 two ground-closed contexts of type τ and e O a span on their free functional variables. Then

S K σ, τ e O,1 (K 1 ) ≃ e O S E τ e O,2 (K 2 ) iff S E τ e O,1 (K 1 ) ≃ e O S K σ, τ e O,2 (K 2 ). Proof (Theorem 26) Let M 1 , M 2 such that S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ). Let M ′′ i , C i such that (M i , ∅) → * s (M ′′ i , C i ).
and α 1 , α 2 two substitutions such that α i (C i ) is valid. From Lemma 22, we get the existence of

M ′ i such that M i → * M ′ i and M ′ i = α i (M ′′ i ). So from S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ) we get that -either both M ′ i = K i [f i v i ] with (f 1 , f 2 ) ∈ e O , S V σ e O,1 (v 1 ) ≃ e O S E σ e O,2 (v 2 ) and S K σ ′ , τ e O,1 (K 1 ) ≃ e O S K σ ′ , τ e O,2 (K 2 ). Then, M ′′ i = K ′ i [f i v ′ i ] with K i = α i (K ′ i ) and v i = α i (v ′ i ).
Thus, using lemmas 24 and 23 and the induction hypothesis, we get that α(S

V σ e O,1 (v 1 ) ≃ e O S E σ e O,2 (v 2 )) and α(S K σ ′ , τ e O,1 (K 1 ) ≃ e O S K σ ′ , τ e O,2 (K 2 )). -Or both M ′ i = v i with S V σ e O,1 (v 1 ) ≃ e O S E σ e O,2 (v 2 ). Then, M ′′ i = v ′ i with v i = α i (v ′ i ).
Thus, using lemma 23 and the induction hypothesis, we get that

α(S V σ e O,1 (v 1 ) ≃ e O S E σ e O,2 (v 2 )). Reciprocally, suppose that S E τ e O,1 (M 1 ) ≃ e O S E τ e O,2 (M 2 ) and that M i → * M ′ i .
Then using Lemma 21, we get the existence of two sets of Presburger constraint C i and two substitution

α i : FV(C i ) → Int such that -α i (C i ) is true, -(M i , ∅) → * s (M ′′ i , C), -α(M ′′ i ) = M ′ i .
Then from the fact that both α i (C i ) are true, we get that -either both

M ′′ i = K i [f i v i ], there exists σ, σ ′ s.t. (f 1 , f 2 ) ∈ e O,σ→σ ′ and α(S V σ e O,1 (v 1 ) ≃ e O S E σ e O,2 (v 2 )) and α(S K σ ′ , τ e O,1 (K 1 ) ≃ e O S K σ ′ , τ e O,2 (K 2 ))
. Then using lemmas 24 and 23 and the induction hypothesis, we get that

S V σ e O,1 (α 1 (v 1 )) ≃ e O S E σ e O,2 (α 2 (v 2 )) and S K σ ′ , τ e O,1 (α 1 (K 1 )) ≃ e O S K σ ′ , τ e O,2 (α 2 (K 2 )). We con- clude using the fact that M ′ i = α i (K i )[f i α i (v i )]. -Or both M ′′ i = v i and α(S V σ e O,1 (v 1 ) ≃ e O S E σ e O,2 (v 2 )). Then using lemma 23, we get that S V σ e O,1 (α 1 (v 1 )) ≃ e O S E σ e O,2 (α 2 (v 2
)) and we conclude using the fact that

M ′ i = α i (v i ).

Discussion and Future Works

In this chapter, we have introduced a fully-abstract trace semantics for both RefML and GroundML. We have shown a precise correspondence with the game model of Murawski and Tzevelekos [START_REF] Murawski | Game semantics for good general references[END_REF]. As a preview of the next two chapters, we have study the pure fragment of RefML to get a simple decidability result on the contextual equivalence. In the following, we are going to study the structure of traces to perform more precise surgery.

Via the relation between trace and games semantics, we have seen that we can equip the trace semantics with a categorical structure, namely a closed-Freyd category. It would be interesting to extend this trace semantics to a polymorphic language, where the mechanism to represent the arenas an action belongs to in terms of tags would become crucial, as in [START_REF] Laird | Game semantics for call-by-value polymorphism[END_REF].

In a recent work [START_REF] Levy | Transition systems over games[END_REF], Levy and Staton have proposed a general framework to prove such a correspondence between a game and a trace model. It would be intersting to see if we could adapt our correspondence proof in their setting.

Integer References

It would be interesting to extend the characterization of fragments of RefML in trace semantics by dealing with the restriction to integer references, namely RedML, as in [START_REF] Murawski | Full abstraction for reduced ml[END_REF]. We believe that our interactive reduction defined for GroundML can be restricted to give a fully abstract model of RedML, using similar restrictions on the use of name pointers in locations.

Control Operators

As we have said, the well-bracketing condition is hard-wired in the definition of justified traces. To remove it, we would need to specify which question an answer is answering. One possibility to do that would be to use the recent work of Gabbay and Ghica [START_REF] Gabbay | Game semantics in the nominal model[END_REF], which uses nominal sets to represent strategies. In fact, our work is halfway to them: the way they name questions, and the freshness condition they impose, seems similar to our use of name-pointers and the nominal reasoning we perform on them. It should thus be possible to use their work to also give fresh name to answers actions.

This would allow the study of languages where we need semantically to remove the wellbracketing condition, namely languages with control operators like call/cc or exceptions.

Algorithmic Game Semantics

Algorithmic Game Semantics [GM00, HMO11, MT12] is a way to give characterization of contextual equivalence in term of equality of languages recognizable by various forms of automaton. However, those techniques rely on restrictions on types to be able to encode the pointer structure of plays inside the considered languages, so that they are still recognizable. Thus, our result, even if it concerns only the pure fragment, seems out of reach of algorithmic game semantics, since we do not have any restriction on the type of terms. Moreover, we have worked inside RefML, where the absence of visibility condition on strategies makes the encoding of the pointer structure harder. the evolution of the information disclosed by the term to the context. Coinduction is then used to reason on the resulting equivalence. This use of coinduction is particularly useful to reason on recursion in terms, avoiding any use of step-indexed methods.

Kripke logical relations, which has been presented in the introduction of this thesis, are an other approach to prove contextual equivalence of terms. In a call-by-value setting, they are defined as relations V τ w and E τ w on values and terms, defined by a mutual induction on the type τ . They use a notion of world w to constrain the heaps used to reduce terms M 1 , M 2 to values in the definition of E τ w. In a recent work [HDNV12], Hur et al. have proposed a way to marry Kripke logical relations and environmental bisimulations into parametric bisimulations.

However, all these works are either not complete w.r.t. contextual equivalence, or rely on a kind of closure which introduces an infinite quantification over contexts. This is especially the case of logical relations, which usually use a biorthogonal definition to achieve completeness:

E τ def = {(M 1 , M 2 ) | ∀(K 1 , K 2 ) ∈ K τ .(K 1 [M 1 ], K 2 [M 2 ]) ∈ O and K τ def = {(v 1 , v 2 ) | ∀(v 1 , v 2 ) ∈ V τ .(K 1 [v 1 ], K 2 [v 2 ]) ∈ O}
where O is the set of pairs of equi-diverging terms. One could imagine relate directly a direct and a birthogonal definition of a logical relation. However, this seems out of reach for languages like RefML. More precisely, consider two terms (M 1 , M 2 ) ∈ E τ w where E τ w is defined by biorthogonality, and let try to unwind this definition to a direct-style: let h 1 , h 2 two heaps satisfying the constraints induced by w, and suppose that both

(M 1 , h 1 ) → (v 1 , h ′ 1 ) and (M 2 , h 2 ) → (v 2 , h ′ 2 ).
Then it is really hard to build a world w ′ future of w s.t. (v 1 , v 2 ) ∈ E τ w and h ′ 1 , h ′ 2 satisfying constraints induced by w ′ . One need to rely on the discriminating power of contexts in K τ w, but trying to do that, one comes to study the precise interaction between terms and contexts, which lead to study game and trace semantics.

Here, we propose the first proof of completeness of Kripke logical relations, defined without any kind of closure, for divergent-free terms of GroundML with contexts in RefML. To do so, we heavily rely on the trace semantics introduce in the previous chapter. In fact, we refine this model into Kripke trace semantics.

To achieve this result, we have tweaked the usual definition of Kripke logical relations in multiple ways, to bring it forward to trace semantics. Firstly, our logical relations are defined on terms with free functional variables1 (i.e. opponent name pointers), which are related with a relational environment e which corresponds to a span, as introduced in Section 3.3. So our logical relations E τ e are indexed by this span, such that -two λ-abstractions λx 1 .M 1 , λx 2 .M 2 are in V τ → σ e , where τ is not a ground type, when (M 1 , M 2 ) ∈ E σ e•(x 1 ,x 2 ,τ ) , -two (functional) variables (x 1 , x 2 ) are in V τ → σ e when they are in e. This is particularly useful to reason abstractly on callbacks.

Then, we deal globally on the constraints on disclosed locations. Indeed, let consider the two following terms:

M 1 = let x = ref0 in λf.fx; x := 1 M 2 = let x = ref0 in λf.fx; x := 2
They are not equivalent because the location linked to x, which is disclosed via the callback fx, does not store the same value at the end of the execution of M 1 and M 2 . Usually, such invariants on disclosed locations are imposed via the world w (just like invariants on private locations) and the definition of V ref τ w. Here, we choose a different approach, and impose globally these equivalences of stored values.

To do so, we need to keep track of disclosed locations. This is done using a notion of span D between disclosed locations, as in the work of Stark [START_REF] Stark | Names, equations, relations: Practical ways to reason about new[END_REF]. So worlds contain such a span D, which evolves during the execution of a term, being extended with new disclosed locations. For example, let consider the following two terms:

M 1 = let x = ref0 in let y = ref0 in λf.fx; fy M 2 = let x = ref0 in λf.fx; fx
They are not equivalent because M 1 discloses two different locations via the two callbacks of f, while M 2 disclosed the same. Trying to prove this equivalence using our logical relations, this would amount to build a span which contain both (l x , l x ) and (l x , l y ) (where l x , l y represent locations linked to x, y) which is not possible by definition of spans as partial bijections. This idea of using spans to relate disclosed locations is already present in the work of Dreyer et al. [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF] but somehow hidden. Indeed, in their approach, every state of their STSs encodes a partial bijection on locations, which can be used for the same purpose. However, it is used locally in the definition of V ref τ w, rather than imposed globally in the definition of the constraints deduced from w on heaps, written (h 1 , h 2 ) : w.

To achieve model-checking results for our logical relations, which are explained in Chapter 7, we have to constrain the notion of future worlds induces by the transition system. In previous works [PS98, ADR09, DNB10], a future world w ′ of w can be extended with new invariants (or new STSs of invariants) on the part of heaps which is disjoint from the heaps described by w. This follows the idea that worlds were partitioned into islands, each one corresponding to a part of the heap disjoint from the others. Here, we forbid this usage. So the transition system stays fixed from the beginning. This means that it has to foreseen the creation of future locations made by the term: we call omniscient such transitions systems which are entirely defined from the beginning. So we make a clear distinction between worlds w, which are simple invariants, and the transition system A, which constraints the evolution of those worlds. Then, the definition of our logical relations E A τ w depends on both a transition system A, which is fixed in the whole inductive definition of the logical relations, and a world w which evolve inside the definition.

We choose to work with Labeled Transition Systems (LTSs), rather than State Transition Systems, to represent the evolution of worlds. This allows transition systems to be kept finite in many examples, as justified in Chapter 7. They are mainly used to represent a constraint on the heaps as a pair of pre-and post-conditions between the heaps taken as input and the heaps we get as output.

As we will see in the definition of the equivalence Σ; Γ ⊢ M 1 ≃ clog M 2 : τ defined using our logical relations, two terms are equivalent if there exists an LTS A constraining worlds such that (M 1 , M 2 ) is in E A τ w for w "initial" (i.e. for which all the locations appearing in M 1 , M 2 are disclosed). In order to prove completeness, we must be able to build such a LTS when two terms M 1 , M 2 have equal denotations from trace semantics.

So we define a finer notion, Kripke trace semantics, which uses worlds to constraint heaps which are used to generate traces. This is particularly useful to control the disclosure of locations, since the definition of [Σ; Γ ⊢ M : τ ] suppose that all locations are disclosed, which is not preserved by reduction. However, this use of worlds to refine trace semantics is independent of any LTS. This means that we have to characterize worlds w and LTS A which have the adequate properties to enforce, from the fact that M 1 , M 2 have their trace denotations equal in w, that (M 1 , M 2 ) ∈ E A τ w. Such worlds are called adequate, which definition can be seen in a first approximation as the "dual" of logical relations. More precisely, we define the set of adequate worlds for two terms M 1 , M 2 via a predicate on worlds, written E A τ (M 1 , M 2 ). Basically, this predicate imposes that there exists exactly all the necessarily future worlds for w (w.r.t. A) to describe the possible evolutions of the heaps we get from the interactive reduction of M 1 , M 2 . Then, from two terms M 1 , M 2 , we build a special LTS A, called the exhaustive LTS, for which the initial world is indeed in E A τ (M 1 , M 2 ). It is build by following all the traces generated by the interactive reduction, adding a new state for each action of such traces.

Finally, we call our logical relations concrete, to make a clear distinction with the temporal logical relations defined in the next chapter.

Plan of the Chapter In Section 6.1, we introduce the notion of LTS and worlds. Then, concrete logical relations for the fragment of divergent-free terms of GroundML in RefML are defined in Section 6.2. In Section 6.3, we introduce Kripke trace semantics, a refinement of the previous chapter where worlds are used to constrain heaps in the definition of interactive reduction. This is used in Section 6.4 to prove the soundness of concrete logical relations w.r.t. trace semantics.

To tackle the problem of completeness, we introduce the notion of adequate worlds in Section 6.5, which is defined dually to logical relations to constrain the shape of LTSs to follow the control flow of terms. This notion is central in the proof of completeness of Section 6.6, where we use an exhaustive LTS, defined using interactive reduction, which is indeed adequate.

In Section 6.7.1, we briefly sketch how to define concrete logical relations for full RefML, using a coinductive definition which can be formalized via guarded recursive

Trans S def = S 2 → P(Heap 4 × Span 2 ) (δ) LTS S def = {(δ priv , δ pub ) | δ priv , δ pub ∈ Trans S , δ pub ⊆ δ priv } (A) World S def = S × Heap 2 × Span (w) Figure 6
.1: Definition of Worlds types. Interestingly, working with a fixed notion of LTS, the usual circularity between the definition of worlds and logical relations disappears. We also sketch in Section 6.7.2 the definition of concrete logical relations for GroundML, where the notion of backtracking between states introduced in [DNB10], used to relax the notion of future world, appears.

LTSs and Worlds

As explained in the introduction, we use a fixed notion of transition system, which cannot be extended, to control the evolution of worlds. By evolution, we mean the notion of future world, written w ′ ⊒ w, which represents the evolution of heap-invariants. So in our settings worlds are just simple invariants on heaps. We use labels over transitions rather than states. Such labels control the evolution between two invariants.

First Definitions

The definitions of LTSs and worlds is given in Figure 6.1. We write P(X) for the powerset of X. Labeled-Transition Systems are defined abstractly over a subset S of a set of states State. This set of states can simply be taken as natural numbers. They are formed by two functions respectively for private and public transitions. Private transitions represent transitions that only terms can take, while public ones can be taken by both terms and contexts. This explains the condition δ pub ⊆ δ priv .

A (public or private) transition associates to a pair of states a predicate on the two heaps and a span taken as input, and the two heaps and the span produced as output, so that, as we said, it can define pre-and post-conditions on them. We do not specify what is the representation of states (i.e. elements of State) are, because it does not really matter. In the model checking implementation in the next chapter (Section 7.5), we take it to be the set of integers.

Worlds are simply triples formed by two heaps and a span on locations. The two heaps are the invariants on the private part of the heap, while the span defines the partial bijection between the disclosed part of the heap.

Constraining heaps with worlds

Worlds specify heaps really precisely, since there is no freedom on the private part of the heap, while on the public part, the span is used to induce a nominal equivalence, as shown in the following definition.

Definition 38. A triple (h 1 , h 2 , D) satisfies the constraints of a world w = (h w 1 , h w 2 , D w ), written (h 1 , h 2 , D) : w, when D = D w , h i = h priv i • h discl i with dom(h discl i ) = D i and h priv i ⊆ h w i , and h discl 1 ∼ D h discl 2 .
As we have seen in the previous chapter, one can characterize the nominal the equivalence h 1 ∼ D h 2 induced by a span on two heaps as:

h 1 ∼ D h 2 def = ∀(l 1 , l 2 ) ∈ D Int . h 1 (l 1 ) = h 2 (l 2 ) ∧ ∀(l 1 , l 2 ) ∈ D ref ι . (h 1 (l 1 ), h 2 (l 2 )) ∈ D ι
From a triple (h 1 , h 2 , D) satisfying the constraints of a world w, one can build new heaps h ′ 1 , h ′ 2 which also satisfies the constraints of w by changing the values stored in the disclosed part in a related way:

Lemma 26: Let (h 1 , h 2 , D) : w, then for all pair of closed heaps h pub 1 , h pub 2 such that dom(h pub i ) = D i and h pub 1 ∼ D h pub 2 , we have (h 1|D 1 • h pub 1 , h 2|D 2 • h pub 2 , D 2 ) : w.

Evolution of Worlds

Transitions of an LTS A are used to define private and public notions of future worlds.

Definition 39. Let A a LTS and

w 1 = (s ′ , h ′ 1 , h ′ 2 , S ′ ), w 2 = (s, h 1 , h 2 , S) two worlds. We say that w 2 is a future (w.r.t. A) of w 1 , written w 2 (A.⊒) w 1 if either w 1 = w 2 or (h 1 , h 2 , h ′ 1 , h ′ 2 , S, S ′ ) ∈ δ priv (s, s ′ ).
Public futures (noted with ⊒ pub ) are defined similarly using δ pub , and transitive closure of these two relations are noted ⊒ * and ⊒ * pub .

We often omit the prefix A when it is clear from context. It is important to remark that the current heaps h 1 , h 2 of a world specified only the private part of the heap. This is because it is not possible to expect any property on public parts of the heaps, except that they are equivalent (a property that is imposed by the definition of future worlds). Moreover, it is possible for worlds to "garbage collect" part of the private heaps, i.e. h ′ i do not necessarily extend h i . These properties are useful to build finite LTSs for terms which create locations under a λ-abstraction.

Because contexts may create fresh disclosed locations during the execution, we also introduce another notion of (public) future ⊒ F pub which forces the existence of a public state creating, for each pair of disclosed locations in the current world storing values of type ref ι, of fresh disclosed locations of Loc ι ′ for each strict subtype of ref ι. One need this special notion of future because the LTS A is fixed, so that it is normally not possible to extend the world with these new locations coming from the context, that A has not foreseen.

This is used to model the indirect disclosure (i.e. via the heap) of locations by the context. For example, if the span w.S of the current world contains a pair of locations (l 1 , l 2 ) ∈ Loc 2 ref ref ι , then the context can store in h i (l i ) some fresh locations l ′ i ∈ Loc ref ι that themselves store in h i (l ′ i ) some fresh locations l ′′ i ∈ Loc ι . These locations will be automatically disclosed when the control flow returns to the term.

We index this notion of public future with a type τ , written ⊒ F τ pub , to force as well the existence of a public state creating fresh disclosed locations of type τ (together with locations on which it may point to in the case of references of references), when τ is equal to some ref ι. This is used to represent the direct disclosure of locations by contexts (i.e. via a callback or a reduction to a value).

To formalize it, we define the set NewLoc(ι) of set of pairs of locations for all subtypes of ι : NewLoc(ι) Definition 40. (s ′ , h ′ 1 , h ′ 2 , S ′ ) ⊒ F pub (s, h 1 , h 2 , S) when h ′ i = h i and there exists a span S ′′ such that S ′ = S ⊎ S ′′ , and S ′′ = (l 1 ,l 2 )∈Sι D ι , with D ι ∈ NewLoc(ι). We refine this definition as ⊒ F ι pub when S ′ = S ⊎ S ′′ ⊎ D ′ ι with D ′ ι ∈ NewLoc(ι).

def = {{(l ι 1 1 , l ι 1 2 ), . . . , (l ιn 1 , l ιn 2 )} | l ι j i ∈ Loc ι j ,
Notice that ⊒ F τ pub is equivalent to ⊒ F pub when τ is not equal to some ref ι.

Concrete Logical Relations on Traces

Trace semantics, just like usual game semantics, generates infinite objects which are hard to reason on. This is due to the fact that, in presence of references, we cannot check the equivalence of two terms by simply executing them only one time, as we have done in the section 5.5 of the previous chapter, since their executions depend on a heap that evolves. Kripke logical relations allow such a "one shot" reasoning by checking the equivalence of terms on every possible pair of heaps, using worlds to get this information.

Operational semantics defined in Section 3.2.1 does not take into account disclosure of locations, so we refine it into elementary interactive reduction → on simple configurations M, h, D given by: if

(M, h) → (M ′ , h ′ ) with M ′ = v or M ′ = K[f v] then M, h, D → M ′ , h ′ , discl(v, h ′ , D) .
The definition of concrete logical relations is given in Figure 6.2. Its main features is to guarantee that: -resulting values (i.e. player answers) are related, -callbacks (i.e. player questions) of the two terms are synchronized-they interrogate equivalent pointers, -values given to those callbacks are related, -there exists a future world such that the heaps given in the entry of those callbacks satisfies its invariant. Notice the use of injection ρ i in the definition of E A τ e (w, w 0 ) to change name of locations created during the reduction, so that they correspond to the ones in w. Indeed, worlds we have defined in Section 6.1 have fixed names for every locations upfront, fixed by the LTS A. Unfortunately, those names may not correspond to the one created during the operational reduction. To circumvent this problem, we use the injections ρ i to perform the reallocation.

In the definition, a relational environment e is used to keep track of the arguments given by the contexts to the terms, via a λ-abstraction or via the returned value of a callback. Indeed, compared to usual logical relations, when τ is of functional type, the definition of V A τ → σ e w do not quantify over logically related values v 1 , v 2 of type τ , but rather use fresh variables y 1 , y 2 (i.e. name pointers), remembering in e that they are related. This relational environment is in fact a span on variable of functional types, or equivalently on opponent name pointers. This way to reason relationally on open terms is in fact really close to normal form (or open) bisimulation [START_REF] Lassen | Typed normal form bisimulation[END_REF][START_REF] Lassen | Typed normal form bisimulation for parametric polymorphism[END_REF], where the same variable is given as arguments to the values we want to relate.

We treat λ-abstractions and variables of functional types in an uniform way. This is necessary to deal with η-equivalence. Indeed, one can prove that

(f, λx.f x) ∈ V A σ → τ (f, f, σ → τ ) e w:
-if σ is atomic, then we simply have to prove that ∀w 1 ⊒ * w.∃w 2 ⊒ F σ pub w 1 , for all

(v 1 , v 2 ) ∈ V A σ e w 2 (f v 1 , (λx.f x)v 2 ) ∈ E A τ e w 2 , which is straightforward from the fact that ((λx.f x)v 2 , h) → (f v 2 , h) with any w 2 ⊒ F σ pub w 1 , -if σ is functional, we have to prove that ∀w 1 ⊒ * w.∃w 2 ⊒ F σ pub w 1 , (f y 1 , (λx.f x)y 2 ) ∈ E A τ e•(
y 1 ,y 2 ,σ) w 2 , which amounts to prove that (y 1 , y 2 ) ∈ V A σ e•(y 1 ,y 2 ,σ) w 2 , which is proved in the following lemma.

Lemma 27: Let e a span on name pointers, and (x 1 , x 2 , σ → τ ) ∈ e. Then (x 1 , x 2 ) ∈ V A σ → τ e w for any world w.

