This dissertation investigates notions of program equivalence and metric for higher-order sequential languages with algebraic e ects.

Computational e ects are those aspects of computation that involve forms of interaction with the environment. Due to such an interactive behaviour, reasoning about e ectful programs is well-known to be hard. This is especially true for higher-order e ectful languages, where programs can be passed as input to, and returned as output by other programs, as well as perform side-e ects. Additionally, when dealing with e ectful languages, program equivalence is oftentimes too coarse, not allowing, for instance, to quantify the observable di erences between programs. A natural way to overcome this problem is to re ne the notion of a program equivalence into the one of a program distance or program metric, this way allowing for a ner, quantitative analysis of program behaviour. A proper account of program distance, however, requires a more sophisticated theory than program equivalence, both conceptually and mathematically. This often makes the study of program distance way more di cult than the corresponding study of program equivalence.

Algebraic e ects provide a powerful formalism to structure e ectful higher-order (sequential) computations. Accordingly, e ectful computations are produced by means of e ect-triggering operations which act as sources of the side e ects of interest. Such operations are algebraic, in the sense that their (operational) semantics is independent of their continuation, and thus e ects act independently of the evaluation context in which they are executed. Algebraic e ects can be used to model several computational e ects, proving formal models for higher-order languages with nondeterministic, probabilistic, and imperative features, as well as combinations thereof. In fact, contrary to other theories of computational e ects, algebraic e ects naturally support operations to combine algebraic theories, and thus allow for the combination of e ects with one another. These features make reasoning about program equivalence for languages with algebraic e ects challenging, as the operational behaviour of a program may be determined by complex interactions between the program and the environment.

The rst part of this dissertation studies bisimulation-based notions of equivalence and re nement for λ-calculi enriched with algebraic e ects. In particular, notions of e ectful applicative and normal form (bi)similarity are de ned for both call-by-name and call-by-value λ-calculi, as well as a notion of monadic applicative (bi)similarity for call-by-name calculi only. For all these notions, congruence and precongruence theorems are proved, which directly lead to soundness results with respect to an extension of Morris' contextual equivalence to e ectful calculi. In order to design the aforementioned notions of equivalence and re nement, an abstract relational framework is developed, which is based on the notions of a monad and of a relator, the latter being an abstract construction axiomatising relation lifting operations.

The second part of this dissertation is devoted to the study of program distances for languages with algebraic e ects. Following Lawvere analysis of metric spaces as enriched categories, the abstract relational framework developed in the rst part of the dissertation, is extended to relations taking values over quantales, the latter being algebraic structures whose elements represent 'abstract quantities'. Using such a framework, the notion of an e ectful applicative bisimulation distance is de ned, and its

main properties are studied. Due to the so-called distance trivialisation, however, the notion of an effectful applicative bisimulation distance is de ned for a calculus supporting program sensitivity. The latter is the law describing how much operational di erences in output are a ected by operational differences in input. Relying on the notion of program sensitivity, an abstract (pre)congruence theorem for e ectful applicative (bi)similarity distance is proved, which states that the latter behaves as a Lipschitzcontinuous metric-like function, this way enabling compositional reasoning about program distance.

I am very grateful to my supervisor, Ugo Dal Lago. None of the results of this dissertation would have been obtained without his patient supervision and his careful guidance. Ugo has been always available to discuss my work and my private life, in both cases giving me constant support as well as suggestions of the highest quality. He always supported me and encouraged me to do some independent research, this way allowing me to grow as a researcher. From him I learnt how to do research. I simply cannot express my gratitude for that.

A special thank goes to Davide Sangiorgi, who has been a second supervisor. With him I enjoyed several discussions on the history and foundation of coinductive techniques. His approach to the subject deeply in uenced my way of doing research.

I am also grateful to Lars Birkedal and Michele Pagani for having reviewed this dissertation in the short amount of time they have at their disposal.

The results presented in this dissertation have been discussed with (and improved by) many people in several occasions. Special thanks go to Paul Blain Levy, who introduced me to the mathematics I needed to develop my theories. I am also very grateful to Alex Simpson and Niels Voorneveld, with whom I discussed ideas on program metric during the (wonderful) four months I spent in Ljubljana.

A spacial thank goes to my family. First of all to my wife Marta: nothing of what I did would have been possible without her. My parents Chiara and Giuseppe have always supported me and encouraged me to pursue my goals. I would never thank them enough for that. I am also very grateful to my brother Federico and to my grandfather Gastone. The latter has always been a source of inspiration for me. Writing this dissertation, his reminder of the proverb il meglio è nemico del bene (perfect is the enemy of good) has been extremely valuable.

In the last three years I shared wonderful moments with colleagues and friends. Thank you all. Among those, special thanks go to Valeria, the two Vincenzos, Saverio, Adele, the two Stefanos, Angelo, Federico, the two Lucas, Flavio, Daniel, and Tong.

I am also grateful to all professors and researchers who contributed to my scienti c and philosophical formation. Among those, special thanks go to Antonio Maria Nunziante for having taught me Leibniz's philosophy, to Gilberto Filè for having introduced me to program correctness and formal methods, to Alessandra Palmigiano and Giuseppe Greco for the passion they put in teaching me algebra and proof theory, and to Henk Barendregt for our 'cappuccino meetings' solving exercises from his λ-calculus book.

Chapter 1

Introduction

This is why we call it a "calculus". We dare to use this word by analogy with Leibniz's di erential calculus; the latter -incomparably greater -is based upon continuous mathematics, while the π -calculus is based upon algebra and logic; but the goal in each case is analysis, in one case of physical systems and in the other case of informatic systems.

Speech by Robin Milner on receiving

an Honorary Degree from the University of Bologna

Program equivalence is arguably one of the most important concepts in the theory of programming languages. Besides its prime importance in the general understanding of programming languages, program equivalence is also recognised as a fundamental tool in elds like program veri cation, compiler optimisation design, and security. Unfortunately, giving satisfactory de nitions and methodologies for program equivalence is a challenging problem. In fact, in order to deem two programs as equivalent, several aspects of their behaviour should be taken into account. Among those, one should consider whether the two programs both terminate, what is their input-output behaviour, how the programs interact with the environment, and which kind of side-e ects (if any) are produced during their evaluation.

As a consequence, reasoning about program equivalence is particularly hard when dealing with higher-order e ectful languages i.e. languages in which programs can be passed as input to, and returned as output by other programs, as well as perform side-e ects. A remarkable example is provided by programming languages based on algebraic e ects (G. D. [START_REF] Plotkin | Notions of computation determine monads[END_REF], 2003) -such as E1 [START_REF] Bauer | Programming with algebraic e ects and handlers[END_REF] -as well as extensions of mainstream languages -such as OCaml, Scala, and C -with algebraic e ects [START_REF] Brachthäuser | E ekt: Extensible algebraic e ects in scala (short paper)[END_REF][START_REF] Dolan | Concurrent system programming with e ect handlers[END_REF][START_REF] Leijen | Implementing algebraic e ects in c[END_REF].

Programs written in such languages usually employ speci c operations to produce e ectful computations, such as probabilistic choices or primitives to raise exceptions. As a consequence, the result of the evaluation of a program usually depends on the environment in which the program is evaluated, hence making reasoning about e ectful programs notoriously hard.

A further di culty is provided by the possibility of combining e ects with one another. In fact, real world programs are often designed to perform combinations of di erent e ects -using e.g. probabilistic, nondeterministic, and imperative primitives -and are thus complex entities. Reasoning about such programs without an appropriate formal apparatus is simply not possible. For instance, even answering a simple question like what does this program do? might require non-trivial forms of reasoning about the interaction between the program and the environment. This cannot be safely done without a toolkit of adequate formal techniques.

A less explored, yet increasingly important, concept than program equivalence, is the one of a program metric or program distance, i.e. of a metric-like function de ning a distance between programs according to their behaviour. The notion of a program metric is emerging as a fundamental tool in the study of languages for probabilistic computation [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF][START_REF] Leijen | Implementing algebraic e ects in c[END_REF], di erential privacy (de Amorim, [START_REF] De Amorim | A semantic account of metric preservation[END_REF][START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF][START_REF] Xu | Metrics for di erential privacy in concurrent systems[END_REF], and e ectful languages, more generally. In all these scenarios, program equivalence is a too coarse notion for reasoning about program behaviour, as it does not allow to quantify the observable, operational di erences between programs. For instance, in probabilistic languages a small perturbation in the probabilistic behaviour of programs may break program equivalence without proving any further information.

To solve these issues, programming language theorists are increasingly interested in studying notions of program distance, this way allowing for a quantitative (and thus ner) analysis of program behaviour. A proper account of program metrics, however, requires a more sophisticated theory than program equivalence, both conceptually and mathematically. This often makes the design and study of program distances way more di cult than the corresponding study of program equivalences.

In the rst part of this dissertation we aim to answer a simple, yet non-trivial question, namely when two e ectful programs should be deemed as (behaviourally) equivalent. In the second part, instead, we tackle a di erent problem, namely the one of quantifying behavioural di erences between programs.

Before introducing the results obtained, we informally outline the main ideas behind the models we use, and the notions we investigate in this work.

Program Equivalence: a Conceptual Introduction

A programming language is an arti cial formalism in which algorithms can be expressed. For all its arti ciality, though, this formalism remains a language2 , and can thus be analysed using notions and results from linguistics. However, looking at algorithms as speci c mathematical functions (notably, the computable ones), programming languages can also be seen as playing a role similar to algebra, as they aim to control and manipulate complexity throughout linguistic abstraction. In this introduction we will take advantage of both these views on programming languages, referring to them as the linguistic and algebraic point of view, respectively.

Looking at a programming language as a language, we see that a program is ultimately a phrase in such a language, and it is therefore natural to ask what its meaning is. The branch of programming language theory that studies how to answer this question is called programming language semantics. One of the most interesting question in program semantics is the one asking when two programs are equivalent. Formally, answers to such a question are provided by relations between program phrases that behave as notions of equality. According to the algebraic perspective, program equivalence is nothing more than equality; according to the linguistic perspective, program equivalence can be understood as a synonymy.

According to both these views, program equivalence is of paramount importance for the formal study of programming languages. Algebraically, a good notion of program equivalence allows to design algebraic identities through which we can manipulate programs symbolically. Linguistically, a well-behaved program equivalence allows to regard the meaning of a program phrase e as theequivalence class of e (denoted by [e] ). This is nothing more than stating that the meaning of an expression is the meaning of its synonyms.

Let us now try to spell out which are the minimal features that qualify a relation between program phrases as a candidate notion of program equivalence. First of all, we notice that some of such features will actually depend on the speci c language one is interested in. We will come back on that later. Nonetheless, there are some structural properties that any notion of program equivalence has to satisfy. Let be a candidate relation.

1. In order to behave as an equality relation, needs to be an equivalence relation, i.e. it must be reexive, symmetric, and transitive. Algebraically, such properties allow to deduce the equivalence e e from a chain of equivalences e e 1 • • • e n e . Linguistically, being an equivalence relation we can state that the meaning of an expression e is the set [e] .

2. Additionally, has to be compatible with all language constructors. That is, must be closed under all language (syntactical) constructors. For instance, if our programming language has an 'ifthen-else' constructor, and e 1 e 1 , e 2 e 2 , e 3 e 3 , then we also need to have if e 1 then e 2 else e 3 if e 1 then e 2 else e 3 . Algebraically, thinking to language constructors as operations, we see that compatibility makes a congruence relation. This gives the powerful reasoning principle of substitution of equals for equals (also known as Leibniz's identity law). Accordingly, we can infer the equivalence C[e] C[e ] between the compound phrases C[e] and C[e ] in virtue of the equivalence e e . Linguistically, requiring to be a congruence gives the so-called principle of compositionality3 . Indeed, the meaning [C[e]] of a compound phrase C[e] can be seen as a function of the meaning [e] of its sub-phrase e. It comes with no surprise that a large part of this dissertation will be devoted in proving congruence properties of program equivalences.

Having outlined some minimal desiderata any candidate notion of program equivalence has to satisfy, we now look at the speci c kind of equivalences we aim to study in this dissertation.

Higher-order Languages

According to our previous discussion, it comes with no surprise that answering the question of whether two programs are equivalent is non-trivial. First of all, we should ask ourselves whether the latter is a well-posed question. In fact, there is no unique notion of a program: di erent programming languages might come with di erent notions of a program. It is thus of paramount importance for our investigation to x a good model for the languages we aim to analyse.

In this dissertation we focus on higher-order functional languages, that is languages in which programs are modelled as functions, and the latter are allowed to be passed as argument to, and returned as result by other functions. A main feature of functional languages is that they have a solid formal foundation, which allows for a ne mathematical analysis of their properties. In fact, starting from the pioneering work by Landin (Landin, 1965a[START_REF] Landin | A correspondence between ALGOL 60 and church's lambda-notations: Part II[END_REF] (see also [START_REF] Plotkin | Call-by-name, call-by-value and the lambda-calculus[END_REF]), the λ-calculus [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF][START_REF] Church | The calculi of lambda conversion[END_REF] has been recognised as a foundational calculus for functional programming languages.

The λ-calculus

The λ-calculus [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF][START_REF] Church | The calculi of lambda conversion[END_REF] is a formalism to study functions as rules (as opposed to the set-theoretic understanding of functions as graphs), i.e. as processes mapping arguments to values [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]. The syntax of the λ-calculus is minimal: a term of the λ-calculus is either a variable

x, an application of terms f e, or a functional abstraction λx.f . We call terms of the λ-calculus λ-terms. The intended meaning of a λ-abstraction λx.f is to represent a function in the variable x with body f . The latter describes how the variable x (which acts as a placeholder for an argument) is manipulated by the function. Dually, an application f e represents the application of the function f to the argument e. The only operation allowed to manipulate λ-terms is the so-called β-rule, which rewrites a term of the form (λx.f )e as f [x := e]. The β-rule simply states that once a function λx.f is applied to an argument e, the λ-term (λx.f )e thus obtained is rewritten as the λ-term obtained by replacing all occurrences of the variable x in f (the body of the function) with e.

From this sketched description of the λ-calculus, we immediately recognise that all λ-terms indeed represent and manipulate functions, so that the λ-calculus may serve as a linguistic abstraction for studying functions. As showed in [START_REF] Turing | Computability and λ-de nability[END_REF], the class of functions expressible in the λ-calculus is exactly the class of computable functions, hence hinting the relationship between the λ-calculus and the idea of a programming language as a language to express and manipulate algorithms.

However, the link between the λ-calculus and programming languages still needs some re nements. In fact, since a λ-term may contain several occurrences of terms of the form (λx.f )e, (called redexes), the β-rule can be applied to di erent redexes of the same λ-term, hence giving potentially di erent results. Such a nondeterminism can be eliminated by xing a so-called reduction strategy [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]. The latter is simply a rule that determines to which redex the β-rule should be applied in a λterm. In this dissertation we are concerned with two di erent reduction strategies, the call-by-name and call-by-value reduction strategy (G. [START_REF] Plotkin | Call-by-name, call-by-value and the lambda-calculus[END_REF].

Roughly speaking, in the call-by-name reduction strategy, when a function λx.f is applied to an argument e, the redex (λx.f )e is reduced as it is, thus giving f [x := e]. In the call-by-value reduction strategy, instead, a redex is rewritten only if the argument of the function is a value, i.e. a λ-term on which the β-rule cannot be applied any further.

Once a reduction strategy is xed, the λ-calculus can be regarded as a foundational calculus for functional programming languages, as showed by the pioneering work by Landin (Landin, 1965a[START_REF] Landin | A correspondence between ALGOL 60 and church's lambda-notations: Part II[END_REF] who established a correspondence between expressions of ALGOL 604 [START_REF] Backus | Report on the algorithmic language algol 60[END_REF] and (a modi ed version of) the λ-calculus. Accordingly, λ-terms can be roughly identi ed with programs, and evaluating a program corresponds to apply the β-rule to the λ-term representing the program until a value is reached. Notice that since we have xed a reduction strategy, program evaluation is deterministic.

Actually, even when equipped with a reduction strategy the λ-calculus is still lacking an important feature of (mainstream) functional programming languages. In fact, almost no functional programming language evaluates functions until they are called. Using the vocabulary of the λ-calculus, that means that the β-rule cannot be applied on expressions (redexes) under the scope of a λ-abstraction5 . As a consequence, any λ-abstraction λx.e is regarded as a value. The λ-calculus obtained by regarding λabstractions as values (independently of the reduction strategy adopted) is called the lazy λ-calculus (Abramsky, 1990a). Our interest being in programming languages, from now, unless explicitly mentioned, we assume the λ-calculus to be the lazy one, and simply refer to it as λ-calculus.

The λ-calculus can be thus regarded as a foundational calculus for functional programming languages, and thus used as formal tool for their theoretical analysis. On one hand, the λ-calculus is expressive enough to allow for the description of interesting features of several languages, on the other hand, it abstracts from those concrete details of real languages that would make the analysis too dependent on the language chosen.

At this point it comes with no surprise that the theoretical model we use for our investigation is based on the λ-calculus.

Three Views on Program Equivalence

In light of previous discussion, in order to study program equivalence it is somehow su cient to study equivalences between terms of the λ-calculus. That is, we can rephrase the question when two programs are equivalent? as when two terms of the λ-calculus are equivalent?. Answering such a question means nothing more than nding good notions of equivalence for the λ-calculus. Here we give a lightweight overview of the main ideas behind (some of) the equivalences we will study in this dissertation. In light of the correspondence between programs and λ-terms, we will sometimes use the latter expressions interchangeably.

Before continuing, we remark that although in this introduction we deal with program equivalence only, this dissertation focuses both on program equivalence and program re nement, the latter being nothing but the order-theoretic counterpart of program equivalence 6 .

The kind of equivalences we will study in this work are the so-called operationally-based equivalences, that is equivalences that aim to identify programs exhibiting the same operational behaviour. The operational behaviour of terms in the λ-calculus is essentially given by the β-rule (properly adapted to the reduction strategy considered), and thus our notions of equivalence should be equate λ-terms according to how they behave when evaluated. For the sake of the argument, we x the call-by-value reduction strategy.

Does the Best Equivalence Exist?

Let us recall that any good notion of program equivalence must be a compatible equivalence relation. Additionally, we remarked that such a relation should distinguish λ-terms for their operational behaviour only. As a rst approximation, the latter requirement might be formalised by stating that if two terms e and e are related, then e evaluates to a given value if and only if e does the same. The choice of the value we look at does not really matter.

Such a choice, however, does not work well, neither for the call-by-name nor for the call-by-value λ-calculus. For instance, the two λ-terms λx.I and λx.II , where I is the λ-term λ . , should be deemed as operationally equivalent, intuitively. However, being values they trivially evaluate to di erent values, and thus we should regard them as operationally di erent. The standard solution to overcome this problem is relaxing the above requirement asking that e converges (i.e. the evaluation of e terminates) if and only if e does. That is, instead of comparing λ-terms for converge to the same value, we compare them convergence only.

It is then natural to ask: does a compatible equivalence relation that compare programs for convergence exist?. The answer is obviously positive, as syntactic equality is such a relation. This is clearly an unsatisfactory answer. What we would like to come up with is not just a compatible equivalence relation that compare programs for convergence, but actually the coarsest one. That is, what we are looking for is a compatible equivalence relation that discriminate programs only for their convergence behaviour. Nothing more, nothing less. Mathematically, we are asking whether there exists the largest compatible equivalence relation that compares programs for their convergence behaviour.

In his doctoral dissertation [START_REF] Morris | Lambda calculus models of programming languages[END_REF] Morris gave a positive answer to such a question, introducing the so-called contextual equivalence (also known as operational or observational equivalence). Due to its universal property 7 , contextual equivalence is considered the golden notion of equivalence for the λ-calculus. Moreover, contextual equivalence can be explicitly characterised by saying that two λ-terms e, e are contextually equivalent if and only if for all compound expressions C[e], C[e ], the former converges if and only if the latter does, this way highlighting how compatibility is an essential part of its de nition 8 .

Unfortunately, contextual equivalence has a major drawback: in order to deem two λ-terms e, e as contextually equivalent, one has to analyse their behaviour in any possible compound expression C[e], C[e ], which is something oftentimes not doable in practice, due to the higher-order nature of the λcalculus. For that reason, semanticists are continuously interested in designing better proof techniques for contextual equivalence. The proof techniques that are relevant for this dissertation take the form of relations between λ-terms that satisfy the following minimal desiderata:

1. They must be easier to use than contextual equivalence.

2. They must be sound for contextual equivalence, meaning that, as relations, they must be included in contextual equivalence. If the other inclusion holds as well, the relation is said to be fully abstract (or complete) for contextual equivalence.

If, additionally, such relations are congruence relations, then they can also become interesting notions of program equivalence by themselves (i.e. independently of their relationship with contextual equivalence). Among such techniques we mention logical relations (G. [START_REF] Plotkin | Lambda-de nability and logical relations[END_REF][START_REF] Reynolds | Types, abstraction and parametric polymorphism[END_REF], CIU-like equivalences [START_REF] Mason | Equivalence in functional languages with e ects[END_REF], applicative bisimilarity (Abramsky, 1990a), and Böhm-tree like equivalences [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF][START_REF] Böhm | Alcune proprietà delle forme βη-normali del λk-calcolo[END_REF].

Interactions, Tests, and Experiments

Taking inspiration from ideas developed in process calculi (e.g. [START_REF] Milner | Communication and concurrency[END_REF][START_REF] Sangiorgi | The π -calculus -a theory of mobile processes[END_REF]), it is possible to look at notions of equivalence for the λ-calculus from a concurrent perspective, as well as to design new equivalences with a more 'interactive' avor. Accordingly, one thinks to program equivalence by means of experiments and observations, following the rationale that two λ-terms should be deemed as equivalent if there is no experiment (testing λ-terms for their operational behaviour) that can tell them apart. This way, program equivalence is de ned by means of an interactive process in which (pairs of) programs (i.e. λ-terms) interact with an external observer that tries to discriminate them using a given apparatus of tests, experiments, and observations. The largest such an apparatus, the stronger the discriminating power of the observer.

As we are interested in operationally-based equivalences, the main notion of observation we will use is simply convergence, meaning that the outcome of an experiment will be a 'yes/no' answer telling whether the tested program(s) converge or not. Moreover, dealing with higher-order languages (notably, the λ-calculus), the role of the experiment is oftentimes -but not always -played by speci c families of programs, that represent the environment in which programs are evaluated. Such programs are called property states exactly that: any relation satisfying P is included in contextual equivalence. 8 Most textbooks take this characterisation of contextual equivalence as a de nition, and then prove its universal property. Moreover, we should notice that Morris's notion of contextual equivalence is actually di erent from the one used nowadays for the call-by-name and call-by-value λ-calculus, as it is based on the idea of comparing terms for convergence to the same value (normal form, actually), and not just for convergence. Morris' notion of contextual equivalence, however, is formulated for the λ-calculus equipped with the so-called head reduction strategy [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]. Without entering details, we simply remark that such a strategy allows us to reduce under λ-abstractions, and therefore does not regard λx .I I as a value (notice that I I is a redex). That allows us to prove that in such a λ-calculus, the notion of contextual equivalence obtained comparing terms for convergence and the notion of contextual equivalence obtained comparing terms for convergence to the same value coincide. The proof of such a result is, however, non-trivial as it requires the so-called Separation Theorem [START_REF] Böhm | Alcune proprietà delle forme βη-normali del λk-calcolo[END_REF]) (a result on which we will come back later).

contexts, and are roughly formalised as programs with a hole [-] to be lled in with the tested program. This is nothing but the structure we have used so far to build compound expressions.

The larger is the family of contexts we use to test programs, the more testing power we have at our disposal. In particular, if we test programs against any possible context, then we obtain Morris' contextual equivalence. We thus notice how contextual equivalence captures the idea of operational indistinguishability in a black-box scenario.

This perspective on contextual equivalence is essentially based on the 'testing' approach to behavioural equivalence [START_REF] De Nicola | Testing equivalence for processes[END_REF], whereby the behaviour of a program is investigated by a series of tests. There is another fundamental notion of program equivalence which is deeply rooted in ideas coming from Concurrency Theory, namely applicative bisimilarity (Abramsky, 1990a). A major contribution of Concurrency Theory has been the introduction of the notion of a bisimulation and of bisimulation equality, called bisimilarity [START_REF] Milner | Communication and concurrency[END_REF]. Bisimilarity is a coinductively-de ned [START_REF] Park | Concurrency and automata on in nite sequences[END_REF][START_REF] Sangiorgi | Introduction to bisimulation and coinduction[END_REF] notion of equivalence, which is arguably the most studied form of behavioural equality for processes.

The theory of bisimulation has found an important application in the λ-calculus starting with the work by Abramsky (Abramsky, 1990a), who introduced the notion of an applicative bisimulation. Abramsky built on the assumption that λ-terms ultimately represent (kind of) functions, notably λ-abstractions, and should be thus tested according to the function extensionality principle. The latter states that two functions F , G : A → B are equal if for any a ∈ A, F (a) = G (a). The fundamental assumption behind this de nition is that there is a notion of equality for elements belonging to the set B9 . Applying extensionality to λ-terms, however, gives problems of well-foundedness: deeming two λ-terms f 1 , f 2 to be equal if and only if for any value , f 1 is equal to f 2 , we see that we are using the relation we are trying to de ne as a part of its very de nition.

Abramsky bypassed this problem imagining the following testing scenario. Given a λ-term e, e is rst evaluated, hence testing it for convergence. If it passes the test, then obviously e converged to a value . At this point we have the real interaction phase between the environment and . The environment cannot inspect , nor it can use it as desired. The only possible interaction it can have with is by passing a value w to , hence resuming the whole testing process on the term w.

Two terms are applicative bisimilar if they cannot be discriminated by the above testing process. Obviously, testing λ-terms in this way may take an in nite amount of time, and it thus comes with no surprise that applicative bisimilarity is de ned coinductively.

Comparing λ-terms following Abramsky's testing scenario, it is natural to ask how much testing power we are loosing compared to contextual equivalence. In fact, applicative bisimilarity tests programs for their applicative behaviour only, hence drastically reducing the testing power given by arbitrary contexts, at least apparently. This is actually (part of) the strength of applicative bisimilarity, which thus quali es as a good candidate proof technique for contextual equivalence. Abramsky showed that not only applicative bisimilarity works ne as a proof technique for contextual equivalence (soundness), but it also provides an alternative characterisation of the latter (full abstraction).

Looking at the Past Throughout the Concurrency Glasses

Recalling that we are interesting in operational equivalences, and that the operational behaviour of a λ-term is essentially determined by the β-rule, there is candidate notion of equivalence that we have not investigated, which is actually the most straightforward one: two λ-terms are equivalent if and only if they evaluate to the same value.

This equivalence is rooted in Church's original idea that the meaning of a λ-term is the value it evaluates to, and is strongly related to the notion of β-equality (or β-convertibility) [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF].

Broadly speaking, the latter is the notion of equality arising from the β-rule 10 . The major drawback of Church's proposal is that not all λ-terms converge 11 , and thus all diverging terms should be regarded as equal (or, from a linguistic perspective, as meaningless). Unfortunately, the theory induced by such a notion of equality has been proved to be inconsistent (see [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF] for a nice exposition of the subject). Historically, this problem has been solved by looking at a more informative notion of a value, which can be elegantly described via the notion of a Böhm tree of a λ-term, giving raise to the so-called standard theory [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF].

Roughly speaking, the Böhm tree of a λ-term e is a kind of in nitary value 12 representing all the stable amount of information obtained by evaluating e. As a consequence, all λ-terms have a Böhm tree, and we can thus regard two λ-terms as equivalent if and only if they have the same Böhm trees. Actually, the Böhm tree of a λ-term e is obtained by evaluating e using neither the call-by-name nor the call-by-value reduction strategy, but the so-called head reduction strategy [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]. We will be sloppy on that for the moment, and simply recall that Böhm tree-like structures can be de ned for both the call-by-name (giving the notion of a Lévy-Longo tree [START_REF] Lévy | An algebraic interpretation of the lambda beta -calculus and a labeled lambda -calculus[END_REF][START_REF] Longo | Set-theoretical models of lambda calculus: Theories, expansions, isomorphisms[END_REF]) and the call-by-value (see e.g. [START_REF] Carraro | A semantical and operational account of call-by-value solvability[END_REF][START_REF] Lassen | Eager normal form bisimulation[END_REF]) λ-calculus.

At this point of the story it is then natural to ask whether there is a link between the above 'treelike' equivalences, and the interactive approach to program equivalence of previous section. This is indeed the case, as shown in [START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario (extended abstract)[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF]. Moving from the theory of open bisimulation for the π -calculus [START_REF] Sangiorgi | A theory of bisimulation for the pi-calculus[END_REF] and from encodings of the λ-calculus into the π -calculus [START_REF] Milner | Functions as processes[END_REF], Sangiorgi modi ed Abramsky's testing scenario as follows: instead of testing a value (which, for the sake of the argument, we assume to be a λ-abstraction) λx.e by passing it a value as argument, the environment can now inspect the body of the function, i.e. the term e under the lambda 13 .

Compared to Abramsky's idea of testing λ-terms extensionally, open bisimulation can be seen as an intensional notion of equivalence, whereby functions are not tested for their input-output behaviour, but for their intensional (syntactical, to some extent) structure. The tree-like structures associated to λ-terms can be now seen as unfolded representation of this new testing process, and their equality thus coincides with open bisimilarity, the latter being open bisimulation equality. This result had several implications, as it provided (to the best of the author's knowledge) the rst coinductive account to treelike equivalences, whose theory was essentially induction-based at the time (see e.g. [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]).

The results proved in [START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario (extended abstract)[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF] concerned the call-by-name λ-calculus and the associated notion of Lévy-Longo tree equality. Such results have been then extended to Böhm trees (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF] and to the call-by-value λ-calculus (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF], introducing the general notion of a normal form bisimulation 14 .

Open bisimilarity provides a powerful candidate proof technique for contextual equivalence, as λterms are essentially tested in isolation (the environment can interact with them inspecting their intensional structure only, and does not have the power to in uence computations 15 ), meaning that in order to prove two λ-terms to be open bisimilar it is enough to reason about them locally. Open bisimilarity can indeed be proved to be a sound proof technique for contextual equivalence. Unfortunately, due to the limited testing power provided by open bisimulations, open bisimilarity turned out to strictly ner (i.e. strictly included) than contextual equivalence, in general 16 . 10 That is, the congruence relation (inductively) generated by the relation relating terms of the form (λx .e ) with e[x := ]. 11 Think, for instance, to Ω (λx .x x )(λx .x x ). 12 Normal form, actually. We will say more on that later. 13 De ning a λ-term e to be closed if all its variables are bound by a λ (and open otherwise), we see that the environment now tests open terms, from which the name open bisimulation. 14 The expressions normal form bisimulation and open bisimulation are used interchangeably, although the former is arguably the most used one. We will stick with this convention, although we remark that the name open bisimulation seems more appropriate given both the foundational link with the notion of an open bisimulation for the π -calculus, and the relevance of testing open terms (the latter being a central di erence with applicative bisimulation).

15 E.g. by passing values as arguments to the tested terms. 16 That holds for both the call-by-name and the call-by-value λ-calculus, as we will see. However, due to the celebrated Böhm

A Bird's-eye View on Program Equivalence

In previous section we informally introduced some of the (operational) equivalences will study in this dissertation. There are, of course, many other ones, such as logical relations-based equivalences [START_REF] Appel | An indexed model of recursive types for foundational proof-carrying code[END_REF][START_REF] Plotkin | Lambda-de nability and logical relations[END_REF][START_REF] Reynolds | Types, abstraction and parametric polymorphism[END_REF][START_REF] Sieber | Reasoning about sequential functions via logical relations[END_REF], just to mention a single example. Designing operational equivalences as well as (relationally-based) proof techniques for contextual equivalence, it is possible to recognise a limited number of di erent principles (or patterns) behind such techniques. These principles can be used to classify program equivalences according to the key ideas behind their de nitions, and thus provide a convenient lens through which our analysis can be viewed. In the following, we summarise such principles, taking inspiration from [START_REF] Mclaughlin | Triangulating context lemmas[END_REF].

• Observational, whereby programs are tested against a restricted family of contexts. This idea nds its prime example in Milner's context lemma [START_REF] Milner | Fully abstract models of typed lambda-calculi[END_REF], and gives rise to program equivalences such as CIU-like equivalences [START_REF] Mason | Equivalence in functional languages with e ects[END_REF].

• Applicative or extensional, whereby programs are tested according to the function extensionality principle for their input-output behaviour. This principle gives rise to Abramsky's applicative bisimilarity (Abramsky, 1990a), and its extensions (e.g. environmental bisimilarity [START_REF] Koutavas | From applicative to environmental bisimulation[END_REF][START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF]).

• Intensional, whereby programs are tested in isolation according to the syntactic structure of suitable in nitary normal forms. This is the principle behind Böhm tree-like equivalences [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF][START_REF] Böhm | Alcune proprietà delle forme βη-normali del λk-calcolo[END_REF] and open/normal form equivalences (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF].

• Logical, whereby programs are tested against logically related inputs and are required to produce logically related outputs. This is the principle behind logical relations [START_REF] Appel | An indexed model of recursive types for foundational proof-carrying code[END_REF][START_REF] Plotkin | Lambda-de nability and logical relations[END_REF][START_REF] Reynolds | Types, abstraction and parametric polymorphism[END_REF][START_REF] Sieber | Reasoning about sequential functions via logical relations[END_REF].

Computational E ects

The reader should now have some intuitions behind programs equivalence in general, and some concrete λ-calculus equivalence in particular. However, up to this point we have ignored one of the main issue of this dissertation, namely computational e ects. Roughly speaking, (computational) e ects are those aspects of computation that involve forms of interaction with the environment (sometimes referred to as the external world). Classical examples are probabilistic and nondeterministic computations (in both cases the environment provides the source of nondeterminism), imperative stateful computations (where the environment is given by the machine state), and computations performing input and output operations. It is clear that any serious analysis of program equivalence should be concerned with computational e ects 17 , to some extent (after all, even printing the result of a computation on the screen of a laptop is a computational e ect).

Before looking at what a notion of an e ectful program equivalence might be, we have to understand what an e ectful program is. In fact, the correspondence between programs and λ-terms on which we built our previous analysis does not directly scale to e ectful programming languages.

The Computational λ-calculus

According to our informal understanding of computational e ects, a fast examination of the syntax of the λ-calculus reveals a major drawback: the grammar of the λ-calculus allows to write pure programs only, i.e. programs that can be somehow described as mathematical functions 18 . This is a major point of departure with ordinary programming languages, which are, on the contrary, deeply e ectful.

The notion of a pure program is usually identi ed with the one of a referentially transparent program [START_REF] Strachey | Fundamental concepts in programming languages[END_REF] 19 . Accordingly, a program is referentially transparent if it is equivalent to the value (if any) it evaluates to. A more pragmatic, although less formal, de nition of referential transparency states that a program is referentially transparent if evaluating it multiple times always gives the same result. This property is not enjoyed by e ectful programs, in general, as their evaluation depends on the environment in which they are executed (the result of program might depend on a keyboard input given by the user, for instance). Terms of the λ-calculus, instead, can be deemed as referentially transparent, since the evaluation of a λ-term is just the sequential application of the β-rule. As a consequence, the λ-calculus as it is, does not provide an adequate foundational calculus for e ectful programming languages.

This de ciency led semanticists to look at extensions of the λ-calculus capable of modelling e ectful computations. In his seminal work on notions of computation [START_REF] Moggi | Computational lambda-calculus and monads[END_REF][START_REF] Moggi | Notions of computation and monads[END_REF], Moggi gave a unied account of computational e ects as monads [START_REF] Maclane | Categories for the working mathematician[END_REF], and designed a core calculus, called computational λ-calculus, for e ectful computations.

The key insight of Moggi's analysis can be easily explained by means of a simple example. First of all, let us recall that a pure program f can be roughly approximated by a function F : I → O mapping inputs to outputs. In particular, the function F (and thus the program f ) associates to any input i ∈ I its unique output value F (i) (notice that, according to such a reading, pure programs always terminates . . .). This is no longer the case if f behaves nondeterministically, so that to any input i, f may associate several outputs. That is, f cannot be modelled as a function from inputs to outputs anymore. Moggi observed that such a nondeterministic program f can actually be modelled as function F , but instead of having as codomain the set O of outputs, this time F has as codomain the powerset of O, denoted by P (O ). That is, to any input i ∈ I , the function F associates a unique set F (i) of outputs, representing the possible outputs f may (nondeterministically) produce. In this way, it is possible to model the impure, nondeterministic program f by means of a function F : I → P (O ), and thus by a pure program.

The very same analysis can be given for many other e ects. For instance, programs printing numerical strings can be modelled using the set N * × O. Abstracting, we can think to an e ectful program f as a function F : I → T (O ), where T is some construction modelling the kind of e ects f may produce. We call such constructions notions of computations [START_REF] Moggi | Notions of computation and monads[END_REF].

It is then natural to ask what is the structure of T . To answer such a question, let us look at pure programs rst, and thus at functions. For simplicity, let us consider endofunctions, i.e. functions of the form F : A → A, for some set A. The natural algebraic structure associated with the space of such functions is the one of a monoid: function composition plays the role of monoid multiplication, and the identity function 1 : A → A behaves as the unit of the monoid. This is the algebra of functions, and thus of (pure) functional programs. Generalising from endofunctions to functions, the algebra of functions gives the notion of a category [START_REF] Maclane | Categories for the working mathematician[END_REF]. In particular, given functions F : A → B and G : B → C, we can compose them obtaining G • F : A → C. Computationally, that means that we can pass the output of a program as input to another program.

A minimal desideratum T should satisfy, is to allow to lift the algebra of functions to functions of the form F : A → T B. Let us brie y expand on that. Consider two functions F : A → T B and G : B → TC modelling e ectful programs. We immediately notice that the output of F is di erent from the input of G, as the former comes together with the e ects produced by the program associated to F . Nonetheless, we would like to be able to pass the actual value computed by F as input to G, combining somehow the e ects produced. What we need is thus an operation • T allowing to produce the function G • T F : A → TC. Additionally, we would like such an operation • T to behave as kind of function composition, this way allowing to restore the algebra of functions20 . The constructions T that allows to perform such an algebraic constructions are called monad [START_REF] Maclane | Categories for the working mathematician[END_REF], and are a well-known notion in Category Theory [START_REF] Maclane | Categories for the working mathematician[END_REF].

Algebraic E ects

Moggi's account of e ectful computations is mostly denotational, focusing more on the nature of the functions associated with λ-terms, rather than on the linguistic analysis of e ectful programs. From an operational perspective, the computational λ-calculus has minimal di erences with the ordinary λcalculus, and thus it does not provide as an adequate calculus for an operational analysis of e ectful languages. In particular, the computational λ-calculus lacks primitives to actually produce e ects, with the consequent necessity of extending it with suitable e ect-triggering operations, whenever one is interested in giving formal accounts of e ectful languages.

Moving from these observations, Plotkin and Power have recently introduced the theory of algebraic e ects (G. D. [START_REF] Plotkin | Adequacy for algebraic e ects[END_REF][START_REF] Manes | Taut monads and t0-spaces[END_REF], 2003) aiming to provide a more satisfactory account of e ectful computations, both from an operational and denotational perspective. Accordingly, the theory of algebraic e ects focuses on the computational primitives producing e ects, rather than on e ects on their own. In languages supporting algebraic e ects, programs are written using e ect-triggering operations (such as probabilistic choices or primitives for raising exceptions) which act as sources of the side e ects of interest.

Although introduced only in recent years, algebraic e ects provide a standard formalism for the operational analysis of e ectful languages. This is due to their wide applicability to model concrete e ectful calculi, on one hand, and on their nice operational properties, on the other hand. In fact, algebraic operations provide, among others, models for probabilistic and nondeterministic computations (by means of probabilistic and nondeterministic choice operations), imperative computations (by means of primitives for reading and writing global stores), computations with output (by means of primitives for printing values), and computations with exceptions (by means of primitives for throwing exceptions), as well as combinations thereof. In fact, contrary to monads, algebraic e ects naturally support operations to combine e ects with one another [START_REF] Hyland | Combining e ects: Sum and tensor[END_REF], hence providing facilities for the design and analysis of languages exhibiting di erent kinds of e ects.

Additionally, the algebraic nature of operations allows to have a tight control on the way e ects are produced and propagated in a computation. In fact, from an operational perspective, algebraicity of an operation states that the operational behaviour of such an operation is independent of its arguments, meaning that e ects act independently of the evaluation contexts in which they are executed. Taking advantage of this property of algebraic operations, (G. D. [START_REF] Plotkin | Adequacy for algebraic e ects[END_REF] de nes a λ-calculus with algebraic operations, which plays the same role of Moggi's computational λ-calculus. Contrary to the latter, however, the λ-calculus in (G. D. [START_REF] Plotkin | Adequacy for algebraic e ects[END_REF]) has a well-behaved operational semantics, hence giving evidences that by enriching the λ-calculus with algebraic operations, one obtains an adequate foundational calculus for e ectful languages.

Obviously, algebraic e ects have their own limitations. For instance, neither continuations [START_REF] Hyland | Combining algebraic e ects with continuations[END_REF] nor exception handlers (G. D. [START_REF] Plotkin | Handling algebraic e ects[END_REF]) can be modelled as algebraic e ects 21 . Nonetheless, as previously stressed, several computational e ects can be described by means of algebraic operations. Additionally, by enriching the λ-calculus with algebraic operations we obtain a powerful (and mathematically well-behaved) formalism for the operational analysis of e ectful programming languages. Even if such a formalism does not allow for a comprehensive analysis of e ectful computations, it certainly allows for the development of a rich theory of e ectful program equivalence, as this dissertation aims to show.

E ectful Program Equivalence

In previous section we have identi ed a family of core calculi for studying e ectful programming languages, namely extensions of the λ-calculus with algebraic operations. The next step in our investigation is to understand what a notion of program equivalence for such calculi might be.

Looking back at our general analysis of program equivalence, we notice that purity did not play any role there, so that we are still interesting in nding suitable congruence relations between program phrases. That is not the case for the concrete equivalences we have introduced in Subsection 1.1.2. In fact, all of them rely on the fundamental assumption that the operational behaviour of a λ-term is entirely determined by the β-rule. Dealing with e ectful programs, such an assumption has to be dropped: the evaluation of a program cannot be identi ed with the β-rule anymore, as it also has to take into account algebraic operations. This is a great source of complexity for the operational analysis of program behaviour. Contrary to the β-rule (which made program evaluation a local process), evaluating algebraic operations require a program to interact with the environment, hence making the evaluation process itself interactive. Looking at program equivalence in terms of tests and observations, this further source of complexity results in far richer notions of observation, whereby the external observer can detect (to some extent, at least) not only the result of the evaluation of a program, but also the e ects produced during such an evaluation (this way requiring to introduce suitable techniques to compare e ects with one another).

The rst part of this dissertation studies the equivalences introduced in Subsection 1.1.2 for λ-calculi extended with algebraic operations, with special focus on coinductive equivalences.

From Equivalences to Distances

Program equivalence answers the question of whether two programs have the same behaviour, and gives meaning to programs via a notion of synonymy. However, when dealing with e ectful programs one may be interested in answering a di erent, more informative question: how much di erent two programs are?. Our focus being on e ectful languages, it is of prime importance for our investigation to provide a satisfactory answer to such a question.

Our approach towards such an achievement is to design suitable notions of program distance (or program metric). Quantifying di erences between program behaviours is of paramount importance for e ectful languages, where e ects are, by their very nature, context dependent. This is not the case for pure programs, whose behaviour is independent of the environment in which they are evaluated. As a consequence, changes in the environment do not a ect the observable behaviour programs exhibit. However, as we have already remarked, e ectful programs interact with the environment, and are thus sensitive to context changes. For instance, small perturbations in probabilities may break equivalence of probabilistic programs. It is then useful to have information on how much changes in the environment a ect changes in the operational behaviour of programs, thus allowing for a ner, quantitative analysis of program equivalence.

programming languages not only with algebraic operations, but also with the so-called e ects handlers, the latter being syntactical constructors handling the behaviour of (algebraic) operations.

The design of well-behaved notions of program distance constitute a challenging problem in the context of higher-order computation. In fact, higher-order programs have the ability to copy and evaluate their input as they like, so to speak. That means that when a higher-order program receives inputs with similar (but not equal) behaviour, each time it forces their evaluation an observable di erence between their behaviour is detected. Additionally, whenever such a di erence is the detected, it is added to the ones previously observed. As a consequence, by copying and evaluating its inputs enough times, the program is able to fully discriminate between its inputs, even if their expected di erence is, in principle, negligible.

This observation mines our approach to the behavioural analysis of programs at its very roots: by reasoning in terms of experiments and observations, an external observer can always fully discriminate (i.e. assign maximal distance) to any pair of non-equivalent programs. As we will see, xing this problem will force us to change our notion of testing process, following the rationale that one should take into account not only how a program is tested, but also how much it is tested.

The second main contribution of this dissertation is the design of a well-behaved program distance capable of handling the above described phenomenon. As we will see, achieving such a goal is simply not possible without providing information on the environment in which programs are tested. After all, this does not come with a big surprise, since context dependency is an intrinsic feature of e ectful programs.

We conclude this informal introduction spending few words on the foundational meaning of moving from program equivalence to program distance.

A Foundational Interlude

Following the linguistic perspective on programming languages, we may ask what is the linguistic counterpart of the shifting from program equivalence to program distance. From a mathematical perspective, moving from program equivalence to program distance means re ning equivalence relations into pseudometrics22 [START_REF] Searcóid | Metric spaces[END_REF], with the rationale that given a pseudometric δ , the quantity δ (e, e ) quanti es the (behavioural) di erences between the program phrases e and e . As a notion of program equivalence describes synonymy, this way inducing a notion of meaning for program phrases, we may now ask what is the linguistic interpretation of program distance.

A conceptual (philosophical, somehow) answer to such a question is provided by structural linguistics (de [START_REF] De Saussure | Course in general linguistics: Translated by wade baskin[END_REF]. Accordingly, meaning is produced di erentially, i.e. throughout di erences. As a consequence, in order to understand the meaning of an expression it is necessary to study its di erences with the other expressions of the language, hence giving to the role of synonymy a secondary role.

The kind of di erences we will consider in this work are rather rudimentary, as they are essentially based on (abstract) notions of quantities. Nonetheless, our analysis of notions of program distance can be read as constituting a small contribution to a richer understanding of program semantics, whereby the notion of identity (formalised through the notion of program equivalence) is secondary to the notion of di erence (here formalised through the notion of program distance23 ) 24 .

Now that the reader has some background notions, we can outline the main contribution of this dissertation in a more detailed way.

First Contribution: E ectful Program Equivalence and Renement

The rst main contribution of this dissertation is the development of operationally-based notions of program equivalence and re nement for λ-calculi enriched with algebraic e ects. The equivalences and re nements designed are mostly of a coinductive nature (with some minor exceptions given by contextual-like equivalences) and are based on di erent forms of bisimulation equivalence (resp. renement). Following the classi cation of program equivalences outlined in Subsection 1.1.3, we can list the equivalences and re nements designed as follows.

Observational. Concerning observational equivalences and re nements, we de ne the notions of effectful contextual approximation ctx (resp. equivalence ctx ) and e ectful CIU approximation ciu (resp. equivalence ciu ). These are de ned in Chapter 5.

Applicative. Concerning applicative equivalences and re nements, we de ne the notions of e ectful applicative similarity A (resp. bisimilarity A ) and monadic applicative similarity M (resp. bisimilarity M ). These are all de ned in Chapter 5 and Chapter 6, respectively.

Intensional. Concerning intensional equivalences and re nements, we de ne the notions of e ectful normal form (bi)similarity (notably e ectful eager normal for similarity E and bisimilarity E , and e ectful weak head normal form similarity W and bisimilarity W ). These are de ned in Chapter 7.

We brie y expand on the contributions given.

E ectful Applicative Similarly and Bisimilarity

In Chapter 5 we de ne the notion of e ectful applicative similarity and bisimilarity for a call-by-value λcalculus with algebraic e ects (Chapter 3). Applicative bisimilarity is a coinductive [START_REF] Milner | Communication and concurrency[END_REF][START_REF] Park | Concurrency and automata on in nite sequences[END_REF] program equivalence for pure λ-calculi that tests pure functional programs extensionally, i.e. for their input-output behaviour. Due to its coinductive nature, applicative bisimilarity comes equipped with a powerful proof technique, called the coinduction proof principle, which makes applicative bisimilarity a powerful tool for proving equivalence between programs. Since Abramsky's seminal work (Abramsky, 1990b), applicative bisimilarity has been extended to several e ectful calculi, notable examples being its extension to nondeterministic (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Ong | Non-determinism in a functional setting[END_REF] and probabilistic [START_REF] Crubillé | On probabilistic applicative bisimulation and call-by-value lambdacalculi[END_REF][START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF] λcalculi. However, all these extensions are rather speci c to the e ects considered, and seem to rely on their speci c properties (for instance, the proof of congruence of applicative bisimilarity in [START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF] relies on the Max-ow Min-cut Theorem [START_REF] Schrijver | Theory of linear and integer programming[END_REF]).

Our notion of e ectful applicative (bi)similarity, instead, is designed to be parametric over a large class of computational e ects. Concretely, e ectful applicative (bi)similarity is parametrised by a monad and a relator [START_REF] Barr | Relational algebras[END_REF][START_REF] Thijs | Simulation and xpoint semantics[END_REF], the latter being an abstract construction axiomatising the structural properties of relation lifting operations [START_REF] Kurz | Relation lifting, a survey[END_REF]. This level of abstraction makes e ectful applicative bisimilarity (resp. bisimilarity) a powerful notion of program equivalence (resp. renement) for e ectful higher-order languages. In fact, suitable choices of relators allow to recover pure, probabilistic, nondeterministic, and imperative notions of applicative (bi)similarity, as well as combinations thereof.

In order to develop the theory of e ectful applicative (bi)similarity, in Chapter 5 we develop an abstract relational framework in which several notions of e ectful program equivalence and re nement can be de ned. We take advantage of such a framework to de ne and analyse, among others, e ectful notions of contextual equivalence and approximation, CIU equivalence and approximation, and normal form similarity and bisimilarity (Chapter 7). The main results proved in Chapter 5 are precongruence (Theorem 4) and congruence (Theorem 5) theorems for e ectful applicative similarity and bisimilarity, respectively. These theorems state that for a suitable class of relators, whose members we call Σ-continuous relators, e ectful applicative similarity is a precongruence relation, whereas e ectful applicative bisimilarity is a congruence relation. Remarkably, all the relators studied in this dissertation (Section 4.3) are Σ-continuous. As an immediate corollary, we obtain soundness of e ectful applicative similarity (resp. bisimilarity) for e ectful contextual approximation (resp. equivalence).

Theorem 4 and Theorem 5 are proved using an abstraction of Howe's method, which take advantage of the structural properties of relators. Howe's method [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF] is a powerful relational construction used to prove (pre)congruence properties of operationally de ned program relations. Howe's technique has been originally designed for the pure λ-calculus, and has later been generalised to several e ectful λ-calculi, prime examples being its generalisation to nondeterministic (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF] and probabilistic [START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF] λ-calculi. Contrary to the rst extension, the latter one is highly non-trivial, and relies on results from probability theory and linear programming (see Chapter 2 for an extensive discussion on Howe's method). This, as well as other further di culties, led to the belief that Howe's technique is fragile in presence of e ectful extensions of the λ-calculus.

Besides providing a powerful construction to prove congruence properties of e ectful notions of equivalence, our abstract Howe's method sheds some light on the very essence of Howe's construction itself. In fact, using relators we can isolate the complexity of (pre)congruence proofs of applicative (bi)similarity, showing how Howe's method can be understood as a general relational technique parametrised by the e ects considered. Additionally, we show a further application of our abstract account of Howe's method by proving that e ectful CIU approximation (resp. equivalence) is fully abstract for e ectful contextual approximation (resp. equivalence) (Theorem 6).

Normal Form Similarly and Bisimilarity

In Chapter 7 we de ne the notions of e ectful normal form similarity and bisimilarity for both call-byname and call-by-value calculi with algebraic e ects.

The notion of applicative (bi)similarity is rooted in the idea that programs should be compared extensionally, i.e. according to their input-output behaviour. However, it is also possible to test programs intensionally, i.e. by inspecting the syntactic structure of the (possibly in nitary) normal form produced by a term during (iterations of) the evaluation process. The notion of equivalence one obtains by following this route is called open or normal form (bi)similarity25 (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Lassen | Eager normal form bisimulation[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF].

Starting from the pioneering work by Böhm on the pure λ-calculus, the notion of a Böhm tree (Barendregt, 1984), and the associated notion of Böhm tree equality, has been proved extremely useful in reasoning about program behaviour. Roughly speaking, the Böhm tree of a λ-term e is a possibly in nite tree representing the in nitary head-normal form of e. The celebrated Böhm Theorem, also known as Separation Theorem [START_REF] Böhm | Alcune proprietà delle forme βη-normali del λk-calcolo[END_REF], stipulates that two terms are contextually equivalent if and only if their respective (appropriately η-equated) Böhm trees are the same.

The notion of equivalence induced by Böhm trees can be characterised without any reference to trees, by means of a suitable bisimilarity relation (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario (extended abstract)[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF]. Additionally, Böhm trees can also be de ned when λ-terms are evaluated according to the call-by-name (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF] and the call-by-value (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF] reduction strategy. In both cases, the notion of program equivalence one obtains by comparing the syntactic structure of trees, admits an elegant coinductive characterisation as a suitable bisimilarity relation. The family of bisimilarity relations thus obtained goes under the name of normal form bisimilarity.

Compared to other standard operational techniques, normal form bisimilarity has the major advantage of being an intensional program equivalence, equating programs according to the syntactic structure of the (possibly in nitary) trees produced by their evaluation. As a consequence, in order to deem two programs as normal form bisimilar, it is su cient to test them in isolation, i.e. independently of their interaction with the environment (the latter being allowed to observe, but not to in uence, computations). This feature makes normal form bisimilarity a powerful technique for program equivalence. The drawback of such a restricted form of testing, is, however, that normal form bisimilarity is usually sound but not fully abstract for contextual equivalence (although full abstraction results are known to hold for calculi with a rich expressive power [START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF][START_REF] Støvring | A complete, co-inductive syntactic theory of sequential control and state[END_REF]).

In Chapter 7 we generalise normal form (bi)similarity to λ-calculi with algebraic e ects. The framework employed for such a generalisation is the same one de ned in Chapter 5 for e ectful applicative (bi)similarity. Perhaps surprisingly, the very same axioms of relators that guarantee e ectful applicative similarity to be a precongruence relation (and e ectful applicative bisimilarity to be a congruence relations), guarantee our generalisation of normal form similarity, which we call e ectful normal similarity, to be a precongruence relation too (and thus e ectful normal bisimilarity to be a congruence relation). This is the content of Theorem 9, Theorem 10, and Theorem 11.

Additionally, e ectful normal form (bi)similarity provides a sound proof technique not only for effectful contextual approximation (resp. equivalence), but for e ectful applicative (bi)similarity as well (Proposition 22). Finally, we show that normal form (bi)similarity allows for enhancements of the bisimulation proof method [START_REF] Pous | Enhancements of the bisimulation proof method[END_REF] (Theorem 13 and Theorem 12), hence making normal form (bi)similarity an extremely powerful tool for reasoning about program equivalence.

Monadic Applicative Similarly and Bisimilarity

In Chapter 6 we propose a new notion of applicative bisimilarity for a call-by-name calculus with algebraic e ects, which we call monadic applicative (bi)similarity.

Contrary to e ectful applicative (bi)similarity, monadic applicative (bi)similarity is not de ned as a relation between programs, but as a relation between their semantics. This paradigm shift originates by the observation that in call-by-name calculi, contextual equivalence is de facto a form of trace equivalence. In fact, contrary to call-by-value calculi, in a call-by-name λ-calculus terms can be tested in functional position only, meaning that testing a term in an arbitrary environment is morally equivalent to testing the term against a nite sequence of inputs.

Taking advantage of this observation, monadic applicative (bi)similarity is shown to be not only sound, but also fully abstract for e ectful contextual approximation/equivalence, under mild conditions (Theorem 8, Corollary 4, and Corollary 5). That holds, however, only for call-by-name calculi.

We summarise the soundness and completeness results obtained for call-by-value calculi in Table 1.1, whereas the soundness and completeness results obtained for call-by-name calculi are summarised in Table 1.2.

E A ciu = ctx E A ciu = ctx
Table 1.1: Call-by-value approximation/equivalence spectrum.

W A M = ciu = ctx W A M = ciu = ctx
Table 1.2: Call-by-name equivalence/approximation spectrum.

Second Contribution: E ectful Program Distances

From Chapter 9 to Chapter 12 we tackle the problem of de ning a well-behaved program distance for e ectful languages. As already remarked, the question of quantifying observable di erences between programs is particularly interesting (and challenging) for e ectful higher-order languages, where ordinary qualitative (i.e. boolean-valued) equivalences and re nements are often too strong. This is witnessed by recent results on behavioural pseudometrics for probabilistic λ-calculi [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF][START_REF] Leijen | Implementing algebraic e ects in c[END_REF] as well as results on semantics of higher-order languages for di erential privacy [START_REF] De Amorim | A semantic account of metric preservation[END_REF][START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF].

In Chapter 12 we de ne e ectful applicative bisimilarity distance, the quantitative re nement of e ectful applicative bisimilarity, for an extension of the calculus Fuzz (de [START_REF] De Amorim | A semantic account of metric preservation[END_REF][START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF] with algebraic e ects (Chapter 10). Fuzz is a foundational calculus developed in the context of di erential privacy [START_REF] Dwork | Di erential privacy[END_REF] with a linear-like type system [START_REF] Maraist | Call-by-name, call-by-value, call-by-need and the linear lambda calculus[END_REF] capable of expressing program sensitivity. Roughly speaking, the latter is the law describing how much behavioural di erences in output are a ected by behavioural di erence in input, and can thus be used to provide information on the environment in which programs are tested.

The necessity of moving from the mainstream formalisms studied in previous parts of this dissertation to calculi with program sensitivity is grounded in the so-called distance trivialisation [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF][START_REF] Leijen | Implementing algebraic e ects in c[END_REF]. Roughly speaking, a program metric trivialises when it collapses to a program equivalence. Distance trivialisation results are rooted in higher-order features of functional languages. Intuitively, when passing programs with distance ε as input to another program e, the latter can copy and evaluate its inputs ad libitum, each time detecting a di erence ε between them. Additionally, each time such a di erence is detected, it is also added to the one previously observed, so that in the end e will be able to fully discriminate between its inputs. This makes reasoning about program metrics compositionally simply not possible. Program sensitivity provides an elegant way to give information about the testing power of programs, and thus about the environment in which programs are evaluated. Relying on program sensitivity, it is possible to de ne a suitable notion of 'metric-compositionality' in the form of a Lipschitz-continuity condition.

In Chapter 10 and Chapter 11 we develop a general framework to study program metrics in the abstract, and instantiate such a framework to de ne e ectful applicative (bi)similarity distance (Chapter 12), the quantitative re nement of e ectful applicative (bi)similarity. Accordingly, the theory of e ectful applicative (bi)similarity distance builds on three major improvements of the theory of e ectful applicative (bi)similarity of Chapter 5.

1. The rst improvement is to move from boolean-valued relations to relations taking values on quantitative domains (such as [0, ∞] or [0, 1]) in such a way that restricting these domains to the boolean algebra {0, 1} makes the theory collapse to the usual theory of e ectful applicative (bi)similarity. For that, we rely on Lawvere's analysis (F. [START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF] of generalised metric spaces and preordered sets as enriched categories, and work with relations taking values over arbitrary quantales [START_REF] Rosenthal | Quantales and their applications[END_REF]. We call such relations quantale-valued relations.

2. The second improvement is the generalisation of the notion of a relator to quantale-valued relators, i.e. relators acting on quantale-valued relations. Perhaps surprisingly, such a generalisation is at the heart of the led of monoidal topology (Hofmann, Seal, & Tholen, 2014), a sub eld of categorical topology aiming to unify ordered, metric, and topological spaces in categorical terms.

3. The third improvement is the development of a compositional theory of behavioural quantalevalued relations (and thus of behavioural distances). Due to distance trivialisation, ensuring compositionality in an higher-order setting is particularly challenging. In order to achieve compositionality, we take advantage of the notion of program sensitivity, and use the latter to de ne a suitable notion of metric-like compositionality. As we will see in Chapter 9, such a paradigm shift is necessary in order to ensure good properties of program metrics.

The result obtained is an abstract theory of behavioural quantale-valued relations that allows to de ne notions of quantale-valued applicative similarity and bisimilarity -which we call e ectful applicative similarity and bisimilarity distance, respectively -parametrised by a quantale-valued relator. The notions obtained generalise the existing notions of real-valued applicative (bi)similarity and can be instantiated to concrete calculi to provide new notions of applicative (bi)similarity distance. A remarkable example is provided by probabilistic λ-calculi, where to the best of the author's knowledge a (non-trivial) applicative distance for a universal (i.e. Turing complete) probabilistic λ-calculus is still lacking in the literature (but see Section 13.1).

Our rst main result (Theorem 16) states that under suitable conditions on monads and quantalevalued relators, e ectful applicative similarity distance is a compatible (i.e. compositional) re exive and transitive quantale-valued relation. The second main result proved (Theorem 17), instead, states that under mild conditions Theorem 16 extends to e ectful applicative bisimilarity distance, which is thus proved to be a compatible, re exive, symmetric, and transitive quantale-valued relation (i.e. a compatible pseudometric).

Chapter 2

An Informal, Motivating Example

In signs one observes an advantage in discovery which is greatest when they express the exact nature of a thing brie y and, as it were, picture it; then indeed the labor of thought is wonderfully diminished Gottfried Wilhelm Leibniz, Briefwechsel von G. W. Leibniz mit Mathematikern

In order to introduce and justify the abstract framework developed in this thesis, we begin with a gentle, yet non-trivial, example of an e ectful (functional) calculus, namely a call-by-value probabilistic λ-calculus. Such a calculus, which we call Λ p , is a ne-grain (P. [START_REF] Levy | Modelling environments in call-by-value programming languages[END_REF] version of the probabilistic untyped λ calculus studied in e.g. [START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF][START_REF] Dal Lago | Probabilistic operational semantics for the lambda calculus[END_REF]. The latter is obtained by adding to the pure, untyped λ-calculus [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF][START_REF] Church | The calculi of lambda conversion[END_REF] a binary fair probabilistic choice operator, hence making program evaluation inherently probabilistic.

The reason behind this choice is simple: Λ p allows to identify most of the features one encounters when studying (algebraic) e ectful extensions of λ-calculi, and thus provides a good starting point to build intuitions behind the abstract machinery we will introduce in next chapters.

Besides introducing the syntax and (operational) semantics of Λ p , in this chapter we de ne the notions of probabilistic contextual approximation (resp. equivalence) and probabilistic applicative similarity (resp. bisimilarity), and prove that probabilistic applicative similarity is sound for probabilistic contextual approximation, meaning that the former is contained in the latter. Although this thesis studies several notions of program equivalence and re nement, such as applicative and normal form (bi)similarity, contextual equivalence and approximation, and CIU equivalence and approximation, here we will de facto focus on applicative (bi)similarity only. In fact, proving probabilistic applicative similarity to be a precongruence relation (from which its inclusion in contextual approximation directly follows) is highly non-trivial, and provides fundamental insights into the mathematical apparatus we will use in our abstract analysis of program equivalence and re nement.

Let us expand on the latter point. In his seminal work [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF] Howe introduced a powerful relational technique to prove congruence of applicative bisimilarity for pure (i.e. e ect free) λ-calculi: such a technique is nowadays known as Howe's method [START_REF] Pitts | Howe's method for higher-order languages[END_REF]). Howe's method has been extended to several calculi with speci c e ects, its extension to nondeterministic (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Ong | Non-determinism in a functional setting[END_REF] and probabilistic [START_REF] Crubillé | On probabilistic applicative bisimulation and call-by-value lambdacalculi[END_REF][START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF] λ-calculi being prime examples.

In most of these extensions the logical complexity of Howe's method (which is essentially determined by the so-called Key Lemma) is, in a way, comparable to the one of Howe's original method for the pure λ-calculus. This is not the case for probabilistic calculi, where the proof of precongruence for applicative similarity (and thus the proof of congruence for applicative bisimilarity) requires to combine non-trivial results from linear programming [START_REF] Schrijver | Theory of linear and integer programming[END_REF] with the standard relational technique of Howe's method. This is witnessed by the complicated proof of precongruence of probabilistic applicative similarity in [START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF]. As a consequence, there is an apparent mismatch between the complexity of Howe's method when applied to di erent e ectful calculi, which led several researchers to consider Howe's technique fragile in presence of e ects.

The abstract analysis of applicative (bi)similarity we will make in Chapter 5 allows to isolate the complexity of (pre)congruence proofs for applicative (bi)similarity, showing how Howe's method can be understood as a general relational technique parametric with respect to the e ects considered. That allows to understand the deep reasons why di erent instances of Howe's method in the literature seem to have di erent complexities: those are, so to speak, properties of e ects, rather than of Howe's method.

Organisation

After having introduced the syntax and operational semantics of Λ p , we de ne probabilistic contextual approximation and probability applicative similarity. Compared to their symmetric counterparts, probabilistic applicative similarity and probabilistic contextual approximation are amenable to an easier mathematical treatment, and thus we focus on the latter for now.

We stress the de nition of probabilistic applicative similarity in terms of a suitable relation lifting operation. This is major di erence compared to previous works on probabilistic applicative (bi)similarity [START_REF] Crubillé | On probabilistic applicative bisimulation and call-by-value lambdacalculi[END_REF][START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF]. Looking at (probabilistic) applicative similarity in terms of relation lifting operations allows to isolate the structural properties such operations should satisfy in order to guarantee (probabilistic) applicative similarity to be precongruence relation. We conclude the chapter discussing the proof of the precongruence theorem for probabilistic applicative similarity and its possible generalisation.

Finally, we remark that the theory presented in this chapter is nothing more than a mechanical instantiation of the abstract theory of e ectful applicative (bi)similarity we will study in Chapter 5. Such a theory might then appear to the reader as a rather straightforward generalisation of the the theory of probabilistic applicative similarity presented here: if that is the case, then this introductory chapter made its purpose. Chronologically, however, Ugo Dal Lago, Paul Blain Levy, and the author rst developed the theory of e ectful applicative (bi)similarity, which then led to a better understanding of probabilistic applicative (bi)similarity.

A Probabilistic λ-calculus and Its Operational Semantics

We now introduce our running example calculus Λ p . We will not give all formal details here (these are not needed for our purposes), which are given instead in Chapter 3 in full generality.

Terms of Λ p are divided into two disjoint classes: computations (denoted by e, f , . . .) and values (denoted by , w, . . .). These are de ned in Figure 2.1, where x ranges over a xed countably in nite set of variables.

The di erence between values and computation is the following: a computation produces (when evaluated) a value, and in doing so can perform some (side) e ects, whose nature is probabilistic. A value, on the contrary, is the result of the evaluation of a computation. The key computation constructors are these: • return is the trivial computation. It converts a value into a computation return that (trivially) produces (without performing any side e ect).

• let x = e in f is the sequenced computation (also known as sequencing). Its operational meaning can be informally described as follows: "evaluate e (say it produces a value ), bind to x in f (we use the notation f [x := ] to denote the resulting computation), then evaluate f [x := ]".

Clearly the e ects produced during evaluation of e and f must be combined (we will come back on that later).

• e or f is the actual e ectful computation. The operation symbol or acts as an e ect-triggering operation, evaluating e with probability 1 2 , and f with probability 1 2 .

An example may help to clarify the intuitive (operational) semantics of Λ p .

