Langages d'ordre supérieur : dualités et techniques de bisimulation

Les comportements des processus concurrents peuvent être exprimés en utilisant des calculs de processus, des langages formels simples qui permettent de démontrer des résultats mathématiques précis sur les comportements et les interactions entre processus (Chapitre 1).

Un exemple simple mais expressif d'un tel langage est CCS (Calculus of Communicating Systems), dont on détaille l'étude des comportements. Un autre exemple répandu est le pi-calcul, qui est encore plus expressif grâce à un mécanisme de communication de canaux. Ce dernier autorise également l'instauration d'un système de types, qui permet de raffiner le calcul aux processus qui évoluent dans des environnements plus contraints. Le pi-calcul permet aussi d'encoder le lambda-calcul, qui lui-même capture l'essence du calcul séquentiel (Chapitre 2).

Plusieurs calculs de processus se déclinent avec des niveaux variables de complexité. Une propriété intéressante de certains de ces calculs est ce qu'on appelle la symétrie : certains calculs, comme CCS, le pi-calcul à mobilité interne ou les calculs dits "de fusions", sont invariants par une opération de dualité entre émission et réception (Sections 3.1 et 3.2). La première contribution de cette thèse se consacre à l'utilisation de cette dualité dans le pi-calcul (Chapitre 3). Le pi-calcul n'étant pas lui-même stable par dualité, on construit par saturation une extension conservatrice du pi-calcul typé, qui elle est stable. Grâce à cet outil, on établit une correspondance entre deux encodages du lambda-calcul dans le pi-calcul qui sont pourtant d'apparences différentes (Section 3.3).

Cette correspondance amène à la construction d'un nouveau calcul symétrique typé. On se pose alors la question de la possibilité d'utiliser des systèmes de types dans les calculs symétriques existants. La suite du chapitre se concentre sur cette question et se termine par une réponse négative : on établit un théorème d'impossibilité, qui spécifie que les calculs de fusions ne peuvent pas supporter l'ajout de disciplines de types, sauf dans des cas triviaux (Section 3.4). codifica del pi-calcolo induce una naturale restrizione sintattica in calcoli con fusioni e preordini. Si dimostra che i calcoli coincidono sul dominio di tale restrizione e che è inoltre possibile aggiungervi un sistema di tipi, scoprendo così un ulteriore modo per recuperare l'uso dei tipi nei calcoli con fusioni (Sezione 4.8).

Ci occupiamo in seguito (Capitolo 5) di metodi di dimostrazione per la semantica comportamentale di processi, con particolare attenzione al metodo di bisimulazione. Quest'ultimo riesce a catturare l'equivalenza desiderata in diversi linguaggi di ordine superiore, come il pi-calcolo e il lambda-calcolo. Una prova di bisimulazione si articola in due parti principali: una prima parte in cui si costruisce una relazione che deve contenere gli oggetti che si vogliono dimostrare equivalenti, ed una seconda parte in cui dimostriamo che questa relazione è una bisimulazione. La seconda parte della dimostrazione richiede solitamente di espandere la relazione, fatto che a sua volta implica l'iterazione alternata delle due parti che costituiscono il metodo di bisimulazione, fino al raggiungimento di una relazione che soddisfa le clausole di bisimulazione. Parte di questa iterazione è ridondante, e può infatti essere evitata o semplificata drasticamente, a volte in modo decisivo per completare la prova, utilizzando tecniche di bisimulazioni "up to" (ad esempio, una bisimulazione "up to context" può essere molto più piccola di una bisimulazione ordinaria). Pous e Sangiorgi hanno sviluppato una teoria generale delle bisimulazioni up to che fornisce un quadro generale e modulare in cui utilizzare queste tecniche: quando due tecniche sono dimostrate essere corrette, la loro combinazione è automaticamente derivata (Sezione 5.1).

Tuttavia questa teoria si applica solamente nel caso in cui i sistemi esaminati siano sistemi "semplici", come automi o CCS. Tecniche di bisimulazione per linguaggi di ordine superiore (come il pi-calcolo, il lambda-calcolo e le loro varianti) devono purtroppo essere adattate di volta in volta a partire dalle prove della teoria generale, e hanno il grave inconveniente di richiedere nuove prove per ciascuna combinazione di tecniche, contrariamente a quanto avviene nella teoria generale.

Questa tesi contribuisce all'applicazione della teoria generale delle tecniche up to ai linguaggi di ordine superiore. L'approccio adottato consiste nello stabilire una corrispondenza precisa tra un linguaggio di ordine superiore e un sistema di transizione del primo ordine, affinché la bisimulazione indotta su quest'ultimo coincida con l'equivalenza comportamentale desiderata sul linguaggio di ordine superiore. Applichiamo questo metodo al pi-calcolo, utilizzando processi con nomi (Sezione 5.2), poi al lambda-calcolo, sulla base di una nozione specifica di bisimulazione basata sul concetto di "ambiente" (Sezione 5.3). Mostriamo infine come trattare un linguaggio con primitive di programmazione imperativa (Sezione 5.4) e altri linguaggi, come il pi-calcolo di ordine superiore (Sezione 5.5).

In ciascuno di questi casi, grazie alla descrizione al primo ordine dei linguaggi, ereditiamo tutte le tecniche della teoria generale. Dimostriamo inoltre la correttezza delle tecniche "up to context", che sono specifiche per ciascuno di questi calcoli e formano una solida base per le dimostrazioni di bisimulazione. Le condizioni di correttezza di queste tecniche non sono sempre rispettate, e possono dipendere da come abbiamo costruito i sistemi di transizione del primo ordine. Questo studio si propone di guidare il lettore nella costruzione di sistemi di transizione che ammettono queste tecniche, al fine di gestire altri linguaggi di ordine superiore. v vi name-passing calculi, they generally have a more complicated semantics but are very expressive. The π-calculus (Section 2.2) is the archetypal name-passing calculus.

Le pi-calcul avec pré-ordres est suffisamment expressif pour encoder le pi-calcul et les calculs de fusions, avec une correspondance particulièrement fine pour les processus asynchrones (Section 4.7). Enfin, on voit que l'encodage du pi-calcul induit une restriction syntaxique naturelle sur les calculs avec fusions et préordres. On peut montrer que les calculs coïncident sur le domaine de cette restriction, et qu'on peut même y ajouter une discipline de types, découvrant un autre moyen de recouvrer l'utilisation des types dans les calculs de fusions (Section 4.8).

On s'intéresse ensuite (Chapitre 5) aux méthodes de preuve pour la sémantique comportementale des processus, plus précisément à la méthode de la bisimulation. Cette dernière permet de capturer efficacement les équivalences désirées dans plusieurs langages d'ordre supérieur, comme le pi-calcul d'ordre supérieur et le lambda-calcul. Une preuve de bisimulation est habituellement constituée d'une première partie qui construit une relation (qui doit contenir les objets à prouver égaux), et d'une deuxième qui s'occupe de prouver que cette relation est une bisimulation. La deuxième partie de la preuve nécessite habituellement d'étendre la relation de la première partie, et ainsi de suite jusqu'à obtenir une relation qui est une bisimulation. Une partie de ce travail d'itération est assez administrative et répétitive, et peut être en fait factorisée pour simplifier les relations de façon radicale, parfois décisive pour compléter la preuve, en utilisant les techniques de bisimulation "modulo" (par exemple, une bisimulation "modulo contexte" peut être beaucoup plus petite qu'une bisimulation stricte). Pous et Sangiorgi ont dévelopé une théorie générale des bisimulations modulo, qui fournit un cadre dans lequel utiliser ces techniques se fait de façon modulaire : quand deux techniques modulo sont prouvées, leur combinaison, par exemple par l'union ou la composition, est automatiquement dérivée (Section 5.1).

En revanche cette théorie s'applique seulement dans le cadre de systèmes exprimés de façon relativement simple, comme pour les automates ou encore des calculs de processus comme CCS. Les techniques de bisimulations modulo pour des langages d'ordre supérieur (comme le pi-calcul, le lambda-calcul et leurs variantes) doivent malheureusement être adaptées à la main à partir des preuves de la théorie générale, et présentent l'inconvénient sérieux de requérir une nouvelle preuve pour chaque combinaison de techniques, contrairement à ce qu'il se passe dans la théorie générale.

Cette thèse contribue à adapter dans des langages d'ordre supérieur la théorie générale des techniques modulo. L'approche utilisée est d'établir une correspondance exacte entre un langage d'ordre supérieur et un système de transitions étiquetées du premier ordre construit à cet effet, tel que la bisimulation induite sur le système du premier ordre coïncide avec l'équivalence comportementale désirée dans le langage d'ordre supérieur. On applique cette méthode pour le pi-calcul, en utilisant une notion de processus nommés (Section 5.2), puis sur le lambda-calcul, en se basant sur une notion de bisimulation spécialisée, dite environnementale (Section 5.3). On explique ensuite comment gérer un langage avec des primitives de programmation impérative (Section 5.4) et d'autres langages, comme le pi-calcul d'ordre supérieur où les objets envoyés sont eux-mêmes des processus (Section 5.5).

Dans chacun de ces cas, grâce à la description au premier ordre des langages, on hérite toutes les techniques génériques de la théorie. On prouve aussi les techniques "modulo contexte" qui sont spécifiques à chacun de ces calculs, et qui forment une base solide pour établir des preuves de bisimulation. Les conditions pour que ces techniques spécifiques soient correctes ne sont pas toujours satisfaites, et peuvent dépendre de la manière dont on a construit le système de transitions du premier ordre. Cette étude s'efforce de guider le lecteur dans la marche à suivre pour construire des systèmes de transitions qui admettent ces techniques, pour la gestion d'autres langages d'ordre supérieur.

iii

Riassunto in italiano

Linguaggi di ordine superiore: dualità e tecniche di bisimulazione Il comportamento di processi concorrenti può essere rappresentato attraverso calcoli di processi, che sono semplici linguaggi formali attraverso i quali è possibile dimostrare specifici risultati matematici su interazioni tra processi (Capitolo 1).

Un semplice ma espressivo calcolo di processi è, ad esempio, CCS (Calculus of Communicating Systems). Un altro esempio comune è il pi-calcolo, la cui espressività è maggiore grazie ad un meccanismo di comunicazione tramite canali. Con il pi-calcolo è inoltre possibile utilizzare sistemi di tipi, che sono in grado di catturare il comportamento di processi che evolvono in ambienti con maggiori vincoli. Il pi-calcolo permette inoltre di codificare il lambda calcolo, che a sua volta cattura l'essenza delle computazioni sequenziali (Capitolo 2).

Sono stati proposti diversi calcoli di processi, con livelli differenti di complessità. Una proprietà di alcuni di questi calcoli è nota come "simmetria": calcoli come CCS, il pi-calcolo con mobilità interna o calcoli "con fusioni" sono invarianti rispetto a un'operazione di dualità tra invio e ricezione (Sezione 3.1 e 3.2). Il primo contributo di questa tesi consiste nell'utilizzo di questa dualità nel pi-calcolo (Capitolo 3). Il pi-calcolo non è stabile rispetto alla dualità, quindi costruiamo per saturazione una estensione conservativa del pi-calcolo tipato che risulta stabile. Questa estensione permette di stabilire una corrispondenza tra due codifiche del lambda-calcolo nel pi-calcolo, che appaiono molto diverse tra loro (Sezione 3.3).

La corrispondenza viene stabilita attraverso la costruzione di un nuovo calcolo simmetrico tipato. Questo porta dunque a indagare la possibilità di avere sistemi di tipi per i calcoli simmetrici esistenti. Il resto del capitolo si concentra su questo tema e si conclude con una risposta negativa: viene stabilito un teorema di impossibilità, che afferma che i calcoli con fusioni non possono supportare l'aggiunta di sistemi di tipi, salvo casi banali (Sezione 3.4). Attraverso la dimostrazione di questo teorema, scopriamo un vincolo fondamentale di questi calcoli che impedisce l'utilizzo di tipi, ossia il fatto che induce una relazione di equivalenza tra i canali di comunicazione. Questa relazione è in particolare evidente nel calcolo con "fusioni esplicite". Rilassando questo vincolo e permettendo ai canali di comunicazione di essere invece in una relazione di preordine si ottiene il "picalcolo con preordini", un nuovo calcolo nello stile dei calcoli con fusioni, di cui vengono in seguito studiate le proprietà (Sezione 4).

Come nel calcolo con fusioni esplicite, un operatore del calcolo chiamato "arco" rappresenta la relazione indotta sui nomi, associando i nomi che sono nella relazione globale di preordine. Questi archi agiscono attraverso un semplice sistema di riscrittura, e definiscono il comportamento del calcolo (Sezione 4.1). Si può inoltre vedere come il pi-calcolo con preordini supporti in maniera diretta un sistema di tipi (Sezione 4.2). La semantica con riscrittura è "avida", in quanto gli archi possono reagire con qualsiasi prefisso in qualsiasi momento. Presentiamo una semantica più "pigra", che utilizza gli archi esclusivamente al momento della comunicazione (Sezione 4.3). Questa semantica descrive una strategia di riduzione più tradizionale, che permette di avere proprietà più interessanti e maggiori corrispondenze con i calcoli esistenti.

Il calcolo è inoltre in grado di gestire i nomi privati, che si trovano nella versione originale del pi-calcolo ma non nei calcoli con fusioni (Sezione 4.4). Questa capacità di creare nuovi nomi privati è ampiamente utilizzata nelle implementazioni, fatto che si aggiunge alla possibilità di avere un calcolo con un sistema di tipi.

Illustriamo in seguito la semantica comportamentale del pi-calcolo "pigro" con preordini e le sue specificità, attraverso lo sviluppo di un sistema di transizione etichettate (LTS), una bisimulazione e dimostrazioni tecniche di risultati di congruenza, alcuni dei quali sono formalizzati in Coq (Sezione 4.5). Una seconda caratterizzazione è data sotto forma di un insieme di leggi comportamentali che catturano completamente la semantica. Questa assiomatizzazione può essere adattata per ottenere, per la prima volta, una assiomatizzazione del calcolo con fusioni esplicite (Sezione 4.6).

Il pi-calcolo con preordini è sufficientemente espressivo da codificare il pi-calcolo e i calcoli con fusioni, con una corrispondenza particolarmente fine per i processi asincroni (Sezione 4.7). Infine, notiamo che la Chapter 1 Introduction

Process algebras

Concurrency theory models interacting systems as mathematical objects, making possible formal reasoning about complex distributed systems and parallel computing. The notion of process algebra formalises those systems: the base objects of these algebras are the processes (P , Q, ...). They can be defined and composed using operators, and can be related through laws (written P ≡ Q).

The key operator of process algebras is parallel composition. If P and Q are two processes, then their parallel composition, written P | Q, is the process that behaves as if P and Q were executed simultaneously, authorising communications between P and Q. This operator has a neutral element, written 0, which is the process that does nothing. Because of this, composing 0 with another process P will result in a process that behaves exactly like P , hence we require in our algebra that P | 0 ≡ P . In fact, parallel composition must form a commutative monoid:

P | Q ≡ Q | P and P | (Q | R) ≡ (P | Q) | R.
Now that parallel composition allows the actual distribution of processes, communication must be accounted for. To that end, processes are provided with communication channels, on which they can send and receive data. Sending some data d on channel a is written a d .P where P is the continuation process. Sending is a blocking action: P will only be run once d has been received. Receiving some unknown data x on channel a is written a(x).Q, process Q being executed only once all data has been received and stored in x. Composing these two processes will trigger an interaction through channel a:

a d .P | a(x).Q -→ P | Q{d/x} (1.1)
where d has indeed replaced variable x in Q after the communication (which we write Q{d/x}). This reduction is usually the only reduction of the calculus, and is enough to represent parallel computing. Another useful primitive is the hiding of communication channels: suppose that a is a channel. Then, in the process (νa)P , the communication channel a can only be used inside of process P . Process (νa)P can also be viewed as a process that creates for itself a new private channel a.

We have seen five primitives for now, summed up in the following BNF-style grammar:

P ::= 0 P | Q (νa)P a d .P a(x).Q .

(1.2)

We did not specify how x can be used inside Q, or even what sort of objects x and d are. There are many ways to answer these questions, resulting in different process calculi:

• the simplest way is to forbid any usage of x in Q; then both x and data d are useless, hence we can write a.P instead of a d .P and a.Q instead of a(x).Q. The resulting calculus is CCS (Section 2.1) which is surprisingly expressive despite its simple semantics.

• The next step is to say that x and d are channels: then communication channel names (or simply "names") can be sent across the network of processes. Process calculi with this ability are called

In some presentations, a and d are names, but x is a variable waiting to be instantiated, which is a different object. We choose here to invariably call them names, as this will make for a more uniform presentation of the other calculi we study.

• Finally x and d can also stand for processes: a process sends the code of another process and the receiver has then the ability to run it. We call those calculi higher-order; a famous example is the higher-order pi-calculus, studied in Section 5.5.2.

We do not consider here the many other sorts of data that can be found in the literature, like constants, functions, or compound patterns. The more sorts of data one can communicate, the more expressive the calculus is. But there are counter-intuitive quirks: for example, the ability to communicate plain processes only is significantly less expressive than name-passing alone. Indeed, the former is surprisingly close to plain CCS, while name-passing can encode process communication fairly easily. In the first parts of this thesis, we will focus on name-passing calculi.

Bisimulations

Concurrent processes are generally given meaning through a notion of behavioural equivalence: one says that P and Q are behaviourally equivalent (P Q) if they behave the same way in all environments. In all process calculi we consider in this thesis, reduction-closed barbed congruence will be our reference behavioural equivalence. Its definition (Definition 2.1.4) is based on the reduction relation -→ of the calculus, on the closure by algebraic laws ≡ and quantifies over a set of environments that is generally infinite. Because of this, a proof of P Q has to include an infinite relation on processes, on which it is difficult to form case analyses.

The usual solution to this problem is usually to generalise the reduction relation -→ to make it compositional. For example, the reduction from a composition of processes P 1 | P 2 -→ P can have several origins: either a reduction from P 1 , or a reduction from P 2 , or a composition of two actions: one from P 1 , and another from P 2 . This idea allows the decomposition of a reduction relation into a Labelled Transition System (LTS), a compositional notion of interaction, easier to manipulate. Especially, processes need not be considered "up to" the algebraic laws ≡ seen in Section 1.1. For example, the reduction in (1.1) can be decomposed into the following two actions: Given some LTS-which is the compositional version of a reduction relation-it is possible to establish the notion of (labelled) bisimulation-which is the compositional version of the reduction-closed barbed congruence: a relation R on processes is a bisimulation if, when it relates two processes (P R Q) and one of them does an action (P µ -→ P or Q µ -→ Q ), then the other process does the same action (Q µ -→ Q or P µ -→ P , respectively) and the two resulting processes are still related (P R Q ).

Graphically, R is a bisimulation if it validates the two diagrams in Figure 1.1 for every action µ. We use plain lines for universal quantifiers (in premises), and dotted lines for existential quantifiers (in conclusions).

Two processes are bisimilar (P ∼ Q) if there is a bisimulation relating them. Bisimilarity ∼ is then the union of all bisimulations or, equivalently, the largest bisimulation. If the LTS is designed correctly, then

P Q P Q R R µ µ P Q P Q R R µ µ
Figure 1.1: Bisimulation diagrams P ∼ Q if and only if P Q, providing an efficient proof technique for equivalence of processes. This proof technique can be further improved using up-to techniques, on which we focus in Chapter 5.

Expressiveness and symmetry

The design of programming languages and process calculi gravitates around several principles, among which the notion of minimality is important for foundational languages. Minimality expresses that no base construct can be encoded into a combination of others. One example is the internal choice operator ⊕ (sometimes called nondeterministic choice operator in sequential calculi), defined as follows:

P ⊕ Q -→ P P ⊕ Q -→ Q . (1.3)
If we assume the presence of the operators seen in Section 1.1, then internal choice can be encoded as follows, where a is a fresh name:

[[P ⊕ Q]] (νa)(a | a.P | a.Q) .
The only actions of the above encoding are exactly the reductions in (1.3). This means that process calculi with operators ν, a, a., and | are inherently non-deterministic, and is the reason why operator ⊕ is not included in foundational process calculi. Consider now instead the external choice operator +, which can be defined as follows, not in terms of reductions but in terms of transitions (cf. discussion in previous section):

P µ -→ P P + Q µ -→ P Q µ -→ Q P + Q µ -→ Q (1.4)
While they could be seen as having roughly similar behaviours, + cannot be encoded as simply as ⊕ can [START_REF] Palamidessi | Comparing the expressive power of the synchronous and the asynchronous πcalculus[END_REF][START_REF] Nestmann | What is a 'good' encoding of guarded choice?[END_REF]. This is why the external choice operator has several variants and can be said to have significant expressiveness. Instead of encoding a lone construct into other more basic constructs, one can encode a whole variant of a calculus into another. For example, the polyadic π-calculus [START_REF] Milner | The polyadic pi-calculus[END_REF] (where emitted data are tuples of names) can be encoded into the monadic π-calculus (sending only one name at a time) under some correspondence conditions.

Knowing a variant of a calculus can be encoded into the original calculus provides robustness. For example, to encode call-by-name λ-calculus into the π-calculus (Section 2.4, [START_REF] Milner | Functions as processes[END_REF]), one can switch from monadic to polyadic prefixes for simplicity, without belittling the result about relative expressive powers of λ and π.

Another desirable property of a calculus is that each operator has only one role: even if this is defined informally, this makes the system easier to analyse. For example in CCS, restriction and parallel composition have the distinct roles of binding and distribution, even if those can interact. On the contrary in the πcalculus, the input construct is also a binder, blurring the differences between constructs. This motivates some sort of separation between the binding and input constructs, suggesting a symmetric syntax with respect to input/output polarities (since output is not binding). CCS has this separation and symmetry properties, but it does not have the expressive power of the π-calculus. The expressiveness gap comes from the name-passing ability of the π-calculus.

There are however calculi that reach an expressiveness of the level of the π-calculus, using different implementations of the name-passing ability, and that have the same symmetry property as CCS. The fusion calculi (Section 3.2, [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF][START_REF] Gardner | Explicit fusions[END_REF]) and the π-calculus with internal mobility (Section 3.1, [START_REF] Sangiorgi | Pi-calculus, internal mobility, and agent-passing calculi[END_REF]) are such examples. In addition, the fusion calculi have only one binder, so they have a property of separation of roles between constructs, as in CCS. Finally, those calculi generate a simpler and clearer behavioural theory ([PV98a, [START_REF] Wischik | Strong bisimulation for the explicit fusion calculus[END_REF][START_REF] Sangiorgi | Pi-calculus, internal mobility, and agent-passing calculi[END_REF]). Rather informally speaking, it appears that symmetry and simplicity go hand in hand: simplicity calls for minimality, hence the symmetry of constructs, and symmetry yields simple behavioural theories.

Contributions

We use symmetry as a tool to establish behavioural properties in the π-calculus, using this to relate existing encodings of the λ-calculus in the π-calculus (Section 3.3). We prove that fusion calculi are incompatible with subtyping and capability types in channel-based type systems and remark that such type systems are irrelevant for the π-calculus with internal mobility (Section 3.4).

We build a process calculus (written the πP-calculus) that lifts this impossibility, thanks to a notion of preorder on names (Chapter 4). Our calculus has only one binder and have a channel-based type system with subtyping and capabilities, and is not captured by existing calculi. In addition, our calculus gets back a notion of privacy of names that was featured by the π-calculus but not by fusion calculi. We then characterise the behavioural theory of this calculus in two ways: by a compositional bisimulation semantics and by establishing an axiomatisation of the calculus. It turns our the latter can be adapted to build an axiomatisation of the explicit fusion calculus, for which no axiomatisation have been established before.

In a second part we extend the scope of application of bisimulations. The theory of up-to techniques provides an impressive number of tools to establish bisimulation results, as well as a way to incorporate new tools and to combine them together. Unfortunately this theory only applies to a restricted number of systems, those who have a "first-order" representation, for example CCS and finite automata. For other systems that do not have such representations (notably, known bisimulations for π-calculi and λ-calculi), one needs to adapt each up-to technique along with its proof of correctness, which is usually redundant with other proofs. Our contribution (Chapter 5) is to find first-order representations for some of those calculi so that they inherit all the already-developed theory of up-to techniques. We also provide and prove correct the tools specific to each representation, i.e. the up to context techniques, which gives shorter and clearer proofs of correctness and congruence. We apply this method for the π-calculus, the λ-calculus, the λ-calculus with references, and the higher-order π-calculus, and try to provide guidelines and the problems to be expected in future applications of this method.

Outline

• Chapter 1 is this introduction.

• Chapter 2 gives some background, containing definitions common to most process calculi mentioned in this work: CSS, the π-calculus, their bisimulations, the typing discipline of π, and the λ-calculus.

• Chapter 3 studies symmetry in process calculi: we list the existing symmetric calculi (Sections 3.1 and 3.2), we explain how to use symmetry to establish behavioural properties (Section 3.3), and the incompatibility of types with symmetric calculi (Section 3.4).

• Chapter 4 describes the πP-calculus.

• Chapter 5 gives first-order representations of calculi, and their corresponding techniques.

Published works

Section 3.3, about using symmetry as a tool to relate processes, has been published in CONCUR [START_REF] Hirschkoff | Duality and i/o-types in the π-calculus[END_REF]. Section 3.4 providing the incompatibility of types, Section 4.1, and several parts of Chapter 4 introducing πP, have been published together in LICS [START_REF] Hirschkoff | Name-passing calculi: From fusions to preorders and types[END_REF]. The complete behavioural theory of πP in Sections 4.5 and 4.6 is to appear in the proceedings of FSEN [START_REF] Hirschkoff | A behavioural theory for a π-calculus with preorders[END_REF]. Most of Chapter 5 on applications of the theory of up-to techniques appears in CONCUR [START_REF] Madiot | Bisimulations up-to: Beyond first-order transition systems[END_REF].

Chapter 2 Background

The Calculus of Communicating Systems

Processes and reductions

The Calculus of Communicating Systems (CCS) is the most basic process calculus based on the operators introduced in Section 1.1. We first describe it by giving the following, simplified grammar of CCS, which is a special case of Grammar (1.2) when no data is transmitted. We give further below the details of the operators of choice and of replication, which are usually presented together with CCS. P ::= 0 P | Q (νa)P a.P a.P .

Above, a ranges over a countable set of names N , the names being the channels of the calculus. They can be bound by the restriction operator ν. To define this formally, we define the set fn(P ) of free names of P as follows: fn(0) ∅ fn(P | Q) fn(P ) ∪ fn(Q) fn((νa)P ) fn(P ) \ {a} fn(a.P ) fn(a.P ) {a} ∪ fn(P ) .

We present here two ways to give meaning to CCS processes: the first is the notion of reduction of processes, and the second is the notion of transitions between processes. As explained in Section 1.2 the latter is more compositional, hence easier to reason about, while the former may be easier to understand. We give first the definition of reductions, for which we first need to define structural congruence. Definition 2.1.1 (Structural congruence). Structural congruence is the least congruence relation ≡ satisfying the following laws:

P | 0 ≡ P P | Q ≡ Q | P (P | Q) | R ≡ P | (Q | R) P ≡ Q if P = α Q (νx)(νy)P ≡ (νy)(νx)P (νx)0 ≡ 0 (νx)(P | Q) ≡ (νx)P | Q if a is not a free name of Q.
where = α is alpha conversion, i.e. in this case (νa)P = α (νb)P {b/a} when b / ∈ fn(P ) where {b/a} is the capture-avoiding substitution of a with b. where ≡-→≡ stands for the relational composition of ≡, -→, and ≡. When not clear from the context, we specify in subscript of -→ the calculus we are working with, and so we write -→ CCS for reduction in CCS.

Remark how the inactive process 0 cannot perform any action or interaction and is only used as the first building block of processes. In the following, we will often omit it when it is a continuation of a prefix. For example, we write a | a.(a | b) instead of a.0 | a.(a.0 | b.0).

Barbed congruence

Now that we have a notion of reduction -→ CCS , we are a few steps away from getting the induced equivalence, but first we need a notion of observable. Intuitively, a barb (or observability predicate) at a holds for a process when the environment can detect that the process can accept an offer of interaction on channel a. More precisely: Definition 2.1.3 (Barbs). Process P has the barb a, written P ↓ CCS a , if for a fresh name w, its composition with the tester process a.w reduces in one step to a process in which w appears not guarded by a prefix. More precisely:

P ↓ CCS a iff P | a.w -→ CCS R | w
for some process R and w / ∈ fn(P ) .

Similarly, we define P ↓ CCS a with the tester a.w:

P ↓ CCS a iff P | a.w -→ CCS R | w
for some process R and w / ∈ fn(P ) .

Traditionally, barbs are defined syntactically, directly in terms of structural congruence. Instead, we use tester processes a.w and a.w. This way, the definition still makes sense for other calculi in the remainder of this work. (Note that for asynchronous calculi, the tester a.w would not be legitimate syntax, and indeed there is no input barbs in asynchronous equivalences-see Section 5.5.1) This definition of barbs is inspired from the notion of success in testing equivalence [START_REF] De Nicola | Testing equivalences for processes[END_REF], the w emulating the special signal usually written ω. Even if our notion of barb coincides with the usual one, it could be slightly different: the equivalence from Definition 2.1.4 is robust enough with respect to most choices of observability predicates.

Barbed congruence for any calculus

In fact, we can define barbed congruence for an arbitrary calculus L. The definition only requires a reduction relation, -→ L , and a notion of barb on names, ↓ L a . For CCS we could take it to be the output barbs, but it does not matter much: any kind of nontrivial observable would do. Since we define a congruence, we also assume a notion of contexts to compose processes: if P is a process in L and if C is a context of L (i.e. a process with one hole [•]), then we write C[P ] for the process obtained by replacing the hole [•] with P in C. Definition 2.1.4 (Reduction-closed barbed congruence). Let L be a process calculus, in which a reduction relation -→ L and barb predicates ↓ L a , for each a in a given set of names, have been defined. A relation R on the processes of L is:

• context-closed if P R Q implies C[P ] R C[Q] for each context C of L; • barb-preserving if P R Q implies that for any name a, P ↓ L a if and only if Q ↓ L a ;
• reduction-closed if, whenever P R Q:

-P -→ L P implies that for some Q , Q -→ L Q and P R Q , -Q -→ L Q
implies that for some P , P -→ L P and P R Q .

Then reduction-closed barbed congruence in L, written L , is the largest relation on the processes of L that is context-closed, reduction-closed, and barb-preserving.

Labelled transition system, bisimulation

Section 1.2 explains how transitions can be seen as a compositional presentation of reductions. This also means that they can be used to describe each operator of the calculus independently. The labels of the transitions are ranged over by µ, and can be: input actions a, output actions a, or silent actions τ where a ranges over names and τ is a fixed symbol:

µ ::= a a τ .
Label τ is an internal computation step of a process, we call it invisible. If label µ is not τ , we call it a visible label. We list below the operators of the calculus, giving for each an informal account of its behaviour and the formal rules giving the possible transitions or "actions" that one can derive from it:

• input: a.P can do an action a and then proceeds to become P :

a.P a -→ P (2.1)
• output: symmetrically, a.P does the output action a to P :

a.P a -→ P (2.2)
• restriction: the hiding operator indeed hides the name: if P can do action µ then (νa)P can do µ as well, as long as µ does not mention a:

P µ -→ P a / ∈ n(µ) (νa)P µ -→ (νa)P (2.3)
where n(µ) is the set of names mentioned by µ and is defined as n(a) n(a) {a} and n(τ ) ∅

• parallel composition has two roles: it lets transitions of either side go through and allows communication between the two sides. Hence, either one of the components does an action, the other being left unaffected:

P µ -→ P P | Q µ -→ P | Q Q µ -→ Q P | Q µ -→ P | Q , (2.4)
or the two components synchronise: if the first component does an input action a and the second component does the corresponding output action a on the same name (or vice versa), then the whole parallel composition does a τ action:

P a -→ P Q a -→ Q P | Q τ -→ P | Q P a -→ P Q a -→ Q P | Q τ -→ P | Q (2.5)
• nil: the process 0 cannot interact with anything, and hence has no transition.

Note how inputs and outputs are treated symmetrically. From a meta-theoretic point of view, this is enough to say that we can exchange input and outputs without changing the behaviour of processes. We give a precise meaning to this in Proposition 3.0.3 (Chapter 3). Putting together rules (2.1), (2.2), (2.3), (2.4), (2.5) yields for each label µ a relation µ -→, defining a labelled transition system (LTS) for CCS processes. Given such an LTS, the induced bisimulation is defined as follows: Definition 2.1.5 (Bisimulation). A relation R is a bisimulation if and only if, whenever P R Q:

• if P µ -→ P then, for some Q , Q µ -→ Q and P R Q , and • if Q µ -→ Q then, for some P , P µ -→ P and P R Q .
Bisimilarity ∼ is the union of all bisimulations. We say that P and Q are bisimilar if P ∼ Q.

Graphically, R is a bisimulation if it validates the bisimulation diagrams from Figure 1.1 (Section 1.2), and bisimilarity is, equivalently, the largest relation that validates them. The property of interest is that bisimilarity coincides with reduction-closed barbed congruence: Theorem 2.1.6. For all CCS processes P and Q, P Q if and only if P ∼ Q.

To show this correspondence, there are two directions. The first is to show that bisimilarity is a congruence, which can be done in several ways. One can prove congruence manually, by induction on the context-the most interesting case is the one for parallel composition, i.e.

P ∼ Q implies P | R ∼ Q | R.
But there are different ways to be more modular and independent of the syntax of the calculus. For instance:

• Milner and Sangiorgi [START_REF] Milner | Barbed bisimulation[END_REF] invoke the fact that the transitions rules for CCS are well-founded and in tyft/tyxt format which implies that ∼ is a congruence [START_REF] Groote | Structural operational semantics and bisimulation as a congruence (extended abstract)[END_REF].

• Pous has developed [START_REF] Pous | Techniques modulo pour les bisimulations[END_REF] the notion of initial contexts in order to derive proof techniques for bisimulation (seen more in depth in Section 5.1.1) by focusing on one operator at a time. The congruence of ∼ is a pleasant side effect of the correctness of those techniques.

The second direction is a quite simple case analysis on visible labels: P a -→≡ P if and only if, for some fresh w, there exists a P 1 such that P | a.(w | w) -→ P 1 -→ P , with P 1 ↓ CCS w and P ↓ CCS w , and symmetrically for input.

Weak behavioural theory

Internal mechanisms of agents are sometimes ignored to allow more general reasoning or to relate an implementation to its specification. The notion of weak behavioural theory is designed to ignore such internal transitions. In the following, we define weak versions of relations and predicates we defined before.

Weak reduction =⇒ L is the reflexive transitive closure of the internal reduction -→ L . The weak observability predicate ⇓ L a is defined by composing a weak reduction and a strong barb:

=⇒ L -→ * L P ⇓ L a ⇐⇒ P =⇒ L ↓ L a .
Weak reduction-closed barbed congruence is defined as the strong version, replacing the strong observability predicate and reduction with their weak variants. In fact, we can make the definition a little less demanding and only ask for the answers to the challenges to be weak:

Definition 2.1.7 (Weak reduction-closed barbed congruence). A relation R on the processes of L is:

• weakly barb-preserving if P R Q implies that for any name a, P ↓ L a implies Q ⇓ L a ;
• weakly reduction-closed if P R Q and P -→ L P imply there is

Q such that Q =⇒ L Q and P R Q .
Then weak reduction-closed barbed congruence in L, written L , is the largest symmetric relation on the processes of L that is context-closed, weakly reduction-closed, and weakly barb-preserving.

To capture weak reduction-closed barbed congruence, one can build weak bisimilarity, defined through weak transitions.

Since the following is independent of the syntax of the calculus we consider, we get rid of the indexing with L-keeping the special transition τ . The formal framework for this is defined in the beginning of Section 5.1. =⇒ are defined as follows:

• =⇒ τ -→ * (where R * (P 0 R * P n iff n ≥ 0 and P 0 R P 1 R . . . R P n ) is the reflexive transitive closure of R) • μ -→ µ -→ if µ = τ and μ -→ -→ = if µ = τ (where R = (P R = Q iff P = Q or P R Q) is the reflexive closure of R) • μ =⇒ =⇒ μ -→=⇒ • µ =⇒ =⇒ µ -→=⇒
Definition 2.1.9 (Weak bisimulation). A relation R is a weak bisimulation if and only if, whenever P R Q:

• if P µ -→ P then, for some Q , Q μ =⇒ Q and P R Q , and
• if Q µ -→ Q then,
for some P , P μ =⇒ P and P R Q .

Weak bisimilarity ≈ is the union of all weak bisimulations, and P and Q are weakly bisimilar if P ≈ Q.

On CCS processes as defined in Section 2.1.1 (without the choice operator), weak bisimilarity coincides with weak reduction-closed barbed congruence: Theorem 2.1.10. For all CCS processes P and Q, P Q if and only if P ≈ Q.

Common extensions

We define in this section two common operators of CCS that are useful in our setting: choice and replication.

Replication (!)

The replication !P of a process P represents an arbitrary number of copies of P in parallel. The grammar is extended as follows:

P ::= . . . !P .

It can be defined both in terms of reduction by adding one law to structural congruence, and in terms of transitions, by adding one rule:

!P ≡ !P | P !P | P µ -→ P !P µ -→ P (2.6)
Both mean that !P stands in principle for an infinite parallel composition of copies of P . Theorems 2.1.6 and 2.1.10 above hold in presence of replication.

Choice (+)

The choice between two processes, or their sum, represents a process that can behave as one of the two processes, possibly by reacting to the actions of the environment (contrary to internal choice, defined in (1.3), which performs this choice by itself). The grammar is extended as follows:

P ::= . . . P + Q .

Choice can be defined in terms of transitions using the two rules of (1.4), that we write again here:

P µ -→ P P + Q µ -→ P Q µ -→ Q P + Q µ -→ Q (2.7)
With this addition, Theorem 2.1.6 holds but Theorem 2.1.10 fails. Indeed, in the weak case and in presence of arbitrary choice, reduction-closed barbed congruence is not a reasonable equivalence: context closure in presence of choice is too strong a requirement in addition to being reduction-closed, and indeed, we reach a contradiction from the expected law a. Arbitrary choice is usually handled using a notion of barbed congruence [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF] that does not alternate between context closure and reduction closure. Another way is to modify Definition 2.1.7 and require the relations to be closed under parallel contexts instead of arbitrary contexts. Alternatively, most use cases of choice can be recovered by the restricted form of guarded choice: all sums must be of the form π 1 .P 1 + • • • + π n .P n where π i s are prefixes (a, a and sometimes1 τ in CCS). The grammar can then be written as summations ranging over a family of indices I (depending on the calculus, I is sometimes allowed to be infinite):

P ::= P | Q (νa)P i∈I π i .P i π ::= a a .
the base rule of the reduction relation can then be defined as follows:

π i = a ρ j = a i∈I π i .P i | j∈J ρ j .Q j -→ P i | Q j (2.8)
In this work, when reduction-closed barbed congruence is used, we use only guarded choice, for which the choice of equivalence between reduction-closed barbed congruence and barbed congruence is unimportant.