V A Unit e w def = {((), ())} V A Bool e w def = {(true, true), (false, false)} V A Int e w def = {(n, n) | n ∈ Int} V A ref τ e w def = {(l 1 , l 2 ) | (l 1 , l 2 ) ∈ w.S τ } V A ι → σ e w def = {(u 1 , u 2 ) | ∀w ′ ⊒ * w.∃w ′′ ⊒ F ι pub w ′ .∀(v 1 , v 2 ) ∈ V A ι e w ′′ . (u 1 v 1 , u 2 v 2 ) ∈ E A σ e (w ′′ , w ′′ )} V A τ → σ e w def = {((u 1 , u 2 ) | ∀w ′ ⊒ * w.∃w ′′ ⊒ F τ pub w ′ . (u 1 y 1 , u 2 y 2 ) ∈ E A σ e•(y 1 ,y 2 ,τ ) (w ′′ , w ′′ )}
(y 1 , y 2 fresh, τ not ground)

K A ι, σ e (w, w 0 ) def = {(K 1 , K 2 ) | ∃w ′ ⊒ F ι pub w.∀(v 1 , v 2 ) ∈ V A ι e w ′ . (K 1 [v 1 ], K 2 [v 2 ]) ∈ E A σ e (w ′ , w 0 )} K A τ, σ e (w, w 0 ) def = {(K 1 , K 2 ) | ∃w ′ ⊒ F τ pub w.(K 1 [x 1 ], K 2 [x 2 ]) ∈ E A σ e•(x 1 ,x 2 ,τ ) (w ′ , w 0 )} (x 2 , x 2 fresh, τ not ground) E A τ e (w, w 0 ) def = (M 1 , M 2 ) | ∀(h 1 , h 2 , D) ∈ (h 1 , h 2 , D) : w.h i ∈ Cl(ν L (M i ) ∪ D i ) ⇒ ∃w ′ ⊒ w.∃(h ′ 1 , h ′ 2 , D ′ ) : w ′ .∃ρ i : (ν L (h ′ i )\ν L (h i )) ֒→ (Loc\ν L (h i )). M i , h i , D i → * ρ i • E i , h ′ i , D ′ i ∧ E i = v i ∧ (v 1 , v 2 ) ∈ V A τ e w ′ ∧ w ′ ⊒ * pub w 0 ∨ E i = K i [f i v i ] ∧ (f 1 , f 2 ) ∈ e σ→ σ ′ ∧ (v 1 , v 2 ) ∈ V A σ e w ′ ∧∀w ′′ ⊒ * pub w ′ .(K 1 , K 2 ) ∈ K A σ ′ , τ e (w ′′ , w 0 ) G A (x 1 , x 2 , τ ) • e P e w def = {((x 1 → v 1 ) • γ 1 , (x 2 → v 2 ) • γ 2 ) | (v 1 , v 2 ) ∈ V A τ e w ∧(γ 1 , γ 2 ) ∈ G A e P e w} Σ; Γ g , Γ f ⊢ M 1 ≃ clog M 2 : τ def = ∃S ⊆ Int, ∃A ∈ LTS S , ∃s ∈ S, ∀h ∈ Cl(Σ, ν L (codom(γ g ))), ∀γ g : Γ g → Val.(γ g (M 1 ), γ g (M 2 )) ∈ E A τ Γ f (w, w)
where w = (s, h, h, ν L (h)) and Γ f (resp. Γ g ) contains only variables of functional (resp. ground) types. Proof By induction on σ. Let w 1 ⊒ * pub w, we can consider any w 2 ⊒ F σ pub w (there is always such w 2 ). Then:

-if σ is of atomic type, we must prove that for all (v 1 , v 2 ) ∈ V A σ e w 2 , (x 1 v 1 , x 2 v 2 ) ∈ E A τ e w 2 , which is direct. -Otherwise, we must prove that (x 1 y 1 , x 2 y 2 ) ∈ E A τ e•(y 1 ,y 2 ,σ) w 2 . To do so, we just have to prove that (y 1 , y 2 ) ∈ V A σ e•(y 1 ,y 2 ,σ) w 2 , which comes from the induction hypothesis.

Notice that even if we use a logical relation K A σ, τ on context, our definition do not use any biorthogonal technique.

Then, concrete logical relations allow us to consider only ground callbacks of the interactive reduction, that is player questions which appears at depth zero. In fact, they are defined by an induction on types and on the number of ground callbacks of the terms considered. This is well-defined because only divergent-free terms of GroundML are considered here.

The relation G A e P e w on substitutions will be particularly useful to relate player environments in trace semantics.

Finally, we define the "full" logical relation

Σ; Γ f , Γ g ⊢ M 1 ≃ clog M 2 : τ for terms
with open ground variables. Notice that we could have used (γ g,1 , γ g,2 ) ∈ G A Γ g ε w in this definition rather than a single substitution γ g : Γ g → Val since for such world w = (s, h, h, ν L (h)), we would have necessarily γ g,1 = γ g,2 .

Kripke Trace Semantics

In order to relate our concrete logical relations to trace semantics, we introduce Kripke trace semantics, that is a refinement of trace semantics where worlds are used to constrain the heaps used, so that there is a distinction between private and disclosed locations. As we said in the previous chapter, trace semantics does not allow for compositional reasoning because the starting heap in the definition is unconstrained-all the locations are disclosed. This suggests that trace semantics could also benefit from a refinement using worlds.

Worlds are used to parametrize the notion of equality induced by trace semantics on two terms, by constraining the heaps appearing in traces. Moreover, we want to keep track of functions values the terms have disclosed to contexts. This is particularly important when these functional values can modify the heap, like setters.

So we refine the equivalence ≃ D e P ,e O on set of traces using worlds. This refined equivalence keeps track in γ 1 , γ 2 of the functions the terms have disclosed to contexts. Definition 41. Given two terms M 1 and M 2 , a world w, two spans e P , e O on player and opponent name pointers and two substitutions γ i : e P,i → Val, we define

[M 1 ] ≃ γ,w e P ,e O [M 2 ], if for all (h 1 , h 2 , D) : w s.t. h i ∈ Cl(ν L (M i , codom(γ i )) ∪ D i ), [ M 1 , γ 1 , e O,1 , h 1 , D 1 ] ≃ D e P ,e O [ M 2 , γ 2 , e O,2 , h 2 , D 2 ] .
Notice that the definition of [M 1 ] ≃ γ,w e P ,e O [M 2 ] does not depend on any LTS A, a fortiori not on the current state of w. Indeed, it just uses the current heaps and spans of w, but not its transition structure induces by A. Then, when working with terms where all locations have been disclosed, one can relate this definition to the usual equivalence on trace.

Theorem 29: Let M 1 , M 2 two terms such that Σ; Γ g , Γ f ⊢ M 1 , M 2 : τ . Then [Σ; Γ g , Γ f ⊢ M 1 : τ ] = [Σ; Γ g , Γ f ⊢ M 2 : τ ] iff for all γ g : Γ g → Val, for all h ∈ Cl(Σ ∪ ν L (codom(γ g ))), [γ g (M 1 )] ≃ ε,w ε, Γ [γ g (M 2 )] where w = ( , h, h, ν L (h)).
Proof Straightforward from Theorem 11.

We now show basic facts about the equivalence between Kripke trace semantics and concrete logical relations. Firstly, we can prove that two ground values logically related in w have their trace semantics equivalent in w.

Theorem 30: Let v 1 , v 2 two closed values of ground type ι, e O a span on opponent name pointers and w a world.

If (v 1 , v 2 ) ∈ V A ι e O w then [v 1 ] ≃ ε,w ε,ε [v 2 ].
Proof Unwinding the definition of

[v 1 ] ≃ ε,w ε,e O [v 2 ],
we have to prove that for all (h 1 , h 2 , D) :

w s.t. h i ∈ Cl(ν L (v i )), ( v1 , h 1|D ′ 1 ) ∼ D ′ •,e O ( v1 , h 2|D ′ 2 ) where D ′ ⊒ D with D ′ i = discl(v i , h i , D i ).
If ι = Int, then D ′ = D and to prove the equivalence of actions amounts to prove

v 1 = v 2 which is direct from (v 1 , v 2 ) ∈ V A Int e O w. If ι = ref ι ′ , then from (v 1 , v 2 ) ∈ V A ref ι ′ e O w, (v 1 , v 2 ) ∈ D w
, the span on locations of w. And from (h 1 , h 2 , D) : w D ⊆ D w , and

h i ∈ Cl(ν L (v i )) gives us that indeed v i ∈ D. So D ′ i = D i , i.e. v 1 ∼ D ′ v 2 and the definition of (h 1 , h 2 , D) : w gives us that h 1|D 1 ∼ D h 2|D 2 .
Notice that the reciprocal property,

if [v 1 ] ≃ ε,w ε,ε [v 2 ] then (v 1 , v 2 ) ∈ V A ι e O w
is in general false for ι = ref ι ′ . Indeed, there is no reason for (v 1 , v 2 ) to be in D w in such a case. This is one of the reason to justify the introduction of adequate worlds in Section 6.5. Then, under the hypothesis of w is adequate, one can prove the wanted property (cf. Theorem 38).

We now want to relate the equivalence of terms M 1 , M 2 to the equivalence of their (elementary interactive) reductions E 1 , E 2 , which are either values v 1 , v 2 or callbacks

K 1 [f 1 v 1 ], K 2 [f 2 v 2 ].
To do so, we first relate the semantics of M i to E i .

Lemma 28: Let M a term, such that M, h, D → * E, h ′ , D ′ , then [ M, γ, I, h, D ] = [ E, γ, I, h ′ , D ′ ] Proof E is either equal to v or K[f v].
The proof is done by case analysis on τ , the type of v.

-If τ is of ground type, then

[ M, γ, I, h, D ] is equal to (a, h ′ |D ′ ) • [ ♦, γ, I, h ′ , D ′ ], where a is either v or f v . But [ E, γ, I, h ′ , D ′ ] is also equal to (a, h ′ |D ′ ) • [ ♦, γ, I, h ′ , D ′ ] since the disclosure of locations has already happened. -Otherwise, we have [ M, γ, I, h, D ] equal to a {(a, h ′ |D ′ ) • [ ♦, γ • (x ֒→ v), I, h ′ , D ′ ]}
where a ranges either over x with x ∈ P\dom(γ

) if E = v, or over f x with x ∈ P\dom(γ) if E = K[f v]. And again [ v, γ, I, h ′ , D ′ ] is also equal to a {(a, h ′ |D ′ ) • [ ♦, γ(x ֒→ v), I, h ′ , D ′ ]}.
Then, we state two lemmas to reason on equivalence of trace semantics. The first one is about renaming of locations.

Lemma 29 (Renaming of locations): Let e P , e O , D three spans respectively on player and opponent name pointers and on locations, and γ 1 , γ 2 two value substitutions defined respectively on e P,1 and e P,2 . Suppose

E 1 • -→ K 1 , γ 1 , e O,1 , h 1 , D 1 ≃ D e P ,e O E 2 • -→ K 2 , γ 2 , e O,2 , h 2 , D 2 and let two injections ρ i : dom(h i ) ֒→ Loc, then, writing D ′ for (ρ 1 × ρ 2 ) • D, we have ρ 1 • E 1 • -→ K 1 , γ 1 , I 1 , h ′ 1 , D 1 ≃ D ′ e P ,e O ρ 2 • E 2 • -→ K 2 , γ 2 , I 2 , h ′ 2 , D 2
Proof Straightforward using Lemma 31.

The second one is about garbage-collecting unused location. It is particularly useful because the definition of [M 1 ] ≃ γ,w e P ,e O [M 2 ] works only with heaps in Cl(ν L (M i , γ i )) while the usual equivalence on trace semantics is defined on any heaps.

Lemma 30 (Garbage Collect): Let e P , e O , D three spans respectively on player and opponent name pointers and on locations, and γ 1 , γ 2 two value substitutions defined respectively on e P,1 and e P,2 . Suppose h 1 , h 2 are two heaps such that we can decompose

h i into h ′ i • h g i with h ′ i ∈ Cl(ν L (E i , -→ K 1 , codom(γ i )) ∪ D i ), Then E 1 • -→ K 1 , γ 1 , e O,1 , h 1 , D 1 ≃ D e P ,e O E 2 • -→ K 2 , γ 2 , e O,2 , h 2 , D 2
if and only if

E 1 • -→ K 1 • -→ K 1 , γ 1 , I 1 , h ′ 1 , D 1 ≃ D e P ,e O E 2 • -→ K 2 , γ 2 , I 2 , h ′ 2 , D 2 .
Proof Straightforward from the fact that the locations from h g i are never disclosed, so cannot appear in traces.

Now, we prove the wanted theorem

Theorem 31: Let (M 1 , M 2 ) a pair of terms, e O a span on their name pointers and w a world. Let also consider e P a span on player name pointers and γ i : e P,i → Val two substitutions on its projections. Suppose that for all (h 1 , h 2 , D) : w s.t.

h i ∈ Cl(ν L (M i , γ i )∪D i ),
there exists E 1 , E 2 , a world w ′ ⊒ w, two heaps and a span (h ′ 1 , h ′ 2 , D ′ ) : w ′ and two injec- Proof Suppose both E i = v i , from lemma 28, we get that

tions ρ i : dom(h ′ i )\dom(h i ) ֒→ Loc such that -M i , h i , D i → * ρ i • E i , h ′ i , D ′ i , -either both E i = v i and [v 1 ] ≃ γ,w ′ e P ,e O [v 2 ], -or both E i = K i [f i v i ] and (f 1 , f 2 ) ∈ e O , [v 1 ] ≃ γ ′ ,w ′ e ′ P ,e O [v 2 ] and [K 1 ] ≃ γ ′ ,w ′ e ′ P ,
[ M i , γ i , e O,i , h i , D i ] = [ρ i • E i , γ i , e O,i , h ′ i , D ′ i ] . Let us decompose h ′ i into h ′′ i • h g i with h ′′ i ∈ Cl(ν L (E i , codom(γ i )) ∪ D i ) Then, from [v 1 ] ≃ γ,w ′ e P ,e O [v 2 ] we get that [ v 1 , γ 1 , e O,1 , h ′ 1 , D ′ 1 ] ≃ D ′ e P ,e O [ v 2 , γ 2 , e O,2 , h ′ 2 , D ′ 2 ]
and we conclude using lemmas on garbage collections (lemma 30) and on renaming of locations (lemma 29).

Otherwise, both E i = K i [f i v i ] and we reason by case analysis of σ.

-If σ is of ground type, then

[ K i [f i v i ], γ i , e O,i , h ′ i , D ′ i ] is equal to (ρ i • ( fi v i , h ′ i|D ′ i )) • [ρ i • K i [•], γ i , e O,i , h ′ i , D ′ i ] and from [v 1 ] ≃ γ,w e P ,e O [v 2 ] and (f 1 , f 2 ) ∈ e O we get that (ρ 1 • ( f1 v 1 , h ′ 1|D ′ 1 )) ∼ D ′′ e P ,e O (ρ 1 • ( f2 v 1 , h ′ 2|D ′ 2
)) where D ′′ = (ρ 1 × ρ 2 )(D ′ ). Then we conclude using

[K 1 ] ≃ γ,
x i ( fi x i , ρ i • h ′ i|D ′ i • [ρ i • K i [•], γ ′ i , e O,i , h ′ i , D ′ i ]
with x i ranges over P\dom(γ i ). Then writing D ′′ for (ρ 1 × ρ 2 )(D ′ ), we have

( f1 x 1 , ρ i •h ′ 1|D ′ 1 ) ∼ D ′′ e ′ P ,e O ( f2 x 1 , ρ 2 (h ′ 2|D ′ 2
)). Then we conclude again using

[K 1 ] ≃ γ,w ′ e ′ P ,e O [K 2 ]
with both lemma 30 and 29.

Finally, we state two lemmas on trace semantics.

.t. ρ • C ρ ′ •U --→ ρ ′ • C ′
Lemma 32 (Disclosed Equivalence): Let e P , e O , D three spans respectively on player and opponent name pointers and on locations, and γ 1 , γ 2 two value substitutions defined respectively on e P,1 and e P,2 . Suppose

K 1 [•] • -→ K 1 , γ 1 , e O,1 , h 1 , D 1 ≃ D e P ,e O K 2 [•] • -→ K 2 , γ 2 , e O,2 , h 2 , D 2 and let h ′ 1 , h ′ 2 such that h ′ i|D i = h i|D i and h ′ 1|D 1 ∼ D e P ,e O h ′ 2|D 2 . Then K 1 [•] • -→ K 1 , γ 1 , I 1 , h ′ 1 , D 1 ≃ D e P ,e O K 2 [•] • -→ K 2 , γ 2 , I 2 , h ′ 2 , D 2 .
Proof Straightforward from the fact that the interactive reduction on opponent configurations choose arbitrary values on the disclosed part of the heap.

From Concrete Logical Relations to Trace Semantics

Soundness of logical relations w.r.t. contextual equivalence is usually proved via the so-called fundamental property, which states that from for a term M s.t. Σ; Γ ⊢ M : τ , we have Σ; Γ ⊢ M ≃ clog M : τ (i.e. (M, M ) ∈ E τ ). This property is proved via an induction on the typing judgment of M , using compatibility lemmas which show that the logical relations follow the structure of the typing proof. However, such approach cannot work here, because of the existential quantification over LTS in the definition of Σ; Γ ⊢ M 1 ≃ clog M 2 : τ . Indeed, performing the induction on the typing proof, the application rule M 1 M 2 : τ is problematic, since we get two LTS A 1 , A 2 which are a priori not related.

To get around this problem, we rather link the logical relation to Kripke trace semantics, and use its soundness to conclude. So the goal of this section is to prove the soundness of our concrete logical relations w.r.t. Kripke trace semantics, that is:

if (M 1 , M 2 ) ∈ E A τ e O (w, w 0 ) then [M 1 ] ≃ (γ 1 ,γ 2 ),w e P ,e O [M 2 ].
for a span e P on player name pointers and γ 1 , γ 2 logically related (see Theorem 34 for the exact statement). In the previous section, we have seen that Kripke trace semantics follows the same reduction properties than the definition of E τ . But this is the "easy" part, since we have only consider "internal" reduction without any actions. It is the soundness for values and contexts which are the hardest one to prove, since they induce actions in trace semantics.

To prove them, we perform some "surgery" on traces to show that Kripke trace semantics follows the inductive structure of logical relations. It is similar to the proof done in Section 5.5, but complicated by the presence of heaps.

Firstly, we prove that the disclosure process performed by opponent actions, namely the "creation" of disclosed locations, corresponds to the notion of future world w 1 ⊒ F τ pub w. Lemma 33: Let e P , e O two spans on name pointers, w a world, γ i two environments on e P,i and K 1 , K 2 two applicative contexts. Taking (h 1 , h 2 , D) : w with h i ∈ Cl(ν L (K i , γ i )), suppose that

K i [•], γ i , e O,i , h i , D i u i ,h ′ i|D ′ i -----→ K i [u i ], γ i , e ′ O,i , h ′ i , D ′ i s.t. there exists a span D ′ extending D with D ′ i = D i and h ′ 1 ∼ D ′ h ′ 1 , u 1 ∼ D ′ u 2 if u 1 ,
u 2 are locations. then there exists w 1 ⊒ F τ pub w, where τ is the type of u i , s.t.

(h ′ 1 , h ′ 2 , D ′ ) : w 1 .
Proof From the rules O-AnsG and O-Ans, simplified due to the absence of higherorder references in h 1 , h 2 , we get that h ′

i|D ′ i = h i|D i and D ′ i = discl(u i , h ′ i , D i ). Let consider the subheap h n i of h ′ i whose domain is disjoint from h i . Then, from h ′ i|D ′ i = h i|D i we get that dom(h n i ) = D ′ i \D i . So let (l 1 , l 2 , ι) ∈ D ′ \D, from D ′ i = discl(u i , h ′ i , D i ) we get that there exists an n > 0 such that l i ∈ h n ({u i } ∪ D i ). Suppose this n is maximal, i.e. either h ′ i (l i ) ∈ {u i } ∪ D i or h ′ i (l i
) is equal to (), a boolean or an integer. This means that there exists l 0 i ∈ {u i }∪D i and

l k+1 i = h n (l k i ) for all k ∈ {1, . . . , n-1}, with l n i = l i . Then, l 0 i is of type ι ′ = ref . . . ref n times
ι (with ι the type of l i ). But then, ι is in subtype(ι ′ ), so there exists

D 1 ∈ NewLoc(ι ′ ) disjoint from D with (l k 1 , l k 2 ) ∈ D 1 for all k ∈ {1, . . . , n}. Iterating the process over D ′ i \(D i ∪ {(l k 1 , l k 2 ) | k ∈ {1, . . . ,
i ∈ Cl(ν L (K i , γ i )), suppose that ♦, γ i , e O,i , h i , D i f i u i ,h ′ i|D ′ i ------→ v i u i , γ 1 , e ′ O,1 , h ′ 1 , D ′ 1 where γ i (f i ) = v i of type τ → σ s.t. there exists a span D ′ extending D with D ′ i = D i and h ′ 1 ∼ D ′ h ′ 1 , u 1 ∼ D ′ u 2 if u 1 , u 2 are locations. Then there exists w 1 ⊒ F τ pub w, s.t. (h ′ 1 , h ′ 2 , D ′ ) : w 1 .
Proof The proof is similar to the previous lemma.

Then, from an opponent action a 1 ,we show how to build an equivalent opponent action a 2 , in the two following lemmas.

Lemma 35: Let e 0 , e O , D three spans respectively on player, opponent name pointers and locations. Let γ 1 , γ 2 two functional substitutions s.t. dom(γ i ) = e P,i . Let

f 1 ∈ e P,1 with γ(f 1 ) = v 1 , s.t. ♦, γ 1 , e O,1 , h 1 , D 1 f 1 u 1 ,h 1 1|D 1 1 -------→ v 1 u 1 , γ 1 , e 1 O,1 , h 1 1 , D 1 1
Then there exists: -a span on opponent name pointers e 1 O ⊒ e O , -a span on locations D 1 ⊒ D, -an action

(f 2 u 2 , h 1 2|D 1 2 ), s.t. (f 1 u 1 , h 1 1|D 1 1 ) ∼ D 1 e P ,e 1 O (f 2 u 2 , h 1 2|D 1 2 ) and ♦, γ 2 , e O,2 , h 2 , D 2 f 2 u 2 ,h 1 2|D 1 2 -------→ v 2 u 2 , γ 1 , e 1 O,2 , h 1 2 , D 1 2 .
Proof Firstly, there exists σ, τ and f 2 s.t. (f 1 , f 2 ) ∈ e O,σ→τ . Then, we reason by case analysis on σ to build u 2 .

-If σ is equal to Unit, Bool or Int, we simply take u 2 = u 1 .

-If σ = ref ι, then if u 1 ∈ D 1 , we take as u 2 the corresponding location u 2 s.t.

(u 1 , u 2 , ι) ∈ D. Otherwise, we take as l 2 any locations not in h 2 . -If σ is of functional type, then we take as u 2 any fresh opponent name pointer not in e O,2 .

Lemma 36: Let e 0 , e O , D three spans respectively on player, opponent name pointers and locations. Let γ 1 , γ 2 two functional substitutions s.t. dom(γ i ) = e P,i . Suppose that

K 1 [•], γ 1 , e O,1 , h 1 , D 1 u 1 ,h 1 1|D 1 1 ------→ K 1 [u 1 ], γ 1 , e 1 O,1 , h 1 1 , D 1 1
Then there exists:

-a span on opponent name pointers e 1 O ⊒ e O , -a span on locations D 1 ⊒ D, -an action

( x 2 u 2 , h 1 2|D 1 2 ), s.t. ( u 1 , h 1 1|D 1 1 ) ∼ D 1 e P ,e 1 O ( u 2 , h 1 2|D 1 2 ) and K 2 [•], γ 2 , e O,2 , h 2 , D 2 u 2 ,h 1 2|D 1 2 ------→ K 2 [u 2 ], γ 1 , e 1 O,2 , h 1 2 , D 1 2 .
Proof It follows the same pattern of the proof of the previous lemma.

Then we state a technical unwinding lemma, proving that for two terms and two heaps logically-related at w, there exists a future world w ′ s.t. they interactively reduce to two values related in w ′ and two heaps validating w ′ . This result is non-trivial since the interactive reduction can perform nested calls of terms, which is not directly taken into account with logical relations.