Example 1. Let Pr (e ⇓ ) denotes the probability that the program e evaluates to the value . For instance, the term e (return 1 ) or (return 2 ) evaluates to 1 with probability 1 2 and to 2 with probability 1 2 . Symbolically, Pr (e ⇓ i ) = 1 2 (for i ∈ {1, 2}). Let now f be a term with a single free variable x such that f [x := 1 ] evaluates to u 1 with probability 1 3 and f [x := 2 ] evaluates to u 2 with probability 2 3 . Then the probability that the program let x = e in f evaluates to u 1 is obtained as the product of the probability of e evaluating to 1 and the probability of f [x := 1 ] evaluating to u 1 . This is the way e ects are composed in Λ p . More formally, the probability that the program let x = e in f evaluates to a value w is obtained as:

Pr (let x = e in f ⇓ w ) = Pr (e ⇓ ) • Pr ( f [x := ] ⇓ w )
Before giving a formal treatment of the operational semantics of Λ p , let us introduce some syntactical conventions. We adopt standard syntactical conventions as in [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]. In particular, we write e[x := ] (resp w[ /x]) for the capture-free substitution of the value for all free occurrences of x in e Γ Λ return

Γ Λ e Γ, x Λ f Γ Λ let x = e in f Γ Λ e Γ Λ f Γ Λ e or f Figure 2.2: Sequents for Λ p .
we simply denote as Λ e and v ). We also introduce the following notation:

Λ {e | ∃Γ. Γ Λ e} Λ Γ {e | Γ Λ e} Λ • {e | Λ e} V { | ∃Γ. Γ v } V Γ { | Γ v } V • { | v }
We can now have a closer look at the operational semantics of Λ p . A convenient way of representing the result of the evaluation of a program e is by means of (discrete) subdistributions over values. A discrete subdistribution over a set X is a function µ : X → [0, 1] such that the support supp(µ) {x ∈ X | µ (x ) > 0} of µ is countable, and x ∈supp(µ ) µ (x ) ≤ 1 (notice that because supp(µ) is countable such a sum always exists). Clearly, if X is countable (as it is e.g. the set of closed values), every map µ : X → [0, 1] has countable support (and thus we simply write x ∈X µ (x ) in place of x ∈supp(µ ) µ (x )). We denote by DX the collection of (discrete) subdistributions over X , and refer to its elements simply as subdistributions.

We de ne the result e of the evaluation of a program e as a subdistribution over (closed) values. The idea is that e ( ) gives the probability that e evaluates to . That is, e ( ) = Pr (e ⇓ ). This justi es our choice of using subdistributions rather than distributions: by assigning probability zero to values we can model divergence. For instance, the probability subdistribution Ω associated with the purely divergent program Ω (λx.xx )(λx.xx ) will assign probability 0 to any value (since Ω diverges, it converges to a value with probability 0).

When trying to formalise this idea we immediately face a rst di culty. In fact, contrary to pure calculi, we cannot give a standard, inductive operational semantics to Λ p . In pure (as well as purely nondeterministic) λ-calculi, if a term converges to a value, then it does so in a nite number of steps. In a probabilistic setting a program may converge to a value with probability 1, but in in nitely many steps only.

To see that, it is useful to represent the subdistribution obtained evaluating a program syntactically. We do so by means of the so-called computation trees (G. D. [START_REF] Plotkin | Adequacy for algebraic e ects[END_REF]. These are in nitary trees whose nodes are labelled with operation symbols (just the probabilistic choice symbol or, in our case) and whose leaves are either values or a bottom symbol ⊥ denoting pure divergence. For instance, the computation tree and its associated probabilistic reading of the recursive program e ( x(z, x ).((return I ) or zx )) , where I is the identity combinator λx.return x and x is a callby-value xed point combinator 1 , are given in Figure 2.3. Looking at Figure 2.3, we easily see that e converges to I with probability lim n→∞ n k =1 1 2 k = 1, but it does so taking in nitely many reduction steps.

To model such an in nitary behaviour we follow [START_REF] Dal Lago | Probabilistic operational semantics for the lambda calculus[END_REF] and notice that DX carries an ω-cppo structure. The order on DX is de ned pointwise: we say that µ ν holds if and only µ (x ) ≤ ν (x ), for any x ∈ X . Clearly the always zero distribution ⊥ acts as bottom element for . Moreover, any ω-chain

(µ n ) n = µ 0 µ 1 • • • µ n • • • has least upper bound given by sup n µ n .
1 The call-by-value xed point combinator x is de ned by the rule

Γ, z, x Λ e Γ v x(z, x ).e
Its computational behaviour is given by a kind of generalised β -rule, which allows to rewrite a term of the form ( x(z, x ).e ) as e[z := x (z, x ).e, x := ].

29

Computation tree of e Probabilistic reading of e or I or Relying on the ω-cppo of DV • , we de ne a N-indexed family of evaluation functionsn : Λ • → DV • such that, for any program e, ( e n ) n forms an ω-chain in DV • . Intuitively, e n is the n-th approximation of the evaluation e of e. Accordingly, we de ne e 0 as ⊥. Moreover, we would like the resulting evaluation functionto satisfy some minimal desiderata. First of all, in order to give semantics to programs of the form return we need to regard values as subdistributions. In particular, we expect return to assign probability 1 to (obviously return converges to with probability one), and 0 to all other values. This can be easily done since we can regard any element of a set X as a subdistribution by means of the map η : X → DX mapping x ∈ X to its Dirac distribution η(x ) de ned by:

I . . . • 1 2 1 2 I • 1 2 1 2 I . . .
η(x )( ) =      1 if = x 0 otherwise.
Secondly, in order to treat the operation symbol or as a fair probabilistic choice, we expect

e or f ( ) = 1 2 • e ( ) + 1 2 • f ( )
to hold for any value . Lastly, we analyse sequencing. Given a program let x = e in f we see that the (open) computation x Λ f induces a function f [x := -] : V • → DV • de ned by:

f [x := -] ( ) f [x := ] .
There is a natural way to lift a function f : X → DY (not to be confusion with the term f above) to a function f † : DX → DY which corresponds to the way we 'concatenated e ects' in Example 1. Simply de ne:

f † (µ)( ) x ∈X f (x )( ) • µ (x ).
As a consequence, we would expect let x = e in f = f [x := -] † e . We can thus give the following de nition.

De nition 1. The N-indexed family of functionsn : Λ • → T V • is inductively de ned as follows:

e 0 ⊥ return n+1 η( ) (λx.e) n+1 e[x := ] n let x = e in f n+1 f [x := -] † n e n e or f n+1 e n ⊕ f n , where for µ, ν ∈ DX , (µ ⊕ ν )(x ) 1 2 • µ (x ) + 1 2 • ν (x ).
To see that De nition 1 indeed gives an ω-chain we notice that we have the following monotonicity and continuity result.

Lemma 1. Recall that any function space of the form X → DY inherits an ω-cppo structure from DY pointwise2 . The following monotonicity and continuity conditions hold, where n ranges over natural numbers.

µ µ , ν ν =⇒ µ ⊕ ν µ ⊕ ν sup n µ n ⊕ sup n ν n = sup n (µ n + ν n ) f =⇒ f † † (sup n f n ) † = sup n f † n µ ν =⇒ f † (µ) f † (ν ) f † (sup n µ n ) = sup n f † (µ n ).
The proof of Lemma 1 is straightforward (just notice that summations commute with suprema, since all numbers involved are positive). Using Lemma 1 (monotonicity) we see that the evaluation function of De nition 1 de nes an ω-chain ( e n ) n , for any closed term e. As a consequence, we can de ne e as the limit of such a chain:

e sup n e n .
Finally, we observe that another consequence of Lemma 1 (continuity) is that our evaluation semantics is continuous.

Proposition 1. The function -: Λ • → DV • is the least function φ : Λ • → DV • such that the following identities hold:

φ(return ) = η( ) φ((λx.e) ) = φ(e[x := ]) φ(let x = e in f ) = ( → φ( f [x := ])) † φ(e)
φ(e or f ) = φ(e) ⊕ φ( f ).

At this point the reader might have noticed that so far we did not use anything really speci c to subdistributions. Our evaluation semantics relied on the existence of an ω-cppo structure on sets of the form DX , as well as on the existence of (families of) functions of the form η : X → DX and f † : DX → DY , for f : X → Y . Such maps give D a monad structure [START_REF] Maclane | Categories for the working mathematician[END_REF]. We required these maps to properly interact with the ω-cppo structure of DX in the form of monotonicity and continuity properties. The only place where subdistributions played an explicit role is in the de nition of the semantics of the operation symbol or. However, a more careful analysis reveals that the way we interpret such an operation symbol does not really matter, as far as it is interpreted as a continuous binary operation on DX . Moving from these observations, in the next chapter we will de ne an abstract, monadic semantics for e ectful calculi. But before that, let us introduce the notion of probability applicative similarity.

Probabilistic Applicative Similarity

Following Abramsky's insights, we notice that the evaluation semantics of De nition 1 de nes a probabilistic labelled transition systems over computations and values of Λ p . Such a transition system is better described abstractly, as a structure resembling a Markov chain.

Recall that a discrete time Markov chain [START_REF] Howard | Dynamic probabilistic systems[END_REF] (Markov chain, hereafter) is given by a set X (the state space of the chain) together with a map c : X → DX . The function c describes probabilistic transitions over X , with the rationale that if c (x )( ) = p, then there is a transition from x to with probability p. A natural notion of equivalence on the state space X is given by Larsen-Skou probabilistic bisimilarity [START_REF] Larsen | Bisimulation through probabilistic testing[END_REF]. Since most of the times we will be more interested in studying the more primitive notion of probabilistic similarity3 , we prefer to work directly with probabilistic similarity (we will discuss probabilistic bisimilarity in later chapters).

Recall that for a set X , a relation R ⊆ X × X , and a set X ⊆ X , the R-image of X is de ned as

R[X] { ∈ Y | ∃x ∈ X. x R }. Moreover, for µ ∈ DX and X ⊆ X we write µ (X) for x ∈X µ (x ). De nition 2. Given a Markov chain c : X → DX , we say that a relation R ⊆ X × X is a probabilistic simulation if x R =⇒ ∀X ⊆ X . c (x )(X) ≤ c ( )(R[X]).
Probabilistic simulation is de ned by lifting a relation R on the state space X to the set of subdistributions over X . Such a lifting can be de ned more abstractly as follows. Given µ ∈ DX , ν ∈ DY , and a relation R ⊆ X × Y , we de ne the relation DR ⊆ DX × DY by:

µ DR ν ⇐⇒ ∀X ⊆ X . µ (X) ≤ ν (R[X]).
With a further abstraction, we can regard D as a set-indexed family of functions from Rel(X , Y ) to Rel(DX , DY ), where for sets X , Y , Rel(X , Y ) denotes the complete lattice of binary relations (ordered by set-theoretic inclusion) between X and Y . We can thus phrase De nition 2 as follows.

Lemma 2. Given a Markov chain c : X → DX , de ne the functional Φ : Rel(X , X ) → Rel(DX , DY ) by:

ΦR {(x, ) | c (x ) DR c ( )}.
Then a relation R ⊆ X × X is a probabilistic simulation if and only if R ⊆ ΦR. That is, probabilistic simulations are exactly post-xed points of Φ.

Since D is monotone (i.e. R ⊆ S =⇒ DR ⊆ DS), we see that Φ is a monotone endofunction on Rel(X , X ). By the Knaster-Tarski Theorem [START_REF] Davey | Introduction to lattices and order[END_REF][START_REF] Tarski | A lattice-theoretical xpoint theorem and its applications[END_REF], Φ has a greatest xed point, which we call probabilistic similarity and denote by . Probabilistic similarity being de ned coinductively (i.e. as the greatest xed point of a Φ), it comes with an associated coinduction proof principle [START_REF] Milner | Co-induction in relational semantics[END_REF][START_REF] Park | Concurrency and automata on in nite sequences[END_REF]: in order to prove that two states of a Markov chain are similar, it is su cient to exhibit a simulation relating them. Formally:

∃ R . R ⊆ ΦR x R x ( -coind.) or, in point-free notation, R ⊆ ΦR R ⊆ ( -coind.)
The notation employed to denote probabilistic similarity suggests the latter to be a preorder relation (which is clearly a desired property). This is indeed the case. In order to see that, we rst observe that the map D satis es the following properties.

Lemma 3. For all relations R ⊆ X × Y , S ⊆ Y × Z the following hold:

= DX ⊆ D(= X ) D S • DR ⊆ D(S • R),
where

S • R {(x, z) | ∃ ∈ Y .
x R ∧ S z} denotes relation composition.

We do not give a proof of Lemma 3 here, as proving properties of D is in general non-trivial. A guide is given in the case of full distributions by Strassen's Theorem [START_REF] Strassen | The existence of probability measures with given marginals[END_REF], an important result that characterises D (whose de nition is based on an universal quanti cation) existentially.

Theorem 1 (Strassen's Theorem). Let µ and ν be full distribution over X and Y , respectively. A coupling of µ, ν is distribution ω over X × Y such that:

∈Y ω (x, ) = µ (x ) x ∈X ω (x, ) = ν ( ).
We denote by Ω(µ, ν ) the set of couplings of µ and ν . The following holds for any relation R ⊆ X × Y :

µ DR ν ⇐⇒ [∃ω ∈ Ω(µ, ν ). ω (x, ) > 0 =⇒ x R ].
We will give intuitions behind the meaning of the notion of a coupling and Strassen's Theorem in Example 30. For now, it is su cient to observe that using Strassen Theorem it is possible to easily prove several properties of D, provided we restrict our treatment to full distributions.

Using Lemma Lemma 3 and the coinduction proof principle, we can prove that is a preorder. For instance, by showing that the identity relation is a probabilistic simulation, we can conclude to be re exive. Let us brie y expand on that. To see that for any Markov chain c : X → DX , the identity relation = X is a probabilistic simulation, we simply observe that if x = X , then c (x ) = DX c ( ), and thus c (x ) D(= X ) c ( ) by Lemma 3. In a similar fashion we can show that • is a simulation, hence concluding to be transitive.

We now look back at Λ p . The evaluation function -: Λ • → DV • does not exactly de ne a Markov chain but, since there is an injection mapping values to computations, we have a 'kind of' Markov chain. In particular, given a relation R V ⊆ V • × V • over closed values, we can modify De nition 2 by saying that a relation

R Λ ⊆ Λ • × Λ • over closed computations is a probabilistic simulation with respect to R V if: e R Λ f =⇒ e DR V f .
At this point we just need to provide conditions on R V making the above implication meaningful. As for the pure λ-calculus, we test the behaviour of closed values (i.e. λ-abstraction) applicatively, hence requiring:

R V w =⇒ ∀u ∈ V • . u R Λ wu.
Summing up, we give the following de nition of a probabilistic applicative simulation relation.

De nition 3. A pair of relations

R = (R Λ ⊆ Λ • × Λ • , R V ⊆ V • × V •
) is a probabilistic applicative simulation if for all closed computations e, f , and all closed values , w, we have:

e R Λ f =⇒ e DR V f (app 1) R V w =⇒ ∀u ∈ V • . u R Λ wu. (app 2) De nition 3 induces an endofunction R → [R] on Rel(Λ • , Λ • ) × Rel(V • , V • ) mapping a pair of relations (R Λ , R V ) to the pair of relations ([R] Λ , [R] V ) de ned by: e [R] Λ f ⇐⇒ e DR V f [R] V w ⇐⇒ ∀u ∈ V • . u R Λ wu.
In particular, we see that a pair of relations R as above is a probabilistic applicative simulation if and

only if R ⊆ [R]. Moreover, the set Rel(Λ • , Λ • ) × Rel(V • , V • ) inherits a complete lattice structure from Rel(Λ • , Λ • ) and Rel(V • , V • ) pointwise. Monotonicity of D makes R → [R]
monotone too, so that the latter has a greatest xed point, which we call probabilistic applicative similarity and denote by = ( Λ , V ). That is a good candidate program re nement is witnessed by the following result, which, as before, can be proved by coinduction (relying on Lemma 3).

Proposition 2. Probabilistic applicative similarity is a preadequate preorder relation, where a pair of relations

(R Λ , R V ) is preadequate if e R Λ f =⇒ e (V • ) ≤ f (V • ).
Preadequacy of a relation (over closed computations) means that whenever two computations e, f are related, then the probability of convergence of e (i.e. e (V • )) is bounded by the probability of convergence of f (i.e. f (V • )). Preadequacy is nothing but the non-symmetric counterpart of the notion of adequacy, which simply states that related computations have the same probability of convergence (which is indeed a desired property of any notion of probabilistic equivalence). We will expand on the notions of adequacy and preadequacy in Chapter 5.

Proposition 2 gives good hints that probabilistic applicative similarity is an interesting candidate program re nement for Λ p . Preadequacy tells us that probabilistic applicative similarity is consistent with ground observations on the operational behaviour of programs, whereas re exivity and transitivity tell that we can use inequational reasoning to study program behaviour. In particular, transitivity allows us to deduce the re nement e e from the chain of intermediate re nements e e 1 • • • e n e . However, in order to indeed qualify as a good program re nement, probabilistic applicative similarity must support compositional reasoning about program behaviour.

Compositionality is a fundamental notion in programming language theory, as well as in many other elds. In our context, we can roughly state that a program relation is compositional if it is preserved by all language (syntactical) constructors. That is, compositionality provides a suitable variation of Leibniz's identity law, whereby a re nement between compound expressions C[e] C[f ] follows from a re nement e f between their sub-expressions. This way, we can take advantage of powerful algebraic laws for inqueational reasoning 4 .

Formally, we say that a program equivalence is compositional if it is a congruence relation, and that a program re nement is compositional if it is a precongruence relation. As a consequence, what we need to show is that probabilistic applicative similarity is a precongruence relation. Before that, however, we introduce the notion of probabilistic contextual approximation.

Probabilistic Contextual Approximation

In previous sections we identi ed some desiderata that any (good) notion of program re nement should satisfy. These can be summarised as follows:

1. The candidate notion must be a preorder.

2. The candidate notion must be preadequate.

3. The candidate notion must be compositional, i.e. a precongruence relation.

It is therefore natural to ask whether there exists a canonical program re nement meeting all the above desiderata. Obviously, the identity relation provides one such a re nement. In fact, it comes with no surprise that syntactic equality behaves both as a notion program equivalence and as a notion of program re nement. Moreover, syntactic equality is the least relation satisfying conditions 1,2, and 3 above, meaning that syntactic equality is included in any re nement satisfying such conditions. However, it comes by itself that comparing programs according to their syntactic structure only does not tell anything useful about their operational behaviour.

There is another canonical notion of program re nement satisfying the above condition, namely Morris' style contextual approximation (also known as operational or observational approximation) [START_REF] Morris | Lambda calculus models of programming languages[END_REF]. The latter is the largest, i.e. the less discriminating (or coarsest), relation satisfying conditions 1, 2, and 3. This universal property gives contextual approximation a prime position among program re nements, making it the universally accepted notion of operational re nement for sequential, higherorder languages.

From a more concrete perspective, contextual approximation is a syntax directed notion of re nement that orders programs according to a pre xed notion of observation (such as probability of convergence, in our case, or pure convergence, in the pure λ-calculus). Accordingly, a program f contextually re nes a program e if there is no context of the language (the latter being a kind of program with a hole to be lled in with the tested program) capable of detecting operational behaviours of e that cannot be simulated by f . Such operational behaviours are speci ed by means of a suitable notion of observation, which describes the observable outcomes of the execution of a program.

For our calculus Λ p , (probabilistic) contextual approximation ctx can be roughly de ned as follows:

e ctx f ⇐⇒ ∀C. C[e] (V • ) ≤ C[f ] (V • ).
Here C ranges over contexts, i.e. terms with a single hole that can be replaced by a given program e, obtaining a new program C[e]. De ning and working with contexts, however, can be rather heavy and error-prone, as contexts cannot be de ned modulo renaming of bound variables (see Remark 10 for details). We thus de ne probabilistic contextual approximation through its universal property. In order to do so, we rst have to introduce some basic notions of program relational algebra in the spirit of (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]. The expression program relational algebra is used to denote a a symbolic apparatus allowing for algebraic manipulations and calculations with program relations. Such relations, which we call λ-term relations (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Pitts | Howe's method for higher-order languages[END_REF]

De nition 4.

1. A closed λ-term relation is a pair R = (R Λ , R V ) of relations R Λ and R V on Λ • and V • , respectively. We refer to R Λ as the computation component of R, and to R V as the value component of R.

2. An open λ-term relation R associates to each nite set of variables Γ a relation Γ Λ -Ron Λ Γ , and a relation Γ v -Ron V Γ . We require open λ-term relations to be closed under weakening:

Γ Λ e R f Γ, x Λ e R f Γ v e R w Γ, x v R w
Although it might appear cumbersome at rst, the notation we use for open λ-term relations has several advantages and highly improves readability (especially when dealing with typed calculi) of the relational techniques we will develop. As a convention, when referring to λ-term relations what we mean is open λ-term relations.

e ∈ Λ Γ Γ Λ e I e ∈ V Γ Γ v I e, f ∈ Λ Γ Γ Λ e 0 f , w ∈ V Γ Γ v 0 w Since e ∈ Λ Γ (resp. ∈ V Γ ) implies e ∈ Λ Γ,∆ (resp. ∈ V Γ,∆
), for any nite set of variables ∆, both 0 and 1 are closed under weakening.

We denote by Rel and Rel c the collections of open and closed λ-term relations, respectively. We can lift most of the usual (abstract) relational algebra to λ-term relations. For instance, by noticing that for any nite set of variables Γ both Rel(Λ Γ , Λ Γ ) and Rel(V Γ , V Γ ) form a complete lattice, we see that Rel carries a complete lattice structure too, its ordering being de ned pointiwise. In particular, we write R ⊆ S if:

∀Γ, e, f . Γ Λ e R f =⇒ Γ Λ e S f Γ Λ f R e Γ Λ e R • f Γ v w R Γ v R • w
Finally, we observe that there are maps -c : Rel → Rel c and -o : Rel c → Rel restring open λ-term relations to closed ones, and extending closed λ-term relations to open ones. Formally, we de ne such maps as follows. Given R ∈ Rel, de ne the closed restriction

5 R c = (R Λ , R V ) of R by: Λ e R f e R Λ f v R w R V w Dually, given a closed λ-term relation R = (R Λ , R V ) we de ne R o
as its open extension. The latter is de ned as follows, where Γ x x 1 , . . . , x n and u u 1 , . . . , u n :

∀ u ∈ V • . e[ x := u] R Λ f [ x := u] Γ Λ e R o f ∀ u ∈ V • . [ u/ x] R V u[ u/ x] Γ v R o w
Taking advantage of these de nitions, for a closed λ-term relation R = (R Λ , R V ) we will often write Λ e R f in place of e R Λ f , and Γ Λ e R f in place of Γ Λ e R o f (and similarity for values). Dually, for an open λ-term relation S we will use the notations Λ e S f and e S Λ f interchangeably (and similarity for values).

Next we introduce the notion of a substitutive λ-term relation, which will be fundamental for proving probabilistic applicative similarity to be a precongruence.

De nition 5.

1. A λ-term relation R is value-substitutive if the following hold, where u ranges over closed values:

Γ, x Λ e R f Γ Λ e[x := u] R f [x := u] Γ, x v R w Γ v [u/x] R w[u/x] 2. A λ-term relation R is substitutive if the following hold: Γ, x Λ e R f v R w Γ Λ e[x := ] R f [x := w] Γ, x v R w v u R u Γ v [u/x] R w[u /x] A closed λ-relation is (value) substitutive if
its open extension is. Moreover, we notice that the open extension of a closed λ-term relation is trivially value-substitutive.

We now have formal notions that allow us to talk about substitutive preorder (and equivalence) λ-term relations. However, what we are actually interested in are precongruence λ-term relations. In order to de ne the notion of a precongruence λ-term relation, we introduce the notion of compatibility. Roughly speaking, a λ-term relation is compatible if it is preserved by all Λ p syntactic constructors. Formally, we follow [START_REF] Gordon | A tutorial on co-induction and functional programming[END_REF][START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]) and de ne compatibility via the notion of compatible re nement. Standard calculations show that compatibility is preserved by relation composition, and that the arbitrary intersection of compatible λ-term relations is compatible (the empty intersection being the indiscrete λ-term relation 0). This is not the case for set-theoretic union, as the union of compatible λterm relations is in general not compatible. Nonetheless, we can de ne the join a family ρ of compatible λ-term relations as the smallest compatible λ-term relation extending ρ, i.e. as:

Γ Λ let x = e in f R let x = e in f (comp-let) Γ Λ e R e Γ Λ f R f Γ Λ e or f R e or f (comp-op)
{S | S ⊆ S, ρ ⊆ S}.
This way, we can give to the collection of compatible λ-term relations a complete lattice structure (see chapter 5 for details), and thus de ne compatible λ-term relations both inductively and coinductively.

We now have all the necessary ingredients to de ne probabilistic contextual approximation.

De nition 7. We say that a λ-term relation R is preadequate if R ∈ Adeq, where:

R ∈ Adeq ⇐⇒ ∀e, f ∈ Λ • . e (V • ) ≤ e (V • ).
De ne probabilistic contextual equivalence ctx as the largest preadequate compatible λ-term relation.

It is not immediately clear whether De nition 7 indeed de nes a λ-term relation. In fact, we notice that preadequacy is not a monotone property, meaning that R ⊆ S in general does not implies that if R ∈ Adeq, then S ∈ Adeq too. As a consequence, we cannot extract (at least in a natural way) a monotone functional from De nition 7. However, we can show that the λ-term relation

{R ∈ Adeq | R ⊆ R}
is itself a preadequate compatible λ-term relation, and thus identity probabilistic contextual approximation with the latter. We will not give a proof of such a fact here, as the latter is a special case of the more result proved in Lemma 12.

The reader might also have noticed that the de nition of the property Adeq involves only the behaviour of λ-term relations on computations, and does not say anything about their behaviour on values. This is rather obvious, as adequacy is an operational notion based on the evaluation semantics of a program. Formally, this does not mean that on values ctx coincides with the indiscrete relation 0.

In fact, compatibility of ctx forces to relate only those values that behaves appropriately when used inside computations. For instance, if v ctx , then by compatibility (and re exivity) of ctx we have Λ w ctx w too, which gives w (V • ) ≤ w (V • ). Obviously, this cannot be the case for all pairs of values , .

De nition 7 comes with an associated proof technique resembling a coinduction proof principle. In order to prove that a program e contextually approximates a program f , it is su cient to exhibiting a compatible preadequate λ-term relation R relating e and f . Symbolically,

R ⊆ R R ∈ Adeq R ⊆ ctx ( ctx -UMP)
We can use this proof technique to prove that ctx is a preorder, and thus a precongruence λ-term relation. For instance, in order to show that ctx is transitive, it su cient to prove that

( ctx • ctx ) ⊆ ( ctx • ctx ) and ( ctx • ctx ) ∈ Adeq.
By the proof principle induced by De nition 7 we can then infer ctx • ctx ⊆ ctx , i.e. transitivity of ctx . Although ctx has several interesting mathematical properties, it has a major drawback: proving that a program f contextually approximates a program e is oftentimes simply not doable in practice.

The reason is evident if we think to ctx as de ned with explicit contexts. In order to check whether Λ e ctx f holds, one has to study the behaviour of e and f inside any possible context of the language. In particular, it is necessary to test the behaviour of e and f when passed as input to arbitrary programs, of which we have no information about.

It is then useful to de ne suitable proof techniques for (probabilistic) contextual approximation. For us, a proof technique has the form of a λ-term relation R that has nicer operational properties than (probabilistic) contextual equivalence. The technique is said to be sound if R ⊆ ctx and fully abstract if R = ctx . Besides investigating probabilistic applicative similarity as program re nement per se, we can think to it as a proof technique for probabilistic contextual approximation. In particular, probabilistic applicative similarity testing values for their applicative behaviour only (i.e. in functional, as opposed to argument, position) and coming with an associated coinduction proof principle, it de nitely quali es as a powerful proof technique for ctx (provided, of course, that it is included in ctx ).

Before giving a proof of precongruence of probabilistic applicative similarity, we remark that in this section, even more than in previous ones, we have almost never used speci c feature of Λ p . The only place where we used its semantics is in the de nition of the notion of preadequacy. It comes with no surprise that we can abstract from such a notion and work with more general notions of preadequacy.

Γ Λ e R H Γ Λ R o f Γ Λ e R H f (H-1) Γ v R H u Γ v u R o w Γ v R H w (H-2).
Unfolding De nition 8 we see that we can give an alternative characterisation of R H using rules in Figure 2.5. Additionally, probabilistic applicative similarity being re exive and transitive, we see that H satis es nice several properties.

Lemma 4. The following hold:

1. o ⊆ H .
2. o • H ⊆ H (we refer to this property as pseudo-transitivity).

3. H is re exive, compatible, and substitutive.

We do not prove Lemma 4 here, as we will prove its generalisation in Chapter 5. By Lemma 4, we know that H is compatible and extends o , so that the restriction of H to closed terms extends . As a consequence, in order to prove probabilistic applicative similarity to be compatible, it is su cient to show that the restriction of H to closed terms is included in . That is:

Λ e H f Λ e f v H w v w (H-let) Γ Λ e R H e Γ Λ f R H f Γ Λ e or f R Γ Λ e or f R H (H-op) Figure 2.5: Howe extension of R.
By coinduction, it is thus su cient to prove that the restriction of H to closed terms is a probabilistic applicative simulation. This is the content of the so-called Key Lemma.

Lemma 5 (Key Lemma). The restriction of H to closed terms is a probabilistic applicative simulation.

Concretely, the Key Lemma requires to prove the following implications, for all closed computations e, f , and all closed values , w:

Λ e H f =⇒ e D( H V ) f v H w =⇒ ∀u ∈ V • . Λ u H wu.
Proving the second implication is straightforward, whereas proving the rst one, i.e. condition (app 1) in De nition 3, is non-trivial. First of all, we observe that attempting a proof of (app 1) by induction on e, we get stuck in the case for sequencing, i.e. for e = (let x = e 1 in e 2 ). In fact, treating such a case requires to deal with the open computation x Λ e 2 , and reasoning on instances of the form e 2 [x := ] does allow us to use the induction hypothesis. Standard proofs of the Key Lemma for the pure λ-calculus proceeds by induction on the big-step semantics of the language, which is something not possible for Λ p due to its in nitary operational semantics. To solve this problem we notice that D satis es the following induction-like principle. For any ω-chain (µ n ) n in DX , relation R on X , and ν ∈ DX , we have:

(∀n ≥ 0. µ n DR ν ) =⇒ sup n µ n DR ν .
As a consequence, we can attempt to prove (app 1) showing

∀n ≥ 0. e n D( H V ) f ,
and proceeding by induction on n. The case for n = 0 trivially holds, since for any ν ∈ DX and relation R on X we have ⊥ DR ν .

Let us now look at the (n + 1)-case. We proceed by case analysis according to the de nition of n , and relying on the de nition of H given by rules in Figure 2.5, which are syntax-directed. Let us examine the most interesting cases.

• Suppose e = return . We assume Λ return H f and show return n+1 D ( H V ) f . By rules in Figure 2.5, the former must be the conclusion of a derivation of the form:

v H w Λ return w f Λ return H f (H-val).
Since is a simulation, return w implies η(w ) D ( ) f . If it is the case that v H w implies η( ) D ( H V ) η(w ), the we could conclude the thesis using Lemma 4 (pseudo-transitivity). That is indeed the case. In fact, the operation D satis es the following general law. For all sets X , Y , and relation R ⊆ X × Y we have:

∀x, x ∈ X . x R x =⇒ η(x ) DR η(x ).
• Suppose e = (let x = in ) and assume Λ let x = in H f . By very de nition ofn , we have to show:

[x := -] † n n D( H V ) f
. By rules in Figure 2.5, Λ let x = in H f must be the conclusion of a derivation of the form:

Λ H h x Λ H h Λ let x = h in h f Λ let x = in H f (H-let).
We can apply the induction hypothesis on Λ H h, obtaining n D ( H V ) h . However, we cannot do the same on x Λ H h . Nonetheless, we notice that since H is substitutive, we have:

∀ , w ∈ V • . v H w =⇒ Λ [x := ] H h [x := w].
At this point the induction hypothesis can be applied, obtaining

[x := ] n D( H V ) h [x := w] . Stated otherwise, the functions [x := -] n , h [x := -] : V • → DΛ • satisfy the following generalised monotonicity condition: v H w =⇒ [x := ] n D( H V ) h [x := w] .
What we need to prove in order to conclude the thesis -again by Lemma 4 (pseudo-transitivity), noticing that Λ let x = h in h f implies let x = h in h D ( H V ) f -is that generalised monotonicity is preserved by the operation - † . That is, we wish the following general law to hold. For all programs e, e and computations x Λ f , f :

∀ , ∈ V • . v H =⇒ f [x := ] n D ( H V ) f [x := ] e n D ( H V ) e =⇒ f [x := -] † n e n D ( H V ) f [x := -] † e
Notice that the above law can rewritten as:

∀ , ∈ V • . v H =⇒ f [x := ] n D ( H V ) f [x := ] e n D( H V ) e =⇒ let x = e in f n+1 D ( H V ) let x = e in f
The above condition is nothing but a speci c instance of a more general (algebraic) law describing the general behaviour of D. For all sets X , Y , subdistributions µ ∈ DX , ν ∈ DY , functions f , : X → DY , and relations R, S over X and Y , respectively, we have:

∀x, x ∈ X . x R x =⇒ f (x ) DS (x ) µ DR ν =⇒ f † (µ) DS † (ν )
Providing that D satis es the above property, is non-trivial, and essentially requires a modi cation of Strassen's Theorem to subdistribution. We will prove that in a more abstract way in Chapter 4.

• Finally, we consider the case for e = or . This case can be proved as previous ones, simply noticing that the following general law holds, for all sets X , subdistributions µ, µ , ν , ν ∈ DX , and relation R on X :

µ DR µ ν DR ν µ ⊕ ν DR µ ⊕ ν
Summing up, the proof of the Key Lemma is rather straightforward once we know that the map D satis es some general properties, which are totally independent of Λ p . The reader may have noticed that such properties can, in principle, be de ned on any relation lifting operation. This is indeed the case, as we are going to discuss.

Final Discussion

Looking back at what we have done in this chapter, we see that our de nitions and results do not really depend neither on subdistributions (and thus on the subdistribution functor D) nor on the map D in an essential way. Rather, they follow from suitable structural properties of D and D. Such structural properties can be summarised as follows:

1. In order to give operational semantics to Λ p , we noticed that the set DX comes with an ω-cppo structure, as well as with maps η : X → DX and f † : DX → DY , for any map f : X → DY . Such maps are required to be monotone and continuous. Abstractly, this means that the subdistribution functor D is part of a monad carrying a suitable domain structure, and that the latter properly interacts with the monad structure of D.

2. In order to de ne probabilistic applicative similarity, we introduced a suitable map D lifting relations over sets X to relations over DX . The map is required to be monotone and to quasi-preserve the identity relation as well as relation composition. That guaranteed probabilistic applicative similarity to be a preorder.

3. Finally, knowing that D satis es a suitable induction-like principle, and some suitable conditions with respect to the maps η and f † (meaning that D properly interacts with the monad structure of D), we were able to use Howe's method to prove compatibility of , hence concluding the latter to be a precongruence.

There are many other functors other than D that satisfy these properties, the powerset functor being an example of such a functor. However, to model e ectful calculi we also need suitable e ect-triggering operations, which act as sources of side e ects. This is done in Λ p using the probabilistic choice operation or. We observed that the choice of operations does not really matter, as far as they can be interpreted as operations on D, and behave in a suitable way. Again, this is not speci c to the functor D (think, for instance, to a nondeterministic choice operation interpreted as set-theoretic union on the powerset functor).

What's Next?

In next chapters we will take advantage of the above observations, de ning an abstract calculus parametric over collections of operation symbols and monads. We will then de ne an abstract notion of applicative similarity, which we call e ectful applicative similarity, and prove it to be a precongruence using a generalisation of Howe's method.

The resulting theory is rich, allowing to describe a large family of e ectful calculi, including probabilistic and nondeterministic calculi, as well as calculi with input/output, global states, exceptions, and combinations thereof. Additionally, the mathematical framework we will develop to de ne e ectful applicative similarity provides a powerful formal tool to study several notions of program equivalence and re nement. Among them, we will de ne and analyse generalisation of contextual approximation (resp. equivalence), CIU approximation (resp. equivalence), and normal form similarity (resp. bisimilarity) to e ectful calculi.

Chapter 3 A Computational Calculus for Algebraic E ects [. . .] what I will call a symbolic calculus; which, with certain symbols and certain laws of combination, is symbolic algebra: an art, not a science; and an apparently useless art, except as it may afterwards furnish the grammar of a science.

Augustus de Morgan, Trigonometry and Double Algebra

In this chapter we introduce the main calculus we will use in this dissertation, namely a call-by-value λ-calculus (G. [START_REF] Plotkin | Call-by-name, call-by-value and the lambda-calculus[END_REF] with algebraic operations in the style of [START_REF] Plotkin | Adequacy for algebraic e ects[END_REF][START_REF] Manes | Taut monads and t0-spaces[END_REF], 2003). We call such a calculus Λ Σ . Λ Σ is a calculus with algebraic e ects (G. D. [START_REF] Plotkin | Notions of computation determine monads[END_REF], 2003), meaning that e ects are produced (and can only be produced) by suitable operations. In his seminal work on notions of computation [START_REF] Moggi | Computational lambda-calculus and monads[END_REF][START_REF] Moggi | Notions of computation and monads[END_REF], Moggi gave a uni ed account of computational e ects as strong monads. An example is provided by the calculus Λ p of Chapter 2, where we used the subdistribution monad to model (the result of) probabilistic computations. However, notions of computation (and thus monads) describe the e ects produced by computations only, and do not prescribe the existence of computational primitives to produce such e ects. To do so, one needs to have operations in the language to actually make e ects happen. This in indeed the case in Λ p , where probabilistic computations are produced by the probabilistic choice operation or, and then propagated using sequencing. The calculus Λ Σ builds upon this observation. Therefore, Λ Σ relies on monads to model computational e ects, and on (algebraic) operations to produce such e ects.

These features qualify Λ Σ as a minimal computational λ-calculus with algebraic e ects. On a syntactic level, Λ Σ is parametrised by a signature Σ of (uninterpreted) operation symbols. Examples are operation symbols meant to model probabilistic and nondeterministic choices, input and output primitives, as well as primitives to read and write from a global store, or rise exceptions. On a semantic level, we use monads (on Set) to de ne an abstract operational semantics for Λ Σ , which we called monadic operational semantics. Following Plotkin andPower (G. D. Plotkin &Power, 2001, 2002), we interpret operation symbols as algebraic operations on monads. From an operational perspective, algebraicity of an operation means that the (operational) behaviour of the operation is independent of its arguments, or, equivalently, of the environment in which it is evaluated. Such a restriction allows to structure e ectful computations and gives a tight control on the way e ects are produced. All the operation symbols previously mentioned can be interpreted as algebraic operations on suitable monads. An example of a nonalgebraic, yet monadic e ect [START_REF] Benton | Monads and e ects[END_REF] is provided by continuations1 (Hyland et al., 2007), whereas exception handlers 2 are an example of non-algebraic, yet natural operations.

This chapter is organised as follows: we rst recall some necessary background notions on monads and give examples of relevant notions of computation (i.e. monads modelling interesting computational e ects). We then introduce algebraic operations abstractly, giving examples of both algebraic and nonalgebraic operations. Lastly, we introduce the calculus Λ Σ and de ne its monadic operational semantics. Such a semantics is de ned in the same spirit of the evaluational semantics of Λ p . This means that in order to address in nitary behaviours, we need to require monads to carry a suitable domain structure and operation symbols to be monotone and continuous.

Monads and Algebraic Operations

We assume the reader to be familiar with basic category theory [START_REF] Maclane | Categories for the working mathematician[END_REF] and basic domain theory [START_REF] Abramsky | Domain theory[END_REF]. In particular, we assume the reader to know the notions of a category and of a functor, as well as the notions of an ω-pointed complete partial order (ω-cppo, for short), and of a monotone and continuous function. Throughout this dissertation, we will work with the categories Set (of sets and functions) and Rel (of sets and relations), only 3 . As a consequence, the amount of category theory we will use is minimal: we may say that we use the vocabulary of category theory, rather than category theory itself.

Concerning notation, we try to use the same notation used in [START_REF] Maclane | Categories for the working mathematician[END_REF] for category theory, and in [START_REF] Abramsky | Domain theory[END_REF] for domains. In order to improve readability, we use the notation

(x n ) n to denote an ω-chain x 0 • • • x n • • • in a domain (X , , ⊥)
, hence assuming n to range over elements of N. As a minor di erence with standard notation, we denote the composition of a morphism with a morphism f (with appropriate source and target) in a category C as • f , rather than • f . We denote by 1 X : X → X the identity morphism, omitting subscripts when unambiguous.

We begin our technical exposition recalling the notion of a monoidal category [START_REF] Maclane | Categories for the working mathematician[END_REF].

De nition 9. A monoidal category C, ⊗, I , α, λ, ρ consists of a category C equipped with a bifunctor ⊗ : C ⊗ C → C, called the tensor product of C, a distinguished object I , called the unit of C, and three natural isomorphisms:

α X ,Y ,Z : X ⊗ (Y ⊗ Z ) (X ⊗ Y ) ⊗ Z λ X : I ⊗ X X ρ X : X ⊗ X X .
The natural isomorphisms are required to satisfy the following coherence conditions:

1 X ⊗ α Y ,Z ,W • α X ,Y ⊗Z ,W • (α X ,Y ,Z ⊗ 1 W ) = α X ,Y ,Z ⊗W • α X ⊗Y ,Z ,W (1 X ⊗ λ Y ) • α X ,I ,Y = ρ X ⊗ 1 Y .
A symmetric monoidal category is a monoidal category C equipped with the additional natural isomorphism γ X ,Y : X ⊗ Y Y ⊗ X subject to the coherence condition:

γ Y ,X = γ X ,Y = 1 X ⊗Y .
Our primary example of a symmetric monoidal category is the category Set, with tensor product given by cartesian product and unit object given by the terminal object. We now recall the notion of a strong monad [START_REF] Kock | Strong functors and monoidal monads[END_REF][START_REF] Moggi | Notions of computation and monads[END_REF]. For our purpose, it is more convenient to work with the equivalent notion of a (strong) Kleisli triple.

De nition 10. Given a monoidal category C, ⊗, I , α, λ, ρ , a strong Kleisli triple on C is a triple T = T , η, - * consisting of:

1. A map T over objects of C, called the carrier of T.

2. A C-object-indexed family η of morphisms η X : X → T X , called the unit of T on X .

3. An operation - * , called strong Kleisli extension, mapping a C-morphism f : Z ⊗ X → TY to f * : Z ⊗ T X → TY . The morphism f * is called the strong Kleisli extension of f . These data must satisfy the following identities, where f : W ⊗ X → TY and : W ⊗ Y → T Z :

f * • (1 V ⊗ η X ) = f (η X • λ X ) * = λ T X ( * • (1 U ⊗ f ) • α U ,V ,X ) * = * • (1 U ⊗ f * ) • α U ,V ,T X .
If we relax De nition 10 replacing - * with an operation - † , called Kleisli extension, mapping a Cmorphism f : X → TY to f † : T X → TY subject to the identities (where f : X → TY and :

Y → T Z ) η † X = 1 T X f † • η X = f † • f † = ( † • f ) † ,
then we obtain the notion of a Kleisli triple. With the exception of Chapter 9 to Chapter 12, throughout this dissertation we will work with Kleisli triples ony. We immediately notice that Kleisli triples can be de ned on arbitrary categories (and not only on monoidal ones), and that f † can be de ned in terms of - * and the unit object. Moreover, (strong) Kleisli triples and (strong) monads [START_REF] Maclane | Categories for the working mathematician[END_REF] are in a bijective correspondence. Each Kleisli triple T , η, - † yields a monad T , η, µ by de ning:

T f (η Y • f ) † µ X (1 T X ) † .
Vice versa, for any monad (T , η, µ) we de ne

f † : T X → TY µ Y • T f . Finally, if T , η, µ has strength t X ,Y : X ⊗ TY → T (X ⊗ Y ), then we can de ne f * : V ⊗ T X → TY as µ Y • T f • t V ,X .
Vice versa, we can de ne t X ,Y as η * X ⊗Y . In light of these equivalences, we will abuse terminology and simply refer to (strong) monads to denote both (strong) monads and (strong) Kleisli triples. We also recall that every monad on Set is strong. Finally, unless explicitly mentioned, all functors and monads will be on Set. Accordingly, when speaking of functors and monads we tacitly assume to refer to Set endofunctors and monads on Set, respectively.

When working with an arbitrary monad, we will use the traditional notation T = T , η, - † to denote it. Such a notation, however, is not very handy when dealing with either speci c monads or with multiple monads at the same time. To x this issue, we sometimes use the following notation and convention. Given a monad T = T , η, - † , we always use capital Latin letter to denote its carrier, whereas the name of the monad is given by the same letter written in 'blackboard style'. This might in principle create confusion with the notation used for sets, i.e. Latin letters X , Y ,W , Z , X , Y , . . ., but the context will resolve any ambiguity (either implicitly or explicitly). The unit of T will be denoted by -i.e. with same letter used to denote its carrier, but written in small capital style -whereas we use the notation -T in place of - † . For instance, when working with two monads T, U we denote them as T = T , , -T and U = U , , -U , respectively. Finally, when unambiguous we omit subscripts. For instance, for a xed set X and a monad T we write η(x ) (reps. (x )) in place of η X (x ) (resp. X (x )).

Relevant Examples

Before introducing algebraic operations, we give examples of monads modelling relevant computational e ects.

Example 3 (Partiality monad). We model partial computations using the partiality (also called maybe) monad M = M, , -M . The carrier MX of M is de ned as {just x | x ∈ X } ∪ {⊥}, where ⊥ is a special symbol denoting divergent computations. The unit and Kleisli extension of M are de ned as follows:

(x ) just x f M (x)      f (x ) if x = just x, ⊥ if x = ⊥.
We notice that we can combine the maybe monad with any other monad T, as an instance of the socalled sum of e ects [START_REF] Hyland | Combining e ects: Sum and tensor[END_REF], an operation on Lawvere theories (Hyland & Power, 2007;[START_REF] Lawvere | Functorial Semantics of Algebraic Theories[END_REF] introduced to combine algebraic theories. Since our focus is on monads, a general treatment of such an operation is outside the scope of this dissertation. Nevertheless, for our purposes the following result is enough.

Proposition 3. Given a monad T = T , , -T , de ne the sum TM of T and M as the triple T M, , -TM de ned as follows:

T MX T (MX ) X MX • X f TM ( f M ) T ,
where, for a function f : X → T MY we de ne f M : MX → T MY by:

f M (x)      MX (⊥) if x = ⊥ f (x ) if x = just x.
Then TM is a monad.

Proving Proposition 3 is a straightforward exercise (the reader can also consult [START_REF] Hyland | Combining e ects: Sum and tensor[END_REF]).

Example 4 (Exception monad). Let E be a set of exception symbols. The exception monad E = E, , -E , over E, has carrier E (X ) X + E (for simplicity we assume E to be disjoint from X ), whereas and -E are de ned as follows:

(x ) x f E (x)      f (x ) if x = x, e if x = e ∈ E.
The exception monad is used to model total computations with exceptions, an element e ∈ E denoting the exception raised by a computation. It is easy to see that E has the same structure of M, so that we can replace M with E in Proposition 3. In particular, we can model partial computations with exceptions using the sum ME.

Example 5 (Output monad). Let A be a given alphabet and let A * be the set of nite strings over A.

We denote by ε the empty string, and write uw for the concatenation of the strings u and w The output monad O = O, , -O has carrier O (X ) A * × X , whereas and -O are de ned as follows:

(x ) (ε, x ) f O (u, x ) (uw, ),
where (w, ) = f (x ). The output monad models total computations with outputs. An element (u, x ) represents the result of a computation outputting the string u and returning the element x.

We can extend O to take into account divergent computations. To do so, we have to take into account divergent computations outputting in nitely many symbols (such as the recursively de ned program e = print c .e). Let A ∞ be the set of nite and in nite strings over A. We extend the de nition of string concatenation to in nite strings by de ning uw to be

u if u is in nite. The partial output monad O ∞ = O ∞ , ∞ , -O ∞ has carrier O ∞ (X ) A ∞ × MX , whereas ∞ and -O ∞ are de ned as follows: ∞ (x ) (ε, just x ) f O ∞ (u, x)      (u, ⊥) if x = ⊥ (uw, y) if x = just x and f (x ) = (w, y).
Example 6 (Powerset monad). The non-empty powerset monad F = F , , -F has carrier FX {x ⊆ X | x ∅}, whereas and -F are de ned by:

(x ) {x } f F (X) x ∈X f (x ).
The non-empty powerset monad is used to model total nondeterministic computations, with the rationale that a set X ∈ FX denotes the set of possible (nondeterministic) outcomes of a computation. In order to model partial computations one can use the full powerset monad P = P, , -P , where and -P are de ned as for F, or use FM, the sum F and M. In the former case we use the empty set to model the result of a purely divergent computation, whereas in the latter case we explicitly keep track of divergence using the symbol ⊥. We prefer the latter alternative, as it provides a ner analysis of pure nondeterminism4 .

Example 7 (Distribution monad). The (discrete) distribution monad

D = D, , -D has carrier DX {µ : X → [0, 1] | x ∈supp(µ ) µ (x ) = 1}, where supp(µ) {x ∈ X | µ (x ) > 0}
is the support of the distribution µ). The maps and -D are de ned as follows:

(x )( )      1 if x = 0 if x f D (µ)( ) x ∈X µ (x ) • f (x )( ).
Sometimes it is useful to write a distribution µ as a weighted formal sum. That is, we write µ as the sum5

i ∈I p i • x i such that µ (x ) = x i =x p i . Accordingly, we can write (x ) as 1 • x. To improve readability6 , for a distribution µ ∈ DX , we will often write x ∈X µ (x ) in place of x ∈supp(µ ) µ (x ).

We have already seen that D does not take into account partiality. Probabilistic partial computations are modelled using the monad DM, the sum of D and M. Another possibility is to work with the subdistribution monad D ≤1 , which is de ned as D but requiring the weaker condition x ∈X µ (x ) ≤ 1. Although we will work with DM, we notice that D ≤1 is isomorphic to DM, the bijection φ : D ≤1 X → DMX being de ned by:

φ(µ)(⊥) 1 -µ (X ) φ(µ)(just x ) µ (x ) φ -1 (µ)(x ) µ (just x ).
Example 8 (Global state monad). L Let L be a set of public location names. For simplicity we assume locations to store bits (later, we will allow locations to store more general values). A store (or state) is a function σ : L → {0, 1}. We write S for the set of stores {0, 1} L . The global state monad G = G, , -G has carrier GX (X × S ) S , whereas and -G are de ned by:

(x )(σ ) (x, σ ) f G (α )(σ ) f (x )(σ ),
where α (σ ) = (x , σ ). An element of GX is thus a function α mapping a state σ to a pair (x , σ ) according to the following rationale: α represents an imperative computation that when executed in the initial state σ ends in the nal state σ , returning the result x. We can combine the global state monad with the partiality monad, obtaining the monad

M ⊗ G whose carrier is (M ⊗ G)X M (X × S ) S .
Actually, the global state monad can be combined with any monad T using the so-called tensor of e ects [START_REF] Hyland | Combining e ects: Sum and tensor[END_REF]. As for the sum of e ects, the formal de nition of the tensor operation is de ned in terms of Lawvere theories, and thus it is outside the scope of this dissertation. Nonetheless, for our purposes the following result is enough.

Proposition 4. Given a monad T = T , , -T the tensor T ⊗ G of T and G is the triple T ⊗ G, ⊗ , -T⊗G de ned as follows:

(T ⊗ G)X T (S × X ) S ( ⊗ ) X = curry S ×X f T⊗G (α )(σ ) = (uncurry f ) T (α )(σ ), where for f : X → Y Z and : Z × X → Y we have uncurry f : Z × X → Y and curry : X → Y Z . Then T ⊗ G is a monad.
Tedious calculations show that T ⊗ G is indeed a monad, but we refer to [START_REF] Hyland | Combining e ects: Sum and tensor[END_REF] for a proper treatment. We notice that tensoring G with DM we obtain a monad for probabilistic imperative computations, whereas tensoring G with FM we obtain a monad for nondeterministic imperative computations.

Example 9 (Cost monad). The (total) cost (also known as ticking or improvement [START_REF] Sands | Improvement theory and its applications[END_REF]) monad C 0 = C 0 , 0 , -C 0 has carrier C 0 X N × X , whereas 0 and -C 0 are de ned as follows:

0 (x ) (0, x ) f C 0 (n, x ) (n + m, ),
where f (x ) = (m, ). The (total) cost monad is used to model the cost of (total) computations. An element (n, x ) models the result of a computation outputting the value x with cost n (the latter being an abstract notion that can be instantiated to e.g. the number of reduction steps performed). In order to model the cost of partial computations, we consider the monad C = C, , -C de ned as:

CX M (N × X ) (x ) just (0, x ), f C (x)      ⊥ if x = ⊥ or x = just (n, x ) and f (x ) = ⊥ just (n + m, ) if x = just (n, x ) and f (x ) = just (m, ).
Our design choice can be motivated thus: as the element ⊥ models divergent computations, we can assume the latter to have all the same cost, so that such information need not be explicitly written (for instance, measuring the number of reduction steps performed, we would have that divergent computations all have cost ∞).

Algebraic Operations

Monads provide an elegant way to structure e ectful computations. However, they do not o er any actual e ect constructor. Following [START_REF] Plotkin | Adequacy for algebraic e ects[END_REF][START_REF] Manes | Taut monads and t0-spaces[END_REF], 2003) we use algebraic operations as e ect producers. As already remarked, from an operational perspective algebraic operations are those operations whose behaviour is independent of their continuations, or, equivalently, of the environment in which they are evaluated. This is re ected by important operational equivalences and re nements, such as the following one that the reader can easily verify to hold in Λ p :

let x = (e or f ) in ctx (let x = e in ) or (let x = f in ).
We begin giving a formal de nition of a nitary algebraic operation on a monad. Let us recall that a signature Σ consists of a collection of operation symbols op together with their arity, the latter being a function associating to each operation symbol a natural number representing its number of arguments (or operands). We sometimes use the notation op : n to indicate that the operation symbol op has arity n. In the following, given a function f :

X → Y we write n f : X n → Y n for f × • • • × f n .
De nition 11. Let Σ be a signature. We say that a monad T = T , η, - † is Σ-algebraic if associated with any n-ary operation symbol op in Σ is a set-indexed family of functions op T X :

(T X ) n → T X such that op T Y • n f † = f † • op T X (alg op)
holds, for any n-ary operation symbol op ∈ Σ and function f : X → TY .

Most of the times we will simply write op in place of op T . Moreover, when unambiguous we will omit subscripts, hence writing op in place of op X . Notice that De nition 11 is essentially requiring T X to carry a Σ-algebra structure such that f † is a Σ-algebra homomorphism, for any set X and function f : X → TY . In fact, when written in pointiwise notation, (alg op) gives:

f † ( op X (x 1 , . . . , x n )) = op Y ( f † (x 1 ), . . . , f † (x n )).
Remark 1. If the monad is strong we straightforwardly generalise De nition 11 modifying (alg op) as

f * (z, op X (x 1 , . . . , x n )) = op Y ( f * ( , x 1 ), . . . , f * ( , x n )),
(strong alg op)

where now f : Z × X → TY .

Example 10 (Partiality monad). The partiality monad M usually comes with no operation, as the possibility of divergence is an implicit feature of any Turing complete language. However, it is sometimes useful to add an explicit divergence operation (for instance, in strongly normalising calculi). For that, we consider the signature Σ M {↑: 0}. Having arity zero, the operation ↑ acts as a constant, and has semantics

↑ M = ⊥. Since f † (⊥) = ⊥, M is Σ M -algebraic.
We thus observe that although divergence is often not considered an e ect, from a mathematical perspective it certainly behaves as such.

Example 11 (Exception monad). For the exception monad E (with set of exception symbols E), we de ne the signature Σ E {raise e : 0 | e ∈ E}. Having arity zero, an operation of the form raise e acts as a constant, and has semantics de ned as raise e E e, for any set X . Obviously E is Σ E -algebraic. We now generalise Proposition 3 to Σ-algebraic monad. We do so for the exception monad (as the maybe monad might be regard as a trivial case with no operations).

Proposition 5. Let T = T , , -T be Σ T -algebraic monad. Then the the monad TE is Σ TE -algebraic, where Σ TE Σ T ∪ Σ E .
As for Proposition 3, the proof is straightforward (again, the reader can consult [START_REF] Hyland | Combining e ects: Sum and tensor[END_REF] for details). In fact, we can interpret operation symbols in Σ TE as follows:

op TE X op T EX raise e TE X EX ( raise e E X ),
where op is an n-ary operation symbol in Σ T . Easy calculations show that (alg op) holds. For instance, we have:

op TE Y • n f TE = op TE Y • n ( f E ) T [By de nitions in Proposition 3] = ( f E ) T • op TE X [By (alg op) for T] = ( f E ) T • op TE X , [By de nitions in Proposition 3]
where f E is the obvious modi cation of f M in Proposition 3 to the exception monad. Example 13 (Powerset monad). For the non-empty powerset monad F we de ne the signature Σ F {or : 2}. The semantics of or is de ned as or F (X, Y) X ∪ Y. Clearly F is Σ FM -algebraic. Moreover, by Proposition 5 FM is Σ FM -algebraic.

Example 14 (Distribution monad). For the distribution monad D we de ne the signature

Σ D {or p : 2 | p ∈ Q ∩ [0, 1]}.
The intended semantics of a program e or p f is to evaluate to e with probability p, and to f with probability 1-p. The interpretation of or p is de ned by or p

D (µ, ν )(x ) p •µ (x )+(1-p) •ν (x ).
We will actually work with the single operation or 1 2 (abbreviated as or). We see that D is Σ D -algebraic, and that by by Proposition 5 DM is Σ DM -algebraic.

Example 15 (Cost). For the partial cost monad C we de ne the signature Σ C {ti : 1}. The intended semantics of ti is to add a unit to the cost counter:

ti C (x)      ⊥ if x = ⊥ just (n + 1, x ) if x = just (n, x ). Clearly C is Σ C -algebraic.
Example 16 (Global State). For the global state monad G we de ne a signature containing operations for reading the content of a location, and from storing bits in a location. Formally, de ne the signature Σ G {set :=b : 1, get : 2 | ∈ L, b ∈ {0, 1}} whose interpretation is de ned as follows:

set :=b G (α )(σ ) α (σ [ := b]) get G (α, β )(σ )      α (σ ) if σ ( ) = 0 β (σ ) if σ ( ) = 1,
where σ [ := b] denotes the function that behaves as σ on locations and that returns b on . We can extend Proposition 4 to Σ-algebraic monads. Proposition 6. Let T = T , , -T be Σ T -algebraic monad. Then the the monad T ⊗ G is Σ T⊗G -algebraic, where Σ T⊗G Σ T ∪ Σ G .

As for Proposition 4, proving Proposition 6 is straightforward (the reader can consult [START_REF] Hyland | Combining e ects: Sum and tensor[END_REF] for details). In fact, we can interpret operation symbols in Σ T⊗G as follows:

op T⊗G X (α 1 , . . . , α n )(σ ) op T X ×S (α 1 (σ ), . . . , α n (σ )) set :=b T⊗G X (α )(σ ) α (σ [ := b]) get T⊗G X (α, β )(σ )      α (σ ) if σ ( ) = 1 β (σ ) if σ ( ) = 0,
where op is an n-ary operation symbol in Σ T . Easy calculations show that indeed (alg op) holds. For instance, we have:

f T⊗G ( op T⊗G X (α 1 , . . . , α n ))(σ ) = (uncurry f ) T ( op T X ×S (α 1 (σ ), . . . , α n (σ ))) [By de nitions in Proposition 6] = op T X ×S ((uncurry f ) T (α 1 )(σ ), . . . , (uncurry f ) T (α n )(σ )) [By (alg op) for T] = op T⊗G X ( f T⊗G (α 1 ), . . . , f T⊗G (α n ))(σ ).
[By de nitions in Proposition 6]

Working with global states we see a limit of our framework, namely that operation symbols must have a nitary arity. If we allow locations to store arbitrary values (such as representation of natural numbers), then it is natural to introduce an operation get whose computational behaviour is as follows: get (x.e) reads the content of the location , which is a value , and continues as e[x := ]. In order to model this kind of operation we introduce generalised operations (G. D. [START_REF] Plotkin | Algebraic operations and generic e ects[END_REF].

De nition 12.

A generalised operation on a set X is a function ω : P × X I → X . The set P is called the parameter set of the operation, whereas the (index) set I is called the arity of the operation.

A generalised operation ω : P ×X I → X thus takes as arguments a parameter p and a map κ : I → X giving for each index i ∈ I the argument κ (i) to pass to ω. The notion of an algebraic signature is modi ed accordingly.

De nition 13.

1. A generalised signature Σ consists of a set of operation symbols op together with their generalised arity. The latter is given by a a parameter set P and an arity/index set I . We write op : P I to denote that the operation symbol op has parameter set P and arity set I .

2. Given a generalised signature Σ, we say that a monad T = T , η, - † is Σ-algebraic if associated with any generalised operation symbol op : P I in Σ is a set-indexed family of functions op T X : P × (T X ) I → T X . such that the following identity holds for any map f : X → TY , parameter p ∈ P, and map κ :

I → T X : f † ( op T X (p, κ)) = op T Y (p, f † • κ). (gen alg op)
It is easy to see by taking the one-element set as parameter set and a nite set as arity set, generalised operations subsume nitary operations. We apply the same notational convention introduced for nitary operations to generalised operations.

Example 17 (Global states, revised). We consider a variation of the global state monad (which, overloading the notation, we still denote by G) in which locations store arbitrary structures which we assume to be encoded as values (via some standard encoding). The main example the reader may keep in mind is given by natural numbers and Church numerals. We denote by V the collection of such values, and assume V to be countable. Formally, we let S be the set V L , and consider a signature consisting of generalised operations set : V 1 and get : 1 V. From a computational perspective such operations are used to build programs of the form set ( , e) (oftentimes abbreviated as := ; e) and get (x.e). The former stores the value in the location and continues as e, whereas the latter reads the content of the location , say it is , and continue as e[x := ]. Here e is used as the description of a function κ e from values to terms de ned by κ e ( ) e[x := ]. The interpretation of the new operations on G is standard:

set G ( , α )(σ ) = α (σ [ := ]) get G (κ)(σ ) = κ (σ ( ))(σ ).
For simplicity, we work with generalised operation symbols with generalised arity given by sets of values only. As a convention, we simply refer to operation symbols and signatures to denote generalised operation symbols and generalised signatures, respectively. Moreover, even if standard nitary operation symbols can be modelled as generalised operation symbols, it is useful to allow signatures to distinguish between di erent kinds of operation symbols. Given a signature Σ and T, we allow Σ to contain operation symbols of the following kinds:

1. Finitary operation symbols. We write op : n to denote that the operation symbol op has arity n.

Its interpretation on T is given by a set-indexed family of functions op X : (T X ) n → T X .

2. Finitary parametric operation symbols. We write op : P n to denote that the operation symbol op has arity n and parameter set P. Its interpretation on T is given by a set-indexed family of functions op X : P × (T X ) n → T X .

3. Generalised (non-parametric) operation symbols. We write op : V to denote that the operation symbol op has arity set V. Its interpretation on T is given by a set-indexed family of functions op X : (T X ) V → T X .

4. Generalised operation symbols. We write op : P V to denote that the operation symbol op has parameter set P and arity set V. Its interpretation on T is given by a set-indexed family of functions op X : P × (T X ) V → T X .

Remark 2 (Generalised operations, abstractly.). Our presentation of generalised operations is rather concrete. Their original formulation in (G. D. [START_REF] Plotkin | Algebraic operations and generic e ects[END_REF] (where they are called algebraic operations) is given in terms of enriched category theory [START_REF] Kelly | Basic concepts of enriched category theory[END_REF]. Roughly speaking, an algebraic operation is de ned as a family of morphisms α x : (T x ) → (T x ) w on a symmetric monoidal V-category C parametrically natural in the Kleisli V-category C T . Here V is a complete and cocomplete symmetric monoidal closed category7 , T is a strong V-monad on C, and (-) denotes cotensor with an object of V. It is easy to see that taking V = Set we recover our, concrete, notion of generalised operation, the set being the arity set and w being the parameter set. Requiring α x to be parametrically natural in C T is essentially requiring (strong) Kleisli extensions of functions to behave as algebra homomorphisms, and in the more abstract setting of (G. D. [START_REF] Plotkin | Algebraic operations and generic e ects[END_REF] ensures algebraic operations to commute with evaluation contexts. The main advantage of the enriched approach is that it allows a uniform treatment of complex arities as objects of V. Interesting examples are for V instantiated as Set, ω-Cpo (the category of ω-cppos), the category of posets, and functor categories (working with categories of the form [W , Set], where W is a suitable category of worlds, it is possible to model local states as algebraic e ects ).

Following the line of our working example Λ p , we see that Σ-algebraic monads do not have enough structure to give operational semantics to e ectful calculi. In fact, in Chapter 2 we relied on the ωcppo structure of D to model the in nitary operational behaviour of Λ p programs. As a consequence, in order to give a general monadic operational semantics to e ectful calculi, we need to impose some domain theoretic properties on monads, whereby we account for in nitary computational behaviours. This can be elegantly done using the abstract notion of (ω-cppo)-enrichment [START_REF] Kelly | Basic concepts of enriched category theory[END_REF]. However, such a level of abstraction is not necessary for our purposes, and thus we prefer the following more concrete de nition.

De nition 14. Given a Σ-algebraic monad T = T , η, - † we say that T is Σ-continuous8 if to any set X is associated an order X and an element ⊥ X ∈ T X such that T X , X , ⊥ X is an ω-cppo and the following conditions hold, for any operation symbol op : P V in Σ.

Monotonicity. For all functions f , : X → TY , κ, ν : V → T X , and elements x, y ∈ T X , we have:

κ ν =⇒ op(p, κ) op(p, ν ) f =⇒ f † † x y =⇒ f † (x) f † (y).
Continuity. For all ω-chains (κ n ) n , ( f n ) n , and (x n ) n in (T X ) V , (TY ) X , and T X , respectively, we have:

op X (p, n κ n ) = n op X (p, κ n ) ( n f n ) † = n f † n f † ( n x n ) = n f † (x n ).
Strictness. For any f : X → TY we have:

f † (⊥) = ⊥.
When clear from the context, we will write ⊥ and in place of ⊥ X and X , respectively.

Example 18. The monads M, ME, FM, DM, O ∞ , GM, and C are Σ-continuous. The order on MX , MEX , and C is the at ordering de ned by:

x y ⇐⇒ x = ⊥ or x = y.
Indeed ⊥ behaves as the bottom element. The order on F M is de ned by:

x y ⇐⇒ ∀x ∈ X . just x ∈ x =⇒ just x ∈ y.
Notice that we have {⊥} y for any set y. Similarly, the order on DMX is de ned by:

µ ν ⇐⇒ ∀x ∈ X . µ (just x ) ≤ ν (just x ).
Notice that we have η(⊥) µ, for any µ ∈ DMX . The order on GMX is de ned pointiwise from the at ordering on M (X × S ), whereas we order O ∞ X as follows:

u, x w, y ⇐⇒ (x = ⊥ ∧ u ⊆ w ) ∨ (x = just x ∧ y = just x ∧ u = w ),
where ⊆ denotes the pre x order on A ∞ . Checking the strictness, monotonicity, and continuity properties of De nition 14 is a routine exercise.

With De nition 14 we have introduced all the abstract counterparts of the structural properties of the subdistribution monad we used in Chapter 2 to give operational semantics to Λ p . Therefore, it is time to introduce our vehicle calculus Λ Σ and its monadic operational semantics.

A Computational Calculus with (Algebraic) Operations

In this section we de ne the syntax and semantics of Λ Σ , our computational calculus with algebraic operations. Λ Σ is an untyped call-by-value λ-calculus extending Levy's ne-grain call-by-value (P. [START_REF] Levy | Modelling environments in call-by-value programming languages[END_REF] with algebraic operations. The syntax of Λ Σ is parametrised by a (generalised) signature of operation symbols Σ, and it is given in Figure 3.1, where x ranges over a xed (countably in nite) set of variables, op : P I (I is countable) ranges over elements of Σ, and p ranges over elements of P. The rationale behind Λ Σ is the same one behind Λ p . We have two disjoint syntactical classes, namely the class of computations (denoted by e, f , . . .) and the class of values (denoted by , w, . . .). We generically refer to syntactical expressions of Λ Σ (i.e. computations or values) as terms. As for Λ p , it is useful to introduce the 'hygienic' convention of keeping track of free variables of computations and values.

e, f ::= return (return)

,

w ::= x (variable) | w (application) | λx.e (abstraction). | let x = e in f (sequencing) Γ Λ e Γ, x Λ f Γ Λ let x = e in f Γ, x Λ e p ∈ P Γ Λ op(p, x.e) Figure 3.2: Sequents for Λ Σ .
We do that by means of sequents of the form Γ Λ e and Γ v . The letter Γ ranges over nite sets of variables, and the intended meaning of a sequent Γ Λ e is that e is a computation with free variables among Γ (the sequent Γ v has a similar reading). Rules for sequents are given in Figure 3.2, where we write Γ, x in place of Γ ∪ {x }.