Remark 2.1.11. In this section on CCS, definitions are independent from the syntax of the language. In fact, the notions of bisimulations from Definitions 2.1.5 and 2.1.9 are standard (contrarily to the ones for the π-calculus), so much that we could call standard bisimulations "CCS-like". This is the notion that will be used in Chapter 5. Note that the addition of operators of replication (using (2.6)) and choice (using (2.7)) in terms of LTS does not depend on the calculus (provided, in the case of replication, that it already features parallel composition).

The π-calculus

The π-calculus is CCS with name-passing abilities. The data passed through channel names are names themselves, that are sometimes private names. This last bit actually provides much of the expressive power of the π-calculus. The grammar is as follows:

P ::= 0 P | Q (νa)P a b .P a(x).P .
(2.9)

Where names are from the same set N and are ranged over by a, b, . . . , x, y, . . . The structural congruence ≡ is defined as for CCS in Definition 2.1.1. Name x is bound in a(x).P , as seen in the updated definition of fn(•) from CCS:

fn(a b .P ) {a, b} ∪ fn(P ) fn(a(x).P ) {a} ∪ (fn(P ) \ {x}) .

The reduction relation is exactly the same as in CCS, except for the base case of communication where the name is indeed passed: Where Q{b/x} is the capture-avoiding substitution of b with x in Q. We sometimes write -→ π to avoid ambiguity.

The transitions for π need more labels: label a(b) is called bound output, and is useful to extend the scope of private names, which is called scope extrusion.

µ ::= ab ab a(b) τ .

We now have bound names in labels, and we write bn(a(b)) = {b} (for other labels µ, bn(µ) = ∅). We also update the definition of n(µ): n(ab) = n(ab) = n(a(b)) = {a, b} and n(τ ) = ∅.

Barbs in the π-calculus are defined similarly to those of CCS:

Definition 2.2.2 (Barbs in π). For a process P , output barbs and input barbs, written respectively P ↓ π a and P ↓ π a are defined as follows (where x = w):

P ↓ π a iff P | a(x).w -→ π R | w
for some process R and w / ∈ fn(P )

P ↓ π a iff P | (νx)a x .w -→ π R | w
for some process R and w / ∈ fn(P ).

Note that we write w as short for (νu)w u where u = w.

Barbed congruence for the π-calculus is defined using the generic Definition 2.1.4.

The rules defining transitions

-→ P a = b P µ -→ P P | Q µ -→ P | Q bn(µ) ∩ fn(Q) = ∅ P ab -→ P Q ab -→ Q P | Q τ -→ P | Q P a(b) -→ P Q ab -→ Q P | Q τ -→ (νb)(P | Q ) b / ∈ fn(Q) Figure 2.1: Labelled transitions in the π-calculus ( • -→ π )
Choice and replication can be added exactly as for CCS: by adding rules from (1.4) and (2.6), respectively. The bisimulation has to be modified to handle extrusion: Definition 2.2.3 (Early bisimilarity in π). A relation R on π-calculus processes is a strong early bisimulation if, whenever P R Q:

1. if P a(b) -→ π P and b / ∈ fn(Q) then Q a(b) -→ π Q for some Q such that P R Q , 2. if P µ -→ π P and µ is not a bound output, then Q µ -→ π Q for some Q such that P R Q ,
3. the converse of (1) and (2), on Q.

Early bisimilarity, ∼ e , is the union of all early bisimulations.

Using the same notation for weak transitions as in Definition 2.1.8, we get a notion of weak bisimilarity: Definition 2.2.4 (Weak early bisimilarity in π). A relation R on π-calculus processes is a weak early bisimulation if, whenever P R Q:

1. if P a(b) -→ π P and b / ∈ fn(Q) then Q a(b) =⇒ π Q for some Q such that P R Q , 2. if P µ -→ π P and µ is not a bound output, then Q μ =⇒ π Q for some Q such that P R Q ,
3. the converse of (1) and (2), on Q.

Weak early bisimilarity, ≈ e , is the union of all weak early bisimulations.

Note how inputs and outputs are treated differently, both in the reduction semantics, the transitions, and the bisimulation. If in CCS, one can trivially exchange inputs and outputs whilst essentially preserving the semantics, this does not seem simple in the π-calculus.

Typing and subtyping for the π-calculus

As in the sequential and functional world, types for the π-calculus are used to impose constraints on how programs or resources are used. They allow more precise behavioural analyses, and are often required to design scalable systems. Types for the π-calculus were first used to control arities of channels [START_REF] Milner | The polyadic pi-calculus[END_REF] (in which case types are called sorts), and then were extended by Pierce and Sangiorgi [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF] to capability types. The latter type discipline focuses on how channel names are used, ensuring that only some names will be used as receiving channels, and only some others as emitting channels. They also determine which kind of data can be exchanged through channels.

Types, ranged over by T , U ,... are described by the following grammar:

T ::= iT oT T 1 X µX.T (2.10)
where iT , called an input type, is the capability of receiving data of type T . Output type oT is the capability of sending such data. Names with type T have both capabilities. The unit type is written 1 and provides no capability. We allow recursive definitions and consider equal µX.T and T {µX.T /X} to be able to manipulate infinite, regular types. We refer to those types as input/output types, or i/o-types. Note that data carried over in the plain π-calculus consist only of channel names, but i/o-types are well-suited to extensions to other kinds of data [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF]. Rules for i/o-types are listed in Figure 2.2. Note that in case of ambiguity (mainly in Section 3.3), the resulting typed calculus is written π io .

We use Γ, ∆ to range over type environments, i.e., partial functions from names to types. We write dom(Γ) for the domain of Γ, that is, the set of names on which Γ is defined. In name-passing calculi, a type system assigns a type to each name. Typing judgements are of the form Γ P (process P respects the type assignments in Γ), and Γ a : T (name a can be assigned type T in Γ).

Note that rule T-NAME mentions a subtyping relation ≤. Subtyping is very natural for capability types: some names can have more capabilities than others. Relation ≤ is defined inductively2 in Figure 2.3: we see here that capability i is covariant, that o is contravariant, and that has no special variance. Rules SUBi and SUBo formally say that capability subsumes the other two.

T-NAME Γ(a) ≤ T Γ a : T T-NIL Γ 0 T-PAR Γ P Γ Q Γ P | Q T-REP Γ P Γ !P T-RES Γ, a : T P Γ (νa)P T-OUT Γ a : oT Γ b : T Γ P Γ a b .P T-INP Γ a : iT Γ, x : T P Γ a(x).P Figure 2.2: i/o-types in the π-calculus (written π io ) SUB-REFL T ≤ T SUB-TRANS T 1 ≤ T 2 T 2 ≤ T 3 T 1 ≤ T 3 SUB-i T ≤ iT SUB-o T ≤ oT SUB-ii T 1 ≤ T 2 iT 1 ≤ iT 2 SUB-oo T 1 ≤ T 2 oT 2 ≤ oT 1 Figure 2.3: Subtyping for i/o-types in π
Subtyping can be directly related to typing judgements: when T 1 ≤ T 2 , we know that T 1 can be used in place of T 2 in every typing judgement. We call this the narrowing property: Lemma 2.3.1 (Narrowing for π). Suppose T 1 ≤ T 2 . Then Γ, a : T 2 P implies Γ, a : T 1 P .

Narrowing-especially written as it is above-says that the subsumption rule:

SUBSUMPTION T 1 ≤ T 2
Γ, a : T 2 P Γ, a : T 1 P is admissible. It is sometimes included in the type system, with a more strict version of T-NAME; the two presentations are strictly equivalent. It can be used to derive the preservation of the typing information through reduction: Lemma 2.3.2 (Subject reduction for π). For every π-calculus process P , if Γ P and P -→ π P then Γ P .

Subject reduction, together with the shape of the typing rules, let one derive in turn Corollary 2.3.3, a safety property about how names can be used: e.g. if a name is typed with an input type, then it will not be used as an output.

Corollary 2.3.3 (Type consistency for π). If Γ, a : iT P then P ⇓ π a and if if Γ, a : oT P then P ⇓ π a .

Polyadic π-calculus [Mil92]

We mentioned in Section 1.3 that the polyadic π-calculus could be encoded in the regular (monadic) π-calculus. While this indeed means that polyadic and monadic π have the same raw expressive power, this does not mean that the types can be preserved through this encoding, and in fact they are more informative in the polyadic variant. In this paragraph, we elaborate on this. The grammar of the polyadic π-calculus is as follows:

P ::= 0 P | Q !P (νa)P a b 1 , . . . , b n .P a(x 1 , . . . , x m ).P wrong ,
the base case of the reduction relation in π is replaced with the following [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF]:

a b 1 , . . . , b n .P | a(x 1 , . . . , x m ).Q -→ P | Q{b 1 /x 1 } . . . {b n /x m } if m = n wrong if m = n ,
and structural congruence is extended with wrong ≡ (νa)wrong ≡ P | wrong ≡ !wrong. The construct wrong emphasises the fact that there might be undesirable arity mismatches. Milner introduced [START_REF] Milner | The polyadic π-calculus: a tutorial[END_REF] a sorting system to prevent those, but here we directly present the extension to i/o-types [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF]. Now, types can be grouped into tuples:

T ::= c(T 1 , . . . , T n ) 1 X µX.T c ::= i o
and typing rules are straightforward but more verbose:

Γ a : o(T 1 , . . . , T n ) (Γ b i : T ) ∀i∈{1,...,n} Γ P Γ a b 1 , . . . , b n .P Γ a : i(T 1 , . . . , T n ) Γ, x 1 : T 1 , . . . , x n : T n P Γ a(x 1 , . . . , x n ).P .
Subject reduction holds for this type system. Consequently, since there is no rule to derive Γ wrong, we know that if Γ P and P =⇒ π P then P ≡ wrong.

In principle, polyadic types are not more intricate than the ones for the monadic π-calculus, but the corresponding type discipline is expressive and useful in practice (note that the usual encoding from polyadic π to monadic π does not preserve types). In light of this, in this work, we handle polyadic prefixes only when needed or as extensions, and not in the base grammar.

Notation When dealing with monadic calculi, we will sometimes omit the chevrons in prefixes, writing e.g. ab instead of a b .

The λ-calculus in the π-calculus

Call-by-name The λ-calculus is the foundational calculus for functional programming, and is often used as a test of expressiveness for process calculi. We give below a call-by-name flavour of λ-calculus [Plo75]more precisely the weak head reduction strategy-which proved to be simple to encode. The set Λ of pure λ-terms is defined by: M, N ::= x λx.M M N where x is bound in λx.M . We write Λ 0 for the subset of closed terms. The call-by-name reduction (cbn) relation -→ n is the least relation over Λ 0 that is closed under the following rules:

(λx.M )N -→ n M {N/x} M -→ n M M N -→ n M N
We write =⇒ n for the reflexive and transitive closure of -→ n . The values are the terms of the form λx.M and are ranged by V , W . In call-by-name, evaluation contexts are described by the following grammar:

C ::= CM [•]
Symbol C is used also for arbitrary contexts; it will be explicitly indicated when C refers to an evaluation context. Plotkin [Plo75] also focuses on a variant of λ where the beta-reduction only happens when the argument is a value, giving birth to a significantly different equational theory. We use what is called the left-to-right call-by-value (cbv), written -→ v , and given by the following rules:

Call-by-value

(λx.M )V -→ v M {V /x} M -→ v M M N -→ v M N N -→ v N V N -→ v V N .
We write =⇒ v for the reflexive and transitive closure of -→ v . We can deduce that evaluation contexts in call-by-value can be described by the following grammar:

C ::= CN V C [•]
Encoding cbv in pi As an example of an encoding result, we recall an encoding of call-by-value λ into π given in [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF]. Note that values are represented by names ranged over by v, and that the encoding [[M ]] p of a term M can be handled to the environment through the name p, which we call the handle.

[[λx.M ]] p = (νv)pv.!v(x, q).[[M ]] q [[x]] p = px [[M N ]] p = (νq) [[M ]] q | q(v).(νr)([[N ]] r | r(w).v w, p ) .
To understand this encoding, looking at a cbv beta-redex (a term of the form V 1 V 2 ) is insightful. For example the encoding of the term (λx.M )(λy.N ) reduces in a deterministic way to a process that behaves like [[M ]] p except that x is bound to a server that provides N whenever x is called:

[[(λx.M )(λy.N )]] p ≈ (νx) [[M ]] p | !x(y, q).[[N ]] q .
We can see how process !x(y, q).[[N ]] q behaves as an environment mapping x to λy.N , while the restriction on x is preventing an outside process from tampering with the mapping. (One could also view it as an explicit substitution (λy.N/x), as explicit substitutions [START_REF] Abadi | Explicit substitutions[END_REF] are decomposing the usual beta-reduction into more elementary steps.) Note that thanks to the replication in the server, x can be used multiple times in M . There are simpler encodings, especially for call-by-name, where the analogy between environments and servers is more immediate. However, more can be said about the cbv encoding above, with respect to the typing discipline:

• a first version of this encoding was studied in Milner's Functions as Processes [START_REF] Milner | Functions as processes[END_REF] with a more verbose clause for the variable: [[x]] p = (νv)pv.!v(y, q).x y, q . As Milner remarked, computations can take more time with this encoding (for instance, each beta step of the usual diverging term Ω = (λx.xx)(λx.xx) takes an increasing number of silent reductions in π, instead of just one with the optimised encoding).

It took the typing system introduced by Pierce and Sangiorgi [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF] to prove the soundness of the optimised encoding.

• The types of the simply-typed lambda-calculus are preserved by this encoding; we recall here the typing rules, building arrow types on top of base types (the latter being ranged over by ι): Chapter 3

A ::= ι | A → B Γ(x) = A Γ x : A Γ, x : A M : B Γ λx.M : A → B Γ M : A → B Γ N : A Γ M N : B a λ-type A corresponds to a π-type [A] defined as: [ι] ι [A → B] o([A], o[B]) . ( 2

Symmetric calculi

In this chapter, we first recall some symmetric calculi known in the literature. We already remarked that CCS is symmetric: it is easy to see that swapping inputs and outputs in processes does not change the induced equivalence. To say this formally, one can define a dualisation operator, mapping a process P to its dual P , defined as follows: Definition 3.0.1 (Dual of a process in CCS). The dual of a process P , written P is defined by the following recursive definition: a.P a.P a.P a.P 0 0

P | Q P | Q (νa)P (νa)P .
The first two equations state that duality indeed swaps inputs and outputs; we say that the last three make the dual operator homomorphic with respect to the other operators of the calculus. We observe the following straightforward symmetry properties in CCS: Proposition 3.0.2. For all CCS processes P and Q, P -→ Q if and only if P -→ Q.

Proposition 3.0.3. For all CCS processes P and Q, P Q if and only if P Q.

In the following, we describe more elaborate calculi having similar properties.

Symmetry as internal mobility

There is a significant expressiveness gap between CCS and the π-calculus: the former has a cleaner theory, the latter allowing more, and cleaner, encodings of data types. The π-calculus with internal mobility [START_REF] Sangiorgi | Pi-calculus, internal mobility, and agent-passing calculi[END_REF], written πI, forms a bridge between the two: the behavioural theory is simple, and the calculus is expressive. One way to define πI is to consider the subcalculus of π where all emitted data are always private names, i.e. outputs are always of the form (νx)a x .P , which is generally written a(x).P , as x is bound. We know that πI is indeed a subcalculus of π, i.e.:

πI ⊆ π (πI-→) ⊆ (≡πI) .
The first inclusion tells us that πI is a subset of π; the second inclusion tells us that πI is a calculus by itself, i.e. that πI is closed by reduction (up to structural congruence: if P ∈ πI and P -→ Q then Q ≡ Q for some Q ∈ πI). Whilst this calculus fits the presentation we gave in Section 1.1, we prefer to use a dedicated grammar:

Definition 3.1.1. Terms of πI are generated by the following grammar:

P ::= 0 P | Q (νa)P a(x
P µ -→ P P | Q µ -→ P | Q bn(µ) ∩ fn(Q) = ∅ P a(x) -→ P Q a(x) -→ Q P | Q τ -→ (νx)(P | Q ) Figure 3.1: Labelled transitions in πI ( • -→ πI )
Note that guarded sum and recursive definitions are usually included in πI. We do not present them here, for the sake of uniformity, but recursive definitions are useful to provide πI with its full expressiveness: it can encode, for example, the λ-calculus [START_REF] Sangiorgi | Pi-calculus, internal mobility, and agent-passing calculi[END_REF]. As in CCS, an input/output duality operator can be defined on πI terms: a(x).P a(x).P a(x).P a(x).P 0 0

P | Q P | Q (νa)P (νa)P
and the properties of symmetry of CCS (Propositions 3.0.2 and 3.0.3) can also be derived in πI.

Symmetry in fusion calculi

The π-calculus has two kinds of prefixes: output prefixes, with free objects and input prefixes, with bound objects. We say that "outputs are free" and that "inputs are bound". The πI-calculus gets rid of this asymmetry by having both bound outputs and bound inputs. This suggests that there could be an approach in the opposite direction, with both free outputs and free inputs. Moreover, this approach removes the binding role from the prefix operator, which serves minimality: the resulting calculus would feature only one binder. In fact, this yields a variety of calculi, that we call here fusion calculi. We give in this section a description of three of them: the update calculus in Section 3.2.1, the fusion calculus in Section 3.2.2 and the explicit fusion calculus in Section 3.2.3.

The first question asked when designing such calculi is what happens during interactions: the objects must be made to be related somehow. In π, the bound object is replaced by the free object. In πI, both bound objects are unified, through α-conversion. In fusion calculi, how objects are related will determine the calculus itself:

Output Input Reduction πI a(x).P a(x).Q a(x).P | a(x).Q -→ (νx)(P | Q) π a b .P a(x).Q a b .P | a(x).Q -→ P | Q{b/x} fusion calculi a b .P a c .Q a b .P | a c .Q -→ ?
We describe below the main flavours of fusion calculi, that answer this question in three different ways.

The update calculus

By analogy with the π-calculus, replacing the input object with the output object seems to be the natural option. In a fusion calculus, to do so in a sensible manner, one must replace all occurrences of the name in input object. Whilst this operation was easy to define in the π-calculus, the fact that the binder is not tied to the input prefix anymore makes it not well defined in all cases. The first solution, used in the updatecalculus [START_REF] Parrow | The update calculus[END_REF], is to apply the substitution within the whole scope of a name, where the scope is delimited by the restriction operator. Hence, a substitution of a name c with a different name b only takes place inside a process of the form (νc)R and will result in R{b/c}. Formally, grammar and reduction are defined as follows:

P ::= 0 P | Q (νa)P a b .P a b .P a b .P | a b .Q -→ up P | Q (νc)(a b .P | a c .Q | R) -→ up (P | Q | R){b/c}
In addition, as usual, -→ is closed by parallel contexts, restriction, and structural congruence, the latter being defined with again the rules from Definition 2.1.1.

If the syntax is symmetric, the reduction relation is not, contrarily to CCS and πI. Indeed, (νc)(a b .0 | a c .0) -→ up 0 but the symmetric process (νc)(a b .0 | a c .0) has no reduction through -→ up . Whilst this itself is not a problem, the update calculus has behaviours one might not expect at first glance:

• two-way substitutions: it seems that substitution is going one way only: input objects are being replaced with output objects. However, a combination of two input objects might induce a replacement of an output object:

(νcb)(u b | u c | v a | v c | P ) -→ up (νb)(v a | v b | P {b/c}) -→ up P {b/c}{a/b} .
In the reduction above, name b is replaced with name a, whereas b appears as output object in the first process.

This means that we cannot statically ensure that output objects are protected from replacement, which impedes the detection of future aliasing of two names.

In addition to not knowing if two names might become equal in the future, this forbids some forms of type systems in the update-calculus (Section 3.4).

• polyadicity: the update calculus lacks robustness: as remarked in [START_REF] Parrow | The update calculus[END_REF], considering its polyadic version raises the question "which process, if any, should (νd)(a b, c | a d, d ) reduce to?". This suggests again that output objects may be altered along the reduction.

We present next the fusion calculus, which solves the second observation by making reduction symmetric, and takes two-way substitutions as a feature instead of an observation. In Chapter 4, we present a calculus that can be seen as a corrected variant of the update-calculus, with, indeed, one-way substitutions.

The fusion calculus

The fusion calculus [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF], occasionally called implicit fusion calculus (or just "implicit fusions") to avoid confusion with Section 3.2.3, is the symmetrised version of the update calculus where objects of both polarities can be subject to substitution in the scope of a restriction. Its grammar is the same as in the update calculus:

P ::= 0 P | Q (νa)P a b .P a b .P and its reductions are defined below (closed under ≡ and the usual contexts):

a b .P | a b .Q -→ fu P | Q (νc)(a b .P | a c .Q | R) -→ fu (P | Q | R){b/c} (νb)(a b .P | a c .Q | R) -→ fu (P | Q | R){c/b}
The usual duality operator defined as a b .P a b .P and a b .P a b .P generates the same symmetry correspondence as in CCS, in Proposition 3.0.3. The polyadic variant can be described using a single rule:

(νd 1 , . . . , d m )(a b 1 , . . . , b n .P | a c 1 , . . . , c n .Q | R) -→ fu (P | Q | R)σ ,
is a reduction when σ is a name substitution, such that:

• the range of σ is {b 1 , . . . , b n , c 1 , . . . , c n } \ {d 1 , . . . , d m } • the domain of σ is {d 1 , . . . , d m },
• and such that σ(b i ) = σ(c i ) for all i ≤ n.

(The domain of σ is the set {x | x = σ(x)}, and the range of σ is {σ(x) | x = σ(x)}.)

The reductions presented above are not compositional, mainly because the substitution happens in the whole scope of the restriction. Another presentation [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF], which is used to build a compositional LTS for the implicit fusion calculus, puts the substitution on hold, waiting for a potential restriction from the environment:

P ab -→ fu P Q ac -→ fu Q P | Q {b=c} -→ fu P | Q P {b=c} -→ fu P (νc)P 1 -→ fu P {b/c} P {b=c} -→ fu P (νb)P 1 -→ fu P {c/b}
The labels can be, in addition to output and input labels, equivalence relations on names. A transition labelled with 1 (the identity relation) is a silent transition, and {b=c} represents the smallest equivalence relation containing (b, c). For example, {b=b} = 1.

Other rules, described in details in [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF], complete the set, but the ones above serve our introductory purposes.

The explicit fusion calculus

The explicit fusion calculus [START_REF] Gardner | Explicit fusions[END_REF] transforms the transition P {b=c} -→ fu P from the implicit fusion calculus into a real silent transition and postpones the act equating of b and c. It relates b in c in an explicit manner, in a process construct b=c, called a fusion, resulting in the reduction P -→ ef P | b=c. The role of the fusion b=c is to somehow equate b and c in the upcoming reductions of the process. We give more details about this calculus. First, the grammar of the explicit fusion calculus (or "explicit fusions") is the same as the one for the implicit fusion calculus, with the additional fusion construct:

P ::= 0 P | Q (νa)P a b .P a b .P | a=b .
The base case of the reduction -→ ef appeals by its simplicity:

a b .P | a c .Q -→ ef P | Q | b=c ,
and can be extended naturally to polyadic communication:

a b 1 , . . . , b n .P | a c 1 , . . . , c n .Q -→ ef P | Q | b 1 =c 1 | . . . | b n =c n .
However, to give meaning to the fusion construct, structural congruence from Definition 2.1.1 has to be augmented with rewriting rules: Compositional LTS Alternatively, one can give a compositional presentation of the explicit fusion calculus without mentioning structural congruence. Whilst the implicit fusion calculus needs a restriction νc or νd to trigger the reduction between a c .P and a d .Q, the explicit fusion calculus needs a fusion a=b to trigger the reduction between a c .P and b d .Q.

P |
Because of this, the labels of the LTS must anticipate such fusions, which can come from the environment. They are ranged by µ and can be either outputs, inputs, or conditional τ s:

µ ::= a(x) | a(x) | [a = b]τ ,
where x is bound in a(x) and a(x). The action [a=b]τ means that a reduction can happen if the environment is able to equate a and b. We therefore identify τ with labels of the form [a = a]τ where a can be any name.

We give below a variant of the original LTS from Wischik [START_REF] Wischik | Strong bisimulation for the explicit fusion calculus[END_REF]. The judgement P a = b, read as "P enforces a = b", is defined by the following rules: This LTS coincides with the one from [START_REF] Wischik | Strong bisimulation for the explicit fusion calculus[END_REF]) up to structural congruence; the differences are small: objects are handled using bound names (instead of concretions), and fusions are introduced to link objects to bound names. We focus on which names can be equated, instead of actually rewriting anything.

P a = a P a = b P b = a P a = b P b = c P a = c a=b a = b P a = b P | Q a = b P a = b Q | P a = b P a = b c / ∈ {a, b} (νc)
-→ P Q b(x) -→ Q P | Q [a=b]τ -→ (νx)(P | Q ) P µ -→ P bn(µ) ∩ fn(Q) = ∅ P | Q µ -→ P | Q P µ -→ P a / ∈ n(µ) (νa)
Given these definitions of LTS

• -→ ef and judgement , we can define the notion of efficient bisimulation [START_REF] Wischik | Strong bisimulation for the explicit fusion calculus[END_REF] that captures barbed congruence. Definition 3.2.1. A symmetric relation R is an efficient bisimulation if, whenever P R Q:

• for all a and b, if P a = b then Q a = b;

• if P a(x) -→ ef P and x / ∈ fn(Q), then Q a(x)
-→ ef Q and P R Q for some Q ;

• if P a(x) -→ ef P and x / ∈ fn(Q), then Q a(x)
-→ ef Q and P R Q for some Q ;

• if P [a=b]τ -→ ef P then (Q | a=b) τ -→ ef Q and (P | a=b) R Q for some Q .
We write ∼ ef for the largest efficient bisimulation.

Remark 3.2.2. Processes of the implicit fusion calculus can be seen as processes of the explicit calculus; the latter is actually a conservative extension of the former, as the identity encoding induces a full abstraction [START_REF] Wischik | Explicit Fusions: Theory and Implementation[END_REF]. Therefore, we denote the two of them using the word "fusion calculi" or sometimes even just "fusions".

We show an important difference (already highlighted in [START_REF] Parrow | The update calculus[END_REF]) between π and fusion calculi: in π with choice, we have x | y = x.y + y.x if we have the guarantee that x is not equal to y. This guarantee can be ensured by adding two restrictions (νxy) before, for example, sending x and y to the environment. This yields the interleaving law:

(νxy)ax.ay.(x | y) = (νxy)ax.ay.(x.y + y.x) .

(3.2)

The law holds in the π-calculus for barbed congruence but not for fusion calculi (for update, fusion, or explicit fusion calculi) since the two names x and y can be equated by a outside process ac.ac, authorising a synchronisation in the left-hand side of the resulting processes:

c | c versus c.c + c.c .
Of course, this is only valid in fusion calculi extended with sums (using a rule similar to (2.8)), but one can build a counterexample replacing sum with replication using Counterexample 5.8.2 from [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF], which is another inequality exploiting the aliasing of two names to distinguish processes.

This example shows how private names can be equated in fusion calculi, whereas this is impossible in the π-calculus. We study this more thoroughly in Section 4.4. We contribute on explicit fusions in two other ways: in Section 4.6.3 we give an axiomatisation of the calculus, and more generally, Chapter 4 introduces and studies an asymmetric variant of the explicit fusion calculus.

Symmetry as a tool

Sections 3.2.1 to 3.2.3 are an account of calculi taken in the literature that have an intrinsic symmetry. In this section, we move to a new contribution (published in [START_REF] Hirschkoff | Duality and i/o-types in the π-calculus[END_REF]). We build a symmetric calculus on top of the π-calculus that is not a interesting by itself, but which can be used as a tool, to study behavioural properties of π-calculus processes.

Reasoning about processes usually involves proving behavioural equivalences, sometimes working in a typed setting with typed behavioural equivalences, that allow one to express constraints about the observations available to the context when comparing two processes. These constraints are generally expressed using the i/o type discipline (Section 2.3).

If dualities may reveal underlying structure and lead to simpler theories, they can also be used to relate different mathematical entities. We study here how duality can help relate processes through typed behavioural equivalences. As it is detailed in Section 3.4 existing symmetric versions of π (πI and fusion calculi) are not suitable for such a purpose: duality breaks with the addition of ordinary i/o-types.

In this section, in order to work in a setting that provides a form of duality and where i/o-types can be used, we introduce a calculus named π (Section 3.3.1). Intuitively, π is the minimal symmetrical conservative extension of π with input/output types: it has constructs for free input and bound output (note that bound output is not seen as a derived construct in π). In π, we rely on substitutions as the main mechanism at work along interactions. To achieve this, we forbid interactions involving a free input and a free output: the type system rules out processes that use both kinds of prefixes on the same channel. Calculus π differs from fusion calculi in how it handles interactions between free prefixes, which we can summarise in the following table:

Reduction fusion calculus (νb)(a b .P | a c .Q) -→ fu (P | Q){c/b} explicit fusion calculus a b .P | a c .Q -→ ef P | Q | b=c π a b .P | a c .Q is not well-typed
Calculus π contains π, and any π process that can be typed using i/o-types can be typed in exactly the same way in π. Moreover π contains a 'dualised' version of π: one can choose to use some channels in free input and bound output. For such channels, the typing rules intuitively enforce a 'contract' on the usage of the transmitted name on the side of the emitter (dually to the typing rules presented above). Usual duality properties, Propositions 3.0.2 and 3.0.3, hold in π. We also show how π can be related to π, by translating π into a variant of the π-calculus with i/o-types in a fully abstract way (in Section 3.3.2). This result shows that π and π are rather close in terms of expressiveness.

In Section 3.3.1 we define a notion of typed barbed congruence in π, which allows us to validate at a behavioural level the properties we have mentioned above: two processes are equivalent if and only if their duals are. It seems that no other existing calculus with i/o-types enjoys this form of duality for behaviours.

As an application of π, its dualities, and its behavioural theory, we use π to relate two encodings of callby-name λ-calculus (Section 3.3.3). The first one is the ordinary encoding by Milner [START_REF] Milner | Functions as processes[END_REF], the second one is by van Bakel and Vigliotti [START_REF] Van Bakel | A logical interpretation of the λ-calculus into the π-calculus, preserving spine reduction and types[END_REF]. The two encodings are syntactically quite different. Milner's is input-based, in that an abstraction interacts with its environment via an input. In contrast, van Bakel and Vigliotti's is output-based. Moreover, only the latter makes use of link processes, that is, forwarders that under certain conditions act as substitutions.

A symmetric π-calculus with types

The syntax of π is defined with the following grammars:

P ::= 0 P | Q !P (νa)P α.P α ::= ρ b | ρ(x) ρ ::= a | a
π differs from the usual π-calculus by the presence of the free input a b and bound output a(x) prefixes. Note that in π, the latter is not a notation for (νx)a x .P , but a primitive construct. These prefixes are the symmetric counterpart of a b and a(x) respectively. Given a process P , fn(P ) stands for the set of free names of P , given that restriction, bound input and bound output are binding constructs. Given ρ of the form a or a, n(ρ) is defined by n(a) = n(a) = a. Structural congruence is standard, and defined as in CCS in Definition 2.1.1 (in particular, as it is usually the case, there are no axioms involving prefixes), with the addition of !P ≡ !P | P (seen in (2.6)) for replication.

Definition 3.3.1 (Reduction in π). The reduction laws -→ (sometimes written -→ π ) allow communication involving two prefixes only if at least one of them is bound:

a b .P | a(x).Q -→ P | Q{b/x} a b .P | a(x).Q -→ P | Q{b/x} a(x).P | a(x).Q -→ (νx)(P | Q) P -→ P P | R -→ P | R P -→ P (
νa)P -→ (νa)P P ≡-→≡ P P -→ P Note that a b | a c is a process of π that has no reduction; this process is ruled out by the type system presented in Figure 3.4.

Types and Behavioural Equivalence

Types are a refinement of standard i/o-types: in addition to capabilities (ranged over using c), we annotate types with sorts (s), that specify whether a name can be used in free input (sort e) or in free output (r)-note that a name cannot be used to build both kinds of free prefixes.

T ::= c s T | 1 c ::= i | o | s ::= e | r
If name a has type c r T , we shall refer to a as an r-name, and similarly for e. The subtyping relation is the smallest reflexive and transitive relation ≤ satisfying the rules of Figure 3.3. As in the π-calculus i r is covariant and o r is contravariant. Dually, i e is contravariant and o e is covariant. Note that sorts (e, r) are not affected by subtyping. The typing rules for r-names impose a constraint on the receiving side: all inputs on an r-channel should be bound. Note that a(x).P and (νx)ax.P are not equivalent from the point of view of typing: typing a bound output on an r-channel (a) imposes that the transmitted name (x) is used according to the "dual constraint" w.r.t. what a's type specifies: this is enforced using T ↔ (while names received on a are used according to T ). Symmetrical considerations can be made for e-names, that impose constraints on the emitting side.

s T ≤ i s T s T ≤ o s T T 1 ≤ T 2 i r T 1 ≤ i r T 2 T 1 ≤ T 2 o r T 2 ≤ o r T 1 T 1 ≤ T 2 i e T 2 ≤ i e T 1 T 1 ≤ T 2 o e T 1 ≤ o e T 2
Remark 3.3.2. The rules for r-channels are exactly those of the π-calculus with i/o-types (π io ), and typability of e-free processes coincides with typability in π io . Remark 3.3.3 ("Double contract"). We could adopt a more liberal typing for bound outputs on r names, and use the rule Γ a : o r T Γ, x : T P T ≤ T Γ a(x).P (and its counterpart for inputs on e-names). This would have the effect of typing a(x).P like (νx)ax.P . We instead chose to enforce what we call a "double contract": the same way a receiving process uses the bound name according to the type specified in the channel that is used for reception, the continuation of a bound output uses the emitted name according to T ↔ , the symmetrised version of T . This corresponds to a useful programming idiom in π, where it is common to create a name, transmit one capability on this name and use locally the other, dual capability. This idiom is used e.g. in [START_REF] Vasconcelos | Fundamentals of session types[END_REF] and in [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF]Sect. 5.7.3]. This choice moreover makes the proofs in Section 3.3.3 easier.

Observe that when a typable process reduces according to

a(x).P | a(x).Q → (νx)(P | Q) ,
if a has type, say, r (o s T ), then in the right hand side process, name x is given type s T , and the capability is "split" into i s T (used by P ) and o s T (used by Q)-it would be the other way around if a's sort were e.

We prove subject reduction and define typed barbed congruence in the same way it has be done for the π-calculus. Proof. (1) and ( 2) are straightforward by induction on the typing derivation of P .

We prove (3) by induction, and rely on transitivity of ≤ in the base cases (i.e. the only place where Γ is invoked). In cases for which new types are introduced (rules for ν or bound prefixes), we keep the same types.

(4) follows from (3), instantiating T 1 with Γ(b) and T 2 with T , and then from (2).

Proposition 3.3.5 (Subject reduction). If Γ P and P → Q then Γ Q.

Proof. By induction on the derivation of P → Q. Typing is closed under contexts and structural congruence, since ≡ does not interfere with prefixes. This leaves only the base cases:

• A free prefix synchronises with a bound prefix:

Γ ρb.P | ρ(x).Q → P | Q[b/x] .
Then we have either ρ = a and Γ(a) = e T or ρ = a and Γ(a) = r T . In both cases, Γ, x : T Q and Γ b :

T . By Lemma 3.3.4 (4), Γ Q[b/x]
• Two bound prefixes synchronise:

Γ ρ(x).P 0 | ρ(x).P 1 → (νx)(P 0 | P 1 ) .
Then for each i ∈ {0, 1} we have either Γ, x : T P i or Γ, x : T ↔ P i . Let T be defined as T with the toplevel capability replaced with . Then T ≤ T and T ≤ T ↔ . By narrowing (Lemma 3.3.4), Γ, x : T P 0 , P 1 and Γ (νx)(P 0 | P 1 ).

Definition 3.3.6 (Environment extension, typed context). Let Γ, ∆ be typing environments. We say that Γ extends ∆ if the support of ∆ is included in the support of Γ, and if ∆ x : T entails Γ x : T for all x.

A context C is a (Γ/∆)-context, written Γ/∆ C, if C can be typed in the environment Γ, the hole being well-typed in any context that extends ∆.

Compositionality of typing is an easy consequence of the previous definition and of Lemma 3.3.4:

Lemma 3.3.7. If ∆ P and Γ/∆ C then Γ C[P ].
We now move to the definition of behavioural equivalence. The barb predicate is defined as it is for πI: Definition 3.3.8 (Barbs). Given ρ ∈ {a, a}, where a is a name, we say that P exhibits barb ρ, written P ↓ ρ , if P | ρ(x).w -→ R | w for some R, where w / ∈ fn(P ). As usual the weak barb P ⇓ ρ stands for P ⇒↓ ρ .

We stick to the notion of typed congruence defined by Pierce and Sangiorgi [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF]; note that we could also adapt to the typed setting the notion of reduction-closed barbed congruence of Definition 2.1.4. Definition 3.3.9 (Typed barbed congruence). Barbed bisimilarity is the largest symmetric relation ≈ such that whenever P ≈ Q, P ↓ ρ implies Q ⇓ ρ and P → P implies Q ⇒ ≈ P .

When ∆ P, Q, we say that P and Q are barbed congruent at ∆, written

∆ P ∼ = c Q, if for all (Γ/∆)- context C, C[P ] ≈ C[Q].
Duality Symmetry in π is expressed through a duality operator, similarly to Definition 3.0.1. A result similar to Proposition 3.0.2 can be trivially adapted (Lemma 3.3.11) , but to adapt Proposition 3.0.3 to π, we need more work, as the notion of equivalence in π is typed. Definition 3.3.10 (Dual of a process in π). The dual of a process P , written P , is the process obtained by transforming prefixes as follows:

a b a b a b a b a(x) a(x) a(x) a(x) ,
and applying dualisation homomorphically to the other constructs.

Lemma 3.3.11 (Duality for reduction).

If P → Q then P → Q.
The converse of Lemma 3.3.11 holds, since P = P . Dualising a type means swapping i/o capabilities and e/r sorts. Definition 3.3.12 (Dual of a type). The dual of T , written T , is defined by setting c s T c s T , with:

r = e, e = r i = o o = i = .
We extend the definition to typing environments, and write Γ for the dual of Γ.

Lemma 3.3.13 (Duality for typing).