Lemma 37: Let M 1 , M 2 two ground-closed terms and e O a span on its (opponent) name pointers. Suppose that (M 1 , M 2 ) ∈ E A τ e O (w, w 0 ), and let e P a span on player name pointers with (γ 1 , γ 2 ) ∈ G A e P e O w and (h 1 , h 2 , D) : w s.t.

h i ∈ Cl(ν L (M i , γ i ) ∪ D i ). Consider T i ∈ [ M i , γ i , e O,i , h i , D i ] such that T 1 ≃ D e P ,e O T 2 with T i = U i • ( vi , h f i|D f i ) and
M i , γ i , e O,i , h i , D i U i -→ v i , γ ′ i , e f O,i , h ′ i , D ′ i vi ,h f i|D f i -----→ ♦, γ f i , e f O,i , h f i , D f i with γ f i = γ ′ i • (x i ֒→ v i ) if v i is of functional type, otherwise γ f i = γ ′ i . Then there exists -two injections ρ f i : (ν L (h f i ) \ ν L (h i )) ֒→ (Loc \ ν L (h i ))
, -a world w f s.t. w f ⊒ w and w f ⊒ pub w 0 , -a span on player name pointers e f P which extends e P and whose projection are equal to dom(γ f i ), -a span on opponent name pointers e f O which extends e O and whose projection are equal to e f O,i , such that

(ρ f 1 •h f 1 , ρ f 2 •h f 2 , ρ f 1 ×ρ f 2 •D f ) : w f , (ρ f 1 •v 1 , ρ f 2 •v 2 ) ∈ V A τ e f O w f and (ρ f 1 •γ f 1 , ρ f 2 •γ f 2 ) ∈ G A e f P e f O w f . Proof From (M 1 , M 2 ) ∈ E A τ e O (
w, w 0 ), we get the existence of -two terms E i , -a world w 1 ⊒ w, -two heaps and a span (h 1 1 , h 1 2 , D 1 ) :

w 1 , -two injections ρ i : (ν L (h 1 i ) \ ν L (h i )) ֒→ (Loc \ ν L (h i )), such that M i , h i , D i → * E i , ρ i • h 1 i , ρ i • D 1 i .
Either both

E i = v i , i.e. U i = ε, ρ i • h 1 i = h f i , e f O,i = e O,i . Then w 1 ⊒ pub w 0 and (ρ -1 1 • v 1 , ρ -1 2 • v 2 ) ∈ V A τ e w 1 .
So we directly get the wanted properties taking w f as w 1 , ρ f i as ρ -1 i , e f P = e P and e f O = e O .

Otherwise

E i = K i [f i u 1 i ] s.t. -(f 1 , f 2 ) ∈ e O,σ→σ ′ for two types σ, σ ′ , -(ρ -1 1 • u 1 1 , ρ -1 2 • u 1 2 ) ∈ V A σ e O w 1 , -for all w 2 ⊒ * pub w 1 , (ρ -1 1 • K 1 , ρ -1 2 • K 2 ) ∈ K A σ ′ , τ e O (w 2 , w 0 ). Then, we can decompose U i into ( fi u 1 i , ρ 1 i • h 1 i|D 1 i ) • U 1 i • U 2 i with K i [f i u 1 i ], γ i , e O,i , ρ 1 i • h 1 i , ρ 1 i • D 1 i fi u 1 i ,ρ 1 i •(h 1 i|D 1 i ) ----------→ K i [•], γ 1 i , e O,i , ρ 1 i • h 1 i , ρ 1 i • D 1 i U 1 i -→ K i [•], γ 2 i , e 1 O,i , h 2 i , D 2 i because discl(u 1 i , h 1 i , D 1 i ) = D 1 i since u 1 i ∈ D 1 i if u 1
i is a location. Then, using lemma 31, we get the existence of

ρ 1 i extending ρ -1 i such that ρ -1 i • K i [f i u 1 i ], γ i , e O,i , h 1 i|D 1 i , fi ρ -1 i • u 1 i , h 1 i| D 1 i ----------→ ρ -1 i • K i [•], ρ -1 i • γ 1 i , e O,i , h 1 i , D 1 i ρ 1 i •U 1 i ---→ ρ 1 i • K i [•], ρ 1 i • γ 2 i , e 1 O,i , ρ 1 i • h 2 i , ρ 1 i • D 2 i If σ is atomic, then u 1 i = u 1 i and ρ -1 i • γ 1 i = γ i .
Otherwise, u 1 i is equal to some fresh player name pointer y i and ρ

-1 i • γ 1 i = γ i • (y i ֒→ ρ -1 i • u 1 i ),
and defining e 1 P = e P • (y 1 , y 2 ), we have (ρ -1 1 • γ 1 1 , ρ -1 2 • γ 1 2 ) ∈ G A e 1 P e O w 1 using world monotonicity of functional values. In both cases, we have (ρ

1 i • U 1 i ) ∈ [ ♦, ρ 1 i • γ 1 i , e O,i , h 1 i , D 1 i ] and (ρ 1 i • U 1 1 ) ≃ D 1 e 1
P ,e O (ρ 1 i • U 1 2 ). So using the induction hypothesis of the second lemma on the pair of traces (ρ

1 i • U 1 1 , ρ 1 i • U 1 2 ) we get the existence of -two injections ρ 2 i : (ν L (ρ -1 i • h 2 i ) \ ν L (h 1 i )) ֒→ (Loc \ ν L (h 1 i )), -a world w 2 ⊒ * pub w 1 such that (ρ 2 1 • h 2 1 , ρ 2 2 • h 2 2 , (ρ 2 1 × ρ 2 2 ) • D 2 ) :
w 2 -a span on player name pointers e 2 P which extends e 1 P and whose projection are equal to dom(γ 2 i ), -a span on opponent name pointers e 1 O which extends e O and whose projection are equal to e 1 O,i , such that, defining ρ i as the injection ). So using lemma 33, we get the existence of

ρ 2 i • ρ 1 i : (ν L (h 2 i ) \ ν L (h i )) ֒→ (Loc \ ν L (h i )), we have ( ρ 1 • γ 2 1 , ρ 2 • γ 2 2 ) ∈ G A e 2 P e 1 O w 2 . Moreover, ( ρ 1 • h 2 1 , ρ 2 • h 2 2 , ( ρ 1 × ρ 2 ) • D 2 ) : w 2 . Then, we can decompose ρ i • U 2 i into ( u 2 i , h 3 i|D 3 i ) • U 3 i such that ρ i • K i [•], ρ i • γ 2 i , e 1 O,i , ρ i • h 2 i , ρ i • D 2 i u 2 i ,h 3 i|D 3 i ------→ ( ρ i • K i )[u 2 i ], ρ i • γ 2 i , e 2 O,i , h 3 i , D 3 i And from the fact that ρ 1 • U 2 1 ≃ D ′ 3 e 2 P ,
w 3 ⊒ F σ ′ pub w 2 such that ( ρ 1 • h 3 1 , ρ 2 • h 3 2 , ( ρ 1 × ρ 2 ) • D 3 ) : w 3 . Then, ρ i •K i = ρ -1
i •K i and from the world motononicity of contexts, (

ρ 1 •K 1 , ρ 2 •K 2 ) ∈ K A σ ′ , τ e 1 O
(w 3 , w 0 ). And we can conclude using the induction hypothesis on the first lemma.

Lemma 38: Let e P , e O two spans respectively on player and opponent name pointers,

(γ 1 , γ 2 ) ∈ G A e P e O w and (h 1 , h 2 , D) : w s.t. h i ∈ Cl(ν L (M i , γ i ) ∪ D i ). Then for all T i ∈ [ ♦, γ i , e O,i , h i , D i ] such that T 1 ≃ D e P ,e O T 2 and ♦, γ i , e O,i , h i , D i T i -→ ♦, γ f i , e f O,i , h f i , D f i there exists -two injections ρ i : (ν L (h ′ i )\ν L (h i )) ֒→ Loc, -a world w f ⊒ * pub w such that (ρ 1 (h f 1 ), ρ 2 (h f 2 ), (ρ 1 × ρ 2 )(D f )) : w f , -a span e f
O which extends e O and whose projections are e f O,i , -and a span e f P which extends e P such that (ρ

1 (γ f 1 ), ρ 2 (γ f 2 )) ∈ G A e f P e f O w f , Proof If T i is non-empty, then we have T i = (f i u i , h 1 i|D 1 i ) • U 1 i • U 2 i and ♦, γ i , e O,i , h i , D i f i u i ,h 1 i|D 1 i ------→ v i u i , γ i , e 1 O,i , h 1 i , D 1 i U 1 i -→ ♦, γ 2 i , e 2 O,i , h 2 i , D 2 i U 2 i -→ ♦, γ f i , e f O,i , h f i , D f i where γ i (f i ) = v i , with U 1 i ∈ v i u i , γ 1 i , e 1 O,i , h 1 i , D 1 i and U 2 i ∈ ♦, γ 2 i , e 2 O,i , h 2 i , D 2 i .
Then, from the equivalence of T 1 and T 2 , (f 1 , f 2 ) ∈ e P,σ→τ , so

(γ 1 (f 1 ), γ 2 (f 2 )) ∈ V A σ → τ e O w.
Using lemma 33, we get the existence of w 1 ⊒ F σ pub w such that (h 1 1 , h 1 2 , D 1 ) : w 1 , and moreover (v 1 u 1 , v 2 u 2 ) ∈ E A τ e 1 O (w 1 , w 1 ). So using the induction hypothesis on the first lemma, we get the existence of -two injections

ρ 2 i : (ν L (h 2 i )\ν L (h 1 i )) ֒→ Loc, -a world w 2 ⊒ pub w 1 such that (ρ 2 1 (h 2 1 ), ρ 2 2 (h 2 2 ),
(γ 2 1 ), ρ 2 2 (γ 2 2 )) ∈ G A e 2 P e 2 O w 2 .
Then, from lemma 31,there exists two injections ρ 3 i extending ρ 2 i s.t.

♦, ρ 2 i (γ 2 i ), e 2 O,i , ρ 2 i (h 2 i ), ρ 2 i (D f i ) U 2 i -→ ♦, ρ 3 i (γ f i ), e f O,i , ρ 3 i (h f i ), ρ 3 i (D f i )
Then using the induction hypothesis on the second lemma, we get the existence of two injections ρ ′ i : (

ρ 3 i (ν L (h f i ))\ρ 2 i (ν L (h 2 i ))) ֒→ Loc so defining the injection ρ f i : (ν L (h f i )\ν L (h i ))) ֒→ Loc as ρ ′ i • ρ 3 i on ν L (h f i )\ν L (h 2 i ) and as ρ 2 i on ν L (h 2 i )\ν L (h 1 i
) and as the identity on ν L (h 1 i )\ν L (h i ), we get the existence of -a world w f ⊒ pub w 2 such that (ρ f

1 (h f 1 ), ρ f 2 (h f 2 ), (ρ f 1 × ρ f 2 )(D f )) : w f , -a
(γ f 1 ), ρ f 2 (γ f 2 )) ∈ G A e f P e f O w f .
and we conclude using the fact that w f ⊒ * pub w 2 ⊒ pub w 1 ⊒ pub w.

Finally, using this unwinding of the logical relation, we can show the wanted theorems for values, terms and contexts. One also need an other lemma which show the adequacy of the equivalence of substitutions (γ 1 , γ 2 ) ∈ G A e P e O w. Theorem 32: Let v 1 , v 2 two values, e O a span on its opponent names pointers, and w a worlds such that (v 1 , v 2 ) ∈ V A τ e O w. Then taking e P a span on player name pointers, for all

(γ 1 , γ 2 ) ∈ G A e P e O w, [v 1 ] ≃ (γ 1 ,γ 2 ),w e P ,e O [v 2 ].
Theorem 33: Let K 1 , K 2 two contexts, e O a span on its opponent names pointers, and w, w 0 two worlds such that (M 1 , M 2 ) ∈ K A σ, τ τ e O (w, w 0 ). Then taking e P a span on player name pointers, for all

(γ 1 , γ 2 ) ∈ G A e P e O w, [K 1 ] ≃ (γ 1 ,γ 2 ),w e P ,e O [K 2 ].
Theorem 34: Let M 1 , M 2 two terms, e O a span on its opponent names pointers, and w, w 0 two worlds such that (M 1 , M 2 ) ∈ E A τ e O (w, w 0 ). Then taking e P a span on player name pointers, for all (γ 1 , γ 2 ) ∈ G A e P e O w, [M 1 ] ≃ (γ 1 ,γ 2 ),w

e P ,e O [M 2 ].
Proof The lemma and the three theorems are proved by a mutual induction on types and on the length of ground callbacks.

Proof ((Lemma 39)) Let

(h 1 , h 2 , D) : w s.t. h i ∈ Cl(ν L (γ i )∪D i ), and T 1 ∈ [ ♦, γ 1 , e O,1 , h 1 , D 1 ]. We must build T 2 ∈ [ ♦, γ 2 , e O,2 , h 2 , D 2 ] such that T 1 ≃ D e P ,e O T 2 .
We can write T 1 as ),

(f 1 u 1 1 , h 1 1|D 1 1 ) • U 1 1 • ( ū2 1 , h 3 1|D 3 1 ) • U 2 1 with f 1 ∈ dom(γ 1 ) and ♦, γ 1 , e O,1 , h 1 , D 1 f 1 u 1 1 ,h 1 1|D 1 1 -------→ v 1 u 1 1 , γ 1 , e 1 O,1 , h 1 1 , D 1 1 U 1 1 -→ u 2 1 , γ 1 1 , e 2 O,1 , h 2 1 , D 2 1 ū2 1 ,h 3 i|D 3 i ------→ ♦, γ 2 1 , e 2 O,1 , h 3 1 , D 3 1 Let f 2 such that (f 1 , f 2 ) ∈ e P , i
such that (f 1 u 1 1 , h 1 1|D 1 1 ) ∼ D 1 e P ,e 1 O (f 2 u 1 2 , h 1 2|D 1 2
). Then, using lemma 34, we get a world w 1 ⊒ F σ pub w such that (h 1 1 , h 1 2 , D 1 ) : w 1 . Then, the first move of T 2 is defined as

(f 2 u 1 2 , h 1 2|D 1 2 ). From (f 1 u 1 1 , h 1 1|D 1 1 ) ∼ D 1 e P ,e 1 O (f 2 u 1 2 , h 1 2|D 1 2 ), we get that (u 1 1 , u 1 2 ) ∈ V A σ e 1 O w 1 , so (v 1 u 1 1 , v 2 u 1 2 ) ∈ E A σ ′ e 1 O (w 1 , w 1 ).
Applying the induction hypothesis of Theorem 34 (i.e. on terms) with lemma 30, we first get the existence of

U 1 2 • ū2 2 , h 3 1|D 3 2 ∈ v 2 u 1 2 , γ 2 , e 1 O,2 , h 1 2 , D 1 2 such that U 1 2 ≃ D 2 e P ,e 2 O U 1 2 and ( ū2 1 , h 3 1|D 3 1 ) ∼ D 3 e 2 P ,e 2 O ( ū2 2 , h 3 2|D 3 2
). Then, applying lemma 37, we get the existence of -two injections

ρ i : (ν L (h 3 i )\ν L (h 1 i )) ֒→ (Loc\ν L (h 1 i )), -a world w 3 ⊒ w 1 -a
(h 3 1 ), ρ 2 (h 3 2 ), (ρ 1 × ρ 2 )(D 3 )) : w 3 , (ρ 1 (γ 2 1 ), ρ 2 (γ 2 2 )) ∈ G A e 2 P e 2 O w 3 and (ρ 1 (u 2 1 ), ρ 2 (u 2 2 )) ∈ V A σ ′ e 2 O w 3 .
Thus, we can use the induction hypothesis to get

U 2 2 ∈ ♦, γ 2 2 , e 2 O,2 , h 3 2 , D 3 2 such that ρ 1 (U 2 1 ) ≃ D 3 e 1 P ,e 2 O ρ 2 (U 2
2 ) where D 3 = (ρ 1 × ρ 2 )(D 3 ). So, using the renaming of locations (lemma 29), we get that U 2 1 ≃ D 3 e 1 P ,e 2 O U 2 2 . And we conclude taking T 2 as (f

2 u 1 2 , h 1 2|D 1 2 ) • U 1 2 • ū2 2 h 3 1|D 3 2 , •U 2 2
Proof (Soundness on Values) If τ is of atomic type, then the result has already been proven in Theorem 30. Otherwise, taking (h 1 , h 2 , D) : w s.t.

h i ∈ Cl(ν L (v i ) ∪ D i ), we have [ v i , γ i , e i , h i , D i ] equal to ( xi , h i|D i )•[ ♦, γ ′ i , e i , h i , D i ] where γ ′ i = γ i •(x i ֒→ v i ).
And we conclude using lemma 39.

Proof (Soundness on Contexts) Let

(h 1 , h 2 , D) : w with h i ∈ Cl(ν L (K i , γ i ) ∪ D i ), and T 1 ∈ [ K 1 , γ 1 , e O,1 , h 1 , D 1 ], we must build T 2 ∈ [ K 2 , γ 2 , e O,2 , h 2 , D 2 ] such that T 1 ≃ D e P ,e O T 2 . We have T 1 = U 1 1 • ( u 1 , h 2 1|D 2 1 ) • U 2 1 with U 1 1 ∈ [ ♦, γ 1 , e O,1 , h 1 , D 1 ] and K 1 , γ 1 , e O,1 , h 1 , D 1 U 1 1 -→ K 1 , γ 1 1 , e 1 O,1 , h 1 1 , D 1 1 u 1 ,h 2 1|D 2 1 ------→ K 1 [u 1 ], γ 1 1 , e 2 O,
2 ⊒ D, -an action ( u 2 , h 2 2|D 1 2 ), such that ( u 1 , h 2 1|D 1 1 ) ∼ D 2 e P ,e 2 O ( u 2 , h 2 2|D 1 2
). Then, using lemma 34, we get a world w 2 ⊒ F σ pub w 1 such that (h 2 1 , h 2 2 , D 2 ) : w 2 . Then, from the equivalence between the two opponent actions, we get that (u 1 , u 2 ) ∈ V A σ e 2 O w 2 . Thus using the monotonicity of contexts, we have

(K 1 [u 1 ], K 2 [u 2 ]) ∈ K A σ, τ e 2 O (w 2 , w 2 ),
so using the induction hypothesis on terms, we get the existence of

U 2 2 such that ρ ′ 1 (U 2 1 ) ≃ D ′ 3 e 1 P ,e 2 O ρ ′ 1 (U 2
2 ). And we conclude using the renaming of locations (lemma 29).

Proof (Soundness on Terms) Straightforward using the main theorem on Kripke trace semantics (theorem 31).

Then, we can deduce the soundness of concrete logical relations w.r.t. trace semantics

Corollary 5: Let M 1 , M 2 two terms such that Σ; Γ g , Γ f ⊢ M 1 , M 2 : τ . Then Σ; Γ g , Γ f ⊢ M 1 ≃ clog M 2 : τ implies [Σ; Γ g , Γ f ⊢ M 1 : τ ] = [Σ; Γ g , Γ f ⊢ M 2 : τ ].
Proof From Σ; Γ ⊢ M 1 ≃ clog M 2 : τ we get the existence of an LTS A and a state s of A such that for all γ g : Γ g → Val and h ∈ Cl(Σ, ν L (codom(γ g ))), defining w as

(s, h, h, ν L (h)), we get (γ g,1 (M 1 ), γ g,2 (M 2 )) ∈ E A τ Γ f (w, w). So Theorem 34 gives us that [M 1 ] ≃ (ε,ε),w ε, Γ f [M 2 ].
We conclude using Theorem 29.

Adequate Worlds

Completeness can no longer be proven abstractly using biorthogonality. That is, for any two terms that are contextually equivalent, we need to construct explicitly a LTS for which they are logically related. To make the proof more abstract and less dependent on the LTS construction, we define a notion of adequate world w.r.t. an LTS A that expresses all we need to know about evolution of worlds to prove that two terms are related. The definition, given in Figure 6.3, is a dual version of concrete logical relations. Indeed, instead of characterizing terms that are in relation for a given world, it characterizes worlds that respects the execution of two given terms M 1 , M 2 . Namely, it imposes:

V A Unit γ e P ,e O (u 1 , u 2 ) def = World V A Bool γ e P ,e O (u 1 , u 2 ) def = World V A Int γ e P ,e O (u 1 , u 2 ) def = World V A ref ι γ e P ,e O (u 1 , u 2 ) def = {w | (u 1 , u 2 ) ∈ w.S ι } V A ι → τ γ e P ,e O (v 1 , v 2 ) def = {w | ∀w 1 ⊒ * w.∀(h 1 1 , h 1 2 , D 1 ) : w 1 .∃(h 1 , h 2 , D) : w.∃e 1 P ⊒ e P .∃e 1 O ⊒ e O .∃T 1 , T 2 . T 1 ≃ D 1 e 1 P ,e 1 O T 2 ∧ ♦, γ i , e O,i , h i , D i T i -→ -→ K i , γ 1 i , e 1 O,i , h 1 i , D 1 i ∧∃w 2 ⊒ F ι pub w 1 .∀(u 1 , u 2 ) ∈ V A ι e O w 2 .(w 2 , w 2 ) ∈ E A τ γ 1 e 1 P ,e 1 O (γ 1 (v 1 ) u 1 , γ 2 (v 2 ) u 2 )} V A σ → τ γ e P ,e O (v 1 , v 2 ) def = {w | ∀w 1 ⊒ * w.∀(h 1 1 , h 1 2 , D 1 ) : w 1 .∃(h 1 , h 2 , D) : w.∃e 1 P ⊒ e P .∃e 1 O ⊒ e O .∃T 1 , T 2 . T 1 ≃ D 1 e P ,e 1 O T 2 ∧ ♦, γ i , e O,i , h i , D i T i -→ -→ K i , γ 1 i , e 1 O,i , h 1 i , D 1 i ∧∃w 2 ⊒ F σ pub w 1 .(w 2 , w 2 ) ∈ E A τ γ 1 e 1 P ,e 1 O •(y 1 ,y 2 ) (γ 1 (v 1 ) y 1 , γ 2 (v 2 ) y 2 )} K A ι, τ γ e P ,e O (K 1 , K 2 ) def = {(w, w 0 ) | ∀w 1 ⊒ * pub w.∀(h 1 1 , h 1 2 , D 1 ) : w 1 .∃(h 1 , h 2 , D) : w.∃e 1 P ⊒ e P .∃e 1 O ⊒ e O . ∃T 1 , T 2 .T 1 ≃ D 1 e 1 P ,e 1 O T 2 ∧ K i [•], γ i , e i , h i , D i T i -→ K i [•], γ 1 i , e 1 i , h 1 i , D 1 i ∧∃w 2 ⊒ F σ pub w 1 .∀(v 1 , v 2 ) ∈ V A ι e O w 2 .(w 2 , w 0 ) ∈ E A τ γ 1 e 1 p ,e 1 O (K 1 [v 1 ], K 2 [v 2 ])} K A σ, τ γ e P ,e O (K 1 , K 2 ) def = {(w, w 0 ) | ∀w 1 ⊒ * pub w.∀(h 1 1 , h 1 2 , D 1 ) : w 1 .∃(h 1 , h 2 , D) : w.∃e 1 P ⊒ e P .∃e 1 O ⊒ e O . ∃T 1 , T 2 .T 1 ≃ D e P ,e O T 2 ∧ K i [•], γ i , e i , h i , D i T i -→ K i [•], γ 1 i , e 1 O,i , h 1 i , D 1 i ∧∃w 2 ⊒ F σ pub w 1 .(w 2 , w 0 ) ∈ E A τ γ 1 e 1 p ,e 1 O •(y 1 ,y 2 ) (K 1 [y 1 ], K 2 [y 2 ])} E A τ γ e P ,e O (M 1 , M 2 ) def = (w, w 0 ) | ∀(h 1 , h 2 , D) : w.∀e 1 P ⊒ e P .∀D 1 ⊒ D.∀c 1 ∼ D 1 e 1 P ,e O c 2 . M i , γ i , e i , h i , D i c i -→ E i , γ 1 i , e O,i , h 1 i , D 1 i ⇒ ∃w 1 ⊒ w.(h 1 1 , h 1 2 , D 1 ) : w 1 ∧ (c i = ( vi , h 1 i|D 1 i )) ∧ w 1 ∈ V A τ γ 1 e 1 P ,e O (v 1 , v 2 ) ∧ w 1 ⊒ pub w 0 or (c i = ( fi v i , h 1 i|D 1 i )) ∧ (f 1 , f 2 ) ∈ e O,σ→σ ′ ∧ w 1 ∈ V A σ γ 1 e 1 P ,e O (v 1 , v 2 ) ∧(w 1 , w 0 ) ∈ K A σ ′ , τ γ 1 e 1
P ,e O (E 1 , E 2 ) Figure 6.3: Definition of adequate worlds -the existence of future worlds for all possible heaps that can be obtained by reducing M 1 , M 2 from two heaps in the current world (see the definition of E A τ γ e P ,e O (M 1 , M 2 )). -that every future world corresponds to a reduction, either public in the definition of K A τ, σ γ e P ,e O (K 1 , K 2 ), or private in the definition of V A τ → σ γ e P ,e O (v 1 , v 2 ). Its definition is parametrized by two spans e P , e O on player and opponent name pointers, and by a couple of substitutions, written γ, whose two components are written γ 1 and γ 2 and are of domain respectively e P,1 and e P 2 . They are used to control the functional values disclosed by the term.