Clearly, provable sequents are closed under weakening, meaning that e.g. if Γ Λ e is provable, then so is Γ, x Λ e. From now on when speaking about sequents we will tacitly mean provable sequents. Closed terms thus correspond to sequents with empty premises (which we simply denote as e.g. Λ e). We also introduce the following notation:

Λ {e | ∃Γ. Γ Λ e} Λ Γ {e | Γ Λ e} Λ • {e | Λ e} V { | ∃Γ. Γ v } V Γ { | Γ v } V • { | v }.
The intuition behind constructors of Λ Σ is the same one given for Λ p . Concerning formal details, we adopt standard syntactical conventions as in [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF] (notably the so-called variable convention). The notion of a free (resp. bound) variable is de ned as usual (notice that the variable x is bound in op(p, x.e)). In particular, the collection FV (e) (resp. FV ( )) of free variables of a computation e (resp. value ) is the smallest set Γ such that Γ Λ e (resp. Γ v ) is provable. As it is customary, we identify terms up to renaming of bound variables and say that a term is closed if it has no free variables (i.e. if Λ e is provable, and similarity for values).

Oftentimes we refer to closed computations as programs. Moreover, for nite lists of syntactic expressions (such as variables, computations, or values) we employ the 'bar notation', thus writing φ for a nite list φ 1 , . . . , φ n of φs. For instance, we write x and for a nite list of variables and values, respectively.

Finally, we write e[x := ] (resp. w[ /x]) for the capture-free substitution of the value for all free occurrences of x in e (resp. w). Formally, we de ne e[x := ] and w[ /x] by mutual recursion on e and w as follows:

x[ /x] [ /x] x (λ .e)[ /x] λ .e[x := ] (return w )[x := ] return w[ /x] (wu)[x := ] w[ /x]u[ /x] (let = e in f )[x := ] let = e[x := ] in f [x := ] op(p, .e)[x := ] op(p, .e[x := ]).
Obviously, the very de nition of substitution gives the following inference rules (recall that we assume the variable convention):

Γ, x Λ e ∆ v Γ, ∆ Λ e[x := ] Γ, x v w ∆ v Γ, ∆ v w[ /x]
The ne-grain style has several advantages when studying meta-theoretical properties of calculi: there is a neat distinction between computations and values (which gives, for instance, a smooth de nition of the notion of an applicative (bi)simulation relation), and proofs are more streamlined. However, calculi in ne-grain style has the drawback of being cumbersome for writing examples. For instance, the identity combinator λx.x in ne-grain style is written as return (λx.(return x )). For this reason, our examples will be mostly given using the following coarse-grain λ-calculus syntax:

e, f ::= x | λx.e | f e | op(p, x.e).
It is not hard to convince ourselves that the two presentations are equivalent, as summarised by Table 3 We now de ne a call-by-value monadic operational semantics for Λ Σ . In the following, we assume a Σ-continuous monad T to be xed.

Remark 3. Since we give semantics to programs, i.e. closed computations, it makes sense to consider generalised operation symbols whose arity set I is encoded by some subset of V • . For simplicity, we ignore the speci c subset of (closed) values used to encode elements of I , and simply write op : P V • for operation symbols in Σ. As already remarked, the standard example the reader may keep in mind is given by I = N and the encoding of natural numbers as Church numerals.

Operational semantics is de ned by means of an evaluation function -:

Λ • → T V • mapping a program to a monadic value, i.e. an element of T V • .
De nition 15. The N-indexed family of functionsn : Λ • → T V • is inductively de ned as follows:

e 0 ⊥ return n+1 η( ) (λx.e) n+1 e[x := ] n let x = e in f n+1 f [x := -] † n e n op(p, x.e) n+1 op (p, → e[x := ] n ).
Notice that the index n inn does not actually refer to the number of β-reductions performed. Moreover, since T is Σ-continuous, ( e n ) n forms an ω-chain in T V • , and thus has least upper bound n e n .

De nition 16. The evaluation function -:

Λ • → T V • is de ned as e n < e n .
Finally, we notice that Σ-continuity gives the following universal property of the evaluation function.

Lemma 6. The evaluation functionis the least function φ : Λ • → T V • satisfying the following identities:

φ(return ) = η( ) φ((λx.e) ) = φ(e[x := ]) φ(let x = e in f ) = ( → φ( f [x := ])) † φ(e) φ(op(p, x.e)) = op (p, → φ(e[x := ])).
Before giving examples of concrete instances of Λ Σ we brie y expand on the operational meaning of algebraic operations. At the very begging of this chapter, we informally de ned algebraic operations as operations whose semantics commutes with evaluation contexts. We can now make such de nition a formal result. First of all, we give Λ Σ an operational semantics based on Felleisen's notion of an evaluation context [START_REF] Felleisen | The revised report on the syntactic theories of sequential control and state[END_REF]). We will extensively use these kinds of semantics in Chapter 6 and Chapter 7. Λ Σ evaluation contexts are de ned by the following grammar, where e is a computation with FV (e) ⊆ {x }:

E ::= [-] | let x = E in e.
The hole [-] in an evaluation context acts as a placeholder for a computation, and we write E[e] for the computation obtained by replacing the hole [-] in E with the computation e. We immediately notice that any computation admits the following unique decomposition (see also Lemma 25).

Lemma 7. Any program e can be uniquely decomposed in one of the following (mutually exclusive) forms:

1. return ; 2. E[let x = (return ) in e]; 3. E[ w]; 4. E[op(p, x.e)].
Using Lemma 7 we can give Λ Σ an alternative operational semantics, and prove its equivalence with the one de ned in De nition 15.

De nition 17. De ne the N-indexed family of evaluation function -

n : Λ • → T Λ • as follows: e 0 = ⊥ return n+1 = η( ) E[let x = (return ) in e] n+1 = E[e[x := ]] n E[(λx.e) ] n+1 = E[e[x := ]] n E[op(p, x.e)] n+1 = op (p, → E[e[x := ]] n ).
As for De nition 15, ( e n ) n forms an ω-chain in T V • , so that we can de ne e as n e n . Since for any op ∈ Σ, op is continuous, we see thatenjoys the following universal property.

Lemma 8. The evaluation functionis the least function φ : Λ • → T V • satisfying the following identities:

φ(return ) = η( ) φ(E[let x = (return ) in e]) = φ(E[e[x := ]]) φ(E[(λx.e) ]) = φ(E[e[x := ]]) φ(E[op(p, x.e)]) = op (p, → φ(E[e[x := ]])).
Finally, we can rely on Lemma 6 and Lemma 8 to prove that the two operational semantics given to Λ Σ are equivalent.

Lemma 9. For any closed computation e, e e .

Proof. We rst prove thatsatis es the identities in Lemma 8, for which we will infer e e .

1. The rst identity obviously holds.

2. For the second identity, we proceed by induction on E. Suppose E = [-]. We reason as follows: [e[x := ]] , so that we can calculate:

let x = (return ) in e = e[x := -] † (η( )) [By Lemma 6] = e[x := ] . [Since ∀f : X → TY . f † • η X = f ] Suppose E to be of the form let = E [-] in f , for some evaluation context E . By induction hypothesis we have E [let x = (return ) in e] = E
let = E [let x = (return ) in e] in f = f [ := -] † ( E [let x = (return ) in e] ) [By Lemma 6] = f [ := -] † ( E [e[x := ]] ) [By induction hypothesis] = let = E [e[x := ]] in f .
[By Lemma 6] 3. For the third identity we proceed exactly as for the second one.

4. We prove the fourth identity by induction on E. The base case is trivial. Suppose now E to be of the form let = E in f , and write φ for the function f [ := -] . We have:

let = (E [op(p, x.e)]) in f = φ † ( E [op(p, x.e)] ) [By Lemma 6] = φ † ( op (p, → (E [e])[ := ] )) [By induction hypothesis] = op (p, → φ † ( (E [e])[x := ] )) [By (gen alg op)] = op (p, → let = (E [e])[x := ] in f ).
[By Lemma 6] Finally, since x is bound in e we can assume x to fresh in E , so to have:

E[op(p, x.e)] = op (p, → let = (E [e])[x := ] in f ) = op (p, → let = E [e[x := ]] in f ) = op (p, → E[e[x := ]] ) = op(p, x.E[e]) .
We now have to prove that for any closed computation e, e e . That is a direct consequence of the following result.

Lemma 10. For any closed computation e and evaluation context E we have:

E[e] = ( → E[return ] ) † e .
Proof. Let us write φ for the function → E[return ] . By induction on n with a case analysis on the shape of E[e] according to Lemma 7, we show that for any n ≥ 0 we have

E[e] n ( → E[return ] ) † e , from which follows E[e]
( → E[return ] ) † e . The case for n = 0 is trivial. We proceed with the inductive step.

• If E[e] = return , then we have ]] and e = E [let x = (return ) in f ], for some evaluation context E . We have: ]] and e = E [(λx.f ) ], for some evaluation context E . We proceed exactly as in previous case.

return n+1 = η( ) = return † . Suppose now E[e] to be of the form F [let x = (return ) in f ]. Then we must have E = E[E [-
E[e] n+1 = E[E [let x = (return ) in f ]] n+1 = E[E [f [x := ]]] n [By De nition 17] φ † E [f [x := ]] [By induction hypothesis] = φ † E [let x = (return ) in f ] [By Lemma 8] = φ † e . • If E[e] = F [(λx.f ) ], then we must have F = E[E [-
• ]] and e = E [op(p, x.f )], for some evaluation context E . Let us write κ for the map → f [x := ] . Relying on the induction hypothesis, we have:

If E[e] = F [op(p, x.f )], then we have F = E[E [-
E[e] n+1 = E[E [op(p, x.f )]] n+1 = op (p, → E[E [f [x := ]]] n ) [By De nition 17] op (p, → (φ † E [f [x := ]] ))
[By induction hypothesis and De nition 14]

= op (p, φ † • κ) = φ † ( op (p, κ)) [By (gen alg op)] = φ † e .
In a similar fashion it is possible to show that for any n ≥ 0 we have

( → E[return ] ) † e n E[e] , from which we infer ( → E[return ] ) † e E[e]
, and thus the wished thesis.

Corollary 1. For any closed computation e we have e = e .

In particular, from Corollary 1 we infer the equality E[op(p, x.e)] = op(p, x.E[e]) which states that the operational semantics of op commutes with evaluation contexts. This is nothing but the operational behaviour we had in mind for algebraic operations.

We now give examples of concrete instances of Λ Σ and show how our monadic operational semantics can be instantiated to standard, concrete semantics. In doing so, we also discuss an example of a nonalgebraic -yet natural -operation, namely exception handling. We omit the example of the probabilistic instance of Λ Σ , as the latter obviously coincides9 with Λ p .

Relevant Examples

Example 19 (Pure λ-calculus). If we consider the empty signature and the partiality monad M we recover Levy's ne-grain call-by-value (P. [START_REF] Levy | Modelling environments in call-by-value programming languages[END_REF]. We refer to such a calculus as Λ M (we prefer the latter notation to Λ Σ M ). Concretely, the syntax of Λ M is de ned by the following grammars:

, w ::= x | λx.e e, f ::= return | w | let x = e in f .
We give Λ M a standard big-step operational semantics by means of binary convergence relation ⇓ between programs and closed values inductively de ned as follows:

return ⇓ e[x := ] ⇓ w (λx.e) ⇓ w e ⇓ f [x := ] ⇓ w let x = e in f ⇓ w
Moreover, we can de ne a coinductive diverge predicate ⇑ on programs as follows10 :

e[x := ] ⇑ (λx.e) ⇑ e ⇑ let x = e in f ⇑ e ⇓ f [x := ] ⇑ let x = e in f ⇑ .
It is easy to show that e = just if and only if e ⇓ , and conversely that e = ⊥ if and only if e ⇑.

Example 20 (Nondeterministic λ-calculus). Instantiating Λ Σ with the the monad FM and its associated signature Σ FM we obtain the nondeterministic call-by-value λ-calculus Λ FM . Concretely, Λ FM is de ned by the follows syntax:

,

w ::= x | λx.e e, f ::= return | w | let x = e in f | e or f .
We inductively de ne the may convergence relation ⇓ between programs and closed values as follows:

return ⇓ e[x := ] ⇓ w (λx.e) ⇓ w e ⇓ f [x := ] ⇓ w let x = e in f ⇓ w e ⇓ e or f ⇓ f ⇓ w e or f ⇓ w
Dually, we coinductively de ne a may divergence predicate ⇑ as follows: Instead on giving semantics using the monad ME (that is not the purpose of this example) we inductively de ne a converge relation ⇓ between programs and closed value and an inductive predicate e with the intended meaning that the exception e has been raised (for simplicity we assume only one exception e to be available). These relations are de ned as follows: The evaluation of a computation of the form handle e (e, f ) depends on the evaluation of e. That is, exception handling cannot be considered as an algebraic operation, as it directly depends on one of its arguments. To see that, it is su cient to observe that no reasonable notion of equivalence will equate the two terms e and f de ned as follows (where 0 and 1 denote the the booelan values false and true, respectively):

e[x := ] ⇑ (λx.e) ⇑ e ⇑ let x = e in f ⇑ e ⇓ f [x := ] ⇑ let x = e in f ⇑ e ⇑ e or f ⇑ f ⇑ e or f ⇑ It is straightforward to prove that e ⇓ if
return ⇓ e[x := ] ⇓ w (λx.e) ⇓ w e ⇓ f [x := ] ⇓ w let x = e in f ⇓ w e ⇓ handle e (e,
E let x = [-] in (if x then raise e else x ) e E[handle e (return 1, return 0)] f handle e (E[return 1], E[return 0]).
In fact, we have e e, whereas f ⇓ 0.

Example 22 (Imperative λ-calculus). Instantiating Λ Σ with the monad M⊗G and its associated signatureΣ T⊗G we obtain the calculus Λ M⊗G . The concrete syntax of the calculus (recall Remark 3) is as follows, where we use the lighter notation := ; e in place of set ( , e):

, w ::= x | λx.e e, f ::= return | w | let x = e in f | := ; e | get (x.e).
We de ne a convergence relation ⇓ by means of judgments of the form e, σ ⇓ , σ (where e is a program and is a closed value) inductively as follows:

return , σ ⇓ , σ e[x := ], σ ⇓ w, σ (λx.e) , σ ⇓ w, σ e, σ ⇓ w, σ f [x := w], σ ⇓ , σ let x = e in f , σ ⇓ , σ e[x := w], σ ⇓ , σ σ ( ) = w get (x.e), σ ⇓ , σ e, σ [ := w] ⇓ , σ := w; e, σ ⇓ , σ
Dually, we de ne a divergence predicate ⇑ coinductively as follows:

e[x := ], σ ⇑ (λx.e) , σ ⇑ e, σ ⇑ let x = e in f , σ ⇑ e, σ ⇓ w, σ f [x := w], σ ⇑ let x = e in f , σ ⇑ e[x := ], σ ⇑ σ ( ) = get (x.e), σ ⇑ e, σ [ := ] ⇑ := ; e, σ ⇑
.

As usual we can show that e, σ ⇓ , σ if and only if e (σ ) = just (σ , ), and, dually, e, σ ⇑ if and only if e (σ ) = ⊥. Moreover, we see that the semantics given to operation symbols behaves as desired.

For instance, assuming σ ( ) = 0 , we have:

get (x.e) (σ ) = get ( → e[x := ] )(σ ) = e[x := 0 ] (σ ).
Example 23 (λ-calculus with output). Instantiating Λ Σ with the partial output monad and the associated signature Σ O ∞ , we obtain the calculus Λ O ∞ . The concrete syntax of Λ O ∞ is de ned by the following grammar:

,

w ::= x | λx.e e, f ::= return | w | let x = e in f | print c .e.
We inductively de ne a convergence relation ⇓ between programs and pairs of nite strings over A (here denoted by letters a, b, . . . to avoid confusion) and values as follows:

return ⇓ ε, e[x := ] ⇓ a, w (λx.e) ⇓ a, w e ⇓ a, f [x := ] ⇓ b, w let x = e in f ⇓ ab, w e ⇓ a, print c .e ⇓ c • a,
Dually, we coinductively de ne a divergence relation ⇑ between programs and possibly in nite strings over A (again denoted by letter a, b, . . .) as follows:

e[x := ] ⇑ a (λx.e) ⇑ a e ⇑ a let x = e in f ⇑ a e ⇓ (a, ) f [x := ] ⇑ b let x = e in f ⇑ ab e ⇑ a print c .e ⇑ c • a .
As usual, we can show e ⇓ a, if and only if e = (a, just ), and e ⇑ a if and only if e = (a, ⊥).

Example 24 (λ-calculus with cost). Instantiating Λ Σ with the cost monad C and its associated signature Σ C , we obtain the calculus Λ C . The concrete syntax of the calculus is as follows:

, w ::= x | λx.e e, f ::= return | w | let x = e in f | ti (e).
The calculus by itself is not very interesting. However, we can consider its fragment de ned by the following grammar:

, w ::= x | λx.ti (e) e, f ::= | w | let x = e in f .
By putting a ticking operation after all λ-abstractions we can count the number of reduction steps performed during the evaluation of a program. In fact, de ning the encoding e of a computation of Λ M as follows So far we have only given examples of calculi with just one type of e ect (provided we do not consider partiality as an e ect). We can also instantiate Λ Σ to obtain richer e ectful calculi, as witnessed by the following example.

Example 25 (Imperative probabilistic λ-calculus). We instantiate Λ Σ with the monad DM ⊗ G and its associated signature Σ DM⊗G . The concrete syntax of the calculus is given by: , w ::

= x | λx.e e, f ::= | w | let x = e in f | e or f | := ; e | get (x.e).
A computation e evaluates to a function e mapping an initial state σ to (something equivalent to) a subdistribution over pairs consisting of a value and a nal state. The rationale is that e (σ )( , σ ) gives the probability that the computation e when evaluated in the initial state σ converges to a value with nal state σ .

Example 26 (Imperative λ-calculus with cost). We instantiate Λ Σ with the monad C ⊗ G and its associated signature Σ C⊗G . We call the resulting calculus Λ C⊗G . As for Λ C , it is more interesting to work with a subset of the calculus rather than with full Λ C⊗G . In particular, we can consider the fragment de ned by following grammar, where is xed location and k ranges over locations di erent from :

, w ::= x | λx.e e, f ::= return | w | let x = e in f | k := ; e | ti ( := ; e) | get (x.e).
The ticking operation is used to count the number of times we store a value in the location (obviously slightly modi cations of the above grammar allow to work with di erent subsets of L) during the evaluation of a program. To see that, let us modify the big-step semantics of Λ M⊗G using judgments of the form e, σ ⇓ , σ , n , where n is a natural number giving the number of times the location is used to store a value:

return , σ ⇓ , σ , 0 e[x := ], σ ⇓ w, σ , n (λx.e) , σ ⇓ w, σ , n e, σ ⇓ w, σ , n f [x := w], σ ⇓ , σ , m let x = e in f , σ ⇓ , σ , n + m e[x := w], σ ⇓ , σ , n σ ( ) = w get (x.e), σ ⇓ , σ , n e, σ [ := w] ⇓ , σ , n := w; e, σ ⇓ , σ , n + 1 e, σ [k := w] ⇓ , σ , n k := w; e, σ ⇓ , σ , n
Let us the consider the translation from terms in Λ M⊗G to the above fragment of Λ C⊗G induced by the rules:

:= ; e ti ( := ; e) k := ; e k := ; e.

Then we see that e (σ ) = just (σ , n, ) if and only if e, σ ⇓ , σ , n .

Having de ned both the syntax and semantics of Λ Σ , it is time to study notions of program equivalence and re nement for it. As for Λ p , we aim to develop a notion of applicative (bi)similarity for Λ Σ , which we call e ectful applicative (bi)similarity. As we will see, such a notion can be instantiated to the calculi of previous examples and allows to recover standard notions of applicative (bi)similarity for them. However, in order to develop the theory of e ectful applicative (bi)similarity we need a further mathematical tool, namely the notion of a relator [START_REF] Thijs | Simulation and xpoint semantics[END_REF] or lax extension [START_REF] Barr | Relational algebras[END_REF]Hofmann et al., 2014). Roughly speaking, the latter is an abstraction of the map D we used to de ne probabilistic applicative similarity for Λ p axiomatising its relevant structural properties.

Chapter 4

Relators and Relation Lifting

The third branch of science may be called semiotics, or the doctrine of signs. Because these are mostly words, this part of science is aptly enough termed also logic. The business of this is to study the nature of the signs that the mind makes use of for understanding things and for conveying its knowledge to others. None of the things the mind contemplates is present to the understanding (except itself); so it must have present to it something that functions as a sign or representation of the thing it is thinking about; and this is an idea.

John Locke, An Essay Concerning

Human Understanding

In this chapter we introduce what we might say to be the central tool we use in this dissertation, namely the notion of a relator [START_REF] Thijs | Simulation and xpoint semantics[END_REF] or lax extension [START_REF] Barr | Relational algebras[END_REF]. Broadly speaking, a relator Γ for a functor T (on Set) describes a possible way to lift a relation R between two sets X and Y to a relation ΓR between T X and TY . Clearly, there are many ways to perform such a lifting. Relators provide an axiomatisation of those lifting operations that preserve some natural structural properties.

The notion of a lax extension of a monad has been introduced by [START_REF] Barr | Relational algebras[END_REF] in the context of (categorical) topology. Building on previous works by Manes (E. [START_REF] Manes | A triple theoretic construction of compact algebras[END_REF], Barr characterised topological spaces as lax algebras for the ultra lter monad in Rel, the category of sets and relations. That is, any topological space can be described as set X together with a (convergence) relation α ⊆ U X × X (where U denotes the carrier of the ultra lter monad) satisfying suitable inequalities. The shift from functions to relations, and from equalities to inequalities, required Barr to solve several di culties, the biggest one being to 'extend' the ultra lter monad from Set to Rel in a suitable way.

Barr de ned an abstract construction that allows to 'extend' not only the ultra lter monad from Set to Rel, but also any other monad (resp. functor) satisfying some minimal conditions (notably, preservation of weak pullbacks). Such a construction is nowadays known as Barr extension and (the outcome of) its application to a monad (resp. functor) is called the lax extension of the monad (resp. functor), as the latter is extended from Set to Rel, laxly. Barr extension provides a canonical way to extend monads (resp. functors) from Set to Rel, laxly, but there are many other possible such extensions, which are arguably well behaved. The criteria that qualify such extensions as well behaved can be nicely axiomatised, the resulting notion being the one of a lax extension of a monad (resp. functor) [START_REF] Ho Man | A cottage industry of lax extensions[END_REF]Hofmann et al., 2014).

Years later, Thijs [START_REF] Thijs | Simulation and xpoint semantics[END_REF] introduced the notion of a relator (also called relational extension) to study notions of (bi)simulation relation in the abstract setting of universal coalgebra (J. J. M. M. [START_REF] Rutten | Universal coalgebra: a theory of systems[END_REF]. Roughly speaking, given a relator Γ as above and a T -coalgebra (on Set) γ : X → T X , one de nes a relation R on X to be a simulation if x R =⇒ γ (x ) ΓR γ ( ). The de ning properties of relators ensure that there exists a largest simulation, and that the latter is a re exive and transitive relation. Additionally, it is easy to extract a notion of bisimilarity from the one of similarity and to prove that the latter is an equivalence relation. Since then, the 'relator approach' (as well as related 'relation lifting' approaches [START_REF] Hermida | Structural induction and coinduction in a brational setting[END_REF][START_REF] Jacobs | Introduction to coalgebra: Towards mathematics of states and observation[END_REF][START_REF] Kurz | Relation lifting, a survey[END_REF])) has been extremely in uent in the eld of (universal) coalgebra, as witnessed by the numerous works on the subject (see [START_REF] Jacobs | Introduction to coalgebra: Towards mathematics of states and observation[END_REF][START_REF] Kurz | Relation lifting, a survey[END_REF] for further references).

In this dissertation we use relators to de ne several notions of simulation and bisimulation (notably applicative, monadic, and normal form (bi)simulation) for higher-order e ectful languages, as well as other notions of program equivalence and re nement (notably contextual and CIU approximation and equivalence). Our main results state that the structural properties of relators ensure precongruence and congruence properties of the obtained notions of program re nement and equivalence, respectively. Therefore, the general theory of relators quali es as a formal toolkit that deserves a spot in the semanticist's arsenal.

Preliminaries

Before de ning relators formally, it is useful to recall some background notions of relational calculus. That will allow us to reduce the complexity of some proofs by means of simple, pointfree calculations. Contrary to standard, set-based presentations of relations, we use an 'algebraic' notation for relations and their algebra. This choice has the advantage of highlighting the connection between relations and abstract notions of distance (the central theme of the second part of this work).

Throughout the rest of this dissertation, let 2 denote the complete lattice 2, ≤ of boolean values1 with 2 {true, false}. Moreover, we tacitly assume all functors and monads to be functors and monads on Set, unless di erently speci ed.

De nition 18. The category Rel has sets as objects and relations as morphisms. A relation R between two sets X and Y , written as R :

X + → Y , is a map R : X × Y → 2.
Given elements x ∈ X , ∈ Y we say that x is R-related to , and write x R , if R (x, ) = true. For any set X the identity relation I X : X + → X is de ned as equality on X . Moreover, for relations R : X + → Y and S : Y + → Z , we de ne the composition S • R : X + → Z of S with R as:

(S • R)(x, z) ∈Y R (x, ) ∧ S( , z).
Composition of relations is associative, and I is the unit of composition, so that Rel is indeed a category.

Remark 4. Notice that relations are not de ned as objects of Set (namely as subsets of cartesian products). We keep explicit the distinction between a relation, which is a morphism in Rel, and its graph2 , which is an object in Set.

Rel is a monoidal category with unit given by the one-element set and tensor product given by cartesian product of sets, with R × S : X × Y + → X × Y de ned pointwise via binary meet. Moreover, for all sets X , Y , the hom-set Rel(X , Y ) inherits a complete lattice structure from 2 pointwise. As it is customary, we denote the resulting order on Rel(X , Y ) by ⊆, whereas meets and joins are denoted by and , respectively. The complete lattice structure of hom-sets nicely interacts with the monoid structure of relation composition, meaning that Rel forms a quantaloid (Hofmann et al., 2014). In particular, for all relations R : X + → Y , S i : Y + → Z (i ∈ I ), and Q : Z + → W the following distributivity laws hold:

Q • ( i ∈I S i ) = i ∈I (Q • S i ), ( i ∈I S i ) • R = i ∈I (S i • R).
Distributivity implies monotonicity of relation composition in both arguments. In fact, assuming

R 1 ⊆ R 2 , i.e. R 2 = i ∈ {1,2} R i we have: S • R 2 = S • i ∈ {1,2} R i = i ∈ {1,2} (S • R i ) ⊇ S • R 1 .
In a similar fashion we can prove that S 1 ⊆ S 2 implies S 1 • R ⊆ S 2 • R, and thus monotonicity of composition in both arguments. We also notice that Rel is self-dual, since for all sets X , Y there is a bijection -

• between Rel(X , Y ) and Rel(Y , X ) mapping each relation R : X + → Y to its dual (or opposite) relation R • : Y + → X de ned by R • ( , x ) R (x, ).
It is a routine exercise to verify that -• is monotone and satis es the following identities (the third one stating that -• is an involution):

(S • R) • = R • • S • I • = I (R • ) • = R.
Additionally, there is a map -• from Set to Rel that interprets the graph of a function f : X → Y (the latter being a morphism in Set) as the relation f

• : X + → Y de ned by f • (x, ) =      true if f (x ) = false otherwise.
The map -• de nes a functor from Set to Rel, so that

( • f ) • = • • f • and 1 • = I. Moreover, we see that -• is faithful. As a consequence, we write f : X → Y in place of f • : X + → Y
, unless we work in Set and Rel at the same time (that will only happen in Subsection 4.3.1). The notation used for the graph functor works as reminder for the following inequalities, for f : X → Y :

I X ⊆ f • • f • f • • f • ⊆ I Y .
It is useful to keep in mind the pointwise reading of relations of the form

• • S • f , for a relation S : Z + → W and functions f : X → Z , : Y → W : ( • • S • f )(x, ) = S( f (x ), ( )).
Given R : X + → Y we can thus express a generalised monotonicity condition in pointfree fashion as:

R ⊆ • • S • f .
Indeed, taking f = , we obtain standard monotonicity of f . We will make extensively use of the following adjunction rules (Hofmann et al., 2014), for f :

X → Y , : Y → Z , R : X + → Y , S : Y + → Z , and Q : X + → Z : • R ⊆ Q ⇐⇒ R ⊆ • • Q (adj 1) Q • f • ⊆ S ⇐⇒ Q ⊆ S • f . (adj 2)
Using (adj 1) and (adj 2) we see that generalised monotonicity R ⊆ • •S• f can be equivalently expressed via the following lax commutative diagram:

X ⊆ f / / R _ Z S _ Y / / W
The diagram acts as a graphical representation of the expression

• R ⊆ S • f , which, by (adj 1), is equivalent to R ⊆ • • R • f .
Finally, since we are interested in preorder and equivalence relations, we recall that we can de ne the notions of a re exive, a transitive, and a symmetric relation pointfree. In fact, a relation R :

X + → X is re exive if I X ⊆ R, transitive if R • R ⊆ R, and symmetric if R ⊆ R • .

Relators

The notion of a relator [START_REF] Barr | Relational algebras[END_REF][START_REF] Thijs | Simulation and xpoint semantics[END_REF] Γ for a functor T is an abstraction meant to capture the possible ways a relation R : X + → Y can be lifted to a relation ΓR : T X + → TY .

De nition 19.

A relator for a functor T is a set-indexed family of maps (R : X + → Y ) → (ΓR : T X + → TY ) satisfying conditions (rel 1)-(rel 4). We say that Γ is conversive if it additionally satis es condition (rel 5).

I T X ⊆ Γ(I X ) (rel 1) Γ S •ΓR ⊆ Γ(S • R) (rel 2) T f ⊆ Γ f , (T f ) • ⊆ Γ f • (rel 3) R ⊆ S =⇒ ΓR ⊆ ΓS (rel 4) Γ(R • ) = (ΓR) • .
(rel 5)

Conditions (rel 1), (rel 2), and (rel 4) are rather standard3 . As we will see, condition (rel 4) makes the de ning endofunction of (bi)simulation relations monotone, whereas conditions (rel 1) and (rel 2) make notions of (bi)similarity re exive and transitive. Similarly, condition (rel 5) makes notions of bisimilarity symmetric. Condition (rel 3), which actually consists of two conditions, states that relators behave as expected when acting on (graphs of) functions. In (P. [START_REF] Levy | Similarity quotients as nal coalgebras[END_REF] a kernel preservation condition is required in place of (rel 3). Such condition is also known as stability in [START_REF] Hughes | Simulations in coalgebra[END_REF]. Stability requires the equality

Γ( • • R • f ) = (T ) • • ΓR • T f (stability)
to hold. It is easy to see that a relator always satis es stability.

Proposition 7. Conditions (rel 1)-(rel 4) implies (stability).

Proof. Proving that (T )

• • ΓR • T f ⊆ Γ( • • R • f ) is straightforward. Indeed we have: (T ) • • ΓR • T f ⊆ Γ • • ΓR • Γ f [By (rel 3)] ⊆ Γ( • • R • f ). [By (rel 2)] To prove Γ( • • R • f ) ⊆ (T ) • • ΓR • T f we reason as follows: Γ( • • R • f ) ⊆ (T ) • • T • Γ( • • R • f ) • (T f ) • • T f [Since ∀h. I ⊆ h • • h] ⊆ (T ) • • Γ • Γ( • • R • f ) • Γ f • • T f [By (rel 3)] ⊆ (T ) • • Γ( • • • R • f • f • ) • T f [By (rel 2)] ⊆ (T ) • • ΓR • T f . [Since ∀h. h • h • ⊆ I]
We also notice that, since relators are monotone, stability gives the following implication

R ⊆ • • S • f =⇒ ΓR ⊆ (T ) • • ΓS • T f ,
which can be diagrammatically expressed as:

X ⊆ f / / R _ Z S _ Y / / W =⇒ T X ⊆ T f / / Γ R _ T Z ΓS _ TY T / / TW
Finally, we observe that any relator Γ for T induces an endomap T Γ on Rel that acts as T on sets and as Γ on relations. It is easy to check that conditions in De nition 19 makes T Γ a lax endofunctor. When T Γ is a functor, we say that Γ is functorial. Concretely, this is the case if conditions (rel 1) and (rel 2) are equalities, i.e. if the following identities hold:

I T X = Γ(I X ) (rel funct 1) ΓS • ΓR = Γ(S • R).
(rel funct 2)

Before giving examples of relators it is useful to observe that the collection of relators is closed under speci c operations (see (P. [START_REF] Levy | Similarity quotients as nal coalgebras[END_REF] for a proof of the following proposition).

Proposition 8. Let T , U be functors, and let UT denote their composition. Moreover, let Γ, ∆ be relators for T and U , respectively, and {Γ i } i ∈I be a family of relators for T . Then:

1. The map ∆Γ de ned by ∆ΓR ∆(ΓR) is a relator for UT .

The map

i ∈I Γ i de ned by ( i ∈I Γ i )R i ∈I Γ i R is a relator for T . 3. The map Γ • de ned by Γ • R (ΓR • ) • is a relator for T .
4. The map Γ ∧ Γ • is the greatest conversive relator smaller than Γ, according to the pointwise order.

Relators provide a powerful abstraction of notions of 'relation lifting', as witnessed by the numerous examples of relators we will discuss in Section 4.3. Before discussing such examples, we introduce the notion of a relator for a monad or lax extension of a monad. In fact, according to De nition 19 relators extend functors from Set to Rel, laxly. However, we de ned notions of computation (and thus modelled computational e ects) as monads. Therefore, it seems natural to require relators to extend monads (and not just functors) from Set to Rel, laxly. Requiring such a condition is exactly what is needed to make applicative (as well as normal form) similarity a precongruence relation. As the reader will notice, we already met the de ning conditions of a lax extension of a monad in our analysis of the precongruence theorem for probabilistic applicative similarity (Chapter 2). In fact, such conditions provided exactly those structural properties of D that made the semantics of return and sequencing well behaved with respect to probabilistic applicative similarity.

De nition 20. Let T = T , η, - † be a monad, and Γ be a relator for T . We say that Γ is a relator for T if it satis es the following conditions:

R ⊆ η • Y • ΓR • η X , (rel unit) R ⊆ • • ΓS • f =⇒ ΓR ⊆ ( † ) • • ΓS • f † .
(rel bind)

We can express conditions (rel unit) and (rel bind) diagrammatically as follows:

X ⊆ η X / / R _ T X Γ R _ Y η Y / / TY X ⊆ f / / R _ T X ΓS _ Y / / TY =⇒ T X ⊆ f † / / Γ R _ T X Γ S _ TY † / / TY
It is an easy exercise in algebra to verify that a relator for a monad T laxly extends T to Rel, in the sense that the natural transformations η X : X → T Γ X and µ X : T Γ T Γ X → T Γ X are oplax (see e.g. (Hofmann et al., 2014)).

Proposition 9. Let T = T , η, - † be a monad, and Γ a relator for T . Then property (rel bind) is equivalent to the validity of the following set-indexed family of inequalities

µ Y • ΓΓR ⊆ ΓR • µ X , (rel µ)
which express the following (lax) commutative condition:

TT X ⊆ µ X / / ΓΓ R _ T X Γ R _ TTY µ Y / / TY Proof. We show that (rel bind) implies (rel µ) 4 . µ Y • ΓΓR ⊆ ΓR • µ X ⇐= ΓΓR ⊆ µ • Y • ΓR • µ X [By (adj 1)] ⇐= ΓΓR ⊆ (1 † T Y ) • • ΓR • (1 † T X ) [Since µ Z = 1 † T Z ] ⇐= ΓR ⊆ 1 • T Y • ΓR • 1 T X [By (rel bind)] ⇐= ΓR ⊆ 1 • T Y • ΓR • 1 T X [Since 1 • = 1]
Vice versa, we prove (rel µ) implies (rel bind). Assume R ⊆ • • ΓS • f . We have:

ΓR ⊆ ( † ) • • ΓS • f † ⇐= ΓR ⊆ (µ • T ) • • ΓS • (µ • T f ) [Since h † = µ • Th] ⇐= ΓR ⊆ T • • µ • • ΓS • µ • T f [Since (k • h) • = h • • k • ] ⇐= ΓR ⊆ T • • ΓΓS • T f [By (rel µ) and (adj 1)] ⇐= ΓR ⊆ Γ( • • ΓS • f ) [By (stability)] ⇐= R ⊆ • • ΓS • f .
[By (rel 4)] Finally we remark that Proposition 8 does not generalise to relators for monads, as the composition of the carriers of two monads does not necessarily carry a monad structure. Nonetheless, we can still prove that the collection of relators for a given monad is closed under speci c operations.

Proposition 10. Given a monad T = T , η, - † and relators Γ, ∆ for it, both Γ ∧ ∆ and Γ • are relators for T. In particular, Γ ∧ Γ • is the largest conversive relator for T contained in Γ.

Proof. The proof is straightforward. As an example, we show that Λ Γ ∧ ∆ is a relator for T. We use Proposition 9 and show that

µ • ΛΛR ⊆ ΛR • µ X .
We have:

µ • ΛΛR ⊆ ΛR • µ X ⇐⇒ ΛΛR ⊆ µ • Y • ΛR • µ X [By (adj 1)] ⇐⇒ ΓΓR ∩ Γ∆R ∩ ∆ΓR ∩ ∆∆R ⊆ µ • Y • (ΓR ∩ ∆R) • µ X [Since Λ = Γ ∧ ∆] ⇐= ΓΓR ∩ ∆∆R ⊆ µ • Y • (ΓR ∩ ∆R) • µ X [Since ΓΓR ∩ Γ∆R ∩ ∆ΓR ∩∆∆R ⊆ ΓΓR ∩ ∆∆R] ⇐⇒ µ Y • (ΓΓR ∩ ∆∆R) • µ • X ⊆ ΓR ∩ ∆R. [By (adj 1)

and (adj 2)]

To prove the latter inequality, it is su cient to prove

µ Y • (ΓΓR ∩ ∆∆R) • µ • X ⊆ ΓR µ Y • (ΓΓR ∩ ∆∆R) • µ • X ⊆ ∆R.
We prove the rst one (the second one is proved in the same fashion). We reason as follows:

µ Y • (ΓΓR ∩ ∆∆R) • µ • X ⊆ ΓR ⇐⇒ ΓΓR ∩ ∆∆R ⊆ µ • Y • ΓR • µ X [By (adj 1) and (adj 2)] ⇐= ΓΓR ⊆ µ • Y • ΓR • µ X [Since ΓΓR ∩∆∆R ⊆ ΓΓR] ⇐⇒ (rel µ).
[By (adj 1)]

Relevant Examples

We now examine examples of relators for the monads studied in Chapter 3.

Example 27 (Partiality monad). For the partiality monad M we de ne the set-indexed families of maps M, M : Rel(X , Y ) → Rel(MX , MY ) as follows:

x MR y ⇐⇒ (x = ⊥) ∨ (∃x ∈ X . ∃ ∈ Y . x = just x ∧ y = just ∧ x R ). x MR y ⇐⇒ (y = ⊥) ∨ (∃x ∈ X . ∃ ∈ Y . x = just x ∧ y = just ∧ x R ).
The mapping M describes the structure of the usual simulation clause for partial computations, whereas M describes the corresponding co-simulation clause. It is easy to see that M is a relator for M and that M = M• . By Proposition 10, the map M ∧ M is a conversive relator for M. It is immediate to see that the latter relator describes the structure of the usual bisimulation clause for partial computations.

Example 28 (Exception monad). Proceeding as in Example 27, we de ne a relator for the exception monad E as the mapping Ê : Rel(X , Y ) → Rel(EX , EY ) de ned by:

x ÊR y ⇐⇒ (x = e =⇒ y = e) ∧ ∀x ∈ X . (x = x =⇒ ∃ ∈ Y . (y = ∧ x R )).
Easy calculations show that indeed Ê is a relator for the monad E. As before, Ê induces a canonical conversive relator, namely Ê ∧ Ê• . We now generalise Proposition 3 and Proposition 5 to take into account relators.

Proposition 11. Given a monad T = T , , -T and a relator T for T, de ne the sum TE of T and Ê as TE T Ê. Then TE is a relator for TE.

The proof of Proposition 11 goes as follows. By Proposition 8, we know that T Ê is a relator for the functor T E. Therefore, it remains to show that T Ê is also a relator for TE. Proving T Ê to satisfy condition (rel unit) is straightforward. We show that it satis es condition (rel bind) too. To see that, we observe that T Ê satis es the following 'intermediate' condition:

R ⊆ • • T MS • f =⇒ ÊR ⊆ • E • T ÊS • f E , (4.1)
or, diagrammatically:

X ⊆ f / / R _ T EX T ÊS _ Y / / T EY =⇒ EX ⊆ f E / / ÊR _ T EX T Ê S _ EY E / / T EY
In fact, if x ÊR y, then either x = e or x = x, for some x ∈ X . In the rst case we must have y = e too, and thus f E (x) = X +E (e) and E (y) = Y +E (e). We can conclude the thesis since T satis es condition (rel unit) (and obviously e ÊR e holds). In the second case we have x = x, for some x ∈ X . As a consequence, since x ÊR y, we also have y = , for some ∈ Y such that x R . Therefore, f E (x) = f (x ) and E (y) = (x ), so that the thesis follows by the main hypothesis. Using (4.1) we conclude the main thesis as follows:

R ⊆ • • T ÊS • f =⇒ ÊR ⊆ • E • T ÊS • f E [By (4.1)] =⇒ T ÊR ⊆ ( T E ) • • T ÊS • f T E [Since T satis es (rel bind)] ⇐⇒ TER ⊆ ( TE ) • • TES • f TE . [Since h TE = h T E ]
Example 29 (Nondeterministic monad). For the monad F de ne maps F, F : Rel(X , Y ) → Rel(FX , FY ) as:

X FR Y ⇐⇒ ∀x ∈ X. ∃ ∈ Y. x R . X FR Y ⇐⇒ ∀ ∈ Y. ∃x ∈ X. x R .
It is not hard to see that the relator F describes Milner's simulation clause for (unlabelled) transition systems. We immediately see that F = F• , and that F∧ F• describes the bisimulation clause for transition systems. Finally, easy calculations show that F is indeed a relator for F.

Since M has essentially the same structure of E, we can sum F and M obtaining a relator FM FM for FM. Spelling out the de nition we obtain:

X FMR Y ⇐⇒ ∀x ∈ X. (x = just x =⇒ ∃y ∈ Y. y = just ∧ x R ).
Notice that {⊥} FMR Y always holds. The relator FM can be used to test nondeterministic computations for may convergence, the resulting similarity notion being known as lower similarity (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Ong | Non-determinism in a functional setting[END_REF]. Additionally, working with the conversive relator FM ∧ FM • one recovers the notion of lower bisimilarity. Another interesting relator for FM is the given by the map FM de ned as:

X FMR Y ⇐⇒ (⊥ X =⇒ ⊥ Y) ∧ (∀ ∈ Y . just ∈ Y =⇒ ∃x ∈ X . just x ∈ X ∧ x R ).
It is not hard to see that FM is indeed a relator for FM (the reader can also consult (P. [START_REF] Levy | Similarity quotients as nal coalgebras[END_REF] for further details on FM as well as other examples of relators for F M). The relator FM tests nondeterministic computations for must convergence, the associated notion of similarity being upper similarity (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Ong | Non-determinism in a functional setting[END_REF]. As before, working with the conversive relator FM ∧ FM • we recover the notion of upper bisimilarity.

Example 30 (Distribution monad). Following our working example Λ p , we de ne a relator for the monad D relying on the notion of a coupling and results from optimal transport [START_REF] Villani | Optimal transport: Old and new[END_REF].

De nition 21. Given two distributions µ ∈ D(X ), ν ∈ D (Y ), a coupling for µ and ν is a joint distribution ω ∈ D(X × Y ) such that: µ = ∈Y ω (-, ) ν = x ∈X ω (x, -).
We denote the set of couplings of µ and ν by Ω(µ, ν ) and immediately observe that Ω(µ, ν ) is always non-empty. In fact, the joint distribution ω de ned by ω (x, ) µ (x ) • ν (x ) is a coupling of µ and ν.

Remark 5 (Couplings as transportation plans). Given distributions µ ∈ DX , ν ∈ DY , the notion of a coupling ω ∈ Ω(µ, ν ) formalises the informal notion of a transportation plan. Thinking to a distribution µ as assigning weight to points in X , then a transportation plan from µ to ν is a mapping specifying how to move weights from X to Y in such a way that µ is 'transformed' into ν . Formally, a transportation plan from µ to ν is a family of maps π x : Y → [0, 1] specifying for each ∈ Y how much weight of the weight µ (x ) of x has to be moved to . Accordingly to such a reading, we have to impose π x some constraints. First of all, π x does not move more weight than the available one: actually, since we want to move the whole weight mass µ, we require π to transport the whole µ. Formally, we require π x ( ) = µ (x ), for all x ∈ X .

Applying π to µ we obtain a new distribution (a new mass, so to speak) on Y , denoted by T π (µ), and de ned as:

T π (µ)( )

x ∈X π x ( ).
Obviously, since π has to transform µ into ν , we require T π (µ) = ν . At this point it is straightforward to see that any transportation plan π from µ to ν induces a coupling π ∈ Ω(µ, ν ) de ned by π (x, ) π x ( ), and that any coupling ω ∈ Ω(µ, ν ) induces a transportation plan ω de ned by ω x ( ) ω (x, ), so that the notions of a transportation plan and of a coupling are equivalent.

Following Remark 5, we can de ne a relator for D simply requiring transportation plans to move weight only between related points (that is, if π x ( ) > 0, then x and must be related). Formally, we de ne the (set-indexed) map D : Rel(X , Y ) → Rel(DX , DY ) as follows:

µ DR ν ⇐⇒ [∃ω ∈ Ω(µ, ν ). ∀x, . ω (x, ) > 0 =⇒ x R ].
We will prove that D is a relator for D in a more abstract setting in Subsection 4.3.1. We conclude our analysis of couplings stating the already mentioned Strassen's Theorem5 [START_REF] Strassen | The existence of probability measures with given marginals[END_REF] which shows that D can be de ned both universally (i.e. using an universal quanti cation) and existentially (i.e. using an existential quanti cation).

Theorem 2 (Strassen's Theorem). Let µ ∈ DX , ν ∈ DY be distributions, and R : X + → Y be a relation. Then:

µ DR ν ⇐⇒ ∀X ⊆ X . µ (X) ≤ ν (R[X]).
Even if we will give an abstract proof that D is a relator for D, using Theorem 2 it is possible to prove such a fact directly. Additionally, as a corollary of Theorem 2, we see that D describes the de ning clause of Larsen-Skou bisimulation for Markov chains (based on full distributions) [START_REF] Larsen | Bisimulation through probabilistic testing[END_REF]. Recall that given a Markov chain c : X → DX , we say that an equivalence relation R on

X is a bisimulation if x R implies c (x )(B) = c ( )(B), for any R-equivalence class B.
Then, it is easy to see that we have:

∀X ⊆ X . µ (X) ≤ ν (R[X]) ⇐⇒ ∀B ∈ X / R . µ (B) = ν (B).
Finally, we observe that we can sum D with M obtaining a relator DM D M for the monad DM (and thus for the subdistribution monad).

Example 31 (Output monad). For the (partial) output monad O ∞ we de ne the map Ô∞ :

Rel(X , Y ) → Rel(O ∞ X , O ∞ Y ) as follows: u, x Ô∞ R w, y ⇐⇒ (x = ⊥ ∧ u ⊆ w ) ∨ (x = just x ∧ y = just ∧ u = w ∧ x R ).
Tedious calculations show that Ô∞ is a relator for O ∞ .

Example 32 (Cost monad). For the total cost monad C 0 de ne the map Ĉ0 :

Rel(X , Y ) → Rel(C 0 X , C 0 Y ) as Ĉ0 R (≥ ×R),
where we recall that for R :

X + → Y , S : X + → Y , we de ne R × S : X × X + → Y × Y as (R × S)((x, x ), ( , )) R (x, ) ∧ S(x , ),
and ≥ denotes the opposite of the natural ordering on N. It is straightforward to see that Ĉ0 is indeed a relator for C 0 . The use of the opposite of the natural order in the de nition of Ĉ0 captures the idea that we use C 0 to measure complexity. If we think to (n, x ) as the result of a computation (the element x) together with the cost of the computation (the number n), then (n, x ) Ĉ0 R (m, ) means that the results

x and are R-related, and that n ≥ m, meaning that right hand computation is more e cient than the left hand one. By taking the sum of Ĉ0 and M we obtain a relator for C that describes Sands' simulation clause for program improvement [START_REF] Sands | Improvement theory and its applications[END_REF].

Example 33 (Global states). For the global state monad G we de ne the map Ĝ : Rel(X , Y ) → Rel(GX , GY ) as follows:

α ĜR β ⇐⇒ ∀σ ∈ S. α (σ ) (I S × R) β (σ ).
It is straightforward to see that Ĝ is a relator for G. Moreover, we can generalise Proposition 4 and Proposition 6 to take into account relators.

Proposition 12. Given a monad T = T , , -T and relator T for it, de ne T ⊗ G as:

α (T ⊗ G)R β ⇐⇒ ∀σ . α (σ ) T(I S × R) β (σ ).
Then (T ⊗ G) is a relator for T ⊗ G.

Straightforward calculations show that (T ⊗ G) is a relator for T ⊗ G. The most interesting part of the proof of Proposition 12 is proving that (T ⊗ G) satis es condition (rel bind). We assume R ⊆

• • (T ⊗ G)S • f , for relations and functions of appropriate source and target, and prove that α

(T ⊗ G)R β implies f T⊗G (α ) (T ⊗ G)S T⊗G (β ).
First of all, we notice that since T satis es condition (rel bind), we have:

R ⊆ • • (T ⊗ G)S • f =⇒ I S × R ⊆ (uncurry ) • • T(I S × S) • uncurry f =⇒ T(I S × R) ⊆ ((uncurry ) T ) • • T(I S × S) • (uncurry f ) T .
In particular, for any store σ , we have

α (σ ) T(I S × R) β (σ ) =⇒ (uncurry f ) T α (σ ) T(I S × S) (uncurry ) T β (σ ) ⇐⇒ f T⊗G (α ) (T ⊗ G)S T⊗G (β ).
As a consequence, it is su cient to prove α (σ ) T(I S × R) β (σ ). But the latter is a direct consequence of α (T ⊗ G)R β, and thus we are done.

In particular, we can tensor Ĝ with M, FM, and DM obtaining relators for partial, nondeterministic, and probabilistic imperative computations. Additionally, tensoring Ĝ with Ĉ we obtain a relator for imperative computations with cost.

Before continuing our analysis of relators, we make a small digression on the so-called Barr's construction (the content of such a digression is not needed to follow the rest of this work).

Digression: Barr's Construction

Most of the conversive relators in previous examples are instances of a general construction known as Barr construction (see e.g. (Hofmann et al., 2014;[START_REF] Kurz | Relation lifting, a survey[END_REF]). Such a construction builds for any functor T (on Set), a candidate relator T for T , called the Barr extension of T . If T preserves weak pullbacks, then T indeed de nes a functorial relator for T , which is also canonical (see Theorem 3).

At the heart of the Barr construction relies the double nature of relations as morphisms in Rel and objects in Set. To avoid confusion, in this section we will adopt the following notational convention: for a relation R :

X + → Y we denote by G R ⊆ X × Y the corresponding object in Set. Any relation G R ⊆ X × Y can be represented as a span (see Appendix B) (X π 1 ← --G R π 2 --→ Y ), where π 1 : G R → X and π 2 : G R → Y are projection maps. In particular, we have the identity R = π 2 • π • 1 in Rel.
We can now de ne the Barr extension of T .

De nition 22. The Barr extension of a functorT (on Set) is the set-indexed family of mapsT :

Rel(X , Y ) → Rel(T X ,TY ) de ned for R = π 2 • π • 1 : X + → Y by: T R T π 2 • (T π 1 ) • , where R = π 2 • π • 1 .
Pointwise, T can be characterised as follows:

x T R y ⇐⇒ ∃w ∈ TG R . T π 1 (w) = x ∧ T π 2 (w) = y,
where x ∈ T X and y ∈ TY

In general, T is not a relator for T , as it might fail to satisfy property (rel 2). However, T has been proved to be a a functorial relator exactly when T preserves weak pullbacks (see Appendix B for insights on the role of pullbacks in Barr's construction).

Theorem 3. Let T be a functor. The following hold:

1. T preserves weak pullbacks or, equivalently, transforms pullbacks into weak pullbacks, if and only if

T is a functorial relator for T .

2. T is canonical, in the sense that if Γ is a functorial relator for T , then Γ = T (and thus T preserves weak pullbacks).

3. If additionally T is the carrier of a monad T = T , η, - † and T preserves weak pullbacks, then T is a relator for T.

The proof of Theorem 3 is not di cult, but is rather long. The reader can consult (Hofmann et al., 2014;[START_REF] Kurz | Relation lifting, a survey[END_REF] for a detailed exposition.

Example 34 (The relator D). We immediately see that D = D. Since D preserves weak pullbacks, Theorem 3 implies that D is indeed a relator for D, and thus DM is a relator for DM.

In Example 30 we stated that it is possible to give a direct proof that D is a relator D relying on Theorem 2 -the discrete version of Strassen's Theorem -which in turn relies on Max-ow Min-cut Theorem. Theorem 3 gives an indirect proof of such a result, and the reader may wondering whether the complexity of Theorem 2 is still present in this indirect proof. This is indeed the case. In fact, in (de Vink [START_REF] De Vink | Bisimulation for probabilistic transition systems: A coalgebraic approach[END_REF] it is shown that the distribution functor preserves weak pullbacks (hence inferring 'good properties' of probabilistic bisimilarity) by presenting an argument relying on the the Max-ow Min-cut Theorem.

In light of the numerous examples of relators obtained as instances of Barr's construction, the Barr extension of a functor can be used to de ne a somehow canonical de nition of a notion of bisimulation. However, begin conversive, the Barr extension of a functor does not provide an adequate tool to de ne canonical notions of similarity (and, as we will see, such notions of similarity are of paramount importance in this work). It is natural to ask whether there exists a canonical way to extract a relator de ning notions of simulation from a functor. Unfortunately, the answer appears to be negative.

First of all, we observe that given a functor T carrying an order ≤ (that is, associating to any set X an order ≤ X on T X ) we can de ne the candidate relator

R → ≤ Y • T • ≤ X
for T . For instance, in this way we can recover the relator FM for F M using the order de ned in Example 18. This observation led to the proposal in [START_REF] Hughes | Simulations in coalgebra[END_REF] of considering notions of simulation de ned in terms of stable orders on functors. Intuitively, a stable order on a functor T (on Set) is a functor F from Set to Preord (the category of preordered sets and monotone functions) mapping a set X to a preordered set (T X , ≤ X ) and sending weak pullbacks to preordered weak pullbacks (see (P. [START_REF] Levy | Similarity quotients as nal coalgebras[END_REF]). [START_REF] Hughes | Simulations in coalgebra[END_REF] showed that given a stable order F on a functor T , the map R → ≤ Y • T • ≤ X indeed de nes a relator for T . However, in (P. [START_REF] Levy | Similarity quotients as nal coalgebras[END_REF] it is shown that there is a bijection 6 between relators for T satisfying (rel funct 2) and stable orders on T , meaning that nding stable orders is essentially equivalent to nding speci c relators.

This essentially concludes our exposition of the general theory of relators. However, there is still one point missing, namely the connection between relators and the domain structure we imposed on monads.

Σ-continuous relators

In order to accommodate in nitary computational behaviours, we required monads to come with a suitable domain structure. It is then natural to require relators to properly interact with such a structure. We have already seen an example of such an interaction in Chapter 2, where we proved precongruence of probabilistic applicative similarity relying on a suitable induction principle for D. Relators allowing such forms of inductive reasoning are called Σ-continuous relators.

De nition 23. Let T = T , η, - † be a Σ-continuous monad and Γ be relator for T. We say that Γ is Σ-continuous if it satis es conditions (ind 1), (ind 2), and (ind 3) -called the inductive conditions -for any ω-chain (x n ) n in T X , element y ∈ TY , elements x, x ∈ T X , and relation R :

X + → Y . ⊥ ΓR y (ind 1) x x , x ΓR y =⇒ x ΓR y (ind 2) ∀n. x n ΓR y =⇒ n ≥0
x n ΓR y.

(ind 3) Condition (ind 2) is actually not needed to prove congruence and precongruence properties of applicative bisimilarity and similarity, respectively. However, we will need it to prove the same properties for normal form bisimilarity and similarity, and thus we take it as a de ning condition of the notion of a Σ-continuous relator. As a convention, when we want to stress that a property holds in virtue of one (or more) of the properties (ind 1)-(ind 3), we will simply say that the property follows since the relator is inductive. Remark 6 (Σ-algebraic relators). The reader might have noticed that up to this point we have not required speci c interactions between relators and algebraic operations on monads. That might appeared wired, since having required relators to properly interact both with the monad and the domain structure of a Σ-continuous monad T, it seems natural to require relators to properly with its Σ-algebra structure too.

Formally, we can require the desired interaction by demanding a relators R to satisfy condition (Σ comp) below, for all operation symbol (op : P I ) ∈ Σ, maps κ, ν : I → T X , parameter p ∈ P, and relation R.

∀i ∈ I . κ (i) ΓR ν (i) =⇒ op (p, κ) ΓR op (p, ν ). (Σ comp)
It is a remarkable result that if T is Σ-algebraic, then any relator Γ for T satis es (Σ comp).

Proposition 13. Let T = T , η, - † be a Σ-algebraic monad, and let Γ be a relator for T. Then Γ satis es condition (Σ comp).

Proof. For simplicity we give the proof for the case of operation symbols without parameters. This is not a real restriction, as we can assume without loss of generality all operations to be such. In fact, we simply replace an operation symbol op : P I with a P-indexed family of operation symbols op p : I . The proof proceeds using the correspondence between algebraic operations and generic e ects (G. D. [START_REF] Plotkin | Algebraic operations and generic e ects[END_REF]. Given an arity set I , an I -ary generic e ect is an element of T I . Moreover, any I -ary generic e ect gives an I -ary algebraic operation op de ned by op (κ) = κ † ( ). Vice versa, any I -ary algebraic operation de nes a generic e ect op ∈ T I as op I (η I ). Straightforward calculations show that these transformations give a correspondence between algebraic operations and generic e ects. Let us now move to (Σ comp). We wish to prove

∀i ∈ I . κ (i) ΓR ν (i) =⇒ op (κ) ΓR op (ν ).
Let be the generic e ect associated with op, and assume κ (i) ΓR ν (i) to hold for all i ∈ I . The latter hypothesis can be rewritten as

I I ⊆ ν • • ΓR • κ, from which we infer ΓI I ⊆ (ν † ) • • ΓR • κ † , by (rel bind).
Therefore, we can conclude κ † ( ) ΓR ν † ( ) (i.e. our main thesis), provided we prove ΓI I . The latter indeed holds, since by condition (rel 1) we have I T I ⊆ ΓI I .

Proposition 13 concludes our exposition of the general theory of relators. Having at our disposal this powerful machinery, we are now going to apply it to de ne and study e ectful equivalences and re nements for Λ Σ .

Chapter 5

E ectful Applicative Similarity and Bisimilarity

Equality gives rise to challenging questions which are not altogether easy to answer . . .

Gottlob Frege, On Sense and Reference

In this chapter we de ne three notions of equivalence and three notions of re nement for the calculus Λ Σ of Chapter 3, namely:

• E ectful contextual approximation ctx and equivalence ctx ( Section 5.2).

• E ectful applicative similarity A and bisimilarity A (Section 5.3).

• E ectful CIU approximation ciu and equivalence ciu (Section 5.5).

All these notions are parametrised by a relator Γ, which speci es the observable properties of computations.

Our main results state that if Γ is Σ-continuous, then e ectful applicative similarity is sound for effectful contextual approximation (Theorem 4), and e ectful applicative bisimilarity is sound for e ectful contextual equivalence (Theorem 5). None of them, however, is fully abstract. That is because e ectful applicative similarity (resp. bisimilarity) subsumes lower applicative similarity (resp. bisimilarity) (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Ong | Non-determinism in a functional setting[END_REF] which is known to be strictly ner than lower contextual approximation (resp. equivalence). We will say more about that later. Our soundness results are proved with a generalisation of Howe's method [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF], which takes advantage of the structural properties of Σ-continuous relators.

A variation of Howe's method also allows to prove that e ectful CIU approximation (resp. equivalence) is fully abstract with respect to e ectful contextual approximation (resp. equivalence) (Theorem 6). These results are summarised in Table 5.1.

This chapter is structured as follows. In Section 5.1 we introduce λ-term relations and de ne a simple relational calculus (as we did in Chapter 2) that we will use throughout the rest of this dissertation. We will instantiate such a calculus to de ne the notions of e ectful contextual approximation and equivalence (Section 5.2) as well as the notions of e ectful applicative similarity and bisimilarity (Section 5.3).

A ciu = ctx A ciu = ctx
Table 5.1: Equivalences and re nements for Λ Σ , part 1.

Section 5.4 is entirely devoted to Howe's method and the proof of the precongruence theorem for e ectful applicative similarity (Theorem 4). Congruence of e ectful applicative bisimilarity (Theorem 5) is proved in Subsection 5.4.1. Finally, in Section 5.5 we de ne the notions of e ectful CIU approximation and equivalence, and prove them to be fully abstract (Theorem 6) with respect to e ectful contextual approximation and equivalence, respectively.

Relational Reasoning

In this section we extend the relational calculus developed in Chapter 2 for Λ p to Λ Σ . Most of the de nitions and results presented in this section are slightly variations of the corresponding ones in Chapter 2. Therefore, the reader already familiar with such notions can safely jump to the next section.

De nition 24.

1. A closed λ-term relation is a pair R = (R Λ , R V ) of relations R Λ and R V on Λ • and V • ,
respectively. We refer to R Λ as the computation component of R, and to R V as the value component of R.

2. An open λ-term relation R associates to each nite set of variables Γ a relation Γ Λ -Ron Λ Γ , and a relation

Γ v -R -on V Γ .
We require open λ-term relations to be closed under weakening:

Γ Λ e R f Γ, x Λ e R f Γ v e R w Γ, x v R w
e ∈ Λ Γ Γ Λ e I e ∈ V Γ Γ v I e, f ∈ Λ Γ Γ Λ e 0 f , w ∈ V Γ Γ v 0 w Since e ∈ Λ Γ (resp. ∈ V Γ ) implies e ∈ Λ Γ,∆ (resp. ∈ V Γ,∆
), for any nite set of variables ∆, both 0 and 1 are closed under weakening.

We denote by Rel and Rel c the collections of open and closed λ-term relations, respectively. Formally, we de ne Rel as Γ Rel(Λ Γ , Λ Γ ) × Rel(V Γ , V Γ ). Rel inherits a rich structure from Rel(Λ Γ , Λ Γ ) and Rel(V Γ , V Γ ), as witnessed by the following result.

Since both R and S are closed under weakening, then so is S • R. Moreover, we see that the unit of composition is given by the discrete λ-term relation I, and that Rel is indeed a monoid. It is straightforward to see that composition is monotone in both arguments. This makes Rel an ordered monoid. Finally, we observe that Rel also has an involution given by the mapping a λ-term relation R to its converse R • . The latter is de ned as follow:

Γ Λ f R e Γ Λ e R • f Γ v w R Γ v R • w
By Proposition 14 we can de ne λ-term relations both inductively and coinductively. Concerning notation, we write R ⊆ S if:

∀Γ, e, f . Γ Λ e R f =⇒ Γ Λ e S f ∀Γ, , w. Γ v R w =⇒ Γ v S w.
Moreover, relying on the (complete) lattice structure of Rel we can de ne the notions of a preorder and equivalence λ-term relation. In fact, we say that λ-term relation R is re exive if

I ⊆ R, transitive if R • R ⊆ R, and symmetric if R • ⊆ R.
There are maps -c : Rel → Rel

1 R c = (R Λ , R V ) of R by Λ e R f e R Λ f v R w R V w Dually, given a closed λ-term relation R = (R Λ , R V ) we de ne R o
as its open extension. The latter is de ned as follows, where Γ x x 1 , . . . , x n and u u 1 , . . . , u n :

∀ u ∈ V • . e[ x := u] R Λ f [ x := u] Γ Λ e R o f ∀ u ∈ V • . [ u/ x] R V u[ u/ x] Γ v R o w
Taking advantage of De nition 25, for a closed λ-term relation R = (R Λ , R V ) we will often write Λ e R f in place of e R Λ f , and Γ Λ e R f in place of Γ Λ e R o f (and similarity for values). Dually, for an open λ-term relation S we will use the notations Λ e S f and e S Λ f interchangeably (and similarity for values). Next we introduce the notion of a substitutive λ-term relation.

De nition 26.

1. A λ-term relation R is value-substitutive if the following hold, where u ranges over closed values:

Γ, x Λ e R f Γ Λ e[x := u] R f [x := u] Γ, x v R w Γ v [u/x] R w[u/x] 2. A λ-term relation R is substitutive if the following hold: Γ, x Λ e R f v R w Γ Λ e[x := ] R f [x := w] Γ, x v R w v u R u Γ v [u/x] R w[u /x] A closed λ-relation is (value) substitutive if
its open extension is. Moreover, we notice that the open extension of a closed λ-term relation is trivially value-substitutive.

Γ Λ let x = e in f R let x = e in f (comp-let) Γ, x Λ e R f Γ Λ op(p, x.e) R op(p, x.f ) (comp-op) Figure 5.1: Compatible re nement Λ Σ .
Notice that R is indeed a λ-term relation (notably, R is closed under weakening). De nition 27 induces a map R → R on the collection of open λ-term relations which is monotone and satis es the following identities (see Subsection 5.4.1):

S • R = S • R R • = ( R) • .
In particular, a λ-term relation is compatible if and only if it is a pre-xed point of R → R. Γ

Λ e 1 R f 1 • • • Γ Λ e n R f n Γ Λ op(e 1 , . . . , e n ) R op( f 1 , . . . , f n )
Easy calculations show that the arbitrary intersection of compatible λ-term relations is compatible (the empty intersection being 0), whereas their union need not be so. Nonetheless, we can still give to the collection of compatible λ-term relations a complete lattice structure.

Lemma 11. The collection of compatible λ-term relations forms a complete lattice ordered by ⊆.

Proof. Given a set ρ of compatible relations we de ne the meet of ρ as ρ. We cannot de ne the join of ρ as ρ, since the union of compatible λ-relations is not necessarily compatible. We get round the problem by de ning the join of ρ as

{S | S ⊆ S, ρ ⊆ S}.
It is easy to see that the latter indeed satis es the universal property of the join. Finally, we observe that the bottom element is given by the discrete λ-term relation I, whereas the top element is the indiscrete λ-term relation 0.

Γ v R cc w Γ Λ e R cc f Γ Λ e R cc f Γ v R cc w Γ v R cc w
It is easy to see that -cc is a closure operator, i.e. it is a monotone and idempotent map extending the identity function (meaning that R ⊆ R cc , for any λ-term relation R). Moreover, R cc is the least compatible λ-term relation containing R.

We now have all the background notions needed to de ne and study interesting notions of program equivalence and re nement for Λ Σ . Although our focus is on e ectful applicative (bi)similarity, we rst introduce e ectful contextual approximation and equivalence. Most of the de nitions given in the rest of this chapter are parametrised by a Σ-continuous monad T = T , η, - † and a relator Γ for T. As a consequence, we assume both T and Γ to be xed, thus oftentimes omitting to mention them explicitly.