1. If T 1 ≤ T 2 then T 1 ≤ T 2 . 2. If Γ P then Γ P . 3. If Γ/∆ C then Γ/∆ C.
Proof.

(1): the covariant type operators (i r and o e ) are dual of each other, and so are the contravariant operators (o r and i e ).

(2) follows from the shape of the typing rules, e.g., the dual of the rule for i r is an instance of the rule for i r = o e .

(3) holds because if Φ extends ∆ then Φ extends ∆ (item (1)).

Most importantly, duality holds for typed barbed congruence. The result is easy in the untyped case, since duality preserves reduction and dualises barbs. On the other hand, we are not aware of the existence of another system having this property in presence of i/o-types (as mentioned before, the statement does not make sense for fusion calculi when equipped with i/o-types: there is no such type system for fusion calculi as we show in Section 3.4).

Theorem 3.3.14 (Duality for

∼ = c ). If ∆ P ∼ = c Q then ∆ P ∼ = c Q.
Proof. By Lemma 3.3.13, we only have to prove that if P ≈ Q then P ≈ Q, which follows from the fact that duality preserves reduction (Lemma 3.3.11) and exchanges input barbs with output barbs.

We reach by this theorem the desired duality property for typed behavioural equivalence. We now move on to the relationship between π and π, to extensions of both calculi, and finally to applications of π.

A conservative extension

From π to π io . The π-calculus equipped with i/o-types (that we note π io , as opposed to the untyped version of π) is an asymmetric calculus. In some sense, π can be seen as a 'dualisation' of π io . This can be formulated rigorously by projecting π into π io . To define this projection, which we call a partial dualisation, we work in an extended version of π io , where capabilities are duplicated: in addition to the i, o, capabilities, we also have capabilities i, o and , that intuitively correspond to the image of the "e-part" of π through the encoding. The additional capabilities act exactly like the corresponding usual capabilities (respectively i, o, ), in particular w.r.t. subtyping and duality. We write π io 2 for the resulting calculus. We discuss below (Remark 3.3.21) to what extent the addition of these additional capabilities is necessary. We also rely on π io 2 to prove that π is a conservative extension of the π-calculus in Theorem 3.3.24-π io 2 is actually close, operationally, to both calculi. Definition 3.3.15 (Partial dualisation). We define a translation from typed processes in π to π io 2 . The translation acts on typing derivations: given a derivation δ of Γ P (written δ :: Γ δ P ), we define a π io 2 process noted [P ] δ as follows:

[ρb.P ] δ = ρb.[P ] δ if Γ δ (n(ρ)) = c e T [ρb.P ] δ = ρb.[P ] δ if Γ δ (n(ρ)) = c r T [ρ(x).P ] δ = ρ(x).[P ] δ if Γ δ (n(ρ)) = c e T [ρ(x).P ] δ = ρ(x).[P ] δ if Γ δ (n(ρ)) = c r T [(νa)P ] δ = [P ] δ [0] δ = 0 [!P ] δ = ![P ] δ [P | Q] δ = [P ] δ 1 | [Q] δ 2
In the above definition, δ is the subderivation of δ, in case there is only one, and δ 1 and δ 2 are the obvious subderivations in the case of parallel composition. We extend the definition to types: T * stands for T where all occurrences of c r (resp. c e ) are replaced with c (resp. c, the dual of c). We define accordingly Γ * .

Remark 3.3.16. This definition does not depend on the choice of T in the case for (νa)P since the definition of [•] • does not depend on capabilities (i/o/ ), but only on sorts (r/e). Hence, the same translation could be defined for a simply typed version of π.

Lemma 3.3.17.

If δ :: Γ P (in π), then Γ * [P ] δ (in π io 2 ).
Proof. In moving from Γ to Γ * , we replace i e (resp. o e , i r , o r ) with o (resp. i, i, o). This transformation preserves the subtyping relation. Moreover, the rules to type prefixes i r , o r , i e , o e in π correspond to the rules for i, o, o, i in π io 2 : covariant constructors (i r and o e ) are mapped to covariant constructors (i and i), same for contravariant constructors (o r and i e correspond to o and o).

Lemma 3.3.18. Whenever δ 1 :: Γ P and δ 2 :: Γ P (in π), we have 2. if P → P then [P ] δ P → [P ] δ for some δ :: Γ P .

Γ * [P ] δ1 c [P ] δ2 (in π io 2 ). Proof. The relation R {([P ] δ1 , [P ] δ2 ) | δ 1 , δ 2 :: Γ P } is a strong bisimulation in π and is substitution- closed; hence R is included in c , since [P ] δi is typable in Γ * (by Lemma 3.3.17

if [P ]

δ P → P 1 then P 1 = [P ] δ with P → P for some δ :: Γ P .

4. P ≈ Q iff [P ] δ P ≈ [Q] δ Q .
Proof. For (1) remark that if Γ(a) = c r T then P and [P ] δ P have the same barbs on a; if Γ(a) = c e T , they have dual barbs on a, but in this case so do Q and

[Q] δ Q .
For (2) and (3), we remark that [•] δ is compositional and preserves the fact that two prefixes can interacteven when moving to a different δ.

(4) is a consequence of (1), (2), (3).

Proposition 3.3.20 (Full abstraction). If δ P :: Γ P and δ Q :: Γ Q then

Γ P ∼ = c Q (in π) iff Γ * [P ] δ P ∼ = c [Q] δ Q (in π io 2 ) .
Proof. Soundness: given a derivation γ ::

∆/Γ C, we build [C] γ which is a (∆ * /Γ * )-context. Then [C] γ [[P ] δ P ] = [C[P ]
] β P for some β P and we can rely on barbed congruence in

π io 2 to establish [C[P ]] β P ≈ [C[Q]] β Q . By Lemma 3.3.19, we deduce C[P ] ≈ C[Q].
Completeness: we define the reverse translation {•} _ of [•] _ and reason as above to prove its soundness. Using the fact that δ P :: Γ P implies {[P ] δ P } δ * P = P (where δ * P :: Γ * [P ] δ is the derivation obtained by Lemma 3.3.17) the soundness of {•} _ implies the completeness of [•] _ , and vice versa.

Remark 3.3.21 (π io

2 vs π io ). We can make two remarks about the above result. First, it would seem natural to project directly onto π io , by mapping capabilities i r and o e into i, and o r and i e into o. However, the result of Proposition 3.3.20 would not hold in this case. The intuitive reason is that in doing so, we would allow two names having different sorts in π to be equated in the image of the encoding, thus giving rise to additional observations (since we cannot equate names having different sorts in π). Technically, this question is reminiscent of the problem of closure of bisimilarity under substitutions in the π-calculus.

Second, the key ingredient in the definition of partial dualisation is to preserve the distinction between names having originally different sorts in the π process. It is possible to define an encoding of π io 2 into a dyadic version of π io (without the extra capabilities), in order to do so, but we do not enter into specifics here.

Lemma 3.3.22. Suppose ∆ P, Q holds in π io . Then ∆ P ∼ = c Q (in π io ) iff ∆ P ∼ = c Q (in π io
2 ). Proof. The right-to-left implication is immediate because any π io -context is a π io 2 -context. To show the converse, we observe that a (Γ/∆)-context in π io 2 is a (Γ /∆)-context in π io , where Γ is Γ where every c capability is replaced with c.

From π io to π. π contains π io , the π-calculus with i/o-types: the rules for r-channels are exactly those of π io , and typability of e-free processes coincides with typability in π io . More precisely we can say that π is a conservative extension of π io . In π io we rely on typed barbed congruence as defined in [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF], which is essentially the same as ∼ = c in π. Before presenting the result, the following remark introduces some notation.

Remark 3.3.23. Suppose δ :: Γ P , in π io . Then δ r :: Γ r P in π, where Γ r stands for Γ in which all types are decorated with r and δ r stands for δ where all usages of the typing rule for restriction introduce an r-type. Moreover [P ] δ r = P (using the translation from Definition 3.3.15).

Theorem 3.3.24 (Conservative extension). Suppose

Γ P, Q holds in π io . Then Γ P ∼ = c Q (in π io ) iff Γ r P ∼ = c Q (in π).
Proof. We use π io 2 as an intermediate calculus. By Remark 3.3.23, let δ P , δ Q be derivations of Γ r P and

Γ r Q such that P = [P ] δ P and Q = [Q] δ Q . By Proposition 3.3.20, the right hand side is equivalent to (Γ r ) * [P ] δ P ∼ = c [Q] δ Q (in π io 2 )
. By hypothesis, and since (Γ r ) * = Γ, the latter is equivalent to

Γ P ∼ = c Q (in π io
2 ). Lemma 3.3.22 allows us to finish the proof.

The result above shows that π can be embedded rather naturally into π. This is in contrast with fusion calculi, where the equivalence on π-calculus terms induced by the embedding into fusions does not coincide with barbed congruence or barbed equivalence in the π-calculus (see Section 3.2).

Remark 3.3.25 (π and existing symmetric calculi). π contains the π-calculus, and hence contains (the typed version of) πI, the π-calculus with internal mobility (see [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF]). On the other hand, because free inputs and free outputs are not allowed to interact in π, π fails to represent the fusion calculus. This is consistent with Section 3.4, which says that fusion calculi do not have i/o-types, whereas π does.

Application: relating encodings of the λ-calculus

The core theory of π now established, we use it to make a correspondence between two encodings of the λ-calculus in the π-calculus: one from Van Bakel and Vigliotti [START_REF] Van Bakel | A logical interpretation of the λ-calculus into the π-calculus, preserving spine reduction and types[END_REF], and the original encoding of Milner. Now, the former actually encode strong call-by-name-reductions may also take place inside a λabstraction. We therefore compare van Bakel and Vigliotti's encoding with the strong variant of Milner's encoding, obtained by replacing an input with a delayed input, following the work of Merro [START_REF] Merro | Locality in the pi-calculus and applications to distributed objects[END_REF] (in a delayed input a(x):P , the continuation P may perform transitions not involving the binder x even when the head input at a has not been consumed).

For this, we develop an extension of the core theory of π to incorporate delayed input to prove that the two encodings are the dual of one another. This is achieved by first embedding the π-terms of the λ-encodings into π, and then applying behavioural laws of π. The correctness of these transformations is justified using i/o-types (essentially to express the conditions under which a link can be erased in favour of a substitution). Some of the transformations needed for the λ-encodings, however, are proved only for barbed bisimilarity; see the remarks concluding the section for a discussion.

Extending π Based on π, we develop an extension, called π a , with forms of asynchronous communication and polyadicity. The extension to polyadic communication is standard. Asynchronous communication is added via the inclusion of delayed prefixes: a(x):P (resp. a(x):P ) stands for a (bound) delayed input (resp. output) prefix. The intuition behind delayed prefixes is that they allow the continuation of the prefix to interact, as long as the performed action is not causally dependent on the prefix itself-this is made more precise below. Intuitively asynchrony [HT91, ACS96] is useful when reasoning about encodings of the λcalculus because in a β-reduction (λx.M )N → M [N/x] the "output" part N has no continuation. It is also useful to have asynchrony in input because the considered λ-strategy allows reduction under a λ-abstraction. Moreover asynchrony allows us to derive some transformation laws involving link processes (Section 3.3.3). Note that synchronous bound prefixes are still necessary, to encode the argument of an application.

Delayed prefixes are typed like bound input and output prefixes in Section 3.3.1. Types are refined with two new sorts that enforce asynchrony: d to force inputs to be bound and delayed, a to force outputs to be bound and delayed-we call such outputs asynchronous. For instance, if we have a : r d T for some T , then all inputs at a are bound and delayed. We also include recursive types.

T ::= c t s1 T 1 , . . . , sn T n | 1 | µX.T | X s ::= e | r t ::= d | a
In the polyadic case, e/r sorts are given to each element of the transmitted tuple. We present here only the typing rule for delayed input, in polyadic form, to illustrate how we extend the type system of Section 3.3.1.

Γ a : i t s1 T 1 , . . . sn T n Γ, x 1 : T s1 1 , . . . , x n : T sn n P Γ a(x 1 , . . . , x n ):P
(with, when applying this typing rule, T r = T and T e = T ↔ ). The sort d (resp. a) is forbidden in the rules to type non-delayed input (resp. output) prefixes.

The definition of operational semantics is extended as follows to handle delayed prefixes (below, ρ(y)P stands for either ρ(y).P or ρ(y):P ):

P | ρ(x):Q ≡ ρ(x):(P | Q) if x / ∈ fn(P ) ρ 1 (y):ρ 2 (x):P ≡ ρ 2 (x):ρ 1 (y):P if n(ρ 1 ) = x, x = y, y = n(ρ 2 ) (νy)ρ(x):P ≡ ρ(x):(νy)P if x = y, y = n(ρ) ρ(x):(ρ(y)P | Q) → (νy)(P | Q)[y/x] ρ(x):(ρb.P | Q) → (P | Q)[b/x] P → Q ρ(x):P → ρ(x):Q
Barbs are defined as in Section 3.3.1, with an additional clause saying that if ρ is a barb of P and n(ρ) = x, then ρ is a barb of ρ (x):P for any ρ .

The results of Section 3.3.1 hold for this extended calculus, with similar proofs:

Proposition 3.3.26 (Duality in π a ).
1. Duality of typing: Γ P ⇒ Γ P .

Duality of barbed congruence:

Γ P ∼ = c Q ⇒ Γ P ∼ = c Q.
The counterpart of Theorem 3.3.24 also holds in π a , where types also specify how names have to be used in delayed prefixes. It can be stated w.r.t. π io,a , which is defined as π io with additional typing information to specify which names have to be used asynchronously.

The extensions π a and π io,a are asynchronous versions of π and π io in the sense that interaction is no longer a synchronous handshaking between two processes: for at least one of the processes, the occurrence of the interaction is not observable because the consumed action is not blocking for a continuation. Theorem 3.3.27 (Conservative extension, π a ). Suppose we have

Γ P and Γ Q in π io,a . Then Γ P ∼ = c Q (in π io,a ) iff Γ r P ∼ = c Q (in π a ) .

Reasoning about Links, a transformation from o e

a to i r a We now move to the development of a technical lemma about the validity of a transformation which is used for the analysis of λ-calculus encodings. Differently from partial dualisation (Definition 3.3.15), the transformation, written • er , modifies prefixes, beyond simple dualisation, by introducing link processes. It also acts on types, by mapping e-names onto r-names. Definition 3.3.28. We set ab.P er = a(x).(x b | P er ), where x b = !x(z).bz is called a link process. We also define ρ(x).P er = ρ(x). P er and similarly for delayed prefixes. • er leaves free outputs unchanged and acts homomorphically on the other constructors.

The transformation • er removes all free inputs and inserts free outputs (in the link process). We therefore expect it to return plain π processes. Moreover, the process computed in the translation of free input behaves as expected provided only the input capability is transmitted (the link process at the receiver's side exerts the input capability on x). Accordingly, we define

T oe = µX.o e a X = o e a o e a o e a • • • , and T ir = µX.i r a X = i r a i r a i r a • • • .
We let Γ ir (resp. Γ oe ) range over environments mapping all names to some c r a T ir (resp. c e a T oe ), for c ∈ {i, o, }.

Lemma 3.3.29 (Typing for • er ). If Γ oe P then Γ ir P er for some Γ ir .

Proof. We prove by induction on P that if Γ P then Γ P er . In the case for ν we always introduce the type r a T ir . For bound prefixes we replace c e a T oe with c r a T ir , and for free inputs we type links with T ir types.

As this result shows, • er yields processes that only transmit the input capability. This is reminiscent of the localised π-calculus ([SW01], Chapter 5.6) where only the output capability is passed.

It can be noted that Lemma 3.3.29 holds because we enforce a "double contract" in the typing rules (cf. Remark 3.3.3), which allows us to typecheck bound prefixes as e-names (before the transformation) and as r-names (after).

The relationship between P and P er is given in terms of barbed expansion precongruence, which is a preorder in between strong and weak barbed congruence. Definition 3.3.30 (Barbed expansion precongruence). Barbed expansion is the largest relation ˙ such that whenever P ˙ Q,

• if P -→ P then Q -→=⇒ Q with P ˙ Q ; • if Q -→ Q then P -→ P or P = P with P ˙ Q ; • P ↓ ρ implies Q ⇓ ρ , and Q ↓ ρ implies P ↓ ρ .
We call (resp. typed) barbed expansion precongruence ( c ) the induced (resp. typed) precongruence.

Lemma 3.3.31 (Properties of links).

1. a : i r a T ir , b : o r a T ir a b c (νx)(a x | x b).
2. If Γ oe , a :

T oe P then Γ ir P er [b/a] c (νa)(a b | P er ).
Proof. 1. The law is valid for the ordinary π-calculus (and is substitution-closed); Lemma 3.3.27 transfers the result to π. 2. By typing, a free output involving a in P er is necessarily in a link; in this case, we can use (1). The other kind of interaction is with some a(x):Q in P er , and b(x

):Q[b/a] behaves like (νa)(a b | a(x):Q[b/a]).
We use Lemma 3.3.31 to deduce operational correspondence for the encoding. Lemma 3.3.32 (Operational correspondence). Suppose that Γ oe P .

1. P ↓ ρ iff P er ↓ ρ.

2. If P → P then P er → c P er .

3. If P er → P 1 then P → P and P 1 c P er for some P .

A version of these results in the weak case can also be proved, for barbed expansion. Notably, P and P er exhibit the same weak barbs.

Lemma 3.3.33. If Γ oe P, Q then P ≈ Q iff P er ≈ Q er .
Proof sketch. We show that ˙ {( P er , Q er ) | P ≈ Q} ˙ and {(P, Q) | P er ≈ Q er } are weak barbed bisimulations. We then use the adaptation of Lemma 3.3.32 to the weak case, for barbed expansion.

Lemma 3.3.34. If Γ oe P, Q and Γ ir P er ∼ = c Q er then Γ oe P ∼ = c Q.
Proof sketch. We need to apply the transformation only to names typed with T ir -types, inside contexts that might not be typed in the same way. In order to do so, we define a type system with marks on types, such that only T ir -types are marked and such that the marking propagates onto the names of the typed processes. We modify the encoding • er to only operate on those marked prefixes. For every (∆/Γ oe )-context C, its encoding C er is a (∆ /Γ ir )-context. Thanks to the compositionality of • er , the hypothesis of the lemma implies the equivalence C[P ] er ≈ C[Q] er . We then adapt the proof of Lemma 3.3.33 to this marked encoding.

An analysis of van Bakel and Vigliotti's encoding

Using the technical tools we introduced, we can move on to the study of the lambda encodings. We start from an adaptation of Milner's call-by-name (cbn) encoding of [START_REF] Milner | Functions as processes[END_REF] to strong cbn, which also allows reductions to occur under λ-abstractions. We obtain this by using a delayed prefix in the clause for λ-abstraction. The encoding, noted • M , is defined as follows:

x M p xp λx.M M p p(x, q): M M q M N M p (νq) M M q | (νx)(q x, p | !x(r). N M r )
The other encoding we analyse, taken from [START_REF] Van Bakel | A logical interpretation of the λ-calculus into the π-calculus, preserving spine reduction and types[END_REF], is written • B :

x B p x(p ):p p λx.M B p p(x, q): M B q M N B p (νq) M B q | q(x, p ).(p p | !x(r). N B r )
Note that • B is written in [START_REF] Van Bakel | A logical interpretation of the λ-calculus into the π-calculus, preserving spine reduction and types[END_REF] using asynchronous free output and restriction instead of delayed bound output. We can adopt a more concise notation since (νx)(ax | P ) and a(x):P are strongly bisimilar processes, and similarly for x(p ):p p and x(p ).p p. (Another difference is that the replication in the encoding of the application is guarded, as in [START_REF] Van Bakel | Implicative logic based encoding of the λ-calculus into the π-calculus[END_REF], to force a tighter operational correspondence between reductions in λ and in the encodings.)

As remarked above, • B and • M differ considerably because they engage in quite different dialogues with their environments: in • M a function receives its argument via an input, in • B it interacts via an output. Differences are also visible in the encodings of variables and application (e.g. the use of links).

To compare the encodings • M and • B , we introduce an intermediate encoding, noted • I , which is defined as the dual of • M (in π):

x I p xp λx.M I p p(x, q): M I q M N I p (νq) M I q | (νx)(q x, p | !x(r). N I r )
Note that while • M and • B can be expressed in π, • I uses free input, and does thus not define π-calculus processes.

The three encodings given above are based on a similar usage of names. Two kinds of names are used: we refer to names that represent continuations (p, p , q, r in the encodings) as handles, and to names that stand for λ-calculus parameters (x, y, z) as λ-variables. Here is how these encodings can be typed in π: Lemma 3.3.35 (Typing the encodings). • M , • B and • I yield processes which are typable with the respective typing environments Γ M , Γ B , Γ I , where:

• Γ M types λ-variables with o r a H and handles with H = µX.i r d o r a X, X ; • Γ B uses respectively i r d G and i r a o r d G, G where G = µY.i r a o r d Y, Y ; • Γ I is the dual of Γ M (that is, it uses i e d
H and H = µZ.o e a i e d Z, Z ). Encoding • I can be obtained from • M by duality. The only difference between • I and • B is the presence of two links. We rely on a link transformation similar to • er to move from • I to • B . Thus, by composing the results on duality and on the transformation, we are able to go from

• M to • B . Proposition 3.3.36. Given two λ-terms M and N , we have M M p ≈ N M p if and only if M B p ≈ N B p (both equivalences are stated in π io,a ). Proof sketch. By duality, M M p ≈ N M p iff M I p ≈ N I p .
To establish that this is equivalent to M B p ≈ N B p , we rely on an adaptation of Lemma 3.3.33. For this, we define a transformation that exploits the ideas presented in the link transformation. In particular, handles (p, p , q, r) are treated like in Definition 3.3.28. The handling of λ-variables (x, y, z) is somehow orthogonal, and raises no major difficulty, because such names are always transmitted as bound (fresh) names.

Remark 3.3.37 (Call by name). To forbid reductions under λ-abstractions, we could adopt Milner's original encoding, and use an input prefix instead of delayed input in the translation of abstractions. Symmetrically, adapting Van Bakel and Vigliotti's encoding to this strategy would mean introducing a free input prefixwhich is natural in π, but is impossible in the π-calculus.

One would naturally want to strengthen the full abstraction in Lemma 3.3.33 from barbed bisimilarity to barbed congruence, which would allow us to replace barbed bisimilarity with typed barbed congruence in Proposition 3.3.36 as well (using the type environments of Lemma 3.3.35). While we believe the result to be true, the proof appears difficult because the link transformation modifies both processes and types, so that the types needed for barbed congruence in the two encodings are different. Therefore also the sets of contexts to be taken into account are different. The problem could be tackled by combining the theory on delayed input and the link bisimilarity in [START_REF] Merro | On asynchrony in name-passing calculi[END_REF], and adapting it to a typed setting: currently we only know how to reason this way when the calculus is asynchronous and localised [START_REF] Merro | On asynchrony in name-passing calculi[END_REF], which only corresponds to a small fragment of the typed calculus.

Conclusion: on symmetry in π

The calculus π enjoys properties of duality while being "large", in the sense that it incorporates many of the forms of prefix found in dialects of the π-calculus (free input, bound input, and, in the extension in Section 3.3.3, also delayed input, plus the analogue for outputs), and a non-trivial type system based on i/o-types. This syntactic abundance makes π a possibly interesting model in which to study various forms of dualities, especially as π has a close relationship with the π-calculus with i/o-types (π io ). This is exemplified in our study of encodings of the λ-calculus, where we have applied π and its theory to explain an encoding of cbn λ-calculus by van Bakel and Vigliotti: it can be related, via dualities, to Milner's encoding.

Even if π is a symmetric typed calculus, the symmetry of types is not completely satisfactory, and comes from the construction of π itself, which is a saturation of π by duality. We would like to study more precisely how types can interact with existing symmetric calculi that are not constructed through a process of saturation and that are more minimal.

Types: the limitations of symmetric calculi

Types in πI

Type consistency in πI Some properties are what we call monotone: if they hold for the π-calculus, they hold for all of its subcalculi as well, in particular they hold for πI. Monotone properties typically quantify positively over processes and reductions of π. For example, P π Q implies P πI Q (using the notation of Definition 2.1.4) since it quantifies over fewer contexts in πI than in π, but P π Q does not imply P πI Q since P and Q might be distinguished by π contexts that are not πI contexts.

Typing properties are also good examples of monotone properties: since subject reduction holds in π (Lemma 2.3.2), it also holds in πI as well, for the induced type system. A similar notion of type consistency is inherited, too: in πI as well as in π, if a : iT P then P cannot do an output on a (Corollary 2.3.3).

In the π-calculus, type consistency is not trivial because this a can be sent as data to different parts of the process, where it will instantiate other variables (for example, in ca.Q | c(x).R, x will be replaced with a in R even if there was no relationship between x and a before). Since we cannot know in advance which are those variables, we need some sort of static guarantee that those variables cannot be used as output. Type systems provide this kind of guarantee.

In πI, though, this notion of type consistency is virtually useless as it is presented. Indeed no free name can be emitted and no variable will be instantiated with a, and hence we can statically decide if a name a will be used in input or output, just by looking up the presence of subterms of the form a(x).P or a(x).P , respectively. However, instead of merely looking at the top-level capabilities (e.g. the i in iT ), we can build a different notion of type consistency in depth, more meaningful in πI, although valid in π as well: Proposition 3.4.1. Suppose x 1 : c 1 c 2 • • • c n T P where each c i can be i, o, or . Then, if w is fresh:

• if c n = i then P | x 1 (x 2 ).x 2 (x 3 ). • • • . x n-1 (x n ).x n (y).w ⇓ w ; • if c n = o then P | x 1 (x 2 ).x 2 (x 3 ). • • • . x n-1 (x n ).x n (y).w ⇓ w .
Proof. We treat the first case only, and we prove the property using the π-calculus. It is then enough, since reductions and barbs are preserved by structural congruence and removing restrictions, to prove that

P | Q ⇓ w where Q is the tester process Q x 1 x 2 .x 2 x 3 . • • • . x n-1 x n .
x n (y).w. By narrowing we can suppose c 1 = . We have now

Γ P | Q with Γ = x 1 : U 1 , x 2 : U 2 , . . . , x n : U n , w : o1 P | Q where U j = c j • • • c n T . Suppose now P | Q ⇒ R 2 with R 2 ↓ w .
Since w was guarded in (x n (y).w) in P | Q, there must have been a synchronisation on x n with an output on x n in a process R 1 such that

P | Q ⇒ R 1 ⇒ R 2 .
By subject reduction we know that Γ R 1 and since Γ(x n ) = iT we reach a contradiction. we can build a rule dedicated to the bound output, to get a typing rule for a(b).P as if it were a macro for the π-calculus process (νb)ab.P . The premise for the judgement Γ a(b).P would be that for some type U such that U ≤ T , we have Γ a : oT and Γ, b : U P . This is in fact equivalent, using the contravariance of o, to the following rule, which is seemingly symmetric to the rule for the input prefix:

Γ a : oT Γ, b : T P Γ a(b).P .
The resulting type system for πI processes is strictly equivalent to the one for π when applied on πI processes, and has rules for prefixes which look symmetric, except for an important detail: the covariance of i and the contravariance of o. Those variances are opposite, and since the shape of the rules cannot compensate for that, switching between inputs and outputs will change the direction of the variance each time it shall be used.

As an example, consider the process P a(x).x | a(y).(y | y). Process P can be typed with typing context a : oT (in the left part a(x).x, the type ioT can be assigned to a (since oT ≤ ioT ) and for the right part a(y).(y | y), o T can be assigned to a (since oT ≤ ooT ≤ o T ).). However, P , the dual process of P , can only be typed with a : S (because types that are subtypes of both oiT 1 and i T 2 must be of the form S). a : oT a(x).x | a(y).(y | y) a : T a(x).x | a(y).(y | y) .

Consider now the dual process a(x).x | a(y).(y | y). Both capabilities of the input object y are now used in the continuation of the input, and hence the type of a must be a subtype of i S for some S, which means it must be of type S, which cannot be a dual of oT as duality is supposed to be an involution.

Worse, duality loses type information: in general, if a : oT P , then we know that the dual typing will be of the form a : iS P , but we do not know much more than that: indeed, consider that P n is an iterated version of the previous example: if

P n = a(x 1 ).(x 1 | x 1 (x 2 ).(x 2 | x 2 (x 3 ).(• • • .(x n | x n ) • • • ))
) then a : oT P n holds for any T , but a : iS P n holds only for types of the form S = . . . U . Inverting polarities, we also lose information: knowing a : iT Q gives you information about how a is used in Q, but for every U , a : oU Q so we lose the entirety of the type information in input types, except for the top-level constructor.

Conclusion

We have seen that in πI, the notion of progress is only meaningful for input processes, and then that duality loses the type information of input types. This amounts to say that no useful type information is preserved when switching from a process P to its dual P .

As a final remark, these observations about the little relevance of i/o-types in πI are not surprising, given that most names are restricted and that basic capabilities have asymmetric variances. On top of this, one of the central expressiveness results of πI is the encodability of π which goes through several encodings, using as intermediate calculi both the asynchronous π-calculus [HT91, Bou92] and the asynchronous localised πcalculus (ALπ) [START_REF] Boreale | On the expressiveness of internal mobility in name-passing calculi[END_REF][START_REF] Merro | Locality in the pi-calculus and applications to distributed objects[END_REF]. In fact, ALπ is a calculus where there is no meaningful i/o-typing information (indeed, every non-top-level capability can be replaced with o in ALπ) and hence the encodings lose all type information by going through ALπ.

Types in fusion calculi

Several points can be made in favour of the study of types in fusion calculi. First, Section 3.3 develops a tool to relate processes of π using duality, with π as an intermediate calculus. Two ingredients were fundamental, in addition to the symmetry of π: first, π comes with a natural notion of typed behavioural equivalence; second, π is a conservative extension of π (Theorem 3.3.24). On the contrary, fusion calculi are not eligible candidates to relate π processes: fusion calculi are extensions of π that are not conservative, since the induced equivalences are different, at least in the untyped case (see equation (3.2)). Moreover, there is no notion of typed equivalence in fusion calculi yet, which naturally leads to the more basic question of types in fusions.

Lastly, another reason to analyse types in these calculi is that the fusion calculus originated from the update calculus by the addition of polyadicity. This addition goes usually [START_REF] Milner | The polyadic π-calculus: a tutorial[END_REF] together with the addition of simple types. Even if this addition can be done in a rather natural way in the fusion calculi, it suggests the extension of simple types to i/o-types [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF].

Hence, in this section, we study the addition of types to fusion calculi and more generally to calculi where input is not binding. We highlight a striking difference between the π-calculus and fusion calculi. We present impossibility results for subtyping (and more precisely for general capability-based type systems, implicitly or explicitly involving subtyping) in fusion calculi. In the statement of these results, we assume a few basic properties of type systems for name-passing calculi, such as strengthening, weakening and type soundness, and the validity of the ordinary typing rules for the base operators of parallel composition and restriction.

Calculi with fusions Section 3.2 mentions several fusion calculi. We first identify some properties they all share. For example, when restriction is the only binder (hence the input construct is not binding), we say that the calculus has a single binder. If in addition interaction involves fusion between names, so that we have (=⇒ stands for an arbitrary number of reduction steps, and in the right-hand side P and Q can be omitted if they are 0) (νc) (ab.

P | ac.Q | R) =⇒ (P | Q | R){b/c} , (3.3)
we say that the calculus has name-fusions, or, more briefly, has fusions.

We are not requiring that (3.3) is among the rules of the operational semantics of the calculus, just that (3.3) holds. The shape of (3.3) has been chosen so to capture the existing calculi; the presence of R allows us to capture also the calculus of Solos.

In this sense, all single-binder calculi in the literature (update [START_REF] Parrow | The update calculus[END_REF], chi [START_REF] Fu | The χ-calculus[END_REF], fusion [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF], explicit fusion calculus [START_REF] Gardner | Explicit fusions[END_REF], Solos [START_REF] Laneve | Solos in concert[END_REF]) have fusions. In Chapter 4 we will introduce a single-binder calculus without fusions.

Γ P Γ Q Γ P | Q Γ, a : T P Γ (νa) P . (3.4)
In resource-sensitive type systems, i.e., those for linearity [START_REF] Kobayashi | Linearity and the pi-calculus[END_REF][START_REF] Hüttel | Types for resources in Ψ-calculi[END_REF] and receptiveness ([SW01], Section 8.2), where one counts certain occurrences of names, the rule for parallel composition has to be modified. As mentioned earlier, we stick to basic type systems, ignoring resource consumption. We also abstract from previous type systems the basic type construct T , for the type of names carrying values of type T : we assume that the following rule for prefixes ab.P and ab.P is admissible:

T-PREF Γ(a) = T Γ(b) = T Γ P Γ α.P α ∈ {ab, ab} (3.5)
(Here we consider input and output prefixes with a continuation; in calculi in which prefixes may not have a continuation, e.g., the asynchronous π-calculus or Solos, P would be missing from the rules.) Again, these need not be the typing rules for prefixes; we are just assuming that the rules are valid in the type system. We can observe that the standard rule for prefix would have, as hypotheses,

Γ a : T Γ b : T .
These imply, but are not equivalent to, the hypotheses in (3.5), for instance in presence of subtyping.

As mentioned above, fundamental properties of type systems are:

• Subject Reduction (or Type Soundness): if Γ P and P → P , then Γ P ;

• Weakening: if Γ P and a is fresh, then Γ, a : T P ;

• Strengthening: whenever Γ, a : T P and a is fresh for P , then Γ P ;

• Closure under injective substitutions: if Γ, a : T P and b is fresh, then Γ, b : T P {b/a}. Definition 3.4.2. A typed calculus with single binder is plain if it satisfies Subject Reduction, Weakening, Strengthening, Closure under injective substitutions, and the typing rules (3.4) and (3.5) are admissible.

If the type system admits subtyping, then another fundamental property is narrowing, which authorises, in a typing environment, the specialisation of types:

• Narrowing: if Γ, a : T P and U ≤ T then also Γ, a : U P .

When narrowing holds, we say that the calculus supports narrowing.

A typed calculus has trivial subtyping if, whenever T ≤ U , we have Γ, a : T P iff Γ, a : U P . When this is not the case (i.e., there are T, U with T ≤ U , and T, U are not interchangeable in all typing judgements) we say that the calculus has meaningful subtyping.

We are now ready to prove that, under the assumptions of Definition 3.4.2, a calculus with fusions may only have trivial subtyping.

Theorem 3.4.3. A typed calculus with fusions that is plain and supports narrowing has trivial subtyping.

Proof. We define the following context:

E (νcb)(ub | uc | va | vc | [•]) .
Note that in E we only use b as an output object (in ub). The intention is that, given some fresh names, u, v, c, and some process P , E[P ] should reduce to P {a/b}. Indeed, by applying hypothesis (3.3) twice, we have

E[P ] = (νbc)(ub | uc | va | vc | P ) =⇒ (νb)(va | vb | P {b/c}) = (νb)(va | vb | P ) =⇒ P {a/b} .
Suppose U ≤ T , we show Γ, a : T P iff Γ, a : U P , which means that the type system has trivial subtyping. The implication from left to right is narrowing.

To prove the implication from right to left, suppose Γ, a : U P , and prove Γ, a : T P . We can pick some name b fresh for P , and deduce, by Closure under injective name substitution, Γ, b : U P {b/a}.

In the typing environment Γ, b:U, u: T, v: T, c:T, a:T the process ub is well-typed thanks to Narrowing and Weakening, hence so is (ub | uc | va | vc | P {b/a}). By the restriction rule we get Γ, a:T, u: T, v: T E[P {b/a}], the latter reducing to P {b/a}{a/b} by (3.6). Since b has been taken fresh, P {b/a}{a/b} = P . Hence, by Subject Reduction, Γ, a:T, u: T, v: T P . We finally deduce Γ, a : T P by Strengthening.

One may wonder whether, in Theorem 3.4.3, more limited forms of narrowing, or a narrowing in the opposite direction, would permit some meaningful subtyping. Narrowing is interesting when it is used to modify the type of the values exchanged along a name, that is, the type of the object of a prefix. (In process calculi, communication is the analogous of application for functional languages, and changing the type of a prefix object is similar to changing the type of a function or of its argument.) In other words, disallowing narrowing on objects would make subtyping useless. We now show that allowing any form of narrowing, on one prefix object, would force subtyping to be trivial. Theorem 3.4.4. We consider a typed calculus with fusions which is plain. We suppose that there is at least one prefix α with object b, where b is different from the subject of α. We further suppose that there are two types S and T such that S ≤ T and one of the following forms of narrowing holds for all Γ:

(1) whenever Γ, b : T α.0, we also have Γ, b : S α.0;

(2) whenever Γ, b : S α.0, we also have Γ, b : T α.0.

Then S and T are interchangeable in all typing judgements. As a consequence, authorising one of the above forms of narrowing for all S and T such that S ≤ T implies that the calculus has trivial subtyping.

Proof. For all ∆ we prove that ∆, x : T P iff ∆, x : S P . Let x 1 , x 2 , a 1 and a 2 be fresh names, we define

∆ i ∆, x i : T, x 3-i : S .
We prove that ∆ i P {x 1 /x} implies ∆ i P {x 2 /x} for all i ∈ {1, 2}. This is enough to conclude, using Weakening, Strengthening and Closure under injective substitutions. We rely on process D a 1 x 1 | a 2 x 2 | a 1 y | a 2 y to simulate the substitution of x 1 with x 2 :

(νx 1 , y)(D | P {x 1 /x}) =⇒ P {x 2 /x} . (3.6)
This way, it is enough to find some types T a1 T a2 , T y such that ∆ D, with ∆ = ∆ i , a 1 : T a1 , a 2 : T a2 , y : T y . We suppose that the subject of α is either a 1 or a 2 , picking the most suitable choice, without loss of generality.

We suppose as well that the object b is the most suitable among x 1 , x 2 or y.

To illustrate how we choose such types, we provide an example. Suppose: that i = 1 (i.e., the type of x 1 is T and the type of x 2 is S), that narrowing of type (1) holds, and that α is an output. Then we take α to be a 2 x 2 and we choose T a1 = T a2 = T and T y = T . We then have ∆ D quite easily: the interesting part is to obtain a 2 : T, x 2 : S a 2 x 2 from the composition of the trivial a 2 : T, x 2 : T a 2 x 2 and from narrowing of type (1). Then, by Subject Reduction, with (3.6) and Strengthening, we get that ∆ 1 P {x 2 /x}. This particular case corresponds to the first line of the following table.