Notice that, from (M 1 , M 2 ) ∈ E A τ e w, it is not true that w ∈ E A τ ε ε,e (M 1 , M 2 ). Indeed, one do not need w to be adequate to prove that (M 1 , M 2 ) ∈ E A τ e w. This notion is only necessary when working on completeness. It is also not true that w ∈

E A τ ε ε,e (M 1 , M 2 ) implies (M 1 , M 2 ) ∈ E
A τ e w, because we do not impose equality on ground values, since it is not needed: when working with contextually equivalent terms, this is automatic.

To show that, for any pair of contextually equivalent terms M 1 , M 2 " there exists an LTS A and an adequate world w.r.t. A, we build coinductively an exhaustive LTS, i.e. an infinite transition system where each state represents a configuration which can appear in the interactive reduction of the terms, and where transitions constraint heaps to be in accordance with the reduction. To build it, we first define some basic operations on transition system:

-Add a private transition r to an transition system A = (δ priv , δ pub ) :

A priv ⊕ r def = (δ priv ∪ {r}, δ pub )
-Add a set R of public transition to an transition system A = (δ priv , δ pub ) :

A pub ⊕ R def = (δ priv ∪ R, δ pub ∪ R)
-Union of two transition systems A 1 , A 2 where A i = (δ i,priv , δ i,pub ) :

A 1 ⊔ A 2 def = (δ 1,priv • δ 2,priv , δ 1,pub • δ 2,pub )
Then, we define operations to construct transitions :

-TransPriv(s, s ′ , h 1 , h 2 , h ′ 1 , h ′ 2 , D, D ′ ) is defined as the private transition (s, s ′ ) ֒→ {(h 1|D 1 , h 2|D 2 , h ′ 1|D ′ 1 , h ′ 2|D ′ 2 , D, D ′ )} -TransPub(c 1 , c 2 )(s, s ′ , h 1 , h 2 , h ′ 1 , h ′ 2 , D, D ′
) is defined as the singleton formed by the public transition

(s, s ′ ) ֒→ {(h 1|D 1 , h 2|D 2 , h ′ 1|D ′ 1 , h ′ 2|D ′ 2 , D, D ′ )}
if the a i are either player or opponent answers or opponent questions, otherwise, it is defined as the empty set.

Then, we define the exhaustive LTS LtsE L,s e P ,e O ,D (C 1 , C 2 ) and LtsK L,s e P ,e O ,D (C 1 , C 2 ) associated respectively to two opponent and player configurations C 1 , C 2 . They use a list L of worlds corresponding to the public transitions that must be added to the LTS once a value is reached in the interactive reduction.

-LtsE L,s e P ,e O ,D (C 1 , C 2 ) is defined as

j LtsK L j ,s j e j P ,e O ,D ′ (C j 1 , C j 2 ) priv ⊕ TransPriv(s, s j , h 1 , h 2 , h j 1 , h j 2 , D, D j ) pub ⊕ TransPub(c 1 , c 2 )(s 0 , s j , h 0 1 , h 0 2 , h j 1 , h j 2 , D 0 , D j )
for all pair of players actions (c j 1 , c j 2 ) s.t. the exists a span on player name pointers e j P ⊒ e P and a span on locations D j ⊒ D with c j 1 ∼ D j e j P ,e O c j 2 and there exists

C i with h 1|D 1 ∼ D h 2|D 2 , h i|D i = h i|D i and C i c j i -→ C j i ,
where we write h i (resp. h i ) for the heap of C i (resp. C i ). If the c i are (player) questions, then we suppose that L j = L (and by definition of TransPub we do not add any public transition). Otherwise, we suppose that

L j = (s 0 , h 0 1 , h 0 2 , D 0 ) • L ′ . -LtsK L,s e P ,e O ,D (C 1 , C 2 ) is defined as j LtsE L j ,s j e P ,e j O ,D j (C j 1 , C j 2 ) pub ⊕ TransPub(c j 1 , c j 2 )(s, s j , h 1 , h 2 , h ′ 1 , h ′ 2 , D, D j )
for all pair of opponent actions (c j 1 , c j 2 ) s.t. the exists a span on opponent name pointers e j O ⊒ e O and a span on locations D j ⊒ D with c j 1 ∼ D j e P ,e j O c j 2 and C i c j i -→ C j i . We suppose that the s j are fresh and write h i (resp. h j i ) for the heap of C i (resp. C j i ). If the c j i are (opponent) questions, then

L j = (s, h j 1 , h j 2 , D j ) • L. Otherwise, L j = L.
The definition of LtsE L,s e P ,e O ,D (C 1 , C 2 ) needs to be generalized to consider any configurations C 1 , C 2 whose private part of the heaps are equal to the one of h 1 , h 2 , but whose disclosed part can be changed, as soon as they are still nominally equivalent. This is due to the fact that the definition of E A τ γ e P ,e O (M 1 , M 2 ) quantifies over (h 1 , h 2 , D) : w, which do not constraint the disclosed part of h 1 , h 2 beside being nominally equivalent. An other solution would have been to merge in the definition of LtsK L,s e P ,e O ,D (C 1 , C 2 ) the states s j for all the configurations C j i whose heaps only differ on the disclosed part (but whose D j i are equal). However, doing so, the definition of LtsK L,s e P ,e O ,D (C 1 , C 2 ) become in a way primitive over the definition of LtsE L,s e P ,e O ,D (C 1 , C 2 ), which would complicate the reasoning.

The exhaustive LTS A = (δ priv , δ pub ) has a tree-structure, i.e. there does not exist two states s, s ′ s.t. s ′ ≥ A s and s ≥ A s ′ , where we define s ′ ≥ A s as δ * priv (s, s ′ ) non empty. Thus, for any state s of A we can define the sub-LTS A ≥s whose transition functions are restricted to states s ′ ≥ A s. Then, one can relate the properties of two LTS A, A ′ about worlds w, when A ≥s = A ′ ≥s and the state of w is greater than s.

Lemma 40:

Let w = (s, h 1 , h 2 , D) a world s.t. w ∈ V A τ γ e P ,e O (v 1 , v 2 ). Let A ′ an LTS s.t. A ≥s = A ′ ≥s , then w ∈ V A ′ τ γ e P ,e O (v 1 , v 2 ). Lemma 41: Let w = (s, h 1 , h 2 , D) and w 0 = (s 0 , h 0 1 , h 0 2 , D 0 ) two worlds s.t. (w, w 0 ) ∈ E A τ γ e P ,e O (M 1 , M 2 ). Let A ′ an LTS extending A s.t. A ≥s = A ′ ≥s and {s ′ | A.δ pub (s 0 , s ′ ) ∧ s ′ ≥ A s} = {s ′ | A ′ .δ pub (s 0 , s ′ ) ∧ s ′ ≥ A ′ s}, then (w, w 0 ) ∈ E A ′ τ γ e P ,e O (M 1 , M 2 ).
Proof Straightforward from the fact that A and A ′ impose the same futures for w.

Before proving that the exhaustive LTS is adequate, we need some lemmas which ensure the existence of equivalent traces from the existence of a succession of (public for the first lemma, private for the second) transitions in an LTS.

Lemma 42: Let C 1 , C 2 two interactive configurations such that C i = ♦, γ i , e O,i , h i , D i . We consider the exhaustive LTS A = LtsK L,s e P ,e O ,D (C 1 , C 2 ) and s ′ , h ′ 1 , h ′ 2 , D ′ s.t. (h 1 , h 2 , h ′ 1 , h ′ 2 , D, D ′ ) ∈ A.δ * pub (s, s ′ )
Then there exists two traces T 1 , T

C i T i -→ ♦, γ ′ i , e ′ O , h ′ i , D ′ i C ′ i , and
A ′ ≥s ′ = A ≥s ′ , where A ′ = LtsK L,s ′ e ′ P ,e ′ O ,D ′ (C ′ 1 , C ′ 2 ). Lemma 43: Let C 1 , C 2 two interactive configurations such that C i = ♦, γ i , e O,i , h i , D i .
We consider the exhaustive LTS A = LtsK L,s e P ,e O ,D (C 1 , C 2 ) and s

′ , h ′ 1 , h ′ 2 , D ′ s.t. (h 1|D 1 , h 2|D 2 , h ′ 1|D 1 1 , h ′ 2|D 1 2 , D, D ′ ) ∈ A.δ * priv (s, s ′ )
Then there exists two traces

T 1 , T 2 s.t. T 1 ≃ D ′ e ′ P ,e ′ O T 2 and C i T i -→ C ′ i where C ′ i = -→ K i , γ ′ i , e ′ O , h ′ i , D ′ i , and A ′ ≥s ′ = A ≥s ′ , where A ′ = LtsK L 1 ,s ′ e ′ P ,e ′ O ,D ′ (C ′ 1 , C ′ 2 ).
Finally, we can prove that the exhaustive LTS is adequate.

Theorem 35 (Adequacy on Values

): Let C 1 , C 2 two opponent interactive configura- tions such that C i = ♦, γ i , e O,i , h i , D i . Then defining A as LtsK L,s e P ,e O ,D (C 1 , C 2 ) and w as (s, h 1|D 1 , h 2|D 2 , D), for all (f 1 , f 2 ) ∈ e P,σ→τ , w ∈ V A σ → τ γ e P ,e O (f 1 , f 2 ).
Theorem 36 (Adequacy on Contexts):

Let K 1 , K 2 two contexts of type σ τ and C 1 , C 2 two interactive configurations such that C i = K i , γ i , e O,i , h i , D i . Then defining A as LtsK L,s e P ,e O ,D (C 1 , C 2 ) where L = (s 0 , h 0 1 , h 0 2 , D 0 ) • L ′ , w = (s, h 1|D 1 , h 2|D 2 , D) and w 0 = (s 0 , h 0 1|D 0 1 , h 0 2|D 0 2 , D 0 ), we have (w, w 0 ) ∈ K A σ, τ γ e P ,e O (K 1 , K 2 ).
Theorem 37 (Adequacy on Terms): Let M 1 , M 2 two terms of type τ and C 1 , C 2 two interactive configurations with

C i = M i , γ i , e i , h i , D i . Then defining A as LtsE L,s e P ,e O ,D (C 1 , C 2 ) where L = (s 0 , h 0 1 , h 0 2 , D 0 ) • L ′ , w = (s, h 1|D 1 , h 2|D 2 , D) and w 0 = (s 0 , h 0 1|D 0 1 , h 0 2|D 0 2 , D 0 ), we have (w, w 0 ) ∈ E A τ γ e P ,e O (M 1 , M 2 ).
Proof The three theorem are proved by a mutual coinduction.

Proof (Adequacy on Values) Let w 1 ⊒ * w with s 1 the state of w 1 and and (h 1 1 , h 1 2 , D 1 ) : w 1 . From lemma 43, there exists two traces

T 1 , T 2 s.t. T 1 ≃ D 1 e 1 P ,e 1 O T 2 , with C i T i -→ C 1 i where C 1 i = -→ K i , γ 1 i , e 1 O , h 1 i , D 1 i . Moreover, defining A 1 as LtsK L,s 1 e 1 P ,e 1 O ,D 1 (C 1 1 , C 1 2 ), we have A 1 ≥s 1 = A ≥s 1 . Then, C 1 i f i u i ,h 2 i|D 2 i ------→ C 2 i where C 2 i = (v i u i ) • -→ K i , γ 1 i , e 2 O , h 2 i , D 2 i with γ ( f i ) = v i . So by definition of A 1 , there exists a state s 2 s.t. (h 1 1|D 1 1 , h 1 2|D 1 2 , h 2 1|D 2 1 , h 2 2|D 2 2 , D 1 , D 2 ) ∈ A 1 .δ pub (s 1 , s 2 ). Moreover, defining A 2 as LtsE L,s 2 e 1 P ,e 2 O ,D 2 (C 2 1 , C 2 2 ), we have A 1 ≥s 2 = A 2 ≥s 2 . Then, defining w 2 as (s 2 , h 2 1|D 2 1 , h 2 2|D 2 2 , D 2 ), the coinduction hypothesis gives us that (w 2 , w 2 ) ∈ E A 2 τ γ e P ,e O (v 1 u 1 , v 2 u 2 )
So using lemma 41, we get that (w 2 , w 2 ) ∈ E A τ γ e P ,e O (v 1 u 1 , v 2 u 2 ).

Proof (Adequacy on Terms) Let

i c i -→ C 1 i . Let write C 1 i as E i , γ 1 i , e 1 O,i , h 1 i , D 1 i .
Then by definition of LtsE L,s e P ,e O ,D (C 1 , C 2 ), there exists a fresh state s 1 such that, writing A 1 for LtsK L ′ ,s 1

e 1 P ,e O ,D 1 (C 1 1 , C 1 2 ), we have (h 1|D 1 , h 2|D 2 , h 1 1|D 1 1 , h 1 2|D 1 2 , D, D 1 ) ∈ δ priv (s, s 1 ) and A 1 ≥s 1 = A ≥s 1 . Let write w 1 for (s 1 , h 1 1|D 1 1 , h 1 2|D 1 2 , D 1 ), so w 1 ⊒ w. And from c 1 ∼ D 1 e 1 P ,e O c 2 , we get that h 1 1|D 1 ∼ D 1 h 1 2|D 2 , so (h 1 1 , h 1 2 , D 1 ) : w 1 . -If both c i are player answers, i.e. c i = ( vi , h 1 i|D 1 i ), then C 1 i = ♦, γ 1 i , e O,i , h 1 i , D 1 i .
If the v i are ground values, then γ 1 i = γ i and either they are of type Unit, Bool or Int, in which case we directly have w

1 ∈ V A 1 τ γ 1 e 1 P ,e O (v 1 , v 2 ), or they are of type ref ι. In such case, (v 1 , v 2 ) ∈ D 1 so we also get w 1 ∈ V A 1 τ γ 1 e 1 P ,e O (v 1 , v 2 ).
Otherwise, they are name pointers, and the coinduction hypothesis on Values applied to v 1 , v 2 gives us that w 1 ∈ V A 1 τ γ 1 e 1 P ,e O (γ(v 1 ), γ(v 2 )). So using new lemma 40, we get that ′ . The coinduction hypothesis on Contexts gives us that (w 1 , w 0 ) ∈ K A σ ′ , τ γ 1 e 1 P ,e O (K 1 , K 2 ). So, we just have to prove that w 1 ∈ V A σ γ 1 e 1 P ,e O (v 1 , v 2 ), which is done in the same way than when the c i are answers.

w 1 ∈ V A τ γ 1 e 1 P ,e O (v 1 , v 2 ). Moreover, the definition of LtsE L,s e P ,e O ,D (C 1 , C 2 ) gives us that (h 0 1|D 0 1 , h 0 2|D 0 2 , h 1 1|D 1 1 , h 1 2|D 1 2 , D 0 , D 1 ) ∈ δ pub (s 0 , s 1 ). Thus we have w 1 ⊒ pub w 0 . -If both c i are player questions, i.e. c i = ( fi v i , h 1 i|D 1 i ), then C 1 i = K i [•], γ 1 i , e O,i , h 1 i , D 1 i . Then there exists σ, σ ′ such that (f 1 , f 2 ) ∈ e O,σ→σ

Proof (Adequacy on Contexts

) Let w 1 ⊒ * pub w and (h 1 , h 2 , D) : w 1 s.t. h i ∈ Cl(ν L (K i ))
, with s 1 the state of w 1 . Then, from lemma 42, there exists two traces T 1 , T 2 , three spans e 1 P ⊒ e P , e 1 O ⊒ e O , and

D 1 ⊒ D, s.t. T 1 ≃ D 1 e 1 P ,e 1 O T 2 and C i T i -→ C 1 i where C 1 i = K i , γ 1 i , e 1 O , h 1 i , D 1 i with dom(γ 1 i ) = e 1 P,i . Moreover, writing A 1 for LtsK L,s e 1 P ,e 1 O ,D 1 (C 1 1 , C 1 2 ), we have A 1 ≥s 1 = A ≥s 1 .
Then, we reason by case analysis on σ. If σ is functional, then, by construction of A 1 , there exists a state s 2 and a span

D 2 s.t. (h 1 1 , h 1 2 , h 1 1 , h 1 2 , D 1 , D 2 ) ∈ A 1 .δ pub (s 1 , s 2 ), and
C 1 i x i ,h 2 i|D 2 i -----→ K i [x i ], γ 1 i , e 2 O , h 2 i , D 2 i C 2 i where e 2 O = e 1 O • (x 1 , x 2 ).
) ∈ E A τ γ 1 e 1 P ,e 2 O (K 1 [x 1 ], K 2 [x 2 ]).
The case where σ is ground is done in the same way.

From Trace Semantics to Concrete Logical Relations

Using this construction of an exhaustive LTS which is adequate, we can now prove the completeness of our concrete logical relations. We first prove it for ground values Theorem 38: Let v 1 , v 2 two closed values of ground type ι, e O a span on opponent name pointers and w a world s.

t. w ∈ V A ι γ e P ,e O (v 1 , v 2 ). Then if [v 1 ] ≃ γ,w e P ,e O [v 2 ] we get that (v 1 , v 2 ) ∈ V A ι e O w. Proof If ι = Int, the theorem is direct since in both cases we have v 1 = v 2 . If ι = ref ι ′ , then from w ∈ V A ι γ e P ,e O (v 1 , v 2 ) we get that (v 1 , v 2 ) ∈ (w.S) ι .
To prove the completeness of concrete logical relations at higher types, we decompose traces to show that they respect the inductive structure induced by Kripke logical relations. To do so, we need invariants on heaps provided by adequate worlds. Indeed, the equivalence of Kripke trace semantics ≃ γ,w e P ,e O depends only on the current state of w, so it does not constraint the shape of any LTS, contrary to the definition of E A τ e O w which depends on A.

The proof of completeness relies on the following lemmas which state that if two functions are related at a given adequate world, then for any future, applying those functions to related values gives rise to related values. Note that this lemma is wrong when the world is not adequate.

Lemma 44: Let (v 1 , v 2 ) a pair of ground-closed values of type σ → τ , e O a span on their name pointers and e P a span on player name pointers with γ i : e P,i → Val two substitutions. Taking w ∈

V A σ → τ γ e P ,e O (v 1 , v 2 ), suppose that [v 1 ] ≃ γ,
⊒ F σ pub w 1 such that for all (u 1 , u 2 ) ∈ V A σ e 1 O w 2 , [v 1 u 1 ] ≃ γ 1 ,w 2 e 1 P ,e 1 O [v 2 u 2 ] and (w 2 , w 2 ) ∈ E A τ γ 1 e 1 P ,e 1 O (v 1 u 1 , v 2 u 2 ).
-otherwise, there exists

w 2 ⊒ F pub w 1 such that [v 1 y 1 ] ≃ γ 1 ,w 1 e 1 P ,e 2 O [v 2 y 2 ] and (w 1 , w 1 ) ∈ E A τ γ 1 e 1 P ,e 2 O (v 1 y 1 , v 2 y 2 ), where e 2 O = e 1 O • (y 1 , y 2 ).
Proof Let w 1 ⊒ w and (h 1 1 , h 1 2 , D 1 ) : w 1 , then from w ∈ V A σ → τ γ e P ,e O (v 1 , v 2 ), we get that there exists (h 1 , h 2 , D) : w, two spans on name pointers e 1 P ⊒ e P ,e 1 O ⊒ e O and a pair of (incomplete) equivalent traces U

1 1 ≃ D 1 e 1 P ,e 1 O U 1 2 such that v i , γ i , e O,i , h i , D i zi ,h i|D i -----→ ♦, γ ′ i , e O,i , h i , D i U 1 i -→ -→ K i , γ 1 i , e 1 O,i , h 1 i , D 1 i (since h i|D i is closed, with γ ′ i = γ i • (z i ֒→ y i ). Then, -If σ is of ground type, then there exists w 2 ⊒ F σ pub w 1 such that for all (u 1 , u 2 ) ∈ V A σ e 1 O w 2 (w 2 , w 2 ) ∈ E A σ γ 1 e 1 P ,e 1 O (v 1 u 1 , v 2 u 2 ). Moreover, for all (h 2 1 , h 2 2 , D 2 ) : w 2 there exists a reduction -→ K i , γ 1 i , e 1 O,i , h 1 i , D 1 i z i u i ,h 2 i|D 2 i ------→ (v i u i ) • -→ K i , γ 1 i , e 1 O,i , h 2 i , D 2 i . Then, we take U 2 1 ∈ v 1 u 1 , γ 1 1 , e 1 O,1 , h 2 1 , D 2 1 s.t. v 1 u 1 • -→ K 1 , γ 1 1 , e 1 O,1 , h 2 1 , D 2 1 U 2 1 -→ -→ K 1 , γ 2 1 , e 2 O,1 , h 3 1 , D 3 1 and taking U 3 1 ∈ -→ K 1 , γ 2 1 , e 2 O,1 , h 3 1 , D 3 1 we have ( z1 , h 1|D 1 ) • U 1 1 • (z 1 u 1 , h 2 1|D 2 1 ) • U 2 1 • U 3 1 T 1 ∈ [ v 1 , γ 1 , e O,1 , h 1 , D 1 ] . 1 D 2 e 1 P ,e 1 O v 2 u 2 , γ 1 2 , e 1 O,2 , h 2 2 , D 2 2 .
Using a symmetric reasoning, we prove the reverse inclusion, so

v 1 u 1 , γ 1 1 , e 1 O,1 , h 2 1 , D 2 1 ≃ D 2 e 1 P ,e 1 O v 2 u 2 , γ 1 2 , e 1 O,2 , h 2 2 , D 2 2 .
And we have prove this property for all

(h 2 1 , h 2 2 , D 2 ) : w 2 , so [v 1 u 1 ] ≃ γ 1 ,w 2 e 1 P ,e 1 O [v 2 u 2 ]. -Otherwise, there exists w 2 ⊒ F pub w 1 such that, defining e 2 O = e 1 O • (y 1 , y 2 ), (w 2 , w 2 ) ∈ E A σ γ 1 e 1 P ,e 2 O (v 1 y 1 , v 2 y 2 ). Moreover, for all (h 2 1 , h 2 2 , D 2 ) : w 2 there exists a reduction -→ K i , γ 1 i , e 1 O,i , h 1 i , D 1 i z i y i ,h 2 i|D 2 i ------→ (v i y i ) • -→ K i , γ 1 i , e 2 O,i , h 2 i , D 2 i .
Then, using the same reasoning as in the ground type case, we get that

[v 1 y 1 ] ≃ γ 1 ,w 2 e 1 P ,e 2 O [v 2 y 2 ].
Lemma 45: Let (K 1 , K 2 ) a pair of ground-closed contexts, e O a span on their name pointers, e P a span on player name pointers and γ i : e P,i → Val two substitutions. We consider a world w ∈ K A σ, τ γ e P ,e O (K 1 , K 2 ). Suppose that [K 1 ] ≃

⊒ F σ pub w 1 such that for all (v 1 , v 2 ) ∈ V A σ e 1 O w 2 , [K 1 [v 1 ]] ≃ γ 1 ,w 2 e 1 P ,e 1 O [K 2 [v 2 ]] and (w 2 , w 2 ) ∈ E A τ γ 1 e 1 P ,e 1 O (K 1 [v 1 ], K 2 [v 2 ]).
-otherwise, there exists

w 2 ⊒ F σ pub w 1 such that [K 1 [x 1 ]] ≃ γ 1 ,w 2 e 1 P ,e 2 O [K 2 [x 2 ]] where e 2 O = e 1 O • (x 1 , x 2 ), and (w 2 , w 2 ) ∈ E A τ γ 1 e 1 P ,e 2 O (K 1 [x 1 ], K 2 [x 2 ]).
Proof Let w 1 ⊒ w and (h 1 1 , h 1 2 , D 1 ) : w 1 , then from w ∈ K A σ, τ γ e P ,e O (K 1 , K 2 ), we get that there exists (h 1 , h 2 , D) : w and a pair of equivalent traces U

1 1 ≃ D 1 e 1 P ,e 1 O U 1 2 in [ K i [•], γ i , e O,i , h i , D i ], such that K i [•], γ i , e O,i , h i , D i U 1 i -→ K i [•], γ 1 i , e 1 O,i , h 1 i , D 1 i .
Then we reason by case analysis on σ.