E ectful Contextual Approximation and Equivalence

The universally accepted notion of operational equivalence (resp. re nement) for sequential, higherorder language is Morris' style contextual equivalence (reps. approximation) [START_REF] Morris | Lambda calculus models of programming languages[END_REF]. The latter is a syntax directed notion of equivalence (resp. re nement) equating (resp. ordering) programs according to a pre xed notion of observation (mostly based on notions of convergence). Accordingly, two programs are deemed as contextually equivalent if there is no context of the language (the latter being a kind of program with a hole to be lled in with the tested program) capable of detecting di erences in the operational behaviour of the two programs, according to the notion of observation given. That is, thinking to contexts as speci c environments or as testing scenarios, contextual equivalence deems two programs as equivalent, if no environment (resp. testing scenario) is capable of distinguish them.

We have already discussed in Chapter 2 the rationale behind the notions of contextual approximation and contextual equivalence. Here we simply recall that in most languages, contextual equivalence (resp. approximation) is characterised by a universal property: contextual equivalence (resp. approximation) is the largest (i.e. the less discriminating) adequate (resp. preadequate) congruence (resp. precongruence) λ-term relation. A λ-term relation R is adequate (reps. preadequate) if R relates programs exhibiting the same operational behaviour (resp. the operational behaviour of the second re nes the operational behaviour of the rst).

In this setting, (pre)adequacy predicates can be used in place of notions of observation. That is, instead of dealing with an explicit notion of observation, we x a predicate Adeq ⊆ Rel on λ-term relations according to the rationale that if a λ-term relation R belongs to Adeq, then it does not relate programs which are observationally distinguishable. For instance, in the pure, untyped λ-calculus one is usually interested in observing convergence of a term (according to a given reduction strategy (G. [START_REF] Plotkin | Call-by-name, call-by-value and the lambda-calculus[END_REF]). As a consequence, a relation is said to be adequate if whenever it relates two programs, then one of the programs converges if and only so does the other. We will follow a di erent route in Chapter 6, where we will work with an explicit notion of observation.

The calculus Λ Σ being untyped, we follow the convention of not observing values, but only e ects. As a consequence, our notion of adequacy will be de ned with respect to a relator Γ only.

De nition 29. A λ-term relation R is Γ-adequate (just adequate, when Γ is clear from the context) if Λ e R f implies e Γ0 V f , where 0 c = (0 Λ , 0 V ) is the closed indiscrete λ-term relation.
Example 37.

The following examples give a taste of the rationale behind De nition 29.

• Instantiating De nition 29 with the relator M, we see that a λ-term relation R over terms in Λ M is adequate if whenever Λ e R f holds, then if e converges, then so does f . Formally:

Λ e R f =⇒ ( e ⊥ =⇒ f ⊥).
(5.1)

Replacing M with M ∧ M• , we see that the rightmost implication of (5.1) becomes an equivalence.

• Instantiating De nition 29 with the relator FM, we see that a λ-term relation R over terms in Λ FM is adequate if whenever Λ e R f holds, then if e may converge, then so does f . Formally:

Λ e R f =⇒ ( e {⊥} =⇒ f {⊥}).
(5.2)

Replacing FM with FM ∧ FM

•

, we see that the rightmost implication of (5.2) becomes an equivalence.

• Instantiating De nition 29 with the relator DM, we see that a λ-term relation R over terms in Λ DM is adequate if whenever Λ e R f holds, then the probability of convergence of e is less or equal than the probability of convergence of f . Formally:

Λ e R f =⇒ e (V • ) ≤ f (V • ).
(5.3)

Replacing DM with DM ∧ DM In light of De nition 29 we wish to de ne e ectful contextual approximation (reps. equivalence) as the largest adequate precongruence (resp. congruence). We have already seen that the collection of compatible λ-term relations forms a complete lattice. However, we soon realise that adequacy is not a 'monotone property', and thus we cannot appeal to the Knaster-Tarski Theorem to infer the existence of the largest adequate precongruence. Following (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF] we prove the existence of the desired relation explicitly. By hypothesis I ∈ α, so that {R ∈ α | R ⊆ R} is non-empty. As a consequence, since α is closed under non-empty union, S ∈ α. In order to conclude the thesis it remains to prove S ⊆ S. Formally, we prove by simultaneous induction the following statements:

1. If Γ Λ e S f , then Γ Λ e S f . 2. If Γ v S w, then Γ v S w.
We prove a couple cases as illustrative examples.

• Suppose Γ Λ let x = e in f S let x = e in f , so that we have Γ Λ e S e and Γ, x Λ f S f . By very de nition of S there exist compatible λ-term relations R 1 , R 2 ∈ α such that Γ Λ e R 1 e and Γ, x Λ f R 2 f . Since both R 1 and R 2 are compatible, then so is

R 2 • R 1 . Moreover, since α is closed under composition, then R 2 • R 1 ∈ α.
We also notice that, since compatibility implies re exivity, both

Γ Λ e (R 2 • R 1 ) e and Γ, x Λ f (R 2 • R 1 ) f hold. In fact, R 1 = I • R 1 ⊆ R 2 • R 1 . Therefore Γ Λ let x = e in f (R 2 • R 1 ) let x = e in f ,
and thus (by compatibility of R 2 • R 1 )

Γ Λ let x = e in f (R 2 • R 1 ) let x = e in f .
We conclude the wished thesis by very de nition of union of λ-term relations.

• Suppose Γ Λ op(p, x.e) S op(p, x.f ), so that Γ, x Λ e S f . As a consequence, there exists a compatible λ-term relation R ∈ α such that Γ, x Λ e R f . Therefore, we have Γ Λ op(p, x.e) R op(p, x.f ) and thus Γ Λ op(p, x.e) R op(p, x.f ), by compatibility of R. We can conclude Γ Λ op(p, x.e) S op(p, x.f ).

Lemma 13. The adequacy property We show e Γ0 V f . Since both R and S belong to Adeq Γ , we obtain e (Γ0 V • Γ0 V ) f . We conclude the thesis by property (rel 2). Finally, given a non-empty set ρ ⊆ Adeq Γ of λ-term relations, we see that if Λ e ( ρ) f , there there exists R ∈ ρ (and thus R ∈ Adeq Γ ) such that Λ e R f . We conclude f Γ0 V f . De nition 30. De ne the λ-term relation ctx , called e ectful contextual approximation with respect to Γ (e ectful contextual approximation or even contextual approximation, for short) as the largest compatible and Γ-adequate relation.

Adeq Γ {R ∈ Rel | Λ e R f =⇒ e Γ0 V f
Remark 9. The notion ctx used to denote contextual approximation does not give any information about the relator de ning the relevant notion of adequacy. For that reason, a better notation for contextual approximation would be ctx Γ . Since most of the times Γ will be clear from the context, we will write ctx in place of ctx Γ where possible. We also apply this convention to the rest of the equivalences and re nements we will study in this dissertation.

The reader might have noticed that the de nition of the property Adeq Γ involves only the behaviour of λ-term relations on computations, and does not say anything about their behaviour on values. This is rather obvious, as adequacy is an operational notion based on the evaluation semantics of a program. Formally, this does not mean that on values ctx coincides with the indiscrete relation. In fact, compatibility forces ctx to relate only those values that behave appropriately when used inside computations.

For instance, if ctx V , then by compatibility (and re exivity) of ctx we have w ctx Λ w too, which gives w Γ0 V w . Obviously, this cannot be the case for all pairs of values , . De nition 30 comes with an associated proof technique resembling a coinduction proof principle. In order to prove that a program e contextually approximates a program f , it is su cient to exhibit a compatible and adequate λ-relation relating e and f . Symbolically:

R ⊆ R R ∈ Adeq Γ R ⊆ ctx ( ctx -UMP)
We can use this proof technique to prove that ctx is actually a precongruence relation.

Corollary 2. The relation ctx is a precongruence relation.

Proof. Since the discrete λ-term relation I is the least xed point of R → R and belongs to Adeq Γ , it is su cient to show that ctx is transitive. We use the proof technique associated with the de nition of ctx showing that

( ctx • ctx ) ⊆ ( ctx • ctx ) and ( ctx • ctx ) ∈ Adeq Γ .
The former obviously holds, since the composition of compatible λ-term relations is compatible. For the latter, we simply observe that in Lemma 13 we show Adeq Γ to be closed under composition.

Finally, we notice that we can extend Corollary 2 showing that if Γ is conversive, then ctx is symmetric. In light of this observation we give the following de nition of e ectful contextual equivalence.

De nition 31. The λ-term relation ctx , called e ectful contextual equivalence with respect to Γ (e ectful contextual equivalence or even contextual equivalence, for short) is de ned as ctx Γ∧Γ • . In particular, ctx is the largest compatible relation in Adeq Γ∧Γ • .

Notice that we are applying the convention of Remark 9 in the notation employed for e ectful contextual equivalence. It is straightforward to see that ctx is a congruence relation. Additionally, we can characterise ctx as follows.

Proposition 15. ctx = ctx ∩ ( ctx ) • .
Proof. The proof uses the proof techniques associated with ctx and ctx , and is rather straightforward. The only relevant points to notice are the following:

( ctx Γ ) • = ctx Γ • and Adeq Γ∧Γ • = Adeq Γ ∩ Adeq Γ • .

E ectful Applicative Similarity and Bisimilarity

We now introduce e ectful applicative similarity and bisimilarity with respect to a relator Γ. As usual, we assume a Σ-continuous monad T and relator Γ for it to be xed. We begin our analysis de ning the notion of an e ectful applicative simulation relation with respect to a relator Γ (e ectful applicative similarity, for short). Contrary to e ectful contextual approximation, e ectful applicative similarity is de ned as a closed λ-term relation, and then extended to an open λ-term relation by means of its open extension.

De nition 32. Given a closed λ-term relation R = (R Λ , R V ) we de ne the closed λ-term relation [R] = ([R] Λ , [R] V ) as follows: Λ e [R] f ⇐⇒ e ΓR V f v [R] w ⇐⇒ ∀u ∈ V • . Λ u R Λ wu.
A λ-term relation R is an e ectful applicative simulation with respect to Γ (e ectful applicative simulation or even applicative simulation, for short

) if R ⊆ [R].
De nition 32 can be equivalently stated by saying that a closed λ-term relation R = (R Λ , R V ) is an applicative simulation is the following conditions hold: Proof. Suppose R ⊆ S. We rst prove that Λ e [R] f implies Λ e [S] f , i.e. e ΓS V f . By hypothesis we have e ΓR V f . Moreover, since R ⊆ S and Γ is monotone, we can conclude ΓR ⊆ ΓS, and thus the wished implication. We now prove that v [R]w implies Λ [S]w, i.e. Λ u S wu, for any closed value u. Since v [R] w, we have Λ u R wu, and thus Λ u S wu, because R ⊆ S.

Λ e R f =⇒ e ΓR V f (app comp) v R w =⇒ ∀u ∈ V • . Λ u R wu. ( app
By Lemma 14 we can de ne e ectful applicative similarity with respect to Γ, denoted by A , as the greatest xed point of R → [R]. Obviously, A is the largest closed λ-term relations satisfying conditions (app comp) and (app val).

De nition 33. De ne the closed λ-term relation A , called e ectful applicative similarity with respect to Γ (e ectful applicative similarity or even applicative similarity, for short), as the greatest xed point of R → [R] (which exists by the Knaster-Tarski Theorem).

Again, notice that we are tacitly applying the notational convention of Remark 9. Additionally, since in this chapter we will deal with applicative similarity only, oftentimes we will use the lighter notation in place of A (the latter will be useful in later chapters, where other notions of similarity will be studied).

Applicative similarity comes with an associated coinduction proof principle: in order to prove that a program f applicatively re nes a program e, it is su cient to exhibit an applicative simulation relating them. Symbolically:

R ⊆

[R] R ⊆ A ( A -coind.)
Example 38. Instantiating De nition 33 with relators of the form T as de ned in Section 4.3, we obtain well known notions of applicative similarity. Notably, taking Γ to be M, FM, DM, and Ĉ we recover (callby-value) Abramsky's applicative similarity (Abramsky, 1990a), (lower) nondeterministic applicative similarity (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Ong | Non-determinism in a functional setting[END_REF], probabilistic applicative similarity [START_REF] Crubillé | On probabilistic applicative bisimulation and call-by-value lambdacalculi[END_REF][START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF], and Sands' improvement similarity [START_REF] Sands | Improvement theory and its applications[END_REF], respectively. We now give an example of how we can use the coinduction proof principle to prove behavioural re nements between programs. Our example is given in Λ p .

Example 39. Instantiating De nition 33 with the partial distribution monad DM and its associated relator DM we recover probabilistic applicative similarity for Λ p . Let us consider computations e (return I ) or Ω, and f return I , where Ω is the purely divergent program (λx.xx )(λx.xx ) and I λx.return x. We show that e Λ f . Let us consider the λ-

term relation R = (R Λ , R V ) whose graph is G R Λ {((return I ) or Ω, return I )} G R V {(I , I )}.
In order to prove that R is an applicative simulation, we have to show e DMR V f , that is:

1 2 • just I + 1 2 • ⊥ DMR V 1 • I .
De ne the distribution ω over MV • × MV • as follows:

ω (just I , just I ) 1 2 ω (⊥, just I ) 1 2
and zero on all other elements. Clearly ω ∈ Ω( e , f ). We have to prove that for all v, w ∈ MV • , ω (v, w) > 0, implies v MR V w. The only cases to consider are for v = just and v = ⊥. In the latter case we are trivially done by very de nition of M. In the former case we have w = just I too, and thus we are done since I R V I .

We now analyse the metatheoretical properties of applicative similarity. First of all, we see that the coinduction proof principle allows for an handy proof of re exivity and transitivity of .

Proposition 16. Applicative similarity is a re exive and transitive (closed) λ-term relation.

Proof. The proof is by coinduction. In order to prove re exivity we show that the closed λ-term relation I c = (I Λ , I V ) is an applicative simulation. Clause (app val) is obviously satis ed, so that it remains to prove clause (app comp). That amounts to show e ΓI V e . This is indeed the case, since by condition (rel 1) we have

I T V • ⊆ Γ(I V • ) = ΓI V
and obviously e I T V • e holds. We prove transitivity of by showing that • is an applicative simulation. Again, the clause (app val) is obviously satis ed. Let us move to (app comp). We have to show that Λ e ( • ) f implies e Γ( V • V ) f . By very de nition of transitivity we have:

Λ e ( • ) f =⇒ e (Γ V • Γ V ) f
[By (app comp) and De nition 33] =⇒ e Γ( V • V ) f .

[By (rel 2)]

Next, we notice that since Γ is monotone, ∈ Adeq Γ . For:

Λ e f =⇒ e Γ V f [By (app comp)] =⇒ e Γ0 V f . [By (rel 4) since V ⊆ 0 V ]
The last (but certainly not least) property we wish to prove about applicative similarity is compatibility, meaning that e ectful applicative similarity is a (pre)adequate precongruence relation, and thus a sound proof technique for e ectful contextual approximation. However, as we saw in Chapter 2, proving to be compatible from rst principles is bound to be hard, due to substitutivity. We prove a compatibility theorem for applicative similarity using a generalisation of Howe's method [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF]. Before that, let us introduce e ectful applicative bisimilarity.

De nition 34. De ne the closed λ-term relation A , called e ectful applicative bisimilarity with respect to Γ (e ectful applicative bisimilarity or even applicative bisimilarity, for short), as e ectful applicative similarity with respect to Γ ∧ Γ • .

We apply the same notational and terminological conventions introduced for e ectful applicative similarity to e ectful applicative bisimilarity. In particular, throughout this chapter, we oftentimes write in place of A . A rst consequence of De nition 34 is that is the largest applicative simulation with respect to Γ ∧ Γ • . Additionally, a straightforward proof by coinduction shows that is indeed symmetric (since Γ ∧ Γ • is conversive) and contained in (since Γ ∧ Γ • ≤ Γ). Finally, we give the following alternative characterisation of , which will be useful when proving applicative bisimilarity to be a congruence relation.

Proposition 17. E ectful applicative bisimilarity is the largest symmetric applicative simulation with respect to Γ.

Proof. De ne the closed λ-term relation S as

S {R | R = R • , R ⊆ [R]}.
Obviously S is a symmetric applicative simulation with respect to Γ, and actually the largest such. We prove ⊆ S using the coinduction proof principle associated with S. To do so, it is su cient to show that is a symmetric applicative simulation with respect to Γ, which is indeed the case. Conversely, we prove S ⊆ using the coinduction proof principle associated with . Doing so amounts to show that Λ e S f implies e ΓS V f and f Γ • (S V ) e . Since S is symmetric, the latter is equivalent to f ΓS V e , and thus we can conclude the thesis since S is a symmetric applicative simulation with respect to Γ.

It is now time to introduce the main results of this chapter, namely a precongruence theorem for e ectful applicative similarity, and a congruence theorem for e ectful applicative bisimilarity.

Howe's Method

Having observed the di culties one encounters when trying to prove to be compatible from rst principles, in this section we develop a generalisation of Howe's method [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF][START_REF] Pitts | Howe's method for higher-order languages[END_REF] and use it to prove a precongruence theorem for , and a congruence theorem for .

At the heart of Howe's method is a relational construction (called precongruence candidate in [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF]) extending to a substitutive and compatible relation H . The key ingredient to make such a method work is the so-called Key Lemma. The latter essentially states that H is an applicative simulation, and thus coincide with . Proving the Key Lemma is notoriously hard in presence of speci c e ects, the case of probabilistic calculi being a prime example [START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF]. Perhaps surprisingly, our proof of the Key Lemma is rather easy, and relies on structural properties of Σ-continuous relators only. This allows to separate the core of Howe's method, viewed as a syntactical construction, from its soundness, which instead is based on semantical and operational properties of the e ects considered. Let us now enter the details of Howe's method.

De nition 36 (Howe extension,2). Given a closed λ-term relation R, the Howe extension R H of R is the open λ-term relation inductively de ned as follows:

Γ Λ e R H Γ Λ R f Γ Λ e R H f Γ v R H u Γ v u R w Γ v R H w
Additionally, unfolding the de nition of R, we see that R H is inductively de ned by the rules in Figure 5.2.

to rule (H-let). Concretely, we prove we prove

Γ Λ let x = e[z := ] in f [z := ] R H [z := w] given the derivation Γ, z Λ e R H e Γ, z, x Λ f R H f Γ, z Λ let x = e in f R Γ, z Λ let x = e in f R H (H-let)
(notice that in the third premise, we are actually referring to the open extension of R, which is trivially value substitutive). We apply the induction hypothesis on the rst and second premise, obtaining:

Γ Λ e[z := ] R H e [z := w] Γ, x Λ f [z := ] R H f [z := w].
Since the open extension of R is value-substitutive, from the third premise we obtain

Γ Λ let x = e [z := w] in f [z := w] R [z := w],
and thus an application of rule (H-let) gives the desired thesis.

Since is re exive and transitive we can apply Lemma 15 on H . We obtain a compatible and substitutive relation extending H . In particular, by property (rel 2), Lemma 15 gives the following inequality, which we refer to as pseudo-transitivity of H :

Γ • Γ H ⊆ Γ .
(pseudo-trans)

We now prove the Key Lemma. Before entering the proof, the reader is invited to observe that so far none of our proofs and de nitions rely on the relator Γ being inductive nor on Γ being a relator for T (we only relied on Γ being a relator for T only). This will not be the case for the Key Lemma, as its proof requires Γ to be Σ-continuous.

Lemma 16 (Key Lemma). Let Γ be Σ-continuous. Then the ( H ) c is an applicative simulation.

Proof. We rst notice that v H w implies Λ u H u, for any closed value u. In fact, H is re exive (meaning that v u H u holds) and compatible. This shows that ( H ) c satis es condition (app val).

Next, we show ( H ) c satis es condition (app comp) too. That amounts to prove that Λ e H f implies e Γ H V f . Since e = n e n and Γ is inductive, we can appeal to property (ind 3). As a consequence, it is su cient to prove the following statement:

Λ e H f =⇒ ∀n ≥ 0. e n Γ H V f .
We assume Λ e H f and proceed by induction on n. The case for n = 0 requires to prove ⊥ Γ H V f , which indeed holds since Γ is inductive. Let us not look at the (n + 1)-case. We proceed by case analysis according to the de nition ofn .

• Suppose e = return , so that e n+1 = η( ). We have to show:

Λ return H f =⇒ η( ) Γ H V f .
Assume the antecedent of the above implication. By very de nition of Howe extension, the latter must be the conclusion of a derivation of the form:

v H w Λ return w f Λ return H f (H-val)
By (app comp), we see that Λ return w f implies η(w

) Γ V f , whereas v H w implies η( ) Γ H V η(w )
, by (rel unit). As a consequence, we have η( ) (Γ V • Γ( H ) V ) f and thus we conclude the thesis by (pseudo-trans).

• Suppose e = (λx. ) , so that e n+1 = [x := ] n . We have to show:

Λ (λx. ) H f =⇒ [x := ] n Γ H V .
Assume the antecedent of the above implication. By very de nition of Howe extension, the latter must be the conclusion of a derivation of the form:

x Λ H h v λx.h u v λx. H u (H-abs) v H w Λ uw f Λ (λx. ) H f (H-app)
We have:

x Λ H h, v H w =⇒ Λ [x := ] H h[x := w] [By Lemma 15 (substitutivity)] =⇒ [x := ] n Γ H V h[x := w] . [By induction hypothesis] Additionally: v λx.h u =⇒ v (λx.h)w uw [By (app val)] =⇒ h[x := w] Γ V uw . [By (app comp)]
As a consequence, we conclude [x := ] n Γ H V uw , by (pseudo-trans). Finally, since Λ uw f implies uw Γ V f , by (app comp), we conclude the wished thesis, by (pseudo-trans).

• Suppose e = (let x = in h), so that e n+1 = h[x := -] † n n . We have to show:

Λ let x = in h H f =⇒ h[x := -] † n n Γ H V f .
Assume the antecedent of the above implication. By very de nition of Howe extension, the latter must be the conclusion of a derivation of the form:

Λ H x Λ h H h Λ let x = in h f Λ let x = in h H f (H-let)
First of all we notice that in order to prove the thesis, it is su cient to prove:

h[x := -] † n n Γ H V h [x := -] † .
(5.4)

For, we have:

Λ let x = in h f =⇒ h [x := -] † Γ V f [By (app comp)] =⇒ h[x := -] † n n Γ H V f .
[By (5.4) and (pseudo-trans)]

Let us prove (5.4). Applying the induction hypothesis on Λ H we obtain n Γ H

V

. As a consequence, by condition (rel bind), in order to prove (5.4) it is su cient to prove:

v H w =⇒ h[x := ] n Γ H V h [x := w] .
The latter is a direct consequence of substitutivity of H and of the induction hypothesis. More precisely:

v H w =⇒ Λ h[x := ] H h [x := w]
[By Lemma 15 (substitutivity) and

x Λ h H h ] =⇒ h[x := ] n Γ H V h [x := w] . [By induction hypothesis]
• Suppose e = op(p, x. ), so that e n+1 = op (p, → [x := ] n ). We have to to show:

Λ op(p, x. ) H f =⇒ op (p, → [x := ] n ) Γ H V f .
Assume the antecedent of the above implication. By very de nition of Howe extension, the latter must be the conclusion of a derivation of the form:

x

Λ H h Λ op(p, x.h) f Λ op(p, x. ) H f (H-op)
As for previous cases, by (pseudo-trans) in order to prove the thesis it is su cient to show:

op (p, → [x := ] n ) Γ H V op (p, → h[x := ] ).
(5.5)

To see that the latter holds we appeal to condition (Σ comp):

(5.5

) ⇐= ∀ ∈ V • . [x := ] n Γ H V h[x := ] [By (Σ comp)] ⇐= Λ [x := ] H h[x := ] [By induction hypothesis] ⇐= x Λ H h.
[ By Lemma 15 (substitutivity and re exivity)]

Theorem 4. If Γ is Σ-continuous, then the open extension of e ectful applicative similarity is a precongruence relation.

Proof. We already know that is a preorder, and thus o is a preorder too. To prove it is compatible (and thus a precongruence relation), it is su cient to prove that H = o . By Lemma 15 we already know that the open extension of is included in H , so that it is su cient to prove:

Γ Λ e H f =⇒ Γ Λ e f .
For that, it is su cient to show that ( H ) c ⊆ . In fact, if that is the case, then we have (where Γ = x):

Γ Λ e H f =⇒ ∀ ∈ V • . Λ e[ x := ] H f [ x := ] [Since H is value-substitutive] =⇒ ∀ ∈ V • . Λ e[ x := ] f [ x := ] [Since ( H ) c ⊆ ] =⇒ ∀ ∈ V • . Λ e f .
[

By de nition of open extension]

Finally, to see that ( H ) c is contained in we proceed by coinduction, showing that ( H ) c is an applicative simulation. The latter is exactly the content of the Key Lemma.

An immediate corollary of Theorem 4 is that the open extension of applicative similarity is contained in contextual approximation (recall that is adequate), meaning that it quali es as a sound proof technique for the latter. The reverse inclusion, which would give full abstraction of o does not hold in general. A counterexample is given by Λ FM , where applicative similarity is well known to be strictly ner than contextual approximation (see Example 6.4.4 in (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]).

The next result we wish to prove is a congruence theorem for applicative bisimilarity. Since we already know applicative bisimilarity to be an equivalence relation, what we have to do is to prove that it is also compatible. It is not hard to realise that compatibility of would easily follow if coincides with ∩ • . This is the case in e.g. Λ M and Λ DM , but it is not the case in Λ FM . Abstractly, the failure of such a property is re ected by the non-validity of the identity Γ(R ∩ S) = ΓR ∩ ΓS.

Applying Howe's construction to also raises some problems. In fact, the Howe extension of a relation is built from relational re nement and postcomposition with the original relation, thus making the construction intrinsically asymmetric. As a consequence, R H is in general not symmetric, meaning that there is little hope to prove the coincidence of H with . Howe [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF] xed this problem by observing that the transitive closure of H is indeed symmetric. The adaption of Howe's construction based on this observation goes under the name of transitive closure trick (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Pitts | Howe's method for higher-order languages[END_REF].

The Transitive Closure Trick

In this section we adapt Howe's original formulation of the so-called transitive closure trick to prove a congruence theorem for applicative bisimilarity. Following [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF], we begin by noticing that the transitive closure of the Howe extension of an equivalence λ-term relation is a compatible symmetric λ-term relation. Recall that the transitive closure R T of a relation R is de ned as follows:

R (0) I R (n+1) R (n) • R R T n R (n) .
Equivalently, we inductively de ne R T as follows:

Γ Λ e R f Γ Λ e R T f Γ Λ e R Γ Λ R T f Γ Λ e R T f Γ v R w Γ v R T w Γ v R u Γ v u R T w Γ v R T w
Lemma 17. Let R be a re exive and transitive λ-term relation. Then (R H ) T is compatible. If additionally R is symmetric, then (R H ) T is symmetric as well.

Proof. We begin by showing that (R H ) T is compatible, i.e. (R H ) T ⊆ (R H ) T . Since the composition of compatible relations is compatible, obviously (R H ) T is compatible. However, since we did not give an explicit proof of the above fact, we sketch a proof of compatibility of (R H ) T from rst principles. The proof is by induction on the de nition of (R H ) T . We show how to handle the case for sequencing (the remaining cases are proved in a similar, but easier way). Suppose to have:

Λ e (R H ) T e x Λ f (R H ) T f Λ let x = e in f (R H ) T let x = e in f (comp-let)
We show Λ let x = e in f (R H ) T let x = e in f . By very de nition of transitive closure, there exist natural numbers n, m such that Λ e (R H ) (n) e and x Λ f (R H ) (m) f hold. Since R H is re exive and transitive, without loss of generality we can assume n = m. In fact, if e.g. n = m + l, then we can 'complete' (R H ) (m) as follows:

(R H ) (m) = (R H ) (m) •I • • • • I l -times ⊆ (R H ) (m) • R H • • • • R H l -times = (R H ) (n) .
We now prove the thesis by induction on n. The base case is trivial. Let us now prove the case for n + 1. By very de nition of transitive closure, we obtain the existence of computations e and f such that the following hold:

Λ e R H e x Λ f R H f Λ e (R H ) (n) e x Λ f (R H ) (n) f .
We apply the induction hypothesis on Λ e (R H ) (n) e and

x Λ f (R H ) (n) f , obtaining Λ let x = e in f (R H ) T let x = e in f . Moreover, since R H is compatible, from Λ e R H e and x Λ f R H f we infer Λ let x = e in f R H let x = e in f .
We thus have

Λ let x = e in f ((R H ) T • R H ) let x = e in f ,
from which the thesis follows, since (R

H ) T • R H = (R H ) T . We now show that if R is an equivalence λ-term relation, then (R H ) T is symmetric. That amounts to show (R H ) T ⊆ ((R H ) T ) • , which in turn is a direct consequence of R H ⊆ ((R H ) T ) • .
Concretely, we simultaneously prove by induction on their premise the following implications:

Γ Λ e R H f =⇒ Γ Λ f (R H ) T e Γ v R H w =⇒ Γ v w (R H ) T .
The proof is straightforward, and thus we show how to handle a couple of cases as illustrative examples only.

• Suppose Γ v R H w is the conclusion of an instance of rule (H-var), so that we have the following derivation:

Γ , x v x R w Γ , x v x R H w (H-var)
Since R is symmetric (and thus so is its open extension), Γ ,

x v x R w implies Γ , x v w R x.
By Lemma 15 we know that the open extension of R is contained in R H , and thus we conclude Γ , x v w R H x.

• Suppose Γ v e R H f is the conclusion of an instance of rule (H-let), so that we have the following derivation:

Γ Λ e R H e Γ, x Λ f R H f Γ Λ let x = e in f R f Γ Λ let x = e in f R H f (H-let)
Since R is symmetric (and thus so is its open extension),

Γ Λ let x = e in f R f implies Γ Λ f R let x = e in f , and thus Γ Λ f R H let x = e in f
, by Lemma 15. Moreover, we can apply the induction hypothesis on Γ Λ e R H e and Γ,

x Λ f R H f , obtaining Γ Λ e (R H ) T e and Γ, x Λ f (R H ) T f
. By compatibility of (R H ) T we obtain

Γ Λ let x = e in e (R H ) T let x = e in f . We conclude Γ Λ f ((R H ) T • R H ) let x = e in f
, and thus the desired thesis.

We can now state and prove our congruence theorem for applicative bisimilarity. Before doing so, let us remark that our proof of the Key Lemma does not depend on applicative similarity being the largest applicative simulation. Rather, it makes use only of being re exive, transitive, and an applicative simulation. As a consequence, we can generalise the Key Lemma over all re exive and transitive applicative simulation.

Theorem 5. If Γ is Σ-continuous, then the open extension of e ectful applicative bisimilarity is a congruence relation.

Proof. We already know to be an equivalence relation (and thus o is). We prove that o is compatible by showing that coincides with the restriction of ( H ) T on closed terms. As for Theorem 4, from that

follows o = ( H ) T , noticing that if a λ-term relation R is value substitutive, then so is R T . Let us show = (( H ) T ) c . Since o ⊆ H ⊆ ( H ) T ,
it is su cient to show that the restriction of ( H ) T on closed terms is contained in . We prove that by coinduction, relying on the characterisation of as the largest symmetric applicative simulation. As a consequence, we have to show that the restriction of ( H ) T on closed terms is a symmetric applicative simulation (with respect to Γ). Symmetry follows by Lemma 17. Moreover, since is a re exive and transitive applicative simulation, by Key Lemma it follows that H is an applicative simulation too. Notice that the characterisation of in terms of symmetric applicative simulations is central here. In fact, working with de ned as applicative similarity with respect to Γ ∧ Γ • does not allow us to apply the Key Lemma, since Γ ∧ Γ • is in general not inductive. Finally, since the composition of applicative simulations is an applicative simulation, we see that ( H ) T is an applicative simulation too, and thus conclude that coincides with the restriction of ( H ) T on closed terms. Since by Lemma 17 the latter is compatible, is compatible too, and thus a congruence relation.

It is straightforward to see that applicative bisimilarity is adequate, with adequacy being de ned by the predicate Adeq Γ∧Γ • . Therefore, Theorem 5 implies that is included in e ectful contextual equivalence, and thus that it provides a sound proof technique for the latter. As for applicative similarity, the opposite inclusion does not hold in general (again, see (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]), meaning that e ectful applicative bisimilarity is not fully abstract for e ectful contextual equivalence.

CIU Approximation and Equivalence

In previous section we showed that e ectful applicative similarity (resp. bisimilarity) is sound for effectful contextual approximation (resp. equivalence), but not fully abstract. Following [START_REF] Pitts | Howe's method for higher-order languages[END_REF], here we show how to apply Howe's method as developed in Section 12.2 to prove a generalisation of Mason-Talcott CIU Theorem [START_REF] Mason | Equivalence in functional languages with e ects[END_REF], thus providing a handier characterisation of contextual approximation (resp. equivalence).

Roughly speaking, CIU-like theorems are a family of context lemmas [START_REF] Milner | Fully abstract models of typed lambda-calculi[END_REF] stating that two programs are contextually equivalent if no evaluation context can distinguish them. The acronymous CIU stands for Closed Instantiation of Use, since the original theorem in [START_REF] Mason | Equivalence in functional languages with e ects[END_REF] states that two terms are contextually equivalent if any closed instantiation of a use of the rst is indistinguishable from the closed instantiation of a use of the second. Therefore, a use is simply an evaluation context, i.e. an environment that uses its input program. We will say more about ideas behind CIU approximation and equivalence in the next chapter, where such notions will be central themes.

Recall from Section 3.2 that Λ Σ evaluation contexts are de ned by the grammar:

E ::= [-] | let x = E in e.
The rst requirement we have to make in order to de ne a meaningful notion of CIU approximation (and thus equivalence) is that whenever a term e CIU-approximates a term f , then no use, i.e. no evaluation context, can produce an observable behaviour using e that it is not able to produce using f . As for contextual approximation, we model approximation under (ground) observations (such us convergence, may convergence, or probability of convergence), as the relation Γ0 V . Accordingly, we said that a λ-term relation R is adequate with respect to Γ if R ∈ Adeq Γ . Therefore, we require CIU approximation ciu to satisfy the following property:

e ciu Λ f ⇐⇒ ∀E. E[e] Γ0 V E[f ] .
That, however, does not take into account values, as evaluation contexts take computations as input and produce new computations. As a consequence, we give the following de nition inspired by (P. B. [START_REF] Levy | Amb breaks well-pointedness, ground amb doesn't[END_REF].

De nition 37. Let Γ be a relator. De ne e ectful CIU approximation ciu with respect to Γ as the largest closed λ-relation R such that:

Λ e R f =⇒ e Γ0 V e (ciu 1) Λ e R e =⇒ ∀f ∈ Λ x . Λ let x = e in f R let x = e in f . (ciu 2) v R =⇒ ∀e ∈ Λ x . Λ e[x := ] R e[x := ]. ( ciu 3)
De nition 37 indeed de nes a λ-term relation, since {R | R satis es (ciu 1), (ciu 2), (ciu 3)} itself satis es (ciu 1), (ciu 2), and (ciu 3). Finally, we de ne e ectful CIU equivalence ciu with respect to Γ as ciu ∩ ( ciu ) • .

As usual, we apply the notation and terminological conventions of Remark 9. Accordingly, we refer to e ectful CIU approximation (resp. equivalence) with respect to Γ simply as CIU approximation (resp. equivalence). It is a straightforward exercise to verify that ciu is a preorder (and ciu an equivalence) relation.

Lemma 18. CIU approximation ciu is a re exive and transitive λ-term relation, whereas CIU equivalence ciu is a re exive, symmetric, and transitive λ-term relation.

We also notice that (the closed restriction of) ctx satis es conditions (ciu 1), (ciu 2), and (ciu 3), meaning that ( ctx ) c ⊆ ciu (similarity, one easily sees that ( ctx ) c is included in ciu ). Actually, proving that ( ctx ) c satis es condition (ciu 3) requires to show substitutivity of ctx . Although we did not give any proof of that, the reader should notice that we can modify the theory of Section 5.2 working with the complete lattice of compatible and substitutive relations, rather than with the complete lattice of compatible relations only. In particular, an analogue of Lemma 12 can be easily proved for the space of compatible and substitutive relations, meaning that there exists a largest compatible and substitutive adequate λ-term relation. This change does not a ect our soundness results, as e ectful applicative (bi)similarity, as well as the other notions of equivalence and re nement studied in the next chapters, are substitutive.

Another, more direct proof of substitutivity of ctx is obtained by showing that the (generalised) β-equivalence relation = β , de ned by:

Γ, x Λ e Γ v Γ Λ (λx.e) = β e[x := ]
is valid for ctx . An elegant way to prove such a result is by showing that the open extension of e ectful Kleene approximation, de ned by is contained in ctx . We do not prove such a result here (although that can be easily done). The reader can consult e.g. Section 4.3 and Section 6.3 in (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF] for details (although instantiated for Λ M and Λ FM only).

Lemma 19. E ectful contextual approximation is contained in the open extension of CIU approximation.

Proof. We have to show

Γ Λ e ctx f =⇒ Γ Λ e ciu f .
Let Γ = x. Then we have:

Γ Λ e ctx f =⇒ ∀ ∈ V • . Λ e[ x := ] ctx f [ x := ] [Since ctx is value-substitutive] =⇒ ∀ ∈ V • . Λ e[ x := ] ciu f [ x := ] [Since ( ctx ) c ⊆ ciu ] =⇒ ∀ ∈ V • . Λ e ciu f .

[By de nition of open extension]

Next, we wish to prove that actually ( ciu ) o provides an alternative characterisation of ctx , and thus that it is fully abstract for it. For that it is su cient to show compatibility of ( ciu ) o . We prove such a compatibility result using Howe's method. In fact, by Lemma 18 ciu is a preorder, and thus by Lemma 15 we see that ( ciu ) H is re exive, compatible, and substitutive open λ-term relation. Therefore, we wish to show that the closed restriction of ( ciu ) H is contained in ciu . Mimicking the proof of Lemma 19, we see that we can then conclude

( ciu ) o = ( ciu ) H .
Let us show (( ciu ) H ) c ⊆ ciu . Since ( ciu ) H is compatible and substitutive, (( ciu ) H ) c obviously satis es conditions (ciu 2) and (ciu 3). The next lemma, which plays the same role played by Lemma 16 for applicative similarity, shows that ( ciu ) H is adequate.

Lemma 20. Let Γ be a Σ-continuous relator. If Λ e ( ciu ) H f , then e Γ0 V f . Proof. The proof goes as for Lemma 16. Since Γ is inductive, it is su cient to prove that for any n ≥ 0 we have:

Λ e ciu f =⇒ e n Γ0 V f .
The case for n = 0 is trivial, as Γ is inductive. For the inductive step, we proceed by case analysis on e.

• If e is of the form return , then Λ return ( ciu ) H f must be the conclusion of a derivation of the form:

v ( ciu ) H Λ return ciu f Λ return ( ciu ) H f (H-val)
In particular, by condition (rel unit), v ( ciu ) H implies η( ) Γ( ciu V ) H η( ), and thus η( ) Γ0 V η( ). Since Λ return ciu f , we have

return = η( ) Γ0 V η( ) = return Γ0 V f ,
from which we conclude the desired thesis.

• If e = (λx.e ) , then Λ (λx.e ) ( ciu ) H f must be the conclusion of a derivation of the form:

x

Λ e ( ciu ) H v λx. ciu u v λx.e ( ciu ) H u (H-abs) v ( ciu ) H Λ u ciu f Λ (λx.e ) ( ciu ) H f (H-app)
From x Λ e ( ciu ) H and v ( ciu ) H , by substitutivity, we infer Λ e [x := ] ( ciu ) H [x := ], and thus e [x := ] n Γ0 V [x := ] . We now reason as follows. First of all we observe that we have the following closure properties for ciu .

∀ , . v ciu =⇒ Λ return ciu return ∀ , . v ciu =⇒ ∀w ∈ V • . Λ let x = (return ) in (xw ) ciu let x = (return ) in (xw ).
In fact, the rst implication follows by (ciu 3) taking the open computation x Λ return x, whereas the second implication follows from the rst one and property (ciu 3) taking the open computation Λ let x = in xw. As a consequence, we have:

v λx. ciu u =⇒ Λ let = (return λx. ) in ( ) ciu let = (return u) in ( ) =⇒ Λ let = (return λx. ) in ( ) Γ0 V let = (return u) in ( ) [By (ciu 1)] =⇒ [x := ] Γ0 V u =⇒ e [x := ] n Γ0 V u [Since e [x := ] n Γ0 V [x := ] ] =⇒ e [x := ] n Γ0 V f [Since Λ u ciu f ].
We are done since (λx.e ) ) n+1 = e [x := ] n .

• If e = (let x = in ), then the thesis directly follows from condition (rel bind) as in Lemma 16. In fact Λ let x = in ( ciu ) H f must be the conclusion of a derivation of the form:

Λ ( ciu ) H h x Λ ( ciu ) H h Λ let x = h in h ciu f Λ let x = in ( ciu ) H f (H-let)
By induction hypothesis, from Λ ( ciu ) H h we infer n Γ0 V h . Moreover, using substitutivity of ( ciu ) H and the induction hypothesis, we see that x Λ ( ciu ) H h implies:

∀ , ∈ V • . v ( ciu ) H =⇒ [x := ] n Γ0 V h [x := ] .
By condition (rel bind) we thus conclude

let x = in n+1 = [x := -] † n n Γ0 V h [x := -] † h = let x = h in h
and thus the wished thesis, since let x = h in h ciu f .

• If e = op(p, x. ), then Λ op(p, ) ( ciu ) H f must be the conclusion of a derivation of the form:

x Λ ( ciu ) H Λ op(p, x. ) ciu f Λ op(p, x. ) ( ciu ) H f (H-op)
We have:

x Λ ( ciu ) H =⇒ ∀ ∈ V • . Λ [x := ] ( ciu ) H [x := ]
[By substitutivity and re exivity of Chapter 6

( ciu ) H ] =⇒ ∀ ∈ V • . [x := ] n Γ0 V [x := ] [By induction hypothesis] =⇒ op (p, → [x := ] n ) Γ0 V op (p, → [x := ] ) [By (Σ comp)] =⇒ op(p, x. ) n+1 Γ0 V op(p, x. ) =⇒ op(p, x. ) n+1 Γ0 V f [Since Λ op(p, x. ) ciu f ] Theorem 6. (

Monadic Applicative Similarity and Bisimilarity

Language is the house of the truth of Being.

Martin Heidegger, Letter on Humanism

In Chapter 5 we have de ned e ectful applicative similarity and bisimilarity for Λ Σ , a call-by-value calculus with algebraic e ects. It is not hard to see that the theory developed there can be rephrased in a call-by-name setting with minimal e orts. Theorem 4 and Theorem 5 show that e ectful applicative similarity and bisimilarity are sound proof techniques for e ectful contextual approximation and equivalence, respectively, although they are not fully abstract. For instance, when instantiated with the nondeterministic monad FM, e ectful applicative similarity can be shown to be strictly ner than contextual approximation (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF].

In a call-by-name setting similar results hold. However, due to the simpler nature of call-by-name calculi, whose programs can only test their inputs in functional position, it is possible to characterise e ectful contextual equivalence and approximation coinductively using a notion of e ectful applicativelike (bi)similarity. The de nition and analysis of such a notion of (bi)similarity, which we call monadic applicative (bi)similarity, constitute the main subject of this chapter.

Monadic applicative (bi)similarity builds on the idea of de ning program equivalences not (directly) on programs, but on their semantics (i.e. on monadic values), which is something simply unsound in a call-by-value setting, as we will see. This way, the interaction between a program and the environment can be modeled by an ordinary, deterministic, transition system and, with minimal side conditions, the resulting notion of (bi)similarity can be proved to be sound and fully abstract with respect to contextual approximation and equivalence.

Before entering technicalities, we outline the main ideas behind this chapter by means of a semiformal discussion. Before that, however, it is convenient to introduce the calculus used in this chapter in full generality.

A Computational Call-by-name Calculus

First of all we notice that in a call-by-name setting, the distinction between values and computations has a minimal importance. For that reason we will work with the coarse-grain version of Λ Σ , denoted by Λ (n) Σ , whose syntax is de ned by the following grammar:

, w ::= x | λx.e e, f ::= | e f | op(p, x.e) All syntactical and notational conventions are the same given for Λ Σ1 , with the exception that in Λ (n) Σ we allow the substitution of a (generic) term inside another (generic) term: we write f [x := e] for the term obtained by simultaneous substitution of all free occurrences of x in f with e. Since in this chapter we will work with Λ (n) Σ only, for readability we will omit superscripts, and simply refer to it as Λ Σ . Operational semantics of Λ Σ is de ned with respect to a Σ-continuous monad T = T , η, - † which, from now on, we assume to be xed. Additionally, it is convenient to de ne the operational semantics of Λ Σ relying on Felleisen's notion of a call-by-name evaluation context [START_REF] Felleisen | The revised report on the syntactic theories of sequential control and state[END_REF]. Callby-name evaluation contexts are terms with a single hole [-] de ned by the following grammar, where e is a closed term:

E, F ::= [-] | Ee.
We write E[e] for the term obtained by substituting the term e for the hole [-] in E. Notice that a callby-name evaluation context (evaluation context, hereafter) is just an expression of the form

[-]e 1 • • • e n .
Redexes are expressions of the form (λx.f )e or op(p, x.e), the former producing a computation step, the latter producing the e ect described by the operation op. We notice that any term is either a value or an expression of the form E[r ], for a redex r . More explicitly, any term e is either a value or can be uniquely decomposed as either E[(λx.f )e] or E[op(p, x.e)] (see also Lemma 25 and Lemma 29).

As usual, operational semantics is de ned by means of an evaluation function -: The sequence ( e n ) n forms an ω-chain in T V • , so that we can de ne e as n e n .

Λ • → T V • mapping each closed term e ∈ Λ •
As usual, monotonicity and continuity of operations op and Kleisli extension ensure the evaluation function of De nition 38 to be the least map φ : Λ • → T V • such that the following identities:

φ( ) = η( ) φ(E[(λx.e) f ]) = φ(E[e[f := x]]) φ(E[op(p, x.e)) op (p, → φ(E[e[x := ]])).
Finally, we observe that we can rephrase the notion of an e ectful applicative (bi)simulation to the call-by-name setting. Even if we do not syntactically distinguish between values and computations, it is still useful to work with (closed) λ-term relations.

De nition 39. A closed λ-term relation R = (R Λ , R V ) is an e ectful applicative simulation with respect to a relator Γ for T (applicative simulation, for short) if:

e R Λ f =⇒ e ΓR V f R V w =⇒ ∀e ∈ Λ • . e R Λ we.
Notice that we do not require R V ⊆ R Λ . However, by condition (rel unit) we can assume that to be the case without loss of generality. In fact, any applicative simulation R = (R Λ , R V ) can be extended to (R Λ ∪R V , R V ), and the latter is still an applicative simulation (notice that R V implies η( ) ΓR V η( ), by condition (rel unit)).

The notions of e ectful applicative bisimulation, e ectful applicative similarity, and e ectful applicative bisimilarity are de ned building on De nition 39 as in Chapter 5. In particular, we denote e ectful applicative similarity and e ectful applicative bisimilarity by A and A , respectively.

Lift Transition Systems, Not Relations

To illustrate the rationale behind monadic applicative (bi)similarity, we rst of all give a more explicit characterisation of e ectful contextual equivalence and approximation. In fact, although in Chapter 5 we gave an elegant de nition of e ectful contextual approximation and equivalence (with respect to a relator Γ), here it is convenient to be a bit sloppy. We notice that, intuitively, e contextually approximates f if and only for any context

C, C[e] Γ0 V C[f ] .
Here a context is a syntax tree with a unique hole de ned by the following grammar:

C ::= [-] | λx.C | eC | Ce | op(p, x.C).
As usual, we write C[e] for the term obtained by the replacing the hole [-] with e in C. We say that a context C closes e, if C[e] is a closed term. We denote by Cl(e) the collection of context that closes e.

Remark 10. Contrary to terms, contexts cannot be identi ed modulo renaming of bound variables. In fact, given a context C, free variables of a term e may become bound in C[e] (e.g. consider the context λx.

[-] and the term x). Equating contexts that di er only for the name of their bound variables can lead to undesired behaviours. For instance, the two contexts λx.[-] and λ .[-] are equal modulo renaming of bound variables, but give di erent terms when lled in with e.g. the term x.

As a consequence, working with contexts usually involves to deal with a lot of 'syntactic bureaucracy', which is the reason why in Chapter 5 we gave a 'context-free' de nition of contextual equivalence and approximation. The reader can refer to (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Pitts | Howe's method for higher-order languages[END_REF] for further details.

We can then rephrase the notion of e ectful contextual approximation ctx with respect to a relator Γ as follows:

e ctx f ⇐⇒ ∀C ∈ Cl(e) ∩ Cl( f ). C[e] Γ0 V C[f ] .
It is straightforward to see that by slightly modifying proofs of Chapter 5 we can prove soundness of (the open extension of) A and A with respect to ctx and ctx (the latter being de ned as ctx ∩ ( ctx ) • ), respectively. That is, we have the inclusions:

( A ) o ⊆ ctx ( A ) o ⊆ ctx .
Moreover, the inclusion is strict. To see that let us consider the calculus Λ FM . It is not hard to convince ourselves that all terms of the form e λx.( f or ) and e (λx.f )or(λx. ) are contextually equivalent.

An informal argument for their equivalence is the following (a formal proof of their equivalence will be given later in full generality). Since in call-by-name calculi terms can only be tested in functional position, any context C will either not test e and e at all, so that trivially no operational di erence between C[e] and C[e ] will be detected, or it will test them in functional position. That means that the evaluation of C[e] and C[e ] will reach a state in which the terms e and e have to be evaluated. Here and are terms produced during the evaluation of C[e] and C[e ] that may 'contain' other occurrences of e, e , respectively. In particular, we see that the only way for C to test e and e is to test them against arbitrary input arguments. We thus reach the following conclusion: testing a program e in a context C is equivalent to testing e in functional position against nite sequences of inputs. This is nothing but the call-by-name version of the CIU Theorem in Section 5.5, which we can state as follows.

Theorem 7 (CIU). The following hold for all closed terms e, f :

e ctx f ⇐⇒ ∀ 1 , . . . , n . e 1 • • • n Γ0 V f 1 • • • n .
Notice that Theorem 7 states that ctx (and thus and ctx ) is a form of trace approximation, and thus it is intrinsically deterministic. Using Theorem 7 we can now easily show that the terms e ans e are indeed contextually equivalent. This comes with no surprise: contextual equivalence being a form of trace equivalence it is not sensitive to 'branching behaviours', and thus by no means it can tell e and e apart. This is not the case for applicative bisimilarity which, instead, is sensitive to forms of branching. From a bisimulation perspective, the di erence between e and e is clear: e postpones the nondeterministic choice to the moment it receives an input, whereas e rst makes the choice, and then waits to receive an input. Accordingly, it is su cient to instantiate2 e as x ΩI and e as xI Ω to observe that e and e cannot be applicatively bisimilar. In fact, the reader might have recognised that e and e are nothing more than the encoding in Λ FM of the labelled transition systems below, which are standard examples in concurrency theory to show that bisimilarity is strictly ner than trace equivalence.

• a • b z z b $ $ • • • a z z a $ $ • b • b • •
Summing up, we observed that in a nondeterministic setting, applicative similarity is sensitive to branching, whereas contextual approximation is not. This is because, in full generality, contextual approximation is a form of trace approximation, and thus intrinsically deterministic. This last observation suggests an easy way to make applicative similarity fully abstract with respect to contextual approximation, namely to determinise our notion of e ectful applicative similarity.

Recall that in Chapter 2 we argued the the operational semantics of Λ p induces a 'kind of' Markov chain. With a similar analogy, we can claim that the operational semantics of Λ FM induces a 'kind of' transition system with divergence, where a labelled transition system with divergence consists of a set X (the state space) together with a transition function c : X → (F MX ) A (the set A being the set of labels or actions).

There are at least two natural notions of approximation for such systems. The rst one is given by 'Milner style' similarity [START_REF] Milner | Communication and concurrency[END_REF][START_REF] Park | Concurrency and automata on in nite sequences[END_REF], and can be de ned using a suitable variation of the relator FM. The second one is given by trace approximation, and can be elegantly de ned using the so-called powerset construction from automata theory3 [START_REF] Rabin | Finite automata and their decision problems[END_REF]. Roughly speaking, the powerset construction lifts a transition system c : X → (F MX ) A to a deterministic transition system c : F MX → (F MX ) A , whose state space is now (morally) given by sets of elements of the original state space. Writing Y for F MX , we see that c : Y → Y A is a deterministic labelled transition system, on which a notion of similarity can be easily de ned. Remarkably, similarity in c : Y → Y A coincides with trace approximation in c : X → (F MX ) A .

Taking inspiration from the powerset construction we aim to de ne notions of applicative similarity and bisimilarity on monadic values, rather than on terms, so to obtain a coinductive characterisation of contextual approximation and equivalence. Remark 11 (The labelled transition system of λ-terms). We already claim twice that the operational semantics of the calculi considered so far induce 'kind of' transition systems. We now make such intuition a formal observation, de ning the labelled transition system (lts, hereafter) of λ-terms. Although we will not work with the lts of λ-term explicitly, the reader might nd such a notion useful for intuitions and informal arguments.

The lts of λ-terms is a generalisation of Abramsky's applicative transition systems (Abramsky, 1990a), and it is de ned as the pair eval :

Λ • → T V • , apply : V • → (Λ • ) Λ • ,
where the evaluation function eval and the application function apply are de ned as:

eval(e) e apply( , e) e.

Looking at the lts of λ-terms we see how the key ingredient to de ne the notion of an e ectful applicative (bi)simulation is a notion of lifting (a relator) that allows to lift relations over values to relations over monadic values. In fact, using the lts of λ-terms we see that the proof obligations of De nition 39 can be expressed by the following lax commutative diagrams (the right hand side diagrams is actually a family of diagrams, as e ranges over arbitrary closed terms):

Λ • ⊆ eval / / R Λ _ T V • Γ R V _ Λ • eval / / T V • V • ⊆ apply(-,e ) / / R V _ Λ • R Λ _ V • apply(-,e )
/ / Λ • However, the lts of λ-terms also suggests another route to de ne notions of program equivalence and approximation. Instead of focusing on lifting relations, we can use the strong monad structure of T to lift the whole lts to eval :

T Λ • → T V • , apply : T V • → (T Λ • ) Λ • where eval eval † apply curry(η Λ • • uncurry(apply)) * .
Using the new lts we can de ne monadic applicative simulation as a pair of relations (R :

T Λ • + → T Λ • , S : T V • + → T V • ) such that: E R F =⇒ eval (E ) Γ0 V eval (F ) V S W =⇒ ∀e ∈ Λ • . apply (V , e) R apply (W , e).
As usual, we de ne monadic applicative similarity as the largest applicative simulation. We will explain the rationale behind monadic applicative similarity in the next section. For now, it is su cient to observe that although coinductively de ned, this new notion of applicative similarity is a trace-like approximation.

Monadic Applicative Similarity and Bisimilarity

In this section we de ne the core notions of this chapter, namely the notions of a monadic applicative simulation and bisimulation. We start by noticing that in previous section, oftentimes we compared programs using the relation Γ0 V . In Chapter 5 we proved such a relation to induce an interesting adequacy predicate, as it captures the idea of ground observation indistinguishability. For instance, we see that e ( DM ∧ DM • )0 V f holds if and only if e and f have the same probability of convergence. As a consequence, if we let our ground observation to be the probability of convergence of a program, then e ( DM ∧ DM • )0 V f states exactly that no ground observation can distinguish e and f . The drawback of this approach is that the notion of ground observation remains implicit. Even if it is possible to develop the theory of monadic applicative (bi)similarity using the relation Γ0 V only, it is useful and instructive to introduce an explicit notion of ground observation, and to work with the latter.

Intuitively, a ground observation is a function that takes a monadic value (representing the result of an e ectful computation) and returns what is observable of it. Following standard practice, we assume that the observable part of a computation consists of the side e ects happened during such a computation only. As a consequence, the observable part of a computation is uniquely determined by the semantics of the (algebraic) operations involved.

De nition 40. Let 1 = { * } be the one element set and ! X : X → 1 be the unique function mapping each element in X to * . De ne the observation function obs : T V • → T 1 as T (! V • ). Observations trivially extends to terms by de ning obs (e) obs ( e ).

We can immediately prove basic algebraic properties of the observation function.

Lemma 21. The following identities hold for any closed value and ω-chain

(v n ) n in T V • . obs (⊥) = ⊥ 1 obs (η V • ( )) = η 1 ( * ) obs ( op V • (p, κ)) = op 1 (p, obs • κ) obs ( n <ω v n ) = n <ω obs (v n ).
Proof. We rst observe that by very de nition of monad we have obs = (η 1 • !) † . As a consequence, we can rely both on strictness and continuity of - † to prove the rst and last identities above. The second identity can be easily proved using standard monad equalities, whereas the third identity one is a direct consequence of algebraicity of operation symbols.

Remark 12. Notice that the function obs is uniquely determined by the signature Σ. This is because of our choice of not distinguishing between values. Nevertheless, it is easy to see that our de nition of obs can be extended to any function γ : V • → O, where O represents a set of observables and γ encodes a ground observation on values. In fact, we would just de ne obs as η • γ .

The following result links the map obs with the relation Γ0 V . Intuitively, it states that depending on whether we are dealing with relators for simulation or bisimulation, if e and f are related by Γ0 V , i.e. e Γ0 V f holds, then either the ground observation of f re nes the ground observation of e, or e and f have the same ground observation.

Lemma 22. We say that a relator Γ for a functor T is at if Γ satis es (rel funct 1)4 , and that a relator is quasi-at if ΓI X = X (recall that X is an ω-pointed complete partial order on T X ). The following hold:

1. If Γ is at, then Γ0 V = obs • • I T 1 • obs. 2. If Γ is quasi-at, then Γ0 V = obs • • 1 •obs.
Proof. Suppose Γ to be at. Then calculate:

obs • • •obs = (T ! V • ) • • ΓI 1 • T ! V • [By (rel funct 1)] = Γ(! • V • • I 1 •! V • ) [By (stability)] = Γ 0 V . Similarly, we see that if Γ is quasi-at, then Γ0 V = obs • • 1 •obs.
Finally, we notice that most of the relators of the form T ∧ T• in Section 4.3 are at, and that most of the relators of the form T in Section 4.3 are quasi-at. In fact, it is easy to see that since

X ∩ • X = I T X , if Γ is quasi-at, then Γ ∧ Γ • is at.
From now on we assume relators to be quasi-at. This is a convenient assumption, as otherwise the following notions of contextual approximation and equivalence would be di erent than the one de ned in terms of relators. In fact, we rephrase the notions of contextual equivalence and approximation in terms of obs, as well as the notion of e ectful CIU equivalence and approximation, as follows.

De nition 41. Contextual approximation ctx : Λ + → Λ is de ned as follows:

e ctx f ⇐⇒ ∀C ∈ Cl(e) ∩ Cl( f ). obs (C[e]) obs (C[f ]).
CIU approximation ciu : Λ • + → Λ • is de ned as follows, where e, f are closed terms:

e ciu f ⇐⇒ ∀E. obs (E[e]) obs (E[f ]).
As usual, we de ne contextual ctx and CIU equivalence ciu as ctx ∩ ( ctx ) • and ciu ∩ ( ciu ) • , respectively.

Finally, we de ne monadic applicative simulation and monadic applicative bisimulation. These are relations over monadic values that test the latter applicatively. In order for that to make sense, we have to lift the notion of application from terms to monadic values.

De nition 42. For

v ∈ T V • and e ∈ Λ • de ne the monadic application v * e ∈ T V • of e to v as v * e ( → f ) † (v).
We immediately notice that e f = e * f and that straightforward calculations give the following identities:

⊥ * e = ⊥; η(λx.f ) * e = f [e := x] ; op (p, κ) * e = op (p, i → κ (i) * e).

De nition 43. A relation

R : T V • + → T V • is a monadic applicative simulation (monadic simulation, hereafter) if v R w =⇒ obs (v) obs (w) ∧ ∀e ∈ Λ • . v * e R w * e.
Monadic applicative similarity (monadic similarity, hereafter) M is de ned as the largest monadic simulation. We say that f is monadic similar to e, and write e M f , if e M f .

In particular, De nition 43 induced a monotone endofunction R → [R] (monotonicity being a consequence of monotonicity of obs) on the complete lattice Rel(T V • ,T V • ) such that R is a monadic simulation if and only if R ⊆ [R]. As a consequence, we can de ne monadic applicative similarity as the greatest xed point of R → [R]. As usual, M comes with as associated coinduction proof principle:

R ⊆ M R ⊆ [R] ( M -coind.)
Using the coinduction proof principle of monadic similarity we can prove M to be preorder.

Proposition 18. Monadic similarity is re exive and transitive.

Proof. The proof is by coinduction. First we notice that I T V • is a monadic simulation. Secondly, we observe that if R and S are applicative simulation, then so is S • R (from which follows M • M ⊆ M ).

In fact, if both v R w and w S u hold, then we have obs (v) obs (u), as is transitive. Moreover, since R and S are simulation, for any closed term e we have v * e R w * e and w * e S u * e, and thus v * e (S • R) u * e.

We also notice that monadic similarity is deterministic, so that we can de ne monadic applicative bisimilarity (monadic bisimilarity, hereafter) as M ∩ ( M ) • . Since we have ciu = ciu ∩ ( ciu ) • and ctx = ctx ∩ ( ctx ) • , our metatheoretical results on program re nement will straightforwardly generalises to the associated notions of program equivalence. Additionally, as a further consequence of determinism, we see that monadic similarity is a trace-like approximation, and that it actually coincides with CIU approximation.

Proposition 19. Monadic similarity M coincides with CIU approximation ciu .

Proof. We rst prove M ⊆ ciu . We notice that by very de nition of monadic simulation, e M f implies The case for n ≥ 1 is trivial. Suppose n = 0, so that we have to show obs (op(p, x.λ .e)) = obs (λ .op(p, x.e)). We calculate:

obs (op(p, x.λ .e)) = obs ( op V • (p, → λ .e[x := ] )) = op 1 (p, → obs (η(λ .e[x := ]))) = op 1 (p, → η( * )) = η( * )
= obs (λ .op(p, x.e)).

The condition op 1 (p, i → η( * )) = η( * ) holds both for the partial nondeterministic monad FM (with signature Σ FM ) and the partial distribution monad DM (with signature Σ DM ), but fails, for instance, for the output monad O ∞ (with signature Σ O ∞ ).

Full Abstraction

In this section we prove a CIU theorem (cf. Theorem 8) stating that ciu coincides with ctx . In virtue of Proposition 19, we will also obtain full abstraction of M with respect to ctx . Our proof of Theorem 8 follows [START_REF] Pitts | Howe's method for higher-order languages[END_REF] and employs a variation of Howe's technique as de ned in Chapter 5. First of all, we adapt the notion of Howe extension of a λ-term relation de ned in Chapter 5 to Λ (n) Σ . In order to deal with evaluation contexts, we also de ne a suitable extension R E of a λ-term relation R to closed evaluation contexts (i.e. evaluation contexts built using closed terms only). We observe that if R is a re exive λ-term relation, then R E nicely interacts with R H , in the sense that the following holds (the proof is a straightforward induction on the derivation of E R E E ):

Γ, x e R H Γ op(p, x. ) R f Γ op(p, x.e) R H f (H-op) [-] R E [-] (E-nil) e R H e E R E E Ee R E E e (E-app)
E R E E Γ e R H e Γ E[e] R H E [E ]
Moreover, it is a straightforward exercise to show that the analogous of Lemma 15 holds in the context of Λ (n) Σ . In particular, ciu being a preorder we see that ( ciu ) H is compatible, substitutive (obviously ( ciu ) o is value substitutive), and contains ( ciu ) o .

The main technical part of our variation of the Howe's method is Lemma 24, which is nothing but a suitable variation of Lemma 20 of Chapter 5. In order to prove it, it is useful to rst prove the following auxiliary result.

Lemma 23. If E[e] ( ciu ) H , then there exist an evaluation context F and a term f such that E ( ciu ) E F , e ( ciu ) H f , and

F [f ] ciu .
Proof. We proceed by induction on E. If E = [-], then we take F [-] and f . The thesis follows since ciu is re exive. If E is of the form E e , then E [e]e ( ciu ) H must be the conclusion of an instance of rule (H-app), i.e. of a derivation of the form Proof. Since obs is continuous to prove the thesis it is su cient to prove:

E [e] ( ciu ) H c e ( ciu ) H f c f ciu E [e]
∀n ≥ 0. obs ( E[e] n ) obs ( F [f ] ).
We proceed by induction on n. The case for n = 0 is trivial. Let n > 0 and suppose the thesis holds for all m < n. We proceed by case analysis on the form of e.

• Suppose e to be a value λx.e . Then e ( ciu ) H f must be the conclusion of an derivation of the form x e ( ciu ) H c λx.c ciu f λx.e ( ciu ) H f (H-abs)

We now make a further case analysis on the shape of E. If E = [-], then, since E ( ciu ) E F , we must have F = [-] too. Therefore, since λx.c ciu f (meaning that obs ( λx.c ) obs ( f )), we have:

obs ( e n ) = obs (η(λx.e )) = η 1 ( * ) = obs ( λx.c ) obs ( f ).
Suppose now E to be of the form [-] , for some terms , . Since E ( ciu ) E F , there exists terms h, h such that F = [-]h h, ( ciu ) H h, and ( ciu ) H h. Moreover, we have:

E[e] n = (λx.e) n = e [x := ] n-1 .
By substitutivity of ( ciu ) H , x e ( ciu ) H c and

( ciu ) H h imply e [x := ] ( ciu ) H c[x := h],
and thus e [x := ] ( ciu ) H c[x := h] h, since ( ciu ) H is compatible and ( ciu ) H h. We obtain the wished thesis as follows:

obs ( E[e] n ) = obs ( e [x := ] n-1 ) obs ( c[x := h] h ) [By induction hypothesis] = obs ( F [λx.c] ) obs ( F [f ] ). [Since λx.c ciu f ]
• Suppose e to be of the form E [(λx.e )c], so that we have E [(λx.e )c] ( ciu ) H f . By Lemma 23 there exists an evaluation context F and a term f such that E ( ciu ) E F , (λx.e )c ( ciu ) H f , and F [f ] ciu f . In particular, (λx.e )c ( ciu ) H f must be the conclusion of a derivation of the form:

x e

( ciu ) H h λx.h ciu λx.e ( ciu ) H (H-abs) c ( ciu ) H ciu f (λx.e )c ( ciu ) H f (H-app)
In particular, we now have the following CIU-approximations:

λx.h ciu (6.1) ciu f (6.2) F [f ] ciu f . (6.3)
From x e ( ciu ) H h and c ( ciu ) H , by substitutivity, we obtain e

[x := c] ( ciu ) H h[x := ], whereas from E ( ciu ) E F and E ( ciu ) E F we infer E[E [-]] ( ciu ) E F [F [-]].
Denoting by G and G the evaluation contexts E[E [-]] and F [F [-]], respectively, we see that we thus have:

G[e [x := c]] ( ciu ) H G [h[x := ]]. (6.4)
We obtain the wished thesis as follows:

obs ( E[e] n ) = obs ( G[(λx.e )c] n ) = obs ( G[e [x := c]] n-1 ) obs ( G [h[x := ]] )
[By (6.4) and the induction hypothesis] = obs ( G [(λx.h) ] )

obs ( G [ ]) [By (6.1)] obs ( G [f ] ) [By (6.2)] = obs ( F [F [f ]] ) obs ( F [f ] )
[By (6.3)]

• Suppose e to be of the form E [op(p, x.e )], so that we have E [op(p, x.e )] ( ciu ) H f . We proceed exactly as in previous case. By Lemma 23 there exists an evaluation context F and a term f such that E ( ciu ) E F , op(p, x.e ) ( ciu ) H f , and F [f ] ciu f . In particular, op(p, x.e ) ( ciu ) H f must be the conclusion of a derivation of the form:

x e ( ciu ) H c op(p, x.c) ciu f op(p, x.e ) ( ciu ) H f (H-op)
We thus have the following CIU-approximations:

op(p, x.c) ciu f (6.5) F [f ] ciu f . (6.6)
From x e ( ciu ) H c, by substitutivity, we obtain e [x := ] ( ciu ) H c[x := ], for any closed value , whereas from

E ( ciu ) E F and E ( ciu ) E F we infer E[E [-]] ( ciu ) E F [F [-]]. Denoting by G and G the evaluation contexts E[E [-]] and F [F [-]]
, respectively, we see that we have:

G[e [x := ]] ( ciu ) H G [c[x := ]]. (6.7)
We obtain the wished thesis as follows:

obs ( E[e] n ) = obs ( G[op(p, x.e )] n ) = obs ( op V • (p, → G[e [x := ]] n-1 ) = op 1 (p, → obs ( G[e [x := ]] n-1 )) [By Lemma 21] op 1 (p, → obs ( G [c[x := ]] ))
[By (6.7) and induction hypothesis]

= obs ( op V • (p, → G [c[x := ]] )) [By Lemma 21] = obs ( G [op(p, x.c)] ) obs ( G [f ] ) [By (6.5)] = obs ( F [F [f ]] ) obs ( F [f ] ).
[By (6.6)] An immediate consequence of Lemma 24 is compatibility of ciu and thus its equivalence with ctx .