The other choices for T a1 T a2 , and T y are listed in the table, following three parameters: is i equal to 1 or to 2? Which form of narrowing, between (1) and (2), holds? Is α an output or an input?

i form α T a1 T a2 T y 1 (1) a 2 x 2 T T T 1 (1) a 1 y T S S 1 (2) a 1 x 1 S S S 1 (2) a 2 y T S T 2 (1) a 2 x 2 T T T 2 (1) a 2 y S T S 2 (2) a 1 x 1 S S S 2 (2) a 1 y S T T
Using the hypothesis on α, we can prove in all these cases that ∆ D, relying on the fact that the type system is plain. The latter hypothesis also gives us ∆ P {x 1 /x}. We use rules from (3.4) and Subject Reduction to deduce that ∆ P {x 2 /x}. From this, Strengthening is enough to conclude. Remark 3.4.5. Theorems 3.4.3 and 3.4.4 apply to all fusion calculi: implicit fusions, explicit fusions, update calculus, chi-calculus, solos.

In calculi of mobile processes, the basis for having subtyping is a type system for capabilities, usually the input/output (I/O) capabilities [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF][START_REF] Hennessy | Resource access control in systems of mobile agents[END_REF]. Another consequence of Theorems 3.4.3 and 3.4.4 is that it is impossible, in plain calculi with fusions, to have an I/O type system; more generally, it is impossible to have any capability-based type system that supports meaningful subtyping.

Actually, to apply the theorems, it is not even necessary for the capability type system to have an explicit notion of subtyping. For Theorem 3.4.3, it is sufficient to have sets of capabilities with a non-trivial ordering under inclusion, meaning that we can find two capability types T and U such that whenever Γ, a : U P holds then also Γ, a : T P holds, but not the converse (e.g., T provides more capabilities than U ). We could then impose a subtype relation ≤ on types, as the least preorder satisfying T ≤ U . Theorem 3.4.3 then tells us that type soundness and the other properties of Definition 3.4.2 would require also U ≤ T to hold, i.e., T and U are interchangeable in all typing judgements. In other words, the difference between the capabilities in T and U has no consequence on typing. Similarly, to apply Theorem 3.4.4 it is sufficient to find two capability types T and U and a single prefix in whose typing the type U can replace T .

Conclusion

The fact that subtyping and the explicit fusion calculus are incompatible is not very surprising, as analysing the possible typing rules for the explicit fusion construct suggests the symmetry constraint on the subtyping relation. It is a little less obvious for the fusion calculus, for which substitutions are more localised, and even less for the update calculus, where the substitutions are directed and lack symmetry with respect to (explicit) fusions. This impossibility result extends further than just type systems with subtyping, as even capability control involves an implicit notion of subtyping. However, this result does not apply to other kinds of type system, especially those that do not admit a rule of the shape T-PAR (Figure 2.2), for example session types (that can, in fact, be adapted to some fusion calculi [START_REF] Guenot | Session types, solos, and the computational contents of sequent calculus proofs[END_REF]) or linear types (we can also recover a linear type system for fusion calculi, although that makes the latter very close to the π-calculus (Section 4.8)).

43

Chapter 4

Preorders on names

Section 3.4 showed that the symmetry of the relation on names induced by fusions, augmented as explicit fusions appear along the execution of a process, is incompatible with the asymmetry of subtyping. This chapter a study of what happens when we drop the symmetry hypothesis of the induced relation on names, which becomes a preorder relation rather than an equivalence relation. This different relation yields a new calculus, which we write πP, for "π with preorders".

In Section 4.1 we describe the calculus πP, and in Section 4.2 we show that it recovers the types of the π-calculus. This can be done using a step-by-step semantics (the eager reduction), and then through a somehow more sensible but less compositional semantics, that we see in Section 4.3. Section 4.4 shows that πP features a notion of privacy of names, the same as in the π-calculus, that fusion calculi do not. Section 4.5 develops in turn a compositional semantics, and Section 4.6 gives an axiomatisation of πP. Section 4.7 gives an account of the expressiveness of the calculi, with respect to π-calculi and fusion calculi. Section 4.8 presents a syntactical restriction that makes all calculi (π, fusions, and πP) equal. Section 4.9 discusses less precise questions about πP.

A π-calculus with preorders, πP

We refine the fusion calculi by replacing the equivalence relation on names generated through communication by a preorder, yielding calculus πP ('π with Preorder'). As the preorder on types given by subtyping enables promotions between related types, so the preorder on names of πP enables promotions between related names. Precisely, if a is below a name b in the preorder, then a prefix at a may be promoted to a prefix at b and then interact with another prefix at b. Thus an input av.P may interact with an output bw.Q; and, if also c is below b, then av.P may as well interact with an output cz.R.

The ordering on names is introduced by means of the arc construct, a/b, that declares the source b to be below the target a. The remaining operators are the same as for fusion calculi (i.e., those of the π-calculus with bound input replaced by free input). Restriction is the only binder. Note that the calculus will be extended in Sections 4.5 and 4.6 to study its axiomatisation. The semantics of the calculus is given by a reduction relation, which is based on structural congruence (the same as Definition 2.1.1), and is defined as follows (the subscript in -→ ea , for "eager", will distinguish this from the alternative semantics discussed in Section 4.3): Definition 4.1.1 (Eager reduction). Eager reduction in πP, written -→ ea , is defined by the following rules:

a/b | bc.Q -→ ea a/b | ac.Q ab.P | ac.Q -→ ea P | Q | b/c a/b | bc.Q -→ ea a/b | ac.Q P -→ ea P P | R -→ ea P | R P -→ ea P (νa)P -→ ea (νa)P P ≡-→ ea ≡ P P -→ ea P
We write =⇒ ea for the reflexive transitive closure of -→ ea .

The first rule shows that communication generates an arc. The next two rules show that arcs only act on the subject of prefixes; moreover, they only act on unguarded prefixes (i.e., prefixes that are not underneath another prefix). The rules also show that arcs are persistent processes. Acting only on prefix subjects, arcs can be thought of as particles that "redirect prefixes": an arc a/b redirects a prefix at b towards a higher name a.

Arcs remind us of special π-calculus processes, called forwarders or wires [START_REF] Honda | On reduction-based process semantics[END_REF], which under certain hypotheses (the calculus should be asynchronous and localised) allow one to model substitutions; as for arcs, so the effect of forwarders is to replace the subject of prefixes. Note also that arcs are different from explicit substitutions: only the latter are binding, and there can be several arcs acting on the same name.

We present below some examples of reduction. We sometimes omit the object part of prefixes, when it is not important, e.g. e.P can stand for (νx)ex.P when x / ∈ fn(P ).

ac.ca.e.P | ad.de.a.Q -→ ea ca.e.P | de.a.Q | c/d -→ ea ca.e.P | ce.a.Q | c/d -→ ea e.P | a.Q | c/d | a/e -→ ea a.P | a.Q | c/d | a/e -→ ea P | Q | c/d | a/e
Reductions can produce multiple arcs that act on the same name. This may be used to represent certain forms of choice, as in the following processes:

(νh, k) (bu.cu.u | bh.h.P | ck.k.Q) =⇒ ea (νh, k) (u | h/u | k/u | h.P | k.Q) .
Arcs h/u and k/u may act on u, and are therefore in competition with each other. The outcome of the competition determines which process between P and Q is activated. For instance, reduction may continue as follows:

-→ ea (νh, k) (k | h/u | k/u | h.P | k.Q) -→ ea (νh, k) (h/u | k/u | h.P | Q) .
The semantics above formalises an eager behaviour for arcs: arcs act on prefixes, substituting their subjects, regardless of the possible consequences on future interactions. For instance, in the example above, the arc k/u could have acted on u even in the absence of the matching prefix k.Q. Under the eager semantics the substitution produced by an arc is a commitment-replacing a with b in a prefix commits that prefix to go along a channel that is at least as high as b in the preorder. In Section 4.3, we formalise a by-need behaviour of arcs, in which substitutions are performed only when reduction takes place. In by-need semantics, there is no separate action of commitment. An occurrence in a restriction (νa) is neither negative nor positive, intuitively because restriction acts only as a binder, and does not stand for an usage of the name (in particular, it does not take part in a substitution).

Negative occurrences are particularly important, as by properly tuning them, different usages of names may be obtained. For instance, a name with zero negative occurrences is a constant (i.e., it is a channel, and may not be substituted); and a name that has a single negative occurrence is like a π-calculus name bound by an input (we investigate this situation in Section 4.7.2). Names having two or more negative occurrences are specific to πP.

The number of negative occurrences of a name is invariant under reduction. Note also that the set of positive occurrences is non-increasing.

Lemma 4.1.3. If P -→ ea P then for each b, the number of negative occurrences of b in P and P is the same.

Types

We now show how the i/o capability type system from π and its subtyping relation (Section 2.3) can be transplanted to πP. Types in πP are the same as for π:

T ::= iT oT T 1
Subtyping rules (Figure 4.1) are unchanged as well, they are the same as in the π-calculus (Figure 2.3).

SUB-REFL

T ≤ T SUB-TRANS In πP, narrowing depends on the negative or positive occurrences of a name. Theorem 4.2.1 (Polarised narrowing). Let T 1 and T 2 be two types such that T 1 ≤ T 2 .

T 1 ≤ T 2 T 2 ≤ T 3 T 1 ≤ T 3 SUB-i T ≤ iT SUB-o T ≤ oT SUB-ii T 1 ≤ T 2 iT 1 ≤ iT 2 SUB-oo T 1 ≤ T 2 oT 2 ≤ oT 1
1. If a occurs only positively in P , then Γ, a : T 2 P implies Γ, a : T 1 P .

2. If a occurs only negatively in P , then Γ, a : T 1 P implies Γ, a : T 2 P .

3. If a occurs both positively and negatively in P , then it is in general unsound to replace, in a typing Γ P , the type of a in Γ with a subtype or a supertype.

Proof.

1. All premises involving a are of the form Γ(a) ≤ T for some T . Applying the transitivity rule for the subtyping relation suffices to conclude. is impossible, even if 1 ≤ i 1 and i 1 ≤ ii1.

Theorem 4.2.1 (specialised to prefixes) does not contradict Theorem 3.4.4, because in πP, reduction does not satisfy relation (3.3) (presented in Section 3.4). Theorem 4.2.1 may be seen as a refinement of the standard narrowing result (Lemma 2.3.1) for namepassing calculi. In the π-calculus, for instance, a free name only has positive occurrences. Hence the usual statement of narrowing corresponds to Theorem 4.2.1(1). In an input a(b).P , the binder for b represents a negative occurrence, so that if b is free in P then b has both positive and negative occurrences, which means that the type of b may not be modified, as by Theorem 4.2.1(3). In contrast, Theorem 4.2.1(2) is vacuous in π, as a name b with only negative occurrences can only be found in an input a(b).P where b is not free in P .

In general, in a name-passing calculus, if a name has only positive occurrences, then its type (be it declared in the typing environment, or in the binding occurrence of that name within the process) may be replaced with a subtype, and conversely for names with only negative occurrences. The type of names with both positive and negative occurrences may not be changed.

The type system for πP enjoys subject reduction: Theorem 4.2.2 (Subject Reduction). If Γ P and P -→ ea P then also Γ P .

The proof of Theorem 4.2.2 is straightforward, given Theorem 4.2.1 (1) combined with the variance properties of i and o. The theorem also holds for the by-need version of reduction (Section 4.3).

Remark 4.2.3. The subject reduction theorem for πP remains valid if an arc a/b is allowed to act not only on the subject of prefixes, but, more generally, on all positive occurrences of b (for instance occurrences of b as the object of an output prefix). Also, subject reduction does not require that the substitutions generated by an arc are performed sequentially: several substitutions could be performed simultaneously, like in implicit fusions.

The subject reduction theorem would however break if arcs acted also on negative occurrences of b, as the arc would then behave as a fusion (otherwise Theorem 3.4.3 would lead to a contradiction with the fact that the subtyping relation in πP is not trivial).

By-need semantics

The operational semantics given to πP in Section 4.1 allows arcs to act locally, at any time. The effect of an arc is irreversible: the application of an arc a/b to a prefix at b commits that prefix to interact along a name that is greater than, or equal to, a in the preorder among names. A commitment may disable certain interactions, even block a prefix for ever. Consider for instance the process

(νa, c) (bv.P | cw.Q | a/b | c/b) . (4.1)
There is a competition between the two arcs; if the first wins, the process is deadlocked:

-→ ea (νa, c) (av.P | cw.Q | a/b | c/b)
since a and c are unrelated in the preorder.

We consider here an alternative semantics, in which the action of arcs is not a commitment: arcs come about only when interaction occurs. For this reason we call the new semantics by-need (arcs act only when 'needed'), whereas we call eager the semantics of Section 4.1 (arcs act regardless of matching prefixes). In this semantics, as in the π-calculus, an interaction involves both a synchronisation and a substitution; however unlike in the π-calculus where the substitution is propagated to the whole term, here substitution only replaces the subject of the interacting prefixes.

Relations on names: preorder, joinability

The formalisation of the new semantics makes use of a preorder on names induced by arcs. An arc is active if it is unguarded, i.e., it is not underneath a prefix. The preorder induced by P is the least preorder ≺ that includes b ≺ a for each active arc a/b in P , and similarly for the preorder induced by a context C.

We write P a b (this judgement is defined formally below) if {a, b} has an upper bound in the preorder induced by P , that is, there is a name that is above both a and b; in this case we also say that a and b are joinable. For instance, we have νu

(u/a | u/b | Q) a b. a/b b ≺ a -COMBINE P Γ Γ ϕ P ϕ -PAR-L P ϕ P | Q ϕ -PAR-R Q ϕ P | Q ϕ -RES P ϕ a / ∈ n(ϕ) (νa)P ϕ .
By construction, the judgement P a ≺ b induces a relation {(a, b) | P a ≺ b}, which is sometimes written ≺ P , that is trivially a preorder on names. Relation {(a, b) | P a b} however is symmetric and reflexive, but generally not transitive.

Example 4.3.2 (Mediators). A process M f g = (νc)(c/f | c/g) acts like a mediator: it joins names f and g (we have M f g f g). Mediators remind us of equators in the π-calculus [START_REF] Honda | On reduction-based process semantics[END_REF], or of fusions in the explicit fusion calculus, but lack the transitivity property (e.g., M f g | M gh f h does not hold). Relation =⇒ bn is the reflexive transitive closure of -→ bn .

By-need reduction

While the eager semantics has simpler rules, the by-need semantics avoids 'too early commitments' on prefixes. For instance, the only immediate reduction of the process in (4.1) is

-→ bn (νa, c) (P | w/v | Q | a/b | c/b)
where prefixes bv.P and cw.Q interact because their subjects are joinable in the preorder generated by the two arcs. Lemma 4.3.4 (Eager and by-need). P -→ bn P (by-need semantics) implies P =⇒ ea P (eager semantics).

Proof. Suppose the transition involves processes ac.P and bd.Q, thanks to a derivation of R a b. The latter means that some name u is an upper bound of {a, b}, via some active arcs in R. Then, according to the eager semantics, we are able to rewrite the prefixed processes into uc.P and ud.Q.

Note that because of the commitments performed by -→ ea , there is no correspondence in the other direction. We can still derive from Lemma 4.3.4 and Theorem 4.2.2 the soundness of typing with respect to by-need reduction: Corollary 4.3.5 (Subject Reduction, by-need semantics). Theorem 4.2.2 holds for the by-need semantics: if Γ P and P -→ bn P then also Γ P .

We now move to a comparison of the two semantics.

Barbed congruence

We contrast barbed congruence in πP under the two semantics we have given, eager and by-need. In order to define both versions of barbed congruence, we need to define barbs. This requires some care, as in πP the interaction of a process with its environment may be mediated by arcs. We follow Definition 2.1.3: Definition 4.3.6. Given process P and name a, we write P ↓ ea a (resp. P ↓ bn a ) if P | (νx)ax.w -→ ea P | w (resp. P | (νx)ax.w -→ bn P | w) for some P and x = w / ∈ fn(P ), and symmetrically for P ↓ ea a and P ↓ bn a . Hence P ↓ a if the offer by the environment of an action at a may be accepted by P . Remark that P ↓ bn a holds if P ≡ (νc)(ad.Q | R) for some process R, some names ẽ with a / ∈ ẽ, and some prefix bd.Q, where b satisfies R a b. With the same notations, P ↓ ea a if b = a. Weak barbs are then defined in the standard way as in Section 2.1.4, as well as barbed congruence: Definition 4.3.7. We write ea and ea (resp. bn and bn ) for the strong and weak versions of eager (resp. by-need) barbed congruence, following Definitions 2.1.4 and 2.1.7.

We provide below a basic proof technique for barbed congruence, so that we need only to quantify on evaluation contexts instead of any context. An evaluation context is a context in which the hole is not guarded by a prefix-in other words, evaluation contexts are the contexts that let reductions go through. Proposition 4.3.8 (Context lemma). Suppose that R is closed under evaluation contexts and symmetric. Then:

• if R is closed under -→ bn and preserves by-need barbs, then R ⊆ bn ,

• if R is closed under -→ ea and preserves eager barbs, then R ⊆ ea ,

• if R is closed under =⇒ bn and preserves weak by-need barbs, then R ⊆ bn ,

• if R is closed under =⇒ ea and preserves weak eager barbs, then R ⊆ ea .

Proof. The proof is independent on the choice of reduction we have, given only a key property on πP contexts: a context C either is an evaluation context, or the following two statements hold for all P :

1. if C[P ] -→ bn P 1 then for some C , P 1 ≡ C [P ] and for all Q, C[Q] -→ bn C [Q], 2. if C[P ]↓ bn a then C[Q]↓ bn a for all processes Q.
(We used the strong by-need case as an example.) The proof also relies on the fact that contexts can be composed.

Let

C(R) be the context closure of R, i.e. C(R) {(C[P ], C[Q]) | P R Q}. Since C(R)
is closed under contexts (since contexts can be composed) and is symmetric by construction, we only need to prove it is barbed-preserving and reduction closed: We just proved that C(R) is a reduction-closed barbed congruence up to ≡, which implies that ≡R ≡ is a reduction-closed (because ≡ is trivially reduction closed) barbed (≡ preserves barbs) congruence (≡ is a congruence). Hence R ⊆ C(R) ⊆ ≡R ≡ ⊆ bn . Note that this is an example of up-to technique, which will be explain in more details in Section 5.1.

• suppose C[P ] R C[Q] and C[P ]↓ bn a ,
Proposition 4.3.9. Proposition 4.3.8 also holds when R is only closed under parallel contexts instead of evaluation contexts.

Proof. Suppose R is closed under parallel composition, reduction-closed, and preserves barbs. We prove Similarly, in the eager semantics, it is possible to put a | a in a context where two arcs rewrite each a prefix differently, while one can only rewrite the topmost prefix in a.a. This scenario cannot be played in the by-need semantics.

R = {((ν ẽ)P, (ν ẽ)Q) | P R Q}
On the other hand, the following law is valid for strong (and weak) eager equivalence, but fails to hold in the by-need case:

(νabu)(a/u | b/u | u | a.w) = (νv)(v | v.τ.w | v.0) .
(τ.w stands for νc(c | c.w) with c = w). The intuition is that concurrent arcs are used on the left-hand side to implement internal choice. As a consequence of the law (νa)a/c = 0, in the by-need case, process b/u can be disregarded on the left, so that the process on the left necessarily does the output on w.

Example 4.3.10 shows that the two semantics are incomparable. Lemma 4.3.4 suggests that the eager reduction is a decomposition of the by-need reduction. We can moreover remark that the addition of dynamic operators like guarded choice is rather natural under the by-need semantics. It is delicate in the eager semantics; for instance it is unclear whether, in a process like c/a | (a.P + b.Q), the arc should be allowed to trigger the choice.

We have introduced πP with the eager semantics for reasons of simplicity, but we find the by-need semantics more compelling. In the following, unless otherwise stated, we work under by-need, though we also indicate what we know under eager.

Behavioural laws

We now present some relevant examples of equalities and inequalities in the two semantics. The laws for the by-need semantics hold for strong barbed congruence, but some corresponding laws (e.g. Lemma 4.3.14) only hold in the weak case of the eager semantics-indeed, sometimes by-need reductions are implemented using several eager reductions, in light of Lemma 4.3.4.

In the case of the by-need semantics ( bn ), the laws are established in Lemma 4.6.1 through a notion of bisimulation that characterises bn (Theorem 4.5.38).

In the case of the eager semantics ( ea or ea ) we provide the proofs of the laws in this section, since we do not have such a characterisation1 for ea . Note that proofs in the eager case differ significantly from the proofs in the by-need case.

We start by establishing laws showing the input-output asymmetry of πP and the difference between πP and fusion calculi, which have this symmetry property. We now move to some behavioural properties of arcs in πP. The first law describes how to compose two arcs into one, the second states the idempotence of parallel composition on arcs.

LHS S (ν ẽ) νb a/b | b/c | cd.Q∈S bd.Q | cd.Q∈S bd.Q | R RHS S (ν ẽ) a/c | cd.Q∈S ad.Q | cd.Q∈S ad.Q | R
then by construction, the relation {(LHS S , RHS S ) | S} is reduction-closed in the two directions:

• left to right, each rewriting from b/c can be caught up with a rewriting from a/c, adding a process to the set S. Each rewriting from a/b removes a process from S, the corresponding process going into R.

• Right to left, each rewriting from a/c can be caught up with two rewritings from b/c and then from a/b. The barbs are visibly the same on both sides, except some barbs on a in RHS S that are only weak barbs from LHS S .

As a consequence, any input and output of πP can be transformed into a bound prefix, by introducing a new restricted name: Proof, eager case. We prove the first law for ea . By Proposition 4.3.9 we prove R {(R | ab.P, R | (νx)ax.(x/b | P ))} ∪ ea is weakly reduction-closed and preserves weak barbs. Reductions or barbs from R alone are trivially handled, what is interesting is when we get to an interaction between an output in R and the input on a, in which case R = E[ac.Q] and the resulting pair would be, up to ≡, the following processes:

E[Q | c/b | P ] ea E[Q | (νx)(c/x | x/b) | P ] .
These are related through ea , by Lemma 4.3.12. The proof for the output is similar.

If these laws are applied to all inputs and outputs of a process P , then the result is a behaviourally equivalent process P , in which all names exchanged in an interaction are fresh. Thus P reminds us of the πI variant of π (Section 3.1).

The following laws involve arcs in relation with negative or positive occurrences of names. These are reminiscent of standard results about substitutions, forwarders and equators in the asynchronous π-calculus (see, e.g., [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF]). Note that the first law generalises the composition of arcs in Lemma 4.3.12. In addition, 1 and 3 hold for ea , but 2 does not.

Proof, eager case. Item 2 does not hold for ea because a/b may transform positive occurrences of b into positive occurrences of a, violating the condition about a. And indeed, with P = 0 we already know that (νa)a/b ea 0 (as in the proof of Lemma 4.3.11).

We now prove items 1 and 3. We write σ for the substitution that replaces a with b. We prove that the induced relations -→. We remark the following correspondences:

1. if P -→ ea P then P σ -→ ea P σ ;

2. if P a=b -→ P then P σ = P σ ;

3. if P σ -→ ea P 1 then P 1 = P σ for some P such that one of the following holds: 1 and 2 are trivial. To prove 3, remark that when P σ -→ ea P σ , we are in one of the following cases:

• (cd.Q | ef.R) σ -→ ea (c/f | Q | R) σ if σ(c) = σ(e) (then, if c = e, one step of b/a
-→ can catch up); With those correspondences, it is easy to show that R 1 and R 2 are reduction-closed, as well as R -1 1 and R -1 2 : a reduction from the left-hand side is caught up with zero or one reduction on the right-hand side (thanks to 1 and 2), and a reduction from the right-hand side is caught up with one or two reductions from the left-hand side (thanks to 3).

• (c/d | ef.R) σ -→ ea (c/d | cf.R) σ if σ(d) = σ(e).
Preservation of barbs follows the argument from closure under reductions.

Private names

Lemma 4.3.11 gives an example of a law that holds in πP and not in fusion calculi. Unfortunately this law contains free input prefixes, which makes us question its significance as there is no counterpart outside single-binder calculi. We study in this section an equation that can be formulated in all name-passing calculi considered so far, as long as they feature a guarded choice operator.

We recall the interleaving law ((3.2) from Section 3.2):

a(x).b(y).(x | y) = a(x).b(y).(x.y + y.x) . (4.2)
Prefix a(x) is the emission of a fresh name x on a, i.e. it is short for (νx)ax. Prefix x (resp. y) stands for an output (resp. input) where the value being transmitted is irrelevant. Equation (4.2) holds for strong barbed congruence both in πP and in π, but does not hold in fusion calculi. Indeed in fusions, unlike in the π-calculus, the process that creates successively two fresh names x and y cannot prevent the context from equating ("fusing") x and y. Hence, in order for the equivalence to hold in fusion calculi, it is necessary to add a third summand on the right, [x=y]τ , that is triggered only when the environment entails that x and y are related in the equivalence relation:

a(x).b(y).(x | y) ef a(x).b(y).(x.y + y.x + [x=y]τ ) .

(The meaning of the prefix [x=y]τ.P is made precise in Section 4.6.3.) This example suggests that πP provides a better control on restricted names than existing fusion calculi, in which it is hard to statically prevent the aliasing of two names.

Related works, privacy and symmetry

Control on privacy This issue of name privacy also partially motivated the study of two variants of the implicit fusion calculus, that feature refined notions of restriction. The distinctive fusion calculus (D) introduced by Buscemi et al. [START_REF] Boreale | D-fusion: A distinctive fusion calculus[END_REF] defines two binding operators: one corresponds to restriction in fusion calculi (authorising aliasing with other names), and the other corresponds to restriction in π (forbidding all aliasings). The U-Calculus (U), by the same authors [START_REF] Boreale | A general name binding mechanism[END_REF] defines a more refined restriction operator, with a parameter specifying the set of names with which aliasing is forbidden. Note that it is not clear how these calculi could be transported to the explicit variant of the fusion calculus.

We hope that πP provides some control on restricted names more naturally, since we did not resort to refining the restriction operator for this purpose alone.

Minimality

The other difference with respect to the implicit fusion calculus is that prefixes are not polarised in Buscemi et al's calculi: they feature neither outputs nor inputs, but only one form of polyadic prefix. They recover polarities by encoding inputs and outputs using different binders on dummy variables, in such a way that any synchronisation between two inputs or two outputs would imply the fusing of two restricted names.

This calls for another informal observation about minimality and symmetry, as an addendum to Section 1.3. By definition, symmetry suggests redundancy: if the input and output constructs play the same role, couldn't we remove one of them? This indeed is the case for the previous two calculi. Another example is the Concurrent Pattern Calculus [START_REF] Given-Wilson | Concurrent pattern calculus[END_REF] (CPC) where polarities can be recovered through a pattern unification process.

However, this observation does not hold for all symmetric calculi: some still need polarities, especially the simpler ones (like CCS, fusion-calculi, and πI). In fact, calculi for which polarities can be recovered by other constructs are arguably more intricate than the ones for which they cannot. For instance, in all three of the aforementioned calculi (D, U and CPC), deciding whether a synchronisation can happen or not depends on the occurrences of binders on both sides of the communication.

For example, in D and U, process P 1 below can have a reduction iff x and y are indeed x and y: if there is no λ-binding of either one of x and y, the reduction cannot happen. In CPC, process P 2 below has a reduction only if the pattern compounds p 1 and p 2 contain no binders.

P 1 = (λx )(νy)a x, y .P | (λy )(νx)a x, y .Q P 2 = a λx • p 1 .P | a p 2 • λy .Q

Coinductive characterisation of barbed congruence

The behavioural theory of πP does not seem to be reducible to existing calculi: novel properties are the fact that the preorder relation induces a communicability relation2 that is not transitive, and that positive private names are staying private, despite the free inputs. In particular, name preorders have an impact on how processes express behaviours. Some laws for barbed congruence in πP show that the behavioural theory of πP departs from existing fusion calculi (Lemma 4.3.11 and Section 4.4).

The main purpose of this section is to deepen the study of the behavioural theory of πP, in an untyped setting. We define a Labelled Transition System for πP, and show that the induced notion of bisimilarity. The LTS reveals interesting aspects of interaction in πP. An important observation is related to the interplay between arcs and the restriction operator. It is for instance possible for a process to react to an input offer on some channel, say c, without actually being able to perform an output on c. This is the case for the following process:

P 0 (νa)(av | a/c) P 0 | cu -→ v/u . (4.3)
(note that P 0 could do an output on c if the arc a/c was replaced with c/a). This phenomenon leads to the addition of a new type of labels in the LTS, corresponding to what we call protected actions (accordingly, we introduce protected names, which correspond to (usages of) names where a protected action occurs: intuitively, name c is protected in P 0 ). As expected, protected actions correspond to observables of barbed congruence.

In addition, arc processes do not have transitions, but they induce relations between names, which in turn influence the behaviour of processes. Accordingly, strong bisimilarity not only tests transitions, but also has a clause to guarantee that related processes entail the same conditions.

Finally, the LTS also includes a label [ϕ]τ , expressing "conditional synchronisation". Intuitively, process a | b is not able to perform a τ transition by itself, but it should be when the environment entails a b. Hence, in order for our LTS to be compositional, we include labels of the form [ϕ]τ , interpreted as "τ under the condition ϕ".

We give in Section 4.6 an axiomatisation of barbed congruence. For this, we introduce the guarded sum construct and a prefix corresponding to label [ϕ]τ akin to the matching construct in π-this is customary for axiomatisations for the π-calculus [START_REF] Parrow | Algebraic theories for name-passing calculi[END_REF][START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF]. The resulting calculus extended with sum and this prefix is called πP + . These two new constructs cannot be encoded in a simple way in the original calculus πP. Fortunately they add no discriminative power: the induced behavioural equivalences coincide (Proposition 4.5.39). In light of this observation, this section builds an LTS for πP + , as it is the more general calculus.

To simplify the presentation of the axiomatisation, we renounce minimality even more, using two kinds of bound prefixes (bound prefixes are also customary for axiomatisations3 ). This particular addition is unimportant, as there are trivial encodings in the two directions (Remark 4.5.4). We discuss in Section 4.5.6 a presentation of transitions and bisimilarity based on free prefixes.

As usual, we focus on a finite calculus. This is sufficient to enlighten the main aspects of the behavioural theory of processes. We do not expect any unpredicted difficulty to arise, in the definition of labelled transitions and bisimilarity, from the extension of πP + with a replication operator.

Extending the calculus

We describe now the additional constructs of πP + : name are replaced with extended names (α, β), prefixes (π) now feature a third construct, and processes now feature sums:

α ::= a {a} π ::= α(x) α(x) [ϕ]τ P ::= P | Q (νa)P i∈I π i .P i a/b .
The new constructs are sums, conditional τ s, extended names, and bound prefixes (as explained above, we see in Remark 4.5.4 that the latter two do not change expressiveness, and in Proposition 4.5.39 that barbed congruence is preserved with all the new constructs). Relations ≺ and extend to extended names, which we define and explain in the following, where needed. When n(ϕ) = {a}, we say that ϕ is reflexive and we abbreviate prefix [ϕ]τ as τ . In a prefix α(x) or α(x), we say that extended name α is in subject position, while x is in object position. As discussed previously, extended names include protected names, of the form {a}, which can be used in subject position only. We call protected prefix a prefix where the subject is a protected name. A prefix of the form [ϕ]τ is called a conditional τ and other prefixes are called visible.

Bound and free names for prefixes are given by: bn([ϕ]τ ) ∅ bn(α(x)) bn(α(x)) {x} fn([ϕ]τ ) n(ϕ) fn(α(x)) fn(α(x)) n(α) with n(a) n({a}) {a} .

In a sum process, we let I range over a finite set of integers. 0 is the inactive process, defined as the empty sum. We use S to range over sum processes of the form i∈I π i .P i , and write π.P ∈ S if π.P is a summand of S. We sometimes decompose sum processes using the binary sum operator, writing, e.g., S 1 +S 2 (in particular, S + 0 = S). As previously, we abbreviate π.0 as π, and write α(x).P simply as α.P when the transmitted name is not relevant, and similarly for α. In (νa)P , (νa) binds a in P , and prefixes α(x) and α(x) bind x in the continuation process. As usual, binders give rise to α-conversion.

We use an overloaded notation, and define processes a b and a ≺ b as follows, to represent conditions:

a b (νu)(u/a | u/b) a ≺ b b/a .
Since Definition 4.3.1 does not mention prefixes at all, there is no need to adapt the definitions of Γ ϕ and P ϕ from πP to πP + . However, we will use the following definition: Φ(P ) {ϕ | P ϕ} is the set of all conditions entailed by P .

Positive and negative occurrences of names can be extended to extended names and conditional synchronisation prefixes: Definition 4.5.1 (Positive and negative occurrences). In protected prefixes, subjects are negative occurrences. In conditions, names are negative except in a ≺ b where b is positive. In [ϕ]τ the polarities are opposite to the one in ϕ. More formally, we extend fn + (P ) and fn -(P ) as follows: Relations ≡ and are used to define the reduction of processes. We rely on to infer that two processes interact on joinable (extended) names. This allows us to introduce the reduction relation -→ (adapted from -→ bn in Definition 4.3.3 to handle choice and conditional τ s): Definition 4.5.3 (Reduction). Relation -→ is the relation defined by the following rules: Again, we use the generic definition of barbs, uniform over usual process calculi, and define P ↓ a as P ↓ bn a in Definition 4.3.6, i.e. P ↓ a iff P | a(x).w -→ w | P for some P and w / ∈ fn(P ) (similarly for P ↓ a ). We can remark that P 0 ↓ c , where P 0 (νa)(a(v) | a/c) is the bound prefix version of process P 0 , previously defined. Barbed congruence, now written , is defined as in Definition 2.1.4 over the reduction and barbs defined above (same definition as bn ).

α(x).P ∈ S 1 β(y).Q ∈ S 2 R α β x = y R | S 1 | S 2 -→ R | (νxy)(x/y | P | Q) a {b} = {b} a = a
Remark 4.5.4 (Encodability of free and protected prefixes). In πP, arcs act like "instantaneous forwarders". This allows us to define an encoding [•] f from a calculus with free prefixes to a calculus with bound prefixes as follows (x is chosen fresh):

[ab.P ] f a(x).([P ] f | x/b) [ab.P ] f a(x).([P ] f | b/x) ,
where [•] f preserves other operators of the calculi. We return to this encoding below (Proposition 4.5.39), and show that it allows us to reflect behavioural equivalence of Definition 4.3.7 into this variant of the calculus.

We can also encode protected prefixes as follows (u is chosen fresh):

[{a}(x).P ] p (νu)(u/a | u(x).[P ] p ) [{a}(x).P ] p (νu)(u/a | u(x).[P ] p ) .
Although protected prefixes are in some sense redundant, we do not treat them as derived operators, to simplify the presentation (in particular in Section 4.6).

→-IN

x / ∈ n(α) ∪ {y} ∪ fn(P ) α(y).P

α(x)

---→ (νy)(x/y | P )

→-OUT x / ∈ n(α) ∪ {y} ∪ fn(P ) α(y).P α(x) ---→ (νy)(y/x | P ) →-TAU [ϕ]τ.P [ϕ]τ --→ P →-COMM-L P α(x) ---→ P Q β(x) ---→ Q P | Q [α β]τ ----→ (νx)(P | Q ) →-TAU- P [ϕ2]τ ---→ P P Γ Γ, ϕ 1 ϕ 2 P [ϕ1]τ ---→ P →-IN- P α(x) ---→ P P α ≺ β P β(x) ---→ P →-OUT- P α(x) ---→ P P α ≺ β P β(x) ---→ P a ≺ {b} = a b {a} ≺ {b} = b ≺ a {a} ≺ b = undefined →-RES P µ -→ P a / ∈ n(µ) (νa)P µ -→ (νa)P →-PAR-L P µ -→ P bn(µ) ∩ fn(Q) = ∅ P | Q µ -→ P | Q →-SUM π i .P i µ -→ P i π i .P i µ -→ P

Labelled transition system

The LTS defines transitions P µ -→ P , where the grammar for the labels, µ, is the same as the one for prefixes π. We comment on the rules, given on Table 4.1.

The first two rules correspond to the firing of visible prefixes. The transition involves a fresh name x, upon which the participants in a communication "agree". Name y remains local, via the installation of an arc, according to the polarity of the prefix. (Adopting a rule with no arc installation would yield a more complex definition of ∼). The rule for the [ϕ]τ prefix is self explanatory. The rule describing communication follows the lines of the corresponding rule for -→; no arc is installed (but arcs are introduced in the prefix rules).

The three rules mentioning are called preorder rules. The two preorder rules for visible actions exploit ≺, which is defined for extended names (as we did for above). Note that the condition involving is the same in these two rules. For instance, if P a(x) ---→ P and P a ≺ c, we can derive P c(x) --→ P . In this case, P a ≺ {c} is also derivable, hence P {c}(x) ---→ P . We can also check that P 0 , a counterpart of P 0 in (4.3), can do a transition labelled with {c}(y):

P 0 (νa)(a(x).0 | a/c) P 0 {c}(y) ---→ (νa)((νx)x/y | a/c)
because a(x).0 | a/c c a (and hence a ≺ {c}).

The other preorder rule can be used to modify conditional τ s involved in a transition. As an example, let

P 1 (a(x).Q | n/u) | (u(y).R | n/a) .
Process P 1 can perform a τ transition: the two arcs can, intuitively, let the output at a and the input at u interact at name n. Technically, this can be derived by inferring a

[a u]τ
----→ transition (from the output on the left and the input on the right), which can then be turned into a τ transition, exploiting the fact that the whole process entails a u.

Finally, the congruence rules, on the last line of Table 4.1, are as expected.

Definition 4.5.5 (∼). A symmetric relation R is a bisimulation if P R Q implies:

• If P ϕ then Q ϕ. • If P α(x) ---→ P , with x / ∈ fn(Q), then there is Q such that Q α(x)
---→ Q and P R Q ; we impose the same condition with α instead of α.

• If P [ϕ]τ --→ P then there is Q such that Q [ϕ]τ --→ Q and P | ϕ R Q | ϕ.
Bisimilarity, written ∼, is the greatest bisimulation.

In the last clause for [ϕ]τ , we add ϕ in parallel, since the transition is fired only if ϕ is satisfied. Indeed demanding P R Q is too strong a requirement: arcs are permanent processes, so a context triggering such a transition necessarily entails ϕ (even after reductions). This definition can be related to the efficient bisimulation from [START_REF] Wischik | Strong bisimulation for the explicit fusion calculus[END_REF].

Remark 4.5.6 (Scope extrusion). Our LTS does not have rules for opening and closing the scope of a restriction. Instead, we rely on arcs in πP to handle scope extrusion. To see this, consider the following πP transition where a private name c is emitted:

a(c).P a(x) ---→ (νc)(c/x | P ) .
(Intuitively, process a(c).P has a restriction on c, since this name is private.) Name x is visible in the label, and arc c/x is installed. Through x, the environment can affect c, so that πP actually implements scope extrusion via arcs, without the need to move restrictions. We have:

a(c).P | a(y).Q τ -→ (νx)((νc)(c/x | P ) | (νy)(x/y | Q)) (νc)(νy)(P | c/y | Q) .
In particular, in the encoding from the π-calculus to πP given in Section 4.7.2, when a fresh name is emitted, it is extruded, and we have ( P is the encoding of P ):

Towards the characterisation theorem

In order to present the proof that barbed congruence coincides with the bisimilarity induced by our LTS, we first need to establish several preliminary technical results, about relations , and .