-If σ is of ground type, then there exists w

2 ⊒ pub σw 1 s.t. for all (v 1 , v 2 ) ∈ V A σ e 1 O w 2 , (w 2 , w 2 ) ∈ E A τ K 1 [v 1 ] e 1 O ,γ 1 (K 2 [v 2 ],
). Moreover, for all (h 2 1 , h 2 2 , D 2 ) : w 2 , there exists a reduction

K i [•], γ 1 i , e 1 O,i , h 1 i , D 1 i v i ,h 2 i|D 2 i -----→ K i [v i ], γ 1 i , e 1 O,i , h 2 i , D 2 i So we take U 2 1 ∈ K i [v 1 ], γ 1 i , e 1 O,1 , h 2 1 , D 2 1 , then U 1 1 • ( v 1 , h 2 1|D 2 1 ) • U 2 1 T 1 ∈ [ K 1 [•], γ 1 , e O,1 , h 1 , D 1 ] so from [K 1 ] ≃ γ,w e P ,e O [K 2 ], we get the existence of T 2 ∈ [ K i [•], γ 2 , e O,
• ( v 2 , h 2 2|D 2 2 ) • U 2 2 with U 2 2 ∈ K 2 [v 2 ], γ 1 2 , e 2 O,2 , h 2 2 , D 2 2 and U 2 1 ≃ D 2 e 1 P ,e 1 O U 2 2 . Thus K 1 [v 1 ], γ 1 1 , e 1 O,1 , h 2 1 , D 2 1 D 2 e 1 O ,e 1 P K 2 [v 2 ], γ 1 2 , e 1 O,2 , h 2 2 , D 2 2 . Using a symmetric reasoning, we get that K 1 [v 1 ], γ 1 1 , e 1 O,1 , h 2 1 , D 2 1 ≃ D 2 e 1 O ,e 1 P K 2 [v 2 ], γ 1 2 , e 1 O,2 , h 2 2 , D 2 2 Since this equivalence is true for all (h 2 1 , h 2 2 , D 2 ) : w 2 , we get that [K 1 [v 1 ]] ≃ γ 1 ,w 2 e 1 P ,e 1 O [K 2 [v 2 ]]. -Otherwise, there exists w 2 ⊒ pub σw 1 s.t. (w 2 , w 2 ) ∈ E A τ K 1 [x 1 ] e 2 O ,γ 1 (K 2 [x 2 ],), where e 2 O = e 1 O • (x 1 , x 2 ).
Moreover, for all (h 2 1 , h 2 2 , D 2 ) : w 2 , there exists a transition

K i [•], γ 1 i , e 1 O,i , h 1 i , D 1 i x i ,h 1 i|D 2 i -----→ K i [x i ], γ 1 i , e 2 O,i , h 2 i , D 2 i
Then, following the same reasoning as in the ground case, we get that

[K 1 [x 1 ]] ≃ γ 1 ,w 2 e 1 P ,e 2 O [K 2 [x 2 ]].
Lemma 46: Let e P , e O , D three spans respectively on player and opponent name pointers and on locations, and γ 1 , γ 2 two value substitutions defined respectively on e P,1 and e P,2 . Suppose

[ ♦, γ 1 , e O,1 , h 1 , D 1 ] ≃ D e P ,e O [ ♦, γ 2 , e O,2 , h 2 , D 2 ]. Then, for all (f 1 , f 2 ) ∈ e P we get that [ γ 1 (f 1 ), γ 1 , I 1 , h 1 , D 1 ] ≃ D e P ,e O [ γ 2 (f 2 ), γ 2 , e O,2 , h 2 , D 2 ] Proof We simply use the fact that [ γ i (f i ), γ i , e O,i , h i , D i ] = ( xi , h i|D i )•[ ♦, γ ′ i , e O,i , h i , D i ] with γ ′ i = γ i •(x i ֒→ γ i (f i )) and the equivalence [ ♦, γ ′ i , e O,i , h i , D i ] ≃ D e ′ P ,
) ∈ E A τ γ e P ,e O (M 1 , M 2 ) such that [M 1 ] ≃ γ,w e P ,e O [M 2 ]. Taking (h 1 , h 2 , D) : w with h i ∈ Cl(ν L (M i )), suppose that M i , h i , D i → * E i , h 1 i , D 1 i . Then there exists w 1 ⊒ w with (h 1 1 , h 1 2 , D 1 ) : w 1 such that -either both E i = v i with [v 1 ] ≃ γ,w 1 e P ,e O [v 2 ] and w 1 ∈ V A τ γ e P ,e O (v 1 , v 2 ), -or both E i = K i [f i v i ] with (f 1 , f 2 ) ∈ e O,σ→σ ′ and [v 1 ] ≃ γ,w 1 e P ,e O [v 2 ], [K 1 ] ≃ γ 1 ,w 1 e 1 P ,e O [K 2 ] with γ 1 = γ and e 1 P = e P if σ is atomic, γ 1 i = γ i •(x i ֒→ v i ) and e 1 P = e P •(x 1 , x 2 ) oth- erwise. Moreover, w 1 ∈ V A σ γ e P ,e O (v 1 , v 2 ) and (w 1 , w 0 ) ∈ K A σ ′ , τ γ 1 e 1 P ,e O (K 1 , K 2 ),
Proof The adequacy of w gives us the existence of w 1 such that w 1 ⊒ w and (h 1 1 , h 1 2 , D 1 ) : w 1 . If both E i = v i , the adequacy also gives us that w 1 ⊒ pub w 0 and w 1 ∈ V A τ e O γ,e P (v 1 , v 2 ). Using lemma 28, we get that

[ M i , γ i , e O,i , h i , D i ] = [ v i , γ i , e O,i , h 1 i , D 1 i ], so from [M 1 ] ≃ γ,w e P ,e O [M 2 ] we get that [ v 1 , γ 1 , e O,1 , h 1 1 , ] ≃ D 2 e P ,e O [ v 2 , γ 2 , e O,2 , h 1 2 , ]. Then, taking any (h 2 1 , h 2 2 , D 2 ) : w 1 s.t. h 2 i ∈ Cl(ν L (v i , γ i )), we have h 2 i|D 2 i = h 1 i|D 2 i and h 2 1|D 2 1 ∼ D 2 h 2 2|D 2 2
, so applying Lemma 32, we get that

[v 1 ] ≃ γ,w 1 e P ,e O [v 2 ]. Otherwise, if both E i = K i [f i v i ], the adequacy of w gives us w 1 ∈ V A σ γ ′ e P ,e O (v 1 , v 2 ) and w 1 ∈ K A σ ′ , τ γ 1 e ′ P ,e O (K 1 , K 2 ). Moreover, [ M i , γ i , e O,i , h i , D i ] is equal to ( fi u i , h 1 i|D 1 i ) • K i [•], γ 1 i , e O,i , h 1 i , D 1 i so from [M 1 ] ≃ γ,w e P ,e O [M 2 ] we get that K 1 [•], γ 1 1 , e O,1 , h 1 1 , D 1 1 ≃ D 1 e P ,e O K 2 [•], γ 1 2 , e O,2 , h 1 2 , D 1 2 We also get that ( f1 u 1 , h 1 1|D 1 1 ) ∼ D 1 e 1 P ,e O ( f2 u 2 , h 1 2|D 1 2 ) so (f 1 , f 2 ) ∈ e σ→σ ′ for some type σ, σ ′ .
Then, if σ is of ground type, we have u i = v i , e 1 P = e P and γ 1

i = γ i . So from ( f1 v 1 , h 1 1|D 1 1 ) ∼ D 1 e P ,e O ( f2 v 2 , h 1 2|D 1 2 ) we get that v 1 , γ 1 , e O,1 , h 1 1 , D 1 1 ≃ D 1 e P ,e O v 2 , γ 2 , e O,2 , h 1 2 , D 1 2
Otherwise, u i is equal to some fresh pointer name x i , e 1 P = e P • (x 1 , x 2 ) and γ

1 i = γ i • (x i ֒→ v i ). So using lemma 46, we also get that [ v 1 , γ 1 , e O,1 , h 1 1 , D 1 1 ] ≃ D 1 e P ,e O [ v 2 , γ 2 , e O,2 , h 1 2 , D 1 2 ].
Finally, using the same reasoning as for the value case, we get that

[v 1 ] ≃ γ,w 1 e P ,e O [v 2 ] and [K 1 ] ≃ γ 1 ,w 1 e 1 P ,e O [K 2 ].
Then, we can deduce that terms that are equivalent for a given adequate world are in concrete logical relations for that world.

Theorem 39 (Completeness for Values): Let v 1 , v 2 two ground-closed values, e O a span on their name pointers, e P a span on player name pointers and γ i : e P,i → Val two substitutions. We consider a world w ∈

V A τ γ e P ,e O (v 1 , v 2 ). If [v 1 ] ≃ γ,w e P ,e O [v 2 ] then (v 1 , v 2 ) ∈ V A τ e O w.
Theorem 40 (Completeness for Contexts): Let K 1 , K 2 two ground-closed contexts, e O a span on their name pointers, e P a span on player name pointers and γ i : e P,i → Val two substitutions. We consider (w, w

0 ) ∈ K A σ, τ γ e P ,e O (K 1 , K 2 ). If [K 1 ] ≃ γ,w e P ,e O [K 2 ] then (K 1 , K 2 ) ∈ K A σ, τ e O (w, w 0 ).
Theorem 41 (Completeness for Terms): Let M 1 , M 2 two ground-closed terms, e O a span on their name pointers, e P a span on player name pointers and γ i : e P,i → Val two substitutions. We consider (w, w

0 ) ∈ E A τ • e P ,e O (M 1 , M 2 ). If [M 1 ] ≃ γ,w e P ,e O [M 2 ] then (M 1 , M 2 ) ∈ E A τ e O (w, w 0 ).
Proof The proof of the three theorem is done by a mutual induction on types and on the number of ground callbacks of terms considered. It follows directly from Lemma 44 for values, Lemma 45 for contexts and Lemma 47 for terms.

Using the conjunction of this last theorem with the adequacy of exhaustive LTS, we get the completeness of concrete logical relations w.r.t. trace semantics.

Corollary 6 (Completeness of Concrete Logical Relations

): Let M 1 , M 2 two terms such that Σ; Γ ⊢ M 1 , M 2 : τ . Then [Σ; Γ g , Γ f ⊢ M 1 : τ ] = [Σ; Γ g , Γ f ⊢ M 2 : τ ] implies Σ; Γ ⊢ M 1 ≃ clog M 2 : τ . Proof Let γ g : Γ g → Val and h ∈ Cl(Σ, ν L (codom(γ g )))}. Then using Theorem 29, we get that [γ g (M 1 )] ≃ (ε,ε),w ε, Γ f [γ g (M 2 )].
Moreover, defining C i as γ g (M 1 ), ε, dom(Γ f ), h, D where D = dom(h), we build a LTS A = LtsE L,s e P ,e O ,D (C 1 , C 2 ) with L = w. Then using Theorem 37, we get that

(w, w) ∈ E A τ (ε,ε) ε, Γ f (M 1 , M 2 ).
Finally we conclude from Theorem 41.

Possible extensions

We have succeeded in building a concrete logical relation defined in a direct way which is sound and complete w.r.t. trace semantics. Thus using the correspondence between trace semantics and game semantics, and the fact that game semantics is fully abstract, we get the soundness and completeness of our logical relations w.r.t. contextual equivalence, which is the wanted result. This work has been performed for divergent-free terms of GroundML with contexts in RefML. But it seems possible to extend this work to two directions: to terms in RefML, or to contexts in GroundML.

Concrete Logical Relations for full RefML

Trying to define our concrete logical relations for the whole RefML, we would expect to encounter the usual circularity between the definition of worlds and logical relations that we have talked about in the introduction, and which was one of the motivations of our work in Chapter 4 in order to solve it.

But quite unexpectedly, this circularity disappears, since we use a fixed notion of LTS which does not evolve. Moreover, we represent higher-order functions stored in the disclosed part of heaps just with variables, as it is done in trace semantics or game semantics (cf. the end of Section 5.1.7), so that a posteriori it seems fair not to encounter the circularity since it does not appear neither in the game nor the trace model.

However, when working with term of RefML, one cannot reason anymore by induction on the number of ground callbacks of terms, since diverging terms like λf : (Unit → Unit). fix g(x) : (Unit → Unit).(f(); g())

can perform an infinity of such callbacks.

Thus we would need a coinductive definition, which would probably be really closed to the work of Hur et al. in [START_REF] Hur | The marriage of bisimulations and kripke logical relations[END_REF]. But we can also use guarded recursive types to define our logical relations in a coinductive way on the number of ground callback terms can perform, which can possibly be infinite. Let see briefly how to do it.

Firstly, we would need to generalize the definition of (h 1 , h 2 , D) : w in two different ways to deal with higher order references. The first one, P e (w) only works on functional free heaps:

P e (w) def = (h 1 , h 2 , D, e ′ ) | D ⊆ D w , h i = h priv i • h discl i s.t. dom(h discl i ) = D i and h priv i ⊆ h w i , h discl 1 ∼ D e ′ h discl 2 and e ′ i = e i ∪ ν O P (h discl i )
where w = (h w 1 , h w 2 , D w ). It takes as a parameter a span on name pointers, that is extended to relate those name pointers stored in heaps. In this setting, the usual equivalence on the disclosed part of the heap is easily defined:

h 1 ∼ S,e h 2 def = ∀(l 1 , l 2 ) ∈ S Int . h 1 (l 1 ) = h 2 (l 2 ) ∧ ∀(l 1 , l 2 ) ∈ S ref ι . (h 1 (l 1 ), h 2 (l 2 )) ∈ S ι ∀(l 1 , l 2 ) ∈ S τ →ι .(h 1 (l 1 ), h 2 (l 2 )) ∈ e
The second one works on any kinds of heaps, so that it is in fact defined recursively with the logical relation:

Q e (w) def = (h 1 , h 2 , D) | D ⊆ D w , h i = h priv i • h discl i s.t. dom(h discl i ) = D i and h priv i ⊆ h w i , ∀(l 1 , l 2 , τ ) ∈ D. ⊲ (h 1 (l 1 ), h 2 (l 2 )) ∈ V A τ e w
Notice the use of ⊲ to ensure the well-foundness of the definition.

Then, we keep the same definition for logical relations, but for two differences. Firstly, we insert a modality ⊲ in front of every occurrence of E τ in the definition of V τ → σ and K τ, σ .

Then, one change the definition of E τ so that it uses the two predicates P e (w) and Q e (w) rather than (h 1 , h 2 , D) : w.

E A τ e (w, w 0 ) def = (M 1 , M 2 ) | ∀(h 1 , h 2 , D, e ′ ) ∈ P e (w).h i ∈ Cl(ν L (M i )) ⇒ ((M 1 , h 1 ) ⇑ ∧(M 2 , h 2 ) ⇑) ∨ ∃w ′ ⊒ w.∃(h ′ 1 , h ′ 2 , D ′ ) ∈ Q ′ e (w ′ ).∃ρ i : (ν L (h ′ i )\ν L (h i )) ֒→ (Loc\ν L (h i )). M i , h i , D i → * ρ i • E i , h ′ i , D ′ i ∧ E i = v i ∧ (v 1 , v 2 ) ∈ V A τ e ′ w ′ ∧ w ′ ⊒ * pub w 0 ∨ E i = K i [f i v i ] ∧ (f 1 , f 2 ) ∈ e ′ σ→ σ ′ ∧ (v 1 , v 2 ) ∈ V A σ e ′ w ′ ∧∀w ′′ ⊒ * pub w ′ .(K 1 , K 2 ) ∈ K A σ ′ , τ e ′ (w ′′ , w 0 )
The idea is that, in input, we get heaps from contexts (i.e. Opponent), whose disclosed part is necessarily functional free. So we can simply use P e (w). However, while terms are executed, they can modify the disclosed part and store functions in it, or simply create an higher-order reference which is then disclosed. So in exit, the disclosed part of the heap has no reason to be functional free. This means that we have to use Q e (w).

Then, the logical relation is defined coinductively on the number of ground callbacks of terms. And this definition is justified by the presence of ⊲ exactly where such ground callbacks are performed.

However, this definition is not complete. Indeed, it does not handle examples like a version of the "deferred divergence" presented in [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF], where terms are related while diverging at two different moment of the execution (i.e. the synchronization of callbacks has to be weaken). This weakness was already present in our definition of concrete logical relations for terms of GroundML, this explains why it is complete only for divergence-free terms.

A way to solve it is to use the idea of inconsistent worlds, as introduced in the same article to solve such equivalences. We left this idea for future work.

Concrete Logical Relations for GroundML

The other direction would be to restrict the power of contexts we have considered. Following this idea, Dreyer et al. [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF] give a characterization of such restriction via constraints on the shape of worlds and on the way we can reason on them. Restriction to GroundML then correspond to the possibility to backtrack in the world.

In Chapter 5, we have presented a fully-abstract trace semantics for GroundML, which uses the usual notion of visibility to restrict strategies, as defined in the "semantic cube" by Abramsky.

Then, one can imagine using it to define sound and complete concrete logical relations for GroundML which relates both notions. The idea is to slightly modify the definition of our concrete logical relations so that the way worlds evolve respects the scoped structure of the trace semantics for GroundML.

More precisely, let consider a term M = λf.let x = ref 0 in fv 1 ; fv 2 with v 1 , v 2 two functions which perform effects on x. In GroundML, the callbacks fv 1 and fv 2 are considered in the same way, that is the fact that fv 1 has been performed first does not give him a special status. To integrate this idea, one would simply modify the definition of K τ (w, w 0 ) so that it can backtrack to the initial world w 0 .

One could then go further, and consider a language with only integer references, that is without the power of storing locations. Then, location disclosure is not monotonic. This is because the scope of disclosed locations is not global anymore. This should correspond to the availability restriction of names [START_REF] Murawski | Full abstraction for reduced ml[END_REF].

LTS A representing the evolution of invariants on heaps for M 1 and M 2 , we could decide if M 1 , M 2 are indeed in E A τ w, for w the initial world.

In fact, many choices in the machinery used in Chapter 6 to define E A τ w were chosen for this purpose, the most important one being to work with a fixed LTS A. Indeed, this opens the possibility to work in a simple logic whose semantics is defined via a Kripke model. This idea was already followed by Dreyer et al. in [START_REF] Dreyer | A relational modal logic for higher-order stateful ADTs[END_REF], however their logic was quite complex, both because quantification over λ-terms is allowed, ans because of the low constraints on the variation of worlds in their setting.

Here, we choose to work in a logic which mixes Presburger Arithmetic, to define constraints on heaps, and Temporal Logic, to reason on the evolution in the LTS, i.e. on the control flow. Temporal Logic is of great importance in the field of model checking, to prove safety and liveness properties, after the seminal work of A. Pnuely [START_REF] Pnueli | The temporal logic of programs[END_REF]. To our knowledge, our framework presented in this chapter is the first one that uses temporal logic to reason on the control flow of an impure functional language, in order to prove equivalence of programs.

We then define temporal logical relations in this logic. To do so, we first introduce a notion of symbolic execution used to reduce terms with open ground variables. In practice, it simply perform an exhaustive reduction, generating predicates which constrain values of ground variables, such that these predicates are altogether satisfiable if and only if the reduction is indeed operationally possible. Using it, we can define temporal logical relations which correspond exactly to concrete logical relations.

In full generality, the problem of model-checking stays undecidable for our logic, because of two reasons:

-the quantifications over heaps, which can be seen as unbounded size lists, -the mix between Presburger arithmetic and Temporal Logic. However, under some reasonable hypothesis on the arity of the transition functions, which allow us to control the quantification over heaps and locations, and supposing that the transitive closure of the LTS is provided and can be stated in Presburger arithmetic, we get a decidable model-checking.

This work has given rise to an implementation in Haskell. This prototype computes the temporal logical relation E τ (M 1 , M 2 ) associated to two terms, but is also able to automatically generate an LTS which can possibly validate this formula. Then, it performs a translation of the validity of the temporal formula w.r.t. to this LTS to SMT-LIB2, the common language of smt-solver. Using the Z3 solver (http://z3.codeplex.com/), we have thus been able to decide various examples from the literature. We left open the possibilities of theoretical results on this LTS generation. If we succeed in proving that the implementation generates an LTS which, under some hypothesis on terms, is adequate (as defined in Section 6.5), this would lead to decidability results for fragments of RefML and GroundML.

Such decidability results have already been obtained with algorithmic game semantics, which rely on the full abstraction results of game models. In theory, all program equiv-alences could be proven by simply looking at equality of strategies. However, reasoning on equality of strategies in the pure functional setting is non-trivial (or even undecidable [START_REF] Loader | Finitary pcf is not decidable[END_REF]) because models are quotiented with a complex relation. For language with references, there is a good characterization of the quotient, using complete strategies, as we have seen in Chapter 5.

Algorithmic game semantics is based on these results, and uses automata theory to represent strategies. In the call-by-name setting, a full classification of the decidability of program equivalence has been given by Ghica and McCusker [GM00] on first-order Idealized Algol. For call-by-value, recent study of a (finitary) ML fragment with bad variables have been developed using variants of pushdown automata [START_REF] Hopkins | A fragment of ML decidable by visibly pushdown automata[END_REF]. And using variants of fresh register automata [START_REF] Tzevelekos | Fresh-register automata[END_REF], this method has been extended to "good" references [START_REF] Murawski | Algorithmic nominal game semantics[END_REF][START_REF] Murawski | Algorithmic games for full ground references[END_REF]. The main difficulty in algorithmic game semantics is to encode the pointer structure, that plays carry, ro languages recognizable by automata. To do so, types of considered terms have to be restricted, in order to get decidability results. It would then be interesting to compare these results to the one one could obtained with our method, which would rely on the control of the creation of locations rather than a restriction on types.

Plan of the Chapter In Section 7.1, we define our logic HeapTL, a mix between Presburger arithmetic and temporal logic. It uses LTS introduced in Chapter 6 to define the semantics of temporal connectives, and worlds for the semantics of the predicates on heaps. Symbolic Execution is introduced in Section 7.2, which is crucial in the possibility of automatically generated the temporal logical relation associated to two terms, as defined in Section 7.3. Then, we study in Section 7.5 model checking properties of the temporal logical relations, which has been sketched in the introduction. These results rely on the soundness and completeness of the temporal logical relations (w.r.t. concrete logical relations), which are proven respectively in Section 7.6 and 7.7.

Temporal Logic for Heaps

We first begin by defining our temporal logic for heaps, named HeapTL, used to afterwards to define our temporal logical relations. HeapTL is a first-order sorted logic with ground sorts θ ranging over Int, Loc and Heap. Unusually for a temporal logic, it is based on top of Presburger arithmetic. It contains basic arithmetic propositions, defined as:

-Arithmetic terms: t, t ′ def = x | n | t + t ′ |t with x ∈ Var and n ∈ Int -Arithmetic propositions:

P def = t = t ′ | t < t ′
We also consider heap terms u, u ′ , which are either locations or variables. A world with history W is then defined as a triple (w, κ, n) where w is a world, κ is a function from integers to World and n is an integer representing a counter to the current history. This history is used to force the existence of public transition between states that represent initial calls (opponent answers) and states where a value is returned.