Theorem 8 (CIU equivalence). CIU approximation ciu is compatible and thus coincide with ctx .

Proof. We know by very de nition of Howe extension that ( ciu ) H is compatible. Therefore, to prove compatibility of ciu it is su cient to show that the open extension of ciu coincides with ( ciu ) H . As usual, that follows if the closed restriction of ( ciu ) H is included in ciu . That is, if for all closed terms e, f :

e ( ciu ) H f =⇒ ∀E. obs (E[e]) obs (E[f ]).
The latter is direct consequence of Lemma 24, since E ( ciu ) E E always holds. Finally, we observe that, as in Lemma 19, we can show that ctx is included in the open extension ciu , and thus conclude

( ciu ) o = ctx .
In virtue of Corollary 3 we obtain full abstraction of (the open extension of) M with respect to ctx .

Corollary 4 (Full abstraction 1). The open extension of monadic applicative similarity M is fully abstract with respect to ctx .

Finally, since M = M ∩ ( M ) • , ciu = ciu ∩ ( ciu ) • , and ctx = ctx ∩ ( ctx ) • , we see that Theorem 8 and Corollary 4 give the following full abstraction result.

Corollary 5 (Full abstraction 2). The open extension of monadic applicative bisimilarity M coincides with the open extension of CIU equivalence ciu which coincides with contextual equivalence ctx .

We conclude this chapter stressing that at the hearth of full abstraction of M and M is the simpler nature of call-by-name calculi compared to call-by-value calculi. In the latter, a context can test its input both in functional and argument position, thus obtaining a stronger testing power than call-by-name contexts, where, instead, terms can only be tested in functional position. For instance, the call-by-value context (λx.C) [-] forces the evaluation of its input, and then pass the result obtained to C. This is indeed the reason why monadic applicative (bi)similarity works for call-by-name calculi only. In fact, extending monadic applicative bisimilarity to the call-by-value case (which is straightforward) would be simply unsound. For instance, the call-by-value probabilistic terms λx.(x orΩ), (λx.x )or(λx.Ω) are not contextually equivalent, as witnessed by the context (λx.x (x (λ . ))) [-]. However, we see that obs (λx.(x or Ω)) = obs ((λx.x ) or (λx.Ω)) and that

λx.(x or Ω) * = (1 • just (λx.(x or Ω))) * = 1 2 • just + 1 2 • ⊥ (λx.x ) or (λx.Ω) * = 1 2 • just (λx.x ) + 1 2 • just (λx.Ω) * = 1 2 • just + 1 2
• ⊥, meaning that λx.(x or Ω) M (λx.x ) or (λx.Ω).

Having studied applicative notions of program approximation and equivalence, in the next chapter we apply our framework to design more intensional notions of re nement and equivalence, which we call e ectful normal form similarity and e ectful normal form bisimilarity.

Chapter 7

Normal Form Similarity and Bisimilarity

The world is my world: this is manifest in the fact that the limits of language (of that language which alone I understand) mean the limits of my world

Ludwig Wittgenstein, Tractatus

Logico-Philosophicus

The notion of an applicative (bi)simulation is rooted in the idea that programs should be compared extensionally, i.e. according to their input-output behaviour. This is re ected in the (bi)simulation clause for values: if R is an applicative (bi)simulation and v R w holds, then so does Λ u R wu, for any closed value u. Since , w are closed values, they must be λ-abstractions, i.e. terms of the form λx.e, λx.f , respectively. Instead of testing and w extensionally, one could test them intensionally, looking at the open subterms e and f . The notion of equivalence and re nement obtained in this way, are called normal form (bi)similarity (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Lassen | Eager normal form bisimulation[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF].

Starting from the pioneering work by Böhm, the notion of a Böhm tree [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF], and the associated notion of Böhm tree equality, has been proved extremely useful in reasoning about program behaviour. Roughly speaking, the Böhm tree BT (e) of a λ-term e is a possibly in nite tree representing the in nitary head-normal form of e. The celebrated Böhm Theorem, also known as Separation Theorem [START_REF] Böhm | Alcune proprietà delle forme βη-normali del λk-calcolo[END_REF], stipulates that two terms are contextually equivalent if and only if their respective (appropriately η-equated) Böhm trees are the same.

Böhm Trees can also be de ned when terms are not evaluated to their head normal form, like in the classic theory of λ-calculus, but to their weak-head normal form (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF], or to their eager normal form (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF]. In both cases, satisfactory notions of program equivalence can be given, although tree equivalence turns out not to coincide with context equivalence (full abstraction can be recovered if the discriminating power of contexts is somehow increased, e.g. through concurrency features [START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF], or when the whole calculus is more expressive, e.g. by adding control and states [START_REF] Støvring | A complete, co-inductive syntactic theory of sequential control and state[END_REF]). Due to the in nitary nature of these 'normal form trees', tree-like equivalences can be expressed in a pure coinductive way, without any reference to trees, as rst shown in [START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario (extended abstract)[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF]. For that reason people often refer to them normal-form bisimilarity relations.

Contrary to applicative bisimilarity, contextual equivalence, and logical relations, normal form bisimilarity is completely independent on how the environment behaves, and focus on the syntactical structure of the terms at hand. That is, when checking whether two terms e and f are normal form bisimilar, only the syntactic structure of e and f is inspected. This is radically di erent from what happens for e.g. applicative bisimilarity where in order to see whether e and f are applicatively bisimilar we have to test them against arbitrary 'external' input values.

In this chapter we de ne e ectful normal form similarity and bisimilarity for (variations of) Λ Σ , and study their main metatheoretical properties. As for applicative (bi)similarity, we will prove congruence and precongruence theorems for normal form bisimilarity and similarity, respectively. Additionally, normal form bisimilarity allows for the of so-called up-to enhancements of the bisimulation method [START_REF] Pous | Enhancements of the bisimulation proof method[END_REF].

Remarkably, the very same notions of Σ-continuous monad and Σ-continuous relator that we used in Chapter 5 to prove (pre)congruence of e ectful applicative (bi)similarity, guarantee similar results for normal form (bi)similarity. As usual, we begin our analysis with some informal considerations on the nature of the notions we aim to investigate.

From Applicative to Normal Form Bisimulation

In this section we informally introduce normal form bisimulation by studying some examples of (pairs of) programs whose equivalence cannot be readily established using the techniques developed in previous chapters, but that can be easily proved to be normal form bisimilar (and thus contextually equivalent). This gives evidence on the exibility and strength of the proposed technique. We will focus on examples drawn from xed point theory, simply because these, being in nitary in nature, are quite hard to be dealt with with " nitary" techniques like contextual equivalence. For simplicity, our examples are given in coarse-grain style. It is well known that Y and Z are contextually equivalent, and thus applicatively bisimilar (recall that in the pure untyped λ-calculus applicative bisimilarity and contextual equivalence coincide). However, proving Y and Z to be applicatively bisimilar is almost as hard as proving them to be contextually equivalent from rst principles. In fact, as already remarked in previous chapters, applicative bisimilarity is an extensional notion of program equivalence, as it tests programs for their input-output behaviour. This is re ected by its proof obligation, which is based on a universal quanti cation on function arguments. A major drawback of extensionality is that proving Y A Z turns out to be extremely di cult.

To have a taste of that, let us try to construct an applicative bisimulation relating Y and Z . Let R = (R Λ , R V ) be our candidate relation. Clearly we need to have (Y , Z ) ∈ R Λ . Since Y = just (λ .∆∆) and Z = just (λ . (λz.ΘΘ z)), in order for R to be an applicative bisimulation, we need

∆[ := ]∆[ := ] R Λ (λz.ΘΘ z)
to hold for any value . If that is the case, then we would need At this point we are stuck, as no information is available about the term e. That is, we have no information on how e tests its input program. In particular, given any context C[-], we can consider the value λx.C[x] (so that e ≡ C[x]), meaning that satisfying the above proof obligation (which is required in order for R to be an applicative bisimulation) is morally equivalent to prove Y and Z to be contextually equivalent directly.

Example 42. Our next example is a re nement of Example 41 to a probabilistic setting, as proposed in [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higher-order languages[END_REF] (although there it is formulated in its, slightly simpler, call-by-name version). We consider a variation of Turing's call-by-value xed point combinator which at any iteration can probabilistically decide whether to start another iteration (following the pattern of the standard Turing xed point combinator) or to turn for good into Y , where Y and ∆ are de ned as in Example 41:

Z ΘΘ Θ λx.λ .( (λz.∆∆z) or (λz.xx z)).
It is natural to ask whether these new version of Y and Z are still equivalent. However, following insights from previous example, it is not hard to see the equivalence between Y and Z is an example of an equivalence that cannot be readily proved by means of standard operational methods such as (probabilistic) contextual equivalence, (probabilistic) CIU equivalence, and (probabilistic) applicative bisimilarity. All the aforementioned techniques require to test programs in a given environment (such as a whole context or an input argument), and are thus ine ective in handling xed point combinators such as Y and Z .

We will give an elementary proof of the equivalence between Y and Z in Example 45, and a more elegant proof relying on a suitable up-to context technique in Subsection 7.4.2. In [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higher-order languages[END_REF] the call-by-name counterparts of Y and Z are proved to be equivalent using probabilistic environmental bisimilarity [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higher-order languages[END_REF]. The notion of an environmental bisimulation [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF] involves both an environment storing pairs of terms played during the bisimulation game, and a clause universally quantifying over pairs of terms in the evaluation context closure of such an environment1 , thus making environmental bisimilarity a rather heavy technique to use. Our proof of the equivalence of Y and Z is simpler: in fact, our notion of e ectful normal form bisimulation does not involve any universal quanti cation over all possible closed function arguments (like applicative bisimilarity), or their evaluation context closure (like environmental bisimilarity), or 'closed instantiations' or 'uses' (like CIU equivalence).

Example 43. Our third example concerns call-by-name calculi and shows how our notion of normal form bisimilarity can handle even intricate recursion schemes. We consider the following argumentswitching probabilistic xed point combinators:

P AA Q BB A λx.λ .λz.( (xx z) or z(xxz )) B λx.λ .λz.( (xxz ) or z(xx z)).
We easily see that P and Q satisfy the following (informal) program equations:

Pe f = e (Pe f ) or f (P f e) Qe f = e (Q f e) or f (Qe f ).
Again, proving the equivalence between P and Q using applicative bisimilarity is problematic. In fact, testing the applicative behaviour of P and Q requires to reason about the behaviour of e.g. e (Pe f ), which in turn requires to reason about the (arbitrary) term e, of which no information is provided. The (essentially in nitary) normal forms of P and Q, however, can be proved to be essentially the same by reasoning about the syntactical structure of P and Q, as we will do in Section 7.4. Moreover, as we will see, our up-to context technique ( De nition 55) enables an elegant and concise proof of the equivalence between P and Q.

Example 44. Our last example discuss the use of the cost monad as an instrument to facilitate a more intensional analysis of programs. In fact, as already remarked in Example 24, we can use the ticking operation ti to perform cost analysis. For instance, we can consider the following variation of Curry and Turing xed point combinator of Example 41 obtained by adding the operation symbol ti after every λ-abstraction.

Y λ .ti (∆∆) Z ΘΘ ∆ λx.ti ( (λz.ti (xxz))) Θ λx.ti (λ .ti ( (λz.ti (xx z)))).
Following Example 24, we see that every time a β-redex (λx.ti (e)) is reduced, the ticking operation ti increases an imaginary cost counter of a unit. Using ticking, we can provide a more intensional analysis of the relationship between Y and Z , along the lines of Sands' improvement theory [START_REF] Sands | Improvement theory and its applications[END_REF].

Computational Calculi Revisited

Contrary to Chapter 3 and Chapter 5, here we will work with the coarse-grain version of Λ Σ , which for simplicity we keep denoting as Λ Σ . As already remarked, ne-grain calculi are in general better suited for metatheoretical purposes, but are a bit cumbersome for writing and studying examples. Given the emphasis we gave to examples and the link we will make with Böhm tree-like equalities, we prefer to work with a pure untyped λ-calculus as in e.g. [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF] enriched with algebraic operations. The syntax of the calculus is standard, and it is de ned in (operation)

Figure 7.1: Syntax of coarse-grain Λ Σ .

The operational semantics of Λ Σ is de ned as in Chapter 3, with some minor di erences. Before de ning such a semantics, we a make couple of useful remarks.

Remark 14.

1. Testing terms according to the their (possibly in nitary) normal forms obviously requires to work with open terms. Indeed, in order to inspect the intensional behaviour of a value λx.e, one has to inspect the intensional behaviour of e, which is an open term. As a consequence, contrary to all previous chapters, here we give operational semantics to both open and closed terms. Actually, the very distinction between open and closed terms is not that meaningful in this context, and thus we simply refer to terms. As a consequence, also the relational apparatus developed in Chapter 5 collapses to simple relations over terms.

2. According to point 1, we notice that values constitute a syntactic notion de ned independently of the operational semantics of the calculus: values are just variables and λ-abstractions. However, giving operational semantics to arbitrary terms (and not just closed ones) we are interested in richer collections of irreducible expressions, i.e. expressions that cannot be simpli ed any further. Such collections, whose members we call eager normal forms in a call-by-value setting, and weak head normal forms in a call-by-name setting, will be di erent accordingly to the operational semantics adopted. For instance, in a call-by-name setting it is natural to regard the term x ((λx.x ) ) as a terminal expression, whereas in a call-by-value setting x ((λx.x ) ) can be further simpli ed to x , which in turn should be regarded as a terminal expression.

Call-by-Value Operational Semantics

We begin by de ning a monadic operational semantics for Λ Σ relying on Felleisen's notion of a callby-value evaluation context [START_REF] Felleisen | The revised report on the syntactic theories of sequential control and state[END_REF]) (recall Lemma 7 and Corollary 1). Call-by-value evaluation contexts are terms with a single hole [-] de ned by the following grammar:

E ::= [-] | Ee | E.
Notice that, contrary to Chapter 3 and Chapter 6 here evaluation contexts are built using open terms. We write E[e] for the term obtained by substituting the term e for the hole [-] in E. Redexes are expressions of the form (λx.e) or op(p, x.e), the former producing a computation step, the latter producing an e ect. Following (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF] we de ne a stuck term as a term of the form E[x ]. Finally, we de ne the collection E of eager normal forms (enfs hereafter) as the collection of values and stuck terms. We let letters s, t, . . . to range over elements in E. In particular, enfs are generated by the following grammar:

s ::= x | λx.e | E[x ].
We notice that any term is either a value, a stuck term, or an expression of the form E[r ], for a redex r (cf. Lemma 7).

Lemma 25. Any term e can be uniquely decomposed in one of the following (mutually exclusive) forms:

1. ;

E[ w];

3. E[op(p, x.f )].

Proof. By induction on e we show that e can be decomposed in one of the above forms. If e is a value, then we are trivially done. If e is a term of the form f , then by induction hypothesis we have two cases to consider.

1. Suppose f is a value . We apply the induction hypothesis on . If the latter is a value w, then f = w and we are done (consider the empty evaluation context). Otherwise is a term of the form E[r ], for a redex r . We are done since f = E[r ] and E is an evaluation context.

2. Suppose f is a term of the form E[r ], for a redex r . Then f = E[r ] . We are done since E is an evaluation context.

We now prove uniqueness of such composition. This is indeed the case if e is a value. Suppose now e to be of the form E[ w] and to admit another decomposition as above. Such a decomposition cannot be a value. Say it is of the form E [ w ]. We show that then it must be the case that = , w = w , and E = E . We proceed by induction on E.

If E is the empty context, we proceed by contradiction and assume E E . Then either E = F f or E = uF , for an evaluation context F . In the former case we would have = F [ w ], which is impossible (F [ w ] cannot be a value). Similarly, in the latter case we would have w = F [ w ] which, again, is not possible. We are done. Suppose now E to be of the form F f . We immediately notice that E

[-]: for we would have F [ w] = , which is impossible. Similarly we see that E cannot be of the form uE .

We conclude E = F f . The thesis now follows by induction hypothesis. The case for E of the form uF is handled similarity.

In a similar fashion we can prove that if e = E[op(p, x.f )] and e = E [r ], then r = op(p, x.f ) and E = E .

Operational semantics of Λ Σ is de ned with respect to a Σ-continuous monad T = T , η, - † relying on Lemma 25. More precisely, we de ne a call-by-value evaluation functionmapping each term to an element in T E.

De nition 45. De ne the N-indexed family of mapsn : Λ → T E as follows:

e 0 ⊥ n+1 η( ) E[x ] n+1 η(E[x ]) E[(λx.e) ] n+1 E[e[x := ]] n E[op(p, x.e) n+1 op E (p, → E[e[x := ]] n ).
The monad T being Σ-continuous, we see that the sequence ( e n ) n forms an ω-chain in T E, so that we can de ne e as n e n .

As usual, Σ-continuity of T ensures continuity of the evaluation function.

Lemma 26. The mapis the least function φ : Λ → T E satisfying the following identities: In order to improve readability, in the rest of this chapter, for a monad T, an element x ∈ T X and a function f : X → TY , we will sometimes write x >>= f in place of f † (x). In general, the bind operator >>= : T X × (X → TY ) → TY is not equivalent to - † . However, if T is strong, then we can de ne >>= as the strong Kleisli lifting of the evaluation map ev : (X → TY ) × X → TY (modulo isomorphisms of the form X × Y Y × X ). Since every monad on Set is strong, we can always assume monads to come with a bind operator >>=. Moreover, we will occasionally use the notation Λ (v) Σ when we want to emphasise that we are working with Λ Σ equipped with the call-by-value operational semantics.

φ( ) = η( ) φ(E[x ]) = η(E[x ])
Before giving Λ Σ a call-by-name operational semantics, let us spell out some useful syntactical properties of Λ (v) Σ . Working with call-by-value e ectful languages we are interested in substituting values for variables in terms, rather than terms themselves. In order to improve readability, we will sometimes denote a substitution -[x := ] as a map σ and write e σ in place of e[x := ]. We also notice that for any value w, w σ is a value. The notion of substitution is extended to evaluation contexts in the obvious way (de ning [-] σ [-]). Notice that for any evaluation context E, E σ is an evaluation context as well.

Finally, we notice that we can always decompose the evaluation of a term of the form e[x := ] as follows: we rst evaluate e obtaining an element e ∈ T E, and then use monadic binding to apply the substitution -[x := ] to enfs in e and evaluate the results obtained (this way composing the e ects produced during the evaluation process). (7.3)

Proof. We immediately notice that (7.3) is a corollary of (7.1) and (7.2). Both (7.1) and ( 7.2) are proved by induction on n proceeding by case analysis according to Lemma 25. We prove (7.1) by induction on n. The case for n = 0 is trivial. Assume n > 0 and proceed by case analysis according to Lemma 25.

• Suppose e = . We have:

σ n = η( σ ) [By De nition 45 since σ is a value] = η( ) >>= σ n .
[By De nition 45 since ∀x ∈ X .∀f :

X → TY . η(x ) >>= f = f (x )]
• Suppose e = E[x ]. We have:

e n >>= σ n = η(E[x ]) >>= σ n [By De nition 45] = (E[x ]) σ n [Since ∀x ∈ X .∀f : X → TY . η(x ) >>= f = f (x )] = e σ n .
• Suppose e = E[(λx.f ) ]. First of all notice that for any term e, and all values , w such that x and x FV (w ), we have (cf. Substitution Lemma in [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]): (pure subst)

Therefore, we can reason as follows:

(E[(λx.f ) ]) σ n = E σ [(λx.f σ ) σ ] n [By de nition of substitution] = E σ [f σ [x := σ ]] n-1 [By De nition 45] = E σ [( f [x := ]) σ ] n-1 [By (pure subst). See also below.] = (E[f [x := ]]) σ n-1 [By de nition of substitution] E[f [x := ]] n-1 >>= σ n-1 [By induction hypothesis] E[f [x := ]] n-1 >>= σ n [By monotonicity of >>=] = E[(λx.f ) ] n >>= σ n .

[By De nition 45]

In particular, we notice that the equality f σ [x := σ ] = ( f [x := ]) σ follows by (pure subst), since f σ [x := σ ] = f [ := w][x := [ := w]] and we can assume x FV (w ) as the former is bound by a λ-abstraction.

• Suppose e = E[op(p, x.f )]. We have

(E[op(p, x.f )]) σ n = E σ [op(p, x.f σ )] n [By de nition of substitution] = op (p, → E σ [f σ [x := ]] n-1 ).

[By De nition 45]

We now observe that since x is bound in x.f , without loss of generality we can assume x FV (w ), and thus w[x := ] = w. As a consequence, we have:

f σ [x := ] = f [ := w][x := ] = f [x := ][ := w[ /x]] [By (pure subst)] = f [x := ][ := w] [Since w[ /x] = w] = ( f [x := ]) σ .
We can thus conclude our argument as follows:

(E[op(p, x.f )]) σ n = op (p, → E σ [f σ [x := ]] . n -1) [By previous argument] = op (p, → (E[f [x := ]]) σ n-1 ) [By de nition of substitution, since f σ [x := ] = ( f [x := ]) σ ] op (p, → ( E[f [x := ]] n-1 >>= σ n-1 )) [By induction hypothesis] op (p, → E[f [x := ]] n-1 ) >>= σ n-1 [By (gen alg op)] op (p, → E[f [x := ]] n-1 ) >>= σ n [By monotonicity of >>=] = E[op(p, x.f )] n >>= σ n .
[By De nition 45] Before giving Λ Σ a call-by-name operational semantics, we make the following easy but useful observation.

Lemma 28. If e[x := ] is a value, then e is a value. Similarly, if e[x := ] is a enf, then e is a enf. Moreover, if e[x := ] is a λ-free enf (i.e. not an abstraction), then so is e.

Proof. We immediately notice that if e is a variable, then we trivially have the thesis. Suppose e is not a variable. We proceed by induction on e σ = e[x := ]. If e σ = λ .f , then since e is not a variable we must have e = λ . with σ = f , and we are trivially done. If e σ = E[ w], then we proceed by case analysis on E.

As usual, Σ-continuity of T ensures continuity of the evaluation function.

Lemma 30. The mapis the least function φ : Λ → T W satisfying the following identities:

φ( ) = η( ) φ(E[xe]) = η(E[xe]) φ(E[(λx.f )e]) = φ(E[f [x := e]]) φ(E[op(p, x.e)) = op W (p, → φ(E[e[x := ]])).
Following the convention introduced in previous section, we occasionally use the notation Λ (n) Σ when we want to emphasise that we are working with Λ Σ equipped with the call-by-name operational semantics. It is a routine exercise to show that the analogue of Lemma 27 holds for Λ (n) Σ .

Lemma 31 (Substitution Lemma for Λ (n) Σ ). Let σ be the substitution - The proof of Lemma 31 closely follows the one of Lemma 27, but it is easier due to simpler form of call-by-name evaluation contexts, and thus it is omitted.

In order to compare the behaviour of terms of Λ Σ we now introduce e ectful normal form similarity and bisimilarity. The expression normal form (bi)similarity actually denotes two distinct notions, namely eager normal form (bi)similarity (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF] and weak head normal form (bi)similarity (also known as open (bi)similarity) (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF]. As the names suggest, eager normal form (bi)similarity is nothing but the instantiation of the (informal) notion of normal form (bi)similarity to call-by-value calculi, whereas weak head normal form (bi)similarity is the instantiation of the (informal) notion of normal form (bi)similarity to call-by-name calculi.

As for monadic and e ectful applicative (bi)similarity, our notion of e ectful normal form (bi)similarity is parametrised by a relator, whereby computational e ects are taken into account.

E ecful Normal Form Similarity and Bisimilarity

In the rest of this section, let a Σ-continuous monad T = T , η, - † and a Σ-continuous relator Γ for it be xed. As usual, Σ-continuity of Γ is not required for de ning e ectful normal form (bi)simulation, but it is central to prove that the induced notion of similarity and bisimilarity are precongruence and congruence relations, respectively. We begin with eager normal form (bi)similarity.

Eager Normal Form Similarity and Bisimilarity

In the rest of this subsection, we tacitly assume to work with the calculus Λ (v) Σ . Although we are working with a coarse-grain calculus, in an e ectful setting it is important to distinguish between relations over terms and relation over eager normal forms. For that reason we we will work with a variation of λ-term relations.

De nition 47.

A λ-term relation (term relation, for short) R is a pair (R Λ : Λ + → Λ, R E : E + → E).
The collection of λ-term relations is the set Rel(Λ, Λ) × Rel(E, E) which inherits a complete lattice structure from Rel(Λ, Λ) and Rel(E, E) pointwise, hence allowing λ-term relations to be de ned both inductively and coinductively. We use these properties to de ne our notion of e ectful eager normal form similarity.

De nition

48. A term relation R = (R Λ : Λ + → Λ, R E : E + → E)
is an e ectful eager normal form simulation with respect to Γ (hereafter enf-simulation, as Γ will be clear from the context) if the following hold.

e R Λ f =⇒ e ΓR E f (enf comp) x R E s =⇒ s = x (enf var) λx.e R E s =⇒ ∃f . s = λx.f ∧ e R Λ f (enf abs) E[x ] R E s =⇒ ∃E , . s = E [x ] ∧ R E ∧ ∃z FV (E) ∪ FV (E ). E[z] R Λ E [z]. (enf stuck)
We say that relation R respects enfs if it satis es conditions (enf var), (enf abs), and (enf stuck).

De nition 48 is quite standard. Clause (enf comp) is essentially as (app comp). Clauses (enf var)-(enf stuck) state that whenever two enfs are related by R E then they must have the same syntactic structure. For instance, if λx.e R E s holds, then s must the a λ-abstraction, i.e. an expression of the form λx.f . Additionally, e and f must be related by R Λ .

Clause (enf stuck) is the most interesting one. It states that whenever E[x ] R E s, then s must be a stuck term E [x ], for some evaluation context E and value . Notice that E[x ] and s must have the same 'stuck variable' x. Additionally, and must be related by R E , and E and E must be properly related too. The idea is that to see whether E and E are related, we replace the stuck expressions x , x with a fresh variable z, and test E[z] and E [z] (thus resuming the evaluation process). We require

E[z] R E E [z]
to hold, for some fresh variable z. The choice of the variable does not really matter, provided it is fresh. In fact, as we will see, enf-similarity E is substitutive and re exive. In particular, if

E[z] E E E [z] holds, then E[ ] E E E [ ]
holds as well, for any fresh variable FV (E) ∪ FV (E ). Notice that De nition 48 does not involve any universal quanti cation. In particular, enfs are tested by inspecting their syntactic structure, thus making the de nition of an enf-simulation somehow 'local': terms are tested in isolation and not via their interaction with the environment3 .

Remark 15. De nition 48 does not require for an enf-simulation R to have R E ⊆ R Λ . Nonetheless, thanks to condition (rel unit) we can assume the latter to be case, without loss of generality. In fact, we can always extend R Λ to a relation S Λ such that (S Λ , R E ) is an enf-simulation. For that, it is su cient to de ne S Λ R Λ ∪ {(s, s ) | s R E s }. To see that we indeed obtain an enf-simulation it is su cient to prove (enf comp), which amounts to show η(s) ΓR E η(s ). That is indeed the case by condition (rel unit), since s R E s .

De nition 48 induces an endofunction R → [R] on the complete lattice

Rel(Λ, Λ) ×Rel(E, E), where [R] = ([R] Λ , [R] E
) is de ned as follows (here I X denotes the identity relation on variables, i.e. the set of pairs of the form (x, x )):

[R] Λ {(e, f ) | e ΓR E f } [R] E I X ∪ {(λx.e, λx.f ) | e R Λ f } ∪ {(E[x ], E [x ]) | R E ∧ ∃z FV (E) ∪ FV (E ). E[z] R Λ E [z]}.
• If (s, s ) = (E[x ], E [x ]) with R E and E[z] R Λ E[z], for some fresh variable z, then R ⊆ S implies S E and E[z] S Λ E [z ]. We conclude E[x ] [S] E E [x ].
By Knaster-Tarski Theorem, R → [R] has a greatest xed point which we call e ectful eager normal form similarity with respect to Γ (hereafter enf-similarity) and denote by E = ( E Λ , E E ). Notice that, as usual, we are applying the notational convention of Remark 9.

Enf-similarity is thus the largest enf-simulation with respect to Γ. Moreover, E being de ned coinductively, it comes with an associated coinduction proof principle: 1. We prove that ∆∆z R Λ Z z implies ∆∆z DM(R E ) Z z . The latter amounts to show:

R ⊆ [R] R ⊆ E ( E -coind.)
1 • just (λz.∆∆z)z DM(R E ) 1 2 • just (λz.∆∆z)z + 1 2 • just (λz.Z z)z , (7.4)
where, as usual, we write distributions as weighted formal sums. To prove (7.4), is is su cient to nd a suitable coupling of ∆∆z and Z z . De ne the distribution ω ∈ D(ME × M E) as follows:

ω (just (λz.∆∆z)z, just (λz.∆∆z)z) = 1 2 ω (just (λz.∆∆z)z, just (λz.Z z)z) = 1 2
, 4 For readability we write R in place of G R .

and assigning zero to all other pairs in ME × ME. Obviously ω is a coupling of ∆∆z and Z z . Additionally, we see that ω (x, y) implies x MR E y, since

(λz.∆∆z)z R E (λz.∆∆z)z (λz.∆∆z)z R E (λz.Z z)z hold.
2. We prove that (λz.∆∆z)z R E (λz.Z z)z implies λz.∆∆z R E λz.Z z and z 0 z R Λ z 0 z, where z 0 is a (fresh) variable. The former holds by very de nition of R E , whereas the latter holds since

I Λ ⊆ R Λ .
As already discussed in Example 42, the re nement Y E Z is an example of a re nement that cannot be readily established using e.g. the operational methods developed in Chapter 5 (notably CIU approximation and applicative similarity), but whose proof is straightforward using enf-similarity. Additionally, considering the symmetric closure of R we can convince ourselves that Y and Z are actually enf-bisimilar, although such a notion has not been formally de ned yet (see De nition 49). Finally, in Subsection 7.4.2 we will prove an up-to context technique which will allow to reduce the size of R, thus minimising the task of checking that our relation is indeed an enf-simulation. To the best of the author's knowledge, the probabilistic instance of enf-similarity is the rst example of a probabilistic normal form similarity in the literature.

We conclude this subsection de ning e ectful eager normal form bisimilarity with respect to a relator Γ following the same patter of De nition 34.

De nition 49.

A term relation R is an e ectful eager normal form bisimulation with respect to Γ (enfbisimulation, for short) if it is an enf-simulation with respect to Γ ∧ Γ • . Eager normal bisimilarity with respect to Γ (hereafter enf-bisimilarity) E is de ned as eager normal similarity with respect to Γ ∧ Γ • .

As usual, a routine proof by coinduction gives us the following characterisation of enf-bisimilarity.

Proposition 20. Enf-bisimilarity E is the largest symmetric enf-simulation with respect to Γ.

Before proving our main result, namely that E is a precongrunce (and that E is a congruence), we introduce the notions of e ectful weak head normal form similarity and e ectful weak head normal form bisimilarity.

Weak Head Normal Form Similarly and Bisimilarity

E ectful weak head normal form (bi)similarity is the call-by-name counterpart of e ectful eager normal form (bi)similarity. In the rest of this subsection we work with Λ (n) Σ . We start by de ning the notion of λ-term relation for Λ

(n) Σ De nition 50. A λ-term relation (term relation, for short) is a pair R = (R Λ : Λ + → Λ, R W : W + → W ). De nition 51. A term relation R = (R Λ : Λ + → Λ, R W : W + → W ) is a weak head normal form simulation with respect to Γ (hereafter whnf-simulation) if: e R Λ f =⇒ e ΓR W f (whnf comp) λx.e R W s =⇒ ∃f . s = λx.f ∧ e R Λ f (whnf abs) xe 0 • • • e n R W s =⇒ ∃f 0 , . . . , f k . s = x f 0 • • • f k ∧ ∀i. e i R Λ f i .
(whnf stuck)

We say that R respects whnfs if it satis es clauses (whnf abs) and (whnf stuck).

As for eager normal form similarity, De nition 51 induces a monotone endofunction R → [R] on the complete lattice Rel(Λ, Λ) × Rel(W, W ). We can characterise whnf-simulations as post-xed points of R → [R] and thus de ne weak head normal form similarity with respect to Γ (whnf-similarity, for short)

W as the greatest xed point of R →

( (P z), (Qz )), (z(Pz ), z(Q z))}.
The relation R is built starting from {(P, Q )} by progressively adding terms and whnfs going through clauses (whnf comp)-(whnf stuck) in De nition 51. Although straightforward, checking that the relation R is indeed a whnf simulation is an annoying work. In Subsection 7.4.2 we will use an up-to context technique to prove that P W Q with minimum e ort. Finally, we notice that we can show that P and Q are actually equivalent by taking the symmetric closure of R.

Following De nition 49, we de ne weak head normal bisimilarity with respect to Γ (whnf-bisimilarity, for short), denoted by W , as weak head normal form similarity with respect to Γ ∧ Γ • . Without surprise,

W can be characterised as the largest symmetric whnf-simulation with respect to Γ.

Proposition 21. Weak head normal form bisimilarity with respect to Γ is the largest weak head normal form simulation with respect to Γ.

Previous examples give evidences that normal form similarity and bisimilarity are interesting notions of program approximation and equivalence, respectively, even in presence of e ects. However, in order to qualify as such, we rst have to prove precongruence and congruence theorems for them. The next section is dedicated to such a task.

Meta-theoretical Properties

In this section we prove congruence and precongruence theorems for normal form bisimilarity and similarity, respectively. Our proofs are based on a generalisation of Lassen's relational construction for the pure call-by-name λ-calculus (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF] to both Λ (n) Σ and Λ (v) Σ . Such a construction has been previously adapted to the pure call-by-value λ-calculus (and its extension with delimited control operators) in [START_REF] Biernacki | Proving soundness of extensional normal-form bisimilarities[END_REF], whereas Lassen has proved compatibility of pure eager normal form bisimilarity via a CPS translation (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF]. Both those proofs rely on syntactical properties of the calculus (mostly expressed using a suitable small-step semantics), and thus seem to be hardly adaptable to e ectful calculi5 . On the contrary, our proofs rely on the properties of relators, thereby making our results and techniques more modular and thus valid for a large class of e ects.

Congruence and Precongruence Theorems

We begin proving precongruence of enf-similarity, as proving the latter is much harder than proving precongruence of whnf-similarity. As a consequence, unless explicitly stated, in the rest of this section we work with the calculus Λ (v) Σ . As usual, we tacitly assume a Σ-continuous monad T and a Σ-continuous relator Γ for T to be xed. Moreover, in order to have a lighter notation, we reintroduce our sequent-like notation for term relations. In particular, for a term relation R = (R Λ , R E ) and arbitrary terms e, f and values , w, we use the notations Λ e R f and e R Λ e, as well as E e R f and e R E f , interchangeably. Notice, however, that in writing e.g. Λ e R f we are not requiring e and f to be closed terms.

The main (new) tool we will use to prove the wished precongruence theorem is the so-called substitutive and compatible closure of a term relation (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF].

De nition 52. Let R be a term relation. The substitutive and compatible closure (sc-closure, for short) of R is the term relation R SC de ned inductively according to the rules in Figure 7.2, where in rules (E-sc.E) and (Λ-sc.E) z is a fresh variable.

Λ e R e Λ e R SC e (Λ-sc.R) E s R s E s R SC s (E-sc.R) E s R SC s Λ s R SC s (E-Λ-sc) E x R SC x (E-sc.var) Λ E[z] R SC E [z] E R SC E E[x ] R SC E[x ] (E-sc.E) Λ E[z] R SC E [z] Λ e R SC e Λ E[e] R SC E [e ] (Λ-sc.E) Λ e R SC f E λx.e R SC λx.f (Λ-sc.abs) Λ e R SC e Λ f R SC f Λ e f R SC e f (Λ-sc.app) E R SC E w R SC w E [x := w] R SC [x := w ] (E-sc.subst) Λ e R SC e E R SC Λ e[x := ] R SC e [x := ] (Λ-sc.subst) Λ e R SC f Λ op(p, x.e) R SC op(p, x.f ) (Λ-sc.op)
Figure 7.2: Compatible and substitutive closure construction for Λ (v) Σ .

We say that term relation R is compatible and substitutive if R = R SC . This de nition obviously agrees with the de nitions of substitutivity and compatibility given in Chapter 5.

We immediately notice that thanks to rules (Λ-sc.R) and (E-sc.R), for any term relation R, we have R ⊆ R SC , and that the latter is always re exive. As a consequence, in order to show that a term relation R is compatible it is su cient to prove R SC ⊆ R. We are now going to prove that if R is a enf-simulation, then so is R SC . In particular, we will infer that ( E ) SC is a enf-simulation, and thus it is contained in E , by coinduction. That allows us to conclude that enf-similarity is compatible and substitutive. For readability, we split the proof in two parts.

Lemma 33. If R respects enfs, then so does R SC .

Proof. Suppose R respects enfs. We prove that R SC satis es conditions (enf var), (enf abs), and (enf stuck) in De nition 48.

• We show that R SC satis es (enf var). That is, we prove:

E x R SC s =⇒ s = x.
We proceed by induction on the derivation of E x R SC s. The only relevant cases to consider are those relatives to rules (E-sc.R), (E-sc.var), and (E-sc.subst). The rst two are trivial. For the 130 latter, suppose E x R SC s to be the conclusion of a derivation of the form:

E w R SC w E R SC E w[ := ] R SC w [ := ]
(E-sc.subst) so that we have x = w[ := ] and s = w [ := ]. As a consequence, w must be a variable.

If w , then we must have w = x and we conclude the thesis by induction hypothesis on E w R SC w . If w = , then we must have = x. By induction hypothesis on E w R SC w we infer w = too, whereas from induction hypothesis on E R SC we infer = x, and thus we are done.

• We show that R SC satis es (enf abs), i.e.

λx.e R SC E s =⇒ s = λx.f ∧ E e R SC f .
We proceed by induction on the derivation of E λx.e R SC s. The only relevant cases to consider are those for rules (E-sc.R), (Λ-sc.abs), and (E-sc.subst). The rst two are trivial. For the latter, suppose E λx.e R SC s to be the conclusion of derivation of the form

E w R SC w E R SC E w[ := ] R SC w [ := ]
(E-sc.subst) so that λx.e = w[ := ] and s = w [ := ]. We do case analysis on the structure of w. The following are the relevant cases.

-Suppose w = . Then we have = λx.f . From E R SC w , since by previous point R SC satis es (enf var), it follows w = . We conclude the thesis by induction hypothesis on s R SC .

- • We show that R SC satis es (enf stuck), i.e.

E E[x ] R SC E s =⇒ ∃E , . s = E [x ] ∧ E R SC ∧ ∃z FV (E) ∪ FV (E ). Λ E[z] R SC E [z].
As before, we proceed by induction on the derivation of

E E[x ] R SC s. Since E[x ] is not a value, E E[x ]
R SC s cannot be the conclusion of an instance of rule (E-sc.subst) (as the substitution of value for a variable in a value is itself a value). As a consequence, the only relevant cases are those for rules (E-sc.R) and (E-sc.E), which are both straightforward.

Lemma 34

(Main Lemma.). Let R = (R Λ , R E ) be a λ-term relation. If R is a enf-simulation, then so is R SC .
Proof. The proof is long and non-trivial. First, we immediately notice that R SC respects enfs. This directly follows from Lemma 33, since R is a enf-simulation (and thus respects enfs). As a consequence, it remains to prove that e R SC Λ f implies e ΓR SC E f . Since Γ is inductive, the latter follows if

∀n. Λ e R SC f =⇒ e n ΓR SC E f .
We proceed by lexicographic induction on (1) the natural number n and (2) the derivation Λ e R SC f . The case for n = 0 is trivial (since Γ is inductive). The remaining cases are nontrivial, and we handle them either using Lemma 27 or observing that E[e] = e >>= (s → E[s] ) (cf. Lemma 10). Both these observations allow us to apply condition (rel bind) to simplify proof obligations (usually relying on part (2) of the induction hypothesis as well). This scheme is iterated until we reach either an enf (in which case we rely on condition (rel unit)) or a pair of expression on which we can apply part (1) of the induction hypothesis. We now give technical details. Assume n > 0. We proceed by cases on the last inference rule in the derivation of e R SC Λ f .

Case (Λ-sc.R). We have e R Λ f . Since R is a simulation we have e n e ΓR E f . We conclude the thesis by condition (ind 2) since R E ⊆ R SC E and Γ is monotone.

Case (E-Λ-sc). We have to prove η(s) ΓR SC E η(t ) given s R SC E t. This directly follows by condition (rel unit).

Case (Λ-sc.app). We have to prove e n ΓR SC E f h , given e R SC Λ f and R SC Λ h. We notice that

e n e n >>= (s → s n ) f h = f >>= (s → sh ),
where s → sh n denotes the function taking as argument an enf s and giving as result sh n (and similarity for s → sh ). By condition (ind 2), it is su cient to prove

e n >>= (s → s n ) ΓR SC E f >>= (s → sh ).
which in turn, by condition (rel bind), amounts to show e n ΓR SC E f and that s R SC E s implies s n ΓR SC E s h . The former directly follows by part (2) of the induction hypothesis, whereas for the latter we assume s R SC E s and proceed by case analysis on s.

Case s = x. Then by Lemma 33 we have s = x too. As before, we have

x n n >>= (t → xt n ) and xh = h >>= (t → xt ). Therefore it is su cient to prove n >>= (t → xt n ) ΓR SC E h >>= (t → xt ).
By Then by Lemma 33 we have that t is a value too. We have to prove

(λx.c) n = c[x := ] n-1 ΓR SC E c [x := ] = (λx.c ) .
The latter follows by part (1) of induction hypothesis, since c

R SC Λ c , R SC E imply c[x := ] R SC Λ c [x := ] by rule (Λ-sc.subst). Case t = E[ ]. By Lemma 33 we have t = E [ ] with R SC E and E[z] R SC Λ E [z]
, for some fresh variable z. We have to prove:

(λx.c)E[ ] n = η((λx.c)E[ ]) ΓR SC E η((λx.c )E [ ]) = (λx.c )E [ ] .
By condition (rel unit) it is su cient to show

(λx.c)E[ ] R SC E (λx.c )E [ ], which holds by rule (E-sc.E). Case s = E[x ]. By Lemma 33 we have s = E [x ] with R SC E and E[z] R SC Λ E [z]
for some fresh variable z. We have to prove:

E[x ] n = η(E[x ] ) ΓR SC E η(E [x ]h) = E [x ]h . By condition (rel unit) it is su cient to show E[x ] R SC E E [x ]h. This is indeed the case since both R SC E and E[z] R SC Λ E [z]h hold, the latter being implied by R SC Λ h and E[z] R SC Λ E [z]
(notice that without loss of generality we can assume z to be fresh in and h since by rule (Λ-sc.subst)

E[z] R SC Λ E [z] implies E[z ] R SC Λ E [z ]
for any variable z fresh for , h, E[z], and E [z]).

Case (Λ-sc.subst). We have to prove e

[x := u] n ΓR SC E f [x := u ] , given e R SC Λ f and u R SC E u . Let σ -[x := u], τ -[x := u ]
. By Lemma 27 and condition (ind 2) to prove the thesis it is su cient to show:

e n >>= (s → s σ n ) ΓR SC E f >>= (s → s τ ).
Relying on condition (rel bind) we claim that e n ΓR SC E f and that s σ n ΓR SC E t τ hold for all enfs s, t such that s R SC E t. The former directly follows by part (2) of the induction hypothesis, whereas for the latter we assume s R SC E t and proceed by case analysis on s.

Case s = . By Lemma 33 we have t = w for some value w. Since both σ and w τ are values, we have to show η( σ ) ΓR SC E η(w τ ). By condition (rel unit) it is su cient to prove σ R SC E w τ , which follows by rule (E-sc.subst).

Case s = E[ ],

x. We proceed as in previous case.

Case s = E[x ]. By Lemma 33 we have t = F [xw] with R SC E w and E[z] R SC Λ F [z]
for some fresh variable z. We have to prove

E σ [u σ ] n ΓR SC E F τ [u w τ ] .
We proceed by case analysis on u. If u is a variable, the we proceed as in previous case.

Otherwise u is a λ-abstraction λ . . By Lemma 33 we have u = λ .h with R SC Λ h. By very de nition of operational semantics, we have to prove:

E σ [ [ := σ ]] n-1 ΓR SC E F τ [h[ := w τ ]] .
The latter follows by part (1) of the induction hypothesis, provided

E σ [ [ := σ ]] R SC Λ F τ [h[ := w τ ]]. This is indeed the case since E[z] R SC Λ F [z] and u R SC E u imply E σ [z] R SC Λ F τ [z]
(without loss of generality we can assume x z). By rule (E-sc.subst), from u R SC E u and R SC E w we infer σ R SC E w τ , and thus [x := σ ] and h[x := w τ ] by rule (Λ-sc.subst). We conclude

E σ [ [ := σ ]] R SC Λ F τ [h[ := w τ ]] by rule (Λ-sc.E). Case (Λ-sc.op). We have to prove op(p, x.e) n ΓR E SC op(p, x.f ) , given e R SC Λ f . For that, it is su cient to show op (p, → e[x := ] n-1 ) ΓR E SC op (p, → f [x := ] ).
Since R E SC is re exive, from e R SC Λ f we infer e[x := ] R SC Λ f [x := ], for any . We can thus conclude the wished thesis using condition (Σ comp) and part (1) of the induction hypothesis.

Case (Λ-sc.E). We have to prove

E[e] n ΓR SC E F [f ] given e R SC Λ f and E[z] R SC Λ F [z],
for some fresh variable z. As usual, it is su cient to show:

e n >>= (s → E[s] n ) ΓR SC E f >>= (s → F [s] ).
By condition (rel bind) it is su cient to prove e n ΓR SC E f and that s

R SC E t implies E[s] n ΓR SC E F [t] .
The former follows by part (2) of the induction hypothesis since e R SC Λ f , whereas for the latter we assume s R SC E t and proceed by case analysis on s.

Case 1. If s is a stuck term, say A[x ], then by Lemma 33 we have t [xw]]. This is indeed the case thanks to rule (E-sc.E) since both E[A [-]] and F [B [-]] are evaluation contexts and we have

= B[xw] with A[ ] R SC Λ B[ ] and R SC E w. As a consequence, proving E[s] n ΓR SC E F [t] amounts to prove η(E[A[x ]]) ΓR SC E η(F [B[xw]]). By condition (rel unit) to prove the latter it is su cient to show E[A[x ]] R SC E F [B
E[A[ ]] R SC Λ F [B[ ]]. Case 2.
If s is a value , then t must be a value w too, and we have to show

E[ ] n ΓR SC E F [w] . Since z is fresh in E[-] and F [-] we notice that E[ ] = (E[z]) σ and F [w] = (F [z]) τ , where σ -[z := ] and τ -[z := w]
. By Lemma 27 to prove the thesis it is thus su cient to show

E[z] n >>= (r → r σ n ) ΓR SC E F [z] >>= (r → r τ ).
By condition (rel bind) to prove the latter it is su cient to prove

E[z] n ΓR SC E F [z] and that r 1 R SC E r 2 implies r σ 1 n ΓR SC E r τ 2 .
As usual the former follows by part (2) of the induction hypothesis since

E[z] R SC Λ F [z]
, whereas for the latter we assume r 1 R SC E r 2 and proceed by case analysis on r 1 . If r 1 is a value, then so is r 2 (by Lemma 33) and proving the thesis is straightforward. If r 1 is a stuck term A 1 [x 1 ], then r 2 must be a stuck term too, say

A 2 [x 2 ], with A 1 [ ] R SC Λ A 2 [ ] and 1 R SC E 2 . If x z, then we have to show A σ 1 [x σ 1 ] n ΓR SC E A τ 2 [x τ 2 ] .
By condition (rel unit) the latter follows from

A σ 1 [x σ 1 ] R SC E A τ 2 [x τ 2 ]
which indeed holds. If x = z, then we have to show

A σ 1 [ σ 1 ] n ΓR SC E A τ 2 [w τ 2 ] .
If is a variable, then so must be w (since R SC E w) and we proceed as above. If ≡ λ . , then by Lemma 33 we have w ≡ λ .h with R SC Λ h. By very de nition of operational semantics we have to show

A σ 1 [ [ := σ 1 ]] n-1 ΓR SC E A τ 2 [h[ := τ 2 ]
] . The latter follows by part (1) of the induction hypothesis, since we have

A σ 1 [ [ := σ 1 ]] R SC Λ A τ 2 [h[ := τ 2 ]].
Theorem 9. Enf-similarity is a precongruence relation.

Proof. From Lemma 34 we know that E is a compatible, re exive, and substitutive term relation. It remains to prove that it is also transitive. By coinduction, it is su cient to show that E • E is an enfsimulation, which is a routine exercise (notice, however, that to handle condition (enf stuck) we rely on substitutivity of E ).

Finally, we can rely on Proposition 20 to prove that enf-bisimilarity is a congruence. In fact, as discussed in Subsection 5.4.1, our proof of Lemma 34 requires the relator Γ to be inductive, a condition which is not satis ed by conversive relators, in general. However, by Proposition 20 we can keep working with the Σ-continuous relator Γ and show that ( E ) SC is a enf-simulation with respect to Γ. In order to conclude ( E ) SC = E we need to show that ( E ) SC is symmetric. An easy inspection of the rules in Figure 7.2 reveals that for any term relation R, R SC is symmetric whenever R is. We have thus proved the following result.

Theorem 10. Enf-bisimilarity is a congruence relation.

We conclude this section with a short discussion on congruence and precongruence properties of whnf-(bi)similarity. We can prove that whnf-similarity is a precongruence by mimicking the proof given for enf-similarity. The substitutive and compatible closure of a term relation R = (R Λ , R W ) is de ned according to the rules in Figure 7.3. Due to the simpler form of evaluation contexts (and thus of whnfs) of Λ (n) Σ , the de nition of substitutive and compatible closure for Λ (n) Σ is easier than the one for Λ (v) Σ . Such simplicity is re ected in the proof of the analogous of Lemma 34 which closely follows the one for Λ (v) Σ but which is substantially easier.

Theorem 11. Whnf-similarity is a precongruence relation, and whnf-bisimilarity is a congruence relation. Theorem 9, Theorem 10, and Theorem 11 qualify e ectful normal form similarity and bisimilarity as good candidate notions for program equivalence and re nement, at least from a structural perspective. Additionally, such notions have been introduced looking at specif examples aimed to show limitations of e ectful applicative (bi)similarity. It is then natural to ask what is the relationship between all such notions.

Λ e R f (Λ-sc.R) Λ e R SC f W s R t (W-sc.R) W s R SC t W s R SC t (W-Λ-sc) Λ s R SC t (W-sc.var) W x R SC x W E[z] R SC F [z] Λ e R SC f (W-sc.E) W E[xe] R SC F [x f ] Λ e R SC f (W-sc.abs) W λx.e R SC λx.f Λ e R SC f Λ R SC h (Λ-sc.app) Λ e R SC f h Λ e R SC f Λ R SC h (Λ-sc.subst) Λ e[x := ] R SC f [x := h] Λ e R SC f (Λ-sc.op) Λ op(p, x.e) R SC op(p, x.f )
We now present a formal comparison between e ectful enf-(bi)similarity and e ectful applicative (bi)similarity, as de ned in Chapter 5. It is a straightforward exercise to rephrase such a comparison for whnf-bisimilarity and the call-by-name e ectful variation of applicative (bi)similarity as sketched at the beginning of Chapter 6. We will say more about that below, and present a summary of the results obtained in Chapter 8.

First of all, we cannot rely on the notation used in Chapter 5, as there would be some inconsistencies. We thus use the following notational convention. Let Λ 0 , V 0 denote the collections of closed terms and closed values, respectively. We keep using the notationto denote the evaluation function of De nition 45. We notice that if e ∈ Λ 0 , then e ∈ T V 0 . Formally, we express that by saying that the evaluation mapfactors as follows, where ι : V 0 → E is the obvious inclusion map:

Λ 0 |-| / / _ T V 0 _ T ι Λ - / / T E
In particular, the map | -| is nothing but the evaluation function of De nition 15. We can thus phrase the de nition of e ectful applicative similarity (with respect to a relator Γ) as follows.

De nition 53. A term relation R = (R Λ : Λ 0 + → Λ 0 , R V : V 0 + → V 0 )
is an e ectful applicative simulation with respect to a relator Γ (applicative simulation, for short) if:

Λ e R f =⇒ |e | ΓR V | f | (app comp ) v λx.e R λx.f =⇒ ∀ ∈ V 0 . Λ e[x := ] R f [x := ].
(app val )

Let A = ( A Λ , A V ) denote applicative similarity, and c = ( Λ c , E c
) denote the restriction of enfsimilarity E to closed terms and closed eager normal forms. Obviously A describes e ectful applicative similarity as de ned in Chapter 5, but adapted to the coarse-grain version of Λ Σ .

Proposition 22. Enf-similarity restricted to closed term and enfs is contained in applicative similarity.

Proof. We show c ⊆ A by coinduction, proving that c satis es conditions (app val ) and (app comp ).

• We show:

E λx.e c λx.f =⇒ ∀ ∈ V • . Λ e[x := ] c f [x := ].
We have:

E λx.e c λx.f =⇒ E λx.e E λx.f [Since c ⊆ E ] =⇒ Λ e f [By (enf abs)] =⇒ ∀ ∈ V • . Λ e[x := ] E f [x := ] [Since E is re exive and substitutive] =⇒ Λ e[x := ] c f [x := ].
[Since e[x := ], f [x := ] are closed]

• We prove (app comp ). We have:

Λ e c f =⇒ Λ e E f [Since c ⊆ E ] =⇒ e Γ E E f [By (enf comp)] =⇒ T ι|e | Γ E E T ι| f |. [Since ∀e ∈ Λ • . e = T ι|e |]
We conclude the thesis observing that since E c = ι • • E E • ι, we can use (stability) to calculate:

(T ι • | -|) • • Γ E • T ι • | -| = | -| • • (T ι) • • Γ E • T ι • | -| = | -| • • Γ(ι • • E • ι) • | -| , and thus conclude |e | Γ E c | f |.
By De nition 49 it follows that enf-bisimilarity restricted on closed terms and enfs is contained in applicative bisimilarity (the latter being de ned as the largest symmetric applicative simulation). This means that e ectful enf-similarity is a sound proof technique for e ectful applicative bisimilarity and thus for e ectful contextual equivalence, in virtue of the results of Chapter 5. Moreover, Proposition 22 extends to enf-similarity and open applicative bisimilarity (i.e. the open extension of A ). For, let e, f be open terms with free variables x. Then for all closed values we have:

e E Λ f =⇒ e[ x := ] E Λ f [ x := ] [By substitutivity of ] =⇒ e[ x := ] A Λ , f [ x := ] [By Proposition 22]
where in applying substitutivity we use the fact that consisting of closed values only, sequential substitution coincide with simultaneous substitution. An analogous result holds for values.

Although enf-(bi)similarity is sound for applicative (bi)similarity, it is not fully-abstract. In fact, already in the pure λ-calculus enf-bisimilarity is strictly ner than applicative bisimilarity (and thus strictly ner than contextual equivalence too), as observed in (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF]. To see that, let us consider Example 1.4 in [START_REF] Durier | Eager functions as processes[END_REF]: the terms x and (λ .x )(x ) are obviously applicatively bisimilar but not enf-bisimilar.

Proposition 22 can also be easily adapted to whnf-(bi)similarity and the call-by-name version of applicative (bi)similarity. Again, full abstraction fails. To see that, we can consider Example 2.3.10 in [START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF], where it is observed that the (open) terms xx and x (λ .x ) are applicatively bisimilar, but not whnf-bisimilar.

Normal Form (Bi)simulation Up-to Context

The up-to context technique (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Pous | Enhancements of the bisimulation proof method[END_REF]) is a re nement of the coinduction proof principle of normal form (bi)similarity that allows for handier proofs of equivalence and re nement between terms. When exhibiting a candidate (bi)simulation relation R, it is desirable for R to be as small as possible, so to minimise the task of verifying that R is indeed a (bi)simulation.

The motivation behind such a technique can be easily seen by looking at Example 45 and Example 46, where we showed the equivalence between probabilistic xed point combinators working with relations containing several administrative pairs of terms. The presence of such administrative pairs was forced by De nition 49 and De nition 51, although they appear somehow unnecessary in order to convince that e.g. Y and Z exhibit the same behaviour.

Normal form (bi)simulation up-to context is a re nement of normal form (bi)simulation that allows to check that a relation R behaves as a (bi)simulation relation up to its substitutive and compatible closure. We rst de ne the notion of an enf-simulation up-to context.

De nition

54. A term relation R = (R Λ : Λ + → Λ, R E : E + → E)
is an e ectful eager normal form simulation up-to context with respect to Γ (hereafter enf-simulation up-to context) if satis es the following conditions.

Λ e R f =⇒ e ΓR SC E f (enf up-to ctx comp) E x R s =⇒ s = x (enf up-to ctx var) E λx.e R s =⇒ ∃f . s = λx.f ∧ Λ e R SC f (enf up-to ctx abs) E E[x ] R s =⇒ ∃E , . s = E [x ] ∧ E R SC ∧ ∃z FV (E) ∪ FV (E ). Λ E[z] R SC E [z].
(enf up-to ctx stuck)

In order for the up-to context technique to be sound, we need to show that every enf-simulation up-to context is contained in enf-similarity. This is a direct consequence of the following variation of Lemma 34.

Lemma 35. If R is a enf-simulation up-to context, then R SC is a enf-simulation.
Proof. The proof is structurally identical to the one of Lemma 34, where we simply observe that wherever we use the assumption that R is an enf-simulation, we can use the weaker assumption that R is an enf-simulation up-to context.

In particular, since by Lemma 34 we have that E = ( E ) SC , we see that enf-similarity is an enfsimulation up-to context. Additionally, by Lemma 35 it is the largest such. Since the same result holds for enf-bisimilarity and enf-bisimilarity up-to context, we have the following result.

Theorem 12. Enf-similarity is the largest enf-simulation up-to context, and enf-bisimilarity is the largest enf-bisimulation up-to context.

Example 47. We apply Theorem 12 to simply the proof of the equivalence between Y and Z given in Example 45. In fact, it is su cient to show that the symmetric closure of term relation R de ned as follows is an enf-bisimulation up-to context.

R Λ {(Y , Z ), (∆∆z, Z z), (∆∆, (λz.∆∆z) or (λz.Z z))} R E I E .
It is not hard to see that the above results can be rephrased in terms of whnf-similarity and whnfbisimilarity.

De nition

55. A term relation R = (R Λ : Λ + → Λ, R W : W + → W
) is a weak head normal form simulation up-to context with respect to Γ (whnf-simulation up-to context, for short) if:

Λ e R f =⇒ e ΓR SC W f (whnf up-to ctx var) W λx.e R s =⇒ ∃f . s = λx.f ∧ Λ e R SC f (whnf up-to ctx abs) W xe 0 • • • e n R s =⇒ ∃f 0 , . . . , f k . s = x f 0 • • • f k ∧ ∀i. Λ e i R SC f i .
(whnf up-to ctx stuck)

Theorem 13. Whnf-similarity is the largest whnf-simulation up-to context, and whnf-bisimilarity is the largest whnf-bisimulation up-to context.

Example 48. We can use Theorem 13 to show the equivalence between the combinators P and Q of Example 46. The reader is invited to compare the (considerably larger) size of the whnf-simulation exhibited in Example 46 with the one de ned below.

R Λ {(P, Q ), (P z, Qz ), (Pz , Q z)} R W ∅.
It is a straightforward exercise to show that R is indeed a whnf-simulation up to-context, so that we have P W Q. Moreover, the symmetric closure of R is whnf-bisimulation up to-context, and thus we have P W Q.

We conclude this section spending a couple of words on up-to techniques. In this chapter we focused on normal form (bi)similarity up-to context, as for our purpose the latter is probably the most powerful technique. There are several other up-to techniques, such as (bi)simulation up-to similarity [START_REF] Milner | Communication and concurrency[END_REF] or (bi)simulation up-to improvement (S. Lassen, 1998a). For instance, it is not hard to see the up-to similarity technique to be valid for e ectful applicative similarity (the proof is straightforward), where the mapping R → [R] is the one de ned in De nition 32.

Proposition 23. The following law holds for any closed λ-term relation R:

R ⊆ [( A ) o • R o • ( A ) o ] R ⊆ A (up-to A )
Proving an up-to similarity technique for normal form similarity requires to deal with some technicalities, as normal form similarity is de ned on open terms. Nevertheless, if R is closed under the substitution rule below, where x FV (E) ∪ FV (F ), then we can easily prove the validity of an up-to similarity technique.

Λ

E[x] R F [x] z FV (E) ∪ FV (F ) Λ E[z] R F [z]
In (S. Lassen, 1998a) several up-to techniques are proved to be sound for pure applicative (bi)similarity. Among those, there are applicative similarity up-to similarity and applicative similarity up-to improvement [START_REF] Sands | Improvement theory and its applications[END_REF], as well as combinations thereof. In particular, the following restricted form of the up-to context technique is proved to be valid for pure applicative similarity (again, the mapping R → [R] is the one de ned in De nition 32):

R ⊆ [ R] R ⊆ A (up-to-ctx-closed)
The soundness of the 'full' up-to context technique

R ⊆ [ (R o )] R ⊆ A (up-to-ctx)
is, to the best of author's knowledge, still an open problem.

E ectful Lévy-Longo Trees

At the very beginning of this chapter, we made several references to Böhm-tree like equivalences. That was rather informal, as there is no precise de nition of such equivalences. In this section we study the formal connection between normal form similarity and Böhm-tree like approximation. Notably, we de ne and analyse suitable generalisation of Lévy-Longo trees for e ectful calculi as well as the equivalence and approximation they induce on terms. As we will see, the latter coincide with whnf bisimilarity and similarity, respectively. Finally, we brie y discuss tree-like equivalences associated with enf-(bi)similarity. Böhm trees [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF] are in nitary tree-like structures used as mathematical descriptions of the behaviour of pure, untyped λ-terms when evaluated according to the so-called head normal form reduction [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]. Lévy-Longo trees [START_REF] Lévy | An algebraic interpretation of the lambda beta -calculus and a labeled lambda -calculus[END_REF][START_REF] Longo | Set-theoretical models of lambda calculus: Theories, expansions, isomorphisms[END_REF][START_REF] Ong | The lazy lambda calculus: An investigation into the foundations of functional programming[END_REF] have been introduced as the natural counterpart of Böhm trees in the context of the so-called lazy or weak head normal form reduction, i.e. a call-by-name reduction strategy reducing terms to weak head normal forms (Abramsky, 1990a).

The original formulation of both Böhm and Lévy-Longo trees is of an inductive nature, as witnessed by e.g. [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF]. Moving from ideas developed in concurrency theory6 , in [START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario (extended abstract)[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF] Lévy-Longo tree equality has been characterised coinductively, introducing the notion of open bisimilarity, the latter being nothing but whnf-bisimilarity for Λ M . The study of Lévy-Longo tree equality as a suitable notion of bisimulation opened the door to the analysis of tree like equivalences using coinductive techniques, as witnessed by the numerous works on the subject (see e.g. [START_REF] Biernacki | Proving soundness of extensional normal-form bisimilarities[END_REF][START_REF] De Liguoro | Non deterministic extensions of untyped lambda-calculus[END_REF][START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Lassen | Eager normal form bisimulation[END_REF], just to mention a few).

In this section we introduce e ectful Lévy-Longo trees as an extension of Lévy-Longo trees to Λ (n) Σ and show that we can de ne a suitable preorder (resp. equivalence) on such trees which coincides with whnf-similarity (resp. whnf-bisimilarity). Speci c notions of e ecful Böhm trees have been introduced in the context of nondeterministic [START_REF] De Liguoro | Non deterministic extensions of untyped lambda-calculus[END_REF] and probabilistic [START_REF] Leventis | Probabilistic lambda-theories[END_REF] λcalculi, and it is not hard to see that our notion of e ectful Lévy-Longo tree is deeply related to such proposals. The major di erences are the following.

1. Di erently from [START_REF] De Liguoro | Non deterministic extensions of untyped lambda-calculus[END_REF] and [START_REF] Leventis | Probabilistic lambda-theories[END_REF] we work with lazy calculi, meaning that we do not evaluate under lambdas, and thus we work with generalisations of Lévy-Longo trees rather than Böhm trees.

2. Our approach is parametric over a large class of e ects, and not tailored to speci c ones.

3. Our de nitions and results are mostly of a coinductive nature, whereas both [START_REF] De Liguoro | Non deterministic extensions of untyped lambda-calculus[END_REF] and [START_REF] Leventis | Probabilistic lambda-theories[END_REF] seem to be more inductively-oriented.

In the rest of this section we work with the calculus Λ (n) Σ and x both a Σ-continuous monad T and a Σ-continuous relator Γ for it. For convenience, we use a compact notation to represent trees.

De nition 56. The collection V T (T) of e ectful value Lévy-Longo trees (with respect to T) is coinductively de ned as follows:

1. If E ∈ T (V T (T)), then λx.E ∈ V T (T). 2. If E 1 , . . . , E n ∈ T (V T (T)), then x E 1 , . . . , E n ∈ V T (T).
The collection of e ectful Lévy-Longo trees (with respect to T) is de ned as T (V T (T)).

As usual, where no confusion arises we will omit references to the monad T and refer to e ectful value trees and e ectful trees as value trees and trees, respectively. Intuitively, a value tree of the form λx.E represent a tree with root λx. and with the single child E . Similarly, x E 1 , . . . , E n represents a tree with root x and children E 1 , . . . , E n . Pictorially, we can present such trees as:

λx E x E 1 • • • E n
The elements E 1 , . . . , E m are, for instance, subdistributions of value trees when T is DM, sets of value trees when T is PM, or simply trees (including the unde ned tree ⊥) when T is M. As for usual λ-terms, we work with (value) trees up to renaming of bound variables.

Example 49. We immediately notice that for any monad T we have ⊥ ∈ T (V T (T)), so that λx.⊥ is a value tree. Moreover, we can de ne the tree as the solution to the equation ξ = λx.η(ξ ). Therefore, we have = λx.η(λx.η(λx.η(. . .)))). Since we work up to renaming of bound variable, intuitively captures the behaviour of terms of order ω without side e ects (see (C. [START_REF] Ong | The lazy lambda calculus: An investigation into the foundations of functional programming[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF] for details).

De nition 57. The e ectful Lévy-Longo tree (hereafter tree or Lévy-Longo tree) LT (e) of a term e is de ned as T (φ) e , where the map φ : W → V T (T) is de ned by: φ(λx.e) = λx.LT (e) φ(xe 1 . . . e n ) x LT (e 1 ) . . . LT (e n ) .