Mechanisation of some proofs. Some of the proofs involving tedious case enumerations have been verified using the Coq proof system [Coq]. When this is the case, the proof script files we mention are available from [START_REF] Madiot | Coq proof scripts for some results on pi with preorders[END_REF]. Note that these proofs have little interest, as they are straightforward, even though they have a lot of cases.

On the relation. To handle some case analyses, we decompose , using an additional relation, written

. The idea is that the transitive closure of is . The predicate ϕ 1 , ϕ 2 ϕ 3 is defined as follows (note how the second line is the symmetric variant of the first):

a ≺ b, b ≺ c a ≺ c a ≺ c, b ≺ c a b a b, c ≺ a c b a b, c ≺ b a c b ≺ c, a ≺ b a ≺ c b ≺ c, a ≺ c a b c ≺ a, a b c b c ≺ b, a b a c
We write ϕ 1 ϕ2 ϕ 3 whenever ϕ 1 , ϕ 2 ϕ 3 and we write P for the union of all relations ϕ between conditions for P ϕ. Intuitively, P denotes all the implications between conditions that hold because of the conditions that are entailed by process P in one step.

Lemma 4.5.7 shows that if ϕ can be decomposed, then so can ϕ .

(b) →-COM-L: (→-COM-R is symmetric) transition µ = [ϕ]τ is obtained from transitions α(x) and γ(x) such that [ϕ]τ P |Q [α γ]τ . Since a / ∈ fn(Q) we already know that {a} = n(γ). Suppose first that {a} = n(α). Then we can obtain the transition α from (νa)P as well, then the [α γ]τ transition, and we conclude to get [ϕ]τ by Lemma 4.5.21. The interesting case is when {a} = n(α). We prove below the following implication:

[ϕ]τ P |Q [α γ]τ =⇒ ∃β {a} = n(β) ∧ [ϕ]τ P |Q [β γ]τ P α ≺ β (4.4)
and we remark that (4.4) implies β(x) P α(x). We can now use Lemma 4.5.23 to easily build back the [ϕ]τ transition from (νaP ) | Q, as follows:

P α(x) ---→ P Q γ(x) ---→ Q P | Q [α γ]τ ----→ (νx)(P | Q ) [ϕ]τ P |Q [α γ]τ P | Q [ϕ]τ --→ (νx)(P | Q ) a / ∈ n(ϕ) (νa)(P | Q) [ϕ]τ --→ (νa)(νx)(P | Q ) P α(x) ---→ P β(x) P α(x) P β(x) ---→ P a / ∈ n(β) νaP β(x) ---→ νaP Q γ(x) ---→ Q (νaP ) | Q [β γ]τ ----→ (νx)((νaP ) | Q ) [ϕ]τ (νaP )|Q [β γ]τ (νaP ) | Q [ϕ]τ --→ (νx)((νaP ) | Q )
We prove now (4.4). Using Lemma 4.5.20 we decompose [ϕ]τ P |Q [α γ]τ into a sequence of ψ with P ψ ∨ Q ψ. We prove (4.4) by induction on this sequence, decomposing it "from the right" into we interrupt the induction since we can derive a plain τ , hence any [ϕ]τ that we want. • η = [α δ]τ and ψ = γ ≺ δ and P ψ or Q ψ:

we use the induction hypothesis to get the expected β and we replay ψ on top of it (the induction hypothesis gives

[ϕ]τ P |Q [β δ]τ , from which through P, Q γ ≺ δ it is easy to get [ϕ]τ P |Q [β γ]τ ).
This concludes the case analysis. We now move on to congruence results. To derive those, we use several up-to techniques to reduce the size of the bisimulation candidates and factor out uninteresting case analyses. Note that we develop up-to techniques in much more details in Chapter 5, which includes a gentle introduction (Section 5.1). Definition 4.5.33 (Bisimulation up to ∼ and σ). A relation R is a bisimulation up to bisimilarity and injective substitution if it validates the clauses of the usual bisimulation, except that the outcomes of the transitions, P 1 and Q 1 , are requested to satisfy P 1 ∼ P 2σ and Q 1 ∼ Q 2σ with P 2 R Q 2 , where σ stands for an injective name substitution.

Proof. We prove ∼R σ ∼ is a bisimulation where R σ stands for {(P σ , Q σ ) | P R Q and σ is injective}. Lemma 4.5.34 is the most complex case in the proof of congruence of ∼. Lemma 4.5.34.

P ∼ Q implies P | R ∼ Q | R for all R.
Proof. We prove that R = {(P | R, Q | R) | P ∼ Q} is a bisimulation up to restriction and bisimilarity. Lemma 4.5.13 handles the first clause about conditions, and Lemma 4.5.23 the second one about visible transitions. Lemma 4.5.23 also helps handling a [ϕ]τ transition from P | R to P 1 by saying it comes from a [ϕ 1 ]τ transition from P , or R, or both, and such that

[ϕ]τ P |R [ϕ 1 ]τ . From that, getting a transition [ϕ]τ from Q | R to Q 1 is easy, but one must relate P 1 | ϕ and Q 1 | ϕ in R using three different assumptions: 1. R [ϕ1]τ ---→ R . Then P | R | ϕ ∼R∼ Q | R | ϕ. (up to ∼) 2. P [ϕ1]τ ---→ P . Then P | ϕ 1 ∼ Q | ϕ 1 , which implies P | R | ϕ ∼R∼ Q | R | ϕ. Indeed ϕ 1 is absorbed by ϕ since P | Q | ϕ ϕ 1 . (up to ∼)
3. P and R synchronise into (νx)(P | R ). Then P ∼ Q and we can relate (νx

)(P | R ) | ϕ to (νx)(Q | R ) | ϕ (up to ∼ and ν).
Proposition 4.5.35 (Congruence of ∼). Bisimilarity is a congruence.

Proof. The difficult case is closure under parallel composition (Lemma 4.5.34). Closure under restrictions is proven in Lemma 4.5.30, and closure under guarded sums is easy but still need Lemmas 4.5.34 and 4.5.30, since arcs and restrictions can appear in the rules for the prefixes and the bisimulation clause for [ϕ]τ .

The following lemma is useful for the proof of completeness of ∼ w.r.t. . Lemma 4.5.36. For any P , Q and ϕ, P

[ϕ]τ --→ Q iff P | ϕ τ -→ Q | ϕ.
Proof. If P Proof. The proof follows a standard pattern. Soundness is a consequence of congruence (Proposition 4.5.35), Lemma 4.5.37, and the correspondence of barbs with visible transitions (which follows from Lemma 4.5.25).

For completeness, we have to show that contexts can express the conditions in the three clauses in Definition 4.5.5. We define accordingly tester processes. The first clause is handled using process [ϕ]τ.w. We use ϕ for the second clause (by Lemma 4.5.36). For transitions (third clause), the counterpart of, e.g., {a}(x) ---→, is given by tester process a(y).(z/y | w | w).

Correspondences between variants of the calculus

The calculus of the previous sections is a version of πP + with prefixes for free input and output, and without the corresponding bound prefixes (as well as without sum and conditional τ ). That calculus (πP) is equipped with the equivalence bn from Definition 4.3.7. The encoding [•] f , which we introduced in Remark 4.5.4, allows us to embed πP into πP + in a faithful way: Proposition 4.5.39 (Correspondence with Definition 4.3.7).

P bn Q iff [P ] f [Q] f . Proof. [P ] f [Q] f ⇒ P bn Q follows from the fact that [•] f
induces standard correspondences of reductions, barbs, and contexts, from πP to πP + :

• if P -→ bn P then [P ] f -→ [P ] f ,
• if [P ] f -→ P 1 then P 1 [P ] f and P -→ bn P for some P ,

• P ↓ bn a iff [P ] f ↓ a • if C is a πP context, for some πP + context D, for all P , [C[P ]] f = D[[P ] f ].
Consider now πP -, the subcalculus of πP + with neither sum nor [ϕ]τ constructs, and -, the barbed congruence induced by πP -contexts. The proof of completeness of ∼ only uses πP -contexts, hence -= ∼ = . We prove the above correspondences between πP -and πP for the encoding Finally, if

P bn Q, then [[P ] f ] b p bn [[Q] f ] b p , and thus [P ] f [Q] f .

Labelled transitions for free prefixes

We now consider πP + F , the variant of πP where only the grammar for prefixes of is changed, as follows (πP + F is πP with sums and conditional τ ):

π ::= αb αb [ϕ]τ
We adapt the LTS of Section 4.5.2 to πP + F . The only modification we need to make is to replace the rules for bound prefixes by the following: b to πP + , with some care to handle binders in sums:

→-F-IN x / ∈ n(α) ∪ {b} ∪ fn(P ) αb.P α(x) ---→ x/b | P →-F-OUT x / ∈ n(α) ∪ {b} ∪ fn(P )
i π i .P i b (νx) i    αx.P i if π i = α(x) αx.P i if π i = α(x) [ϕ]τ.P i if π i = [ϕ]τ
, where x is chosen fresh in the third clause. Note that we rely on α-conversion to have the same name x bound in all summands in the encoding of sums.

We can show that both encodings [•] f and [•] b preserve transitions and bisimilarity, so, as in Proposition 4.5.39, they preserve barbed congruence.

Axiomatisation

In this section, we provide a second characterisation of barbed congruence, by presenting a set of laws that define an axiomatisation of . Algebraic laws help analysing the behaviour of the constructs of the calculus and their interplay. We present a sample of behavioural equalities, and explain how they can be derived equationally, in Section 4.6.1 (page 71).

The axiomatisation we give is less simple than, say, the one for fusions in [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF], for two reasons: first, we manipulate preorders between names rather than equivalence relations, the fact that is not transitive making the problem more intricate. Second, the preorder is explicitly represented in processes, so that some equational laws must describe the interplay between processes and the preorder relation. On the contrary, such aspects are dealt with implicitly in fusions. We show how our ideas can be adapted to provide an axiomatisation of behavioural equivalence for explicit fusions in Section 4.6.3.

The axiomatisation exploits the idea that πP + processes have a state component, corresponding to the preorder induced by arcs. Several laws in the axiomatisation express persistence of the state component (the state can only be extended along computation, since arcs are persistent in πP + ). Moreover, the restriction operator prevents the state from being globally shared in general: for instance, in process P 0 in (4.3) (page 56), name a can be used instead of c, but is only known inside the scope of (νa). All in all, the handling of restriction in our axiomatisation requires more care than is usually the case, due to the necessity to express the "view" that subprocesses have on the preorder of names.

Equational laws for strong bisimilarity

Notations and terminology. We use A to range over processes that consist of compositions of ϕ processes only, which we call preorder processes. We often view such processes as multisets of conditions. We use notation A, P to denote a process that can be written, using the monoid laws for parallel composition, as A | P , where P does not contain toplevel arcs. Note that A may contain restrictions, corresponding to the definition of join processes (given in Section 4.5.1), but extrusion is not allowed to decompose a process as A, P .

We write P = Q whenever P and Q can be related by equational reasoning using the laws of Table 4.2, together with the following standard axiom:

Expansion law (we can suppose x = y, bn(π i ) / ∈ fn(T ), bn(ρ j ) / ∈ fn(S).)

i π i .P i S | j ρ j .R j T = i π i .(P i | T ) + j ρ j .(S | R j )
when α β is defined.

+ i,j [α β]τ.(νxy)(x/y | P i | R j ) and {π i , ρ j } = {α(x), β(y)}
Note that we omit the standard laws expressing that | and + obey the laws of commutative monoids, and that + is idempotent. We also omit the laws for equational reasoning (equivalence, substitutivity). We will reason up to these laws in the remainder.

Comments on the laws. Before presenting the properties of the axiomatisation, we comment on the laws of our axiomatisation and illustrate them on some examples. As usual, the expansion law allows us to rewrite the parallel composition of two sums into a sum, the third summand describing synchronisation in πP + . ∈ fn(P ) L21 (νc)(νd)P = (νd)(νc)P L22 (νa)0 = 0

Laws for preorder processes

L1 a ≺ b | b ≺ c = a ≺ b | b ≺ c | a ≺ c L2 a ≺ b | c ≺ b = a ≺ b | c ≺ b | a c L3 a ≺ b | b c = a ≺ b | b c | a c L4 a ≺ a =
L23 (νa)A = {b ≺ c | b ≺ a, a ≺ c ∈ A = } {b c | b ≺ a, c ≺ a ∈ A = } {b c | a c, b ≺ a ∈ A = } {ϕ ∈ A | a / ∈ n(ϕ)} L24 (νa)(A, S + π.P ) = (νa) A, S + π.(νa)(A | P ) a / ∈ n(π) L25 (νa)(A, S+ a(x).P ) = (νa) A, S + a≺b∈A = b(x).(νa)(A | P ) + b≺a∈A = ∨a b∈A = {b}(x).(νa)(A | P ) L26 (νa)(A, S + {a}(x).P ) = (νa) A, S + b≺a∈A = {b}(x).(νa)(A | P ) L27 (νa)(A, S + [a ≺ c]τ.P ) = (νa) A, S + a≺b∈A = [b ≺ c]τ.(νa)(A | P ) a = c L28 (νa)(A, S + [c ≺ a]τ.P ) = (νa) A, S + b≺a∈A = [c ≺ b]τ.(νa)(A | P ) a = c L29 (νa)(A, S + [a c]τ.P ) = (νa) A, S + a≺b∈A = [b c]τ.(νa)(A | P ) a = c + b≺a∈A = ∨a b∈A = [c ≺ b]τ.(νa)(A | P ) Table 4.2: An axiomatisation of ∼
Prefixes. Law L5 propagates ϕs in depth, expressing the persistence of condition processes (ϕ). Law L6 is the counterpart of the third clause of Definition 4.5.5, and describes the outcome of a [ϕ]τ transition. Similarly, laws L17-L18 correspond to the firing of visible transitions in the LTS (regarding these rules, see also the comments after Proposition 4.6.5).

We note that α-conversion for input prefixes follows from laws L17 and L19, by deriving the following equalities (and similarly for the other visible prefixes): Laws L11-L16 can be used to expand process behaviours using the preorder: arcs can modify the subject of visible prefixes (L11-L12) and the condition in [ϕ]τ prefixes (L13-L16). Laws L8, L9 and L13-L16 rely on the defining properties of relations ≺ and . Finally, law L7 is used to equate all reflexive τ prefixes.

Restriction. Laws L19-L22 are standard. The other laws are used to "push" restrictions inside processes. Due to the necessity to handle the preorder component (A), they are rather complex.

Law L23 is used to eliminate a restriction on a name a in a preorder process, by propagating the information expressed by all ϕs that mention a.

Law L24 is rather self-explanatory, and shows how the A component prevents us from simply pushing the restriction downwards (under prefixes).

Laws L25-L29 describe a kind of "synchronous application" of the prefix laws seen above. For instance, the two summands in law L25 correspond to applications of laws L11-L12: as we push the restriction on a downwards, we make sure that all possible applications of these laws are taken into account.

Intuitively, L23 is used after laws L24-L29 have been used to erase all prefixes mentioning the restricted name a, pushing the restriction on a inwards.

All in all, the set of laws in Table 4.2 is rather lengthy. We make two comments on this. First, it can be remarked that axiomatisations often treat restriction separately, by first focusing on a restriction-free calculus. In πP + , because of preorder processes, we cannot in general push restrictions on top of sum processes, so the situation is more complex.

Second, we could have presented the laws in a more compact way, by writing schemas. A uniform presentation for laws L7-L16 and L25-L29 is as follows:

η A µ µ.P ∈ S A, S = A, S + η.P a ∈ fn(µ) ∀η A µ a ∈ fn(η) ∨ ∃ρ η A ρ ∧ ρ.P ∈ S (νa)(A, µ.P + S) = (νa)(A, S)
(To remove µ.P from µ.P + S, the second rule requires that some ρ.P are in S. The second rule can be used to add those summands to S.) We prefer however to write all rules explicitly, since this is how they are handled in proofs.

Examples of derivable equalities. In the following examples, we sometimes switch silently to notation A, P to ease readability. We also allow ourselves to simplify some reasonings involving prefixes where the object is not important. We explain how the following equalities between πP + processes can be derived:

(νa)(b/a | a/c) = b/c (
νa)(S +a(x).P ) = (νa)S (νa)(a/b | a(x).P ) = {b}(x).(νa)P a(x).x = a(x).{x} a(x).{x} = a(x).0

The first equality above is established using law L23: before getting rid of the restriction on a, we compute all conditions not involving a that can be deduced from b/a | a/c. In this case, this is only b/c.

The second equality is a direct consequence of law L25. Law L25 is also used for the third equality: only the second summand in the law is not empty, which gives (νa)(a/b, a(x).P ) = (νa)(a/b, {b}(x).(νa)P ). Then, L20 allows us to restrict the scope of νa, and we can get rid of (νa)a/b using law L23, which yields the result.

Another way to see the third equality is to observe that we can derive a/b, a(x).P = a/b, a(x).P +{a}(x).P + {b}(x).P using laws L10 and L12. In the latter process, the sum is intuitively expanded, in the sense that all derivable toplevel summands have been made explicit. When considering the restricted version of both processes, it is sound to push the restriction on a downwards in the expanded process, to obtain the expected equality. In this sense, law L25 implements a "synchronous version" of this reasoning, so as to insure that when pushing a restriction downwards, the behaviour of the process is fully expanded.

The next two equalities illustrate the meaning of protected names. We reason as follows: a(x).x L18 = a(x ).(νx)(x /x, x) L25 = a(x ).(νx)(x /x, {x }.(νx)0). We then obtain the expected equality by getting rid of (νx)x /x, using laws L20-L23. The reason why this equality holds is that fresh name x is emitted without the context having the ability to interact at x, since x will never be under another name in an arc. Therefore, the input at x is equivalent to a protected input.

In the last equality, because of the transition a(x).{x} a(x ) ---→ (νx)(x /x | {x}), x will never be above another name, so that the prefix {x} cannot be triggered, and is equivalent to 0. This equality is derived as follows:

a(x).{x} L17 = a(x ).(νx)(x /x | {x}) L26 = a(x ).(νx)x /x L23 = a(x ).0 .
(we have explained above how a(x ).0 = a(x).0 can be derived).

We leave it to the reader to check that the law for interleaving, presented in Section 4.4, can be derived using the expansion law, followed by the rules for prefixes and restriction to get rid of the summand [x y]τ.(νt, u)(t/u).

Soundness and completeness of the axioms Lemma 4.6.1 (Soundness). The laws of Table 4.2 relate bisimilar processes.

Proof. Laws L19-L22 are instances of Lemma 4.5.26.

Laws L1-L4 are proven by showing Φ(lhs) = Φ(rhs), since both sides have no transitions, which is done by a simple induction.

Similarly for law L23: the inclusion Φ(lhs) ⊇ Φ(rhs) is trivial, and the inclusion Φ(lhs) ⊆ Φ(rhs) is shown by induction, proving that all useful usages of a have to be combined to other usages of a using a technique similar as in case 3 of the proof of Lemma 4.5.15.

The remaining laws are easy: the clause about the preorder relation is always trivial, so we only focus on the clauses about transitions. In each case, we need only to run one step of the bisimulation game to reach processes we already know how to prove bisimilar.

For L8-L16 we check that lhs can do the transitions corresponding to the additional summands of rhs. Law L4 is trivial. For L5-L6 we need ϕ | ϕ ∼ ϕ which is derivable from L1-L4. For L17-L18 we get two pairs of the form (νy)(z/y | P ) and (νx)(z/x | (νy)(x/y | P )) which is derivable using L23.

For L24-L29 we check that the transitions of both sides are the same. Then, we reach processes of the form (νa)(A, R) and (νa

)(A | (νa)(A | R)). The latter process is bisimilar to (νa )(A{a /a} | (νa)(A | R)), which is bisimilar to (νa)(A | ((νa )(A{a /a}) | R) again bisimilar to (νa)(A | ((νa)A) | R) and we conclude by observing that A | (νa)A ∼ A using the fact that Φ(A | (νa)A) = Φ(A), since Φ((νa)A) ⊆ Φ(A).

Auxiliary results: preorder processes, prefixes, restriction.

In order to establish completeness, we first need some technical results, given by Propositions 4.6.2, 4.6.5 and 4.6.8.

First, laws L1-L4 can be used to saturate preorder processes:

Proposition 4.6.2. If A 1 , S 1 ∼ A 2 , S 2 , then there exists A such that A i , S i = A , S i (i = 1, 2), and A = {ϕ | ϕ not reflexive and A 1 ϕ}.

(Note that we could have picked A 2 instead of A 1 above, and that {P 1 , . . . , P n } stands for the parallel composition P 1 | . . . | P n .)

Proof. We rely on a rewriting relation on preorder processes. We write A → A whenever A is obtained from A using one of the laws L1-L4, oriented from left to right, as a rewrite rule modulo associativity and commutativity of parallel composition. We furthermore impose that no reflexive condition is added in a rewrite step, nor a condition that is already contained in the preorder process.

We then prove the following three properties about →:

1. If A → A , then A ∼ A : this is a consequence of Lemma 4.6.1 (or, alternatively, follows from Lemma 4.5.29). This is useful to be able to relate →-normal forms through ∼ and hence say that they entail the same conditions.

2. For any (finite) A, there is no infinite →-chain emanating from A.

Indeed, the rules defining → do not introduce any new name. Moreover, a new arc or join can only be added if it is not already present. Since there are finitely many conditions built on a finite set of names, → terminates.

3. Suppose A is a →-normal form. Then, for any non-reflexive ϕ, if A ϕ, then ϕ appears in A (which we write ϕ ∈ A).

This follows by induction on the derivation of A ϕ. The only interesting case is for the -COMBINE rule, i.e. we know that A Γ and Γ ϕ. We conclude by associating to rules -TRANS, -JOIN and -EXTJOIN laws L1, L2 and L3 respectively.

The observations above entail the expected property.

We say that A is a saturated preorder process whenever A ≡ A. We use A to range over such processes. We can remark that even if A contains only arcs, A may contain restrictions, because of induced conditions involving .

The next lemma relates transitions of sums and the laws for prefixes. Proof. Suppose S is of the form S 1 + π .Q and that the transition A, S µ -→ A, P is in fact (Lemma 4.5.23) coming from the summand π .Q µ -→ P , with µ A,S µ and µ = α π (i.e. µ and π only differ in their bound names). Since Φ(A, S) = Φ(A) we know also that µ A µ .

Then we have directly π A π . We prove by induction on π A π that for all S, A, S + π .Q = A, S + π .Q + π.Q.

• Reflexivity of is handled by the fact that + is idempotent.

• Transitivity (e.g. π 3 A π 2 A π 1 ) is handled by monoid laws for +. We write Q i for π i .Q below. We know by induction that:

(1)

A, S + Q 1 = A, S + Q 1 + Q 2 (for all S) and (2) A, S + Q 2 = A, S + Q 2 + Q 3 (for all S)
. Then (up to ≡):

A, S + Q 1 (1) = A, S + Q 1 + Q 2 (2) = A, (S + Q 1 ) + Q 2 + Q 3 (1)
= A, S + Q 1 + Q 3 so now we can only have to prove it for π ϕ π when A ϕ. Note that using the reasoning above we can work up to transitivity.

(νx)(y/x | T 1 ) = (νx)(y/x | T 2 ) and hence a(y).(νx)(y/x | T 1 ) = a(y).(νx)(y/x | T 2 ) which gives us, as announced, π.T 1 = π.T 2 .

The other cases for the shape of π are treated similarly.

We now move to the full calculus, by taking into account parallel composition. As is usually the case, this step relies on applications of the expansion law. Lemma 4.6.10. For any P , there exists a |-free process Q s.t. P = Q.

Proof. First P = A, P 1 using the monoid laws for parallel composition. Then by induction on P 1 we build S such that P 1 = S and |P 1 | = |S|. There are only two cases: sums, and parallel compositions of two sums (by induction hypothesis), on which we apply the expansion law. Both preserve | • |.

We can then extend Proposition 4.6.9 to the whole πP + calculus: Theorem 4.6.11 (Axiomatisation of ∼). For all P and Q, P ∼ Q iff P = Q.

Proof. The theorem follows from Proposition 4.6.9 and Lemma 4.6.10. Remark 4.6.12 (Normal forms). The proofs in this section suggest that we can define a strategy to apply the laws of our axiomatisation, in order to rewrite a πP + process P to its normal form, nf(P ), so that

P ∼ Q iff nf(P ) = nf(Q).
For preorder processes, the saturated form is a normal form for ∼: if A 1 ∼ A 2 , then, by Proposition 4.6.2, A 1 = A 2 . By contrast, the proof of Proposition 4.6.5 does not compute a canonical form for sum processes. For instance, from the equivalence

b/a | c/a | a(x).0 ∼ b/a | c/a | a(x).0 + b(x).0 , Proposition 4.6.5 rewrites these processes into b/a | c/a | a(x).0 + b(x).0, but not into b/a | c/a | a(x).0 + b(x).0 + c(x)
.0, which could be seen as a normal form for ∼, obtained by saturating the sum. Actually, the normal form could even be b/a | c/a | a(x).0 + b(x).0 + c(x).0 + {a}(x).0 + {b}(x).0 + {c}(x).0 , by virtue of several applications of (the counterpart for output of) law L10 with π 1 an output prefix and π 2 a protected output.

Related works

The stateful nature of the preorder component of πP processes can be related to frames in the applied π-calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF] and Psi-calculi [START_REF] Bengtson | Psi-calculi: Mobile processes, nominal data, and logic[END_REF]. Arcs in πP can be seen in some sense as substitutions, but they differ from the active substitutions of applied π. The latter map variables to terms, while, in the tradition of fusion calculi, we only have (channel) names in πP. Moreover, several arcs acting on the same name are allowed in πP, while a substitution acts on at most one variable in applied π. For these reasons, the behavioural theories of πP and applied π are rather different. Liu and Lin's proof system for applied π [LL10] departs from our axiomatisation for πP, but has in common the stateful component of processes.

Adapting our axiomatisation to explicit fusions

We can reuse the ideas presented above to describe an axiomatisation for barbed congruence in explicit fusions ([GW00, WG04] and Section 3.2.3). Accordingly, we add guarded sums and conditional synchronisation to the explicit fusion calculus along the lines of πP + . We also adopt a presentation of the calculus with primitive bound prefixes. The conditions and arcs of πP + become explicit fusions.

i π i .P i | j ρ j .R j = i π i .(P i | T ) + j ρ j .(S | R j ) + i,j [a=b]τ.(νx)(P i | R j )
where {π i , ρ j } = {a(x), b(x)} We have defined in Section 3.2.3 an LTS and a definition of efficient bisimulation adapted 4 from [START_REF] Wischik | Strong bisimulation for the explicit fusion calculus[END_REF]. The only difference with Section 3.2.3 are sums (for which we take the standard rule →-SUM in Figure 4.1, page 59) and prefixes, for which we give the rules below:

a(z).P a(x) -→ (νz)(z=x | P ) a(z).P a(x) -→ (νz)(z=x | P ) [a=b]τ.P [a=b]τ -→ P
We do not change the definition of bisimulation (cf. Remark 4.5.4 and Section 4.5.6).

We give in Table 4.3 an axiomatisation of efficient bisimulation (and hence, barbed congruence) for the explicit fusion calculus. We write EF P = Q if the equality can be derived using equational reasoning from these laws.

The axiomatisation is considerably simpler than the one for πP + . The stateful component of processes encodes an equivalence relation on names. This makes it possible to reason locally, whereby a form of global reasoning is necessary in the laws of Table 4.2 for πP + . The fact that fusions are symmetric (and that the communicability relation is transitive) makes protected names unnecessary and simplifies greatly the handling of restriction. Indeed, laws L25-L29 can be dealt with using the last of the structural laws in Table 4.3.

The effect of an explicit fusion a=b can be summed up with a simple derivable equality:

4 Note that in the original LTS of [START_REF] Wischik | Strong bisimulation for the explicit fusion calculus[END_REF], P τ -→ P does not necessarily imply that P

[a=b]τ ----→ P for every a and b, so the authors had to adapt the last clause of the definition of bisimulation (requiring

Q | a=b τ -→ instead of Q [a=b]τ ----→).
Given the LTS of Section 3.2.3 we could have chosen the last clause of Definition 3.2.1 to be similar to the last clause of Definition 4.5.5.

We conclude thanks to the fact that ∼ is a congruence and an equivalence relation.

2) Thanks to 1) and the fact that relation -→ bn is preserved by evaluation contexts, we only have to consider the base case of the reduction relation: R ab.

P | ac.Q -→ ef b=c | P | Q R .
Moreover, since bn is stable by ≡ and evaluation contexts, we can restrict ourselves to considering the reduction Remark 4.7.7 (The Solo Calculus). The calculus of Solos [START_REF] Laneve | Solos in concert[END_REF] can be seen as the polyadic fusion calculus without continuations ( [START_REF] Laneve | Solos in concert[END_REF] shows that Solos can encode continuations). We believe that using basically the same machinery, we can show that polyadic πP without continuations is able to encode continuations as well.

π-calculus

The embedding of the π-calculus into any existing fusion calculus is defined by translating the bound input construct as follows:

[[a(x).P ]] = (νx) ax.[[P ]]
(the other constructs being translated homomorphically). The same encoding can be used for πP.

The encoding of π-calculus into fusions is not fully abstract for barbed congruence (Section 4.4). We do not know whether the encoding of the full π-calculus into πP is fully abstract. We present an operational correspondence result below (Section 4.7.2.1), and show in Section 4.7.2.2 that the encoding is fully abstract on Aπ, the asynchronous subset where no continuation is allowed after the output prefix.

Operational correspondence for synchronous processes

We use the following properties of the encoding: Lemma 4.7.8 (Operational correspondence). Let P, Q be π-calculus processes.

1. P ≡ Q iff [[P ]] ≡ [[Q]]; 2. if P -→ π P then [[P ]] -→ bn bn [[P ]];

conversely, if [[P ]

] -→ bn P 1 then there is P such that P -→ π P and P 1 bn [[P ]];

4. P ↓ a iff [[P ]] ↓ a .
Proof.

1. The direction from left to right is straightforward. For the converse direction, suppose [[P ]] ≡ R 1 , then there exists R such that P ≡ R and we can obtain

R 1 from [[R]] only by moving restrictions on input objects. Hence if R 1 = [[Q]], we have necessarily R = Q.

By induction on

P -→ π P . Base case: if ab.P | a(x).Q -→ π P | Q{b/x} we have [[ab.P | a(x).Q]] -→ bn νx([[P ]] | b/x | [[Q]]) bn [[P ]] | [[Q]]{b/x} by Lemma 4.3.14 since x has no negative occurrence in [[Q]].

Inductive case: E

[P ] -→ π E[P ] with P -→ π P and E is either R | [•] or (νa)[•]. It is enough to observe that [[E]
] is an evaluation context, since -→ bn and bn are both preserved by evaluation contexts.

Inductive case: P

≡ P 1 -→ π P 1 ≡ P with, by induction, [[P 1 ]] -→ bn bn [[P 1 ]].
Using the property established above, [[P ]] ≡-→ bn bn ≡ [[P ]]. We conclude by remarking that (≡-→ bn bn ≡) ⊆ (-→ bn bn ), by definition of -→ bn and bn .

Suppose [[P ]

] -→ bn P 1 . Since [[P ]] does not contain any arc process, the reduction comes from a communication between two prefixes on the same name a:

[[P ]] ≡ E 1 [ab.[[Q]] | ax.[[R]]
] with E binding x, and then, keeping track of all modifications brought by ≡, we know that P 1 is of the form

P 1 ≡ E 1 [[[Q]] | b/x | [[R]]]. We can recover P ≡ E[ab.Q | a(x).R] -→ π E[Q | R{b/x}] P . Then [[P ]] = [[E]][[[Q]] | [[R]]{b/x}] ≡ E 1 [[[Q]] | [[R]]{b/x}] bn P 1 .
In the reasoning above, we rely on the following decomposition: if

[[P ]] ≡ E 1 [ab.Q 1 | ax.R 1 ] then Q 1 ≡ [[Q]], R 1 ≡ [[R]] and P ≡ E[ab.Q | a(x).R] with [[E]][νx[•]] ≡ E 1 [•].
We prove this decomposition by combining techniques we have used in the first item, to deduce that Q 1 and R 1 are structurally congruent to the encodings of some processes, with the fact that structural congruence acts independently on either sides of the prefixes ab and ax.

4. The implication from left to right is straightforward by induction. Remark in passing that to test the input barb, a synchronous tester ab.ω is needed (note that input barbs are not tested in the asynchronous version of behavioural equivalence.) The other implication follows from the fact that there is no arc in

[[P ]] so [[P ]] ↓ a if

and only if [[P ]

] contains a prefix whose subject is a (which is equivalent to P satisfying the same property).

One inclusion of the full abstraction result actually holds for the whole π-calculus:

Lemma 4.7.9. Let P and Q be π terms. Then

[[P ]] bn [[Q]] implies P π Q. Proof. The relation {(P, Q) | [[P ]] bn [[Q]]} is reduction-closed (consequence
such that [[C[P ]]] = C 1 [[[P ]]],
and similarly for Q. Hence

[[P ]] bn [[Q]] implies [[C[P ]]] bn [[C[Q]]].

Full abstraction for asynchronous processes

We now establish full abstraction for the encoding of Aπ, the asynchronous π-calculus [START_REF] Honda | An object calculus for asynchronous communication[END_REF][START_REF] Boudol | Asynchrony and the pi-calculus[END_REF]. We say that P ∈ πP is asynchronous if the continuation of all outputs in P is 0 (more precisely, the only constraint we need is that no input is ever guarded by an output). We can remark that the encoding of a process in Aπ is an asynchronous πP process.

We first establish correspondence results for labelled transitions. Labelled transitions in the π-calculus are written µ -→ π (in particular, we write µ = a(x) for a ground input, i.e. when x is not free in the source process). For clarity, labelled transition in πP are written µ -→ πP . The following lemma relates visible transitions in π to visible transitions in πP (for which we use the LTS of Section 4.5.6). Lemma 4.7.10 (Label correspondences). Let P be any π process and f a fresh name.

1. If P ac -→ π P then [[P ]] a(y) -→ πP ∼ c/y | [[P ]]. 2. If P a(c) -→ π P then [[P ]] a(y) -→ πP ∼ (νc)(c/y | [[P ]]). 3. If P a(x) -→ π P then [[P ]] a(y) -→ πP ∼ (νx)(y/x | [[P ]]).

If [[P ]]

If [[P ]]

a(y)

-→ πP P 1 then P a(x) -→ π P with P 1 ∼ (νx)(y/x | [[P ]]).
Moreover, protected labels are superfluous in the image of the encoding of π: if

[[P ]] {a}(y) -→ πP P 1 then [[P ]] a(y) -→ πP P 1 and if [[P ]] {a}(y) -→ πP P 1 then [[P ]] a(y) -→ πP P 1 .
Proof. Trivial, by transition induction.

In general, when inspecting processes, it is always possible to decompose a τ transition into two visible transitions. In an asynchronous setting, we can moreover compose them back into a τ transition. Lemma 4.7.11 (Re-composition of transitions, asynchronous πP). Let P be an asynchronous πP term.

If P α(x) -→ πP β(y) -→ πP P then P [α β]τ -→ πP ∼ (νxy)(P | x/y).
This result is the πP counterpart of the similar property in Aπ (Lemma 5.3.2 in [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF]). In the proof, we use ∼ for renaming and concatenating arcs involving fresh names using Lemma 4.3.12. Lemma 4.7.12. Let P and Q be Aπ processes. Then

P π Q implies [[P ]] bn [[Q]]. Proof. We prove that P ∼ g Q implies [[P ]] ∼ [[Q]]
, where ∼ g is ground bisimilarity in the π-calculus [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF] (it is coarser than π in general, but coincides on Aπ terms).

We do so by showing that the following relation is a bisimulation up to restriction and bisimilarity:

R {([[P ]] | A, [[Q]] | A) P ∼ g Q} ,
where A is a parallel composition of arcs.

Clearly, Φ(

[[P ]] | A) = Φ(A) = ([[Q]] | A)
. Hence, we have to check the correspondences on transitions between π and πP, using Lemmas 4.7.8, 4.7.10 and 4.7.11. We analyse all possible transitions from [[P ]] | A:

1. in the case of an input transition, we have 2. Symmetrically with an output transition, adding x/y instead of y/x to A. (b) or, in two steps (we write ĉ for a set of names of size at most one, and (νĉ)P for (νc)P if ĉ = {c} and P if ĉ = ∅ and similarly for label (νĉ)ac):

[[P ]] | A α(y) -→ πP ∼ (νx)(y/x | [[P ]]) | A with P b(x) -→ π P such that A α ≺ b. We deduce from P ∼ g Q that [[Q]] b(y) -→ πP ∼ (νx)(y/x | [[Q ]]) with P ∼ g Q , so modulo ∼-

The case of a silent transition [[P ]] | A

[[P ]] a(y) -→ πP b(z) -→ πP (νĉx)(c/y | z/x | [[P ]]) P 2 P ν ĉac -→ π b(x) -→ π P such that [ϕ]τ A [a b]τ and P 1 ∼ (νyz)(P 2 | y/z).
We can again play the ground bisimilarity game, first with transition νĉ ac and then with transition

b(x) to get Q ν ĉac -→ π b(x)
-→ π Q with P ∼ g Q . Using Lemma 4.7.10 we obtain two transitions along a(y) and b(z) from [[Q]], which we compose with Lemma 4.7.11 to get

[[Q]] | A [a b]τ -→ πP (νyz)(νĉx)((z/x | c/y | [[Q ]]) | y/z). Bisimilarity can be used to finally rewrite processes related through R ν : νyzĉx([[P ]] | A ) R ν νyzĉx([[Q ]] | A ) with A = A | c/y | y/z | z/x.
We get back the [ϕ]τ transition using Lemma 4.5.23 and use ∼-rewriting again to push the additional ϕ into A .

Relation R is symmetric, and thus R is a bisimulation up to restriction and bisimilarity; we conclude by Lemma 4.5.32.

Theorem 4.7.13 (Full abstraction for the asynchronous π-calculus). Suppose P, Q are Aπ processes. Then

P π Q iff [[P ]] bn [[Q]].
Proof. Follows from Lemmas 4.7.9 and 4.7.12.

In the theorem, π is barbed congruence in the full π-calculus, as opposed to asynchronous barbed congruence, where output barbs are observable but input barbs are not. It can be proved that in a π-calculus with neither replication nor choice, asynchronous and synchronous barbed congruence coincide, and hence the theorem holds also under asynchronous barbed congruence.