The meaning of HeapTL is given in Figure 7.1 via a Kripke semantics, defined as a validity relation W |= A ψ, indexed by a LTS A that translates formulas of HeapTL to second-order logic.

The validity of logical connectives is standard and not detailed. When the sort of a variable is clear from the context, we omit its type.

The definition of W |= A u ֒→ i u ′ says that u points to u ′ in the current heap h i of the world. Note that it is possible that u does not belong to the domain of h i as long as it is a disclosed location.

HeapTL is composed of four temporal modalities:

-Xψ which forces the existence a private future of the current state and which satisfies ψ. -X F ι pub ψ, which forces the existence of a public future of the current state, that satisfies ψ, and that extends the set of disclosed locations with fresh ones with respect to a ground type ι.

-ψ (resp. pub ψ) which forces ψ to be true in all private (resp. public) future states of the current one. The predicate P pub (n) forces the existence of a public transition between the current state and the state appearing at position n in the history.

To specify the disclosed part of the heap, the predicate Discl τ (u 1 , u 2 ) imposes u 1 and u 2 to be related by using the span on locations of the world. In the same way, h 1 D ∼ h 2 expresses the equivalence between the disclosed part of heaps h 1 and h 2 by simply using the equivalence of the current span.

Finally, HeapTL contains three specific binder: -H x.ϕ, which substitute x with the current history counter in ϕ, -N1 y.ϕ (resp. N2 y.ϕ) that provides a fresh existential quantification on locations, that is on locations that do not appear free in ϕ. We define FHT i (ψ) to be the free heap terms of ψ appearing in predicates u ֒→ i u ′ of ψ, as -FHT i (u ֒→ i u ′ ) = {u} and FHT i (u ֒→ j u ′ ) = ∅ when i = j, -FHT i ( Ni x.ψ) = FHT i (ψ)\{x}, -FHT i (ψ ∧ ψ ′ ) = FHT i (ψ) ∧ FHT i (ψ ′ ), the rest of the definition going through the structure of ψ. Notice that (w, κ, n) |= A Ni x.ϕ could have been defined as ∃y ∈ Loc \ (ν L (h i ) ∪ S i ), but this would have forbidden the possibility for worlds to reuse an undisclosed location which are no more present in the term.

Symbolic Execution

The definition of temporal logical relations will not be based on the operational semantics of the language but rather on a symbolic version of it. Symbolic execution uses a symbolic heap H, defined as a partial function from heap terms u (i.e. locations or variables) to heap terms or arithmetic terms. Arithmetic is used to force conditions on (symbolic) variables used to represent values pointed to by locations and variables. For example, the heap defined as [x ֒→ l] • [l ֒→ 3] can be represented symbolically as [x ֒→ x 1 ] • [x 1 ֒→ x 2 ] plus the arithmetic constraints x 1 = l ∧ x 2 = 3.

Figure 7.2 defines the one-step symbolic execution of a triple (M, H, C) where M is a term, H a symbolic heap and C a list of arithmetic and heap constraints. This execution is non-deterministic and generates all possible terms and symbolic heaps that can be obtained from M with a heap satisfying (H, C). We also use the notation (M, H, C) → s (M ′ , H ′ , C ′ ) to represent the fact that (M ′ , H ′ , C ′ ) is in the list of the redexes of (M, H, C). When the set of constraints is empty, we simply write (M, H) rather than (M, H, ∅).

The symbolic reduction of (K[u := v], H, C) is the more evolved rule as it deals with aliasing of locations. That is, it generates all executions for each possible aliasing of u to a location occurring in the set L.

Finally, we define ⇓ (M, H, C) as the set of irreducible (M ′ , H ′ , C ′ ) such that (M, H, C) → * s (M ′ , H ′ , C ′ ). We will only consider such configurations for H closed for M , that is:

Temporal Logical Relations

Using the symbolic execution, we define in Figure 7.3 temporal logical relations as formulas over HeapTL. The reader can check that it follows the very same pattern as the definition of concrete logical relations, where interactive reduction has been replaced by the symbolic execution, where concrete reasoning on location becomes abstract, and where constraints on the structure of public transitions are now explicit.

More precisely, the universal quantifications over worlds are replaced by modalities and pub , while the existential ones are replaced by X and X F τ pub . Thus, the definition of the temporal logical relation is abstract over both LTS and worlds.

As usual for logical relations, the construction is given by a mutual induction between formulas for terms, values, and contexts. The well-foundedness of the construction is guarantee in our case by an analysis on types and on the number of "ground-callbacks", which are the configurations on which, with the values, the symbolic execution stopped.

The definition of E τ n e uses an auxiliary predicate Rel e,τ , in which we check that C 1 ∧ C 2 to ensure that the two symbolic reductions are consistent, i.e. they correspond to concrete feasible reductions.

Rel n e,τ ((v 1 , H post 1 , C 1 ), (v 2 , H post 2 , C 2 ))

def = N1 -→ y 1 . N2 -→ y 2 .∀ -→ x ′ . X (C 1 ∧ C 2 ) ⇒↑ 1 (H post 1 )∧ ↑ 2 (H post 2 ) ∧(H post 1 D ∼ H post 2 ∧ V τ e (v 1 , v 2 ) ∧ P pub (n))
Rel n e,τ ((K

1 [f 1 v 1 ], H post 1 , C 1 ), def = N1 -→ y 1 . N2 -→ y 2 .∀ -→ x ′ X (C 1 ∧ C 2 ) ⇒ (↑ 1 (H post 1 )∧ ↑ 2 (H post 2 ) (K 2 [f 2 v 2 ], H post 2 , C 2 )) ∧H post 1 D ∼ H post 2 ∧ V σ e (v 1 , v 2 ) ∧ pub K σ ′ , τ n e (K 1 , K 2 )) (when (f 1 , f 2 ) ∈ e σ→σ ′ )
Rel n e,τ (( , , C 1 ), ( , , C 2 ))

def = N1 -→ y 1 . N2 -→ y 2 .∀ -→ x ′ ¬(C 1 ∧ C 2 ) (otherwise) V Unit e (v 1 , v 2 ) def = v 1 = v 2 V Bool e (v 1 , v 2 ) def = v 1 = v 2 V Int e (v 1 , v 2 ) def = v 1 = v 2 V ref ι e (l 1 , l 2 ) def = Discl ι (l 1 , l 2 ) V ι → τ e (v 1 , v 2 ) def = X F ι pub (∀u 1 , u 2 : ι.V ι e (u 1 , u 2 ) ⇒ H y.E τ y e (v 1 u 1 , v 2 u 2 )) V τ → σ e (v 1 , v 2 ) def =
X F τ pub ( H y.E σ y e•(y 1 ,y 2 ,τ ) (v 1 y 1 , v 2 y 2 )) (τ not ground , y 1 / ∈ e 1 , y 2 / ∈ e 2 ) Γ f (M 1 , M 2 ) where w = (s, h, h, ν L (h)), Γ f (resp. Γ g ) only contains variables of functional (resp. ground) types and (x i : ι i ) cover all Γ g . In the definition of Rel n e,τ , the fresh existential quantifications are on locations -→ y 1 and -→ y 2 introduced during symbolic execution, i.e. in dom(H post i )\dom(H pre i ), while the universal quantification -→

K ι, σ n e (K 1 , K 2 ) def = X F ι pub (∀v 1 , v 2 : ι.V ι e (v 1 , v 2 ) ⇒ E σ n e (K 1 [v 1 ], K 2 [v 2 ])) K τ, σ n e (K 1 , K 2 ) def = X F τ pub (E σ n e•(x 1 ,x 2 ,τ ) (K 1 [x 1 ], K 2 [x 2 ])) (τ
x ′ is on all the other variables of FV(H post 1 , H post 2 )\FV(H pre 1 , H pre 2 ). In the definition of E τ n e , the universal quantification is on logical variables -→ x introduced in H pre 1 , H pre 2 , i.e. during the symbolic execution to impose constraint on the heap. It is straightforward that concrete and logical relations correspond on ground values.

Theorem 42: Let v 1 , v 2 two closed values of ground type ι, w a world and (κ, n) an history for w. Then (w, κ, n)

|= A V ι (v 1 , v 2 ) iff (v 1 , v 2 ) ∈ V A ι ε w.
Proof If ι = Int, the theorem is direct since in both cases we have v 1 = v 2 . If ι = ref ι ′ , then the equivalence comes from the fact that (w, κ, n)

|= A Discl ι (v 1 , v 2 ) iff (v 1 , v 2 ) ∈ (w.S) ′ ι and that (v 1 , v 2 ) ∈ V A ι ε w iff (v 1 , v 2 ) ∈ (w.S) ′ ι .
The goal of Sections 7.6 and 7.7 will be to prove that they corresponds on all types.

Some Examples

We now detail some examples of E τ (M 1 , M 2 ).

Awkward example

Let us first consider the so-called "awkward example":

M awk 1 = let x = ref 0 in λf.x := 1; f(); !x M awk 2 = λf.f(); 1 Its name come from the fact that the first notion of Kripke logical relations introduced by Pitts and Stark [START_REF] Pitts | Operational reasoning for functions with local state[END_REF] could not handle it, why their relations were complete. Indeed, they used worlds as fixed invariants on heaps, which couldn't evolve. But here, the state invariant which constrains x to point either to 0 or to 1 is not enough to deduce that the first program returns 1.

The formula E (Unit → Unit) → Int n e (M awk 1 , M awk 2 ), once simplified with uninterestingly clauses, is equal to:

SOME EXAMPLES

203

H n 0 . N1 l 1 .X (l 1 ֒→ 1 0) ∧ P pub (n 0 ) ∧ H n 2 .X((l 1 ֒→ 1 1)∧ pub (∀x 4 .((l 1 ֒→ 1 x 4 ) ⇒ X((l 1 ֒→ 1 x 4 ) ∧ (x 4 = 1)) ∧ P pub (n 2 ))))

The formula imposes that there is a transition from the initial state to state with l 1 ֒→ 0 and P pub (n 0 ) forces the transition to be public. In the same way, it forces to have a public transition to another state where l 1 ֒→ 0. Finally, one need to check that for every public future, one can reach a state where l 1 ֒→ 0. This is easily satisfied by the world

h ′ i (l 1 ) = 0 h ′ i (l 1 ) = 1
Note that here, we do not really use Hoare-style transitions, because the example already works with an STS.

Hoare-style Worlds

We now consider callback with lock example (taken from [START_REF] Ahmed | State-dependent representation independence[END_REF]) that compares two encoding of a counter object: Using an STS approach, two states are needed for each natural number stores in the location x, to keep track of the increment of the counter [START_REF] Dreyer | The impact of higher-order state and control effects on local relational reasoning[END_REF]. To solve this issue, we use a label transition system (LTS) approach in order to use Hoare-style description of the heap-relating heaps before the transition (noted h 1 , h 2 ) to heaps after the transition (noted h ′ 1 , h ′ 2 ):

h ′ i (x) = 0 h ′ i (b) = false h ′ i (x) = h i (x) + 1 h ′ i (b) = true h ′ i (x) = h i (x) h ′ i (b) = false h ′ i (x) = h i (x) + 1 h ′ i (b) = true

Name Disclosure

We now consider the following example adapted from the ν-calculus. To simplify the formula, all mentions to public transition have been omitted because it simply forces every transition to be public. The locations l 1 and l 2 represent the location c passed by the context. The location l 3 is the location x and the locations l 4 and l 5 represents the location y passed by the context. This formula is satisfiable because we cannot have l 3 = l 4 since we have Discl ref Int (l 4 , l 5 ) and l 3 is not disclosed. Here, the world has to be explicit on spans to validate the formula

P 1 P 2 P 1 P 1 P 3 with P 1 def = S ′ \ S = {(l 1 , l 2 , Int)} (l 1 , l 2 fresh) P 2 def = S ′ \ S = ∅ ∧ h ′ i = H lx i P 3 def = (S ′ \ S = ∅ ∧ h i = H lx i ∧ h ′ i = H l ′ x i ) ∨(S ′ \ S = ∅ ∧ h i = H l ′ x i ∧ h ′ i = H lx i ) where H lx i def = [l x i ֒→ l i ] ∧ [l i ֒→ x i ]
Note that the transition P 3 allows us to rebind the location l x i , thus performing some kind of local garbage collect to keep the world finite.

Checking that the formula is true is tedious. This leads us to the next section devoted to model checking. resulting formula. In that case, the program produces a Presburger formula which uses two abstract predicates to represent the transition functions (and their transitive closures) of the world. More precisely, it gives as output a formula written in SMT-LIB2, so that it can be checked, once a world is defined, by an SMT solver. In practice, we have performed our test with Z3.1 .

The program is also able, in some case, to build a world in Presburger arithmetic to check the validity of the formula. The algorithm is based on symbolic execution to compute the shape of the world. Using some heuristic, our program is also able to give the transitive closures of the transition functions for simple cases. Note that the correctness of the transitive closure is checked by a Presburger formula, so the correctness of our heuristics is not critical. It is also possible, as done in Algorithmic Game Semantics, to suppose that integers are bounded, so that the computation of the transitive closure becomes simpler.

The Haskell implementation is available at http://guilhem.jaber.fr/tlr/. Taking two terms, it outputs:

-the formula corresponding to the temporal logical relations, written in HeapTL, -the Presburger translation written in SMT-LIB2, -the world generated, -a definition of the world in SMT-LIB2. In some cases, as expected since the problem is undecidable in general, the world generated do not model-checked the formula. However, we have been able to prove many examples from the literature. In the Section 7.9 we give as an example the code generated for the awkward example, both for the world and the translation of the temporal formula. More examples can also be found on http://guilhem.jaber.fr/tlr/.

From Temporal to Concrete Logical Relations

We now prove the soundness of temporal logical relations w.r.t. contextual equivalence. To do so, we simply relate it to concrete logical relations, to import the soundness proved in the previous chapter.

First, we state that every possible operational reduction can be simulated with a symbolic execution.

Lemma 53: Let M a ground-closed term, h a heap such that ν L (M ) ⊆ dom(h) and (M, h) → * (M ′ , h ′ ) with M ′ irreducible. Then taking H pre a fresh symbolic heap closed for h, there exists a symbolic execution (M ′′ , H post , C) ∈⇓ (M, H pre ) and a substitution α on FV(H pre , C, H post ) such that α is not aliased on dom(H post )\dom(H pre ), α(C) is valid, h = α(H pre ) and h ′ = α(H post ). Moreover, if M ′ is equal to Proof The proof is done by induction on the length of (M, h) → * (M ′ , h ′ ). When this length is 0, i.e. (M, h) = (M ′ , h ′ ), we simply define α as α(h(l)) = h(l) for all l ∈ dom(h). The induction step is simply done using Lemma 51.

K[f v] then M ′′ = K ′ [f v ′ ] with K = α(K ′ ) and v = α(v ′ ). Otherwise, M ′ is equal to v, then M ′′ = v ′ with v = α(v ′ ).
Lemma 54: Suppose that (M ′ , H post , C) ∈⇓ (M, H pre ) such that there exists a substitution α on FV(H pre , C, H post ) such that α(C) is valid. Then for all injection ρ on ν L (α(H post ))\ν L (α(H pre )), ρ(α(C)) is valid.

Proof The only constraints on locations generated by the symbolic reduction are equalities and inequalities, whose validity is conserved by injections. . Thus, (α(H 1 ), α(H 2 ), D) : w. Lemma 57: Suppose W |= A α(V τ e (v 1 , v 2 )) with α a substitution on FGV(v 1 , v 2 ). Then W |= A V τ e (α(v 1 ), α(v 2 )).

Lemma 58: Suppose W |= A α(K σ, τ n e (K 1 , K 2 )) with α a substitution on FGV(K 1 , K 2 ). Then W |= A E τ n e (α(K 1 ), α(K 2 )). Lemma 59: Suppose W |= A α(E τ n e (M 1 , M 2 )) with α a substitution on FGV(M 1 , M 2 ). Then W |= A E τ n e (α(M 1 ), α(M 2 )). Proof The three lemmas are proved by a mutual induction on type and on the number of ground callbacks of terms considered. It is straightforward using the fact that substitutions go through logical connectives. The only case which is not direct is the generation of all the S i ∈⇓ (M i , H i ) in the definition of E τ n e (M 1 , M 2 ). In this case, we simply use the fact that ⇓ (α(M i ), α(H i )) is included in α(⇓ (M i , H i )), since some rules which where non-deterministic because of the variables become deterministic. Then, using an induction on types and on the number of ground callbacks, we can prove that when two terms are in temporal logical relation for a given world then they are in concrete logical relation for class of worlds obtained by permuting location of the initial world. A similar result holds for values and contexts.

Theorem 43 (Soundness for Values): Let v 1 , v 2 two ground-closed values with e a relational environment for them, and (w, κ, n) a world with history. If (w, κ, n) |= A V τ e (v 1 , v 2 ), then (v 1 , v 2 ) ∈ V A τ e w.

Theorem 44 (Soundness for Contexts): Let K 1 , K 2 two ground-closed contexts and e a relational environment for them, and (w, κ, n) a world with history. suppose that (w, κ, n) |= A K τ, σ m e (K 1 , K 2 ), then, writing w 0 for (w.A, κ(m)), we have (K 1 , K 2 ) ∈ K A τ, σ e (w, w 0 ).

Theorem 45 (Soundness for Terms): Let M 1 , M 2 two ground-closed terms and e a relational environment for them, and (w, κ, n) a world with history. suppose that (w, κ, n) |= A E τ m e (M 1 , M 2 ), then, writing w 0 for (w.A, κ(m)), we have (M 1 , M 2 ) is in E A τ e (w, w 0 ).

Proof The three theorems are proved by a mutual induction on types and on the number of ground callbacks of the considered terms.

Proof (Soundness for Values) By case analysis on τ : -When τ is ground, we get the result from theorem 42.

-When τ = ι → σ, suppose (w, κ, n) |= A V ι → σ e (v 1 , v 2 ). Let w 1 ⊒ * w, κ 1 = κ • (n ֒→ (w.s, w.h 1 , w.h 2 , w.S)) and W 1 = (w 1 , κ 1 , n + 1), so from the hypothesis we get the existence of w 2 ⊒ F ι pub w 1 . Then, taking (u 1 , u 2 ) ∈ V A ι e w 2 , from theorem 42, we get that W 2 |= A V ι e (u 1 , u 2 ) where W 2 = (w 2 , κ 2 , n + 2), κ 2 = κ 1 • (n + 1 ֒→ (w 1 .s, w 1 .h 1 , w 1 .h 2 , w 1 .S)). So from the hypothesis, we know that W 2 |= A E σ n+2 e (v 1 u 1 , v 2 u 2 ). Then, using the induction hypothesis (v 1 u 1 , v 2 u 2 ) ∈ E A σ e (w 2 , w 2 ).

-When τ = σ → σ ′ , suppose (w, κ, n) |= A V σ → σ ′ e (v 1 , v 2 ). Let w 1 ⊒ * w, κ 1 = κ • (n ֒→ (w.s, w.h 1 , w.h 2 , w.S)) and W 1 = (w 1 , κ 1 , n + 1), so from the hypothesis we get the existence of w 2 ⊒ F pub w 1 s.t.

W 2 |= A E σ ′ n+1 e•(y 1 ,y 2 ,σ) (v 1 y 1 , v 2 y 2 )
with y 1 , y 2 fresh in e. Using the induction hypothesis we get that (v 1 y 1 , v 2 y 2 ) ∈ E A σ ′ e•(y 1 ,y 2 ,σ) (w 2 , w 2 ).

Proof (Soundness for Contexts) By case analysis on τ -When τ = ι, suppose (w, κ, n) |= A K ι, σ m e (K 1 , K 2 ). Let w 1 ⊒ * w, κ 1 = κ • (n ֒→ (w.s, w.h 1 , w.h 2 , w.S)) and W 1 = (w 1 , κ 1 , n + 1), so from the hypothesis we get the existence of w 2 ⊒ F ι pub w 1 . Then, taking (u 1 , u 2 ) ∈ V A ι e w 2 , from theorem 42, we get that W 2 |= A V ι e (u 1 , u 2 ) where W 2 = (w 2 , κ 2 , n + 2), κ 2 = κ 1 • (n + 1 ֒→ (w 1 .s, w 1 .h 1 , w 1 .h 2 , w 1 .S)). So from the hypothesis, we know that W 2 |= A E σ n+2 e (K 1 [u 1 ], K 2 [u 2 ]). Then, using the induction hypothesis

(K 1 [u 1 ], K 2 [u 2 ]) ∈ E A σ e (w 2 , w 2 ).
-When τ is of functional type " suppose (w, κ, n) |= A K τ, σ m e (K 1 , K 2 ). Let w 1 ⊒ * w, κ 1 = κ • (n ֒→ (w.s, w.h 1 , w.h 2 , w.S)) and W 1 = (w 1 , κ 1 , n + 1), so from the hypothesis we get the existence of w 2 ⊒ F pub w 1 s.t.

W 2 |= A E σ n+1 e•(x 1 ,x 2 ,σ) (K 1 [x 1 ], K 2 [x 2 ])
Using the induction hypothesis we get that

(K 1 [x 1 ], K 2 [x 2 ]) ∈ E A σ e•(
• β i • α post i α ′ i )(C i ) is valid (indeed ρ i • α i = α ′ i ).
Thus, using again the hypothesis W |= A E τ n e (M 1 , M 2 ), we get the existence of a world w 1 ⊒ w s.t. defining κ 1 = κ • (n ֒→ (w.s, w.h 1 , w.h 2 , w.S)) and W 1 = (w 1 , κ 1 , n + 1), we have

W 1 |= A α ′ (↑ 1 (H post 1 )∧ ↑ 2 (H post 2 ) ∧ H post 1 D ∼ H post 2 ). Moreover, ρ i (h ′ i ) = α ′ i (H post i ) and ρ i (M ′ i ) = α ′ i (M ′′ i ). -If both M ′ i = K i [f i v i ], we have M ′′ i = K ′ i [f i v ′ i ] with K i = α i (K ′ i ) and v i = α i (v ′ i ).
Then, from (w, κ, n) |= A E τ n e (M 1 , M 2 ) we get that -there exists a functional type σ → σ ′ such that (f 1 , f 2 ) ∈ e σ→σ ′ Theorem 48 (Completeness for Terms): Let W = (w, κ, n) a world with history, M 1 , M 2 two ground-closed terms, e an environment for M 1 , M 2 . Suppose w 0 = (w.A, κ(m)), if (M 1 , M 2 ) ∈ E A τ e (w, w 0 ) then W |= A E τ m e (M 1 , M 2 ).

Proof Proof (Completeness for Values) By case analysis on τ -When τ is ground, we get the result from theorem 42.

-When τ = ι → τ ′ , from the hypothesis we get that for all w 1 ⊒ w there exists w 2 ⊒ F ι pub w 1 s.t. for all (u 1 , u 2 ) ∈ V A ι e w 2 , (v 1 u 1 , v 2 u 2 ) ∈ E A τ ′ e (w 2 , w 2 ). We define W 1 = (w 1 , κ 1 , n + 1) and W 2 = (w 2 , κ 2 , n + 2), where κ 1 = κ • (n ֒→ (w.s, w.h 1 , w.h 2 , w.S)) and κ 2 = κ 1 • (n + 1 ֒→ (w 1 .s, w 1 .h 1 , w 1 .h 2 , w 1 .S)). Then, taking u 1 , u 2 two values of type ι s.t. W 2 |= A V ι e (u 1 , u 2 ), from theorem 42, we get that (u 1 , u 2 ) ∈ V A ι e w 2 . So from the theorem hypothesis, we know that (v 1 u 1 , v 2 u 2 ) ∈ E A τ ′ e (w 2 , w 2 ), and from the induction hypothesis on terms, we get that W 2 |= A E τ ′ n+2 e (v 1 u 1 , v 2 u 2 ).