Pictorially:

LT (e) T (φ) e φ(λx.e) λx

LT (e)

φ(xe 1 . . . e n ) x
LT (e 1 ) . . . LT (e n )

Example 50. Let T be the partiality monad M. We immediately observe that LT (Ω) = ⊥, where as usual Ω (λx.xx )(λx.xx ). Similarly, we can calculate the Lévy-Longo tree LT (λx.xI Ω), for I λx.x, as follows:

LT (λx.xI Ω) = just (λx.LT (xI Ω)) = just (λx.just (x LT (I ), LT (Ω) )) = just (λx.just (x just (φ(λx.x )), ⊥ )) = just (λx.just (x just (λx.LT (x )), ⊥ )) = just (λx.just (x just (λx.just x ), ⊥ )).
Omitting just annotations, we can represent LT (λx.xI Ω) as: Omitting just annotations, we can represent LT (λx.(x or Ω)) and LT ((λx.x ) or (λx.Ω)) as follows:

LT (λx.(x or Ω)) =          λx {x, ⊥}          LT ((λx.x ) or (λx.Ω)) =          λx {x } , λx {⊥}         
Similarly, considering the partial distribution monad DM (and mitting just annotations) we can represent LT (λx.(x or Ω)) and LT ((λx.x ) or (λx.Ω)) as follows:

LT (λx.(x or Ω)) = 1 • λx 1 2 • x + 1 2 • ⊥ LT ((λx.x ) or (λx.Ω)) = 1 2 • λx 1 • x + 1 2 λx 1 • ⊥
Comparing e ectful Lévy-Longo tree with plain equality can be easily seen to be too discriminating. For instance, λx.(x or Ω) and λx.x have di erent Lévy-Longo trees, but can be easily seen to be whnfbisimilar. As a consequence, our notions of e ectful Lévy-Longo tree equivalence and approximation are de ned with respect to a relator Γ.

De nition 58. Lévy-Longo value tree approximation with respect to Γ (Lévy-Longo value tree approximation, for short) VLT : V T (T) + → V T (T) is de ned as the largest relation R : V T (T) + → V T (T) such that:

λx.E R F =⇒ ∃F ∈ T (V T (T)). F = λx.F ∧ E ΓR F x E 1 , . . . , E n R F =⇒ ∃G 1 , . . . , G n ∈ T (V T (T)). F = x G 1 , . . . , G n ∧ ∀i ≤ n. E i ΓR G i .
As usual, De nition 58 induces a monotone endofunction R → [R] (monotonicity being a consequence of monotonicity of Γ) on the complete lattice of binary relations on value trees. As a consequence, we see that VLT is nothing but the greatest xed point of R → [R]. We can nally extract a λ-term relation from VLT that provides an alternative characterisation of whnf-similarity.

De nition 59.

De ne e ectful Lévy-Longo tree approximation with respect to Γ (Lévy-Longo tree approximation, for short) as the λ-term relation LT = ( LT Λ , LT W ), de ned by:

LT Λ LT • • Γ VLT • LT , LT W φ • • VLT •φ.
That is:

e LT Λ f ⇐⇒ LT (e) Γ VLT LT ( f ) s LT W t ⇐⇒ φ(s) VLT φ(t ).
Theorem 14. Lévy-Longo tree approximation LT coincide with whnf-similarity W .

Proof. The proof is entirely by coinduction and relies on stability of Γ. Let us start by showing W ⊆ LT , i.e. that the following implications hold:

e W Λ f =⇒ LT (e) Γ VLT LT ( f ) s W W t =⇒ φ(s) VLT φ(t ).
Since VLT is de ned coinductively, to prove the above implications it is su cient to exhibit a relation R : V T (T) + → V T (T) satisfying proof obligations in De nition 58 and such that

W Λ ⊆ LT • • ΓR • LT W W ⊆ φ • • R • φ.
In fact, since R satis es proof obligations in De nition 58, by coinduction we have have R ⊆ VLT and thus

ΓR ⊆ Γ VLT , as Γ is monotone. De ne R as (φ × φ)( W W ), i.e. R {(φ(s), φ(t )) | s W t }.
We claim that R satis es proof obligations in De nition 58.

1. Suppose λx.E R φ(t ). We prove that there exists F ∈ T (V T (T)) such that φ(t ) = λx.F and E ΓR F . By very de nition of φ, there exists a term e such that E = LT (e) and λx.E = φ(λx.e).

By very de nition of R we have λx.e W W t, and thus t = λx.f , for some term f such that e W Λ f . In order to conclude the desired thesis we have to show LT (e) ΓR LT ( f ). We have:

LT (e) ΓR LT ( f ) ⇐⇒ T (φ) e ΓR T (φ) f [By De nition 57] ⇐⇒ e Γ(φ • • R • φ) f [By (stability)] ⇐⇒ e Γ W W f [φ • • R • φ = W W ] ⇐= e W Λ f .
2. We can prove that x E 1 , . . . , E n implies that there exist F 1 , . . . , F n ∈ T (V T (T)) such that φ(t ) = x F 1 , . . . , F n and E i ΓR F i , for any i ≤ n, as we did in point 1.

Obviously W W ⊆ φ • • R •φ.
It remains to prove that e Λ f implies LT (e) ΓR LT ( f ), but that is exactly what we showed in point 1 above. We now show that LT is a whnf-simulation, from which LT ⊆ W will follow. Proving that LT respects whnfs is straightforward. It remains to show that e LT Λ f implies e Γ LT W f . We have:

e LT Λ f ⇐⇒ LT (e) Γ VLT LT ( f ) [By De nition 59] ⇐⇒ T (φ) e Γ VLT T (φ) f [By De nition 57] ⇐⇒ e Γ(φ • • VLT φ) f [By (stability)] ⇐⇒ e Γ LT W f . [By De nition 59]
Finally, we de ne e ectful Lévy-Longo value tree equivalence with respect to Γ, denoted as VLT , as the largest symmetric e ectful Lévy-Longo tree approximation. The relation VLT induces a λ-term relation LT as in De nition 59. Moreover, a slightly modi cation of Theorem 14 allows us to conclude the following result.

Theorem 15. E ectful Lévy-Longo tree equivalence LT coincides with whnf-bisimilarity W .

We conclude this section as well as this chapter, with a short discussion on the analogous of e ectful Lévy-Longo tree equivalence for enf-bisimilarity. As we remarked above, Lévy-Longo trees have been introduced as the analogous of Böhm trees for the so-called lazy λ-calculus, where one works with weak head normal forms, rather than with head normal forms. To the best of the author's knowledge, the notion of a Böhm tree has not been adapted to the eager λ-calculus of (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF], where weak head normal forms are replaced by eager normal forms. The reason why this has not been done is rather evident: because such trees would faithfully mimic the bisimulation game associated with eager normal form bisimulation. To see that, let us de ne the eager tree ET (e) of a pure λ-term e.

De nition 60. The eager tree ET (e) of a pure term e is the (possibly) in nitary tree with edges possibly labelled by variables coinductively de ned as follows:

ET (e)      ⊥ if e = ⊥ φ(s) if e = just s
where the function φ is de ned as follows, where z FV (E):

φ(x ) x φ(λx.e) λx ET (e) φ(E[x ]) x z ET (E[z]) φ( )
De nition 60 has been proposed by Ronchi della Rocca to Sangiorgi and Durier 7 , and by the latter to the author in a private communication.

Example 52. We can use De nition 60 to see that the applicatively bisimilar terms x and (λ .x )(x ) previously discussed have di erent eager trees.

ET (x ) = x z z φ( ) ET (λ .x )(x ) = x z x z φ( ) z φ( )
In a similar fashion, we can prove the equivalence between the (pure) xed point combinators Y and Z

7 They refer to ET (e ) as the Lassen tree of e.

144

of Examplex 41, observing that they have the same eager tree.

LT (Y ) = λ λz z z z λz z z z z z λz z z . . . = LT (Z )
Finally, it is straightforward to see that we can generalise De nition 60 to full Λ (v) Σ simply de ning ET (e) as T (φ) e . It comes with no surprise that we can de ne notions of eager tree approximation and equivalence, and that the latter coincide with E and E , respectively. Here we summarise the main results proved so far, and their relationship. In fact, we studied several notions of program equivalence and approximation, and, although several soundness and completeness (i.e. full abstraction) theorems have been proved, it is useful for the reader to have a conceptual map of the results obtained.

Concerning program equivalence and re nements for call-by-value calculi, we introduced:

• E ectful applicative similarity A and bisimilarity A .

• E ectful contextual approximation ctx and equivalence ctx .

• E ectful CIU approximation ciu and equivalence ciu .

• E ectful eager normal form similarity E and bisimilarity E .

With the exception of CIU approximation (resp. equivalence) and contextual approximation (resp. equivalence), these relations do not coincide, in general. In particular, we have:

• (The open extension of) e ectful applicative similarity (resp. bisimilarity) is strictly included in effectful contextual approximation (resp. equivalence). Inclusion follows from Theorem 4 and Theorem 5, whereas strictness has been proved for the nondeterministic calculus Λ FM in (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]) (Example 6.4.4).

• E ectful eager normal form similarity (resp. bisimilarity) is strictly included in (the open extension of) e ectful applicative similarity (resp. bisimilarity). Inclusion follows by Proposition 22, whereas strictness has been in shown in (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF] for the pure, untyped λ-calculus (see also the discussion after Proposition 22).

• (The open extension of) e ectful CIU approximation (resp. equivalence) coincides with contextual approximation (resp. equivalence). This follows from Theorem 6.

These results are summarised in Table 8.1. Concerning program equivalence and re nements for call-by-name calculi, we introduced:

E ( A ) o ( ciu ) o = ctx E ( A ) o ( ciu ) o = ctx Table 8
.1: Call-by-value re nement/equivalence spectrum.

• E ectful applicative similarity A and bisimilarity A (we only sketched the de nition).

• Monadic applicative similarity M and bisimilarity M .

• E ectful contextual approximation ctx and equivalence ctx .

• E ectful CIU approximation ciu and equivalence ciu .

• E ectful weak head normal form similarity W and bisimilarity W .

• E ectful Lévy-Longo tree approximation LT and equivalence LT .

The relationship between these equivalences and re nements is the following, where we assume relators to be quasi-at.

• (The open extension of) monadic applicative similarity (resp. bisimilarity), e ectful contextual approximation (resp. equivalence), and (the open extension of) CIU approximation (resp. equivalence) coincide. This follows from Theorem 8, Corollary 4, and Corollary 5.

• E ectful applicative similarity (resp. bisimilarity) is strictly included in monadic applicative similarity (resp. bisimilarity), and thus in e ectful contextual approximation (resp. equivalence), and CIU approximation (resp. equivalence). Strictness has been showed for Λ FM at the beginning of Chapter 6.

• E ectful weak head normal form similarity (resp. bisimilarity) is strictly included in (the open extension of) e ectful applicative similarity (resp. bisimilarity). Inclusion follows by mimicking the proof of Proposition 22, whereas strictness has been proved in [START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF], Example 2.3.10.

• E ectful Lévy-Longo tree approximation (resp. equivalence) coincides with e ectful weak head normal form similarity (resp. bisimilarity).

These results are summarised in table 8.2.

LT = W ( A ) o ( M ) o = ( ciu ) o = ctx LT = W ( A ) o ( M ) o = ( ciu ) o = ctx Table 8
.2: Call-by-name re nement/equivalence spectrum.

Chapter 9

A Theory of Abstract Behavioural Metrics

Algebra is the intellectual instrument which has been created for rendering clear the quantitative aspects of the world.

Alfred North Whitehead, The Aims of Education

The rest of this dissertation is devoted to the study of e ectful applicative (bi)similarity distance, the quantitative-like re nement of e ectful applicative (bi)similarity, as de ned in Chapter 5. Roughly speaking, such a re nement is obtained by moving from ordinary boolean-valued relations to relations taking values over arbitrary quantitative domains (such as the real extended half-line [0, ∞] or the unit interval [0, 1]). Accordingly, the theory of e ectful applicative (bi)similarity distance builds on three major improvements of the theory of e ectful applicative (bi)similarity of Chapter 5.

1. The rst improvement is to move from boolean-valued relations to relations taking values on quantitative domains, such as [0, ∞] or [0, 1], in such a way that restricting these domains to the (carrier of the) boolean algebra 2 makes the theory collapse to the usual theory of applicative (bi)similarity. For that, we rely on Lawvere's analysis (F. [START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF] of generalised metric spaces and preordered sets as enriched categories. Accordingly, we replace boolean-valued relations with relations taking values over quantales [START_REF] Rosenthal | Quantales and their applications[END_REF]) (see De nition 61) (V, ≤, ⊗, k ), i.e. algebraic structures (notably complete lattices equipped with a monoid structure) that play the role of sets of abstract quantities. Examples of quantales include the extended real half-line ([0, ∞], ≥, 0, +) ordered by the "greater or equal" relation ≥ and with monoid structure given by addition (and its restriction to the unit interval [0, 1]), and the extended real half-line ([0, ∞], ≥ , 0, max) with monoid structure given by binary maximum (in place of addition), as well as any complete Boolean and Heyting algebra. This allows to develop an algebra of quantale-valued relations, V-relations for short, which provides a general framework for studying both behavioural relations and behavioural distances (for instance, an equivalence V-relation instantiates to an ordinary equivalence relation on the boolean quantale ({false, true}, ≤, ∧, true), and to a pseudometric on the quantale ([0, ∞], ≥, 0, +)).

2. The second improvement is the generalisation of the notion of relator to quantale-valued relators, i.e. relators acting on relations taking values over quantales. Perhaps surprisingly, such generalisation is at the heart of the led of monoidal topology (Hofmann et al., 2014), a sub eld of categorical topology aiming to unify ordered, metric, and topological spaces in categorical terms.

Central to the development of monoidal topology is the notion of a V-relator or V-lax extension of a monad T (with carrier T ) which, analogously to the notion of relator, is a construction lifting V-relations on a set X to V-relations on T X . Notable examples of V-relators are obtained from the Hausdor distance (for the powerset monad) and from the Wasserstein-Kantorovich distance [START_REF] Villani | Optimal transport: Old and new[END_REF] (for the distribution monad).

3. The third improvement (on which we will expand more in Section 9.2) is the development of a compositional theory of behavioural V-relations (and thus of behavioural distances). As we are going to see, ensuring compositionality in an higher-order setting is particularly challenging due to the ability of higher-order programs to copy their input several times, a feature that allows them to amplify distances between their inputs ad libitum.

The result is an abstract theory of behavioural V-relations that allows to de ne notions of quantalevalued applicative similarity and bisimilarity parametrised by a quantale-valued relator. The notions obtained, which we refer to as e ectful applicative similarity and bisimilarity, respectively, generalise the existing notions of real-valued applicative (bi)similarity and can be instantiated to concrete calculi to provide new notions of applicative (bi)similarity distance. A remarkable example is the case of probabilistic λ-calculi, where to the best of the author's knowledge a (non-trivial) applicative distance for a universal (i.e. Turing complete) probabilistic λ-calculus is still lacking in the literature (but see Section 13.1).

As for Chapter 5, the main theorem we prove states that under suitable conditions on monads and quantale-valued relators, the abstract notion of e ectful applicative similarity distance is a compatiblei.e. compositional -re exive and transitive V-relation. Under mild conditions such a result extends to e ectful applicative bisimilarity distance, which is thus proved to be a compatible, re exive, symmetric, and transitive V-relation (i.e. a compatible pseudometric).

This chapter aims to provide an extensive, informal introduction to Chapter 10, Chapter 11, and Chapter 12, which, instead, are devoted to the technical exposition of the theory of e ectful applicative (bi)similarity distance.

An Abstract Theory of Distances

The observation that ordered and metric spaces share a common structure dates back at least to Hausdor [START_REF] Hausdor | Grundzüge der mengenlehre[END_REF]. In fact, Hausdor observed that an order on a set X can be described as a function f : X × X → {<, =, >}. Accordingly, Hausdor presented metric spaces as a direct generalisation of ordered sets where now the map f associates to each pair of points in X the distance between them. Decades later, this simple analogy has been extended by [START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF] to a formal correspondence. Metric and ordered spaces not only share the same structure, but also the same axioms. Moreover, such axioms are nothing but a concrete instance of the de nition of an enriched category [START_REF] Kelly | Basic concepts of enriched category theory[END_REF].

In ordinary category theory, each category C comes with a map, the so-called hom-map C(-, -), that associates to each pair of objects X , Y of C a set, namely the set of morphism from X to Y . Such homsets must satisfy speci c conditions; for any object X there is an identity morphism 1 X belonging to C(X , X ). Additionally, for all objects X , Y , and Z there is a binary operation • associating to morphisms

∈ C(Y , Z ) and f ∈ C(X , Y ) a morphism • f ∈ C(X , Z )
, called the composition of f with . Enriched category theory moves from the observation that there is no formal reason to require hom-sets to be sets. Hom-sets are then replaced by objects in another category V. In that case, we say that C is enriched over V. However, the category V needs to have enough structure to allow the de nition of identity morphisms and composition operations. For that, it is su cient to require V to be a monoidal category. The existence of a composition operation can be then formalised as a family of morphisms

m X ,Y ,Z : C(Y , Z ) ⊗ C(X , Y ) → C(X , Z )
in V , whereas identity is given by morphisms

i X : I → C(X , X ).
The coherence conditions of V ensures m and i to behave as composition and identity, respectively. For instance, the category Set being monoidal, it is easy to see that a locally small category is nothing but a category enriched over Set.

A more interesting example of an enriched category is provided by preorders. Recall that the twoelement boolean algebra 2 can be seen as a category with two objects (0 and 1, or false and true), and a single morphism x → if x ≤ . Moreover, 2 is monoidal, with tensor product given by binary meet ∧ and unit given by true. A preorder is thus a category X enriched over 2. The hom-set X (x, ) ∈ 2 denotes the truth value of the dominance of over x. Accordingly, identity and composition are modelled by the 2-morphisms:

true ≤ X (x, x ) X ( , z) ∧ X (x, ) ≤ X (x, z),
which are nothing but the usual axioms stating that the order X (-, -) is transitive and re exive.

Lawvere's key insight is that another example of an enriched category is provided by what he called generalised metric spaces, i.e. pairs of the form (X , µ), with µ : X × X → [0, ∞], satisfying the following subset of the usual metric axioms (where x, , z are universally quanti ed):

0 ≥ µ (x, x ) µ (x, ) + µ ( , z) ≥ µ (x, z).
In order to see the enriched nature of generalised metric spaces, we rst observe that the extended non-negative real line [0, ∞] carries a monoidal category structure. Arrows are given according to the opposite of the natural ordering ≥ (so that 0 is the terminal object, and ∞ is the initial one), whereas the tensor product is given by addition, so that the unit is 0. In a category X enriched over [0, ∞], the hom-set X (x, ) ∈ [0, ∞] gives the 'distance' between x and . Identity and composition are thus given as the morphisms:

0 ≥ X (x, x ) X ( , z) + X (x, ) ≥ X (x, z),
which are nothing but the usual axioms for identity and triangle inequality. We can also notice that there is another natural way to give the set [0, ∞] a monoidal category structure, namely replacing addition (i.e. the tensor product) with the binary maximum operator max. Composition now gives max(X ( , z), X (x, )) ≥ X (x, z) which is nothing but the usual strong triangle inequality axiom characterising ultrametric spaces.

Moving form these observations Lawvere built a beautiful theory of categories enriched over complete and cocomplete monoidal categories that uni es the theory of locally small categories, preroder spaces, and generalised metric spaces (as well as the logic(s) associated with those structures). Here, we will be more concrete and work with relations taking values over quantales [START_REF] Rosenthal | Quantales and their applications[END_REF], the latter being the decategori cation of complete and cocomplete monoaidal categories.

More precisely, a quantale is a structure V = (V, ≤, ⊗, k ) such that (V, ≤) is a complete lattice and (V, ⊗, k ) is a monoid. We require the complete lattice and monoid structure of quantale to nicely interact, meaning that some suitable distributivity laws has to be satis ed (see De nition 61 for details). For the moment, we simply observe that the structures 2 = (2, ≤, ∧, true), L = ([0, ∞], ≥, +, 0), and SL = ([0, ∞], ≥, max, 0) are quantales. We refer to them as the boolean, Lawvere, and strong Lawevere quantale, respectively. Finally, for a quantale V as above, we de ne a V-relation between X and Y to be a map α : X × Y → V.

Intuitively quantales model abstract quantities, and thus quantale-valued relations can be used as models of abstract distances. On a formal level, the structure of a quantale V allows to generalise the usual algebra of boolean-valued relations to V-relations.

The correspondence between 2, L, SL, and an arbitrary quantale

V = (V, ≤, ⊗, k ) is summarised in Table 9.1. 2 (boolean) L (Lawvere) L (strong Lawvere) V (quantale) Carrier 2 [0, ∞] [0, ∞] V Order ≤ ≥ ≥ ≤ Join ∃ inf inf Meet ∀ sup sup Tensor ∧ + max ⊗ Unit true 0 0 k Table 9.1: Correspondence 2-[0, ∞]-V.
We can use Table 9.1 as a recipe to lift the algebra of boolean-valued relations to V-relations, as well as to translate standard relational constructions into their quantitative counterparts.

For instance, it is straightforward to generalise the usual notion of relation composition. In fact, the latter is de ned using only the join (∃) and binary meet (∧) of 2, and both these notions are de ned in any quantale. Applying Table 9.1 to the de nition of relation composition we thus obtain the following de nitions of (generalised) composition, where R, S are 2-relations, µ, ν are L-relations, p, s are SLrelations, and α, β are V-relations we have:

(S • R)(x, z) ∃ . R (x, ) ∧ S( , z) (ν • µ)(x, z) inf µ (x, ) + ν ( , z) (p • s)(x, z) inf max(s (x, ), p( , z)) (β • α )(x, z) α (x, ) ⊗ β ( , z).
As a consequence, we can say that a V-relation α is transitive if α • α ≤ α. It is straightforward to see that V-relation transitivity generalises the usual notion of transitivity of boolean-valued relations as well as the well-known triangle and strong triangle inequality formulas.

Extending this line of reasoning to the notions of symmetry and re exivity, we come up with preorder and equivalence V-relations (oftentimes abbreviated as V-preorders and V-equivalences). These generalise standard preorder and equivalence relations, as well as generalised (ultra)metrics, and their symmetric extensions (known as (ultra-)pseudometrics [START_REF] Steen | Counterexamples in topology[END_REF]). As a consequence, our notions of quantale-valued program equivalence and re nement provide abstract notions of program distance, the latter subsuming both standard, boolean-valued program equivalence and re nement, and program metric (the latter, as it is customary, denoting both program generalised (ultra)metrics and program (ultra-)pseudometrics).

Having clari ed the basic intuitions behind the abstract approach to relations and distances used in this work, we now discuss the so-called distance ampli cation phenomena.

Compositionality, Distance Ampli cation, and Linear Types

As usual, we begin our analysis with an informal example giving some insights on the nature of the notions we aim to investigate. The informal example we study here is the calculus Λ p of Chapter 2 (and actually is equivalent formulation Λ DM ). Our goal is to de ne a notion of program distance δ between terms of Λ p re ning probabilistic applicative bisimilarity. Intuitively, δ (e, e ) quanti es the observable di erences between (the operational behaviour of) e and (the operational behaviour of) e . Since we postulated the probability of convergence to be the only observable property of a program, it is natural to let δ (e, e ) be a non-negative real number between 0 and 1. Following Section 9.1, we see that [0, 1] carries the same quantale structure of L, the only di erence being that the tensor product on [0, 1] is de ned as truncated addition1 . We call the quantale thus obtained unit interval quantale, and denote it as I. We have thus obtained our rst assumption.

Assumption 1. A program distance δ in Λ p is a pair of functions (δ Λ , δ V ), where δ Λ : Λ • × Λ • → [0, 1] and δ V : V • × V • → [0, 1].
We now look at some minimal desiderata a candidate distance δ should satisfy. First of all, since we observe the probability of convergence of programs, it is natural to require δ Λ (e, e ) to be at least as big as the absolute value of the di erence between the probability of convergence of e and of e . In fact, the latter is somehow the minimal distance an external observer can detect, even without interacting with e and e . We are thus requiring δ to be adequate with respect to the observable (operational) behaviour of programs in Λ p .

Assumption 2. Writing e for ∈V • e (just ), we say that a program distance δ = (δ Λ , δ V ) is adequate if:

|

ee | ≤ δ (e, e ).

Next, we ask if and how much the distance δ Λ (e, e ) is modi ed when e and e are used inside a context C. Indeed we would like to reason about the distance δ Λ (C[e], C[e ]) compositionally, i.e. in terms of the distance δ Λ (e, e ). As we have already remarked, compositionality is at the heart of relational reasoning about program behaviour, and most of the main results proved in previous chapters are concerned with showing compositionality of several forms of (bi)simulation-based equivalence and re nement relations. Formally, we modelled compositionality via the notion of compatibility, a relation being compatible if it is preserved by all language constructors. Analogous to the idea that compatible relations are preserved by language constructors, we are tempted to de ne as compatible those distances that are not increased by language constructors. That is, we would like to say that a behavioural distance δ is compatible if the distance δ Equivalently, δ is compatible if for all programs e, e we have:

sup C δ Λ (C[e], C[e ]) ≤ δ Λ (e, e ).
Notice that Assumption 3 requires δ to be non-expansive with respect to all language constructors. At this point we encounter a serious problem: as noticed in [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF][START_REF] Leijen | Implementing algebraic e ects in c[END_REF], requiring Assumption 1, Assumption 2, and Assumption 3 can lead to some distance trivialisation phenomena. Roughly speaking, we say that a program distance δ trivialises if for all programs e, e , either δ Λ (e, e ) = 0 or δ Λ (e, e ) = 1. That is, interpreting 0 as true and 1 as false, δ trivialises if it behaves as a (booleanvalued) relation.

Distance trivialisation is a consequence of higher-features of calculi. In fact, higher-order programs can freely copy and duplicate their input several times, thus having the testing power to amplify distances between their inputs ad libitum. Here we are not concerned with distance trivialisation in full generality (the interested reader can refer to [START_REF] Crubillé | Metric reasoning about lambda-terms: The general case[END_REF] for a formal analysis of distance trivialisation). For our purposes, it is su cient to notice that Assumption 1, Assumption 2, and Assumption 3 make any candidate distance not satisfactory. We clarify this point with the following example taken from [START_REF] Crubillé | Metric reasoning about lambda-terms: The general case[END_REF], and here (re)formulated in the calculus Λ p .

Example 53. Let δ be a program distance satisfying Assumption 1, Assumption 2, and Assumption 3. Let I be the identity combinator λx.return x and Ω be the purely divergent computation (λx.xx )(λx.xx ).

As usual, we see that (return I ) or Ω evaluates to I with probability 1 2 , and diverges with probability 1 2 . Since we observe the probability of convergence of a program, it speaks by itself that we would expect δ Λ (return I , (return I ) or Ω) = 1 2 . However, we can easily prove δ Λ (return I , (return I ) or Ω) = 1. Consider the family of contexts {C n } n ≥0 de ned by:

C n λx.((xI ) . . . (xI ) n )(λ .[-]).
Each context C n duplicates its input n times, meaning that the distance δ Λ (return I , (return I ) or Ω) is detected n times in C n . Therefore, the resulting distance δ Λ (C n [return I ], C n [(return I ) or Ω]) is the observed (ground) distance between return I and (return I ) or Ω ampli ed of a factor n. In fact, as n grows, the probability of convergence of C n [(return I ) or Ω] tends to 0, whereas the one of C n [return I ] remains always equal to 1. Formally, we have:

Assumption 2 =⇒ ∀n ≥ 0. | C n [e] - C n [e ] | ≤ δ Λ (C n [e], C n [e ]) =⇒ sup n | C n [e] - C n [e ] | ≤ sup n δ Λ (C n [e], C n [e ]) [By de nition of sup ] =⇒ 1 ≤ sup n δ Λ (C n [e], C n [e ]) [Since sup n | C n [e] - C n [e ] | = 1] =⇒ 1 ≤ sup C δ Λ (C[e], C[e ]) [Since sup n δ Λ (C n [e], C n [e ]) ≤ sup C δ Λ (C[e], C[e ])]
=⇒ 1 ≤ δ Λ (e, e ).

[By Assumption 3] During its evaluation, every time the context C n evaluates its inputs the detected distance between the latter is somehow accumulated to the distances previously observed, thus exploiting the linearas opposed to classical -nature of the act of measuring. Such linearity naturally re ects the monoidal closed structure of categories of metric spaces, in opposition with the cartesian closed structure characterising 'classical' (i.e. boolean-valued) observations. The moral of Example 53 is that not only how a context uses a program matters, but also how much it uses the program does. As a consequence, if we want to reason compositionally about behavioural distances, we have to take into account how much programs can access their inputs.

We can give a precise meaning to the expression how much above through the notion of program sensitivity [START_REF] De Amorim | A semantic account of metric preservation[END_REF][START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF]. Intuitively, the sensitivity of program is the law describing how much di erences in the output are a ected by di erences in the input. We thus use the notion of sensitivity to formalise the testing power of contexts. For instance, we can de ne the sensitivity of a context C in Λ p as a non-negative real number s, and re ne our notion of compatibility accordingly: we now allow a context C with sensitivity s to increase the distance δ (e, e ) between e and e , but of a factor at most s. That is, the distance δ (C[e], C[e ]) must be bounded by s • δ (e, e ).

Remark 16. It is important to stress that the sensitivity of a program in Λ p is not the number of times the program accesses its input. For instance, we obviously expect the single-hole context [-] to have sensitivity 1, and the zero-hole context , for a closed value , to have sensitivity 0. Up to this point indeed program sensitivity can be identi ed with the number of times inputs are used. However, it is reasonable to expect the context [-] or to have sensitivity 1 2 , since with probability 1 2 it will test its input (once), and with probability 1 2 it will not.

We can thus formulate a new notion of compatibility. We also remark that there are other reasonable notions of program sensitivity: for instance, we could have de ned the sensitivity of a context as a polynomial p bounding the testing power of the context. Our approach will be more abstract, allowing the sensitivity of a program to be any function satisfying some minimal structural properties, and thus leaving the freedom to choose the concrete notion of sensitivity that ts best the concrete calculus at hand. In fact, it turned out that program sensitivity can be seen as an instance of a more general notion, namely the one of a coe ect2 [START_REF] Brunel | A core quantitative coe ect calculus[END_REF][START_REF] Gaboardi | Combining e ects and coe ects via grading[END_REF][START_REF] Petricek | Coe ects: a calculus of context-dependent computation[END_REF].

The introduction of the notion of program sensitivity seems to allow to resolve many issues related to the notion of compositionality as de ned in Assumption 3. However, it also raises an important question: how can we track program sensitivity? To answer this question, we follow [START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF] and re nes Λ p in a linear-like calculus. The resulting calculus has a powerful type systems inspired by bounded linear logic [START_REF] Girard | Bounded linear logic: A modular approach to polynomial-time computability[END_REF] and, compared to other linear type systems, has the novelty of introducing types of the form ! s σ , where s is a non-negative real number modelling program sensitivity. Moreover, allowing the sensitivity of a program to be ∞, meaning that we are working with non-negative extended real numbers, we can model programs testing their input ad libitum. As a consequence, we can recover the full bang type !σ as ! ∞ σ .

Structure of the Analysis

At this point the reader should have enough intuitions and motivations to follow the rest of this dissertation. The latter is structured as follows. In Chapter 10 we introduce V-relations and their algebra, as well as the notion of a change of base functor [START_REF] Kelly | Basic concepts of enriched category theory[END_REF][START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF]. We will use the latter to de ne our abstract notion of program sensitivity. Having de ned a notion of program sensitivity, we de ne our vehicle calculus V-Fuzz. The latter is a generalisation of Reed's and Pierce's Fuzz [START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF], a PCF-like language with a powerful linear type system enriched with sensitivity-indexed 'bang types' that allow to track program sensitivity. V-Fuzz has two major di erences compared to Fuzz. First, V-Fuzz is parametrised by an arbitrary quantale and a signature of change of base functors. This allows V-Fuzz to model several concrete calculi as well as several notions of program sensitivity. Secondly, and most importantly, V-Fuzz is an e ectful calculus parametrised by a monad and a signature of (algebraic) operation symbols. As a consequence, V-Fuzz quali es as a re nement of Λ Σ , which we already argued by means of several examples to be good model for several e ectful calculi. For instance, V-Fuzz subsumes imperative, nondeterministic, and probabilistic versions of Fuzz, as well as combinations thereof.

Next, in Chapter 11 we introduce relators on V-relations, which we call V-relators. The resulting theory is the generalisation of the usual theory of relators as exposed in Chapter 4. We give examples of relevant relators, notably relators associated with the Hausdor [START_REF] Munkres | Topology[END_REF] and Wasserstein [START_REF] Villani | Optimal transport: Old and new[END_REF] distance.

Finally, in Chapter 12 we de ne a notion of e ectful applicative (bi)similarity distance for V-Fuzz, i.e. a V-relation (parametric with respect to a V-relator) generalising the notion of e ectful applicative (bi)similarity of Chapter 5. Our main theorem (Theorem 16) states that under suitable conditions on Vrelators, e ectful applicative similarity distance is a compatible (according to a suitable generalisation of Assumption 4), re exive, and transitive V-relation, and thus gives a compatible generalised metric in the sense of (F. [START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF]. Similarly, we show that under mild conditions on change of base functors, e ectful applicative bisimilarity distance is a compatible equivalence V-relation (Theorem 17), and thus gives a compatible pseudometric.

Chapter 10

An E ectful Calculus with Program Sensitivity

In language there are only di erences Ferdinand de Saussure, Course in General Linguistics

In this chapter we introduce V-relations and their algebra, as well as the notion of a change of base functor [START_REF] Kelly | Basic concepts of enriched category theory[END_REF][START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF]. The latter provides the mathematical instrument we use to de ne our abstract notion of program sensitivity.

We use change of base functors to de ne our vehicle calculus V-Fuzz. The latter is a generalisation of Reed's and Pierce's Fuzz [START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF], a PCF-like language with a powerful linear type system enriched with sensitivity-indexed 'bang types' that allow to track program sensitivity. V-Fuzz has two major di erences compared to Fuzz. First, V-Fuzz is parametrised by an arbitrary quantale and a signature of change of base functors. This allows V-Fuzz to model several concrete calculi as well as several notions of program sensitivity. Secondly, and most importantly, V-Fuzz is an e ectful calculus parametrised by a monad and a signature of (algebraic) operation symbols. As a consequence, V-Fuzz quali es as a re nement of Λ Σ , which we already argued by means of several examples to be good model for several e ectful calculi. Finally, following Chapter 3, we give V-Fuzz monadic operational semantics.

Quantales and Quantale-valued Relations

In this section we recall some necessary background notions on quantales [START_REF] Rosenthal | Quantales and their applications[END_REF] and quantalevalued relations (V-relations) along the lines of (F. [START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF]. The reader is referred to the monograph (Hofmann et al., 2014) for a comprehensive introduction.

De nition 61. A (unital) quantale V = (V, ≤, ⊗, k ) consists of a monoid (V, ⊗, k ) and a sup-lattice (V, ≤) satisfying the following distributivity laws:

b ⊗ i ∈I a i = i ∈I (b ⊗ a i ) ( i ∈I a i ) ⊗ b = i ∈I (a i ⊗ b).
The element k is called unit of the quantale, whereas ⊗ is called multiplication or tensor of the quantale. Given quantales V, W, a quantale lax morphism is a monotone map h : V → W satisfying the following inequalities:

≤ h(k ), h(a) ⊗ h(b) ≤ h(a ⊗ b),
where is the unit of W.

It is easy to see that ⊗ is monotone in both arguments. We denote the top and bottom element of a quantale by and , respectively (notice that we use the symbol to denote the bottom element of a quantale V, and the symbol ⊥ to denote the bottom element of a Σ-continuous monad). Moreover, we say that a quantale is commutative if its underlying monoid is such, and that it is non-trivial if k . Finally, we observe that for any a ∈ V, the map a ⊗ (-) : V → V has a right adjoint a (-) : V → V which is uniquely determined by the law:

a ⊗ b ≤ c ⇐⇒ b ≤ a c.
From now on we tacitly assume quantales to be commutative and non-trivial.

Example 54. The following are examples of quantales.

1. The boolean quantale 2 = (2, ≤, ∧, true) where 2 = {true, false} and false ≤ true.

2. The Lawvere quantale L = ([0, ∞], ≥, +, 0) consists of the extended real half-line ordered by the "greater or equal" relation ≥ and extended1 addition as monoid multiplication. Notice that in the Lawvere quantale the bottom element is ∞, the top element is 0, whereas in mum and supremum are de ned as sup and inf, respectively. Notice also that is truncated subtraction.

3. Replacing addition with maximum in the Lawvere quantale we obtain the strong Lawvere quantale SL = ([0, ∞], ≥, max, 0), which has been used to study generalised ultrametric spaces (J. [START_REF] Rutten | Elements of generalized ultrametric domain theory[END_REF]. In fact, in the strong Lawvere quantale tensor and meet coincide. (c) The Gödel t-norm: x * min{x, }.

6. The collection Rel(X , X ) of binary relations on a set X forms a quantale with monoid structure given by relation composition and the identity relation.

7. The structure (τ , ⊆, ∩, X ), where τ is a collection of open sets on a set X is a quantale. Here the join is de ned as , from which we can de ne arbitrary meets (notice that these are, in general, di erent from arbitrary intersections). More generally, recall that a frame [START_REF] Vickers | Topology via logic[END_REF] consists of a sup lattice (V , ≤, ) satisfying the following distributivity laws:

b ∧ i ∈I a i = i ∈I (b ∧ a i ) ( i ∈I a i ) ∧ b = i ∈I (a i ∧ b).
We see that any frame is a quantale. More speci cally, a frame is nothing but a quantale V with monoid structure given by the poset structure (V, , ).

8. All complete boolean and Heyting algebras are (trivially) quantales.

9. The three-element chain 3 = { , k, } is a quantale, with ≤ k ≤ . We can use 3 to model scenarios like the following one. Suppose we have a family of contexts C acting as experiments. Given two programs e, e we can test them against contexts in C. The output of the experiment performed by a context C is, as usual, an observation obs (C[e]). Each test can take only a given amount of time, after which the test fails (meaning that we were not able to prove neither the equivalence nor to discriminate between e and e ). In such a case we write obs (C[e]) ↑. We de ne the distance δ (e, e ) between e and e as the result of the whole experiment:

δ (e, e )            if ∃C ∈ C. obs (C[e]) obs (C[e ]) if ∀C ∈ C. obs (C[e]) = obs (C[e ]) k if ¬∃C ∈ C. obs (C[e]) obs (C[e ]) ∧ ∃C ∈ C.(obs (C[e]) ↑ ∨obs (C[e ]) ↑).
Obviously there are cases where performing the same experiment twice gives di erent results (e.g. consider the program (return ) or Ω), or we can extend old experiments with new ones (for instance by enlarging C). It thus makes sense to introduce an operation ⊗ to collect and update the results of experiments. Obviously, we expect ⊗ x = , as once we nd an experiment discriminating between e and e , we can tell them apart. Moreover, if an experiment gives result k at rst, but once repeated a second time gives a conclusive result x k, then it is desirable to have k ⊗ x = x. We can summarise these desiderata in the following multiplication table:

⊗ k k k
It is a straightforward exercise to verify that (3, ≤, ⊗, k ) is a quantale.

With the exception of Rel(X , X ) and the three-element 3, all quantales mentioned in Examplex 54 have unit k coinciding with the top element . Quantales with such property are called integral quantales, and are particularly well-behaved. For instance, in an integral quantale a ⊗ b is a lower bound of a and b (and thus a ⊗ = , for any a ∈ V). For instance, by monotonicity of tensor products we have:

a ⊗ b ≤ a ⊗ = a ⊗ k = a.
Due to their nice properties, we will work with integral quantales only. In particular, from now on we tacitly assume all quantales to be integral.

Having de ned quantales, we can now de ne quantale-valued relations. As we have already stressed, the notion of a V-relation, for a quantale V, provides an abstraction of the notion of a relation that subsumes both the qualitative (i.e. boolean valued) and the quantitative (i.e. real valued) notion of a relation. Moreover, sets and V-relations form a category which, thanks to the quantale structure of V, behaves essentially like Rel. That allows to develop an algebra of V-relations on the same line of the usual algebra of relations.

Formally, for a quantale V = (V, ≤, ⊗, k ), a V-relation α : X + → Y between sets X and Y is a function α : X × Y → V. For any set X we can de ne the identity V-relation I X : X + → X mapping diagonal elements (x, x ) to k, and all other elements to . Moreover, for V-relations α : X + → Y and β : Y + → Z , we can de ne the composition β • α : X + → Z by the so-called 'matrix multiplication formula':

(β • α )(x, z) ∈Y α (x, ) ⊗ β ( , z).
Composition of V-relations is associative, and I is the unit of composition. As a consequence, we have that sets and V-relations form a category, called V-Rel. V-Rel is a monoidal category with unit given by the one-element set and tensor product given by cartesian product of sets with α ⊗ β : X × Y + → X × Y , for α : X + → X and β : Y → Y , de ned pointwise. Moreover, for all sets X , Y , the hom-set V-Rel(X , Y ) inherits a complete lattice structure from V according to the pointwise ordering. Actually, the whole quantale structure of V is inherited, in the sense that V-Rel is a quantaloid (Hofmann et al., 2014). In particular, for all V-relations α : X + → Y , β i : Y + → Z (i ∈ I ), and γ : Z + → W we have the following distributivity laws:

γ • ( i ∈I β i ) = i ∈I (γ • β i ), ( i ∈I β i ) • α = i ∈I (β i • α ).
There is a bijection -• : V-Rel(X , Y ) → V-Rel(Y , X ) that maps each V-relation α to its dual α • de ned by α • ( , x ) α (x, ). It is straightforward to see that -• is monotone (i.e. α ≤ β implies α • ≤ β • ), idempotent (i.e. (α • ) • = α), and preserves the identity V-relation (i.e. I • = I). Moreover, since V is commutative we also have the equality

(β • α ) • = α • • β • .
Finally, we de ne the graph functor G from Set to V-Rel acting as the identity on sets and mapping each function f to its graph (so that G ( f )(x, ) is equal to k if = f (x ), and otherwise). It is easy to see that since V is non-trivial G is faithful. In light of this observation we will use the notation f : X → Y in place of G ( f ) : X + → Y in V-Rel. A direct application of the de nition of composition gives the equality:

( • • α • f )(x, w ) = α ( f (x ), (w )) for f : X → Y , α : Y +
→ Z , and : W → Z . Moreover, it is useful to keep in mind the following adjunction rules (Hofmann et al., 2014) (for α, β, γ V-relations, and f , functions with appropriate source and target):

• α ≤ β ⇐⇒ α ≤ • • β, β • f • ≤ γ ⇐⇒ β ≤ γ • f .
The above inequalities turned out to be useful in making pointfree calculations with V-relations. In particular, we can use lax commutative diagrams of the form

X ≤ f / / α _ Z β _ Y / / W
as diagrammatic representation for the inequality •α ≤ β • f . By adjunction rules, the latter is equivalent to α ≤ • • β • f , which, pointwise, gives the following generalised non-expansiveness condition2 : ∀(x, ) ∈ X × Y . α (x, ) ≤ β ( f (x ), ( )). Among V-relations we are interested in those generalising equivalences and pseudometrics.

De nition 62. A V-relation α :

X + → X is re exive if I X ≤ α, transitive if α • α ≤ α, and symmetric if α ≤ α • .
When read pointwise, re exivity, transitivity, and symmetry give the following inequalities:

k ≤ α (x, x ) α (x, ) ⊗ α ( , z) ≤ α (x, z) α (x, ) ≤ α ( , x ),
for all x, , z ∈ X . We call a re exive and transitive V-relation a preorder V-relation (V-preorder, for short), and a re exive, symmetric, and transitive V-relation an equivalence V-relation (V-equivalence, for short).

Example 55. We have already seen that instantiating the transitivity formula on the boolean, Lawvere, and strong Lawvere quantale we recover the notion of (boolean) transitivity, triangle inequality, and strong triangle inequality, respectively. Proceeding in a similar fashion with re exivity (resp. re exivity and symmetry), we see that V-preorders (resp. V-equivalences) generalise preorder (resp. equivalence), generalised metric (resp. pseudometric), and generealised ultrametric (resp. ultra-pseudometric) spaces, respectively. These correspondences are summarised in Table 10.1, where R :

X + → X is a 2-relation, µ : X + → X is a L-relation, and p : X + → X is a SL-relation Boolean Lawvere Strong Lawvere true ≤ R (x, x ) 0 ≥ µ (x, x ) 0 ≥ p(x, x ) R (x, ) ≤ R ( , x ) µ (x, ) ≥ µ ( , x ) p(x, ) ≥ p( , x ) R (x, ) ∧ R ( , z) ≤ R (x, z) µ (x, ) + µ ( , z) ≥ µ (x, z) max(p(x, ), p( , z)) ≥ p(x, z)
Table 10.1: Correspondences re exivity-symmetry-transitivity.

Remark 17 (V-categories). In his seminal paper (F. [START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF] Lawvere introduced generalised metric spaces as L-preorder spaces, i.e. pairs (X , α ) consisting of a set X and an L-preorder α : X + → X . Generalising from the Lawvere quantale to an arbitrary quantale V we obtain the so-called V-categories (Hofmann et al., 2014). In fact, a V-category (X , α ) is nothing but a category enriched over V regarded as a bicomplete monoidal category. The notion of a V-enriched functor instantiates to the notion of a non-expansive map between V-categories, so that one can consider the category V-Cat of V-categories and V-functors. The category V-Cat has a rich structure. In particular, it is a (symmetric) monoidal closed category. Given V-categories (X , α ), (Y , β ), their exponential (Y X , [α, β]) is de ned by [α, β]( f , )

x ∈X β ( f (x ), (x )), whereas their tensor product (X × Y , α ⊗ β ) is de ned pointwise. Instantiating V-Cat with the boolean, Lawvere, and strong Lawvere quantale we obtain the category of preorders and monotone function, the category of generalised metric spaces and non-expansive maps, and the category of generalised ultrametric spaces and non-expansive maps, respectively. In particular, given monotone/non-expansive functions f , : X → Y , relations R : X + → X , S : Y + → Y , and generalised (ultra)metrics µ :

X + → X , ν : Y +
→ Y , we see that we have:

[R, S]( f , ) ⇐⇒ ∀x. f (x ) S (x ) [µ, ν ]( f , ) = sup x ν ( f (x ), (x )).
Finally, we observed that given V-categories (X , α ), (Y , β ) and V-enriched functors we can equivalently express [α, β]( f , ) as

x ,x ∈X α (x, x ) β ( f (x ), (x )).
In fact, since α is re exive, for all x ∈ X we have:

α (x, x ) β ( f (x ), (x )) = (α (x, x ) β ( f (x ), (x ))) ⊗ k ≤ (α (x, x ) β ( f (x ), (x ))) ⊗ α (x, x ) ≤ β ( f (x ), (x )),
from which we conclude x ,x α (x, x ) β ( f (x ), (x )) ≤ x β ( f (x ), (x )). Dually, since f is a Venriched functor and β is transitive, for all x, x we have:

α (x, x ) ⊗ x β ( f (x ), (x )) ≤ α (x, x ) ⊗ β ( f (x ), (x )) ≤ β ( f (x ), f (x )) ⊗ β ( f (x ), (x )) ≤ β ( f (x ), (x )).
By adjunction, we can infer x β ( f (x ), (x )) ≤ α (x, x ) β ( f (x ), (x )), and thus x β ( f (x ), (x )) ≤

x ,x α (x, x ) β ( f (x ), (x )).

Although here we do not work with V-categories (we work in V-Rel only), it is sometimes useful to think in terms of V-categories for 'semantical intuitions'.

Operations and Change of Base Functors

Since e ects in V-Fuzz will be speci ed by means of a signature Σ of operation symbols, we need to specify how operations in Σ interact with V-relations (e.g. how they modify distances), and thus how they interact with quantales. For simplicity, we will consider only nitary operation symbols. Although we conjecture our results to hold also for generalised operations, the latter are not very natural in V-Fuzz, as they would require to work in an in nitary type system. Nonetheless, we will give some hints on how to extend our de nitions to generalised operations too.

De nition 63. Let Σ be a signature consisting of nitary operation symbols only. A Σ-quantale is a quantale V equipped with monotone operations op V : V n → V, for each n-ary operation op ∈ Σ, satisfying the following inequalities:

k ≤ op V (k, . . . , k ), op V (a 1 , . . . , a n ) ⊗ op V (b 1 , . . . , b n ) ≤ op V (a 1 ⊗ b 1 , . . . , a n ⊗ b n ).
Example 56. Both in the Lawvere quantale and in the unit interval quantale we can interpret the fair probabilistic choice operation symbol or as:

x or W 1 2 •x + 1 2 •
, where W ranges over {[0, ∞], [0, 1]}. More generally, we can interpret the (unfair) p-probabilistic choice operation symbol or p , where p is a rational number in [0, 1], as x or p W p • x + (1p) • . In general, for a quantale V we can always interpret op V (a 1 , . . . , a n ) both as a 1 ⊗ . . . ⊗ a n and as a 1 ∧ . . . ∧ a n . In order to have a clear intuition about the above interpretation of operation symbols, it is useful to look at the result of the evaluation of a program as a computation tree. Recall from Chapter 2 that each node in a computation tree is labelled by an operation symbol op which corresponds to the evaluation of a computation of the form op(e 1 , . . . , e n ). Each subtree of the node represents the result of the evaluation of one of the continuations e 1 , . . . , e n . As a consequence, the interpretation of op as a tensor product corresponds to the view that all distances observed in each possible continuation should be accumulated, whereas the interpretation of op as binary meet states that the observed distance is obtained by taking the maximal distance observed in each possible continuation.

It is easy to see that we can extend De nition 63 to generalised operation symbols as follows. Given an operation op : P I , let k : I → V be the constant function mapping each i ∈ I to k. Then we require op V to satisfy the following inequalities:

k ≤ op V (p, k ) op V (p, κ) ⊗ op V (p, ν ) ≤ op V (p, κ ⊗ ν ),
where κ ⊗ ν is de ned pointwise. We also require op V to be monotone in its second argument, where the order on V I is de ned pointwise.

Finally, we introduce the notion of a change of base functor (Hofmann et al., 2014;[START_REF] Kelly | Basic concepts of enriched category theory[END_REF][START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF]. As stressed in Chapter 9, we model program sensitivity as a function giving the 'law' describing how much distances between inputs are modi ed by the program. The notion of a change of base functor provides a mathematical abstraction to model the concept of program sensitivity with respect to an arbitrary quantale.

De nition 64. A change of base functor, CBF for short, between quantales V, W is a lax quantale morphism h : V → W (see De nition 61). If V = W we speak of change of base endofunctors (CBEs, for short), and denote them by s, r . . .. Clearly, every CBE s is also a CBF.

The action

h • α of a CBF h : V → W on a V-relation α : X + → Y is de ned by h • α (x, ) h(α (x,
)) (to improve readability we omit brackets). Notice that since V is integral, CBFs preserve the unit k.

Example 57.

1. We de ne (extended) multiplication by a constant c ∈ [0, ∞] as the function c • (-) : [0, ∞] → [0, ∞] de ned as follows, where x < ∞:

0 • ∞ 0 ∞ • 0 0 ∞ • x ∞ x • ∞ ∞.
Extended multiplication by a constant is a CBE on the Lawvere quantale. Moreover, it also acts as a CBE on the unit interval quantale, where multiplication is meant to be truncated.

Our de nition of extended multiplication is di erent from the one given in [START_REF] De Amorim | A semantic account of metric preservation[END_REF], where extended multiplication is de ned as follows (with 0):

x • ∞ ∞ ∞ • 0 0 ∞ • ∞.
Despite making extended multiplication non-commutative, the above de nition does not t with our intuition about program sensitivity. In fact, according to our informal reading, the equality 0 • ∞ = 0 expresses the principle that if we test observationally distinguishable objects zero times (i.e. we do not test them at all), then we are not able to tell them apart. Dually, the equality ∞ • 0 = 0 states that observationally indistinguishable objects cannot be told apart, no matter how many times are tested.

We should also remark that although our de nition of extended multiplication agrees with our intuition of program sensitivity, it has the drawback of being non-continuous. For instance, consider the set

X = {ε | ε > 0}. Continuity requires ∞ • inf X = inf (∞ • X ), which is obviously not the case since ∞ • inf X = ∞ • 0 = 0 and inf {∞ • ε | ε > 0} = inf ∞ = ∞.

2.

Another interesting example of a CBE both on the Lawvere and the unit interval quantale is provided by polynomials P such that P (0) = 0. Such polynomials can be used to express sensitivity of context having only polynomial testing power (meaning that contexts are required to be able to discriminate programs e ciently).

3. More generally, given a quantale V we can de ne CBEs n, ∞ : V → V, for n < ω as follows:

0(a) k (n + 1)(a) a ⊗ n(a)

∞(a)

.

Notice that 1 acts as the identity function, and that on the Lawvere and unit interval quantale we have n(c) = n • c and ∞(c) = ∞.

4. An important example of CBFs is given by the map ψ : 2 → V and its right adjoint φ : V → 2 de ned by:

φ(k ) true ψ (true) φ(a) false ψ (false) .
Intuitively, the map φ is used to collapse distances into relations, whereas ψ is used to translate a relation into a (trivial) distance.

Finally, we observe that the action of CBFs on a V-relation obeys the following laws:

(h • h )(α ) = h • (h • α ), (h • α ) • (h • β ) ≤ h • (α • β ).
Remark 18. We saw that V-categories generalise both generalised metric spaces and preorders, and that V-functors generalise both monotone and non-expansive functions. However, when dealing with metric-like spaces, besides non-expansive functions a prominent role is played by Lipshitz-continuous functions [START_REF] Searcóid | Metric spaces[END_REF]. Given metric-like spaces (X , µ) and (Y , ν ), a function f : X → Y is said to be c-continuous, for c ∈ R ≥0 , if the inequality

c • µ (x, x ) ≥ ν ( f (x ), f (x ))
holds, for all x, x ∈ X . Example 57 shows that multiplication by a (possibly extended) non-negative real number c is a change of base endofunctor on the Lawvere quantale, meaning that using CBEs we can generalise the notion of Lipshitz-continuity to V-categories. In fact, easy calculations show that for any V-category (X , α ) and any CBE s on V, (X , s • α ) is a V-category. Moreover, since CBEs are monotone, such an operation is functorial (with morphism left unchanged). In particular, we can de ne s-continuous functions from (X , α ) to (Y , β ) as V-functors from (X , s • α ) to (Y , β ). That is, we say that a function f :

X → Y is s-continuous if s • α (x, x ) ≤ β ( f (x ), f (x ))
holds, for all x, x ∈ X .

We conclude this section with the following useful result on the algebra of CBEs.

Lemma 36. Let V be a Σ-quantale. CBEs are closed under the following operations (where op is an n-ary operation symbol in Σ):

(s ⊗ r )(a) s (a) ⊗ r (a) (r • s)(a) r (s (a)) (s ∧ r )(a) = s (a) ∧ s (b) op V (s 1 , . . . , s n )(a)
op V (s 1 (a), . . . , s n (a)).

The proof of Lemma 36 is straightforward. Moreover, we can extend its content to generalised operations as follows. Let op : P I be a generalised operation, and let κ be a function mapping each i ∈ I to a CBE κ (i). We de ne the CBE op V (p, κ) by:

op V (p, κ)(a) op V (p, i → κ i (a)).
It is easy to see that op V (p, κ) is indeed a CBE. For instance, suppose a ≤ b. Since κ i is a CBE, we have κ i (a) ≤ κ i (b), for any i ∈ I . It follows that i → κ i (a) ≤ i → κ i (b), and thus op

V (p, i → κ i (a)) ≤ op V (p, i → κ i (b)), since op V is monotone.

The V-Fuzz Language

As already observed in Chapter 9, when dealing with behavioural V-relations a crucial parameter in distance trivialisation is program sensitivity. To deal with such parameter we now introduce V-Fuzz, a higher-order ne-grain λ-calculus extending Fuzz [START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF] with algebraic operations. As Fuzz, V-Fuzz is characterised by a powerful linear type system with sum and recursive types inspired by bounded linear logic [START_REF] Girard | Bounded linear logic: A modular approach to polynomial-time computability[END_REF] giving syntactic information on program sensitivity. The syntax of V-Fuzz is parametrised by a signature Σ of operation symbols, a Σ-quantale V, and a family Π of CBEs. From now on we assume Σ, V, and Π to be xed. Moreover, we assume Π to contain Γ v fold : µt.σ Before giving examples of concrete instances of V-Fuzz, let us comment some of the typing rules in Figure 10.2. Most of these rules are similar to those of Fuzz (e.g. in the variable rule we require s ≤ 1, meaning that the open value x can access x at least once) with the exception of the rule for sequencing and the rule for operation symbols (which is just not present in Fuzz, the latter not having algebraic operations). Concerning the former, let us consider the following instance of the sequencing rule on the unit interval quantale:

Γ v : µt.σ ∆, x : s σ [µt.σ /t] Λ e : τ s • Γ ⊗ ∆ Λ case of {fold x → e} : τ Γ 1 Λ e 1 : σ • • • Γ n Λ e n : σ op V (Γ 1 , . . . , Γ n ) Λ op(
x : 1 σ Λ e : σ : 0 σ Λ f : τ x : max(0,1) •1 σ Λ let = e in f : τ where f is a closed term of type τ , so that we can assume it to have sensitivity 0 on all variables. According to our informal intuition, e has sensitivity 1 on input x, meaning that (i) e can possibly detect (behavioural) di erences between input values , w, and (ii) e cannot amplify their behavioural distance of a factor bigger than 1. Formally, point (ii) states that we have the inequality α ( , w ) ≥ α (e[x := ], e[x := w]), where α denotes a suitable behavioural I-relation. On the contrary, f is a closed term and thus has sensitivity 0 on any input, meaning that it cannot detect any observable di erence between input values. In particular, for all values , w we have α ( f

[ := ], f [ := w]) = α ( f , f ) = 0
(provided that α is re exive). Replacing max(0, 1) with 0 in the above rule (i.e. s ∧ 1 with s in the general case) would allow to infer the judgment x : 0 σ Λ let = e in f : τ , and thus to conclude α (let = e[x := ] in f , let = e[x := w] in f ) = 0. The latter equality is unsound as evaluating let = e[x := ] in f (resp. let = e[x := w] in f ) requires to rst evaluate e[x := ] (resp. e[x := w]) thus making observable di erences between and w detectable (see also Section 12.1 for a formal explanation).

Relevant Examples

Example 58. Instantiating V-Fuzz with the empty signature, the Lawvere quantale, and CBEs Π = {c • (-) | c ∈ [0, ∞]} we obtain the original Fuzz of [START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF]. Actually, to recover full Fuzz we should add a basic type for real numbers, as well as primitive operations on its inhabitant. We can also add nondeterminism considering the signature Σ FM .

Example 59. A more interesting calculus is obtained by instantiating V-Fuzz with the signature Σ DM , the unit interval quantale, and CBEs Π = {c • (-) | c ∈ [0, ∞]} ] (as usual we are actually referring to truncated multiplication). We refer to the calculus those obtained as P-Fuzz. The interpretation of the operation symbol or on [0, 1] is de ned as in Example 56. In particular, we have the following typing rule:

Γ Λ e : σ ∆ Λ f : σ

1 2 • Γ + 1 2 •
∆ Λ e or f : σ As a consequence, we see that we have

x : 1 σ v x : σ x : 1 σ Λ return x : σ x : 0 σ v : σ x : 0 σ Λ return : σ x : 1 2 σ Λ (return x ) or (return )
for any value ∈ V σ

• . This witnesses that the notion of program sensitivity cannot be identi ed with the number of times programs access their inputs, as already (informally) remarked in Chapter 9.

Example 60. Let V be a frame, i.e. a quantale such that ∧ and ⊗ coincide. Taking the empty signature, we see that V-Fuzz gives a linear-like λ-calculus as follows. We take Π {0, 1, ∞}. Since V is a frame, obviously Π is closed under operations of Lemma 36. The type ! 0 has as inhabitants those values that cannot be used, whereas the types ! 1 and ! ∞ have as inhabitants those values that can be use linearly and as libitum, respectively. (V-rel 5).

I T X ≤ Γ(1 X ) (V-rel 1) Γβ • Γα ≤ Γ(β • α ) (V-rel 2) T f ≤ Γ f , (T f ) • ≤ Γ f • (V-rel 3) α ≤ β =⇒ Γα ≤ Γβ (V-rel 4) Γ(α • ) = (Γα ) • . (V-rel 5)
It is immediate to see that when instantiated with V = 2, the above de nition gives the usual notion of relator as de ned in Chapter 4. We also observe that any V-relator Γ for T induces an endomap T Γ on V-Rel that acts as T on sets and as Γ as V-relation. It is easy to check that conditions in De nition 66 makes T Γ a lax endofunctor.

Before giving examples of V-relators it is useful to observe that the collection of V-relators is closed under speci c operations.

Proposition 25. Let T , U be functors, UT be their composition, Γ, ∆ be relators for T and U , respectively, and {Γ i } i ∈I be a family of relators for T . Then:

1. The map ∆ • Γ de ned by (∆ • Γ)α ∆Γα is a V-relator for UT .

The map

i ∈I Γ i de ned by ( i ∈I Γ i )α i ∈I Γ i α is a V-relator for T . 3. The map Γ • de ned by Γ • α (Γα • ) • is a V-relator for T .
4. The map Γ ∧ Γ • is the greatest conversive V-relator smaller than Γ.

Proof. The proof consists of a number of straightforward calculations. As an example, we show that i ∈I Γ i in point 2 satis es condition (V-rel 2). Concretely, we have to prove

i ∈I Γ i β • i ∈I Γ i α ≤ i ∈I Γ i (β • α ).
For that it is su cient to prove that for any j ∈ I we have:

i ∈I Γ i β • i ∈I Γ i α ≤ Γ j (β • α ).
Observe that we have i ∈I Γ i β ≤ Γ j β and i ∈I Γ i α ≤ Γ j α, so that by monotonicity of composition (recall that V-Rel is a quantaloid) we infer

i ∈I Γ i β • i ∈I Γ i α ≤ Γ j β • Γ j α.
The thesis now follows from (V-rel 2).

As we have already seen working with Λ Σ , relators for a functor do not have enough structure to guarantee e ectful applicative (bi)similarity to be compatible, so that we worked with the richer notion of a relator for a monad. This essentially holds for V-Fuzz too. However, what we need in order to prove applicative distance(s) to be compatible are not relators for monads, but relators for strong monads.

The reason behind such requirement can be intuitively understood as follows. Recall that by Proposition 24 we have (for readability we omit types) let x = e in f = f [x := -] † e . This operation can be described using the bind operator >>=: T X × (X → TY ) → TY , so that we have let

x = e in f = e >>= f [x := -] . Let now f , : X → Y be functions, α : X + → X , β : Y + → Y be V-relations,
and Γ be a V-relator for T . Considering the compound V relation [α, Γβ] ⊗ Γα (see Remark 17) and ignoring issues about sensitivity, it is then natural to require >>= to be non-expansive. That is, we require the inequality

[α, Γβ]( f , ) ⊗ Γα (x, y) ≤ Γβ (x >>= f , y >>= ) i.e. x ∈X Γβ ( f (x ), (x )) ⊗ Γα (x, y) ≤ Γβ (x >>= f , y >>= ).
Informally, we are requiring the behavioural distance between sequential compositions of programs to be bounded by the behavioural distances between their components (this is of course a too strong requirement, but at this point it should be clear to the reader that it is su cient to require >>= to be Lipshitz-continuous, rather than non-expansive). Since >>= is nothing but the strong Kleisli extension apply * of the application function apply : (X → TY )×X → TY (which is de ned by apply( f , x ) f (x )), what we need to do is indeed to extend strong monads from Set to V-Rel, laxly.

De nition 67. Let T = T , η, - * be a strong monad, and Γ be a V-relator for T . We say that Γ is an L-continuous V-relator for T if it satis es the following conditions for any CBE s ≤ 1.

s • Γα = Γ(s • α ) (L-dist) α ≤ η • Y • Γα • η X (Lax unit) γ ⊗ (s • α ) ≤ • • Γβ • f =⇒ γ ⊗ (s • Γα ) ≤ ( * ) • • Γβ • f * (Strong lax bind)
We can represent conditions (Lax unit) and (Strong lax bind) with the following lax commutative diagrams:

X ≤ η X / / α _ T X Γα _ Y η Y / / TY Z × X ≤ f / / γ ⊗α _ TY Γβ _ Z × X / / TY =⇒ Z × T X ≤ f * / / γ ⊗Γα _ TY Γβ . _ Z × T X * / / TY
The condition s ≤ 1 re ects the presence of s ∧ 1 in the typing rule for sequencing and it will be fundamental for our distances to be sound. Conditions (Lax unit) and (Strong lax bind) state nonexpansiveness of unit and strong Kleisli extension (this is particularly clear when instantiated on the Lawvere quantale). Condition (L-dist) makes strong Kleisli extension Lipshitz-continuous with respect to CBEs. In fact, we can replace conditions (L-dist) and (Strong lax bind) with the following condition:

γ ⊗ (s • α ) ≤ • • Γ(r • β ) • f =⇒ γ ⊗ (s • Γα ) ≤ ( * ) • • (r • Γβ ) • f * (L-Strong lax bind)
where s, r ≤ 1. Diagrammatically, we can express (L-Strong lax bind) as follows:

Z × X ≤ f / / γ ⊗s•α _ TY Γ(r •β ) _ Z × X / / TY =⇒ Z × T X ≤ f * / / γ ⊗(s•Γα ) _ TY r •Γβ . _ Z × T X * / / TY We immediately see that (L-dist) and (Strong lax bind) implies (L-Strong lax bind): γ ⊗ (s • α ) ≤ • • Γ(r • β ) • f =⇒ γ ⊗ Γ(s • α ) ≤ ( * ) • • Γ(r • β ) • f * [By (Strong lax bind)] =⇒ γ ⊗ (s • Γα ) ≤ ( * ) • • (r • Γβ ) • f * [By (L-dist)].
Dually, we can decompose (L-Strong lax bind) in the following two conditions, where s ≤ 1:

γ ⊗ (s • α ) ≤ • • Γβ • f =⇒ γ ⊗ (s • Γα ) ≤ ( * ) • • Γβ • f * (L-Strong lax bind 1) γ ⊗ α ≤ • • Γ(s • β ) • f =⇒ γ ⊗ Γα ≤ ( * ) • • (s • Γβ ) • f * (L-Strong lax bind 2)
Instantiating (L-Strong lax bind 1) with Kleisli extension (rather than strong Kleisli extension) we obtain:

(Lax unit) =⇒ s • α ≤ η • Y • Γ(s • α ) • η X =⇒ Γ(s • α ) ≤ (η † Y ) • • (s • Γα ) • η † X [By (L-Strong lax bind 1)] =⇒ Γ(s • α ) ≤ s • Γα.
In a similar fashion, using condition (L-Strong lax bind 2) we can prove Γ(s • α ) ≤ s • Γα, and thus conclude (L-dist).

Before giving some relevant examples of V-relator, we observe that we can extend Proposition 10 to V-relators, provided that the CBEs are lattice morphisms, i.e. provided that the equality s

(a ∧ b) = s (a) ∧ s (b) (and thus s • (α ∧ β ) = (s • α ) ∧ (s • β )) holds, for any CBE s and elements a, b ∈ V. In fact, if that is the case, then Γ(s • α ) = s • Γα and ∆(s • α ) = s • ∆α imply: (Γ ∧ ∆)(s • α ) = Γ(s • α ) ∧ ∆(s • α ) = (s • Γα ) ∧ (s • ∆α ) = s • (Γα ∧ ∆α ) = s • ((Γ ∧ ∆)α ). To see that s • Γ • α = Γ • (s • α ) it is su cient to observe that s • α • = (s • α ) •
. This shows that if Γ, ∆ are relators (for a functor T ) satisfying condition (L-dist), then so are Γ ∧ ∆ and Γ • . A similar result can be proved for conditions (Lax unit) and (Strong lax bind) along the lines of the proof of Proposition 10.

Relevant Examples

Example 62. For the partiality monad M we de ne the V-relator M as:

Mα (x, y)            α (x, ) if x = just x, y = just k if x = ⊥ otherwise.
It is easy to see that M de nes a relator for M satisfying conditions (Lax unit) and (Strong lax bind). We also see that M satis es condition (L-dist), where the condition s ≤ 1 turns out to be crucial. In fact, we see that M(s • α )(just x, ⊥) = and (s • Mα )(just x, ⊥) = s ( ). Since s ≤ 1, we have s ( ) ≤ , and thus s ( ) = , as desired.

To see the problem related with CBEs greater than 1, let us consider the Lawvere quantale with CBEs given by extended multiplication by a constant. Let us consider a convergent program e (meaning that e = just , for some value ) and a divergent program f (meaning that f

= ⊥). Given a [0, ∞]- relation α, we have 0 • Mα (e, f ) = 0 • ∞ = 0, although M(0 • α )(e, f ) = ∞,
which is a rather undesired behaviour. Finally, we also have the conversive relator M ∧ M • .