Theorem 4.7.13 (and the results on types) shows that πP, although syntactically similar to fusions, is closer to the π-calculus in the management of names.

Discussion. We do not know whether full abstraction holds for the encoding of the full π-calculus. More precisely, if the source calculus features replication or the choice operator, full abstraction would break at least for ground, early and late bisimilarities. The situation is less clear for open bisimilarity.

Regarding translations in the opposite direction, both for fusion calculi and for πP, the encoding into π is not possible in general. Under some conditions, an arc a/b can be encoded as the π-calculus process !b(x).ax, called a forwarder from b to a. For this encoding to work, two constraints on the source calculus are necessary: asynchrony (all outputs have 0 as continuation) and locality (a name that has negative occurrences may not occur as subject of an input; in the π-calculus, this may be rephrased by saying that a name bound by an input may not occur as subject of an input). M. Merro presents in [START_REF] Merro | Locality in the pi-calculus and applications to distributed objects[END_REF] an encoding of the asynchronous monadic fusion calculus into Aπ. Such an encoding for πP would probably bear some resemblance to an encoding of the calculus obeying constraints of asynchrony and locality into ALπ, the asynchronous localised π-calculus [START_REF] Merro | Locality in the pi-calculus and applications to distributed objects[END_REF].

Unique negative occurrences of names

In this section we consider a constrained version of the calculi discussed until now, where each name may have at most one negative occurrence in a process. In the fusion calculus [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF] the constraint means that each name appears at most once as the object of an input. In πP, the constraint affects also arcs, as their source is a negative occurrence. We call πP1 and FU1 the constrained versions of πP and fusions. (Note that in the case of a calculus with replications, if a free name of P appears negatively in P , then !P does not qualify as a constrained process.)

It is also possible to adapt this constraint to explicit fusions. This requires, given a process P of explicit fusions, to assign a "polarisation", for each explicit fusion a=b occurring in P , whereby either a or b is considered as negative. Then P belongs to the constrained explicit fusion calculus if every name occurs at most once in negative position, either as an input object or in the negative side of an explicit fusion construct. Structural congruence has to be slightly adapted, as the reflexivity law a=a ≡ 0 does not preserve the constraint. In fact, removing it is enough, since it has no effect on the induced equivalence, since symmetry and transitivity are still derivable without it, and since, interestingly, the other laws preserve the constraint, in particular P | a=b ≡ P {b/a} | a=b, even if it might change the polarisation of the fusion a=b. We call the resulting calculus EF1.

The constraint is rather draconian, bringing the calculi closer to the π-calculus, where the constraint is enforced by having binding input. It may be remarked that when encoding the π-calculus in πP (see Section 4.7.2), the image is included in πP1. Still, the constraint is more generous than tying the input to a binder as in π. For instance, we have more complex forms of causality involving input, as in the process νx(ax.wt | bx), where the input at a blocks the output at w, and can be triggered before or after the output at b takes place. Delayed inputs [START_REF] Merro | Locality in the pi-calculus and applications to distributed objects[END_REF] are thus simply encodable in πP1 as (νx) (ax | P ), whereas in π they represent a non trivial extension of the calculus.

In the remainder of this section, we show the consequences of imposing unique negative occurrences of names for behavioural equivalence (Section 4.8.1) and types (Section 4.8.2).

P • bn P 1 bn / k s πP1bn Q 1 bn / + 3 Q bn ea P P 1 / k s πP1bn Q 1 / + 3 Q
To prove πP1ea ⊆ πP1bn we show that πP1ea enjoys the following property of stability under by-need reductions: (←bn πP1ea ) ⊆ ( πP1ea ⇐= bn ). Suppose that P πP1ea Q and P -→ bn P which implies by Lemma 4.3.4 that P =⇒ ea P . This allows us to draw the πP1ea diagram, to get

Q =⇒ ea Q such that P πP1ea Q . Since -→ ea = ( • -→ ∪ / -→) and • -→ ⊆ -→ bn , we deduce =⇒ ea ⊆ (-→ bn ∪ / -→)
P πP1ea Q πP1ea Q implies P πP1ea Q . P bn P ea πP1ea Q ea Q bn P P πP1ea Q Q / πP1ea k s
We thus proved that the reduction diagrams for πP1ea and πP1bn can be related. Properties involving context closure and barbs correspond to each other in the eager and by-need cases, so that πP1ea = πP1bn .

It also appears that the calculi πP1 and FU1, defined by the constraint on unique negative occurrence of names, are behaviourally close. For instance, in πP1 the direction of arcs is irrelevant (that is, arcs behave like explicit fusions), as shown by the following law (where we omit the subscripts 'ea' and 'bn' in the light of Theorem 4.8.2). Note that due to the constraint, the processes in Lemma 4.8.3 must be compared in contexts where a and b only occur positively.

We now prove that contextual equivalences in EF1 and πP1 coincide. For this, when P ∈ πP1, we write P ∈ EF1 for the canonical projection of P in EF1. We moreover refine the behavioural equivalences as follows: we write P N πP1 Q iff P πP1 Q and all names which occur free in negative position in P and Q belong to the set of names N . Moreover, when closing by contexts in checking N πP1 , we impose that contexts cannot use names in N in negative position.

Relation ∼ = N EF1 is defined along the same lines; for context closure, we impose that there exists a polarisation of each fusion construct such that the constraints about N and about uniqueness of negative occurrence are satisfied. Lemma 4.8.4. For all N , if all names occurring free in negative position in P and Q belong to N , we have

P N πP1 Q iff P ∼ = N EF1 Q.
For example Lemma 4.8.3 equivalently states that a/b {a,b} πP1 b/a.

Proof. We prove the two implications:

• {(P, Q) | P ∼ = N EF1 Q} ⊆ N πP1 for all N : -context closure: if C is a πP1 context without negative occurrence in N , there exists a EF1 context C such that C[R] = C[R]
and there is a trivial polarisation of C such that no name having a negative occurrence in C is in N . Then if we write N C for the names occurring free in negative position in C, we have that * if P -→ πP P then P → EF P (indeed if P a b then P a = b) * if P → EF P 1 then for some P , P → πP P and P 1 = P (indeed if P a = b then P a b since P ∈ πP1) -the above two results allow us to deduce barb preservation. context closure: if there some EF1 context C without negative occurrence in N , then for some πP1 context D we know that: for all R ∈ πP1 such that names that have a negative occurrence in R are in

C[P ] ∼ = N ∪N C EF1 C[Q],
• {(P 1 , Q 1 ) | P 1 ↔ = P ∧ Q 1 ↔ = Q ∧ P N πP1 Q} ⊆ ∼ = N EF1 for
N , D[R] ↔ = C[R]. By context closure of N πP1 , we know that D[P ] N ∪N D πP1 D[Q] and hence (C[P 1 ], C[Q 1 ]) is in the relation.
reduction closure and barb preservation are handled in the same way as above (note that ↔ = is a strong bisimulation).

Capabilities and subtypes in constrained fusions

Another difference that disappears under the constraint of unique negative occurrences of names is the one regarding capabilities and subtyping. We have seen that fusion calculi cannot have the same type systems as π and πP have (Sections 3.4 and 4.2). Indeed, it is possible to equip FU1 with an I/O type system and subtyping. To achieve this, we can use exactly the rules of πP in Section 4.2-with the exception of T-ARC as FU1 does not have arcs.

To understand how I/O types work in FU1, let us analyse how the constraint on unique occurrences of negative names evolves along reductions. We first consider the following reduction step in FU1 (-→ FU1 stands for reduction in FU1):

(νc)(ab.P | ac.Q | R) -→ FU1 (P | Q | R){b/c} . (4.6)
In this reduction, only positive occurrences of c are replaced with b, since the only negative occurrence of c is in ac in the initial process. Hence, no negative occurrence of b is introduced. The other kind of reduction in FU1 is as follows (note that the restriction is now on b, and that the substitution intuitively goes in the opposite direction w.r.t. πP):

(νb)(ab.P | ac.Q | R) -→ FU1 (P | Q | R){c/b} . (4.7)
Along reduction, the negative occurrence of c in prefix ac disappears. In the original process, the only visible usage of b is in ab, which is a positive occurrence. Therefore, there is at most one negative occurrence of b in P, Q, R, hence (P | Q | R){c/b} contains at most one negative occurrence of c. The resulting process is hence a FU1 process. Finally, note that the following reduction in FU1 (the special case, when b = c) only makes prefixes disappear, and straightforwardly yields a process in FU1:

ab.P | ab.Q -→ FU1 P | Q .
Polarised narrowing (Theorem 4.2.1) holds in FU1 because every process of FU1 is also a process of πP. Regarding the Subject Reduction property, we observe that typechecking the process obtained after reduction in (4.7) may involve changing the type of name c into a smaller type: after the reduction, name c is used at type T b , which is a smaller type than the type of c. Accordingly, the statement of Subject Reduction is refined: Theorem 4.8.5. Let P be a FU1 process. If Γ P and P -→ FU1 P , then Γ P , where for at most one name c, Γ (c) ≤ Γ(c); for any other name b = c, Γ (b) = Γ(b).

Proof. By induction on -→ FU1 , only the base case is interesting (closure by contexts and structural congruence are handled by compositionality of the type system). There are two subcases, depending on whether the object being replaced is an input object or an output object.

Suppose we have the following typings in each case, which we write with additional type annotations: In the second case, we replace b with c, and assign type T b to c in the typing environment for the resulting process. This allows us to typecheck the newly created occurrences of c in the resulting process. The previously existing ones are still well-typed using positive narrowing. Remark 4.8.6. Theorem 4.8.5 does not contradict Theorems 3.4.3 and 3.4.4: the calculus obeys a syntactical constraint, which restricts the way processes can be composed. Indeed, it is not always the case that if P and Q are in FU1, then P | Q is also in FU1. Therefore, in the proof of Theorem 3.4.3, it would be impossible in general to replace a with b using contexts like (ub

| ua | -) or (ub | va | uc | vc | -), since the latter is not a FU1 context.

Conclusion

This chapter is a study of πP, covering types, strong behavioural theory, a proof system, and the relationship to other calculi and variants of πP. Several questions remain, and we discuss some of them in this section.

Typed behavioural theory

The results of Section 4.5 establish foundations for the behavioural theory of the πP calculus, and Section 4.2 studies i/o-types. These provide a basis to build a notion of typed behavioural equivalence [START_REF] Pierce | Typing and subtyping for mobile processes[END_REF][START_REF] Deng | Towards an algebraic theory of typed mobile processes[END_REF], which can be used to establish fine behavioural properties of concurrent systems, like in Section 3.3.3. This could reveal helpful to refine untyped analyses of systems where fusions have been used.

Weak behavioural theory

The first step in studying weak behavioural theory of πP is to build a the weak variant of bisimilarity in order to capture bn with a characterisation theorem similar to Theorem 4.5.38. We define the candidate relation ≈ below and we comment on it:

Definition 4.9.1. A symmetric relation R is a weak bisimulation if P R Q implies: 1. If P ϕ then Q =⇒ Q and Q ϕ for some Q such that P R Q . 2. If P α(x) -→ P , with x / ∈ fn(Q), then there is Q such that Q α(x)
=⇒ Q and P R Q ; we impose the same condition with α instead of α.

If P

[ϕ]τ -→ P then there is Q such that Q | ϕ =⇒ Q and P | ϕ R Q .
Weak bisimilarity, written ≈, is the greatest weak bisimulation. Clause 1 requires not only that Q catches up entailment P ϕ with Q ⇒ Q and Q ϕ for some Q , but also that Q is related to P in the bisimulation candidate. This is necessary, since otherwise we could prove

ϕ | a ⊕ b ≈ (ϕ | a) ⊕ (ϕ | b)
where ⊕ is the internal choice operator, whereas those two processes are distinguished by the context

[•] | [ϕ]τ.(a | b).
Note that iterating clause 1, and using the fact that conditions are persistent, we get that if R is a weak bisimulation and if P R Q then there is a Q such that P R Q and Q =⇒ Q with Φ(P ) ⊆ Φ(Q ). Iterating this remark (on P , then on Q , and so on, as long as Φ(P ) = Φ(Q )-which terminates since the number of entailed conditions that are not reflexive is bounded5 ) we can prove that if P R Q then for some P and Q , we have P R Q with P =⇒ P and Q =⇒ Q such that Φ(P ) = Φ(Q ).

Clause 3 could have been of the form

Q [ϕ]τ =⇒ Q (or Q =⇒ Q when ϕ is
reflexive), but this would have been too strong a requirement since Q must be able to answer with no transition at all. The problem is revealed when we want the law τ ≈ 0: τ can make a [ϕ]τ transition, whereas 0 cannot.

To reach a characterisation of bn , the soundness of bisimilarity seems achievable and does not depend on which sub-calculus we are considering. On the contrary, to show completeness, we need to use some tester processes. To test visible transitions (clause 2) and those with labels of the form [ϕ]τ (clause 3), the usual tester processes are enough. To test clause 1, of course, the tester process [ϕ]τ.(w | w) is enough to conclude the proof and reach a characterisation (≈) = ( bn ).

However, if there is no prefix [ϕ]τ in the calculus considered, the situation is more complicated6 . Suppose that we have now a replication operator, and consider process M below:

M !(νx)(ax | bx) | !(νx)(ax | bx) .
We can prove that M bn M | a b, whereas there is no M for which M =⇒ M a b. This problem was in fact already present in the explicit fusion calculus (M ef M | a=b), but not in implicit fusions. Indeed the equivalent of a=b is (u)(ua | ub) for which there is no special clause in the bisimulation. And indeed, there is a weak behavioural theory for implicit fusions, together with the corresponding axiomatisation [START_REF] Parrow | The tau-laws of fusion[END_REF]. This motivates an implicit presentation of πP, which we discuss below.

Implicit πP

We do not see any natural "implicit" version of πP, mimicking the relation between explicit fusions and implicit fusions, whereby the extension of the preorder along a communication would not generate an arc process. One approach-that might have worked if one wanted to derive the implicit fusion calculus from explicit fusions-would be to require at least to have some processes f (P ) and g(P ) such that:

(νa)(ca | cb.P ) -→ f (P ) (νa)(ca | cb.P ) -→ g(P ) ,
where f and g should be compositional functions satisfying the following equations:

f (P ) ∼ (νa)(b/a | P ) g(P ) ∼ (νa)(a/b | P ) .
This would imply in particular (using in particular the expansion law and law L25):

f (a) ∼ b f ({a}) ∼ 0 f (a | {a}) ∼ b + τ ∼ f (a) | f ({a}) . Similarly, g(a | a) ∼ g(a) | g(a)
. Therefore, it is not straightforward to give a compositional description of f (P | Q) and g(P | Q) in terms of P and Q, because of the possible interactions between P and Q on channel a.

Chapter 5

Bisimulation enhancements for higher-order languages

Previous chapters showed that bisimulation, when proved sound, is an efficient proof method to capture barbed congruences for a given calculus L: to prove P L Q, one exhibits a relation containing the pair (P, Q) and then proves it to be a bisimulation. This proof method can be enhanced by employing relations called 'bisimulations up to' [START_REF] Lenisa | Themes in Final Semantics[END_REF][START_REF] Pous | Enhancements of the bisimulation proof method[END_REF][START_REF] Rot | Coalgebraic bisimulation-up-to[END_REF]. These need not be bisimulations; they are simply contained in a bisimulation. Such techniques have been widely used in languages for mobility such as the π-calculus or higher-order languages such as the λ-calculus, or Ambients (e.g., [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF][START_REF] Merro | Behavioral theory for mobile ambients[END_REF][START_REF] Lassen | Relational reasoning about contexts[END_REF], as well as in Section 4.5).

This chapter contributes to improve these techniques and their usability. It is independent from Chapters 3 and 4, apart from Section 5.2.2.4. Several forms of bisimulation enhancements have been introduced: 'bisimulation up to bisimilarity' [START_REF] Milner | Communication and Concurrency[END_REF] where the derivatives obtained when playing bisimulation games can be rewritten using bisimilarity itself; 'bisimulation up to transitivity' where the derivatives may be rewritten using the up-to relation; 'bisimulation up to context' [START_REF] Sangiorgi | On the bisimulation proof method[END_REF], where a common context may be removed from matching derivatives. Further enhancements may exploit the peculiarities of the definition of bisimilarity on certain classes of languages: e.g., the up to injective substitution techniques of the π-calculus [JR99, SW01], techniques for shrinking or enlarging the environment in languages with information hiding mechanisms (e.g., existential types, encryption and decryption constructs [START_REF] Abadi | A bisimulation method for cryptographic protocols[END_REF][START_REF] Sumii | A bisimulation for type abstraction and recursion[END_REF][START_REF] Sumii | A bisimulation for dynamic sealing[END_REF]), frame equivalence in the psi-calculi [START_REF] Pohjola | Bisimulation up-to techniques for psi-calculi[END_REF], or higher-order languages [START_REF] Lassen | Relational Reasoning about Functions and Nondeterminism[END_REF][START_REF] Koutavas | Small bisimulations for reasoning about higher-order imperative programs[END_REF]. Lastly, it is important to notice that one often wishes to use combinations of up-to techniques. For instance, up to context alone does not appear to be very useful; its strength comes out in association with other techniques, such as up to bisimilarity or up to transitivity. For example, in Section 4.5 up to bisimilarity and up to bisimilarity and restriction are used (Definitions 4.5.27 and 4.5.31), but up to restriction alone is not.

The main problem with up-to techniques is proving their soundness (i.e. ensuring that any 'bisimulation up to' is contained in bisimilarity). In particular, the proofs of complex combinations of techniques can be difficult or, at best, long and tedious. And if one modifies the language or the up-to technique, the entire proof has to be redone from scratch. Indeed the soundness of some up-to techniques is quite fragile, and may break when such variations are made. For instance, in certain models up to bisimilarity may fail for weak bisimilarity, and in certain languages up to bisimilarity and context may fail even if bisimilarity is a congruence relation and is strong (treating internal moves as any other move).

This problem has been the motivation for the development of a theory of enhancements, summarised in [START_REF] Pous | Enhancements of the bisimulation proof method[END_REF]. Expressed in the general theory of fixed points in complete lattices, this theory has been fully developed for both strong and weak bisimilarity, in the case of first-order labelled transition systems (LT-Ses) where labels are simple syntactic objects. In this framework, up-to techniques are represented using compatible functions, whose class enjoys nice algebraic properties. This allows one to derive complex up-to techniques algebraically, by composing simpler techniques by means of a few operators.

Only a small part of the theory has been transported onto other forms of transition systems, on a case by case basis, for instance those needed in the π-calculus, or in higher-order formalisms. These techniques have been developed in a 'by-need' fashion: one has concrete bisimilarity proofs to carry out, and ensures the soundness of the up-to techniques employed in such proofs. Transferring the whole theory of bisimulation enhancements outside the realm of first-order transition systems would be a substantial and non-trivial effort. Moreover it might have limited applicability, as this work would probably have to be based on specific shapes for transitions and bisimilarity (a wide range of variations exist, e.g., in higher-order languages). This chapter tackles this problem. We explore here a different approach to the transport of the theory of bisimulation enhancements onto richer languages. The approach consists in exhibiting fully abstract translations of the more sophisticated LTSes and bisimilarities onto first-order LTSes and bisimilarity. This allows us to import directly the existing theory for first-order bisimulation enhancements onto the new languages. Most importantly, the schema allows us to combine up-to techniques for the richer languages. The only additional ingredient that has to be provided manually is the soundness of some up-to techniques that are specific to the new languages. This typically includes the up to context techniques, since those contexts are not first-order.

We consider four languages: the π-calculus, the call-by-name λ-calculus, an imperative call-by-value λ-calculus (a call-by-value λ-calculus with references), and the Higher-Order π-calculus.

We moreover focus on weak bisimilarity, since its theory is more delicate than that of strong bisimilarity (e.g., the congruence properties) and these differences are magnified in theories of enhancements of the bisimulation proof method. When we translate a transition system into a first-order one, the grammar for the labels can be complex (e.g. include terms, labels, or contexts). What makes the system 'first-order' is that labels are taken as syntactic atomic objects, that may only be checked for syntactic equality. Note that full abstraction of the translation does not imply that the up-to techniques come for free: further conditions must be ensured. We shall see this with the π-calculus, where early bisimilarity can be handled (Section 5.2.1) but not the late one (Section 5.2.2.2).

Forms of up to context have already been derived for the languages we consider [Las98a, SW01, SKS11]. The corresponding soundness proofs are difficult (especially in λ-calculi), and require a mix of induction (on contexts) and coinduction (to define bisimulations). Recasting up to context within the theory of bisimulation enhancements has several advantages. First, this allows us to combine this technique with other techniques, directly. Second, substitutivity (or congruence) of bisimilarity becomes a corollary of the compatibility of the up to context function (in higher-order languages these two kinds of proofs are usually hard and very similar). And third, this allows us to decompose the up to context function into smaller pieces, essentially one for each operator of the language, yielding more modular proofs, also allowing, if needed, to rule out those contexts that do not preserve bisimilarity (e.g., input prefix in the π-calculus).

Section 5.1 recalls the ingredients we need from the theory of bisimulation enhancements, together with some other basic tools we introduce for the remaining of the chapter. Section 5.2 presents the translation of the π-calculus capturing early bisimilarity, with the corresponding up to context techniques. We also give an account for other bisimilarities. Section 5.3 is the translation of the call-by-name λ-calculus, through environmental bisimilarity, again with up to context techniques. Section 5.4 does the same for the imperative λ-calculus and provides examples of bisimulations up to using combinations of up-to techniques. Section 5.5 gives, with fewer details, LTSes for some other calculi.

Background: a theory of bisimulation enhancements

This section is largely inspired by Chapter 6 of [START_REF] Pous | Enhancements of the bisimulation proof method[END_REF], which is an evolution from [START_REF] Pous | Techniques modulo pour les bisimulations[END_REF], the latter also handling a more abstract theory. Most proofs in this section are rather easy and abstracted to a latticetheoretic level.

To clarify the meaning of 'first order', we give a more formal definition of first-order Labelled Transition System, or simply LTS. An LTS a triple (Pr, Act, -→) where Pr is a non-empty set of processes, Act is the set of A pleasant consequence of compatibility is the substitutivity property: Lemma 5.1.9. Suppose f and b are monotone. Then if f is b-compatible then f (gfp(b)) ⊆ gfp(b).

In the particular case where b = b and f is a closure operation, Lemma 5.1.9 states that bisimilarity is closed by f . This is especially useful if f is the context closure function C: the compatibility of C implies both the soundness of any combination of the up to context technique with other compatible functions, and the congruence of bisimilarity. This considerably reduces the proof effort, getting two important properties with one, typically short, proof. Indeed, proving compatibility is usually straightforward, when the result holds (there are not a lot of choices, compared to soundness proofs). A good example is the environmental bisimilarity in λ-calculi, for which proofs of soundness of up to context techniques have lengthy common parts with proofs of congruence [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF].

Proofs of compatibility themselves contain case analyses that one would like to split into several independent results. Unfortunately, they often depend on each other. The definition of compatibility can be refined even further to take this into account: Definition 5.1.10 (Evolution). We say that f evolves to g through b, written f

b g, when f • b ⊆ b • g.
One can read b as a dependency: if g is compatible and f b g then f would be included into a compatible function (f ∪ g where ∪ is lifted to pointwise union), which would imply the desired properties of soundness and substitutivity. Since evolution behaves well with respect to union and composition, and compatibility corresponds to a function evolving to itself, these "dependencies" can have cycles. This is clarified and formalised in the following lemma:

Lemma 5.1.11. Suppose b is monotone, and F is a set of monotone functions. Let u F . Suppose that for all f in F we have f b u ω . Suppose that u ω is idempotent. Then u ω is b-compatible. This concludes the induction. We can deduce from this that n∈N (u n • b) ⊆ b • u ω which we rewrite to

Proof. We know that f • b ⊆ b • u ω for all f ∈ F , hence f ∈F (f • b) ⊆ b • u ω , which we can rewrite to u • b ⊆ b • u ω . From
u ω • b ⊆ b • u ω , hence u ω is b-compatible.
Remark 5.1.12 (Conditions for idempotence). The condition of u ω being idempotent (u ω • u ω = u ω ) is equivalent to u • u ω ⊆ u ω . When proving this inclusion in a lattice-theoretic setting, one would like to have the hypothesis that each function f in F preserves joins (i.e. unions). Unfortunately, in a powerset lattice, those functions are degenerate: since every subset is the union of its singletons, a join-preserving function f can be described in a pointwise manner:

f (R) = f x∈R {x} = x∈R f ({x}) .
Indeed, there are important compatible functions that do not preserve joins. In fact, a weaker equation makes for a better condition. We say a function f on powersets is continuous if it is characterised by its image on finite subsets, i.e.:

f (R) = X∈P fin (R) f (X) (5.2)
where P fin (R) is the set of finite subsets of R. This is exactly equivalent to f being Scott-continuous in the subset partial order in a powerset. (Scott continuity is usually formulated in other terms [START_REF] Amadio | Domains and Lambda-calculi[END_REF], but in powersets, we prefer (5.2) which is more obvious to check.) The class of continuous functions is closed under composition, intersection, arbitrary union and-when the powerset is the set of relations-under relational composition. In addition, if f is continuous, then f is monotone and f ω is idempotent. Another formulation of (5.2) is that (P, Q) ∈ f (R) iff there are pairs (P 1 , Q 1 ) ∈ R, . . . , (P n , Q n ) ∈ R such that (P, Q) ∈ f ({(P 1 , Q 1 ), . . . , (P n , Q n )}). Using this formulation, it is clear that functions with inductive definitions of the form:

"if P 1 R Q 1 and P 2 R Q 2 then (P 1 | P 2 ) f (R) (Q 1 | Q 2 )" "if P R Q then for all R we have (P | R) f (R) (Q | R)"
are continuous, as most of the functions we are considering in this chapter. We see that the number of "requests" on R is bounded for a given pair (P, Q). Continuity does not, however, authorise an infinite number of such requests (this could make f ω not idempotent). For example, the function defined by

"if ∀R ∈ A (P | R) R (Q | R) then P f (R) Q" is not continuous if A is infinite (it is if A is finite for all P and Q).
Continuity allows us to find the compatible function with a relatively simple expression: if f b (∪F ) ω then the b-compatible function containing all f s is (∪F ) ω , assuming the other hypotheses of Lemma 5.1.11. This is interesting, as (∪F ) ω coincides with interesting functions (for example, context closure). If we do not care about the shape of the compatible function, we can drop the idempotence condition, and know that f is included in some compatible function, obtained by an omega-iteration of order two. Omega-iteration being a function on functions on relations, we say informally that it is a function "of order two". We can reason about such functions: the following lemma shows that omega-iteration is "compatible" in a second-order sense, which simply means that it preserves evolutions. Proof. We take for g the monotone function f , where

f n∈N f n f 0 f f n+1 (f n ) ω ,
and we show that

f is b-compatible, i.e. f • b ⊆ b • f , for which it is enough to show that f n • b ⊆ b • f for all n.
By monotonicity of b, we prove in fact that Note that each f n is monotone since • ω preserves monotonicity, and hence f is monotone as well.

f n • b ⊆ b • f n+1 (i.e. f n b f n+1 ) by induction on n. • f 0 b f 1 is f b f ω (our hypothesis). • if f n b f n+1 then f ω
We recall here the example of CCS [START_REF] Pous | Enhancements of the bisimulation proof method[END_REF], which is a particularly nice example where the up to context function can be decomposed using one function per operator of the calculus. The up to context function is the context closure function C, defined as follows:

C : R → {(C[ P ], C[ Q]) C is a CCS context and P R Q} .
We will use in the following a different-inductive-presentation of the same definition:

P R Q C is a CCS context C[ P ] C(R) C[ Q] .
Since arities are finite, defining functions this way makes it obvious that they are continuous, in light of Remark 5.1.12.

To prove the compatibility of C directly, one needs to analyse the transitions of C[ P ], which usually involves an induction on C, and some amount of proof redundancy. Another way is to say that contexts can be decomposed into the following initial contexts, each being a polyadic context corresponding to one operator, or just simply a hole:

[•] 1 0 [•] 1 | [•] 2 (νa)[•] 1 a.[•] 1 a.[•] 1 ![•] 1 [•] 1 + [•] 2
Each initial context induces a function on relations. For example, [•] 1 induces id : R → R. We explicit the seven other functions below, one for each form of context:

0 C 0 (R) 0 P R Q a ∈ N (νa)P C ν (R) (νa)Q P R Q a ∈ N a.P C o (R) a.Q P R Q a ∈ N a.P C i (R) a.Q P R Q !P C ! (R) !Q P 1 R Q 1 P 2 R Q 2 P 1 | Q 2 C | (R) Q 1 | Q 2 P 1 R Q 1 P 2 R Q 2 P 1 + Q 2 C + (R) Q 1 + Q 2
Let F be the set of these functions: F {id, C 0 , C ν , C o , C i , C ! , C | , C + }. By structural induction on the context C, we can prove that C is included in (∪F ) ω , which means that C = (∪F ) ω (the other inclusion holds since C is idempotent). It is possible to establish the b-compatibility of C by proving the following evolutions:

C 0 b id C ν b C ν C o b C o ∪ id C i b C i ∪ id C | b C | C + b C + ∪ id C ! b C ω | • (C ! ∪ id)
and then invoking Lemma 5.1.11. In addition, each of these functions is wb-compatible up to, except C + (since ≈ is not preserved by sum contexts, for the reasons explained in Section 2.1.5).

The π-calculi

We define here a translation of the π-calculus LTS into a first-order LTS that follows the schema of abstract machines for the π-calculus (e.g., [START_REF] Turner | The polymorphic pi-calculus: Theory and Implementation[END_REF]) in which the issue of the choice of fresh names is resolved by ordering the names and indexing the processes with a name that represents an upper bound to the names occurring in the process. In this way, early bisimilarity is the easiest style of bisimilarity to capture, but we discuss also the other styles (ground, late, open).

Early bisimilarity

We consider the early transition system defined in Section 2.2. In the bound output label a(b), name b is a binder for the free occurrences of b in P and, as such, it is subject to α-conversion. The definition of bisimilarity takes α-conversion into account. The clause for bound output of strong early bisimilarity (Definition 2.2.3) says that:

1. if P a(b) -→ π P and b / ∈ fn(Q) then Q a(b) -→ π Q for some Q such that P ∼ Q .
This means that the LTS is not first-order, as demanding syntactic equality between labels is not enough to ensure the freshness of b.

When translating the π-calculus semantics to a first-order one, α-conversion and the condition b / ∈ fn(Q) have to be removed. To this end, one has to force an agreement between two bisimilar processes on the choice of the bound names appearing in transitions. We obtain this by considering named processes (c, P ) in which c is bigger than or equal to all names in P . For this to make sense we assume an enumeration of the names and use ≤ as the underlying order, and c + 1 for name following c in the enumeration; for a set of names N , we also write c ≥ N to mean c ≥ a for all a ∈ N . The state space Pr is now instantiated with the set named processes:

Pr = {(c, P ) | fn(P ) ≤ c}
The rules in Figure 5.3 define the translation of the π-calculus transition system to a first-order LTS. In the first-order LTS, the grammar for labels (Act) is the same as that of the original LTS:

Act : µ ::= τ ab ab a(b)
However, for a named process (c, P ) the only name that may be exported in a bound output is c + 1; similarly only names that are below or equal to c + 1 may be imported in an input transition. (Indeed, testing for all fresh names b > c is unnecessary, doing it only for one (b = c + 1) is enough.) This makes it possible to use the ordinary definition of bisimilarity for first-order LTS, and thus recover the early bisimilarity on the source terms. Each rule of Figure 5.3 has, as its main premise, a

• -→ π -transition, using the LTS for π defined in Figure 2.1. Note that one could also build directly an equivalent LTS directly on named processes without using • -→ π , but the correspondence is more clear this way.

This approach also allows us to consider extensions of π that can be described with the same kind of transitions. In fact, in the following, we will handle the π-calculus with choice and replication (Figure 2.1 augmented with the rules from (2.6) and (2.7) (Section 2.1.5)). We write π 1 for the first-order LTS derived from the translation of the π-calculus in Figure 5.3. Although the labels of the source and target transitions have a similar shape, the LTS in π 1 is first-order because labels are taken as purely syntactic objects (without α-conversion). We relate strong and weak early bisimilarities ∼ e and ≈ e to strong and weak standard bisimilarities in π 1 : Theorem 5.2.1. Let P and Q be processes of π. Assume c ≥ fn(P ) ∪ fn(Q). Then we have:

• P ∼ e Q iff (c, P ) ∼ (c, Q), and
• P ≈ e Q iff (c, P ) ≈ (c, Q).
Proof. We prove the case of weak bisimilarity, the strong case being slightly easier. The following relation:

(c, 0) C 0 (R) (c, 0) (c, P ) R (c, Q) c ≥ a, b ∈ N (c, ab.P ) C o (R) (c, ab.Q) (c, P ) R (c, Q) a ∈ N (c, (νa)P ) C ν (R) (c, (νa)Q) (c, P ) R (c, Q) (c, !P ) C ! (R) (c, !Q) (c, P 1 ) R (c, Q 1 ) (c, P 2 ) R (c, Q 2 ) (c, P 1 | P 2 ) C | (R) (c, Q 1 | Q 2 ) (c, P 1 ) R (c, Q 1 ) (c, P 2 ) R (c, Q 2 ) (c, P 1 + P 2 ) C + (R) (c, Q 1 + Q 2 )
Bisimilarity in the π-calculus is not preserved by input prefix. However, a weaker implication, requiring that the processes are bisimilar for every instantiation of the object, holds: (where = can be ∼ e or ≈ Proof. We establish an evolution for each function. The proofs largely follow the ones from [START_REF] Pous | Techniques modulo pour les bisimulations[END_REF] (and corresponding to Section 5.1.1). We account for the differences, which arise when name-passing is involved.

For each context function f , we prove f b g for some g combination of context functions and of isub∪str.

For each evolution, we assume R S and R ⊆ S, and we prove f (R) g(S) (and we check that f (R) ⊆ g(S)). The following evolutions are trivial:

C 0 b id C o b C o ∪ id C + b C + ∪ id .
We give more details for the following evolutions. When proving f (R) g(S), we analyse transitions from the left-hand side, as the functions are all symmetric.

• C i b C i ∪ str Assume (d, a(b).P ) C i (R) (d, a(b).Q).
Each transition is of the form ac -→, yielding a pair (p, q) where p = (d , P {c/b}) and q = (d , Q{c/b}).

if d = c + 1 then (p, q) ∈ R by definition of C i .

if d = c then (d + 1, P {c/b}) R (d + 1, Q{c/b}) by definition of C i , and hence (p, q) ∈ str(R).

• C ν b C ν ∪ isub
The interesting case arises for transitions for which the last rule applied is the extrusion rule: (c, (νd)P ) a(b) -→ (b, P {b/d}) with b = c + 1 and P ad -→ π P . The problem is to relate (b, P {b/d}) to (b, Q {b/d}) knowing that (c, P ) S (c, Q ), which is done using the isub function with the injective substitution {b/d} : c → b.

• C | b N • C | • isub, where N (str • C ν ) ∪ id.
We know that the transition involves only (c, P i ) µi -→ (b i , P i ) with b i = c, we progress to C | (R ∪ S) = C | (S), using the fact that id ⊆ N and id ⊆ isub with a proof similar to the one of [START_REF] Pous | Techniques modulo pour les bisimulations[END_REF]. Otherwise, if one or two of the b i is c + 1, some work is needed. There are two cases:

-The last rule is a parallel rule, from P 1 (P 2 being symmetric), with a label of the form a(b). We know (c, P 1 ) R (c, Q 1 ) and (c, P 2 ) R (c, Q 2 ) and, say:

P 1 a(b) -→ π P 1 P 1 | P 2 a(b) -→ π P 1 | P 2 b / ∈ fn(P2)
We have b = c + 1, following the rule for bound output. We get the following reductions in π 1 , from (c, P 1 ), and (c, Q 1 ) using the progression R S:

(c, P 1 ) a(b) -→ (b, P 1 ) (c, Q 1 ) a(b) -→ (b, Q 1 )
With (b, P 1 ) S (b, Q 1 ). We now need to relate the resulting processes:

(b, P 1 ) S (b, Q 1 ) (b, P 1 ) isub(S) (b, Q 1 ) (c, P 2 ) R (c, Q 2 ) (c, P 2 ) S (c, Q 2 ) (b, P 2 ) isub(S) (b, Q 2 ) (b, P 1 | P 2 ) (C | • isub)(S) (b, Q 1 | Q 2 )
.

The same happens for the input transition ab -→ when b = c + 1.

-The last rule is a closing rule: we know (c, P 1 ) R (c, Q 1 ) and (c, P 2 ) R (c, Q 2 ) and, say:

P 1 a(b) -→ π P 1 P 2 ab -→ π P 2 P 1 | P 2 τ -→ π (νb)(P 1 | P 2 ) b / ∈ fn(P2)
In fact, we can assume b = c + 1 as b is fresh on both sides. The two hypotheses can then be transformed into transitions in π 1 :

(c, P 1 ) a(b) -→ (b, P 1 ) (c, P 2 ) ab -→ (b, P 2 ) .
We have the same transition for Q 1 and Q 2 . Using the hypothesis R S, we get named processes (b, Q 1 ) and (b, Q 2 ), related through S, which we can combine using the context functions:

(b, P 1 ) S (b, Q 1 ) (b, P 2 ) S (b, Q 2 ) (b, P 1 | P 2 ) C | (S) (b, Q 2 | Q 1 ) (b, (νb)(P 1 | P 2 )) C ν (C | (S)) (b, (νb)(Q 2 | Q 1 )) (c, (νb)(P 1 | P 2 )) str(C ν (C | (S))) (c, (νb)(Q 2 | Q 1 ))
.

Finally C | (R) progresses to str(C ν (C | (S))) in the case of a closing transition. Note that for the communication rule, the progression goes to C | (S). The same happens when only P 1 or P 2 is moving, using the fact that R ⊆ S.

Proof. The progressions are as in the proof of Theorem 5.2.5, except that general choice is not compatible in the weak case, and we need one more up-to technique for the case of the replication. The proofs of the following progressions are similar the corresponding ones in the proof of Theorem 5.2.5, except for C g+ which is new but is treated as C o and C i .

C 0 wb id C o wb C o ∪ id C i wb C i ∪ str C ν wb C ν ∪ isub C g+ wb C g+ ∪ str C | wb N • C | .
For the replication operator, only case 1 of the corresponding proof cannot be transported to the weak case.

We have: We use the fact that R w S to get from (c,

P ) R (c, Q) that (c, Q) τ -→ n (c, Q 0 ). Then • if n > 0 we have (c, !Q) =⇒ (c, !Q | Q 0 | . . . | Q)
and we conclude as before.