-When τ = σ → τ ′ with σ not ground, from the hypothesis we get that for all w 1 ⊒ w there exists w 2 ⊒ F pub w 1 s.t. (v 1 y 1 , v 2 y 2 ) ∈ E A τ ′ e•(y 1 ,y 2 ,σ) (w 2 , w 2 ). We define W 1 = (w 1 , κ 1 , n + 1) and W 2 = (w 2 , κ 2 , n + 2), where κ 1 = κ • (n ֒→ (w.s, w.h 1 , w.h 2 , w.S)) and κ 2 = κ 1 • (n + 1 ֒→ (w 1 .s, w 1 .h 1 , w 1 .h 2 , w 1 .S)). Then from the induction hypothesis on terms, we get that ). So from the hypothesis (M 1 , M 2 ) ∈ E A τ e (w, w 0 ), we get the existence of two injections ρ i : (dom(h ′ i )\dom( h i )) ∈ Loc (since dom( h ′ i )\dom( h i ) = dom(h ′ i )\dom( h i ), and a world w 1 ⊒ w such that (ρ -1

W 2 |= A E τ ′ n+2 e•(
1 • h ′ 1 , ρ -1 2 • h ′ 2 , (ρ -1 1 × ρ -1
2 ) • D ′ ) : w 1 . Then, defining α ′ i as ρ -1 i • α i , we get from lemma 54 that α ′ i (C i ) is also valid. Thus, we instantiate the fresh names quantifiers with the locations in α ′ (dom(H post i )\dom(H pre i )), which are fresh since α is not aliased on on dom(H post i )\dom(H pre i ) and ρ -1 i is a bijection. So, using using lemma 55,

W 1 |= A α ′ (↑ 1 (H post 1 )∧ ↑ 2 (H post 2 ) ∧ H post 1 D ∼ H post 2 )
where W 1 = (w 1 , κ • n ֒→ (w.s, w.h 1 , w.h 2 ), n + 1). Then, -If both M ′′ i are equal to some K ′ i [f i v ′ i ], then K ′ i = α(K) and v ′ i = α(v). So using the fact that (M 1 , M 2 ) ∈ E A τ e w, w 0 , we get that (f 1 , f 2 ) ∈ e σ→σ ′ with (ρ -1

1 •v ′ 1 , ρ -1 2 •v ′
2 ) ∈ V A σ e w 1 and (ρ -1 1 (K ′ 1 ), ρ -1 2 (K ′ 2 )) ∈ K A σ ′ , τ e (w 2 , w 0 ). Thus, the induction hypothesis gives us that W 1 |= A V σ e (α ′ (v 1 ), α ′ (v 2 )) ∧ K σ ′ , τ n e (α ′ (K 1 ), α ′ (K 2 )) and using lemma 59 we get that W 1 |= A α ′ (V σ e n(v 1 , v 2 ) ∧ K σ ′ , τ n e (K 1 , K 2 ). -If both M ′′ i are to equal to some v ′ i , then v ′ i = α(v i ), and with the same reasoning we prove that W 1 |= A α ′ (V σ e (v 1 , v 2 ). And from (M 1 , M 2 ) ∈ E A τ e (w, w 0 ) we get that w 1 ⊒ pub w 0 , so W 1 |= A P pub (m) since κ(m) = w 0 .

Corollary 8: Let M 1 , M 2 two terms such that Σ; Γ ⊢ M 1 , M 2 : τ . Then Σ; Γ ⊢ M 1 ≃ clog M 2 : τ implies Σ; Γ ⊢ M 1 ≃ llog M 2 : τ .

Discussion

Finally, we can state the soundness and completeness of temporal logical relations w.r.t. contextual equivalence:

Theorem 49: Let M 1 , M 2 two terms such that Σ; Γ ⊢ M 1 , M 2 : τ . Then Σ; Γ ⊢ M 1 ≃ ctx M 2 : τ iff Σ; Γ ⊢ M 1 ≃ llog M 2 : τ .

To achieve this result, we have used four intermediate layers:

-Nominal Game Semantics, via the work of Murawski and Tzevelekos [START_REF] Murawski | Game semantics for good general references[END_REF], -Trace Semantics, presented in Chapter 5, -Kripke Trace Semantics, presented in Section 6.3, -Concrete Logical Relations, presented in Chapter 6. It would have been possible to avoid the use of nominal game semantics, since Laird had already proved [START_REF] Laird | A fully abstract trace semantics for general references[END_REF] the full abstraction for a similar model of our trace semantics. However, we have preferred to establish a link between trace and game semantics since there is now an important literature on game models for various languages, that we can import following our approach. It would be particularly interesting to extend this work to universal and existential types. This would allow us to apply standard methods to derive parametricity and representation independance from logical relations, following the seminal work of Reynolds [START_REF] Reynolds | Types, abstraction and parametric polymorphism[END_REF].

An other possibility is to reason on terms with recursion, via a marriage between guarded recursive types and temporal logic. Indeed, the Löb rule is particularly appropiate to reason on recursion. However, to achieve some model-checking or decidability results in this setting seems uncertain.

Figure 3 . 1 :

 31 Figure 3.1: MLTT U Type System: Contexts, Universes, Dependent Products

Figure 3

 3 Figure 3.2: MLTT U Type System: Identity Types

Figure 3

 3 Figure 3.3: MLTT U Type System: Dependent Sums

Figure 3 . 4 :

 34 Figure 3.4: MLTT U Type System: Empty and Unit Types

Figure 3 . 7 :

 37 Figure 3.7: MLTT U Type System: Natural Numbers

Theorem 2 :

 2 Suppose Γ ⊢ e M : T , then |Γ| ⊢ |M | : |T |. Theorem 3: Suppose Γ ⊢ M : T , then there exists Γ e , M e , T e a context and two terms of MLTT e U such that -|Γ e | = Γ, |M e | = M and |T e | = T , -Γ e ⊢ e M e : T e .

Figure 3 . 9 :

 39 Figure 3.9: Typing Rules of RefML

4. 4 . 2

 42 Forcing equalities on the new constructors . . . . . . . . . . . . 98 4.4.3 General recursive types . . . . . . . . . . . . . . . . . . . . . . 98 4.4.4 Simple Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 99 4.4.5 A more complex example: the pure λ-calculus . . . . . . . . . . 100 4.5 Forcing the Negation of the Continuum Hypothesis . . . . . . 101 4.5.1 Building the injection i 2 . . . . . . . . . . . . . . . . .

Figure 4 .

 4 Figure 4.1: Definition of the Forcing Translation (I/II)

Figure 4 . 2 :

 42 Figure 4.2: Definition of the Forcing Translation (II/II)

=

  unfold U (λT : U.T → T )f and defunf def = fold U (λT : U.T → T )f.

==

  Nat → (P p → Prop) while P(Nat) σ p def Nat → Prop.

Definition 11 (

 11 Product Value-Arena). Let A, B two Value-Arenas, we define the Value-arena A ⊗ B as the triple (M A⊗B , I A ⊗ B, λ A⊗B , ⊢ A⊗B ) where -I A⊗B def = ((l

  t. (a, r • ξ) is a moves of s, and where we add pointers from moves m ∈ M C to m ′ ∈ M A if there exists a move n = (a, l • r • ξ) of s s.t. r • m points to n and n points to l • m ′ in s. Notice that s |AB (resp. s |BC , s |AC ) is a justified sequence of A → B (resp. B → C, A → C), so that the labeling function of their moves are supposed to be taken in these term-arenas, and not in A → B → C. We can now define the set of interaction sequences Interact(A, B, C) on A, B, C as the justified sequences s over A → B → C which are well-bracketed and which satisfy s |AB ∈ P A→B , s |BC ∈ P B→C and s |AC ∈ P A→C . The parallel composition of two strategies is then simply defined as the set of interaction sequences over Interact(A, B, C) whose respective restrictions on AB and BC are in the corresponding strategies. Definition 19 (Parallel Composition of strategies). Given two strategies υ and κ respectively on the arenas A → B and B → C, we define their parallel composition on the arena A → B → C, written υ||κ as the set {s ∈ Interact(A, B, C) | s |AB ∈ υ and s |BC ∈ κ}. Notice that the sequentiality between υ and κ in the definition of υ||κ is imposed by the fact that only initial moves (that is player answers) of B can justify initial moves of C in the definition of A → B → C. We can now define the composition of strategies by simply hiding the moves occurring in the value-arena B. Definition 20 (Composition of strategies). Given two strategies υ and κ respectively on the arenas A → B and B → C, we define the composed strategy υ; κ on the arena A → C, as the set {s |AC | s ∈ υ||κ}.

  Taking an arena A and a strategy υ : B → C, we define the left identity pairing (A ⊗ υ) : A ⊗ B → A ⊗ C as the strategy formed by the plays {s ∈ P A⊗B→A⊗C | s |BC ∈ υ and s |AA ∈ id A }. The right identity pairing (υ ⊗ A) : B ⊗ A → C ⊗ A is defined dually. Then, taking two strategies υ : A → B and κ : C → D, we define their left pairing, written υ ⊗ l κ : A ⊗ C → B ⊗ D as (υ ⊗ C); (B ⊗ κ).

Figure 5 . 1 :

 51 Figure 5.1: Definition of compound arenas

  We define the set of available locations of a trace T , written Av(T ), as Av(ε) def = ∅ and Av(T • (a, h)) def = h * (Av(T ) ∪ ν L (a)), where h * (S) def = j≤0 h j (S) with h 0 (S) def = S and h j+1 (S) def = h(h j (S)) ∩ Loc.

  iff for all γ g : Γ g → Val, for all h ∈ Cl(Σ), Tr γ g (M 1 ), ε, I, h, D ≃ D ε, Γ f Tr γ g (M 2 ), ε, I, h, D where I = ν P (Γ f ) ∪ codom(h fn ), D = dom(h) and D = D.

Theorem 13 :

 13 The trace-strategy [x : τ ⊢ x : τ ] is equal to id [τ ] . Proof If τ is equal to Unit, Bool or Int, then the result is straightforward. If τ is equal to ref σ, then taking T ∈ [x : ref σ ⊢ x : ref σ] there exists a location l ∈ Loc σ Definition 29.

  ,[τ ] ([Γ, x : σ ⊢ M : τ ]) are strongly-single threaded plays which are, by construction of L [σ] [Γ],[τ ] , in [Γ ⊢ λx.M : σ → τ ]. We prove the reverse inclusion. Let us decompose Γ into Γ g , Γ f , and let γ : Γ g → Val.

  and z and codom(h ′ fn ) are fresh player name pointers. We reason by induction on the size of T ′ . If |T | = 0, then by definition of L [σ]

Let

  A, B, C three trace value-arenas, we define the term-arena A → B → C def = (M A→B→C , I A→B→C , ⊢ A→B→C ) where:

  we define the following restricted traces: -T |(A,B) is defined as the traces formed by the actions of T in M A→B \I B plus the player answers ( ū , h) ∈ I B for every player question ( ? u , h) of T , -T |(B

Figure 5 . 4 :

 54 Figure 5.4: Definitions of the callback structure

  2 . Then, we reason by case analysis on σ -If σ = Int, then e 2 O,1 = e 1 O,1 and we define u 2 as u 1 and e 2 O as e 1 O . -If σ is of functional type, then u 1 is an opponent name pointer x 1 and e 2 O,1 = e 1 O,1 • (x 1 , σ). Then, taking x 2 an opponent name pointer not in e 1 O,2 , we define e 2 O as e 1

Figure 5 . 5 :

 55 Figure 5.5: Definition of Symbolic Execution

Figure 5 . 6 :

 56 Figure 5.6: Definitions of the symbolic callback structure

Figure 5 .

 5 5 with the operational reduction of Figure 3.8. Lemma 21: Let M a term such that M → * M ′ . Then there exists a set of Presburger constraint C and a substitution α : FV

  ι j ranges over subtype(ι)}. We define subtype(ι) as subtype(Unit) = ∅, subtype(Bool) = ∅, subtype(Int) = ∅, -and subtype(ref ι) = {ref ι} ∪ subtype(ι).

Figure 6 .

 6 Figure 6.2: Definition of Concrete Logical Relations for RefML

Lemma 31 :

 31 Let C, C ′ two configurations and U a trace s.t. C U -→ C ′ and ρ : X ֒→ Loc with X ⊆ ν L (C) an injection. Then there exists ρ ′ which extends ρ s

Lemma 39 :

 39 Let e p , e O two spans respectively on player and opponent name pointers. and (γ 1 , γ 2 ) ∈ G A e P e O w. Then [•] ≃ (γ 1 ,γ 2 ),w e P ,e O [•].

  Figure 7.1: Kripke Semantics of the Temporal Symbols

  aliased on dom(H ′ )\dom(H) and α(C ′ ) is valid. Consider h : α(dom(H)) → Val a heap s.t. α(H(α(u))) = h(α(u)) for all u ∈ dom(H). Then there exists an injection ρ : α(dom(H post )\dom(H pre )) ֒→ Loc such that :-(α(M ), h) → (ρ(α(M ′ )), h ′ ) -α((H ′ (u))) = h ′ (ρ(α(u))) for all u ∈ dom(H ′ ).Proof By case analysis on(M, H, C) → s (M ′ , H ′ , C ′ ) : -If (M, H) → (M, H), then (α(M ′ ), H) → (α(M ), H). -If M = K[x + y] then (M, H, C) → s (K[z], H, C ∧ z = x + y]) with z fresh. Then, from the fact that α(z) = α(x) + α(y) is valid, we have (α(M ), h) → (α(M ′ ), h). -If M = K[!u], (M, H, C) → s (K[H(u)], H, C]). Then (α(M ), h) → (α(K)[h(α(u)], h),and we conclude using the equality α(H(α(u))) = h(α(u)). -If M = K[ref v] then (M, H, C) → s (K[y], H • (y ֒→ v), C) with y fresh. Moreover, (α(M ), h) → (α(K)[l], h • [l ֒→ α(v)]) with l / ∈ dom(h). Then, defining ρ as α(y) ֒→ l, we get that ρ(α(K[y])) = α(K)[ρ(α(y))] since α is not aliased on FLV(H ′ ), so α(y) / ∈ ν L (K) since y is fresh in K. Then, α(K)[ρ(α(y)] is indeed equal to α(K)[l]. Moreover, α(H ′ (y)) = α(v) and h ′ (ρ(α(y))) = h ′ (l) = α(v). -If M = K[u := v],from the fact that α(C) is valid, we get that the only set containing all the locations aliased tou is L = {u ′ | α(u) = α(u ′ )}. Then (K[u := v], H, C) → s (K[()], H ′ , C ′ ) with H ′ = H |dom(H)\dom(L) • ----→ u i ֒→ v and C ′ = C ∧ ----→ u i = u ∧ ----→ u ′ j = u)with -→ u i ranges over L and -→ u j ′ ranges over dom(H) \ dom(L). Thus, (α(M ), h) → (α(K)[()], h[α(u) → α(v)]) and for all u ′ ∈ L, h ′ (α(u)) = α(v) and α(H ′ (u)) = α(v).

Figure 7 . 3 :

 73 Figure 7.3: Definition of Temporal Logical Relations

M cbl 1 =

 1 C [f(); x :=!x + 1] M cbl 2 = C [let n =!x in f(); x := n + 1] where C = let b = ref true in let x = ref 0 in (λf.if !b then b := false; • ; b := true else (), λ .!x)

M nd 1 = 2 =

 12 λc. let x = ref c in λy. x == y M nd λc. let x = ref c in λy. falseBoth terms are returning functions that always return false. But to know that, the world must explicitly know that x is private and thus can not be bound by the context to the variable y.The formulaE ref Int → ref (ref Int) → Int n e (M nd 1 , M nd 2 ) is equal to: X F ref Int pub ∀l 1 , l 2 .Discl Int (l 1 , l 2 ) ⇒ ( N1 l 3 .X((l 3 ֒→ 1 l 1 )∧ X F ref ref Int pub (∀l 4 , l 5 .(Discl ref Int (l 4 , l 5 ) ⇒ (∀x 1 .(l 3 ֒→ 1 x 1 ) ⇒ X(l 3 = l 4 ) ∧ X((l 3 = l 4 ) ⇒ (l 3 ֒→ 1 x 1 )))))))

  In the definition above, a substitution α : A → Val is said to be not aliased on a subset B ⊆ A of locations variables iff for all b ∈ B, a ∈ A s.t. a = b, α(a) = α(b).

Lemma 60 :

 60 Let h 1 , h 2 two closed heaps, D, D ′ two spans and v 1 , v 2 two values s.t. D ′ i = discl(v i , h i , D i ). Let (w, κ, n) a world with history s.t. (w, κ, n) |= A h 1 D ∼ h 2 . Moreover, suppose that (w, κ, n) |= A v 1 D ∼ v 2 ι if v 1 , v 2 ∈ Loc ι . Then D ′ ⊆ w.S.

  . . . . . 102 4.5.2 Absence of surjections . . . . . . . . . . . . . . . . . . . . . . . 103 4.6 Discussion and Future Work . . . . . . . . . . . . . . . . . . . . 103 4.6.1 Topos of trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 4.6.2 Higher-Order Abstract Syntax . . . . . . . . . . . . . . . . . . 104

4.6.3 Presheaves models of HoTT . . . . . . . . . . . . . . . . . . . . 105 4.6.4 Forcing as a program transformation . . . . . . . . . . . . . . . 105 4.6.5 From presheaves to sheaves . . . . . . . . . . . . . . . . . . . . 105 4.6.6 Constructive Mathematics . . . . . . . . . . . . . . . . . . . . . 105

  But using the lifting next Tree , and the equality of Lemma 4, we can define a derived induction principle.The lifting next P : P → ⊲P (which gives a computational content to the rule Mono of Gödel-Löb logic) is now used on hypotheses to weaken the formula and get the usual induction principle Tree ′′ ind : ΠP : Tree → P rop, P ε → (Πn : Nat.Πt : Tree, P t → Πt ′ : Tree, P t ′ → P (node n t t ′ )) → Πt : Tree, P t 4.4.5 A more complex example: the pure λ-calculusLet us consider the generalized recursive type

	Tree ′

Tree ind : ΠP : Tree → P rop, P ε → (Πn : Nat.Πt : ⊲Tree, switch((nextP )t) → Πt ′ : ⊲Tree, switch((nextP )t ′ ) → P (node n t t ′ )) → Πt : Tree, P t ind : ΠP : Tree → P rop, P ε → (Πn : Nat.Πt : Tree, ⊲(P t) → Πt ′ : Tree, ⊲(P t ′ ) → P (node n t t ′ )) → Πt : Tree, P t

  When answering, Opponent can also provide new name pointers via the disclosed part of the heap. Those ones live in the disclosed part of h ′ fn , i.e. in codom(h ′ fn|D ′

h ′ |D ′ is closed and functional-free) Figure 5.2: Definitions of the interaction semantics name pointer.

  resp. in e P ) and either both v i are name pointers x i with (x 1 , x 2 ) in e P (resp. in e O ), or both v i are locations l i with (l 1 , l 2 ) ∈ D, or both v i are equal ground values. This equivalence is extended pointwisely on traces T 1 , T 2 , written T 1 ≃ D e P ,e O T 2 . Then, taking two sets of traces Tr 1 , Tr 2 , we define Tr 1 D e P ,e O Tr 2 (resp. Tr 1 D e P ,e O Tr 2 ) when for all T 1 ∈ Tr 1 (resp. T 2 ∈ Tr 2 ), there exists three spans e ′ P , e ′ O , D ′ extending respectively e P , e O and D and T 2 ∈ Tr 2 (resp. T 1 ∈ Tr 1 ) such that T 1 ≃ D ′

	e ′ P ,e ′

O T 2 . We write Tr 1 ≃ D e P ,e O Tr 2 when Tr 1 D e P ,e O Tr 2 and Tr 1 D e P ,e O Tr 2 .

  Let e P and e O two spans respectively on player and opponent name pointers, and γ 1 , γ 2 two substitutions whose domains are equal respectively to e P,1 , e P,2 , with γ 1 ≃ e P ,e O γ 2 . Let T i ∈ Tr ♦, γ i , e O,i such that T 1 ≃ e P ,e O T 2 and ♦, γ i , e O,i

	e ′ O i . 2 and S V τ e ′ O γ ′ P ,e ′ 1 ≃ e ′ O ⊒ e O such that γ ′ P ⊒ e P and e ′ Then there exists e ′ O,1 (v 1 ) ≃ e ′ O
	S V τ e ′ O,2 (v 2 ).
	Lemma 19: T i -→ ♦, γ ′ i , e ′ O,i . Then there exists e ′ P ⊒ e P and e ′ O ⊒ e O such that γ ′ 1 ≃ e ′ P ,e ′ O γ ′ 2 .

  for some fresh opponent name pointers y i , . Using the induction hypothesis on the first lemma, we get the existence of e 1 P ⊒ e P and e 2 O ⊒ e 1 O such that γ 1 1 ≃ e 1 Let e P , e O two spans respectively on player and opponent name pointers, and γ i : e P,i → Val two substitutions such that γ 1 ≃ e P ,e O γ 2 . Then Tr ♦, γ 1 , e O,1 ≃ e P ,e O Tr ♦, γ 2 , e O,2

	P ,e 2 O γ 1 2 . Then using the induction hypothesis on the second lemma, we can conclude, since we get the existence of e 2 P ⊒ e 1 P and e 3 O ⊒ e 1 O such that γ ′ 1 ≃ e 2 P ,e 3 O γ ′ 2 .
	Those two lemmas are used to prove that two equivalent substitution functions gen-
	erates two sets of equivalent traces.
	Lemma 20:
	such that and e 1	e 3 O,i

O = e O if σ is equal to Int, otherwise e 1 O = e O • (y 1 , y 2 , σ)

  using lemma 19, we get the existence of two spans e 2

	P and e 2 O extending e P and 2 . So applying the induction hypothesis, we get the existence of O γ 2 P ,e 2 1 ≃ e 2 O such that γ 2 e 1

  we get T 1 ≃ e P ,e O T 2 . Let us prove now the reverse implication. If Tr K 1 , γ 1 , e O,1 ≃ e P ,e O Tr K 2 , γ 2 , e O,2 we reason by case analysis on σ:

  e O,i . Thus there exists T 2 ∈ Tr K 2 [n], γ 2 , e O,2 such that T 1 ≃ e P ,e O T 2 . Using a symmetric reasoning, we get that Tr K 1 [n], γ 1 , e O,1 ≃ e P ,e O Tr K 2 [n], γ 2 , e O,2 . So using the induction hypothesis on terms, we get that

  e O [K 2 ], where γ ′ i = γ and e ′ P = e P if σ, the type of v i , is atomic, otherwise γ ′ i = γ i • (x i ֒→ v i ) and e ′ P = e P • (x 1 , x 2 , σ) for x 1 , x 2 fresh in e P . Then [M 1 ] ≃ γ,w e P ,e O [M 2 ].

  w ′ e P ,e O [K 2 ] with both lemma 30 and 29. -Otherwise, [ M i , γ i , e O,i , h i , D i ] is equal to

  n}}), we get the existence of such disjoints spans D 1 , . . . , D m . Thus, one can write (D ′ i \D i ) as a subset of j∈{1,...,m} D j .Finally, from (h 1 , h 2 , D) : w, we get that w = (h w 1 , h w 2 , D w ) with h i|D i ⊆ h w i and D = D w . So one can define w 1 as (h w 1 , h w 2 , D w ⊎ ( j∈{1,...,m} D j )). Let e P , e O two spans on name pointers, w a world, γ i two environments on e P,i and K i two applicative contexts. Taking (h 1 , h 2 , D) : w with h

	Lemma 34:

  .e. there exists two types σ, σ ′ s.t. (f 1 , f 2 ) ∈ e P,σ→σ ′ .