In Chapter 4 we showed how to sum monads and relators. It is immediate to see that the sum of monads extends to strong monads (we simply replace Kleisli extensions with strong Kleisli extensions). Similarly, we can also de ne the sum of V-relators.

Proposition 26. Given a strong monad T = T , ε, -T with a V-relator Γ for it, if Γ satis es condition (ind V 1) in De nition 69, then Γ M is a relator for TM = T M, η, -TM .

Proving Proposition 26 is rather straightforward. For instance, we have:

s • Γ Mα = s • Γ( Mα ) = Γ(s • Mα ) = Γ( M(s • α )) = Γ M(s • α ).
In order to show that Γ M satis es condition (Strong lax bind), however, we need Γ to satisfy condition (ind V 1). Let us assume such a condition and show that Γ M satis es (Strong lax bind). For that, we assume

γ ⊗ α ≤ • • Γ Mβ • f , and show γ ⊗ Γ Mα ≤ • • Γ Mβ • f ,
where f , are functions with suitable source and target. As for the case of (boolean-valued) relators, we can easily derive the conclusion once we prove

γ (z, z ) ⊗ Mα (x, x ) ≤ Γ Mβ ( f ⊥ (z, x), ⊥ (z , x )), (11.1)
where for any function h : Z × X → T MY we de ne h ⊥ : Z × MX → T MY by:

h ⊥ (z, x)      h(z, x ) if x = just x ε MY (⊥) otherwise.
Again, proving (11.1) is mostly trivial, except for x = ⊥, in which case we have to prove γ (z, z ) ⊗ k ≤ Γ( Mβ )(⊥, ⊥ (z , x )). This is the case exactly if condition (ind V 1) holds.

Example 63. For the monad F we de ne the V-relator F (called generalised Hausdor lifting) as Fα (X, Y)

x ∈X ∈Y α (x, ).

If we instantiate V as the Lawvere quantale, then F gives the (non-symmetric) Hausdor lifting [START_REF] Searcóid | Metric spaces[END_REF] whereas F ∧ F • gives the usual Hausdor lifting. Similarly, when instantiating V as 2, F gives the (2-)relator F of Chapter 4. It is easy to verify that F is a relator for F that satis es conditions (Lax unit) and (Strong lax bind). However, F does not satisfy (L-dist), in general. In fact, for that to be the case we need CBEs to be continuous.

Example 64. We now introduce one of the most interesting V-relators we will deal with. Let as instantiate V as the unit interval quantale I. We de ne the map D as the Wasserstein-Kantorovich lifting [START_REF] Villani | Optimal transport: Old and new[END_REF]. Recall that for µ ∈ D (X ), ν ∈ D(Y ), we denote by Ω(µ, ν ) the set of couplings of µ and ν. De ne Dα, for α : X + → Y as follows:

Dα (µ, ν ) inf ω ∈Ω(µ,ν ) x , α (x, ) • ω (x, ).
Remarkably, Dα (µ, ν ) attains its in mum and has a dual characterisation.

Proposition 27. Let µ ∈ D(X ), ν ∈ D (Y ) be countable distributions and α : X + → Y be a I-relation. Then: Proof. The proof is a direct consequence of the following duality theorem for countable transportation problems [START_REF] Kortanek | Discrete in nite transportation problems[END_REF] (Theorem 2.1 and 2.2).

Dα (µ, ν ) = min{ x , α (x, ) • ω (x, ) | ω ∈ Ω(µ, ν )} = max{ x a x • µ (x ) + b • ν ( ) | a x + b ≤ α (x,
Fact 1. Let i, j, . . . range over natural numbers. Let m i , n j , c i j be non-negative real numbers, for all i, j. De ne

M inf { i,j c i j x i j | x i j ≥ 0, j x i j = m i , i x i j = n j , } M * sup{ i m i a i + j n j b j | a i + b j ≤ c i j , a i , b j bounded}.
Then the following hold:

1. M = M * . 2. The linear problem P induced by M has optimal solution. 3. The linear problem P * induced by M * has optimal solution.

First of all we notice that Dα

(µ, ν ) is nothing but inf { x , α (x, ) • ω (x, ) | ω (x, ) ≥ 0, ω (x, ) = µ (x ), x ω (x, ) = ν ( )}.
In fact, ω (x, ) ≥ 0, ω (x, ) = µ (x ) and x ω (x, ) = ν ( ) imply ω ∈ D(X × Y ). Moreover, since α is a I-relation, α (x, ) ∈ [0, 1] (recall that Fact 1 requires c i j to be a non-negative real number). We conclude the thesis by Fact 1. In particular, it follows that there exists ω ∈ Ω(µ, ν ) such that:

Dα (µ, ν ) = x , α (x, ) • ω (x, ). Since α (x, ), ω (x, ) ∈ [0, 1] we have α (x, ) • ω (x, ) ≤ ω (x, ), for all x, . It follows 0 ≤ x , α (x, ) • ω (x, ) ≤ x , ω (x, ) = 1 so that Dα is indeed a [0, 1]-relation.
Using Proposition 27 we can show that D indeed de nes a relator for D (but see Remark 20). We now prove that D is also a relator for D.

Proposition 28. Wasserstein lifting D satis es all conditions in De nition 67.

Proof. We start by showing that D satis es condition (Lax unit). It is convenient to work with the following notation: given an element x ∈ X we denote by |x the Dirac distribution on x, i.e. η X (x ), where η is the unit of D. We have to show that for any z ∈ X , w ∈ Y , α (z, w ) ≥ Dα (|z , |w ) holds. By duality (Proposition 27) we have: We now show that D satis es condition (Strong lax bind). Concretely, that amounts to prove the following implication:

Dα (|z , |w ) = max{ x a x • |z (x ) + b • |w ( ) | a x + b ≤ α (x, )},
U × X ≥ f / / γ +α _ DZ Dβ _ V × Y / / DW =⇒ U × DX ≥ f * / / γ + Dα _ DZ Dβ . _ V × DY * / / DW
We show that for any u ∈ U , ∈ V , µ ∈ DX , ν ∈ DY we have:

Dβ ( f * (u, µ), * ( , ν )) ≤ γ (u, ) + Dα (µ, ν )
(notice that in the right hand side of the above equations we can assume without loss of generality to have ordinary addition in place of truncated sum). By very de nition of strong Kleisli extension we have:

f * (u, µ)(z) = x µ (x ) • f (u, x )(z) * ( , ν )(w ) = ν ( ) • ( , )(w ). Let m Dβ ( f * (u, µ), * ( , ν )). By duality we have: m = max{ z a z • x µ (x ) • f (u, x )(z) + w b w • ν ( ) • ( , )(w ) | a z + b w ≤ β (z, w )},
where a z and b w are bounded. By Proposition 27, there exists ω ∈ Ω(µ, ν ) such that Dα (µ, ν ) = x , ω (x, ) • α (x, ). We have to prove:

m ≤ γ (u, ) + x , ω (x, ) • α (x, ).
From ω ∈ Ω(µ, ν ) we obtain µ (x ) = ω (x, ), ν ( ) = x ω (x, ). We apply the above equalities to m, obtaining (for readability we omit the constraint a z + b w ≤ β (z, w )): )).

m = max{ z a z • x µ (x ) • f (u, x )(z) + w b w • ν ( ) • ( , )(w )} = max{ z a z • x , ω (x, ) • f (u, x )(z) + w b w • x , ω (x, ) • ( , )(w )} = max{ x , ω (x, )( z a z • f (u, x )(z) + w b w • ( , )(w ))} = x , ω (x, ) • max{ z a z • f (u, x )(z) + w b w • ( , )(w )} = x , ω (x, ) • Dβ ( f (u, x ), ( ,
We are now in position to use our hypothesis, namely the inequality:

Dβ ( f (u, x ), ( , )) ≤ γ (u, ) + α ( f (u, x ), ( , ))
(notice that we actually have a stronger hypothesis, as the latter gives an inequality for truncated addition). We conclude:

m ≤ x , ω (x, ) • (γ (u, ) + α (x, )) = x , ω (x, ) • γ (u, ) + x , ω (x, ) • α (x, ) = γ (u, ) + x , ω (x, ) • α (x, )
(where in the last equality we used the fact that ω (x, ) ∈ Ω(µ, ν ) implies x , ω (x, ) = 1). We are done.

Proving that D satis es condition (L-dist) is straightforward. In fact, given c ∈ [0, 1] we have:

c • Dα (µ, ν ) = c • min{ x , α (x, ) • ω (x, ) | ω ∈ Ω(µ, ν )} = min{ x , c • α (x, ) • ω (x, ) | ω ∈ Ω(µ, ν )} = D(c • α )(µ, ν ).
Finally, we sum D and M obtaining a new relator DM for DM.

Example 65. Let us instantiate V as the strong Lawvere quantale. Given an alphabet A, de ne the SL-relation λ :

A ∞ + → A ∞ by: λ(w, u)      0 if u = w 2 lcp(w ,u ) otherwise,
where lcp(w, u) is the length of the longest common pre x of u and w. We then de ne the map O ∞ as follows, where α : X + → Y :

O ∞ α ( w, x , u, y ) max(λ(u, w ), ( M ∧ M • )α (x, y)). It is not hard to see that O ∞ is a conversive [0, ∞]-relator for O ∞ .
Remark 20. Following Subsection 4.3.1 we might ask whether there exist canonical V-relators for a monad. This is only partially the case. In fact, recall that De nition 22 crucially relies on the double nature of a relation, which can be viewed both as a morphism in Rel and as an object in Set. This is no longer the case for a V-relation, and thus it is not clear how to de ne the Barr extension of a functor T from Set to V-Rel. However, the Barr extension of T can be characterised in an alternative way if we assume T to preserves weak pullback diagrams (although the reader can see [START_REF] Hofmann | Topological theories and closed objects[END_REF][START_REF] Manes | Taut monads and t0-spaces[END_REF] for more general conditions). Let ξ : T 2 → 2 be the map de ned by ξ (x) = true if and only if x ∈ T {true}, where T {true} is the image of the map T ι for the inclusion ι : {true} → 2. That is, ξ (x) = true if and only if there exists an element y ∈ T {true} such that T ι(y) = x. Notice that this makes sense since T preserves monomorphisms (recall that we can describe monomorphism as weak pullbacks) and thus T ι : T {true} → T 2 is a monomorphism. We can now characterise T R without mentioning the graph of R:

T R (x, y) = true ⇐⇒ ∃w ∈ T (X × Y ).            T π 1 (w) = x, T π 2 (w) = y, ξ • T R (w) = true.
Since the existential quanti cation is nothing but the join of the boolean quantale 2, the above characterisation of T can be turned into a de nition of an extension of T to V-Rel parametric with respect to an map ξ : T V → V.

De nition 68. For a set endofunctor T and a map ξ : T V → V de ne the V-Barr extension T ξ of T to V-Rel with respect to ξ as follows:

T ξ α (x, y) w∈Ω(x,y) ξ • T α (w),
for x ∈ T X , y ∈ TY , where the set Ω(x, y) of generalised couplings of x, y is de ned by:

Ω(x, y) {w ∈ T (X × Y ) | T π 1 (w) = x, T π 2 (w) = y}.
We refer to ξ as the structure map, since it gives V the structure of a T -algebra. For instance, taking ξ : F V → V de ned by ξ (X)

X we recover the Hausdor lifting F ∧ F • . Similarly, taking ξ as the expectation function, so that ξ : D[0, 1] → [0, 1] is de ned by ξ (µ)

x x • µ (x ), we recover D. Using the map ξ : T V → V we can de ne an extension of T to V-Rel. However, such extension is in general not a V-relator. Nonetheless, under mild conditions on ξ and assuming T to preserve weak pullback, it is possible to show that T ξ is indeed a V-relator. The following proposition has been proved in (Clementino & Tholen, 2014;[START_REF] Hofmann | Topological theories and closed objects[END_REF] (a similar result for real-valued pseudometric spaces has been proved in [START_REF] Baldan | Behavioral metrics via functor lifting[END_REF], 2015)).

Proposition 29. Let T be a monad with carrier T preserving weak pullbacks, and ξ : T V → V be a structure map. If ξ satis es the following conditions, then T ξ is a conversive V-relator for T. Moreover, if conditions 1 and 2 belows are equalities, then T ξ is functorial.

1. ξ respect quantale multiplication:

T (V × V) ≤ T ⊗ / / ξ •T π 1 ,ξ •T π 2 T V ξ . V × V ⊗ / / V 2.
ξ respects the unit of the quantale:

T 1 ≤ T k / / ! T V ξ . 1 k / / V 3. ξ respects the order of the quantale. That is, the map φ → ξ • T φ, for φ : X → V, is monotone.
Finally, an open question (which the author has not yet investigated) concerns whether non-conversive V-relators can be de ned along the lines of Subsection 4.3.1. This is conjectured to be the case, provided that we replace stable preorders with stable generalised metrics, i.e. with functors F mapping each set X to a V-category (FX , α X ) such that for each map f :

X → Y in Set, F f : (FX , α X ) → (FY , α ) is a V-enriched functor.
At this point it should be clear to the reader that most of the relators studied in Section 4.3 are instances of more general V-relators when V = 2. We now make this observation formal. Recall the change of base functor ψ : 2 → V and its right adjoint φ : V → 2 of Example 57:

ψ (true) k φ(k ) true ψ (false) φ (
Γ R φ • Γ(ψ • R).
Moreover, since φ is the right adjoint of ψ we have the inequalities:

ψ • ∆ Γ R ≤ Γ(ψ • R) ∆ Γ (φ • α ) ≤ φ • Γα. If ∆ Γ (φ • α ) = φ • Γα, we say that Γ is compatible with φ.
Example 66. For T ∈ {M, F, D} we see that ∆ T = T and

∆ T∧ T • = T ∧ T• . Moreover, straightforward calculations show that ∆ T (φ • α ) = φ • Tα.
Finally, we see that if Γ is compatible with φ, then we have the following inequalities.

Lemma 38. Let Γ be V-relator compatible with φ. Then the following hold:

X ≤ f / / α _ T Z Γβ _ Y / / TW =⇒ X ≤ f / / φ•α _ T Z ∆ Γ (φ•β ) _ Y / / TW , X ≤ f / / R _ T Z ∆ Γ S _ Y / / TW =⇒ X ≤ f / / ψ •R _ T Z Γ(ψ •S) _ Y / / TW .
Proof. The proof is straightforward. As an illustrative example, we show

α ≤ • • Γβ • f =⇒ φ • α ≤ • • ∆ Γ (φ • β ) • f .
We have:

α ≤ • • Γβ • f =⇒ φ • α ≤ • • (φ • Γβ ) • f [By monotonicity of φ] =⇒ φ • α ≤ • • ∆ Γ (φ • β ) • f [By compatibility of Γ with φ].
As for ordinary, boolean-valued relators we required some compatibility conditions with the Σcontinuous structure of monads, we do the same for V-relators.

De nition 69. Let T be a Σ-continuous monad, V be a Σ-quantale, and Γ be a V-relator for T.

1. We say that Γ is inductive if the following inequalities hold:

k ≤ Γα (⊥ X , y) (ind V 1) n Γα (x n , y) ≤ Γα ( n x n , y) (ind V 2)
for any ω-chain (x n ) n in T X , element y ∈ TY , and V-relation α : X + → Y .

2. We say that Γ is Σ-compatible if it satis es the following condition, for all elements u 1 , . . . , u n ∈ T X , y 1 , . . . , y n ∈ TY , and n-ary operation symbol op ∈ Σ.

op V (Γα (u 1 , y 1 ), . . . Γα (u n , y n )) ≤ Γα ( op X (u 1 , . . . , u n ), op Y (y 1 , . . . , y n )) (Σ comp V )
Notice that if Γ is inductive then we have the following 'induction-like' principle:

∀n ≥ 0. a ≤ Γα ( n x n , y) =⇒ a ≤ Γα (x n , y).
We refer to inductive and Σ-compatible V-relators for a monad T as Σ-continuous V-relators.

Example 67. Easy calculations show that M and FM are inductive and Σ-compatible. Using results from [START_REF] Villani | Optimal transport: Old and new[END_REF] and [START_REF] Clément | Wasserstein metric and subordination[END_REF] (notably Lemma 5.2) it is possible to show that DM is inductive, the relevant inequality being DMα (sup n µ n , ν ) ≤ sup n DMα (µ n , ν ). Proving Σ-compatibility of D and DM is straightforward, as it amounts to show Γα (µ

1 ⊕ ν 1 , µ 2 ⊕ ν 2 ) ≤ Γα (µ 1 , µ 2 ) ⊕ Γα (ν 1 , ν 2 ), for Γ ∈ { D, DM}.
This concludes our exposition of the general theory of V-relators. We are now going to apply such a theory to de ne abstract notions of program distance for V-Fuzz.

Chapter 12

E ectful Applicative Distances

Là onde, come sarebe male la abolizione ed il non essere di questo mondo, cossì' non sarebe buono il non essere de innumerabili altri.

Giordano Bruno, De l'in nito, universo e mondi

In this chapter we de ne e ectful applicative similarity and bisimilarity distance and prove precongruence and congruence results for them, respectively. In order to achieve these results, we rst generalise the relational framework of Chapter 5 to V-Fuzz and V-relations, and the instantiate it to de ne our notions of e ectful distance.

E ectful applicative similarity and bisimilarity distance being de ned coinductively, we easily prove them to be preorder and equivalence V-relations, respectively. Additionally, relying on Lemma 38 we prove that the kernel of e ectful applicative (bi)similarity distance coincides with a re nement of effectful applicative (bi)similarity (Proposition 31).

(Pre)congruence results are proved using a re nement of abstract Howe's method as developed in Chapter 5, taking inspiration from [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF]. As for the proof of Lemma 16, the proof of Lemma 43 relies on the axioms of V-relators.

In the rest of this chapter we assume a signature Σ, a Σ-quantale V, a collection of CBEs Π (according to Section 10.2), a Σ-continuous (strong) monad T, and a Σ-continuous relator for T to be xed.

Behavioural V-relations

We begin our analysis extending the relational framework developed in Chapter 5 to V-Fuzz and Vrelations. Since the development of this section closely follows Section 5.1, we will be rather succinct, not commenting routine de nitions and results (the reader should already be familiar with them from Chapter 5).

De nition 70.

A closed λ-term V-relation α = (α Λ , α V ) associates to each closed type σ , binary V-relations α V
σ , α Λ σ on closed values and computations inhabiting it, respectively.

Since the syntactic shape of expressions determines whether we are dealing with computations or values, oftentimes we will write α It is easy to see that if α is compatible, then it satis es inequalities in Figure 12.2. Actually, α is compatible precisely if it satis es such inequalities. Notice also that in the clause for sequential composition the presence of s ∧ 1, instead of s, ensures that for terms like e let x = (return I ) in f and e let x = Ω in f , where f is a closed computation, the distance α (e, e ) is determined before sequencing (which captures the idea that although f will not 'use' any input, return I and Ω will be still evaluated, thus producing observable di erences between e and e ). In fact, if we replace s ∧ 1 with s, then by taking s 0 compatibility would imply α (e, e ) = k, which is clearly unsound.

σ (e, f ) (resp. α σ ( , w )) in place of α Λ σ (e, f ) (resp. α V σ ( , w )). Γ, x : s σ |= Λ k ≤ α (x, x ) : σ (comp V -var) a ≤ Γ, x : 1 σ α (e, f ) : τ Γ |= v a ≤ α (λx.e, λx.f ) : σ τ (comp V -abs) a ≤ Γ v α ( , ) : σ τ b ≤ ∆ v α (w, w ) : σ Γ ⊗ ∆ |= Λ a ⊗ b ≤ α ( w, w ) : τ (comp V -app) a ≤ Γ v α ( , w ) : σ î Γ |= v a ≤ α ( î, , î, w ) : i ∈I σ i (comp V -inj) a ≤ Γ v α ( î, , î, w ) : i ∈I σ i b i ≤ ∆, x : s i σ i ≤ α (e i , f i ) : τ (∀i ∈ I ) s • Γ ⊗ ∆ |= Λ s (a) ⊗ b î ≤ α (case î, of { i, x → e i }, case î, w of { i, x → f i }) : τ (comp V -sum-cases) a ≤ Γ v α ( , w ) : σ Γ |= Λ a ≤ α (return , return w ) : σ (comp V -val) a ≤ Γ α (e, e ) : σ b ≤ ∆, x : s σ α ( f , f ) : τ (s ∧ 1) • Γ ⊗ ∆ |= Λ (s ∧ 1)(a) ⊗ b ≤ α (let x = e in f , let x = e in f ) : τ (comp V -let) a ≤ Γ |= Λ α ( , w ) : σ s • Γ |= v s (a) ≤ α (! , !w ) : ! s σ (comp V -bang) a ≤ Γ v α ( , w ) : ! r σ b ≤ ∆, x : s •r σ α (e, f ) : τ s • Γ ⊗ ∆ |= Λ s (a) ⊗ b ≤ α (case of {!x → e}, case w of {!x → f }) : τ (comp V -bang-cases) aΓ v α ( , w ) : σ [µt.σ /t] Γ |= v a ≤ α (fold , fold w ) : µt.σ (comp V -fold) a ≤ Γ v α ( , w ) : µt.σ b ≤ ∆, x : s σ [µt.σ /t] b ≤ α (e, f ) : τ s • Γ ⊗ ∆ |= Λ s (a) ⊗ b ≤ α (case of {fold x → e}, case w of {fold x → f }) : τ (comp V -fold-cases) a 1 ≤ Γ 1 α (e 1 , f 1 ) : σ • • • a n ≤ Γ n α (e n , f n ) : σ op V (Γ 1 , . . . , Γ n ) |= Λ op V (a 1 , . . . , a n ) ≤ α (op(e 1 , . . . , e n ), op(e 1 , . . . , e n )) : σ (comp V -op) Figure 12.1: Compatible re nement. k ≤ (Γ v α (x, x ) : σ ) Γ, x : 1 σ Λ α (e, f ) : τ ≤ Γ v α (λx.e, λx.f ) : σ τ (Γ v α ( , ) : σ τ ) ⊗ (∆ v α (w, w ) : σ ) ≤ (Γ ⊗ ∆ Λ α ( w, w ) : τ ) Γ v α ( , w ) : σ î ≤ Γ v α ( î, , î, w ) : i ∈I σ i s • (Γ v α ( î, , î, w ) : i ∈I σ i ) ⊗ (∆, x : s σ Λ α (e î , f î ) : τ ) ≤ s • Γ ⊗ ∆ Λ α (case î, of { i, x → e i }, case î, w of { i, x → f i }) : τ Γ v α ( , w ) : σ ≤ Γ Λ α (return , return w ) : σ (s ∧ 1) • (Γ Λ α (e, e ) : σ ) ⊗ (∆, x : s σ Λ α ( f , f ) : τ ) ≤ (s ∧ 1) • Γ ⊗ ∆ Λ α (let x = e in f , let x = e in f ) : τ s • (Γ v α ( , w ) : σ ) ≤ s • Γ v α (! , !w ) : ! s σ s • (Γ v α ( , w ) : ! r σ ) ⊗ (∆, x : s •r σ Λ α (e, f ) : τ ) ≤ s • Γ ⊗ ∆ Λ α (case of {!x → e}, case w of {!x → f }) : τ Γ v α ( , w ) : σ [µt.σ /t] ≤ Γ v α (fold , fold w ) : µt.σ s • (Γ v α ( , w ) : µt.σ ) ⊗ (∆, x : s σ [µt.σ /t] Λ α (e, f ) : τ ) ≤ s • Γ ⊗ ∆ Λ α (case of {fold x → e}, case w of {fold x → f }) : τ op V (Γ 1 Λ α (e 1 , f 1 ) : σ , . . . , Γ n Λ α (e n , f n ) : σ ) ≤ op V (Γ 1 , . . . , Γ n ) Λ α (op(e 1 , . . . , e n ), op( f 1 , . . . , f n )) : σ
We can nally de ne e ectful applicative similarity distance, the generalisation of e ectful applicative similarity of Chapter 5 to V-relations.

De nition 75. Let Γ be a V-relator for T and α

= (α Λ , α V ) be a closed λ-term V-relation. De ne the closed λ-term V-relation [α] = ([α] Λ , [α] V ) as follows: [α] Λ σ (e, f ) Γα V σ ( e , f ) [α] V σ τ ( , w ) u ∈V σ • α Λ τ ( u, wu) [α] V i ∈I σ i ( î, , î, w ) α V σ î ( , w ) [α] V i ∈I σ i ( î, , , w ) [α] µt .σ (fold , fold w ) α σ [µt .σ /t ] ( , w ) [α] ! s σ (! , !w ) (s • α σ )( , w ).
(notice that the de nition of [α] V is by case analysis on v , w : σ ). A λ-term V-relation α is an e ectful applicative simulation distance with respect to We apply notational convention of Remark 9 and simply refer to applicative simulation (resp. similarity) distance in place of e ectful applicative simulation (resp. similarity) distance with respect to Γ. Applicative similarity distance comes with an associated coinduction principle: for any closed λ-term

Γ if α ≤ [α].
V-relation α, if α ≤ [α], then α ≤ δ . Symbolically: α ≤ [α] α ≤ δ (δ -coind.)
Example 68. Instantiating De nition 76 with DM, we obtain the quantitative re nement of probabilistic applicative similarity for P-Fuzz. In particular, for two computations e, f ∈ Λ σ , δ (e, f ) is (for readability we omit subscripts):

min ω ∈Ω( e , f ) ,w ∈V • ω (just , just w ) • δ V ( , w ) + ∈V • ω (just , ⊥)
where we have implicitly used the following identities:

Mδ V (⊥, ⊥) = 0 Mδ V (just , ⊥) = 1 Mδ V (⊥, just w ) = 0.
We immediately notice that δ is adequate in the following sense: for all terms e, f ∈ Λ σ we have the inequality ef ≤ δ Λ (e, f ), where e is the probability of convergence of e, i.e.

∈V • e (just ), and subtraction is actually truncated subtraction.

holds for all values , w ∈ V σ τ

•

. For that it is su cient to prove that for any u ∈ V σ

• and for any z ∈ V σ τ • there exists a term e ∈ Λ τ

• such that:

δ V σ τ ( , z) ⊗ δ V σ τ (z, w ) ≤ δ Λ τ ( u, e) ⊗ δ Λ τ (e, wu).
By very de nition of δ V σ τ we have:

δ V σ τ ( , z) ⊗ δ V σ τ (z, w ) ≤ u ∈V σ • δ Λ τ ( u , zu ) ⊗ u ∈V σ • δ Λ τ (zu , wu ) ≤ δ Λ τ ( u, zu) ⊗ δ Λ τ (zu, wu),
so that it is su cient to instantiate e as zu.

3. We prove that

(δ V i ∈I σ i • δ V i ∈I σ i )( î, , , u ) ≤ (δ V i ∈I σ i • δ V i ∈I σ i )( î, , î, w ) ≤ (δ V σ î • δ V σ î )( , w ) hold for all , w ∈ V σ î • and u ∈ V σ 
• , with î . We have

(δ V i ∈I σ i • δ V i ∈I σ i )( î, , , u ) = ˆ ,z ∈V i ∈I σ i • δ V i ∈I σ i ( î, , ˆ , z ) ⊗ δ V i ∈I σ i ( ˆ , z , , w ).
Since î  at least one among î ˆ and ˆ  holds, for any ˆ , z ∈ V i ∈I σ i

•

. As a consequence, by very de nition of δ , the right hand side of the above inequality is equal to something of the form ⊗ a, which is itself equal to . To prove the second inequality, we have to show that for any î, u ∈

V i ∈I σ i • there exists z ∈ V σ î • such that δ V i ∈I σ i ( î, , î, u ) ⊗ δ V i ∈I σ i ( î, u , î, w ) ≤ δ V σ î ( , z) ⊗ δ V σ î (z, w ).
Notice that for a value , u ∈ V i ∈I σ i

• with  î we would have, by very de nition of δ , δ V i ∈I σ i ( î, , , u ) = , and thus we would be trivially done. Proving the above inequality is straightforward: simply instantiate z as u and observe that by de nition of δ we have

δ V i ∈I σ i ( î, , î, u ) ≤ δ V σ î ( , u) δ V i ∈I σ i ( î, u , î, w ) ≤ δ V σ î (u, w ).
4. The case for µt.σ follows the same pattern of the above one.

5. We prove:

(δ V ! s σ • δ V ! s σ )(! , !w ) ≤ s • (δ V σ • δ V σ )( , w ).
For that we notice that for every !u ∈ V ! s σ

• we have:

δ V ! s σ (! , !u) ⊗ δ V ! s σ (!u, !w ) ≤ (s • δ V σ )( , u) ⊗ (s • δ V σ )(u, w ) ≤ ((s • δ V σ ) • (s • δ V σ ))( , w ) ≤ s • (δ V σ • δ V σ )( , w ).
In light of Example 66 we can look at the kernel of δ and recover e ectful applicative similarity of Chapter 5 (suitably generalised to V-Fuzz).

Proposition 31. De ne applicative ∆ Γ -similarity by instantiating De nition 75 with the 2-relator ∆ Γ and replacing the clause for types of the form ! s σ as follows:

! R ! s σ !w =⇒ (φ • s • ψ ) • R σ ( , w ).
Then the kernel φ • δ of δ coincide with .

Proof. The proof is by coinduction. We start proving that φ • δ is an applicative ∆ Γ -simulation. Since δ Λ

σ (e, f ) ≤ Γδ V σ ( e , f ) holds for all terms e, f ∈ Λ σ • , we can apply Lemma 38 and infer the inequality

φ • δ Λ σ (e, f ) ≤ ∆ Γ (φ • δ V σ )( e , f ).
Let us now move to the value clauses. 1. We prove that for all values , w ∈ V σ τ • we have:

φ • δ V σ τ ( , w ) ≤ u ∈V σ • φ • δ Λ τ ( u, wu). Suppose φ • δ V σ τ ( , w ) = true, so that δ V σ τ ( , w ) = k. We show that φ • δ Λ τ ( u, wu) = true holds for any u ∈ V σ • . By very de nition of applicative similarity distance, δ V σ τ ( , w ) = k implies u ∈V σ • δ Λ τ ( u, wu) = k. Since V is integral (i.e. k = ), we must have δ Λ τ ( u, wu) = k (and thus φ • δ Λ τ ( u, wu) = true) for any u ∈ V σ • . 2.
Clauses for sum and recursive types are straightforward. 3. We show that for all values ! , !w ∈

V ! s σ • , φ•δ V ! s σ (! , !w ) = true implies (φ•s•ψ )•(φ•δ V σ )( , w ) = true.
By algebra of CBFs we have:

(φ • s • ψ ) • (φ • δ V σ ) = (φ • s • ψ • φ) • δ V σ = (φ • s) • δ V σ = φ • (s • δ V σ ).
Since φ•δ V ! s σ (! , !w ) = true, and thus δ V ! s σ (! , !w ) = k, by very de nition of δ we infer s

•δ V σ ( , w ) = k. We conclude (φ • (s • δ V σ ))( , w ) = true. We now prove by coinduction (ψ • ) ≤ δ , from which follows ((φ • ψ ) • ) ⊆ (φ • δ ) and thus ⊆ (φ • δ ).
The clause for terms directly follows from Lemma 38. The clauses for values follow the same structure of the previous part of the proof. We show the case for values of type ! s σ . Suppose ψ • V ! σ σ (! , !w ) = k to hold (otherwise we are trivially done), meaning that ! V ! σ σ !w holds as well. As a consequence, we have

((φ • s • ψ ) • V σ )( , w ) = true, and thus s • (ψ • V σ )( , w ) = k. Remark 21. Notice that if R σ ( , w ) holds, then so does (φ • s • ψ ) • R σ ( , w
), but the vice versa is not true, in general. For instance, taking s 0 we see that

(φ • 0 • ψ ) • R σ ( , w ) = φ(0(ψ (false))) = φ(0 • ∞) = φ(0) = true,
which essentially means we identify distinguishable values if they are not used. Nonetheless, the reader should notice that the encoding of a 'standard' λ-calculus Λ in V-Fuzz can be obtained via the usual encoding of Λ in its linear re nement [START_REF] Maraist | Call-by-name, call-by-value, call-by-need and the linear lambda calculus[END_REF] which corresponds to the fragment of V-Fuzz based on CBEs 1 and ∞, thus avoiding the above undesired result.

In order to make applicative similarity distance a useful tool for reasoning about program distance, we need to prove it to be compositional. Formally, that amounts to prove that applicative similarity distance is compatible.

a ≤ Γ, x : s σ v α (x, w ) : σ Γ, x : s σ |= Λ a ≤ α H (x, w ) : σ (H-var) Γ, x : 1 σ |= Λ a ≤ α H (e, ) : τ c ≤ Γ α (λx. , f ) : σ τ Γ |= Λ a ⊗ c ≤ α H (λx.e, f ) : σ τ (H-abs) Γ |= Λ a ≤ α H ( , ) : σ τ ∆ |= Λ b ≤ α H (w, w ) : σ c ≤ Γ ⊗ ∆ α ( w , f ) : τ Γ ⊗ ∆ |= Λ a ⊗ b ⊗ c ≤ α H ( w, f ) : τ (H-app) Γ |= v a ≤ α H ( , w ) : σ î b ≤ Γ v α ( î, w , u) : i ∈I σ i Γ |= v a ⊗ b ≤ α ( î, , u) : i ∈I σ i (H-inj) Γ |= v a ≤ α H ( î, , î, w ) : i ∈I σ i c ≤ s • Γ ⊗ ∆ Λ α (case î, w of { i, x → f i }, ) : τ ∀i ∈ I . ∆, x : s σ i |= Λ b i ≤ α H (e i , f i ) : τ s • Γ ⊗ ∆ |= Λ s (a) ⊗ b î ⊗ c ≤ α H (case î, of { i, x → e i }, ) : τ (H-sum-cases) Γ |= Λ a ≤ α H ( , w ) : σ c ≤ Γ α (return w, f ) : σ Γ |= Λ a ⊗ c ≤ α H (return , f ) : σ (H-val) Γ |= Λ a ≤ α H (e, ) : σ ∆, x : s σ |= Λ b ≤ α H (e , ) : τ c ≤ (s ∧ 1) • Γ ⊗ ∆ α (let x = in , f ) : τ (s ∧ 1) • Γ ⊗ ∆ |= Λ (s ∧ 1)(a) ⊗ b ⊗ c ≤ α H (let x = e in e , f ) : τ (H-let) Γ |= Λ a ≤ α H ( , w ) : σ c ≤ s • Γ α (!w, z) : ! s σ s • Γ |= Λ s (a) ⊗ c ≤ α H (! , z) : ! s σ (H-bang) Γ |= Λ a ≤ α H ( , w ) : ! r σ c ≤ s • Γ ⊗ ∆ α (case w of {!x → }, f ) : τ ∆, x : s •r σ |= Λ b ≤ α H (e, ) : τ s • Γ ⊗ ∆ |= Λ s (a) ⊗ b ⊗ c ≤ α H (case of {!x → e}, f ) : τ (H-bang-cases) Γ |= Λ a ≤ α H ( , w ) : µt.σ c ≤ s • Γ ⊗ ∆ α (case w of {fold x → }, f ) : τ ∆, x : s σ [µt.σ /t] |= Λ b ≤ α H (e, ) : τ s • Γ ⊗ ∆ |= Λ s (a) ⊗ b ⊗ c ≤ α H (case of {fold x → e}, f ) : τ (H-fold-cases) Γ |= Λ a ≤ α H ( , w ) : σ [µt.σ /t] c ≤ Γ α (fold w, z) : µt.σ Γ |= Λ a ⊗ c ≤ α H (fold , z) : µt.σ (H-fold) ∀i ≤ n. Γ i |= Λ a i ≤ α H (e i , i ) : σ c ≤ op V (Γ 1 . . . . , Γ n ) α (op( 1 , . . . , n ), f ) : σ op V (Γ 1 , . . . , Γ n ) |= Λ op V (a 1 , . . . , a n ) ⊗ c ≤ α H (op(e 1 , . . . , e n ), f ) : σ (H-op)
Figure 12.3: Howe extension of α.

Suppose

A {a | Γ |= Λ a ≤ α H (let x = e in f , ) : τ } to be non-empty. That means there exists a ∈ V such that Γ |= Λ a ≤ α H (let x = e in f , ) : τ is derivable. The latter judgment must be the conclusion of an instance of rule (H-let) from premises:

Σ |= Λ b ≤ α H (e, e ) : σ ∆, x : s σ |= Λ c ≤ α H ( f , f ) : τ d ≤ (s ∧ 1) • Σ ⊗ ∆ α (let x = e in f , ) : τ so that Γ = (s ∧ 1) • Σ ⊗ ∆ and a = (s ∧ 1)(b) ⊗ c ⊗ d.
In particular, the sets 1. α H is re exive.

B = {b | Σ |= Λ b ≤ α H (e, e ) : σ } C = {c | ∆, x : s σ |= Λ c ≤ α H ( f , f ) : τ }
2. α o ≤ α H . 3. α • α H ≤ α H . 4. α H is compatible.
We refer to property 1 as pseudo-transitivity. In particular, by very de nition of V-relator we also have the following inequality.

Γα • Γα H ≤ Γ α H .
(Γ pseudo-trans.)

Notice that Proposition 30 implies that (δ o ) H is compatible and bigger than δ o . Finally, we notice that the Howe extension of a λ-term V-relation is substitutive.

Lemma 42 (Substitutivity). Let α be a value substitutive λ-term V-preorder. For all values, Γ, x : s σ v u, z : τ and , w : σ , and terms Γ, x : s σ e, f : τ , let a v α H ( , w ) : σ . Then:

(Γ, x : s σ v α H (u, z) : τ ) ⊗ s (a) ≤ Γ v α H (u[ /x], z[w/x]) : τ (Γ, x : s σ α H (e, f ) : τ ) ⊗ s (a) ≤ Γ α H (e[x := ], f [x := w]) : τ .
Proof. We simultaneously prove the following statements.

For any

a ∈ V if Γ, x : s σ |= Λ a ≤ α H (e, f ) : τ is derivable, then a ⊗ s (a) ≤ Γ α H (e[x := ], f [x := w]) : τ . 2. For any a ∈ V if Γ, x : s σ |= v a ≤ α H (u, z) : τ is derivable, then a ⊗ s (a) ≤ Γ α H (u[ /x], z[w/x]) : τ .
The proof is by induction on the derivation of the judgments:

J Γ, x : s σ |= Λ a ≤ α H (e, f ) : τ J Γ, x : s σ |= v a ≤ α H (u, z) : τ .
1. Suppose J has been inferred via an instance of rule (H-var). We have two subcases to consider.

1.1 J has been inferred via an instance of rule (H-var) from premises:

a ≤ Γ, x : s σ v α (x, u) : σ Γ, x : s σ |= v a ≤ α H (x, u) : σ (H-var), so that s ≤ 1 and J is Γ, x : s σ |= v a ≤ α H (x, u) : σ . We have to prove a ⊗s • ( v α H ( , w )) ≤ Γ v α H ( , u[w/x]) : σ . Since α is value substitutive, from Γ, x : s σ |= v a ≤ α H (x, u) : σ we infer a ≤ Γ v α (w, u[w/x]) : σ . Moreover,
a ⊗ s (a) ≤ (Γ v α H ( , w ) : σ ) ⊗ s • (Γ v α (w, u[w/x]) : σ ) ≤ (Γ v α H ( , w ) : σ ) ⊗ (Γ v α (w, u[w/x]) : σ ) [ since s ≤ 1 ] ≤ Γ v α H ( , u[w/x]) : σ [ by pseudo-transitivity ].
1.2 J has been inferred via an instance of rule (H-var) from premises:

a ≤ Γ, : r τ , x : s σ v α ( , u) : τ Γ, : r τ , x : s σ |= v a ≤ α H ( , u) : τ (H-var) so that J is Γ, : r τ , x : s σ |= v a ≤ α H ( , u) : τ . We have to prove a ⊗ s • (∅ v α H ( , w )) ≤ Γ, : r τ v α H ( , u[w/x]) : τ .
As V is integral and α is value-substitutive, we have:

a ⊗ s • (∅ v α H ( , w )) ≤ a ≤ Γ, : r τ v α ( , u[w/x]).
Since α ≤ α H we are done.

2. Suppose J has been inferred via an instance of rule (H-let) from premises:

Γ, x : s σ |= Λ a ≤ α H (e, e ) : σ (12.1) ∆, x : r σ , : p σ |= Λ b ≤ α H ( f , f ) : τ (12.2) c ≤ (p ∧ 1) • (Γ, x : s σ ) ⊗ (∆, x : r σ ) α H (let = e in f , ) : τ . (12.
3) so that is:

(p ∧ 1) • Γ ⊗ ∆, x : (p∧1) •s ⊗r σ |= Λ (p ∧ 1)(a) ⊗ b ⊗ c ≤ α H (let = e in f , ) : τ . (p ∧ 1)(s (a)) ⊗ r (a) ⊗ (p ∧ 1)(a) ⊗ b ⊗ c ≤ (p ∧ 1) • Γ ⊗ ∆ α H (let = e[x := ] in f [x := ], [x := w]) : τ .
We apply the induction hypothesis on (12.1) and (12.2) obtaining:

s (a) ⊗ a ≤ Γ α H (e[x := ], e [x := w]) : σ (12.4) r (a) ⊗ b ≤ ∆, : p σ α H ( f [x := ], f [x := w]) : τ .
(12.5) From (12.4) and (12.5) by compatibility of α H (and lax equations of change of base functors) we infer:

(p ∧ 1)(s (a)) ⊗ (p ∧ 1)(a) ⊗ r (a) ⊗ b ≤ (p ∧ 1) • Γ ⊗ ∆ α H (let = e[x := ] in f [x := a], let = e [x := w] in f [x := w]) : τ . (12.6)
Finally, since α is value-substitutive, from (12.3) we obtain:

c ≤ (p ∧ 1) • Γ ⊗ ∆ α H (let = e [x := w] in f [x := w], ) : τ
and thus conclude the thesis from the latter and (12.6) by pseudo-transitivity.

3. Suppose J has been inferred via an instance of rule (H-op) from premises (as usual we write x i for items x 1 , . . . , x n ):

∀i. Γ i , x : s i σ |= Λ a i ≤ α H (e i , e i ) : τ (12.7) b ≤ op V ( Γ i ), x : op V ( s i ) σ α (op( e i ), f ) : τ (12.8) so that is op V ( Γ i ), x : op V ( s i ) σ |= Λ op V ( a i ) ⊗ b ≤ α H (op( e i ), f ) : τ .
We have to prove

op V ( ---→ s i (a)) ⊗ op V ( a i ) ⊗ b ≤ op V ( Γ i ) α H ( --------→ e i [x := ], f [x := w]) : τ .
We apply the induction hypothesis on (12.7) obtaining:

∀i. s (a) ⊗ a i ≤ Γ i α H (e i [x := ], e i [x := w]) : τ . (12.9)

Monotonicity of op V on (12.9) followed by compatibility gives: by pseudo-transitivity. We conclude the thesis as De nition 63 entails:

op V ( --------→ s i (a) ⊗ a i ) ≤ op V ( Γ i ) α H (
op V ( ---→ s i (a)) ⊗ op V ( a i ) ≤ op V ( --------→ s i (a) ⊗ a i ).
The remaining cases follow the same pattern.

Notice that the open extension of any closed λ-term V-relation is value-substitutive. We can now prove the main result of Howe's method, the so-called Key Lemma. The latter states the Howe extension of applicative similarity distance (restricted to closed terms) is an applicative simulation distance. By coinduction, we conclude δ = (δ H ) c (the latter being the closed restriction of δ H ), and thus δ o = δ H , meaning that the former is compatible.

Lemma 43 (Key Lemma). Recall that we assume Γ to be Σ-continuous. Let α be a re exive and transitive applicative simulation distance. Then the Howe extension of α restricted to closed terms/values in an applicative simulation distance.

Proof. Let us write α H for the Howe extension of α restricted to closed computations/values. It is easy to see that α H satis es the simulation clauses for values. For instance, we prove the inequality α H ! s σ (! , !w ) ≤ s•α H σ ( , w ), where for readability we omit values superscript in α and α H . It is su cient to show that for any a ∈ V such that the judgment J (|= Λ a ≤ α H (! , !w ) : ! s σ ) is derivable, the inequality a ≤ s • α H σ ( , w ) holds. The judgment J must have been inferred via an instance of rule (H-bang), so that without loss of generality we can assume a = s (b) ⊗ α ! s σ (!u, !w ), with |= Λ b ≤ α H ( , u) : σ derivable, for some value u. We conclude the thesis as follows:

a ≤ s • α H σ ( , u) ⊗ α ! s σ (!u, !w ) ≤ s • α H σ ( , u) ⊗ s • α σ (u, w ) [α is an applicative simulation distance] ≤ s • (α H σ ( , u) ⊗ α σ (u, w )) ≤ s • (α σ • α H σ )( , w ) ≤ s • α H σ ( , w ). [pseudo-transitivity]
The crucial part of the proof is to show that α H satis es the clause for computations. We prove that for any n ≥ 0, and all computations e, f ∈ Λ σ

• , we have:

(α H ) Λ σ (e, f ) ≤ Γ(α H ) V σ ( e n , f ).

Since Γ is inductive the above inequality gives the thesis as follows:

(α H σ ) Λ (e, f ) ≤ n Γ(α H σ ) V ( e n , f ) ≤ Γ(α H σ ) V ( n e n , f ) = Γ(α H σ ) V ( e , f ).
The proof is by induction on n with a case analysis on the term structure in the inductive case. For readability we simply write α in place of α Λ and α V . Moreover, to avoid confusion we remark that we explicitly distinguish between (ordinary) Kleisli extension and strong Kleisli extension. Given a monoidal category C, I , ⊗ , recall that we denote by f * : Z ⊗ T X → TY the strong Kleisli extension of f : Z ⊗ X → TY and by † : T X → TY the Kleisli extension of : X → TY . Moreover, the latter can be de ned in terms of the former as † ( • λ X ) * • λ -1 T X , where λ X : I ⊗ X -→ X is the natural isomorphism given by the monoidal structure of C. Notice also that † • λ T X = ( • λ X ) * . We now enter the details of the induction.

1. We have to prove:

α H
σ (e, f ) ≤ Γα H σ ( e 0 , f ).

Since Γ is inductive and e 0 = ⊥ V σ • , it is su cient to prove α H σ (e, f ) ≤ k. Because the quantale is integral the latter trivially holds.

2. We have to prove: α H σ (return , w ) ≤ Γα H σ ( return n+1 , w ).

Since return n+1 = η( ), it is su cient to prove that for any a such that the judgment |= Λ a ≤ α H (return , w ) : σ is derivable, a ≤ Γα H σ (η( ), w ) holds. Suppose |= Λ a ≤ α H (return , w ) : σ to be derivable. The latter must have been inferred via an instance of rule (H-val) from premises:

|= Λ b ≤ α H ( , ) : σ (12.11) c ≤ α σ (return , w ).

(12.12)

In particular, we have b ≤ α H σ ( , ) and thus, by condition (Lax unit), b ≤ Γα H σ (η( ), η( )). From, (12.12) we infer, by very de nition of applicative simulation distance, c ≤ Γα σ (η( ), w ), and thus b ⊗ c ≤ Γα H σ (η( ), η( )) ⊗ Γα σ (η( ), w ). We conclude the thesis by (Γ pseudo-trans.). (12.15)

Let us examine premise (12.14). First of all, since u is a closed value of type σ τ it must be of the form λx. . Moreover, (12.14) must have been inferred via an instance rule rule (H-abs) from premises:

x : 1 σ |= Λ c 1 ≤ α H (e, h) : τ (12.16) c 2 ≤ α σ τ (λx.h, λx. ).

(12.17)

In particular, we have the equality c 1 ⊗ c 2 = c. From (12.16) we deduce c 1 ≤ x : 1 σ α H (e, h) : τ , whereas from (12.13) we infer b ≤ α H σ ( , w ). We are now in position to apply Lemma 42, obtaining c 1 ⊗ b ≤ α H τ (e[x := ], h[x := w]). By very de nition of applicative simulation distance, (12.17) implies the inequality c 2 ≤ α τ (h[x := w], [x := w]). Applying pseudo-transitivity followed by the induction hypothesis we obtain: (recall that u = λx. , so that uw = [x := w] ). We can now conclude the thesis by (Γ pseudo-trans.).

c 1 ⊗ c 2 ⊗ b ≤ α H τ (
4. Cases for pattern matching against folds and sums are standard (they follow the same pattern of point 5, but are simpler).

5. We have to prove:

α H τ (case ! of {!x → e}, f ) ≤ Γα H τ ( case ! of {!x → e} n+1 , f ).
As case ! of {!x → e} n+1 = e[x := ] n , we show that for any a such that |= Λ a ≤ α H (case ! of {!x → e}, f ) : τ is derivable, the inequality a ≤ Γα H τ ( e[x := ] n , f ) holds. Suppose |= Λ a ≤ α H (case ! of {!x → e}, f ) : τ . The latter must have been inferred via an instance of rule (H-bang-cases) from premises: (12.20)

∅ |= Λ b ≤ α H (! ,
In particular, we have a = r (b) ⊗ c ⊗ d. Let us examine premise (12.18). First of all, since u is a closed value of type ! s σ , it must be of the form ! . Moreover, (12.18) must have been inferred via an instance of rule (H-bang) from premises:

∅ |= Λ b 1 ≤ α H ( , w ) : σ (12.21) b 2 ≤ α ! s σ (!w, ! ).
(12.22)

In particular, b = s (b 1 ) ⊗b 2 . From (12.22), by de nition of applicative simulation distance we infer b 2 ≤ s • α σ (w, ). Since (12.21) implies b 1 ≤ α H σ ( , w ), we have:

b = s (b 1 ) ⊗ b 2 ≤ s • α H σ ( , w ) ⊗ s • α σ (w, ) ≤ s • (α H σ ( , w ) ⊗ α σ (w, )) ≤ s • α H σ ( , )
where the last inequality follows by pseudo-transitivity. From (12.19) we infer the inequality c ≤ x : r •s σ α H (e, e ) : τ . We are now in position to apply Lemma 42 obtaining: Moreover, by de nition of applicative simulation distance, (12.25) implies d ≤ Γα τ ( let x = e in f , ), which allows to conclude the thesis by (Γ pseudo-trans.). Let us now turn to the proof of (12.25). First of all we apply the induction hypothesis on α H σ (e, e ). By monotonicity of s ∧ 1 we have thus reduced the proof of (12.25) to proving the inequality: 12.28) where I = { * } and γ ( * , * ) = (x : s σ α H ( f , f ) : τ ). It is easy to see that (12.27) follows from (12.28), since e.g.:

I × T V σ • ≤ γ ⊗(s∧1)•Γα H σ _ f [x :=_] † n •λ T V σ • / / T V τ Γα H τ _ I × T V σ • f [x :=_] † •λ T V σ • / / T V τ • (
( f [x := _] † n • λ T V σ • )( * , e n ) = e[x := _] † n e n .
To prove (12.28) we rst observe that by very de nition of strong monad we have f [

x := _] † n • λ T V σ • = ( f [x := _] n •λ V σ • ) * .
We can now apply condition (L-Strong lax bind). As a consequence, to prove (12.28) it is su cient to prove that for all closed values , w of type σ , we have:

(x : s σ α H ( f , f ) : τ ) ⊗ (s ∧ 1) • α H σ ( , w ) ≤ Γα H τ ( f [x := ] n , f [x := w] ).
By Lemma 42 and induction hypothesis we have:

(x : s σ α H ( f , f ) : τ ) ⊗ s • α H σ ( , w ) ≤ Γα H τ ( f [x := ] n , f [x := w] ).
We conclude the thesis since s ∧ 1 ≤ s. where op is an m-ary operation symbol in Σ. As usual, we use the notation x i for items x 1 , . . . , x m . We show that for any a such that |= Λ a ≤ α H (op( e i ), f ) : σ is derivable, a ≤ Γα H τ ( op( e i ) n f ) holds. Suppose to have |= Λ a ≤ α H (op( e i ), f ) : τ . The latter must have been inferred via an instance of rule (H-op) from premises: ∀i ≤ m. |= Λ a i ≤ α H (e i , f i ) : σ (12.29) b ≤ α τ (op( f 1 , . . . , f m ), f ).

(12.30)

In particular, we have a = op V (a 1 , . . . , a m ) ⊗ b. We apply the induction hypothesis on (12.29) obtaining, for each i ≤ m, the inequality a i ≤ Γα H ( e i n , f i ). By monotonicity of op V we thus infer: where the second inequality follows since Γ is Σ-compatible. We conclude the thesis from (12.30) by (Γ pseudo-trans.) and de nition of applicative simulation distance.

op V ( a i ) ≤ op V (Γα
Theorem 16 (Compatibility). Applicative similarity distance is compatible.

Proof. We have to prove that δ o is compatible. By Lemma 41 we know that δ o ≤ (δ o ) H and that (δ o ) H is compatible. Therefore, to conclude the thesis it is su cient to prove (δ o ) H ≤ δ o . The Key Lemma implies that the restriction of (δ o ) H on closed terms is an applicative simulation distance, and thus smaller or equal than δ . We can thus show that for all Γ Λ e, e : σ , the inequality Γ Λ (δ o ) H (e, e ) : σ ≤ Γ Λ δ o (e, e ) : σ holds. In fact, since (δ o ) H is substitutive, and thus value substitutive 1 , we have: It is worth noticing that Theorem 16 gives the following generalisation of the so-called metric preservation [START_REF] De Amorim | A semantic account of metric preservation[END_REF][START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF].

Γ Λ (δ o
Corollary 6 (Metric Preservation). For any environment Γ x 1 : s 1 σ , . . . , x n : s n σ , values ¯ , w : Γ, and Γ Λ e : σ we have: Having proved that applicative similarity distance is a compatible generalised metric, we now move to applicative bisimilarity distance.

s 1 • δ V σ 1 ( 1 , w 1 ) ⊗ • • • ⊗ s n • δ V σ n ( n , w n ) ≤ δ Λ σ (
1 Notice that in De nition 73 we substitute closed values (in computations and values) meaning that simultaneous substitution and sequential substitution coincide. In particular, value substitutivity implies e.g. .

E ectful Applicative bisimilarity Distance

In previous section we proved that applicative similarity distance is a compatible V-preorder. However, in the context of programming language semantics it is often desirable to work with V-equivalences (cf. pseudometrics). In this section we discuss two natural program V-equivalences: e ectful applicative bisimilarity distance (applicative bisimilarity distance, for short) and two-way e ectful applicative similarity distance (two-way applicative similarity distance, for short). We prove that under suitable conditions on CBEs, both applicative bisimilarity distance and two-way applicative similarity distance are compatible V-equivalences. Proving compatibility of the latter is straightforward, whereas proving compatibility of the former is non-trivial, and requires a generalisation of the transitive closure trick of Chapter 5. Before entering formalities, let us remark that so far we have mostly worked with inequation and inequalities. That was ne since we have been interested in non-symmetric V-relations. However, for symmetric V-relations inequalities seem to be not powerful enough, and often plain equalities are needed in order to make proofs work. For that reason in the rest of this section we assume CBFs to be monotone monoid (homo)morphism. That is, we modify De nition 64 requiring the equalities:

h(k ) = h(a ⊗ b) = h(a) ⊗ h(b).
Notice that we do not require CBEs to be join-preserving (i.e. continuous). We also require operations op V to be quantale (homo)morphism, i.e. to preserves unit, tensor, and joins. It is easy to see that the new requirements are met by most of the examples considered so far. We start with two-way applicative similarity distance.

Proposition 32. For a V-relator Γ, de ne two-way applicative similarity distance as δ ⊗δ • . Then two-way applicative similarity distance is a compatible V-equivalence.

Proof. Clearly δ ⊗ δ • is symmetric. Moreover, since CBEs are monoid (homo)morphism it is also compatible.

We now move to the more interesting case of applicative bisimilarity distance.

De nition 79. De ne e ectful applicative bisimilarity distance with respect to Γ (applicative bisimilarity distance, for short), denoted as γ , as e ectful applicative similarity distance with respect to Γ ∧ Γ • .

Proposition 30 implies that γ is re exive and transitive. Moreover, if CBEs preserve binary meet, i.e. s (a) ∧ s (b) = s (a ∧ b) for any CBE s in Π, then γ is also symmetric, ad thus a V-equivalence. Finally we observe that γ is the greatest λ-term V-relation α such that both α and α • are applicative simulation distance (with respect to Γ).

We now look at the proof of compatibility of γ . As usual, we cannot rely on Lemma 43 since Γ ∧ Γ • being conversive is, in general, not inductive. To overcome this problem, we proceed as in Chapter 5 and characterise applicative bisimilarity distance di erently.

Lemma 44. Let Γ be a V-relator. De ne the λ-term V-relation γ as follows:

γ {α | α • = α, α ≤ [α]}.
Then:

1. γ is a symmetric applicative simulation distance (with respect to Γ), and therefore the largest such.

2. γ coincides with γ .

holds. First of all we observe that since α H is re exive, we can assume n = m. In fact, if e.g. n = m + l, then we can 'complete' (α H ) (m) as follows:

(α H ) (m) = (α H ) (m) •I • • • • I l -times ≤ (α H ) (m) • α H • • • • α H l -times
= (α H ) (n) .

We now do induction on n. The base case is trivial. Let us turn on the inductive step. We have to prove: We can now apply compatibility of α H plus the induction hypothesis, thus reducing the thesis to:

(s ∧ 1) • Γ ⊗ ∆ α H (let x = e in f , let x = e in f ) : σ ) ⊗ (s ∧ 1) • Γ ⊗ ∆ (α H ) T (let x = e in f , let x = e in f ) : σ ) ≤ c.
We can now conclude the thesis by very de nition of (α H ) T .

To prove point 2 we have to show (α H ) T ≤ ((α H ) T ) • . For that it is su cient to show α H ≤ ((α H ) T ) • . That amounts to prove that for all computations Γ e, e : σ and values Γ v , , and for any a ∈ V such that Γ |= Λ a ≤ α H (e, e ) : σ is derivable we have a ≤ Γ (α H ) T (e, e ) : σ (and similarity for Γ v , : σ ). The proof is by induction on the derivation of Γ |= Λ a ≤ α H (e, e ) : σ using point 1.

Finally, we can prove that applicative bisimilarity distance is compatible.

Theorem 17. If any CBE in Π is nitely continuous, then applicative bisimilarity distance is compatible.

Proof. From Lemma 45 we know that (γ H ) T is compatible. Therefore, it is su cient to prove ((γ ) H ) T = γ . One inequality follows from Lemma 41 as follows: γ ≤ γ H ≤ (γ ) T . For the other inequality, we rely on the coinduction proof principle associated with γ , meaning that it is su cient to prove that ((γ ) H ) T is a symmetric applicative simulation (with respect to Γ). Symmetry is given by Lemma 45. From Lemma 43 (Key Lemma) we know that γ H is an applicative simulation distance. Since the identity λ-term V-relation is an applicative simulation distance, and the composition of applicative simulation distances is itself an applicative simulation distance (see Proposition 30), we see that (γ H ) T is itself an applicative simulation distance (with respect to Γ).

We conclude this chapter by noticing that we can rely on Theorem 17 to come up with concrete notions of compatible applicative bisimilarity distance. For instance, we obtain a compatible pseudometric for for P-Fuzz (observe that CBEs are indeed nitely continuous). To the best of the author's knowledge, this is the rst example of a compatible applicative pseudometric for a Turing complete higher-order probabilistic sequential language (but see Section 13.2).

Chapter 13 Conclusion

What if some day or night a demon were to steal into your loneliest loneliness and say to you: 'This life as you now live it and have lived it you will have to live once again and innumerable times again; and there will be nothing new in it, but every pain and every joy and every thought and sigh and everything unspeakably small or great in your life must return to you, all in the same succession and sequence -even this spider and this moonlight between the trees, and even this moment and I myself. The eternal hourglass of existence is turned over again and again, and you with it, speck of dust!' Friedrich Nietzsche, The Gay Science Chapter 12 concludes our investigation on coinductive equivalences and metrics for languages with algebraic e ects. Before discussing some related and future works, it is useful to brie y summarise the results we have achieved.

In the rst part of this dissertation we have de ned abstract notions of program equivalence and re nement for higher-order languages with algebraic e ects, aiming to answer the question of whether two e ectful programs can be deemed as operationally equivalent. To answer such a question we have de ned the notions of e ectful applicative (bi)similarity, monadic applicative (bi)similarity, and e ectful normal form (bi)similarity. For all these notions we proved congruence and precongruence theorems, as well several results about their relationship.

In order to de ne such notions of equivalence and re nement, we have developed an abstract relational framework, based on monads and relators, which we have also used to de ne the notions of e ectful contextual approximation (resp. equivalence) and e ectful CIU approximation (resp. equivalence). The aforementioned congruence and precongruence theorems, directly lead to soundness of our notions of (bi)similarity for e ectful contextual approximation (resp. equivalence).

In order to prove soundness of e ectful applicative (bi)similarity, in Chapter 5 we have developed a non-trivial generalisation of Howe's method, the standard relational construction used to prove con-202 gruence properties of applicative bisimilarity. We have argued that our abstract Howe's method is of interest by itself, as it sheds light on the very essence of Howe's construction itself. Additionally, we have showed a further application of such a method by proving full abstraction of e ectful CIU approximation (resp. equivalence) for e ectful contextual approximation (resp. equivalence).

These results hold both for call-by-name and call-by-value calculi. In Chapter 6 we have showed that we can strengthen our techniques and achieve, under mild conditions, full abstraction of monadic applicative (bi)similarity for e ectful contextual equivalence. That holds, however, only for call-byname calculi.

In Chapter 7 we have de ned e ectful normal form (bi)similarity, which gives the notion of e ectful eager normal form (bi)similarity, in call-by-value calculi, and e ectful weak head normal form, in callby-name calculi. We have proved congruence and precongruence theorems for all these notions, as well as their (strict) inclusion in e ectful applicative (bi)similarity.

Compared to other standard operational techniques, normal form bisimilarity has the major advantage of being an intensional program equivalence, equating programs according to the syntactic structure of their (possibly in nitary) normal forms. As a consequence, in order to deem two programs as normal form bisimilar, it is su cient to test them in isolation, i.e. independently of their interaction with the environment. These features make normal form bisimilarity a powerful technique for program equivalence. Additionally, we make such a technique even more powerful by proving suitable up-to context techniques.

In the second part of this dissertation we have tackled a di erent problem, namely the one of quantifying operational di erences between programs. That directly led to the investigation of notions of e ectful program metric (or distance). In Chapter 10, Chapter 11, and Chapter 12 we have de ned effectful applicative (bi)similarity distance for the calculus V-Fuzz. The latter is a linear λ-calculus with a powerful type system expressing program sensitivity.

In order to de ne e ectful applicative (bi)similarity distance, which is de facto the re nement of effectful applicative (bi)similarity to quantale-valued relations, in Chapter 12 we have designed an abstract relational framework for studying e ectful program distances. Such a framework builds on Lawvere's insights on the categorical nature of metric spaces as well as on results from monoidal topology. In particular, of a central importance is the notion of a V-relator (Chapter 11), i.e. of a relator acting on quantale-valued relations. Prime examples of V-relators are provided by the well-known Hausdor and Wasserstein-Kantorovich distances.

Finally, in Chapter 12 we have proved our main results, namely congruence and precongruence theorems for e ectful applicative bisimilarity and similarity distance, respectively. Such results are proved with a further generalisation of Howe's method.

Related Work

The results presented in this dissertation are de nitely not the rst account of program equivalences, re nements, and metrics for e ectful languages. However, our results are, to the best of the author's knowledge, the rst abstract accounts of operational coinductive techniques for languages with algebraic e ects.

Concerning applicative notions of equivalence, to the best of the author's knowledge, no abstract account exists on applicative coinductive techniques for calculi with algebraic e ects. Nevertheless, there are several works that investigate such techniques for calculi with speci c e ects. Among them, prime examples are given by (C. L. [START_REF] Ong | Non-determinism in a functional setting[END_REF] and (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF], to which this dissertation is in great debt, for nondeterministic calculi, and [START_REF] Crubillé | On probabilistic applicative bisimulation and call-by-value lambdacalculi[END_REF][START_REF] Dal Lago | On coinductive equivalences for higher-order probabilistic functional programs[END_REF] for probabilistic calculi. An abstract account of logic-based equivalences for higher-order languages with algebraic e ects has been developed in [START_REF] Simpson | Behavioural equivalence via modalities for algebraic e ects[END_REF], where congruence properties of the equivalences de ned are proved using our abstract Howe's method. Applicative bisimilarity has also been investigated for languages with non-algebraic e ects, notably for languages with control operators [START_REF] Biernacki | Applicative bisimilarities for call-by-name and call-by-value λµcalculus[END_REF]. However, we have to remark that applicative bisimilarity has been proved to be fragile in presence of non-algebraic e ects, and actually unsound in presence of information hiding [START_REF] Koutavas | From applicative to environmental bisimulation[END_REF].

Normal form bisimulations have been extensively investigated for pure λ-calculi (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Lassen | Eager normal form bisimulation[END_REF][START_REF] Ong | Non-determinism in a functional setting[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF], as well as for calculi with non-algebraic e ects, notably continuations [START_REF] Biernacki | Proving soundness of extensional normal-form bisimilarities[END_REF] and control operators (S. B. Lassen, 2006a;[START_REF] Støvring | A complete, co-inductive syntactic theory of sequential control and state[END_REF]. Until Lassen's work on eager normal form bisimulation (S. B. [START_REF] Lassen | Eager normal form bisimulation[END_REF], normal form bisimilarity has been mainly investigated for call-by-name languages, due to its equivalence with Lévy-Longo tree equivalence, and for the so-called classical theory of λ-calculus [START_REF] Barendregt | The lambda calculus: its syntax and semantics[END_REF], due to its equivalence with Böhm tree equivalence.

To the best of the author's knowledge, no abstract account of normal form bisimilarity in the context of languages with algebraic e ects has been given so far. However, there are some works on speci c e ectful extensions of Böhm trees, notably the work of de Liguoro and Piperno on nondeterministic Böhm trees (De Liguoro & Piperno, 1995), and the work of Leventis on probabilistic Böhm trees [START_REF] Leventis | Probabilistic böhm trees and probabilistic separation[END_REF], as well as works on nondeterministic extensions of weak head normal form bisimulation, notably (S. B. [START_REF] Lassen | Normal form simulation for mccarthy's amb[END_REF].

The situation is rather di erent if one looks at non-coinductive abstract theories of program equivalence. Denotational semantics of e ectful calculi has been studied since Moggi's seminal work [START_REF] Moggi | Computational lambda-calculus and monads[END_REF], thus implicitly providing a notion of program equivalence. All this has been given a more operational avour starting with Plotkin and Power account of adequacy for algebraic e ects (G. D. [START_REF] Plotkin | Adequacy for algebraic e ects[END_REF][START_REF] Manes | Taut monads and t0-spaces[END_REF]. The literature also o ers abstract accounts on logical relations for e ectful calculi. The rst of them is due to [START_REF] Goubault-Larrecq | Logical relations for monadic types[END_REF], which is noticeably able to deal with nondeterministic and probabilistic e ects, but also with dynamic name creation, for which applicative bisimilarity is known to be unsound [START_REF] Koutavas | From applicative to environmental bisimulation[END_REF]. Similar in spirit to our approach, the work of [START_REF] Katsumata | Preorders on monads and coalgebraic simulations[END_REF] (as well as [START_REF] Katsumata | Relating computational e ects by -lifting[END_REF]) analyses monadic lifting of relations in the context of -lifting. Another piece of work which is related to ours is due to Johann, Simpson, and Voigtländer [START_REF] Johann | A generic operational metatheory for algebraic e ects[END_REF], who focused on algebraic e ects and observational equivalence, and their characterisation via CIU theorems and a form of logical relation based -lifting. In both cases, the target language is a call-by-name typed λ-calculus. A further account on logical relations for languages with algebraic e ects is given in [START_REF] Biernacki | Handle with care: relational interpretation of algebraic e ects and handlers[END_REF]. An extensive analysis of observational equivalences and preorders for languages with algebraic e ects (with a case studied on combinations of probability with nondeterminism) is given in [START_REF] Lopez | Basic operational preorders for algebraic e ects in general, and for combined probability and nondeterminism in particular[END_REF].