• if n = 0 then there is no transition from Q or !Q, we know P 0 S Q but we cannot reach the desired form Compared to the strong case, we only need to compose (on the left) the right-hand side of the evolution with R → ∼R∼. Note that all the functions are continuous (R → ∼R∼ is even pointwise defined), so the omega-iteration of their union is idempotent as desired.

(c, !Q | Q | . . . | Q) with a transition. Instead, we remark that (c, !Q) ∼ (c, !Q | Q | . . . | Q) and
The compatibility of these functions does not follow from results of up to context techniques in the πcalculus; instead, above, we prove them from scratch, with the benefit of having a separate proof for each initial context.

As a byproduct of the compatibility up to of these initial context functions, and using Lemma 5.1.8, we derive the standard substitutivity properties of strong and weak early bisimilarity, including the rule (5.4) for input prefix.

Corollary 5.2.7. In the π-calculus, relations ∼ e and ≈ e are preserved by the operators of output prefix, replication, parallel composition, restriction; ∼ e is also preserved by sum, whereas ≈ e is only preserved by guarded sums. Moreover, rule (5.4) is valid both for ∼ e and ≈ e .

Other bisimilarities in name-passing calculi

Section 5.2.1 studies the early version of the bisimilarity in the π-calculus. We examine in this section how we can recover with this method various bisimilarities in the π-calculus and other name-passing calculi.

Ground bisimilarity

The notion of early bisimulation (Definition 2.2.3) can be weakened to ground bisimulation, where there is no possible aliasing when dealing with inputs, since we only need to test one (fresh) object: Definition 5.2.8 (Ground bisimilarity in π). A relation R on π-calculus processes is a strong ground bisimulation if, whenever P R Q:

1. if P a(b) -→ π P and b / ∈ fn(Q) then Q a(b) -→ π Q for some Q such that P R Q , 2. if P ab -→ π P and b / ∈ fn(Q) then Q ab -→ π Q for some Q such that P R Q , 3. if P µ -→ π P and µ is either ab or τ , then Q µ -→ π Q for some Q such that P R Q , 4
. the converse of (1), (2) and (3), on Q.

Ground bisimilarity, ∼ g , is the union of all ground bisimulations.

Weak ground bisimulations and weak ground bisimilarity ≈ g are defined accordingly. We just remark that the input is now treated as a bound output, and can only involve fresh names. Looking at Figure 5

∼ = ∼ g ≈ = ≈ g
A similar method can be used to tackle πI (Section 3.1).

Late bisimilarity

Late bisimilarity makes use of transitions P The usual label ab for an input is split into two labels a and b, the grammar of labels is now:

Act : µ ::= τ a b ab a(b) .
The rule for input is split into three rules: the first triggers the abstraction configuration, the second instantiates it with a new name (à la ground bisimilarity) which has been chosen beforehand (b itself), and the third aliases b with a name d below c.

P ab -→ π P (c, P ) a -→ (b)(c, P ) b = c + 1 (b)(c, P ) b -→ (b, P ) b = c + 1 (b)(c, P ) d -→ (c, P {d/b}) d ≤ c
This translation does yield full abstraction for both strong and weak late bisimilarities. However, the decomposition of an input transition into two steps prevents us from obtaining the compatibility of up to context techniques. Moreover, bisimulation candidates now contain two syntactical categories.

Open bisimilarity

Open bisimilarity [START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF] is a coinductively defined congruence in the π-calculus and does not need any closure on top of it (unlike like full bisimilarity ([SW01], Definition 2.4.13) which needs closure under substitution). This makes it a good candidate for corresponding to a first-order LTS. Open bisimulations make use of a notion of distinction, which specifies which names cannot be equated: To transform this into a first-order LTS, configurations must contain the current information of distinction D. Since the object of the bound output is still subject to a quantification, we need again the "c" of the named processes. Each of the rules follows closely the clauses of the definition of open bisimulations, so we can derive the expected full abstraction:

P ∼ D o Q iff ∃c ≥ fn(P, Q) (D, c, P ) ∼ (D, c, Q) .
We do not go into proving the compatibility of the up to context technique, but since each transition of a compound process can be decomposed into one or zero transitions from each of its parts (contrarily to the late first-order labelled transition system, where two are sometimes needed), there is room for hope.

πP

A first-order LTS for πP is trivially derived from the clauses of its bisimulation (Definition 4.5.5), and is inspired from the one for the ground bisimilarity seen in Section 5.2.2.1 to handle the bound names in input and output transitions. Labels now contain plain conditions, to test entailment directly in the LTS. We also add a special label τ that is syntactically distinct from any [ϕ]τ , to properly handle the weak behavioural theory.

Act : µ

::= ϕ α(b) α(b) [ϕ]τ τ
To ensure freshness of the bound objects, the state space consists of named πP processes:

Pr = {(c, P ) | P ∈ πP fn(P ) ≤ c} .
The set of rules, one for each label, is defined in Figure 5.5. Note that we could require n(ϕ) ≤ c when defining the transition for labels [ϕ]τ or ϕ to reduce the number of cases to check without changing the set of bisimulations. When considering strong bisimilarity, the last rule (for label τ ) can be removed. The usual up to context techniques can be defined. We add C / : R → {((c, ϕ), (c, ϕ)) | n(ϕ) ≤ c}, and we adapt C o and C i to extended bound prefixes (note that C i is simpler now), and incorporate the matching prefix [ϕ]τ with C []τ . There is no C + , but C g+ , as general sum has no precise sense in πP. Functions isub and str, with similar proofs as in π, are even more useful in πP than in π.

The progressions are more involved and use the up to ∼ technique, since we need to sometimes move around and rewrite arc processes after a [ϕ]τ transition. The set of functions isub, str, C

0 , C / , C []τ , C o , C i , C ν , C ! , C | , C + is then b-compatible up to f ∼ R → ∼R∼: isub b isub str b str • isub C 0 b C 0 C / b C / C ν b f ∼ • C ν C []τ b C []τ ∪ C | • (C / ∪ id) f b f ∪ (C ν • C | • (C / ∪ isub)) for f ∈ {C o , C i , C g+ } C | b (C | • (C / ∪ id) • str • C ν • C | ) ∪ (f ∼ • C | )
The proofs of these evolutions intensively use tools designed in Section 4.5, in particular Lemma 4.5.23 and analyses resembling the one in the proof of Lemma 4.5.34. Note that each function evolves to a composition that involves itself, this is due to the ϕ -→ transitions. Some functions need to move arcs around, so we need the f ∼ function. Remark that C ν progresses to C ν combined with f ∼ , which is consistent with the proof of Lemma 4.5.32, where proving up to restriction needs the usage of the up to bisimilarity technique.

Call-by-name λ-calculus

To study the applicability of our approach to higher-order languages, we investigate the pure call-byname λ-calculus, referred to as ΛN in the sequel.

We use M, N to range over the set Λ of λ-terms, and x, y, z to range over variables. The standard syntax of λ-terms, and the rules for call-by-name reduction, are recalled in Section 2.4. We assume the familiar concepts of free and bound variables and substitutions, and identify α-convertible terms. The only values are the λ-abstractions λx.M . In this section and in the following one, results and definitions are presented on closed terms; extension to open terms is made using closing abstractions (i.e., abstracting on all free variables). The reduction relation of ΛN is -→ n , and =⇒ n is its reflexive and transitive closure.

As bisimilarity for the λ-calculus we consider environmental bisimilarity [SKS11, KLS11], which allows a set of up-to techniques richer than Abramsky's applicative bisimilarity [START_REF] Abramsky | The lazy lambda calculus[END_REF], even if the two notions actually coincide, together with contextual equivalence. Environmental bisimilarity makes a clear distinction between the tested terms and the environment. An element of an environmental bisimulation has, in addition to the tested terms M and N , a further component E, the environment, which expresses the observer's current knowledge. When an input from the observer is required, the arguments supplied are terms that the observer can build using the current knowledge; that is, terms obtained by composing the values in E using the operators of the calculus. An environmental relation is a set of elements each of which is of the form (E, M, N ) or E, and where M, N are closed terms and E is a relation on closed values. We use X , Y to range over environmental relations. In a triple (E, M, N ) the relation component E is the environment, and M, N are the tested terms. We write M X E N for (E, M, N ) ∈ X . We write E for the closure of E under contexts. We only define the weak version of the bisimilarity; its strong version is obtained in the expected way.

Definition 5.3.1. An environmental relation X is an environmental bisimulation if 1. M X E N implies: (a) if M -→ n M then N =⇒ n N and M X E N ; (b) if M = V then N =⇒ n W and E ∪ {(V, W )} ∈ X (V and W are values);
(c) the converse of the above two conditions, on N ; 2. if E ∈ X then for all (λx.P, λx.Q) ∈ E and for all (M, N ) ∈ E it holds that P {M/x} X E Q{N/x}.

Environmental bisimilarity, ≈ env , is the largest environmental bisimulation.

For the translation of environmental bisimilarity to first-order, a few issues have to be resolved. For instance, an environmental bisimilarity contains both triples (E, M, N ), and pure environments E, which shows up in the difference between clauses (1) and (2) of Definition 5.3.1. Moreover, the input supplied to tested terms may be constructed using arbitrary contexts. This is an important difference, compared to the LTS for π.

We write ΛN 1 for the first-order LTS resulting from the translation of ΛN . The states of ΛN 1 are sequences of λ-terms in which only the last one need not be a value. We use Γ and ∆ to range over sequences of values only; thus (Γ, M ) indicates a sequence of λ-values followed by M ; and Γ i is the i-th element in Γ.

Pr = {(Γ, M ) | Γ sequence of closed values, M a closed term}
For an environment E, we write E 1 for an ordered projection of the pairs in E on the first component, and E 2 is the corresponding projection on the second component. In the translation, intuitively, a triple (E, M, N ) of an environmental bisimulation is split into the two components (E 1 , M ) and (E 2 , N ). Similarly, an environment E is split into E 1 and E 2 . We write C[Γ] for the term obtained by replacing each hole [•] i in C with the value Γ i . The labels of ΛN 1 include the special label τ , and can also be of the form i, C where i is a integer and C a multi-hole context:

Act : µ ::= τ i, C

The rules for transitions in ΛN 1 are as follows:

M -→ n M (Γ, M ) τ -→ (Γ, M ) Γ i (C[Γ]) -→ n M Γ i,C -→ (Γ, M ) (5.5)
The first rule says that if M reduces to M in ΛN then M can also reduce in ΛN 1 , in any environment. The second rule implements the observations in clause (2) of Definition 5.3.1: in an environment Γ (only containing values), the ith component of Γ (Γ i ) can be tested by supplying, as input, a term obtained by filling a context C with values from Γ itself (C must range over contexts of arity |Γ|). The label of the transition records the position i and the context chosen.

Theorem 5.3.2. Suppose M and N are closed values and E is an environment. Then:

• M ≈ env E N iff (E 1 , M ) ≈ (E 2 , N ), • E ∈ ≈ env iff E 1 ≈ E 2 .
Proof. (⇒) We show that if X is an environmental bisimulation then X 2 is a (first-order) weak bisimulation, where X 2 relates (E 1 , M ) to (E 2 , N ) when (E, M, N ) ∈ X , and E 1 to E 2 when E ∈ X . By symmetry we consider only one direction: we suppose x X 2 y and a transition x µ -→ x , and we build y such that y μ =⇒ y and x X 2 y .

1. µ = τ : then x = (E 1 , M ) τ -→ (E 1 , M ) = x with M -→ n M , and y = (E 2 , N ) with M X E N . By definition of environmental bisimulation, N =⇒ n N with M X E N and hence y =⇒ y with y = (E 2 , N ) and x X 2 y . 2. µ = i, C: then (x, y) = (E 1 , E 2 ) with E ∈ X , and x = (E 1 , P {C[E 1 ]/x}) with λx.P = (E 1 ) i and we chose y = (E 2 , Q{C[E 2 ]/x}) with λx.Q = (E 2 ) i . Then by construction, y i,C -→ y and x X 2 y because (λx.P, λx.Q) ∈ E and (C[E 1 ], C[E 2 ]) ∈ E . (⇐)
The correspondence is less direct, so instead of establishing a correspondence between weak bisimulations, we define the candidate relation on top of weak bisimilarity. The environmental relation X is defined as follows:

X {(Γ • ∆, M, N ) | (Γ, M ) ≈ (∆, N )} ∪ {Γ • ∆ | Γ ≈ ∆}
(where Γ and ∆ only contain values). We prove that X is an environmental bisimulation up to reduction [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF].

1. Suppose M X Γ•∆ N (i.e. (Γ, M ) ≈ (∆, N )). (a) if M -→ n M then (Γ, M ) τ -→ (Γ, M ) which implies (∆, N ) =⇒ (∆, N ) with (Γ, M ) ≈ (∆, N ) and hence N =⇒ n N with M X Γ•∆ N ; (b) if M = V , we want that N =⇒ n W and Γ • ∆ ∪ {(V, W )} ∈ X . Since (Γ, V ) = x i,C
-→ x for some x , this implies that (∆, N ) -→ y 2 =⇒ y 3 . Since y 1 has an i, C transition, y 1 is of the form (∆, W ) for some W . Since y 0 =⇒ y 1 and τ -→ is deterministic, we get y 0 ≈ y 1 . By transitivity of ≈, we get x ≈ y 1 and hence (Γ, V ) ≈ (∆, W ), and hence (Γ, V ) • (∆, W ) ∈ X .

(c) the converse of the above two conditions, on N , holds, as ≈ is symmetric.

2. If (λx.P, λx.Q) ∈ Γ • ∆ ∈ X and (M, N ) ∈ (Γ • ∆) , we prove that P {M/x} X Γ•∆ N ⇐= Q{N/x} for some N , using the "environmental bisimulation up to reduction" technique.

We just remark that (λx.P, λx.Q) = (Γ i , ∆ i ) for some i, and that

(M, N ) = (C[Γ], C[∆]) for some C. Then Γ i (C[Γ]) -→ n P {M/x} so Γ i,C -→ (Γ, P {M/x}) must be answered with ∆ i,C =⇒ (∆, N ) (with (Γ, P {M/x}) ≈ (∆, N )). The first transition of ∆ i,C =⇒ (∆, N ) is necessarily i,C
-→, and is deterministic, so it must come from the sequence of ∆

i (C[∆]) -→ n Q{N/x} =⇒ n N and P {M/x} X Γ•∆ N ⇐= n Q{N/x}.
Hence, X is a environmental bisimulation up to reduction, and X ⊆ ≈ env .

(The theorem also holds for the strong versions of the bisimilarities.) Again, having established full abstraction with respect to a first-order transition system and ordinary bisimilarity, we can inherit the theory of bisimulation enhancements. We have however to check up-to techniques that are specific to environmental bisimilarity. A useful such technique is 'up to environment', which allows us to replace an environment with a Theorem 5.3.8. The set {str, C, C e } is:

1. b-compatible up to the identity function.

wb-compatible up to wb

∪ f where f (R → R ) is 'up to expansion' is proved compatible in [PS12].
Proof. We only handle the weak case: the strong case is significantly easier, but hides important problems since the diagrams are symmetric. For each function f in F = {str, C, C e } we build g ⊆ (∪F ) ω such that f wb g, in separate lemmas (Lemmas 5.3.9, 5.3.10 and 5.3.11). We establish these evolutions using diagramchasing arguments: for each f in F we suppose R w S and R ⊆ S and we prove that f (R) w g(S) (we also check that f ⊆ g).

Lemma 5.3.9. str wb str ∪ str

• C • wb • f . Proof. Let (Γ, M ) R (∆, N ). We study transitions from (Γ, C v [Γ], M ), (∆, C v [∆], N ). 1. if M is not a value then (Γ, C v [Γ], M ) τ -→ x is the only transition. We know that M -→ n M and x is of the form (Γ, C v [Γ], M ), and hence (Γ, M ) τ -→ (Γ, M ). Playing the progression game R w S, we get an N such that (∆, N ) =⇒ (∆, N ) and hence (∆, C v [∆], , N ) =⇒ (∆, C v [∆], N ) with (Γ, C v [Γ], M ) str(S) (∆, C v [∆], N ). (Γ, M ) (∆, N ) (Γ, M ) (∆, N ) R S τ (Γ, C v [Γ], M ) (∆, C v [∆], N ) (Γ, C v [Γ], M ) (∆, C v [∆], N ) str(R) str(S) τ 2. If M = V is a value, we consider the transition Γ = (Γ, C v [Γ], V ) i,C -→ x = (Γ , M ) which means Γ i (C[Γ ]) -→ n M .
Depending on i, we handle the progression differently (we write n |Γ| and Γ (Γ, V )):

(a) i ≤ n or i = n + 2: then we have Γ i = Γ i with i = min(i, n + 1). We can also build a context C from the composition of

C with C v such that C[Γ ] = C [Γ ], yielding: Γ (∆, N ) ∆ (Γ , M ) (∆ , N 1 ) R S i , C i , C Γ (∆, C v [∆], N ) (∆, C v [∆], W ) ∆ (Γ , M ) (∆ , N 1 ) str(R) str(S) i, C i, C
(Note that we use "up to permutation".)

(b) i = n + 1. This time Γ i = C v [Γ]
, and hence M = C [Γ ] for some C , combining again C and C v .

We can apply Lemma 5.3.5 with Γ (Γ, V ) and (∆, N ) to get (∆, N ) =⇒ ∆ = (∆, W ) for some W with (Γ , ∆ ) ∈ wb ( S ).

Γ (∆, C

v [∆], N ) (∆, C v [∆], W ) ∆ (Γ , C [Γ ]) (∆ , C [∆ ]) str(R) str(C(wb (f (S)))) i, C i, C Indeed, Γ S 1 ∆ with S 1 wb (f (S)) so (Γ , C [Γ ]) C(S 1 ) (∆ , C [∆ ])
that C[Γ] is a value, hence C is a value context C v . 1. (Γ, C v [Γ]) i,C -→ (Γ, C v [Γ], M ). (a) If i = |Γ| + 1 then M is of the form C [Γ] and we end up in str(C(R)). (b) If i < |Γ| + 1 then Γ i (C[Γ, C v [Γ]]) -→ n M and since C[Γ, C v [Γ]] = C [Γ] for some C we get Γ i,C
-→ (Γ, M ), and similarly for ∆.

Γ ∆ (Γ, M ) (∆, N ) R S i, C i, C (Γ, C v [Γ]) (∆, C v [∆]) (Γ, C v [Γ], M ) (∆, C v [∆], N ) C(R) str(S) i, C i, C
Note that this time, we moved from C(R) to str(S).

If

b) C[Γ] = E[Γ i (C [Γ]), Γ] where Γ i (C [Γ] (
) is in evaluation position, because Γ i is in evaluation position and C[Γ] is not a value (the same holds with ∆ instead of Γ).

Then M = E[M 1 , Γ] with Γ i (C [Γ]) -→ n M 1 .
Then we can do the same with ∆ i (C [∆]) using a i, C transition, and using

C e : Γ ∆ (Γ, M 1 ) (∆, N 1 ) R S i, C i, C (Γ, E[Γ i (C [Γ]), Γ]) (∆, E[∆ i (C [∆]), ∆]) (Γ, E[M 1 , Γ]) (∆, E[N 1 , ∆]) C(R) C e (S) τ τ Lemma 5.3.11. C e wb w • (C ∪ C e ∪ str ∪ str • C) • (wb • f ∪ id).
Proof. We know (Γ, M ) R (∆, N ) and we analyse transitions from (Γ, E[M, Γ]) where M is in evaluation position.

1. If M is not a value and M -→ n M , then the only transition is

(Γ, E[M, Γ]) τ -→ (Γ, E[M , Γ]
) which is trivially answered to, using R w S, yielding processes in C e (S).

2. If M is a value V , we write Γ = (Γ, V ) and E[V, Γ] = C[Γ ] for some C. We follow an analysis similar to the one for C in Lemma 5.3.10, using weakening to remove the extra value when needed. Using Lemma 5.3.5 we get (∆, N ) =⇒ (∆, W ) ∆ such that Γ S 1 ∆ with S 1 wb (f (S)).

(a) If C[Γ ] is not a value, then:

i. if C[Γ ] τ -→ C [Γ ] with C[∆ ] τ -→ C [∆ ], then we need to relate (Γ, C [Γ ]) to (∆, C [∆ ]): Γ S 1 ∆ (Γ , C [Γ ]) C(S 1 ) (∆ , C [∆ ]) (Γ, C [Γ ]) w(C(S 1 )) (∆, C [∆ ]) ii. otherwise C[Γ ] = E 2 [Γ i (C [Γ ]), Γ ]
for some E 2 and C and the transition is of the form

(Γ, E 2 [Γ i (C [Γ ]), Γ ]) τ -→ (Γ, E 2 [M , Γ ]) which corresponds to the transition Γ i,C -→ (Γ , M ), to which RHS responds with (∆, N ) =⇒ ∆ i,C
=⇒ (∆ , N ) which allows us to close the diagram with w(C e (S)) (using w to get Γ and ∆ from Γ and ∆ ).

Γ (∆, N ) ∆ (Γ , M ) (∆ , N ) R S i, C i, C (Γ, E[V, Γ]) (∆, E[N, ∆]) (∆, E[W, ∆]) = (∆, E 2 [∆ i (C [∆ ]), ∆ ]) (Γ, E 2 [M , Γ]) (∆, E 2 [N , ∆]) C e (R) w(C e (S)) τ τ (b) or E[V, Γ] = C[Γ ] is a value C v [Γ ]
(we ignore the case where C v = [•] i for which we progress to str(S)) and the transition is

(Γ, C v [Γ ]) Γ i,C -→ (Γ , M ) with Γ i (C[Γ ]) -→ n M .
Again there are two cases depending on i:

i. if i ≤ |Γ| then Γ i (C[Γ ]) = Γ i (C [Γ ]) for some C and we use transition i, C with R w S to get (∆, N ) i,C =⇒ (∆ , N ) such that ∆ i (C[∆ ]) =⇒ n N (noting ∆ = (∆, C v [∆ ])) so we get the transition (∆, E[N, ∆]) =⇒ (∆, E[W, ∆]) = ∆ i,C =⇒ (∆ , N ). Now from (Γ , M ) S (∆ , N ) we relate (Γ, C v [Γ ], M ) to (∆, C v [∆ ], N ): (Γ , M ) S (∆ , N ) (Γ , C v [Γ ], M ) str(S) (∆ , C v [∆ ], N ) (Γ, C v [Γ ], M ) w(str(S)) (∆, C v [∆ ], N ) ii. if i = |Γ| + 1 then M = C 2 [Γ ]
for some C 2 and we can get the same transition from the RHS:

(∆, E[N, ∆]) =⇒ (∆, C v [∆ ]) i,C -→ (∆, C v [∆ ], C 2 [∆ ]
) to which we can relate (Γ , M ) in three steps:

Γ S 1 ∆ (Γ , C 2 [Γ ]) C(S 1 ) (∆ , C 2 [∆ ]) (Γ , C v [Γ ], C 2 [Γ ]) str(C(S 1 )) (∆ , C v [∆ ], C 2 [∆ ]) (Γ, C v [Γ ], C 2 [Γ ]) w(str(C(S 1 ))) (∆, C v [∆ ], C 2 [∆ ])
Once more, the compatibility up to of the up to context functions entails the substitutivity properties of environmental bisimilarity. In [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF] the two aspects (substitutivity and up to context) had to be proved -→ so R is indeed an expansion relation.

Lemma 5.3.15 is a useful term rewriting tool for bisimulation proofs, to reduce redexes in depth. Note that rewriting at toplevel corresponds to call-by-name reductions (proving -→ n ⊆ is much easier as -→ n is deterministic).

Imperative call-by-value λ-calculus

In this section we study the addition of imperative features (higher-order references, that we call locations), to a call-by-value λ-calculus. It is known that finding powerful reasoning techniques for imperative higher-order languages is a hard problem. The language, ΛR, is a simplified variant of that in [START_REF] Koutavas | Small bisimulations for reasoning about higher-order imperative programs[END_REF][START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF]. The syntax of terms, values, and evaluation contexts, as well as the reduction semantics are given in Figure 5.6. A λ-term M is run in a store: a partial function from locations to closed values, whose domain includes all free locations of both M and its own co-domain. We use letters s, t to range over stores. New store locations may be created using the operator ν M ; the content of a store location may be rewritten using set V , or read using get V (the former instruction returns a value, namely the identity I λx.x, and the argument of the latter one is ignored). We denote the reflexive and transitive closure of -→ R by =⇒ R .

Note that in contrast with the languages in [KW06, SKS11], locations are not directly first-class values; the expressive power is however the same: a first-class location can always be encoded as the pair (get , set ).

We present the first-order LTS for ΛR, and then we relate the resulting strong and weak bisimilarities directly with contextual equivalence (the reference equivalence in λ-calculi). Alternatively, we could have related the first-order bisimilarities to the environmental bisimilarities of ΛR, and then inferred the correspondence with contextual equivalence from known results about environmental bisimilarity, as we did for ΛN . We write (s; M ) ↓ when M is a value; and (s; M ) ⇓ if (s; M ) =⇒ R ↓. For the definition of contextual equivalence, we distinguish the cases of values and of arbitrary terms, because they have different substitutivity properties: values can be tested in arbitrary contexts, while arbitrary terms must be tested only in evaluation contexts-the two notions coincide on values. As in [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF], we consider contexts that do not contain free locations (they can contain bound locations). We refer to [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF] for more details on these aspects.

Definition 5.4.1.

• For values V , W , we write (s; V ) ≡ (t; W ) when (s; C[V ])⇓ iff (t; C[W ])⇓, for all location-free context C.

• For terms M and N , we write (s; M ) ≡ (t; N ) when (s; E[M ])⇓ iff (t; E[N ])⇓, for all location-free evaluation context E.

We now define ΛR 1 , the first-order LTS for ΛR. The states and the transitions for ΛR 1 are similar to those for the pure λ-calculus of Section 5.3, with the addition of a component for the store: Pr = {(s; Γ, M ) | Γ sequence of closed values, M a closed term, s a store} .

The transitions are similar too, but the visible label is adapted in two ways. First, the argument context now is a value context, since we are in a call-by-value setting. Second, we also need to add a list of value contexts to the transition, in order to account for additional store information: Act : µ ::= τ i, C v , (C 1 v , . . . , C n v ) .

The two transitions (5.5) of call-by-name λ-calculus become: The first rule is the analogous of the first rule in (5.5). The important differences are in the second rule. First, since we are call-by-value, C v now ranges over C v , the set of value contexts (i.e., contexts of the form λx.C ) without free locations. Moreover, since we are now imperative, in a transition we must permit the creation of new locations, and a term supplied by the environment should be allowed to use them. In the rule, the new store is represented by r (whose domain has to be disjoint from that of s). Correspondingly, to allow manipulation of these locations by the observer, for each new location we make set and get available, as an extension of the environment; in the rule, these are collectively written getset(r), and Γ is the extended environment. Finally, we must initialise the new store, using terms that are constructed using the extended environment Γ ; that is, each new location is initialised with a term D [Γ ] (for D ∈ C v ). Moreover, the contexts D chosen must be made visible in the label of the transition. To take care of these aspects, we view r as a store context, i.e. a tuple of assignments → D . Thus the initialisation of the new locations is written r[Γ ]; and, denoting by cod(r) the tuple of the contexts D in r, we add cod(r) to the label of the transition. Note also that, although C v and D are location-free, their holes may be instantiated with terms involving the set and get operators, and these allow manipulation of the store. Once more, on the (strong and weak) bisimilarities that are derived from this first-order LTS we can import the theory of compatible functions and bisimulation enhancements. Concerning additional up-to functions, specific to ΛR, the functions w, str, C and C e are adapted from Section 5.3 in the expected mannercontexts C v , C and E must be location-free. A further function for ΛR is store, which manipulates the store by removing locations that do not appear elsewhere (akin to garbage collection); thus, store(R) is the set of all pairs ((s r[Γ ]; Γ , M ), (t r[∆ ]; ∆ , N )) such that (s; Γ, M ) R (t; ∆, N ), and with Γ = Γ, getset(r) and ∆ = ∆, getset(r).

In practice s and t might have different domains, so we may want to have two separate r and r for the LHS and RHS, such that cod(r) = cod(r ). Instead, we chose to reason up to renaming of locations (and impose r = r ) which corresponds indeed to a compatible function. Alternatively, we can work up to ∼, since renaming locations preserves strong bisimilarity. (This case is simpler than the "up to injective substitution" technique in the π-calculus, since names appear in transitions but locations do not.) Lemma 5.4.2. The set {w, str, C e , store, C} is • b-compatible up to the identity function,

• e-compatible up to e ∪ (R → R∼).

• wb-compatible up to wb ∪ f . Proof. In each case, we apply the same methodology as in Theorem 5.3.8, with more technical details to be handled, as the store is to be accounted for. However, we provide details mainly for the evolution starting from store itself, which is the most interesting and the only one fundamentally new. We explain how the others are modified, compared to the proof of Theorem 5.3.8.

In fact, we handle store first, because of the naming convention we will use: we write Γ V for Γ, V and Γ r for Γ, getset(r). This way, when (s, Γ) i,C,cod(r) ------→ (s r[Γ r ], Γ r , M ) when (s; Γ i (C[Γ r ])) -→ R (s ; M ). Now store can be defined as (s r[Γ r ]; Γ r , M ) store(R) (t r[∆ r ]; ∆ r , N ) when (s; Γ, M ) R (t; ∆, N ). We analyse transitions of the former. Silent transitions are one again easy to handle, as the locations of M are contained in the domain of s, the other part r[Γ r ] left unchanged (progressing to store(S)). We handle now visible transitions from the LHS (then M is a value V ), labelled by µ such that µ = i, C, cod(u) for some u (we suppose for simplicity that the locations used by u are fresh). The transition satisfies: i for some i , and we can in fact run the same -→ R transition from (s, Γ V ), using label µ = i , C , cod(v) for some v and C such that:

(a) r[Γ r ] u[Γ rV u ] = v[Γ V v ] (b) C[Γ rV u ] = C [Γ V v ]
The premise of (5.7) can be rewritten to the following, with a different conclusion:

(s v[Γ V v ]; Γ V i (C [Γ V v ])) -→ R (s ; M ) (s; Γ V ) i ,C ,cod(v)
-------→ (s ; Γ V v , M ) Weak asynchronous bisimilarity ≈ a is defined similarly, replacing

Q µ -→ Q with Q μ =⇒ Q and Q τ -→ Q with Q =⇒ Q .
These asynchronous bisimilarities respectively coincide with strong and weak barbed congruence (∼ a = ACCS and ≈ a = ACCS ). Canonical examples of asynchronous equalities are: τ ∼ a τ + a.a 0 ≈ a a.a .

(5.12)

These two examples immediately show that the bisimilarities induced by the standard LTS for CCS are not coarse enough, as the right-hand sides can both perform the a input action, whereas the left-hand sides only have silent actions. However, it is possible to define an LTS with the usual processes and labels, with transitions

• -→ 1 defined as follows: Note that a -→ 1 does not have the usual meaning, it only ensures that every bisimulation is closed under contexts of the form [•] | a (this corresponds to the notion of 1-bisimulation in [START_REF] Amadio | On bisimulations for the asynchronous pi-calculus[END_REF]). This LTS induces bisimilarities that coincide with barbed congruence: ∼ 1 = ∼ a and ≈ 1 = ≈ a . The problem is that the usual up to context techniques are unsound in this setting, for example using "up to context [•] | a" would cancel the a -→ 1 transition. Using the same method as for the lambda-calculus, we can define another LTS with transitions The corresponding strong bisimilarity coincides with asynchronous strong bisimilarity: ∼ 2 = ∼ a and we have now that the usual up to context techniques are sound (for example, up to parallel composition). The problem is that now, ≈ 2 = ≈ a since in (5.12) process 0 has no a -→ 2 transition. To capture ≈ a , one can define yet another LTS We have now that ≈ 3 = ≈ a but ∼ 3 = ∼ a (since 0 ∼ 3 a.a). Up to context techniques work for ∼ 3 and ≈ 3 as well. In addition, the technique "≈ 3 -bisimulation up to ∼ 2 " is sound, but needs a separate proof: it is not a consequence of a theorem in the general theory of up-to techniques, since the LTSes are different.

The conclusion of this is that there seems to be no simple first-order LTS (with Pr being the regular set of processes) for ACCS admitting up to context techniques and capturing both ∼ a and ≈ a .

Higher-order π-calculus

In the higher-order π-calculus, communicated data can include processes themselves. We consider the calculus HOπ described by the following grammar: P ::= 0 P | Q (νa)P a P .Q a(X).P X 127 with the following reduction rule: a R .P | a(X).Q -→ P | Q{R/X} which we close under usual structural congruence, restriction and parallel contexts, and where Q{R/X} denotes capture-avoiding substitution of processes. Bisimulations for higher-order π-calculus are not straightforward. The literature proposes several notions of bisimulations, and we study here those that seem most suited for establishing first-order LTSes. We reason about closed processes, i.e. processes with no free process variables.

Context bisimulation [San96a]

The context bisimulation corresponds to the following LTS: where • -→ HOπ is defined in an early style on HOπ processes, and C ranges over multi-hole contexts. The idea is that each time a process R is emitted, an external process could add any process of the form C[R] in parallel. Up to context techniques accommodate well in this setting, with verbose but rather straightforward compatibility proofs. These proofs are rather easy, which mainly comes from the fact that the output transition already closes bisimulations under contexts built from emitted processes. Lemma 5.5.2. The following techniques are compatible up to: In both case, we derive straightforwardly the same transition from the RHS Q.

P R Q (νa)P C ν (R) (νa)Q ∀R P {R/X} R Q{R/X} a(X).P C i (R) a(X).Q P R Q a R .P C o (R) a R .Q P R Q P | R C | (R) Q | R

Environmental bisimulation [SKS11]

Another relevant notion is environmental bisimulation from [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF], which corresponds to the following LTS, where environments record the emitted processes: Pr = {(ã, Γ, P ) ã is a set of names, Γ is a sequence of closed processes, P is closed} The role of the i action is to put back emitted processes R in the tested process P at any point, closing bisimulations under parallel compositions of Γ i (note that the context bisimulation is less subtle, as it imposes to close under parallel compositions of C[Γ]).

Again we obtain full abstraction, but we get again a problem with up to context, as the transition i can be cancelled by context 4

C i = [•] | [•] i : x (ã, Γ, P ) i -→ (ã, Γ, P | Γ i ) = C i [x] .
(5.13) (In fact x i -→ x implies x = C i [x] for all x and x .) One can fix this using a trick similar to the one for the lambda-calculus, by adding transitions of the form: where we require that I is a sequence of integers (of length at most 2). If we transport the same kind of transitions to the other labels, we can have forms of up-to techniques together with full abstraction, but only in the strong case. Unfortunately, we have found no simple way to correct this approach to work for weak bisimilarity even when resorting to a non-uniform treatment of strong and weak bisimilarities like we did in Section 5.5.1.

Environmental bisimulation [KH12]

Koutavas and Hennessy presented in [START_REF] Koutavas | First-order reasoning for higher-order concurrency[END_REF] a first-order LTS with environments (which they call knowledge environments), as above, such that bisimulation captures the desired equivalence, very much like the approach we have throughout this chapter, but without providing up to context proof techniques. The calculus they use is rather general and slightly different in several ways. In particular, we focus on their notion of value: in their setting, a value is a "thunked process", written λ.P , that represents a process P waiting to be "run". We import this precise ingredient from [START_REF] Koutavas | First-order reasoning for higher-order concurrency[END_REF] and otherwise stick to the same setting as above, to facilitate comparisons: P ::= 0 P | Q (νa)P a V .Q a(X).P appV V ::= X | λ.P

There are now two reduction rules: a V .P | a(X).Q -→ P | Q{V /X} app(λ.P ) -→ P .

We define the following LTS: This time, C v is a value context of the form λ.C where C is a regular context. The only difference is the action i, which triggers the thunked content of the environment value Γ i before adding it in parallel of processes. This small difference makes the usual up to context problem disappear, as now P | R cannot be built as a context of P and Γ i = λ.R. Importantly, in [START_REF] Koutavas | First-order reasoning for higher-order concurrency[END_REF], the corresponding rule creates the process P | app(λ.R) which can be built as a context of P and λ.R, as in (5.13), forbidding yet again any up to context.

Note that, when reasoning with environments, bisimilarity is not closed under arbitrary contexts. For example, using a typical law in presence of replication: since a c .!c HOπ a 0 .!c, we have also Note that the first-order LTS of [START_REF] Koutavas | First-order reasoning for higher-order concurrency[END_REF] has other interesting properties: it handles name passing (being a superset of both HOπ and π) and has the distinctive advantage of dealing with open processes in a nice way, using a symbolic style: transitions on configurations correspond to the following transitions of plain processes: a(X).P a(X) -→ P X X -→ 0 .

if C[Γ]

By contrast, the LTS we use above has a large set of actions: one aC for each context C. We already know that up to context techniques are unsound in the setting of [START_REF] Koutavas | First-order reasoning for higher-order concurrency[END_REF] for the reason mentioned above. We hope that changing rule CONC-APP-TRANS the same way we used previously P | R instead of P | app(λ.R) will make the up to context techniques compatible, as it would be the first example of first-order bisimulation with symbolic transitions (the same transitions as CCS with the addition of i -→ transitions) with a complete tool set of up to context proof techniques. We leave this for future work.

Conclusion

Building a first-order labelled transition system that captures the equivalence of interest allows one to fit into the theory of bisimulation enhancements, and inherit all the compatible up-to techniques. However, those up-to techniques are mainly useful when we provide in addition the expected set of compatible up to context techniques. The main difficulty we have faced while establishing the results presented in this chapter was the careful design of labelled transitions, to make the up to context techniques compatible functions through known notions of bisimulations.

In several cases, following the approach involved establishing precise notions of values (e.g. thunks in HOπ and get and set in imperative λ) so to have those values treated uniformly, and to satisfy a notion of "consumption" of the value, that cannot be cancelled by up-to techniques.

We have applied this approach to various examples of calculi, systematically highlighting the technical difficulties and overcoming unsuitable design choices. We hope to have thereby helped the reader to a deeper and more uniform understanding of first-order reasoning for higher-order systems.

  Q{d/x}that can be composed back together using a communication rule:P | a(x).Q τ -→ P | Q{d/x} ,where τ is the label of a silent action, or internal action: transition τ -→ is essentially the same relation as reduction -→.

  Definition 2.1.2 (Reduction). The reduction relation of CCS, written -→, is the least relation generated by the following rules: a.P | a.Q -→ P | Q P -→ P P | R -→ P | R P -→ P (νa)P -→ (νa)P P ≡-→≡ P P -→ P

  τ.b a.b: a.τ.b a.b (by assumption) a | a.τ.b a | a.b (by context closure) ↓ ⇓ τ.b b (reduction from LHS, with no a barb) c + τ.b c + b (by context closure) ↓ ⇓ b c + b (reduction from LHS, and contradiction.)