	-a span on locations D 1 ⊒ D,
	-an action (f 2 u 1 2 , h 1 2|D 1 2
	From lemma 35, we get the existence of:
	-a span on opponent name pointers e 1 O ⊒ e O ,

  span e 2 P which extends e P and whose projections are equal to dom(γ 2 i ), -a span e 2 O which extends e O and whose projections are equal to e 2 O,i , such that (ρ 1

  1|D 1 ∼ D h 2|D 2 and h i|D i = h i|D i so we define C i as M i , γ i , e O,i , h i , D i . Suppose that there exists two player actions c i , a span on player name pointers e 1 P ⊒ e P and a span on locations D 1 ⊒ D s.t. c 1 ∼ D 1

	e 1 P ,e O c 2 , and there exists two opponent configurations C 1 i s.t.
	C

( h 1 , h 2 , D) : w s.t. h 1 ∈ Cl(ν L (M i , γ i )), then h

  Moreover, defining A 2 as LtsEL,s

	A 1 ≥s 2 . Then, defining w 2 as (s 2 , h 2 1|D 2 1 that (w 2 , w 0 ) ∈ E A 2 τ γ 1 e 2 P ,e 2	, h 2 2|D 2 2	e 1 P ,e 2 O ,D 2 (C 2 1 , C 2 2 ), we have A 2 ≥s 2 = , D 2 ), the coinduction hypothesis gives us

O (K 1 [x 1 ], K 2 [x 2 ]) Finally, w 2 ⊒ F

pub w and, using lemma 41, (w 2 , w 0

  w e P ,e O [v 2 ]. Then for all w 1 ⊒ * w there exists two spans e 1 P ⊒ e P and e 1 O ⊒ e O , and two substitutions γ 1 i whose domain is e 1 P,i and which extend γ i such that -if σ is atomic, there exists w 2

  w,γ e P ,e O [K 2 ]. Then for all w 1 ⊒ * pub w there exists two spans e 1 P ⊒ e P and e 1 O ⊒ e O , and two substitutions γ 1 i whose domain is e 1 P,i and which extend γ i such that -if σ is atomic, then there exists w 2

  2 , h 2 , D 2 ] s.t. T 1 ≃ D e P ,e O T 2 . Then, due to the determinism of interactive reduction w.r.t. a trace, we can write T 2 as U 1 2

  Lemma 47: Let (M 1 , M 2 ) a pair of ground-closed terms, e O a span on their name pointers e P a span on player name pointers and γ i : e P,i → Val two substitutions. We consider a world (w, w 0

e O [ ♦, γ i , e O,i , h i , D i ]

where e ′ P = e P • (x 1 , x 2 ), due to the fact that γ i (f i ) is by definition already in γ i .

  not ground , x 1 / ∈ e 1 , x 2 / ∈ e 2 ) : ι i , (w, ε, 1) |= A E τ 1

	E τ n e (M 1 , M 2 )	i ) S i ∈⇓(M i ,H pre	(↑ 1 (H pre 1 )∧ ↑ 2 (H pre 2 ) ∧ H pre 1	D ∼ H pre 2 ) =⇒ Rel n e,τ (S 1 , S 2 )
	Σ; Γ

def = ∀ x. f , Γ g ⊢ M 1 ≃ llog M 2 : τ def = ∃S ⊆ Int, ∃A ∈ LTS S , ∃s ∈ S, ∀h ∈ Cl(Σ),

∀ ---→

x i

  Lemma 55: Let (h 1 , h 2 , D) : w and H 1 , H 2 two symbolic heaps with α a substitution onFV(H 1 , H 2 ). Then if h i = α(H i ), we have W |= A α(↑ 1 (H 1 )∧ ↑ 2 (H 2 ) ∧ H 1 D ∼ H 2 ) where W = (w, κ, n). = w.h i and dom(h pub i ) = D i . Then, for all l → i v in α(↑ i (H i )), if l ∈ dom(h priv i ), we have w.h i (l) = h(l) = v so W |= A l → i v. Otherwise, W |= A l → i v is trivial. Finally, by definition of (h 1 , h 2 , D) : w, h pub Lemma 56: Let H 1 , H 2 two symbolic heaps with α a substitution on FV(H 1 , H 2 ). If (w, κ, n) |= A α(↑ 1 (H 1 )∧ ↑ 2 (H 2 ) ∧ H 1 D ∼ H 2 )then there exists a span D on location such that (α(H 1 ), (α(H 2 ), D) : w. D i ⊆ (w.S) i . From (w, κ, n) |= A α(↑ i (H i )) we get that h priv i = w.h i . And from (w, κ, n) |= A α(H 1

	Proof We first decompose h i into h priv i	• h pub i	with h priv i
	1	∼ h pub 2	so W |= A H 1	D ∼ H 2 .
	Proof We first decompose α(H i ) into h priv i	• h pub i	with h pub i	closed and dom(h pub i ) =

D ∼ H 2 ) we get that h pub 1 ∼ w.S h pub 2

  x 1 ,x 2 ,τ ) (w 2 , w 2 ).Using this with the hypothesis W |=A E τ n e (M 1 , M 2 ) we get two substitution β L i : L i → Loc such that α post i • β L i is not aliased on L i . Define an injection ρ i : dom(α i (H post ))\dom(α i (H pre )) ֒→ Loc as β i • (α L i ) -1 .Then, from the fact that α i (C i ) is valid and lemma 54, we get that ρ i (α i (C i )) is valid, i.e. (α pre i

	i )\dom(H pre i ), we can decom-) which are not i on L i and α post i ) Writing L i for dom(H post )\dom(H pre i pose α i into three substitutions α pre aliased on dom(H post i i on FV(H pre i ), α L i on FV(C)\(FV(H pre i )∪ L. Then, h i = α pre i (H pre

Proof (Soundness for Terms) Let

(h 1 , h 2 , D) : w s.t. h i ∈ Cl(ν L (M i )) and suppose M i , h i , D i → M ′ i , h ′ i , D ′ i .

Then from Lemma 53, we get two symbolic execution

(M i , H pre i ) → * s (M ′′ i , H post i , C i )

and two substitution α i on FV(H pre i , C i , H post i ), so writing α pre for α pre 1 • α pre 1 (we can suppose that FV(H pre 1 ) and FV(H pre 2 ) are disjoint), we get from lemma 55 that

(w, κ, n) |= A α pre (↑ 1 (H pre 1 )∧ ↑ 2 (H pre 2 ) ∧ H 1 D ∼ H 2 )

  y 1 ,y 2 ,σ) (v 1 y 1 , v 2 y 2 ). pre i ), and suppose that, writing α pre for α pre 1 • α pre 2 , we have W |= A α pre ((↑ 1 (H pre 1 )∧ ↑ 2 (H pre Then defining h i as α pre i (H pre i ) and writing D i for (w.S) i ∩ dom(h i ), we get using lemma 56 that (h 1 , h 2 , D) : w. So, from lemma 61, we get that there exists -a substitutionα post i a substitution on FV(H pre 1 , H pre 2 ) -an interactive reduction M i , h i , D i → M ′′ i , h ′ i , D ′ ) is valid and α i is not aliased on ν L (H post i )\ν L (H pre i ). Let consider two heaps h pub i of domain (w.S) i \dom(h i ) s.t. h pub 1 ∼ w.S h pub 2 . Then, writing h i for h i • h pub i and D for D ∪ dom(h pub i ) (i.e. D = (w.S) i , we have (h 1 • h pub 1 , h 2 • h pub 2 , w.S) : w and M i , h i , D i → M ′′ i , h ′ i , D ′

	Proof (Completeness for Terms) Let H pre 1 , H pre 2 spectively M 1 , M 2 , and (M ′ i , H post	two fresh symbolic heaps for re-
	H pre 1	D ∼ H pre 2 )). i	where h ′ i = h ′ i • h pub i	2 ) ∧ i = D ′ and D ′ i ∪
	dom(h pub i

i , C i ) ∈⇓ (M i , H pre i ). Let α pre i a substitution on FV(H i such that, writing α i for α pre i • α post i , h ′ i = α i (H post i

) and α i (C i

un λ-calcul simplement typé avec entiers naturels et récursion

"bonne" s'oppose ici aux "bad-variables" qui proviennent de la représentation sous forme d'objets des références, inspirée par les travaux sur Idealized Algol par Reynolds.

Notons que, comme prouvée dans[START_REF] Murawski | Functions with local state: regularity and undecidability[END_REF][START_REF] Murawski | Algorithmic games for full ground references[END_REF], l'équivalence contextuelle est en général indécidable pour un langage avec références, même en absence de récursion ou de types de donnés infinis.

À notre connaissance, les relations logiques sont toujours définies sur des termes clos. Cela aurait pu justifier un choix de nom différent pour notre technique.

a simply-type λ-calculus with natural numbers and recursion

Σ-Univ Γ ⊢ T : U i Γ, x : T ⊢ U : U i Γ ⊢ Σx : T.U : U i Σ-Intro Γ ⊢ M : T Γ ⊢ N : U {M/x} Γ ⊢ M, N (x:T )U : Σx : T.U Proj-1 Γ ⊢ M : Σx : T.U Γ ⊢ π 1 M : T Proj-2 Γ ⊢ M : Σx : T.U Γ ⊢ π 2 M : U {π 1 M/x} Conv-Proj1

CHAPTER 3. PRELIMINARIES+-Univ Γ ⊢ T : U i Γ ⊢ U : U i Γ ⊢ T +U : U i +-IntroL Γ ⊢ T : U i Γ ⊢ U : U i Γ ⊢ M : T Γ ⊢ inl(M ) : T +U +-IntroR Γ ⊢ T : U i Γ ⊢ U : U i Γ ⊢ M : U Γ ⊢ inr(M ) : T +U +-Elim Γ, z : T +U ⊢ V : U i Γ, x : T ⊢ M l : V {inl(x)/z} Γ, y : U ⊢ M r : V {inr(y)/z} Γ ⊢ N : T +U Γ ⊢ ind + ((z:T+U)V, (x:T )M l , (y:U )M r , N ) : V {N/z} +-ConvL Γ, z : T +U ⊢ V : U i Γ, x : T ⊢ M l : V {inl(x)/z} Γ, y : U ⊢ M r : V {inr(y)/z} Γ ⊢ N : T Γ ⊢ ind + ((z:T+U)V, (x:T )M l , (y:U )M r , inl(N )) ≡ M l {N/x} : V {inl(N )/z} +-ConvR Γ, z : T +U ⊢ V : U i Γ, x : T ⊢ M l : V {inl(x)/z} Γ, y : U ⊢ M r : V {inr(y)/z} Γ ⊢ N : U Γ ⊢ ind + ((z:T+U)V,(x:T )M l , (y:U )M r , inr(N )) ≡ M r {N/y} : V {inr(N )/z} Figure 3.5: MLTT U Type System: CoproductsBool-ConvL Γ ⊢ V : U i Γ ⊢ M 1 : V Γ ⊢ M 2 : V Γ ⊢ ind + (V, M 1 , M 2 , true) ≡ M 1 : V

Σ; Γ ⊢ Ω τ : τ Σ; Γ ⊢ () : Unit Σ; Γ ⊢ true : Bool Σ; Γ ⊢ false : Bool Σ; Γ ⊢ M 1 : Bool Σ; Γ ⊢ M 2 : τ Σ; Γ ⊢ M 2 : τ Σ; Γ ⊢ if M 1 then M 2 else M 3 : τ Σ; Γ ⊢ n : Int Σ; Γ ⊢ M 1 : Int Σ; Γ ⊢ M 2 : Int Σ; Γ ⊢ M 1 == M 2 : Bool Σ; Γ ⊢ M 1 : Int Σ; Γ ⊢ M 2 : Int Σ; Γ ⊢ M 1 + M 2 : Int (x : τ ) ∈ Γ Σ; Γ ⊢ x : τ Σ; Γ, x : τ ⊢ M : σ Σ; Γ ⊢ λx.M : τ → σ Σ; Γ ⊢ M : τ → σ Σ; Γ ⊢ N : τ Σ; Γ ⊢ M N : σ l ∈ Σ ∩ Loc τ Σ; Γ ⊢ l : ref τ Σ; Γ ⊢ M 1 : ref τ Σ; Γ ⊢ M 2 : ref τ Σ; Γ ⊢ M 1 == M 2 : Bool Σ; Γ ⊢ M : ref τ Σ; Γ ⊢!M : τ

This corresponds to the definition of a shallow embedding of the language in the theory.

a luff (as opposed to full) category is a subcategory which keeps the same objects.

To our knowledge, logical relations are always defined on closed terms. This could have maybe justified to choose a different name for our technique.

Note that a recent version is needed, since a bug in quantifier elimination in previous versions gives unsatisfiability results for true equivalence.

Remerciements

such that T ∈ (? l , h) • Tr l, ε, I, h, D with D = dom(h) and I = codom(h fn ). Then, l, ε, I, h, D l h --→ l, ε, I, h, D and the previous lemma applied. Finally, if τ is functional, the equality is also deduced from the previous theorem.

In the same way, taking n trace-arenas A 1 , . . . , A n we define the ith-projection tracestrategy on A 1 ⊗ . . . A n → A i , written p i as the set of play-traces T ∈ P A 1 ⊗...An→A i such that either T is empty, or the two first actions of T are (? -→ u j , h) • ( ¯ u i , h ′ ) with u i = u i if u i is a ground value, otherwise it is a pointer, and for all other subtraces (o, h) • (p, h ′ ) of length two of T , ((o, h), (p, h ′ )) is a copycat pair of T . Again, we can easily see that Θ(p i ) is equal to π i , the usual projection game-strategy over the corresponding game-arena A.

Theorem 14: Let i ∈ {1, . . . , n} then [x 1 : τ 1 , . . . , x n : τ n ⊢ x i : τ i ] = p i

Denotation of λ-abstractions

Next, we proceed by showing that [Γ ⊢ λx.M : σ → τ ] can be reconstructed from [Γ, x : σ ⊢ M : τ ] exactly in the same way as in game semantics.

Let T ∈ Tr λx.M, γ, I, h, D then the first action of T is ( ȳ , h ′ |D ) such that λx.M, γ, I, h, D

where dom(h ′ ) = D, θ(h |D ) = θ(h ′ |D ) and for all l ∈ D ∩ Loc φ , h(l), h ′ (l) are two name pointers which form a copycat pair in T when they are questioned. This justifies the following two definitions, imported from [START_REF] Murawski | Game semantics for good general references[END_REF].

We first introduce the notion of copycat triple, which allows us to control the callbacks performed indirectly with functions stored in the heap. Indeed, just as in nominal game semantics, only name pointers are stored in disclosed functional part of heaps. And even if what is stored in a location is not modified, the interaction rule refreshes this name pointer. We use the following definition to control this refreshing.

Definition 28. Let T a legal trace and

Using it, we define the notion of total trace strategies.

namely the fact that the undisclosed part of the heap cannot store name pointers. Thus, when reducing (M, h) to (M ′ , h ′ ), we know that the name pointers contained in M ′ are also in M .

We now prove that a term M ′ appearing in the interactive reduction of M via a trace T only contains name pointers from Av O (T ).

Lemma 15: Let M a term of GroundML such that Σ; Γ ⊢ M : τ , and

Proof By induction on the length of

an opponent action and (a 1 , h 1|D 1 ) its (player) justifier. We have M, γ, I, h 0 , D

Let us reason by case analysis on a 2 :

-Suppose a 2 is an opponent answer v , then we have

. Then the induction hypothesis on T 1 gives us ν O P (M 1 ) ⊆ Av O ((a 0 , h 0 ) • T 1 ), and we conclude using

-Suppose that a 2 is an opponent question x v justified by the player action (a 1 , h 1|D 1 ), with γ(x) = u and M 2 = u v. From Av O ((a 0 , h 0 )•T ) = Av O ((a 0 , h 0 )•T 1 )∪ν O P (v), we simply have to prove that ν O P (u) ⊆ Av O ((a 0 , h 0 ) • T 1 ). Suppose M, γ, I, h 0 , D

, then the induction hypothesis gives us that ν O P (M ′ 1 ) ⊆ Av O ((a 0 , h 0 ) • T 1 ). We reason by case analysis on a 1 :

From this lemma we get directly the following corollary:

We can finally prove Theorem 20 using the conjunction of lemma 14 and corollary 3.

Full Abstraction for GroundML

We have seen in Section 5.4.1 that terms of GroundML give rise to P-visible traces. However, the trace semantics of Section 5.2.3 is not fully abstract, since there are still -for all u a free location or a free location variable of M , H(l) is defined, -for all u ∈ dom(H), if H(u) = u ′ is a heap term, then H(u ′ ) is defined.

We now state various lemmas on the symbolic reduction which will be useful to relate it to the operational reduction.

Let A ⊆ Var, we say that a substitution α :

Lemma 48: Let M a ground closed term, and H a closed symbolic heap for M . Then if

Proof By induction on the length of (M,

Lemma 49: Let M a ground closed term, and H a closed symbolic heap for M . Then for all

with H(u) undefined. But this case is impossible since, by the previous lemma, H post is closed for M ′ so H(u) is defined.

Lemma 50: Let M a ground closed term and H pre a symbolic heap for it. Suppose that (M, H pre ) → s (M ′ , H post , C), and α pre : FV(H pre ) → Val a substitution. Then there exists a substitution α post : (FV(H post , C)\FV(H pre )) → Val s.t. α pre • α post is not aliased on dom(H post )\dom(H pre ) and α(C) is valid.

Finally, we state the two following lemmas which make the link between operational and symbolic reductions.

Proof By case analysis on (α(M ), h) → (N, h ′ ).

-If (M, h) → (N, h) then we simply take

x + y)) with z fresh. Thus, defining α ′ as the extension of α with z ֒→ x + y, we have the wanted properties.

, so the wanted property on heaps is true.

Lemma 52: Let (M, H, C) a symbolic configuration s.t. (M, H, C) → s (M ′ , H ′ , C ′ ), and α : FGV(M, M ′ , H ′ , C ′ ) → Val a substitution on its free ground variables s.t. α is not

Model Checking Contextual Equivalence

The definition of W |= A ϕ introduces quantification over heaps and set of locations. Thus, a general decidability result of the model checking problem is out of reach. Moreover, we need a representation of the transitive closures ⊒ * and ⊒ * pub , which are in general not computable. However, in some cases, the decidability of model checking and even sometimes the decidability of the satisfiability of M 1 ≃ llog M 2 : τ can be obtained.

In this section, we first present a setting in which model checking can be reduced to Presburger arithmetic. Then we show how worlds can be automatically computed in some cases and briefly describe our implementation of those techniques.

Model Checking as Presburger Arithmetic

Suppose that for two terms ⊢ M 1 and M 2 of type τ : In that situation, the decidability of the model checking is decidable since W |= A M 1 ≃ llog M 2 : τ is simply a Presburger formula. Using (2), we can represent heaps as vector of couple (l, v) (with l ∈ Loc and v ∈ Val) of size k. Then, the only second order quantifications are introduced by the quantification on S, but using (3), there is no disclosed reference, so quantification can be removed. Using (4), we know that heaps have a flat structure so we can replace Heap directly by Int k in the definition of HeapTL.

We can handle creations of location under functions by performing garbage collect as in the name disclosure example. However, as soon as a location is passed by the context through a λ-abstraction or a callback, heaps cannot been bounded. Nevertheless, if there are no private locations introduced before a λ-abstraction expecting a location, we can still work in the bounded-heap setting, using the extensionality principle Σ

Notice that working with pure terms (i.e. terms which do not create references and whose type does not contain any ref ι occurrences), we can use the single-state world. Thus, using the model checking above with this world, we get the decidability of the contextual equivalence for this fragment-which has already been proved in section 5.5.

An Implementation using SMT-solvers

We have written a program in Haskell that computes the temporal formula M 1 ≃ llog M 2 : τ for any terms M 1 and M 2 . We then verify that heaps can be bounded, by checking that there is no fresh existential quantification on locations under a modality in the

), so using lemma 59 and the induction hypothesis on values, we get that (ρ

), so using again lemma 59 and the induction hypothesis on contexts, we get that (ρ 1 (K 1 ), ρ 1 (K 2 )) ∈ K A σ ′ , τ e (w 1 , w 0 ). So we still have to prove that (ρ 1 (h ′ 1 ), ρ 2 (h ′ 2 ), D ′′ ) : w 1 where D ′′ = (ρ 1 ×ρ 2 )(D ′ ). To do so, we first prove that D ′′ ⊆ (w 1 .S) i using lemma 60, since

. And we conclude using lemma 56.

-Otherwise, if both

Then, using the same reasoning as before, we get that (ρ

From Concrete to Temporal Logical Relations

Finally, we prove the completeness of temporal logical relations w.r.t. contextual equivalence. To do so, we simply relate it to concrete logical relations, to import the soundness proved in the previous chapter.

Similarly to Lemma 53, we state that every possible symbolic execution of a term can be simulated with an operational reduction leading to a normal form.

Lemma 61: Let M a ground-closed term, H pre a fresh closed symbolic heap for M and α pre a substitution FV(H pre ) → Val. Let (M ′ , H post , C) ∈⇓ (M, H pre ), then defining h as α pre (H pre ), there exists -a reduction (M, h)

Theorem 46 (Completeness for Values): Let v 1 , v 2 two ground-closed values, e a relational environment for them andW = (w, κ, n) a world with history,

Theorem 47 (Completeness for Contexts): Let W = (w, κ, n) a world with history, K 1 , K 2 two ground-closed terms, e an environment for them. Suppose

7.9 Appendix: SMTLIB Code for the "Awkward Example"

We provide in a file awkward.l the following pair of term: (let x1 = ref 0 in \f1:Unit-> Unit.x1:=1;f1 unit;!x1, \f2:Unit->Unit.f2 unit;1)

We generate the world using

./world -flat -compact Test-Suite/Awkward/awkward.l which generate the following code:

Checking the two codes together with z3, we get that it is indeed satisfiable. L'objectif de cette thèse est de proposer un système logique dans lequel de telles preuves peuvent être formalisées, et dans certains cas inférées automatiquement. Dans la première partie, une méthode générique d'extension de la théorie des types dépendants est proposée, basée sur une interprétation du forcing vu comme une traduction de préfaisceaux de la théorie des types. Cette extension dote la théorie des types de constructions récursives gardées, qui sont utilisées ensuite pour raisonner sur les références d'ordre supérieure. Dans une deuxième partie, nous définissons une sémantique des jeux nominale opérationnelle pour un langage avec références d'ordre supérieur. Elle marie la structure catégorique de la sémantique des jeux avec une représentation sous forme de traces de la dénotation des programmes, qui se calcule de manière opérationnelle et dispose donc de bonnes propriétés de modularité. Cette sémantique nous permet ensuite de prouver la complétude de relations logiques à la Kripke définit de manière directe, via l'utilisation de types récursifs gardés, sans utilisation de la biorthogonalité. Une telle définition directe nécessite l'utilisation de mondes omniscient et un contrôle fin des locations divulguées. Finalement, nous introduisons une logique temporelle qui donne un cadre pour définir ces relations logiques à la Kripke. Nous ramenons alors le problème de l'équivalence contextuelle à la satisfiabilité d'une formule de cette logique générée automatique, c'est à dire à l'existence d'un monde validant cette formule. Sous certaines conditions, cette satisfiabilité peut être décidée via l'utilisation d'un solveur SMT. La complétude de notre méthode devrait permettre d'obtenir des résultats de décidabilité pour l'équivalence contextuelle de certains fragment du langage considéré, en fournissant un algorithme pour construire de tels mondes.

Index

Abstract

Proving program equivalence for a functional language with references is a notoriously difficult problem. The goal of this thesis is to propose a logical system in which such proofs can be formalized, and in some cases inferred automatically. In the first part, a generic extension method of dependent type theory is proposed, based on a forcing interpretation seen as a presheaf translation of type theory. This extension equips type theory with guarded recursive constructions, which are subsequently used to reason on higher-order references. In the second part, we define a nominal game semantics for a language with higher-order references. It marries the categorical structure of game semantics with a trace representation of denotations of programs, which can be computed operationally and thus have good modularity properties. Using this semantics, we can prove the completeness of Kripke logical relations defined in a direct way, using guarded recursive types, without using biorthogonality. Such a direct definition requires omniscient worlds and a fine control of disclosed locations. Finally, we introduce a temporal logic which gives a framework to define these Kripke logical relations. The problem of contextual equivalence is then reduced to the satisfiability of an automatically generated formula defined in this logic, i.e. to the existence of a world validating this formula. Under some conditions, this satisfiability can be decided using a SMT solver. Completeness of our methods opens the possibility of getting decidability results of contextual equivalence for some fragments of the language, by giving an algorithm to build such worlds.