Concerning program metrics, several works have been done in the past years on quantitative reasoning in the context of programming language semantics. In particular, several authors have used (cartesian) categories of ultrametric spaces as a foundation for denotational semantics of both concurrent [START_REF] Arnold | Metric interpretations of in nite trees and semantics of non deterministic recursive programs[END_REF][START_REF] De Bakker | Denotational semantics of concurrency[END_REF] and sequential programming languages [START_REF] Escardo | A metric model of pcf[END_REF]. Bisimilarity-based distances have been proposed for probabilistic rst-order calculi [START_REF] Du | Behavioural pseudometrics for nondeterministic probabilistic systems[END_REF], where, due to the absence of higher-order features, ampli cation phenomena do not occur (but see [START_REF] Gebler | Compositional bisimulation metric reasoning with probabilistic process calculi[END_REF]). A di erent approach is investigated in [START_REF] De Amorim | A semantic account of metric preservation[END_REF], where a denotational semantics combining ordinary metric spaces and domains is given to pure (i.e. e ect-free) Fuzz. The main theorem of (de Amorim et al., 2017) is a denotational version of the so-called metric preservation [START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF] (whose original proof requires a suitable step-indexed metric logical relation). Corollary 6 is the operational counterpart of such result generalised to arbitrary algebraic e ects.

A di erent but deeply related line of research has been recently proposed in [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF][START_REF] Leijen | Implementing algebraic e ects in c[END_REF], where coinductive, operationally-based distances have been studied for probabilistic λ-calculi. In particular, in [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF] a notion of applicative distance based on the Wasserstein lifting is proposed for a probabilistic a ne λ-calculus. Restricting to a ne programs only makes the calculus strongly normalising and removes copying capabilities of programs by construction. That way programs cannot amplify distances between their inputs and therefore are forced to behave as nonexpansive functions. This limitation is overcome in [START_REF] Crubillé | Metric reasoning about lambda-terms: The general case[END_REF], where a coinductive notion of distance is proposed for a full linear λ-calculus, and distance trivialisation phenomena are studied in depth. The price to pay for such generality is that the distance proposed is not applicative, but a tuple distance somehow resembling environmental bisimilarity [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF].

Future Work

Topics for further work are plentiful. Here we list some major lines of research.

Handlers

This dissertation analyses calculi with algebraic e ects. As remarked in the introduction of this work, the theory of algebraic e ects has been extended with e ect handlers, giving rise to the theory of algebraic e ects and handlers [START_REF] Bauer | Programming with algebraic e ects and handlers[END_REF][START_REF] Plotkin | Handling algebraic e ects[END_REF][START_REF] Pretnar | An introduction to algebraic e ects and handlers[END_REF]. An handler is a syntactical constructor for manipulating the control ow of the program by specifying how to interpret operation symbols. For instance, consider the program print c .e that prints the character c and continues as e. As usual, the operational semantics of print c .e is to rst print c, and then continue as e. We can use handlers to modify the control ow of computation, so that we rst evaluate e, and then we print c. For that we use the handler:

handler {print c .k → let x = k in print c .(return x )}.
Accordingly, the handler acts as way to rede ne the operational behaviour of print c , and thus behaves as a kind of algebraic homomorphism.

It is an open question whether the techniques developed in this dissertation can be extended to languages with algebraic e ects and handlers. This is certainly the case for some (restricted) handlers. An example is provided by Example 21, where a restricted exception handling constructor is introduced. Although non-algebraic, such operation can be easily shown to satisfy condition (Σ comp), meaning that we can apply our abstract soundness results to that calculus.

Extending such a result to arbitrary e ect handlers, however, seems to require non-trivial extension of the framework designed, as the semantics of an operation symbol is now determined by the context in which it is evaluated. A promising route to achieve such a goal seems to look at speci c normal form bisimulations.

Full Abstraction and Non-algebraic E ects

Both e ectful applicative (bi)similarity and e ectful normal form (bi)similarity have been proved to be sound, but not fully abstract for e ectful contextual equivalence/approximation. An interesting question is whether there exist conditions on monads and relators guaranteeing full abstraction results.

Full abstraction of applicative bisimilarity is known to hold for the pure λ-calculus (Abramsky, 1990a), as well as for the probabilistic λ-calculus [START_REF] Crubillé | On probabilistic applicative bisimulation and call-by-value lambdacalculi[END_REF], but to fail for the nondeterministic λ-calculus (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]. The latter perfectly ts the abstract theory of Chapter 5, meaning that proving full abstraction results for e ectful applicative (bi)similarity seems to require a severe restriction on our axioms of Σ-continuous monads and relators. A promising route towards this challenge would be to understand which class of tests (if any) characterise e ectful applicative bisimilarity, depending on the underlying monad and relator, this way generalising results in [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF] and [START_REF] Crubillé | On probabilistic applicative bisimulation and call-by-value lambdacalculi[END_REF].

Another interesting line of research is to investigate whether the theory of normal form bisimulation can be extended to languages with non-algebraic e ects. In particular, normal form bisimilarity has been extended to languages with local states [START_REF] Støvring | A complete, co-inductive syntactic theory of sequential control and state[END_REF], control operators [START_REF] Biernacki | Proving soundness of extensional normal-form bisimilarities[END_REF], and both control operators and local states, where it has additionally been proved to be fully abstract for contextual equivalence [START_REF] Støvring | A complete, co-inductive syntactic theory of sequential control and state[END_REF]. In light of such results, it is natural to ask whether there exists an abstract notion of normal form bisimulation for languages with local e ects. Achieving such a result would be a major improvement in the theory of normal form bisimulation, especially considering that applicative bisimilarity has been proved to be unsound for several languages with non-algebraic e ects [START_REF] Koutavas | From applicative to environmental bisimulation[END_REF].

E ectful Logical Relations

Recalling the distinction between observational, applicative (or extensional), intensional, and logical program equivalence made in the introduction, it is clear that a major issue that has not been addressed in this work concerns e ectful logical equivalences. Logical relations techniques for e ectful languages have been extensively investigated both for languages with speci c algebraic e ects [START_REF] Bizjak | Step-indexed logical relations for probability[END_REF][START_REF] Culpepper | Contextual equivalence for probabilistic programs with continuous random variables and scoring[END_REF] and for e ectful languages in general [START_REF] Goubault-Larrecq | Logical relations for monadic types[END_REF][START_REF] Katsumata | Relating computational e ects by -lifting[END_REF][START_REF] Katsumata | Preorders on monads and coalgebraic simulations[END_REF]. In particular, the latter work uses relation lifting constructions resembling relators, and thus seems to suggest the applicability of our relational framework to study e ectful logical relations.

We also remark that logical relations for general algebraic e ects have been studied in [START_REF] Johann | A generic operational metatheory for algebraic e ects[END_REF] and [START_REF] Biernacki | Handle with care: relational interpretation of algebraic e ects and handlers[END_REF]. The latter work seems to have some limitations for our purposes, since the calculus studied does not take into account pure algebraic operations, i.e. (algebraic) operations whose semantics is de ned independently of handlers. Having such operations give calculi more expressive power, as handlers alone do not allow for a ne analysis of e.g. true probabilistic nondeterminism (the latter requires to have operations, either internal or external to the calculus, that act as sources of probabilistic nondeterminism). More relevant for us is [START_REF] Johann | A generic operational metatheory for algebraic e ects[END_REF], where logical relations for a call-by-name polymorphic PCF (G. [START_REF] Plotkin | Lcf considered as a programming language[END_REF] enriched with algebraic operations are de ned. It is not hard to realise that the de nition of such logical relations can be mimicked in our framework relying on the observation function of Chapter 6 and on a suitable step-indexing [START_REF] Appel | An indexed model of recursive types for foundational proof-carrying code[END_REF], and that the logical relations thus obtained can be used to provide an alternative characterisation of e ectful contextual equivalence/approximation. That holds for both call-by-name and call-by-value calculi.

An abstract understanding of the relationship between logical relations and notions of bisimulation is, however, still missing.

Program Distances and Coe ects

Compared to the results achieved on program equivalence and re nements, our investigation on program distance is at its very beginning. A rst extension of the theory developed is the design of e ectful contextual and CIU distances. Such distances should be de nable by generalising the results of Chapter 5 to V-Fuzz and V-relations. The author conjectures that to be possible, provided one restricts to nitelycontinuous change of base functors. On a similar line of research, the development of e ectful distances based on logical relations, along the lines of [START_REF] Reed | Distance makes the types grow stronger: a calculus for di erential privacy[END_REF], should be rather straightforward.

A potentially more interesting notion of program distance might be the generalisation of normal form bisimilarity to the abstract setting of quantale-valued relations.

On a di erent side, we observe that program sensitivity is an instance of the more general notion of a coe ect. Coe ects [START_REF] Brunel | A core quantitative coe ect calculus[END_REF][START_REF] Gaboardi | Combining e ects and coe ects via grading[END_REF][START_REF] Petricek | Coe ects: a calculus of context-dependent computation[END_REF] are a formalism introduced to model context-dependent computations, i.e. computations whose behaviour depends on the context in which they happen. From a mathematical perspective, coe ects are the dual of e ects. As a consequence, as e ects are modelled as monads, coe ects are modelled as comonads. This suggests the possibility of looking at more general notions of distances (as well as equivalences), for e ectful and coe ectful calculi.

Finally, recalling the informal introduction to program metric of Chapter 9, we notice that the development of the theory of applicative bisimulation distances is rooted in the re nement of Assumption 3 (non-expansiveness) into Assumption 4 (Lipshitz-continuity). Such a re nement allowed us to bypass problems raised by distance trivialisation. However, that was only one possible route to de ne well-behaved notions of program distance. Another possibility is the one investigated in [START_REF] Crubillé | Metric reasoning about lambda-terms: The general case[END_REF], where the proposed notion of tuple distance can be seen as a way to re ne Assumption 1 by de ning distances not on pairs of terms, but on pairs of tuples. Looking at other possible 'non-standard' notions of program distance is a stimulating topic for further research.

Appendix B Spans

In order to have a better grasp of the Barr extension of a functor, it is useful to look at relations using the notion of a span [START_REF] Bruni | Some algebraic laws for spans (and their connections with multirelations)[END_REF][START_REF] Carboni | Bicategories of spans and relations[END_REF].

De nition 81. A span on a category C is given by an ordered pair of C-morphisms (α : U → X , β : U → Y ). The object U is called the source of the span.

We use the notation X → Y . Spans, however, retain more information than relations, as they are sensitive to multiplicity (in fact, there is a correspondence between spans and relations over multisets; see [START_REF] Bruni | Some algebraic laws for spans (and their connections with multirelations)[END_REF] for details).

Barr's construction can be seen as a construction on spans. In fact, we can de ne the Barr extension of a functor T as the map T on spans thus de ned:

T : X α ← -Z β -→ Y → T X T α ← --T Z T β --→ Y
This abstract perspective on Barr's construction gives several insights on the structure of T . For instance, given the prime role of pullbacks in the de nition of span composition, it comes with no surprise that in order for T to satisfy (rel 2) (properly generalised to spans), T need preserve weak pullbacks.

We conclude remarking that we can indeed safely look at Barr's construction in terms of span, rather than relation. This is not evident, in principle, as spans and relations are not in a one-to-one correspondence, and thus di erent spans may represent di erent relations. Nonetheless, we can easily prove that Barr's construction is independent from the span representation of a relation. Proof. First of all notice that the map e = ι • α, β is surjective.

U α β α ,β X × Y _ ι X G R π 1 o o π 2 / / Y
In fact, for any (x, ) ∈ G R we have x (π 2 •π • 1 ) , and thus x (β •α • ) . That means that there exists u ∈ U such that α (u) = x and β (u) = , meaning that e (u) = (x, ). Since e is a surjection, by the axiom of choice T e is a surjection too. In particular, we have T e • (T e) • = I, and thus we can calculate as follows:

T β • (T α ) • = T (π 2 • e) • (T (π 1 • e)) • = T π 2 • T e • (T e) • • (T π 1 ) • = T π 2 • (T π 1 ) • .

  Figure 2.1: Syntax of Λ Σ .

Figure 2 . 3 :

 23 Figure 2.3: Computation tree of e ( x(z, x ).((return I ) or zx )) .

  , relate (possibly open) computations with (possibly open) computations, and (possibly open) values with (possibly open) values.

Example 2 .

 2 Both the discrete/identity relation I and the indiscrete relation 0 de ned by the rules below are open λ-term relations. The empty relation is an open λ-term relation too.

Figure 2 . 4 :

 24 Figure 2.4: Compatible re nement of R.

Example 12 (

 12 Output monad). Both for the total (i.e. O) and the partial (i.e. O ∞ ) output monad we de ne the signature Σ O {print c : 1 | c ∈ A}. The intended semantics of a program print c (e) is to print the character c and then continue as e. Formally, we interpret print c as print c O (w, x) (c • w, x), where (w, x) ∈ O ∞ (X ) and c •w denotes the string obtained by appending c to w. Straightforward calculations show that both for O and O ∞ are Σ O -algebraic.

  Example 21 (λ-calculus with exceptions). We now instantiate Λ Σ with the monad ME and its associated signature Σ ME plus a new operation for handling exceptions. The concrete syntax of the calculus is thus de ned: , w ::= x | λx.e e, f ::= return | w | let x = e in f | raise e | handle e (e, f ).

  f ) ⇓ e e f ⇓ handle e (e, f ) ⇓ raise e e e[x := ] e (λx.e) e e e let x = e in f e e ⇓ f [x := ] e let x = e in f e e e f e handle e (e, f ) e

  x = e in f let x = e in f , we see that e = (n, just ) if and only if e ⇓ performing n (β-)reduction steps, i.e. steps of the form (λx.e) → e[x := ].

Example 35 .

 35 The relators M, ME, FM, DM, Ô∞ , Ĉ, M ⊗ G, FM ⊗ G, DM ⊗ G, C ⊗ G are Σ-continuous.

Example 36 .

 36 Both the discrete/identity relation I and the indiscrete relation 0 de ned by the rules below are open λ-term relations. The empty relation is an open λ-term relation too.

  c and -o : Rel c → Rel restring open λ-term relations to closed ones, and extending closed λ-term relations to open ones. Formally, we de ne such maps as follows. De nition 25. Given a λ-term relation R ∈ Rel, de ne the closed restriction

  It is not hard to prove that the discrete open λ-term relation I of Example 36 is a pre-xed point of R → R. Moreover, it is the least such. As a consequence, any compatible relation is re exive. Dually, the indiscrete open λ-term relation 0 is the greatest xed point of R → R. Remark 7. If Σ consists of nitary operations only (as in most of the examples studied), then Denition 27 can be slightly simpli ed by replacing rule (comp-op) with the following one (for any n-ary operation symbol op in Σ):

Lemma 12 .

 12 Let α ⊆ Rel be a predicate on open λ-term relations closed under non-empty union and composition. If I ∈ α, then there exists a largest compatible λ-term relation in α. Proof. De ne the λ-term relation S as S {R ∈ α | R ⊆ R}.

  } contains the discrete open λ-term relation, and it is closed under non-empty union and composition. Proof. We show that the open λ-term relation I is in Adeq Γ . We rst notice that Λ eIf implies e I Λ f , and thus e = f . By property (rel 1) we have that e ΓI V e , and thus e Γ0 V e , since Γ is monotone. Let us now prove closure under relation composition. Given two open λ-term relations R, S ∈ Adeq Γ , assume Λ e (S • R) f .

  val) De nition 32 induces a map R → [R] on the complete lattice of closed λ-term relations. Since Γ is monotone, then so is R → [R]. Lemma 14. The map R → [R] is monotone.

  to a monadic values e ∈ T V • . De nition 38. De ne the N-indexed family of mapsn : Λ • → T V • as follows: λx.f )e] n+1 E[f [x := e]] n E[op(p, x.e) n+1 op (p, → E[e[x := ]] n )

  e M f , for any term . As a consequence, for any evaluation context E, e M f implies E[e] M E[f ], and thus obs (E[e]) obs (E[f ]). To prove ciu ⊆ M we proceed by coinduction showing that R {( E[e] , E[f ] ) | e ciu f } is a monadic simulation. Clearly R is closed under the lifting of application, since E[e] * f = E[e]f = E [e] , for E E f . To conclude the thesis, we have to show obs (E[e]) obs (E[f ]). This is obviously the case since e ciu f . Corollary 3. Monadic bisimilarity M coincides with CIU equivalence ciu . Example 40. We show that if op 1 (p, i → η( * )) = η( * ), then λs distribute over operations. I.e. op(p, x.λ .e) M λ .op(p, x.e). By Corollary 3, it is su cient to show op(p, x.λ .e) ciu λ .op(p, x.e). Let E [-]f 1 • • • e n . We show by induction on n obs (E[op(p, x.λ .e)]) = obs (E[λ .op(p, x.e)]).

Figure 6 . 1 :

 61 Figure 6.1: Howe and evaluation context extension of R for Λ (n)Σ .

Example 41 .

 41 Our rst example comes from the ordinary theory of pure, untyped λ-calculus. Let us consider Curry and Turing call-by-value xed point combinators Y and Z : Y λ .∆∆ Z ΘΘ ∆ λx. (λz.xxz) Θ λx.λ . (λz.xx z).

  ∆[ := ]∆[ := ] = (λz.∆[ := ]∆[ := ]z) MR V (λz.ΘΘ z) too. Assuming = λx.e, we can rewrite the above requirement as: e[x := λz.∆[ := ]∆[ := ]z] MR V e[x := λz.ΘΘ z] .

  Figure 7.1, where x ranges over a xed (countably in nite) set of variables, op : P V ranges over elements 2 of Σ, and p ranges over elements of P. Notational and syntactical conventions of Chapter 3 are left unchanged. In particular, we denote by Λ and V ⊆ Λ the collections of (open and closed) terms and values of Λ Σ , respectively. | op(p, x.e).

  φ(E[(λx.e) ]) = φ(E[e[x := ]]) φ(E[op(p, x.e)) = op E (p, → φ(E[e[x := ]])).

Lemma 27 (

 27 Substitution Lemma for Λ (v) Σ ). Let σ be the substitution -[ := w], and let us write σ for -[ := w] . The following hold: e σ = ( e >>= σ ).

  e[x := ][ := w] = e[ := w][x := [ := w]].

  [ := e ], and let us write σ for -[ := e ] . The following hold: e σ n e n >>= σ n e n >>= σ e σ e σ = ( e >>= σ ).

  It is easy to see that a term relation R is an enf-simulation if and only if R ⊆ [R]. Notice also that although [R] E always contains the identity relation on variables, R E does not have to: the empty relation (∅, ∅) is an enf-simulation. Lemma 32. The mapping R → [R] is monotone. Proof. Suppose R ⊆ S. If e [R] Λ e , then we have e ΓR E e . Since R ⊆ S and Γ is monotone, we conclude e ΓS E e . If s [R] E s , then we have three possible cases to consider. • If (s, s ) = (x, x ), for some variable x, then we trivially have s [R] E s . • If (s, s ) = (λx.e, λx.e ) with e R Λ e , then since R ⊆ S we infer e S Λ e , and thus λx.e [S] E λx.e .

Example 45 .

 45 Recall the probabilistic call-by-value xed point combinators of Example 42: Y λ .∆∆ Z ΘΘ ∆ λx. (λz.xxz) Θ λx.λ .( (λz.∆∆z) or (λz.xx z)). Let us consider the relator DM for probabilistic partial computations. We show Y E Z by coinduction, proving that the term relation R = (R Λ , R E ) whose graph is de ned as follows 4 is an enf-simulation (where I Λ and I E denote the identity relations on terms and enfs, respectively): R Λ {(Y , Z ), (∆∆z, Z z), (∆∆, (λz.∆∆z) or (λz.Z z))} ∪ I Λ R E {( (λz.∆∆z), (λz.Z z)), (λz.∆∆z, λz.Z z), (λ .∆∆, λ .( (λz.∆∆z) or (λz.Z z))), ( (λz.∆∆z)z, (λz.Z z)z)} ∪ I E The term relation R is obtained by starting with the relation {(Y , Z )} and progressively adding terms and eager normal forms going through clauses (enf comp)-(enf stuck) in De nition 48. Checking that R is an enf-simulation is straightforward. We show a couple of cases as illustrative examples.

  [R]. Example 46. Recall Example 43. We prove P W Q by coinduction, showing that the term relation R = (R Λ , R W ) (whose graph is) de ned as follows is a whnf-simulation: R Λ {(P, Q ), ( (P z) or z(Pz ), (Qz ) or z(Q z)), (P z, Qz ), (Pz , Q z)} R W {(λ .λz. (P z) or z(Pz ), λ .λz. (Qz ) or z(Q z)), (λz. (P z) or z(Pz ), λz. (Qz ) or z(Q z))

  Suppose w = λx. . Then we have e = [ := ]. By induction hypothesis on E w R SC w we have w = λx. with R SC Λ , and thus s = λx. [ := ]. Since s R SC by rule (Λ-sc.subst) we conclude Λ [x := ] R SC [x := ], and thus we are done.

Figure 7 . 3 :

 73 Figure 7.3: Compatible and substitutive closure construction for Λ (n)Σ .

x

  Let us now consider the ogre combinator O ≡ Y K, where K λx.λ .x and Y is Curry xed point combinator. Let us write ∆ K for λx.K (xx ).Since O = just λ .∆ K ∆ K and ∆ K ∆ K = just λ .∆ K ∆ K , we see that LT (O )is given as the solution to the equation ξ = just (λ .ξ ). Omitting just annotations, we can represent LT (O ) as the following tree, and thus see that LT (O ) coincides with . Example 51. Let T be the partial powerset monad FT. We have: LT (λx.(x or Ω)) = {just (φ(λx.(x or Ω)))} = {just (λx.LT (x or Ω))} = {just (λx.{just x, ⊥})} LT ((λx.x ) or (λx.Ω)) = {just (φ(λx.x )), just (φ(λx.Ω))} = {just (λx.{just x }), just (λx.{⊥})}.

µ

  έσoν τ ε καὶ ά ριστoν Aristotle, Nicomachean Ethics Chapter 7 is the last chapter of this dissertation that deals with notions of program equivalence and program re nement. Chapter 9 to Chapter 12 are entirely dedicated to the study of the so-called program metrics or program distances.

  (C[e], C[e ]) between C[e] and C[e ] is always bounded by the distance δ (e, e ), no matter how C[-] uses e and e . This intuition gives our third assumption. Assumption 3. A program distance δ = (δ Λ , δ V ) is compatible if for all programs e, e and any context C, we have: δ Λ (C[e], C[e ]) ≤ δ Λ (e, e ).

Assumption 4 .

 4 A program distance δ is compatible if for all programs e, e and context C with sensitivity s, δ (C[e], C[e ]) ≤ s • δ (e, e ).

4.

  The unit interval quantale I = ([0, 1], ≥, +, 0) is obtained by restricting the Lawvere quantale to the unit interval [0, 1] and addition to truncated addition. 5. A left continuous triangular norm (t-norm for short) is a binary operator * : [0, 1] × [0, 1] → [0, 1] that induces a quantale structure over the complete lattice ([0, 1], ≤) in such a way that the quantale is commutative. Examples of t-norms are:(a) The product t-norm: x * p x • .(b) The Łukasiewicz t-norm: x * l max{x + -1, 0}.

  Figure 10.2: Typing rules for V-Fuzz.

  ), a x , b bounded}, where a x , b bounded means that there exist ā, b ∈ R such that ∀x. a x ≤ ā, and ∀ . b ≤ b.

  where a x , b are bounded. Clearly Dα (|z , |w ) = a x + b , for suitable x ∈ X and ∈ Y . Since a x + b ≤ α (x, ) we are done.

  a) false Using φ and ψ we associate to every V-relation α its kernel 2-relation φ • α and to any 2-relation R the V-relation ψ • R. Similarly, we can associate to each V-relator Γ the 2-relator ∆

Figure 12 . 2 :

 122 Figure 12.2: Compatibility clauses.

  are non-empty. By induction hypothesis we have B ∈ B andC ∈ C. Let d = (s ∧ 1) • Σ ⊗ ∆ α (let x = e in f , ) : τ . We can now apply rule (H-let) obtaining (s ∧ 1) B ⊗ C ⊗ d ∈ A.To see that the latter is actually A it is su cient to show that for any a ∈ A we have a ≤(s ∧ 1) B ⊗ C ⊗ d. But any a ∈ A (with a ) is of the form (s ∧ 1)(b) ⊗ c ⊗ d for b ∈ B, c ∈ C,and d ≤ d. We are done since both (s ∧ 1) and ⊗ are monotone. It is not hard to convince ourselves that De nition 77 and De nition 78 gives the same λ-term Vrelation. In particular, for an open λ-term V-relation α, α H is the least compatible λ-term V-relation satisfying the inequality α o • β ≤ β. The following are standard results. Proofs are straightforward but tedious (they closely resemble their relational counterparts), and thus are omitted. Lemma 41. Let α be a re exive and transitive closed λ-term V-relation. Then the following hold:

  op( --------→ e i [x := ]), op( ---------→ e i [x := w])). (12.10)Finally, as α is value-substitutive, from (12.8) we obtain:b ≤ op V ( Γ i ), α (op( ---------→ e i [x := w]) f [x := w]) : τ .The latter together with (12.5) impliesop V ( --------→ s i (a) ⊗ a i ) ⊗ b ≤ op V ( Γ i ) α H (op( --------→ e i [x := ]), f [x := w])

  3. We have to prove:α H τ ((λx.e) , f ) ≤ Γα H τ ( (λx.e) n+1 , f ).As (λx.e) n+1 = e[x := ] n , it is su cient to show that for any a such that|= Λ a ≤ α H ((λx.e) , f ) : τ holds, we have a ≤ Γα H τ ( e[x := ] n , f ) . Assume |= Λ a ≤ α H ((λx.e) , f) : τ . The latter must have been inferred via an instance of rule (H-app) from premises:|= Λ b ≤ α H ( , w ) : σ (12.13) |= Λ c ≤ α H (λx.e, u) : σ τ (12.14) d ≤ α τ (uw, f ).

  e[x := ], [x := w]) ≤ Γα H τ ( e[x := ] n , [x := w] ).Finally, from (12.15), by de nition of applicative simulation distance we infer d ≤ Γα τ ( [x := w] , f )

  u) : ! s σ (12.18) x : r •s σ |= Λ c ≤ α H (e, e ) : τ (12.19) d ≤ α τ (case u of {!x → e }, f ).

  (r • s) • α H σ ( , ) ⊗ c ≤ α H τ (e[x := ], e [x := ]). The latter, together with the inequality b ≤ s • α H σ ( , ), implies r (b) ⊗ c ≤ α H τ (e[x := ], e [x := ]).Applying the induction hypothesis we conclude:r (b) ⊗ c ≤ Γα H τ ( e[x := ] n , e [x := ] ).Finally, from (12.20), by de nition of applicative simulation distance we inferd ≤ Γα τ ( e [x := ] , f )(recall that u = ! ) and thus conclude the thesis by (Γ pseudo-trans.).6. We have to prove:α H τ (let x = e in f , ) ≤ Γα H τ ( let x = e in f n+1 , ).As let x = e in f n+1 = f [x := _] † n e n , it is su cient to prove that for any a such that|= Λ a ≤ α H (let x = e in f , ) : τ is derivable, we have a ≤ Γα H τ ( f [x := _] † n e n , ). Suppose|= Λ a ≤ α H (let x = e in f , ) : τ . The latter must have been inferred via an instance of rule (H-let) from premises:|= Λ b ≤ α H (e, e ) : σ (12.23) x : s σ |= Λ c ≤ α H ( f , f ) : τ (12.24) d ≤ α τ (let x = e in f , ).(12.25)In particular, we have a = (s ∧ 1)(b) ⊗ c ⊗ d. We now claim to have:(x : s σ α H ( f , f ) : τ ) ⊗ (s ∧ 1) • α H σ (e, e ) ≤ Γα H τ ( let x = e in f n+1 , let x = e in f ). (12.26)By very de nition of Howe extension, the latter obviously entails (s ∧ 1)(b) ⊗ c ≤ Γα H τ ( let x = e in f n+1 , let x = e in f ).

  (x : s σ α H ( f , f ) : τ ) ⊗ (s ∧ 1) • Γα H σ ( e n , e ) ≤ Γα H τ ( f [x := _] † n e n , f [x := _] † e ). (12.27)Consider the diagram:

7.

  We have to prove:α H σ (op(e 1 , . . . , e m ), f ) ≤ Γα H σ ( op(e 1 , . . . , e m ) n+1 , f )

  ) H (e, e) : σ ≤ ¯ :Γ Λ (δ o ) H (e[ x := ¯ ], e [ x := ¯ ]) : σ ≤ ¯ δ Λ σ (e[ x := ¯ ], e [ x := ¯ ]) = Γ Λ δ o (e, e ) : σ .A similar argument holds for values.

  e[ x := ], e[ x := w]).

(

  Γ Λ α (e, f ) : τ ) ≤ ¯ :Γ α Λ τ (e[ x := ¯ ], f [ x := ¯ ]).

  H (e, e ) : σ ) ⊗ (Γ (α H )(n) (e , e ) : σ )⊗ f (∆, x : s σ α H ( f , f ) : τ ) ⊗ (∆, x : s σ (α H ) (n) ( f , f ) : τ ) ≤ c.Since s ∧ 1 is continuous it is su cient to prove that for all terms e , f we have:(s ∧ 1) • (Γ α H (e, e ) : σ ) ⊗ (s ∧ 1) • (Γ (α H ) (n) (e , e ) : σ ) ⊗ (∆, x : s σ α H ( f , f ) : τ ) ⊗ (∆, x : s σ (α H ) (n) ( f , f ) : τ ) ≤ c, i.e. (s ∧ 1) • (Γ α H (e, e ) : σ ) ⊗ (∆, x : s σ α H ( f , f ) : τ ) ⊗ (s ∧ 1) • (Γ (α H ) (n) (e , e ) : σ ) ⊗ (∆, x : s σ (α H ) (n) ( f , f ) : τ ) ≤ c.

  be de ned as follows, provided that C has enough pullbacks. Let U be a pullback of β : U → Y and φ : W → Y , then de ne: Since pullbacks are unique modulo isomorphism, we need to work with equivalence classes of spans. For any C-object U the span U 1 is obtained by taking a pullback of β : U → Y and 1 : Y → Y . Obviously U 1 used as set-theoretic presentation of relations. In fact, any relation R can be represented as the span X de nes a relation, namely β • α • : X +

Lemma 46 .

 46 Let R : X + → Y be a relation, and let X be another span representing R, that is such that β• α • = π 2 • π • 1 holds. Then T X TY represent the same relation too; that is, T β • (T α ) • = T π 2 • (T π 1 ) • holds.

  .1.

	λ-calculus syntax	ne-grain syntax
	x	return x
	λx.e	return λx.e
	f e

let x = f in (e to .x ) op(p, x.e) op(p, x.e)

Table 3

 3

.1: Correspondence between ne-grain and coarse-grain calculi

  and only if just ∈ e , and dually e ⇑ if and only if ⊥ ∈ e . Moreover, we can recover a must converge semantics by noticing that e must converge if and only if ⊥ e . It follows that e = ⊥ if and only if e must diverge.

  The open extension of) e ectful CIU approximation and e ectful CIU equivalence coincide with e ectful contextual approximation and e ectful contextual equivalence, respectively.Proof. By Lemma 20 (and previous discussion) ( ciu ) H restricted to closed values is contained in ciu , and thus ( ciu ) H coincides with ( ciu ) o . Therefore ( ciu ) o is compatible, substitutive, and preadequate, and thus contained in ctx . By Lemma 19 ctx is included in ( ciu ) o , and thus we have ( ciu ) o = ctx . Finally, by Proposition 15 we have ( ciu ) o = ctx too.

  e ( ciu ) H (H-app) for some terms c, f . By induction hypothesis, from E [e] ( ciu ) H c we infer the existence of an evaluation context F and a term f such that E ( ciu ) E F , e ( ciu ) H f , and F [f ] ciu c. From the latter we infer F [f ]f Finally, by rule (E-app) we see that e ( ciu ) H f and E ( ciu ) E F implies E e ( ciu ) E F f , and thus we are done taking F F f . Lemma 24. For all closed evaluation contexts E, F and closed terms e, f , if E ( ciu ) E F and e ( ciu ) H f , then obs (E[e]) obs (F [f ]).

ciu c f , and thus F [f ]f ciu , since c f ciu and ciu is transitive.

  SC E t holds. By condition (rel unit) it is su cient to show xt R SC E xt which can be easily seen to be the case by case analysis on t. If t is a value , then by Lemma 33 t is a value too. But then both xt = x and xt = x are stuck terms. We conclude the thesis by rule (E-sc.E). If t is a stuck term, say E[ ], then by Lemma 33 t is a stuck term too, say E [ ] with R SC SC Λ xE [z] holds too, and thus we can conclude the desired thesis by rule (E-sc.E), since both xE and xE are evaluation contexts. Case s = λx.c. By Lemma 33 we have s = λx.c with c R SC Λ c . Proceeding as in previous case, we reduce the proof to showing that t R SC E t implies (λx.c)t n ΓR SC E (λx.c )t . We assume t R SC E t and prove the thesis by case analysis on t. Case t = .

	E	and
	E[z] R SC

condition (rel bind) it is su cient to show n ΓR SC E h and that t R SC E t implies xt n ΓR SC E xt . The former follows from part (2) of the induction hypothesis, whereas the latter amounts to prove η(xt ) ΓR SC E η(xt ) for all enfs t, t such that t R Λ E [z]. But then xE[z] R

  The clause for σ τ generalises the usual applicative clause, whereas the clause for ! s σ 'scale' α V

σ by s. It is easy to see that the above de nition induces a map α → [α] on the complete lattice of closed λ-term V-relations. Moreover, such map is monotone since both Γ and CBEs are.

De nition 76.

De ne e ectful applicative similarity distance with respect to Γ, denoted as δ , as the greatest xed point of α → [α]. That is, δ is the greatest (closed) λ-term V-relation satisfying the equation α = [α] (such greatest solution exists by the Knaster-Tarski Theorem).

  H ( e 1 n , f 1 ), . . . , Γα H ( e m n , f m )) ≤ Γα H σ ( op V σ ( e 1 n , . . . , e m n ), op V σ ( f 1 , . . . , f m )) = Γα H σ ( op(e 1 , . . . , e m ) n+1 , op( f 1 , . . . , f m ) ),

https://www.eff-lang.org/.

Quoted from[START_REF] Gabbrielli | Programming languages: Principles and paradigms[END_REF].

Whereby the meaning of a complex expression is determined by its structure and the meanings of its constituents.

Notice, however, that ALGOL 60 is a sequential procedural language, rather than a functional one.

Consider, for instance, the following Standard ML piece of code[START_REF] Milner | De nition of standard ML[END_REF], to which we refer to as P : fn x=>((fn y=>y)x). Regarded as a λ-term, the latter can rewritten as λx .((λ . )x ). According to our de nition of reduction strategy (say the call-by-value one), an application of the β -rule gives λx .x . However, the evaluation mechanism of Standard ML treats P as value, and does not evaluate (fn y=>y)x.

That is, a program re nement is a relation between program phrases relating pairs of programs e, e according to the rationale that the behaviour of e is re ned by (or approximates) the behaviour of e . Mathematically, moving from program equivalence to program re nement means moving from equivalences to preorders, and from congruence to precongruence relations.

Contextual equivalence being the largest relation satisfying a desired property P (notably, being a compatible equivalence relation equating λ-terms for their convergence behaviour), it can be seen as a canonical relation satisfying P . Its universal

This is indeed the case in Set Theory, where everything is a set ( sets are essentially built starting from the empty set using the axioms of e.g. Zermelo and Frankel[START_REF] Jech | Set theory[END_REF]) and set-theoretic equality is de ned by means of the axiom of extensionality.

Theorem (also known as Separation Theorem)[START_REF] Böhm | Alcune proprietà delle forme βη-normali del λk-calcolo[END_REF], open bisimilarity has been proved to be fully abstract for contextual equivalence when the λ-calculus is equipped with the head reduction strategy.17 That of course does not mean that the analysis of e ect-free programs is meaningless: several interesting notions can be actually studied in the setting of e ect-free programs, where such notions nd good approximations.

This is not entirely true, as, for the sake of the argument, we are overlooking issues related to non-termination and partiality.

Strachey took the expression referential transparency from (van Orman Quine, 1964).

Of course we also need to have a special function η : A → T (A) playing the role of the unit of • T .

Moving from the analysis of exception handlers, the theory of algebraic e ects has been extended to the so-called theory of e ects and handlers[START_REF] Bauer | Programming with algebraic e ects and handlers[END_REF][START_REF] Plotkin | Handling algebraic e ects[END_REF][START_REF] Pretnar | An introduction to algebraic e ects and handlers[END_REF]. The latter is obtained by extending

Understanding how to re ne compatibility is not straightforward, and we will come back on that later.

It is a fascinating question how to generalise the notion of a program distance to the (richer) notion of a program di erence.

The idea of regarding di erence as having an ontological privilege over identity is at the heart of the eld of philosophy known as Di erential Ontology[START_REF] Donkel | The theory of di erence: Readings in contemporary continental thought[END_REF].

See Subsection 1.1.2 for a short remark on terminology.

(resp. w) and identify terms up to renaming of bound variables. A program is a closed computation, i.e. a computation without free variables. In light of the relational apparatus we will develop in next sections, it is useful to introduce the 'hygienic' convention of keeping track of free variables of computations and values. We do so by means of sequents of the form Γ Λ e and Γ v . The letter Γ ranges over nite sets of variables, and the intended meaning of a sequent Γ Λ e is that e is a computation with free variables among Γ (the sequent Γ v has a similar reading). Rules for sequents are given in Figure2.2, where we write Γ, x in place of Γ ∪ {x }.Clearly, provable sequents are closed under weakening, meaning that if Γ Λ e (resp. Γ v ) is provable, then so is Γ, x Λ e (resp. Γ, x v ). From now on when speaking about sequents we will tacitly mean provable sequents. Closed terms thus correspond to sequents with empty premises (which 28Γ, x v x Γ, x Λ e Γ v λx.e Γ v Γ v w Γ Λ w Γ v

Overloading the notation, we de nef ⇐⇒ ∀x ∈ X . f (x ) (x ) ⊥(x ) ⊥..

In general, a bisimulation is a relation R such that both R and its converse R • are simulation.

An analogous argument holds for probabilistic applicative bisimilarity (and more generally for notions of program equivalence) and equational reasoning. Moreover, the notion of compositionality is oftentimes de ned as the principle stating that the meaning of an expression is a function of the meaning of its parts (i.e. its sub-expressions). If we de ne the meaning of a program as its equivalence class modulo a given program equivalence, then our notion compositionality states exactly that the meaning of a program is determined by the meaning of its sub-expressions.

∀Γ, , w. Γ v R w =⇒ Γ v S w.We will take advantage of the complete lattice structure of Rel by de ning λ-term relations both inductively and coinductively.Additionally, given λ-term relations R and S we can de ne the composition of S with R, denoted by S • R, as follows:Γ Λ e R Γ Λ S f Γ Λ e (S • R) f Γ v R u Γ v u S w Γ v (S • R) wSince both R and S are closed under weakening, then so is S • R. Moreover, we see that the unit of composition is given by the discrete λ-term relation I.As a consequence, we obtain the notion of a preorder λ-term relation. In fact, we say that λ-term relation R is re exive if I ⊆ R and transitive if R • R ⊆ R. Moreover, we can de ne the converse λ-term relation R • of R by the rules below, hence obtaining the notion of symmetric λ-term relation (i.e. a λ-term relation such that R • ⊆ R) and thus the notion of an equivalence λ-term relation too.

Notice that the notation R Λ (resp. R V ) is not de ned for open λ-term relations, so that we can safely use that to denote the computation (resp. value) component of R c .

De nition 6. The compatible re nement R of an open λ-term relation R is de ned by the rules in Figure 2.4. We say R is compatible if R ⊆ R, and that a closed λ-term relation is compatible if its open extension is.Γ, x v x R x (comp-var) Γ, x Λ e R f Γ v λx.e R λx.f (comp-abs) Γ v R Γ v w R w Γ Λ w R w (comp-app) Γ v R w Γ Λ return R return w (comp-ret)Γ Λ e R e Γ.x Λ f R f

2.4 Howe's MethodIn light of previous discussion, it is of paramount importance for our aims to prove (the open extension of) probabilistic applicative bisimilarity to be compatible. A direct attempt to prove compatibility of probabilistic applicative similarity requires to show to be substitutive, which turns out to be problematic (see[START_REF] Pitts | Howe's method for higher-order languages[END_REF]). Howe bypassed the problem by constructing a λ-term relation H extending that is compatible by construction. The so-called Key Lemma states that H is indeed a simulation, and thus coincide with , by coinduction.De nition 8. Given a closed λ-term relation R, the Howe extension R H of R is inductively de ned by the following rules:

Γ, x v x R Γ, x v x R H (H-var) Γ, x Λ e R H f Γ v λx.f R Γ v λx.e R (H-abs) Γ v R H Γ v w R H w Γ Λ w R e Γ Λ w R H e (H-app) Γ v R H w Γ Λ return w R e Γ Λ return R H e (H-val) Γ Λ e R H e Γ, x Λ f R H f Γ Λ let x = e in f R Γ Λ let x = e in f R H

According to(Hyland et al.,

2007) continuations involve logical, as opposed to algebraic, operations. 2 Non-algebraicity of exception handlers led to the development of more general theories of algebraic e ects, where algebraic operations are combined with speci c algebraic morphisms manipulating the control ow of programs. Such morphisms are called handlers, and the resulting theory goes under the name of theory of e ects and handlers[START_REF] Bauer | Programming with algebraic e ects and handlers[END_REF][START_REF] Plotkin | Handling algebraic e ects[END_REF][START_REF] Pretnar | An introduction to algebraic e ects and handlers[END_REF].3 In Chapter 10 and Chapter 11 we will study a re nement of Rel, where relations take values over arbitrary quantales[START_REF] Rosenthal | Quantales and their applications[END_REF]).

For instance, consider the programs e (return ) or Ω and f return , where or is a nondeterministic choice operation. Modelling nondeterministic computations using the full powerset monad P, we see that both both e and f produce the set { } as outcome. However, if we instead model nondeterministic computations using the monad FM, then we see that e produces the set {just , ⊥} as outcome, whereas f produces { }. Both e and f may converge, but, contrary to e, f must also converge.

For simplicity, we write only those p i s such that p i > 0.

Additionally, we will mostly work with countable sets (such as the set of values), so that x ∈X µ (x ) will be always de ned.

A concept we will meet again when studying abstract generalised distances.

Cf.[START_REF] Goguen | Initial algebra semantics and continuous algebras[END_REF].

| op(p, x.e) (operation).Figure3.1: Syntax of Λ Σ . Γ, x v x Γ, x Λ e Γ v λx.e Γ v Γ v w Γ Λ w Γ v Γ Λ return

Notice, however, that Λ p models probabilistic computations using the subdistribution monad and thus di ers from the instance of Λ Σ based on the partial full distribution monad DM (and the signature Σ DM ), which we denote as Λ DM . Nevertheless, since these two monads are equivalent, we can safely regard Λ p and Λ DM as equivalent too.

Throughout this dissertation we use double-lines inference rules for coinductive de nitions.

The notation for joins and meets is as usual.

For R : X → Y de ne the graph G R of R as G R {(x , ) | R (x , ) = true}.

Notice that since I = (1) • we can derive condition (rel 1) from condition (rel 3).

Recall that 1 • = I, so that we write e.g. 1• R in place of 1 • • R = I • R.

The original formulation of Strassen's Theorem is actually more general than Theorem 2 (notably, it does not require distributions to be discrete). This is re ected by the possibility of giving a proof of Theorem 2 based on the Max-ow Min-cut Theorem[START_REF] Schrijver | Theory of linear and integer programming[END_REF].

Intuitively, given a relator Γ satisfying (rel funct 2), one de nes the stable order F Γ on T as follows:F Γ X (T X , Γ(I X )) F Γ f T f .

Proposition 14. Rel is a quantale (see De nition 61) with an involution. In particular, it is a complete lattice.Proof. We notice that Rel inherits a complete lattice structure from Rel(Λ Γ , Λ Γ ) and Rel(V Γ , V Γ ) pointwise. The bottom element is the empty relation, whereas the top element is the indiscrete relation 0. Monoid multiplication is de ned as λ-term relation composition: given λ-term relations R and S, we de ne the composition of S with R, denoted by S • R, as:Γ Λ e R Γ Λ S f Γ Λ e (S • R) f Γ v R u Γ v u S w Γ v (S • R) w

Notice that the notation R Λ (resp. R V ) is not de ned for open λ-term relations, so that we can safely use that to denote the computation (resp. value) component of R c .

De nition 27. The compatible re nement R of an open λ-term relation R is de ned by the rules in Figure5.1. We say R is compatible if R ⊆ R, and that a closed λ-term relation is compatible if its open extension is.Γ, x v x R x (comp-var) Γ, x Λ e R f Γ v λx.e R λx.f (comp-abs) Γ v R Γ v w R w Γ Λ w R w (comp-app) Γ v R w Γ Λ return R return w (comp-ret) Γ Λ e R e Γ, x Λ f R f

Lemma 11 allows us to de ne compatible λ-term relations both inductively and coinductively. Moreover, we can rely on De nition 27 to de ne a closure operator mapping a λ-term relation to the least compatible λ-term relation extending it. De nition 28. The compatible closure R cc of an open λ-term relation is inductively de ned by the following rules.Γ Λ e R f Γ Λ e R cc fΓ v R w

De nition 35(Howe extension, 1). Given a closed λ-term relation R, de ne the open λ-term relation R H , called the Howe extension of R, as the least xed point of the map X → R o • X.Since both X → X and X → X o are monotone, then so is X → R o • X, meaning that, by the Knaster-Tarski Theorem, De nition 35 indeed de nes λ-term relation. In particular, R H is the least λ-term relation satisfying R o • R H ⊆ R H (see (S.[START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Levy | In nitary howe's method[END_REF] and Lemma 15 below). An equivalent, more concrete characterisation of R H is given by the following de nition.

Γ, x v x R Γ, x v x R H (H-var) Γ, x Λ e R H f Γ v λx.f R Γ v λx.e R (H-abs) Γ v R H Γ v w R H w Γ Λ w R e Γ Λ w R H e (H-app) Γ v R H w Γ Λ return w R e Γ Λ return R H e (H-val) Γ Λ e R H e Γ, x Λ f R H f Γ Λ let x = e in f R

In particular, Λ denotes the collection of all terms, whereas V ⊆ Λ denotes the collection of all values. Closed terms and closed values are denoted by Λ • and V • , respectively.

As usual, I denotes the identity combinator λx .x whereas Ω denotes the purely divergent term (λx .x x )(λx .x x ).

Such a construction has been extended to a large class of coalgebras in e.g.[START_REF] Hasuo | Generic trace semantics via coinduction[END_REF][START_REF] Jacobs | Trace semantics via determinization[END_REF].

I.e. ΓI X = I T X

Remark 13. The calculus Λ(n) Σ being coarse-grain, we work with λ-term relations de ned on the whole set of terms. As a consequence, for a λ-term relation R we simply write Γ e R f to say the the open terms e, f with free variables in Γ are related by R. As usual, we use the notion e R f and e R f , interchangeably. All the basic relational constructions (such as open extension and closed restriction) of Chapter 5 are modi ed accordingly. De nition 44. Given a closed λ-term relation R, the Howe extension R H of R is the open λ-term relation inductively de ned by rules (H-var)-(H-op) in Figure 6.1. The evaluation context extension R E of R is the relation over closed evaluation contexts de ned by rules (E-nil) and (E-nil) in Figure 6.1.Γ x R e Γ x R H e (H-var) Γ, x e R H Γ λx. R f Γ λx.e R H f (H-abs) Γ e R H e Γ h R H Γ e R f Γ e R H f(H-app)

Meaning that two terms e, f are tested for their applicative behaviour against all terms of the form E[ ], E[h], for any pair of terms ( , h) stored in the environment.

We tacitly apply Remark

3, here properly modi ed to open values.

In the case of applicative simulation such interaction is expressed by clause (app val) in De nition 32: the environment interacts with tested values by passing them arbitrary closed values as arguments.

[START_REF] Lassen | Normal form simulation for mccarthy's amb[END_REF] studied weak head normal form (bi)similarity for a nondeterministic call-by-name λ-calculus. However, his treatment uses speci c features of nondeterminism and, to the best of the author's knowledge, is not extended to the call-by-value case.

Notably from the theory of open bisimulation for the π -calculus[START_REF] Sangiorgi | A theory of bisimulation for the pi-calculus[END_REF].

Truncated addition is de ned as min(x + , 1): we overload the notation and denote by + both ordinary and truncated addition.

Unfortunately, the author was not aware of the connection between program sensitivity and coe ects until the moment of writing the present dissertation. As a consequence, a proper treatment of such a connection is not treated in this work.

We extend ordinary as follows: x + ∞ ∞ ∞ + x .

Taking f = generalised non-expansiveness expresses monotonicity of f in the boolean quantale, and non-expansiveness of f in the Lawvere quantale and its variants (recall that when we instantiate V as e.g. the Lawvere quantale we have to reverse inequalities).

s ≤ 1 Γ, x : s σ v x : σ Γ, x : 1 σ Λ e : τ Γ v λx.e : σ τ Γ v : σ τ ∆ v w : σ Γ ⊗ ∆ Λ w : τ Γ v : σ î Γ v î, : i ∈I σ i Γ v : i ∈I σ i ∆, x : s σ i Λ e i : τ (∀i ∈ I ) s • Γ ⊗ ∆ Λ case of { i, x → e i } : τ Γ v : σ Γ Λ return : σ Γ Λ e : σ ∆, x : s σ Λ f : τ (s ∧ 1) • Γ ⊗ ∆ Λ let x = e in f : τ Γ v : σ s • Γ v ! : ! s σ Γ v : ! r σ ∆, x : s •r σ Λ e : τ s • Γ ⊗ ∆ Λ case of {!x → e} : τ Γ v : σ [µt.σ /t]

Recall that since a is integral we have the inequality a ⊗ ⊥ = ⊥ for any a ∈ V.

Acknowledgements

Figure 5.2: Howe extension of R.

The Howe extension of preorder λ-term relation satis es many nice properties. These are summarised by the following result.

Lemma 15. Let R be re exive and transitive closed λ-term relation. Then the following hold:

3. R H is compatible, and thus re exive.

4. R H is substitutive.

Proof. The proof of Lemma 15 is standard (this comes with no surprise as the Lemma 15 focuses on syntactical, rather than semantical, properties of Howe's construction). The reader is referred to (S. [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF][START_REF] Pitts | Howe's method for higher-order languages[END_REF] for detailed proofs. Here we sketch a proof of substitutivity of R H . We prove by simultaneous induction on Γ, z Λ e R H f and Γ, z v R H w the admissibility of the following rules:

The key point is to observe that the de nition of R H involves the open extension of R, which is valuesubstitutive by construction. As an illustrative example, we show how to handle the case corresponding 1 = and e σ 2 = w. By induction hypothesis we have that e 2 is a value. Moreover, e σ 1 = implies that e 1 must be a variable. We are done.

• Suppose E = F f . Then e is of the form e 1 e 2 with e σ 1 = F [ w] and e σ 2 = f . By induction hypothesis e 1 is a λ-free enf. Moreover, e 1 cannot be a variable, and thus it must be of the form F [zu]. We conclude e 1 e 2 = F [zu]e 2 , and thus we are done.

• Suppose E ≡ wF . As above.

Call-by-Name Operational Semantics

We now give Λ Σ call-by-name monadic operational semantics. In order to do so, we rst need to change our notion of evaluation context. As in Chapter 6, call-by-name evaluation contexts are de ned by the following grammar, but contrary to Chapter 6 here we do not require e to be closed:

As usual, we write E[e] for the term obtained by substituting the term e for the hole [-] in E. Redexes are expressions of the form (λx.e) f or op(p, x.e), whereas a stuck term is a term of the form E[xe]. In particular, stuck terms are expressions of the form xe 0 • • • e k . Following (S. B. [START_REF] Lassen | Bisimulation in untyped lambda calculus: Böhm trees and bisimulation up to context[END_REF][START_REF] Sangiorgi | The lazy lambda calculus in a concurrency scenario[END_REF] we de ne the collection W of weak head normal forms (whnfs hereafter) as the collection of values and stuck terms, and let letters s, t, . . . to range over whnfs. Notice that whnfs are generated by the following grammar:

As for the call-by-value case, we can easily prove the following unique decomposition lemma.

Lemma 29. Any term e can be uniquely decomposed in one of the following (mutually exclusive) forms:

1. ;

E[ e];

3. E[op(p, x.f )];

Call-by-name operational semantics is de ned with respect to a Σ-continuous monad T = T , η, - † relying on Lemma 29. More precisely, we de ne a call-by-name evaluation functionmapping each term to an element in T W.

De nition 46. De ne the N-indexed family of mapsn : Λ → T W as follows:

The monad T being Σ-continuous, we see that the sequence ( e n ) n forms an ω-chain in T W, so that we can de ne e as n e n .

Types σ , τ ::= t

Values , w ::= x Computations e, f ::= return

| op(e, . . . , e). Free and bound variables in computations and values are de ned as usual, and we adopt the same syntactical conventions de ned in Chapter 3. We extend such conventions to types. In particular, we denote by σ [τ /t] the result of capture-avoiding substitution of type τ for the type variable t in σ . We also write 0 for the empty sum type, 1 for 0 0, and nat for µt.1 + t. In order to de ne the class of well-de ned V-Fuzz terms we equip V-Fuzz with a suitable type system. Intuitively, the latter is based on judgments of the form x 1 : s 1 σ 1 , . . . , x n : s n σ n e : σ , where s 1 , . . . , s n are CBEs. The informal meaning of such judgment is that on input x i (i ≤ n), the computation e has sensitivity s i . That is, e ampli es the (behavioural) distance between two input values i , i of at most a factor s i . Symbolically, we have:

In order to de ne typing judgments formally, we need the notion of an environment. An environment Γ is a nite sequence x 1 : s 1 σ 1 , . . . , x n : s n σ n of distinct variables with associated closed types and CBEs (we denote the empty environment by ∅ and oftentimes writes e : σ in place of ∅ e : σ ). We can lift operations on CBEs in Lemma 36 to environments as follows, where op in an m-ary operation symbol in Σ:

Notice that the above operations are de ned for environments having the same structure (i.e. di ering only on CBEs). This is not a real restriction, since we can always add the missing variables :k σ , where k is the constant function returning the unit of the quantale.

Having at our disposal operations on environments we can de ne a type system for V-Fuzz. Such a type system is based on two kinds of judgment (exploiting the ne-grained style of the calculus): judgments of the form Γ v : σ for values and judgments of the form Γ Λ e : σ for computations. The system is de ned in Figure 10.2.

As for Λ Σ , we denote by V σ • and Λ σ • for the set of closed values and terms of type σ , respectively. Accordingly, we will also use the notation Λ Γ Λ σ for the set {e ∈ Λ | Γ Λ e : σ } (and similarity for values).

165

Example 61. Another interesting example is obtained by instantiating V-Fuzz with the signature Σ O ∞ and the strong Lawvere quantale. The latter is a frame, and thus we obtain a linear-like λ-calculus. We interpret the operation symbol print c as the identity function on [0, ∞]. We will come back on this example later.

The typing system of Figure 10.2 makes V-Fuzz a re nement of the linear λ-calculus [START_REF] Maraist | Call-by-name, call-by-value, call-by-need and the linear lambda calculus[END_REF]. For instance, for any type σ we have the term I return (λx.return x ) of type σ σ . Moreover, as the above examples suggest, V-Fuzz is a Turing complete language. In fact, we can encode the linear λ-calculus in V-Fuzz by translating the type !σ into ! ∞ σ . For instance, for any type σ we have the purely

Finally, we remark that the syntactic distinction between terms and values gives the following (obvious) result.

Lemma 37. The following equalities hold:

Remark 19. Before de ning the operational semantics of V-Fuzz, we brie y expand on the possibility of considering generalised operation symbols. First, given a generalised operation symbol op : P I with interpretation op V on a quantale V (extended to CBEs according to Lemma 36), we extend op V to environments as follows. Given a map γ associating to each i ∈ I an environment

We then extend the typing system of Figure 10.2 with the in nitary rule:

We can now de ne an operational semantics for V-Fuzz.

Operational Semantics

We give V-Fuzz monadic operational semantics in the style of Chapter 3. Let Σ be an algebraic signature for a Σ-continuous monad T = T , η, - † . Operational semantics is de ned by means of an evaluation function -σ indexed over closed types, associating to any computation in Λ σ

• a monadic value in T V σ • . The evaluation function -σ is itself de ned by means of the N-indexed family of functions -σ n .

De nition 65. The N-indexed family of functions -σ n :

• is inductively de ned as follows:

The de nition of -σ n is rather standard and closely resembles De nition 15. Moreover, it is straightforward to observe that indeed -σ n a function from

• , the judgment Λ let x = e in f : σ must be the conclusion of a derivation of the form:

As for Λ Σ , we can thus de ne the evaluation map

In order to improve readability we oftentimes omit type superscripts in e σ . We also notice that because T is Σ-continuous, -σ is itself continuous.

Proposition 24. The following identities hold:

op(e 1 , . . . , e j ) = op V σ ( e 1 , . . . , e j ).

Having de ned the syntax and semantics of V-Fuzz, it is time to look at program distances for it. In order to do so, we rst have to generalise the theory of relators of Chapter 4 to V-relations. We refer to relators for V-relations as V-relators.

Chapter 11

Barr Meets Lawvere

It is indi erent to me where I am to begin, for there shall I return again

Parmenides

In this chapter we de ne the notion of a V-relator (Hofmann et al., 2014) for a quantale V. The latter is somehow the 'quantitative' generalisation of the concept of a relator. Analogously to ordinary relators, V-relators for a set endofunctor T are abstractions meant to capture the possible ways a Vrelation on a set X can be turned into a V-relation on T X , and thus provide ways to lift a behavioural distance between programs to a (behavioural) distance between monadic values. On a formal level, we say that a V-relator extends T from Set to V-Rel, laxly.

V-valued relators have been introduced in the context of monoidal topology (Hofmann et al., 2014) (where are usually called lax extension (Ho man, 2015)), in order to provide a unifying account of Lawvere's theory of generalised metric spaces (F. [START_REF] Lawvere | Metric spaces, generalized logic, and closed categories[END_REF]) and Barr's categorical analysis of topological spaces [START_REF] Barr | Relational algebras[END_REF]. Using the notion of V-relator (which leads to the notion of lax V-algebra (Hofmann et al., 2014)), it is possible to unify the notion of a (generalised) metric, preorder, topological, and approach space, in purely categorical terms.

According to (Hofmann et al., 2014), the observation that a similar uni cation should have been possible dates back to Lawvere. The reader can also consult [START_REF] Hofmann | Convergence and quantale-enriched categories[END_REF] for an historical introduction to the subject.

Quantale-valued Relators

In this section we introduce the notion of a V-relator for a (strong) monad, which will be a central tool for our analysis of e ectful program distance. After having introduced some basic notions and de nitions, we focus on some speci c examples of V-relators, giving special attention to the so-called Wasserstein-Kantorovich lifting [START_REF] Villani | Optimal transport: Old and new[END_REF]. As usual, in the rest of this chapter we assume all functors (and thus monads) to be on Set, unless explicitly stated.

De nition 66. For a fucunctor T a V-relator for T is a mapping (α : X + → Y ) → (Γα : T X + → TY ) satisfying conditions (V-rel 1)-(V-rel 4). We say that Γ is conversive if it additionally satis es condition De nition 71. An open λ-term V-relation α associates to each sequent Γ Λ σ a V-relation Γ Λ α (-, -) : σ on computations inhabiting it, and to each sequent Γ v σ a V-relation Γ v α (-, -) : σ on values inhabiting it. We require open λ-term V-relations to be closed under weakening, i.e. for any environment ∆ we require:

As for closed λ-term V-relations, we will often write Γ α ( , w ) : σ in place of Γ v α ( , w ) : σ (and similarity for computations) and simply refer to open λ-term V-relations as λ-term V-relations (whenever relevant we will explicitly mention whether we are dealing with open or closed λ-term Vrelations).

We notice that the collection of open λ-term V-relations carries a complete lattice structure (ordered pointwise), meaning that we can de ne λ-term V-relations both inductively and coinductively. Moreover, we can always extend a closed λ-term V-relation α = (α Λ , α V ) to an open one (as well as restricting an open λ-term V-relation to a closed one).

De nition 72. Let Γ x 1 : s 1 σ 1 , . . . , x n : s n σ n be an environment. For values 1 , . . . , n we write : Γ if for any i ≤ n, v i : σ i holds. Given a closed λ-term V-relation α = (α Λ , α V ) we de ne its open extension α o as follows:

In the following we will adopt the notational conventions introduced in Chapter 5. We now de ne the notions of substitutivity and compatibility for λ-term V-relations. Due to the presence of program sensitivity annotations in V-Fuzz, these notions are quite di erent than their boolean-valued counterparts for Λ Σ .

De nition 73. We say that an open λ-term V-relation α is value substitutive if for all values Γ, x : s σ v , w : τ and computations Γ, x : s σ Λ e, f : τ we have:

for any closed value u ∈ V σ • . We say that α is substitutive if for all values Γ, x : s σ v , w : τ and computations Γ, x : s σ Λ e, f : τ we have:

for all closed values u, u of type σ .

The notion of compatibility captures an abstract form of Lipshitz-continuity with respect to V-Fuzz constructors. Formally, we de ne the notion of a compatible λ-term V-relation by means of the compatible re nement operator.

De nition 74. The compatible re nement α of an open λ-term V-relation α is de ned by:

where judgments Γ |= Λ a ≤ α (e, f ) : σ and Γ |= v a ≤ α ( , w ) : σ are inductively de ned for a ∈ V, Γ Λ e, f : σ , and Γ v , w : σ by rules in Figure 12.1. We say that α is compatible if α ≤ α.

Lemma 39. For all µ ∈ DMX and ν ∈ DMY , and I-relation α : X + → Y , we have:

wheredenotes truncated subtraction.

Proof. By Proposition 27 we have:

where a x , a ⊥ X , b , b ⊥ Y are bounded and satisfy the following constraints (already simpli ed according to the de nition of Mα):

0 we obtain the desired inequality.

Let now e, f be return I and (return I ) or Ω, respectively. We claim that δ Λ (e, f ) = 1 2 . By adequacy we immediately see that 1 2 ≤ δ Λ (e, f ). We prove δ Λ (e, f ) ≤ 1 2 . Let us consider the coupling ω de ned by: ω (just

and zero for the rest. Indeed ω is a coupling of e and f . Moreover, by very de nition of δ and DM we have:

The right hand side of the above inequality gives exactly 1 2 , provided that δ V (I , I ) = 0. This indeed holds in full generality.

Proposition 30. Applicative similarity distance δ is a re exive and transitive λ-term V-relation.

Proof. The proof is by coinduction. Let us show that δ is transitive, i.e. that δ • δ ≤ δ . We prove that the λ-term V-relation (δ Λ • δ Λ , δ V • δ V ) is an applicative simulation distance. We split the proof into ve cases:

1. We show that for all terms e, f ∈ Λ σ

• we have:

By (V-rel 2) it is su cient to prove:

), we are done by very de nition of δ .

2. We prove that

Howe's Method

In order to prove compatibility of applicative similarity distance we design a re nement of Howe's technique as presented in Section 5.4, taking inspiration from [START_REF] Crubillé | Metric reasoning about lambda-terms: The a ne case[END_REF]. We start by de ning the notion of It is easy to see that compatible re nementis monotone, and thus so is the map Φ α de ned by Φ α (β ) α • β. As a consequence, we can de ne α H as the least xed point of Φ α . Since open extension o is monotone as well, we can de ne the Howe's extension of a closed λ-term V-relation α as (α o ) H . It is also useful to spell out the above de nition concretely.

De nition 78 (Howe extension (2)). The Howe extension α H of an open λ-term V-relation α is de ned by:

where judgments Γ |= Λ a ≤ α H (e, f ) : σ and Γ |= v a ≤ α H ( , w ) : σ are inductively de ned for a ∈ V, Γ Λ e, f : σ , and Γ v , w : σ by rules in Figure 12.3.

The next lemma is useful for proving properties of Howe's extension. It states that α H attains its value via the rules in Figure 12.3.

Lemma 40. The following hold:

1. Given well-typed values Γ v , w : σ , let

2. Given well-typed terms Γ Λ e, f : σ , let

Proof sketch. We simultaneously prove statements 1 and 2 by induction on ( , e). We show a couple of cases as illustrative examples:

to be non-empty. If the judgment Γ |= v a ≤ α H (x, w ) : σ is provable, then it must be the conclusion of an instance of rule (H-var) from the premise: a ≤ (∆, x : s σ v α (x, w ) : σ ) so that Γ = ∆, x : s σ . As a consequence, we see that the set A is just {a | a ≤ (∆, x : s σ v α (x, w ) : σ )}. In particular, we have ∆, x : s σ v α (x, w ) : σ = A ∈ A.

Proof. Obviously γ is an applicative simulation distance (with respect to Γ). Moreover, γ is symmetric and thus we have γ ≤ γ . To see that γ ≤ γ it is su cient to prove that γ is an applicative simulation distance with respect to Γ ∧ Γ • . Clauses on values are trivially satis ed. We now show that for any symmetric applicative simulation α, we have the inequality α Λ σ (e, e ) ≤ Γα V σ ( e , e )∧Γ(α V σ )

• ( e , e ) for all terms e, e ∈ Λ σ . For that it is su cient to prove α Λ σ (e, e ) ≤ Γ(α V σ )

• ( e , e ), which obviously holds since α is symmetric.

Lemma 44 allows to apply the Key Lemma on γ , thus showing that γ H is compatible. However, as we already know there is little hope to prove γ H to be symmetric. We thus look at its transitive closure. The latter is in general not symmetric, but it is so for a speci c class of CBEs.

De nition 80. We say that a CBE s is nitely continuous, if s ∞ implies s ( A) = {s (a) | a ∈ A}, for any set A ⊆ V.

Example 69. All concrete CBEs considered in previous examples satisfy the conditions mentioned in this section, and thus are nitely continuous. Moreover, it is easy to prove the all CBEs de ned from the CBEs n, ∞ of Example 57 using operations in Lemma 36 are nitely continuous 2 provided that V is completely distributive (Hofmann et al., 2014) and op V (a 1 , . . . , ⊥, . . . , a n ) = ⊥ (which is the case for most of the concrete operations we considered).

The following is the central result of our argument.

Lemma 45. Assume CBEs in Π to be nitely continuous. De ne the transitive closure α T of a V-relation α as α T n α (n) , where α (0) I, and α (n+1) α (n) • α. 1. Let α be a re exive and transitive λ-term V-relation. Then (α H ) T is compatible. 2. Let α be an re exive, symmetric, and transitive open λ-term V-relation. Then (α H ) T is symmetric.

Proof. We start with point 1. First of all observe that by Lemma 41 α H is compatible. To prove compatibility of (α H ) T we have to check that it satis es all clauses in Figure 12.2. We show the case for sequential composition as an illustrative example (the other cases are proved in a similar, but easier, way). We have to prove: By nite continuity, either s ∧ 1 = ∞ or it is continuous with respect to joints. In the former case we are trivially done. So suppose the latter case, so that thesis becomes:

In particular, we also have s ∞. We prove that for any n, m ≥ 0 the following holds: for all e, e , f , f (of appropriate type), Appendix A

Names of Categories

The following is a list of the categories mentioned in this dissertation.

• Set: the category of sets and functions. Objects are denoted by letters X , Y , . . . whereas morphisms by letters f : X → Y , : X → Y , . . ..

• Rel: the category of sets and relations. Objects are denoted by letters X , Y , . . . whereas morphisms by letters R : X + → Y , S : X + → Y , . . ..

• PreOrd: the category of preordered sets and monotone functions. A preorder on a set X is a re exive and transitive relation ≤ X : X + → X . We denote objects of PreOrd as (X , ≤ X ), (Y , ≤ Y ), . . ..

• V-Rel is the category of sets and V-relations, for a quantale V. Objects are denoted by letters X , Y , . . . whereas morphisms by letters α : X + → Y , β : X + → Y , . . ..

• V-Cat: the category of V-categories and V-functor. A V-category (X , α ) consists of a set X together with a re exive and transitive V-relation α : X + → X . We denote objects of V-Cat as (X , α ), (Y , β ), . . .. A morphism f : (X , α ) → (Y , β ) is a V-functor, i.e. a morphism f : X → Y in Set such that f • α ≤ β • f holds in V-Rel.