Definition 2 .

 2 2.1 (Reduction). The reduction relation of the π-calculus is the least relation -→ generated by the following rules: a b .P | a(x).Q -→ P | Q{b/x} P -→ P P | R -→ P | R P -→ P (νa)P -→ (νa)P P ≡-→≡ P P -→ P

  when the context is unclear) of the π-calculus in Figure2.1 are similar to those of CCS. The differences are about extrusion: when the object b meets a restriction (νb), when it synchronises with an input, and some side conditions keeping the private name private. We choose the early flavour of the LTS[START_REF] Sangiorgi | The Pi-Calculus: a theory of mobile processes[END_REF], in which substitution happens in the rule for the input.

  P P -→ ef P | b=c .

  P a = b . The LTS defining the transitions • -→ ef is defined by the rules of Figure 3.2. Note how the judgement P a = b is only used in the last three rules to rewrite the labels.

Figure 3 . 2 :

 32 Figure 3.2: Labelled transitions in the explicit fusion calculus ( • -→ ef )

Figure 3 . 3 :

 33 Figure 3.3: Subtyping in π

  Lemma 3.3.4 (Properties of typing). 1. (Weakening) If Γ P then Γ, a : T P . 2. (Strengthening) If Γ, a : T P and a ∈ fn(P ) then Γ P . 3. (Narrowing) if T 1 ≤ T 2 and Γ, a : T 2 P then Γ, a : T 1 P ; 4. (Substitution) If Γ, x : T P and Γ b : T then Γ P [b/x].

  ). Lemma 3.3.19. If δ P :: Γ P and δ Q :: Γ Q then we have the following: 1. (P and Q have the same barbs) iff ([P ] δ P and [Q] δ Q have the same barbs)

Γ

  a : oT Γ b : T Γ P Γ ab.P Γ, b : T P Γ (νb)P ,

  π ::= a b a b P ::= 0 P |Q (νa)P π.P a/b .

  Definition 4.1.2 (Positive and negative occurrences). In an input ab.P and an arc a/b, the name b has a negative occurrence. All other occurrences of names in input, output and arcs are positive occurrences. More formally, we define fn + (P ) and fn -(P ), the free positive (resp. negative) names of P , as follows: fn + (ab.P ) = {a, b} ∪ fn + (P ) fn + (ab.P ) = {a} ∪ fn + (P ) fn + (a/b) = {a} fn -(ab.P ) = fn -(P ) fn -(ab.P ) = {b} ∪ fn -(P ) fn -(a/b) = {b} fn -(P | Q) = fn -(P ) ∪ fn -(Q) fn -((νa)P ) = fn -(P ) \ {a} fn + (0) = ∅ fn + (P | Q) = fn + (P ) ∪ fn + (Q) fn + ((νa)P ) = fn + (P ) \ {a} fn -(0) = ∅ and we remark that fn(P ) = fn + (P ) ∪ fn -(P ).

Figure 4 . 1 :

 41 Figure 4.1: Subtyping for i/o-types in πPThe type system for πP is presented in Figure4.2. With respect to the π-calculus, only the rule for input needs an adjustment, as πP uses free, rather than bound, input. The idea in rule T-INPFREE of πP is however the same as in rule T-INP of π: we look up the type of the object of the prefix, say T , and we require iT as the type for the subject of the prefix. To understand the typing of an arc a/b, recall that such an arc allows one to replace b with a. Rule T-ARC essentially ensures that a has at least as many capabilities as b, in line with the intuition for subtyping in capability type systems.

2.

  When a appears only negatively, premises are of the form T ≤ Γ(a). Indeed, the premise Γ a : Γ(b) (in rule T-ARC) is equivalent to Γ(a) ≤ Γ(b) and the premise Γ a : iΓ(b) (in rule T-INPFREE) is equivalent to ∃T Γ(a) ≤ iT ∧ T ≤ Γ(b), by covariance of i. 3. a : T, b : T, c : T a/b | b/c when for example T = i 1, but replacing the type of b alone with 1 or ii1

  Definition 4.3.3 (By-need reduction). By-need reduction, P -→ bn P , is defined by the following rules: R a b R | ac.P | bd.Q -→ bn R | P | d/c | Q P -→ bn P P | R -→ bn P | R P -→ bn P (νa)P -→ bn (νa)P P ≡-→ bn ≡ P P -→ bn P .

  then either C is an evaluation context, in which case C[P ] R C[Q] and we can conclude by the fact R is barb-preserving, or 2 holds and then C[Q]↓ bn a . • suppose C[P ] R C[Q] and C[P ] -→ bn P 1 , then either C is an evaluation context, in which C[P ] R C[Q] and we can conclude by the fact R is reduction-closed, or 1 holds and then P 1 ≡ C [P ] and for all Q, C[Q] -→ bn C [Q], and then P 1 ≡R C [Q].

  is a reduction-closed barbed evaluation congruence up to ≡, and use Proposition 4.3.8 to conclude. The closure under evaluation context is trivial (up to ≡) as an evaluation context can be decomposed (up to ≡) into a context of the form (νc)(R | [•]). The reduction closure and the preserving of the barbs follows from the fact that they cannot be influenced by restrictions:1. if P -→ bn P then (νb)P -→ bn (νb)P and if (νb)P -→ bn P 1 then P -→ bn P and P 1 ≡ (νb)P , 2. (νb)P ↓ bn a iff P ↓ bn b and a = b. (Contrarily to the implicit fusion calculus where restrictions can trigger reductions.) Example 4.3.10 (Contrasting eager and by-need semantics). The eager and by-need semantics of πP yield incomparable equivalences. The following two laws are valid in the by-need case, and fail in the eager case: (νa)a/c = 0 a | a = a.a . To see the failure of the first law in the eager semantics, consider a context C [•] | (νb)(b/c) | c | c.w; then C[(νa)(a/c)] can lose the possibility of emitting at w, by reducing in two steps to (νa)(a/c | a) | (νb)(b/c | b.w), because of a commitment determined by arcs; this cannot happen for C[0]. In the by-need semantics, there are no early commitments, and the two processes are hence equal.

  Lemma 4.3.11 (Contrasting πP and fusions). We have, for by-need, eager, and explicit fusions: (νb, c)ab.ac bn (νb)ab.ab (νb, c)ab.ac ea (νb)ab.ab (νb, c)ab.ac ef (νb)ab.ab (νb, c)ab.ac bn (νb)ab.ab (νb, c)ab.ac ea (νb)ab.ab (νb, c)ab.ac ef (νb)ab.ab . Proof, eager case. Using Proposition 4.3.9 we prove that the following relation, closed under evaluation contexts, R {(E[(νb, c)(ab.ac) ], E[(νb)(ab.ab) ]) for all E}∪ {(E[(νb, c)(d/b | ac) ], E[(νb)(d/b | ab) ]) for all E} ∪ {(E[(νb, c)(d/b | e/c)], E[(νb)(d/b | e/b)]) for all E} ∪ ea is reduction-closed as well as R -1 (it is trivially barb-preserving in the eager case, since they have the same prefix subjects). The reductions from E alone are not interesting, and each interaction between E and its content goes from one line to the next, the last one being included in ea . The important observation is that d/b and e/c can never interact with anything, because there are no b or c in subject position.To prove (νb, c)ab.ac ea (νb)ab.ab we use the tester process T (νd, e)(ad.ae.(e | d.w)), yielding: (νb, c)ab.ac | T -→ 2 ea (νb, c, d, e)(b/d | c/e | e | d.w) ea 0 (νb)ab.ab | T -→ 2 ea (νb, d, e)(b/d | b/e | e | d.w) ⇓ ea w Indeed (νb)ab.ab generates (νb)(b/d | b/e), authorising further reductions between d and e since b can be a unifier, whereas (νb, c)(b/d | c/e) will never rewrite d and e into the same name. These laws show a difference between input and output in behavioural equalities of πP. The reason for the inequality is that the right-hand side will eventually yield (νb)(b/d | b/e), authorising further reductions between d and e. The left-hand side will yield (νb, c)(b/d | c/e) which does not allow such reductions. For the fusion calculi, e.g. the explicit fusion calculus, the resulting processes would be (νb)(b=d | b=e) and (νb, c)(b=d | c=e) respectively bisimilar to d=e and 0, which are not in ef . The dual of these processes are not bisimilar either, by symmetry of ef . But in πP the dual processes would yield (νb)(d/b | e/b) and (νb, c)(d/b | e/c) which are both bisimilar to 0, indeed πP is not symmetric.

  Lemma 4.3.12 ( bn laws about arcs). When a = b and b = c, we have: νb(a/b | b/c) bn a/c νb(a/b | b/c) ea a/c a/b | a/b bn a/b a/b | a/b ea a/b . Proof, eager case. The relation induced by a/b | a/b ea a/b and closed under evaluation contexts is trivially reduction-closed and trivially preserves barbs. Consider now the relation induced by the first law, again closed under evaluation contexts, and close it with all the rewritings that b/c and a/c can operate on prefixes of subject c on both sides: some prefixes of the form bd.Q and bd.Q on the left-hand side will correspond to ad.Q and ad.Q on the right-hand side. More precisely, we write, when S is a set of prefixed processes with subject c:

  Lemma 4.3.13 (From free to bound prefixes). We have, for x / ∈ fn(P ) ∪ {a, b} and y / ∈ fn(Q) ∪ {a, c}: ab.P bn (νx)ax.(x/b | P ) ab.P ea (νx)ax.(x/b | P ) ac.Q bn (νy)ay.(c/y | Q) ac.Q ea (νy)ay.(c/y | Q) .

  Lemma 4.3.14 (Substitution and polarities). Suppose a = b. 1. If a has only positive occurrences in P , then (νa)(P | b/a) bn P {b/a}; 2. if a has only negative occurrences in P , then (νa)(P | a/b) bn P {b/a}; 3. (νa)(P | b/a | a/b) bn P {b/a}.

R

  1 {((νa)(b/a | P ), P σ ) | for all P such that a / ∈ fn -(P )} R 2 {((νa)(a/b | b/a | P ), P σ ) | for all P } are evaluation-context-closed up to structural congruence, weakly reduction-closed and preserve weak barbs. To prove closure under evaluation contexts, observe that E[(νa)(b/a | P )] ≡ (νa)(b/a | P ) for P = E[P ] and E[P σ ] = (E[P ]) σ . We consider now closure under reduction. We write P b/a -→ P whenever a prefix ad.Q in P is rewritten into the corresponding bd.Q in P and we write a=b -→ for the symmetric closure of b/a

  (a) P -→ ea P ; (b) P b/a -→-→ ea P , which implies b/a | P -→ * ea b/a | P ; (c) P a=b -→-→ ea P (only if a ∈ fn -(P )), which implies a/b | b/a | P -→ * ea a/b | b/a | P .

  Then, if c = e then if e = a and d = b then one step of b/a -→ can catch up, otherwise we first need to transform bf σ .R σ back into af σ .R σ with a step of a=b -→. • (c/d | ef.R) σ -→ ea (c/d | cf.R) σ if σ(d) = σ(e), handled as above.

  fn + (a) {a} fn + ({a}) ∅ fn -(a) ∅ fn -({a}) {a} fn + ([ϕ]τ.P ) fn -(ϕ) ∪ fn + (P ) fn + (a ≺ b) {b} fn + (a b) ∅ fn -([ϕ]τ.P ) fn + (ϕ) ∪ fn -(P ) fn -(a ≺ b) {a} fn -(a b) {a, b} fn + (α(x).P ) fn + (α(x).P ) fn + (α) ∪ (fn + (P ) \ {x}) fn -(α(x).P ) fn -(α(x).P ) fn -(α) ∪ (fn -(P ) \ {x}) Definition 4.5.2. Structural congruence, written ≡, is the smallest congruence satisfying the laws of Definition 2.1.1 and the following law handling the sum construct: i∈I π i .P i ≡ i∈I π σ(i) .P σ(i) when σ a permutation of I .

  τ.P ∈ S R ϕ R | S -→ R | P P -→ P P | R -→ P | R P -→ P (νa)P -→ (νa)P P ≡ -→ ≡ P P -→ P

a

  (y).Q | (νb)ab.P τ -→∼ (νb)(Q{b/y} | P ) .

  [ϕ]τ P |Q η ψ [α γ]τ : we assume (4.4) holds when [α γ]τ is replaced with η and we decompose η ψ [α γ]τ into easy cases: • η = [β γ]τ and ψ = α ≺ β and n(α) = n(β): in this case, P ψ and since [ϕ]τ P |Q [β γ]τ we are done. • η = [β γ]τ and ψ = α ≺ β and n(α) = n(β): in this case, P ψ (even if Q ψ). We use the induction hypothesis to get β such that [ϕ]τ P |Q [β γ]τ and n(β ) = n(β) and P β ≺ β . This β is enough, since P α ≺ β . • η = [α δ]τ with n(δ) = {a}:

Lemma 4. 5 .

 5 26. ≡ is a bisimulation.Proof. This follows from Lemmas 4.5.15 and 4.5.25. The correspondence between transitions is exact, hence the only non-trivial case is for the [ϕ]τ transition because one requires P | ϕ ≡ Q | ϕ instead of just P ≡ Q . This holds because ≡ is a congruence, by definition.

  P , then P | ϕ [ϕ]τ --→ P | ϕ and P | ϕ τ -→ P | ϕ by Lemma 4.5.23, since τ ϕ [ϕ]τ and P | ϕ ϕ. From P | ϕ τ -→ P | ϕ Lemma 4.5.23 provides a condition ζ such that P [ζ]τ --→ P and τ P |ϕ [ζ]τ , which implies in turn P | ϕ ζ. We prove by induction on P | ϕ ζ that [ϕ]τ P [ζ]τ (see proof script in [Mad14]) and conclude with Lemma 4.5.23. The following "Harmony lemma" relates reduction and τ -→ transitions. Lemma 4.5.37. If P -→ P then P τ -→∼ P , and if P τ -→ P then P -→∼ P . Proof. Follows from Lemma 4.5.25 (-→ produces an arc a/b when τ -→ produces the bisimilar process (νx)(a/x | x/b)).

  Theorem 4.5.38 (Characterisation). P Q iff P ∼ Q.

  [P ] b p [[P ] p ] b where [•] b is the standard encoding of bound prefixes using free prefixes (e.g., [a(x).P ] b (νx)ax. [P ] b ). This implies that [P ] b p bn [Q] b p ⇒ P -Q for two πP -processes P and Q. Remarking that [•] f : πP → πP -, we compose the encodings and we prove P bn [[P ] f ] b p by induction on P using the following πP laws (when x is fresh): ab.P bn (νx)ax.(b/x | P ) ab.P bn (νx)ax.(x/b | P ) .

  → b/x | P The calculi πP + F and πP + are similar, and can be encoded into each other. The domain of [•] f can be trivially extended to πP + F (extended names are handled like regular ones, e.g. [αb.P ] f α(x).(x/b | [P ] f )). In the other direction, we need to extend [•]

0

  Laws for prefixes (the counterparts of laws L10-L12 for output are omitted) L5 ϕ, S + π.P = ϕ, S + π.(ϕ | P ) L6 [ϕ]τ.P = [ϕ]τ.(ϕ | P ) L7 [a ≺ a]τ.P = [b b]τ.P L8 [a b]τ.P = [a b]τ.P + [a ≺ b]τ.P L9 [a b]τ.P = [a b]τ.P + [b a]τ.P L10 a(x).P = a(x).P + {a}(x).P L11 b/a, S + a(x).P = b/a, S + a(x).P + b(x).P L12 a/b, S + {a}(x).P = a/b, S + {a}(x).P + {b}(x).P L13 b/a, S + [a ≺ c]τ.P = b/a, S + [a ≺ c]τ.P + [b ≺ c]τ.P L14 a/b, S + [c ≺ a]τ.P = a/b, S + [c ≺ a]τ.P + [c ≺ b]τ.P L15 b/a, S + [a c]τ.P = b/a, S + [a c]τ.P + [b c]τ.P L16 b/a, S + [a c]τ.P = b/a, S + [a c]τ.P + [c ≺ b]τ.P L17 α(y).P = α(x).(νy)(x/y | P ) if x / ∈ fn(P ) L18 α(y).P = α(x).(νy)(y/x | P ) if x / ∈ fn(P ) Laws for restriction (the counterparts of laws L25 and L26 for output are omitted; a ≺ b ∈ A = stands for a ≺ b ∈ A and a = b, and similarly for a b.) L19 (νb)P = (νa)(P {a/b}) if a / ∈ fn(P ) L20 P | (νa)Q = (νa)(P | Q) if a /

  a(y).P L17 = a(x).(νy)(x/y | P ) L19 = a(x).(νy )(x/y | P {y /y}) L17 = a(y ).P {y /y} .

Lemma 4.6. 3 .

 3 If A, S µ -→ A, P then A, S = A, S + π.Q for some π and Q such that µ and π only differ in their bound names and π.Q µ -→ P .

  π ::= a(x) a(x) [a=b]τ P ::= P | Q (νa)P a=bi π i .P i Standard structural laws. P | (Q | R) = (P | Q) | R P | Q = Q | P P | 0 = P (νa)(P | Q) = P | (νa)Qand (νb)P = (νa)P {a/b} when a / ∈ fn(P ) (νa) i π i .P i = i|a / ∈n(πi) π i .(νa)P i Laws for fusions. a=a = 0 a=b | a=c = a=b | a=c | b=c a=b = b=a (νa)a=b = 0 Laws for prefixes. a=b | S + π.P = a=b | S + π.(a=b | P ) [a=b]τ.P = [a=b]τ.(a=b | P ) π.P + π.P = π.P [a=b]τ.P = [b=a]τ.P a=b | [a=c]τ.P = a=b | [b=c]τ.P a=b | S + a(x).P = a=b | S + b(x).P a=b | S + a(x).P = a=b | S + b(x).P Expansion law.

  [[R]] -→ bn (νwy)(b/c | w/y | wb.[[P ]] | y c .[[Q]]). The latter process can only make a deterministic reduction to process [[R ]] | (νwy)(w/y), which is strongly bisimilar to [[R ]] by Lemma 4.7.4. 3) The reduction [[P ]] -→ bn P 1 comes from a communication between two prefixes [[a v .Q]] and [[b x .R]] where P must be of the form P ≡ (νc)(S | a v .Q | b x .R) and [[S]] a b. Lemma 4.7.5 gives S ≡ S | a=b to get finally P ≡ (νc)(S | a v .Q | a x .R) and P -→ ef (νc)(S | v=x | Q | R) P . We relate [[P ]] to P 1 through bn by the same reasoning as in 2.

  πP P 1 then either P ac -→ π P with P 1 ∼ c/y | [[P ]], or P a(c) -→ π P with P 1 ∼ (νc)(c/y | [[P ]]).

  rewriting and Lemma 4.5.23 we get a α(y) transition from [[Q]] | A and the resulting processes are related by ∼R ν ∼.

  [ϕ]τ -→ πP P 1 | A yields two cases:(a) either [[P ]]τ -→ πP P 1 . This is handled using Lemma 4.7.8.

  Lemma 4.8.3. a/b πP1 b/a. Proof. The relation relating C[π.E[a/b]{a/x}] with C[π.E[b/a]{b/x}] (for any context C, any evaluation context E, and where x can only appear in subject position in E) is reduction-closed and barb preserving.

  which means C[P ] and C[Q] are in the relation. -reduction closure follows from the following operational correspondence:

  all N , where ↔ = is the smallest congruence on EF1 terms satisfying a=b ↔ = b=a for all a, b.

  1. Γ, b : T b (νc : T c )(ab.P | ac.Q | R) (using (4.6) the process reduces to (P | Q | R){b/c}), 2. Γ, c : T c (νb : T b )(ab.P | ac.Q | R) (using (4.7) the process reduces to (P | Q | R){c/b}). By definition of FU1, P , Q, and R have no negative occurrence of c. Moreover, because of the typing rules, we have T b ≤ T c . In the first case, since c does not appear in negative position in P | Q | R, applying positive narrowing on T b ≤ T c is enough to conclude without changing the typing environment.

  this, we prove by induction on n thatu n • b ⊆ b • u ω . The case n = 0 (b ⊆ b • u ω ) follows from the monotonicity of b. Suppose now u n • b ⊆ b • u ω . We consider then u n+1 • b: u • u n • b ⊆ u • b • u ωby induction and monotonicity of u⊆ b • u ω • u ω by hypothesis ⊆ b • u ωby idempotence of u ω .

  Lemma 5.1.13. If f and b are monotone and f b g, then f ω b g ω .Proof. To provef ω • b ⊆ b • g ω , it is enough to prove f n • b ⊆ b • g ω for all n. Since b • g n ⊆ b • g ω (bymonotonicity of b) we prove only the following:f n • b ⊆ b • g n .(5.3)We prove (5.3) by induction on n. The case n = 0 (i.e. b ⊆ b) is trivial. Suppose (5.3) for n, we prove it for n + 1. By monotonicity of f , (5.3) implies f• (f n • b) ⊆ f • (b • g n ), and (f • b) • g n ⊆ (b • g) • g nby hypothesis, which concludes the induction. Lemma 5.1.14. If b and f are monotone and f b f ω then f ⊆ g b g for some monotone function g.

n b f ω

  n+1 by Lemma 5.1.13 (f n and b are monotone) i.e. f n+1 b f n+2 .

  Figure 5.3: First-order LTS for early bisimilarity in named π-calculus processes

R

  1 {((c, P ), (c, Q)) P ≈ e Q ∧ c ≥ fn(P ) ∪ fn(Q)} Proof. We decompose isub into two functions: isub = bsub • w where 1. bsub : R → {((n, P σ), (n, Qσ)) (n, P ) R (n, Q) , σ : n → n is bijective} (up to bijective substitutions) 2. w : R → {((n + k, P ), (n + k, Q)) (n, P ) R (n, Q) , k ∈ N}. For both b = b and b = wb, we prove that bsub b bsub, and that w b bsub•w. From that isub b bsub•isub = isub. The same way, str b str • bsub. The iteration is idempotent, as the functions are Scott-continuous.The up to context function is decomposed into a set of smaller context functions, similarly to initial contexts, one for each operator of the π-calculus. The only exception to this is the input prefix, since early bisimilarity in the π-calculus is not preserved by this operator. We writeC 0 , C o , C ν , C ! , C | ,and C + for these initial context functions, respectively returning the closure of a relation under the operators of nil, output prefix, restriction, replication, parallel composition, and sum. Definition 5.2.3. We define the functions C 0 , C o , C ν , C ! , C | and C + on relations on π 1 by the following rules:

  e ) P = Q and P {c/b} = Q{c/b} for each c free in P, Q a(b).P = a(b).Q (5.4) Definition 5.2.4. We define C i , the function for input prefixes, accordingly: a ≤ d for all c ≤ d + 1 we have (d + 1, P {c/b}) R (d + 1, Q{c/b}) (d, a(b).P ) C i (R) (d, a(b).Q) Theorem 5.2.5. The set {C 0 , C o , C i , C ν , C ! , C | , C + } is b-compatible up to isub ∪ str.

  c, !P | P 0 | P | . . . | P ) with (c, P ) τ -→ (c, P 0 ) .

  so we simply progress to the relation S 2 ∼ where S 2 = C ω | (C ! (S) ∪ S).

Figure 5

 5 Figure 5.4: First-order LTS for ground bisimilarity in named π-calculus processes

-

  → π P where b is bound, and the definition of bisimulation contains a quantification over names. To capture this bisimilarity in a first-order LTS we need to have two transitions for each input a(b): one to fire the input a, leaving b uninstantiated, and another to instantiate b. Configurations are defined as follows, where fn(P ) ≤ c. The first is a regular configuration, and the second is called an abstraction: Pr : C ::= (c, P ) (b)(c, P )

  Definition 5.2.9. A distinction is a finite symmetric and irreflexive relation on names. A substitution σ respects a distinction D, written D σ, if (x, y) ∈ D implies σ(x) = σ(y). Definition 5.2.10. {∼ D o | D is a distinction} is the largest family of symmetric relations such that if P ∼ D o Q and D σ, then 1. if P σ µ -→ π P and µ is not a bound output, then Qσ µ -→ π ∼ Dσ o P 2. if P σ a(b) -→ π P and b / ∈ fn(Qσ) then Qσ a(b) -→ π ∼ D o where D = Dσ ∪ ({b} × fn(P σ, Qσ)) ↔ (where R ↔ is the symmetric closure of R). Each ∼ D o is called open D-bisimilarity.

  Pr = {(D, c, P ) | fn(P ) ≤ c and D is a distinction and D ⊆ {1 . . . c} 2 } Labels now contain a substitution σ, to specify which names are being fused during the transition: µ 0 ::= τ ab ab a(b) Act : µ ::= (σ, µ 0 ) Note that the silent transition τ would be (σ 0 , τ ) with σ 0 the identity substitution, but we do not consider here weak open bisimilarity. In the following rules, we require that all substitutions are restricted to the set {1 . . . c}, i.e. σ : c → c (we could be more precise and say σ : c → d with d ≤ c). Dσ ∪ ({b} × {1 . . . c}) (D, c, P ) σ,a(b) -→ (D , b, P ) b = c + 1

Figure 5

 5 Figure 5.5: First-order LTS for bisimilarity in named πP processes

  =⇒ y 3 for some y 3 , i.e. (∆, N ) =y 0 =⇒ y 1 i,C

  and finally we get up to permutation: (Γ , C [Γ ]) str(C(S 1 )) (∆ , C [∆ ]). Lemma 5.3.10. C wb str ∪ C ∪ C e . Proof. We know Γ R ∆ and we analyse transitions from (Γ, C[Γ]). If C = [•] i then we progress to str. We suppose now C = [•] i . In the first two cases, we suppose

  C[Γ] is not a value then (Γ, C[Γ]) τ -→ (Γ, M ) with C[Γ] -→ n M . We distinguish two cases: (a) C has no hole in evaluation position. Then M = C [Γ] for some C and C[∆] -→ n C [∆] and we end up in str(R).

-

  Lemma 5.3.15. If M → β N then (Γ, M ) (Γ, N ).Proof. We prove R = {(Γ, M ), (∆, N ) | M → * β N ∧ ∀i Γ i → * β ∆ i } is an expansion relation. Let us play the transitions for either sides of M → * β N . In the following, we write V {N } for M when V N -→ n M (i.e. (λx.P ){N } P {N/x}). We distinguish cases for silent and visible transitions, and transitions from the LHS and from the RHS:1. (Γ, M ) τ -→ (Γ, M ), i.e. M -→ n M . Using Lemma 5.3.13 we find N such that M → * β N and N -→ = n N , i.e. (∆, N ) τ -→ (∆, N ). 2. (∆, N ) τ -→ (∆, N ), i.e. N -→ n N .Obviously N is not a value, hence neither is M so for some M , M -→ n M . By Lemma 5.3.13 for some N we have M → * β N and N -→ = n N , so:(a) either N = N in which case M → * β N → β N , (b) or N -→ n N , hence N = N (by determinism of -→ n ) and M → * β N .In both cases, (Γ, M )τ =⇒ (Γ, M ) and (Γ, M ) R (∆, N ). 3. M is a value V and (Γ, V ) Γ i,C -→ (Γ , Γ i {CΓ }) for some context C. Then N , as a β-derivative of a value, is a value W and ∆ (∆, W ) i,C -→ (∆ , ∆ i {C∆ }). In passing note that Γ R ∆ . Remarking that Γ i (CΓ ) -→ n Γ i {CΓ } and ∆ i (C∆ ) -→ n ∆ i {C∆ } and Γ i (CΓ ) → * β ∆ i (C∆ ) by congruence of → * β ,we conclude by Lemma 5.3.13. 4. N is a value W and (∆, W ) ∆ i,C -→ (∆ , ∆ i {C∆ }). Then by Lemma 5.3.14 M -→ * n V for some value V (plus V → * β W by Lemma 5.3.13), which means (Γ, M ) =⇒ (Γ, V ) Γ and incidentally Γ R ∆ . Now from Γ we do the transition Γ i,C-→ (Γ , Γ i {CΓ }) and we relate the two resulting configurations as in the item before.From left to right, we answered to τ

M

  Figure 5.6: The imperative λ-calculus

  (s; M ) -→ R (s ; M ) (s; Γ, M ) τ -→ (s ; Γ, M ) Γ = Γ, getset(r) (s r[Γ ]; Γ i (C v [Γ ])) -→ R (s ; M ) (s; Γ) i,Cv,cod(r)-------→ (s ; Γ , M )

  (s r[Γ r ] u[Γ rV u ]; Γ rV i (C[Γ rV u ])) -→ R (s ; M ) (s r[Γ r ]; Γ rV ) i,C,cod(u) ------→ (s ; Γ rV u , M ) (5.7)There are two cases, depending if Γ rV i is in Γ V or getset(r).

1.

  Suppose i ≤ |Γ| or i = |Γ rV | + 1 = |Γ| + 2|r| + 1. Then Γ rV i = Γ V

Definition 5.5. 1 .

 1 Strong asynchronous bisimilarity is the largest symmetric relation ∼ a such that, whenever P ∼ a Q and P µ -→ P , we have:1. either Q µ -→ Q and P ∼ a Q , 2. or µ = a is an input action and Q τ -→ Q with P ∼ a (Q | a).

  νc)(P | C[R])

  Proof. Functions C 0 and C ν are compatible up to identity, and C o is compatible up to C | . For C | itself, observe that the non-trivial transitions from P | R are silent transitions to (νc)(P | R ) where: 1. either P (ν c)a S -----→ HOπ P and R aS --→ HOπ R with R = C[S] for some C. This corresponds exactly to a first order transition aC from P and we simply progress to S.

  2. or R (ν c)a S-----→ HOπ R with P aS --→ HOπ P which corresponds again to the first order transition aS from P , and we progress to C | (S).

  ã, Γ, P )P (ν c)b R -----→ HOπ P b / ∈ ãc (ã, Γ, P ) b -→ (ãc, Γ, R, P ) (ã, Γ, P ) i -→ (ã, Γ, P | Γ i )128We write n(C) for fn(C[0]) ∪ cn(C) where cn(C) is the set of names captured by C.

  (ã, Γ, P )whereΓ I = Γ i1 | . . . | Γ in

Pr

  = {(ã, Γ, P ) ã is a set of names, Γ is a sequence of closed values, P is closed} Act : µ ::= τ aC v ã, Γ, P | R)

  (λ.c, !c) ∼ (λ.0, !c). However, (λ.c, b.!c) ∼ (λ.0, b.!c) so the context b.[•] does not preserve bisimilarity (we write c for c 0 .0 and b. for b 0 .). For this reason, the method of initial contexts does not work here, and we get techniques close to those for the lambda-calculus.Lemma 5.5.3. The following techniques are compatible up to ∼:(ã, Γ, V, P ) R ( b, ∆, W, Q) (ã, Γ, P ) w(R) ( b, ∆, Q) (ã, Γ, P ) R ( b, ∆, Q) (ã, Γ, C v [Γ], P ) str(R) ( b, ∆, C v [Γ], Q) (ã, Γ, P ) R ( b, ∆, Q) n(C) ∩ (ã ∪ b) = ∅ (ã, Γ, P | C[Γ]) C | (R) ( b, ∆, Q | C[∆]) (ã, Γ, P ) R ( b, ∆, Q) c ∩ (ã ∪ b) = ∅ (c ∪ ã, Γ, P ) C ν (R) (c ∪ b, ∆, Q)Proof. We consider proofs for b and wb at the same time, since there is no important difference. Compatibilities of w and C ν are straightforward. Then, remark that({b} ∪ ã, Γ, P ) ∼ (ã, Γ,(νb)P ) (5.14) when b / ∈ fn(Γ) ∪ ã, which means that the compatibility of C ν and R → ∼R∼ implies the compatibility of the technique "up to restriction", with contexts of the form (νb)[•] when b is not used in the environment. Function str progresses to str ∪ C | (the C | part is useful for the transitions labelled with aC v or i).We now move to the compatibility of C | which is the critical part of the proof for up to context. Suppose that R ⊆ S, that R progresses to S, and that (ã, Γ, P ) R ( b, ∆, Q) with n(C) ∩ (ã ∪ b) = ∅, and consider the transitions from (ã, Γ, P | C[Γ]). Actions from P alone are easy to handle. Actions from C[Γ] alone can be:1. if C[Γ] -→ R | C [Γ] with Γ i = λ.R and C ≡ app([•] i ) | Cwe use a i transition from P and Q to progress to C | (S). This case is particularly interesting, as it is the one that fails for the LTS derived from[START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF].2. if C[Γ]aV -→ HOπ P 1 with V = C v [Γ], in which case C[Γ] aCv[∆] ----→ HOπ Q 1 with P 1 = C 1 [Γ] and Q 1 = C 1 [∆], to progress to C | (R) ⊆ C | (S).

(

  ν c)b V -----→ HOπ P 1 then V = C v [Γ] and P 1 = C 1 [Γ]. We obtain a similar transition from C[∆], and we need to relate(cã, Γ, C v [Γ], P | C 1 [Γ]) to (c b, ∆, C v [∆], Q | C 1 [∆]), which we do through the relation C ω ν (str(C | (R))).We now need to handle the τ transitions that are obtained from a combination of P andC[Γ], i.e. (ã, Γ, P | C[Γ]) τ -→ (ã, Γ, (νc)(P | C [Γ])).There are two cases (we recall that since the names of C do not intersect with ã, the communication happens on a public channel x):1. P (ν c)x V ------→ HOπ P and C[Γ]xV --→ HOπ P 1 . By analysing the latter transition, we know that P 1 = C 1 [Γ, V ] for some C 1 . Using the fact that R progresses to S and that (ã, Γ, P )x -→ (ãc, Γ, V, P ), we know( b, ∆, Q) x =⇒ ( b d, ∆, W, Q ) with Q (ν d)x W = ===== ⇒ HOπ Q and C[∆] xW --→ HOπ C 1 [∆, W ].We relate then the final configurations using several techniques:(ãc, Γ, V, P ) S ( b d, ∆, W, Q ) (ãc, Γ, V, P | C 1 [Γ, V ]) C | (S) ( b d, ∆, W, Q | C 1 [∆, W ]) (ãc, Γ, P | C 1 [Γ, V ]) w(C | (S)) ( b d, ∆, Q | C 1 [∆, W ]) (ã, Γ, (νc)(P | C 1 [Γ, V ])) ∼w(C | (S))∼ ( b, ∆, (ν d)(Q | C 1 [∆, W ]))using (5.14) (beginning of this proof) to move c inside the tested process. 2. P xV --→ HOπ P and C[Γ]

(

  ν c)x Cv[Γ]--------→ HOπ C 1 [Γ] (every output transition from C[Γ] has to be of this shape and hence V = C v [Γ]). We derive then the transition xC v from (ã, Γ, P ) to (ã, Γ, P ) and similarly for ( b, ∆, Q). Finally, we relate (ã, Γ, (νc)(P | C 1 [Γ])) to ( b, ∆, (νc)(Q | C 1 [∆])) through the relation ∼C |c| ν (C | (S))∼, again using (5.14) All together, we proved that C | progresses to (C | ∪ C ω ν ∪ w ∪ str ∪ (R → ∼R∼)) ω (note that C ω ν is compatible since C ν is).

  Definition 2.1.8 (Weak transitions). Relation =⇒, and indexed relations • -→, • =⇒ and

	•

Table 4

 4

.1: LTS for πP + . Symmetric versions of the two rules involving | are omitted.

Table 4

 4

.3: Axiomatisation for the explicit fusions calculus As for πP + , free prefixes can be encoded: [ab.P ] = a(u).(u=b | P ). Note in passing that fusions can be represented in πP + , encoding a=b with a/b | b/a (see Section 4.7.1).

  and from property 2 above we have =⇒ ea ⊆ =⇒ bn / =⇒, i.e., Q =⇒ bn Q / =⇒ Q for some Q . We are able to close the diagram with Q since / =⇒ ⊆ πP1ea by Lemma 4.8.1. Finally, since a name has a negative occurrence in Q if and only if it has one in Q , we have that

*

En étudiant la preuve de ce théorème d'impossibilité, on découvre une contrainte fondamentale de ces calculs qui empêche l'utilisation des types : les processus induisent une relation d'équivalence entre les canaux de communication, qui est particulièrement évidente dans la variante du calcul des fusions "explicites". En relâchant cette contrainte pour que les canaux de communication soient au lieu de cela sujets à une relation de pré-ordre, on obtient assez directement un nouveau calcul, dans le style des calculs de fusions, qu'on appelle "pi-calcul avec pré-ordres" et dont on étudie les propriétés dans la suite (Chapitre 4).Comme dans le calcul des fusions explicites, un opérateur du calcul appelé "arc" représente la relation induite sur les noms, en imposant à deux noms d'être reliés dans la relation globale de pré-ordre. Ces arcs agissent grâce à un système de réécriture très simple, et définissent directement le comportement du calcul (Section 4.1). On récupère alors dans le pi-calcul avec pré-ordres la même notion de types que dans le pi-calcul (Section 4.2).La sémantique par réécriture est "avide", dans le sens où les arcs peuvent réagir avec n'importe quel préfixe à n'importe quel moment. On présente une autre sémantique plus paresseuse, qui n'utilise les arcs qu'au moment de la communication (Section 4.3). Elle décrit des étapes de réduction plus traditionnelles, ce qui permet des propriétés plus intéressantes et des correspondances plus fines avec les calculs existants.Le calcul fait également preuve d'une capacité à gérer les noms privés, cette dernière ayant été perdue à dessein lors de l'élaboration des calculs de fusions à partir du pi-calcul original (Section 4.4). Cette capacité à créer de nouveaux noms privés est largement utilisée dans les implémentations, ce qui s'ajoute au fait le calcul est muni d'un système de types.On décrit ensuite la sémantique comportementale paresseuse du pi-calcul avec pré-ordres et ses spécificités, à travers l'élaboration d'un système de transitions étiquetées, une bisimulation, des preuves techniques de résultats usuels de congruence, dont certaines sont formalisées en utilisant coq (Section 4.5). Une deuxième caractérisation est donnée sous la forme d'une liste de lois comportementale qui capture complètement la sémantique. Enfin, cette axiomatisation peut être adaptée pour obtenir, pour la première fois, une axiomatisation du calcul des fusions explicites (Section 4.6).

The prefix τ.P (defined by τ.P τ -→ P ) can be encoded using τ.P = (νu)(u | u.P ) where u does not appear in P . (The same works inside a sum.)

Whilst this definition is enough for our needs, it does not cover all the cases for recursive types. For a satisfactory characterisation we can say that ≤ is in fact defined coinductively through the same set of rules and modulo µX.T = T {µX.T /X}. For a less cumbersome way, we refer to the different set of rules explicitly taking into account recursive definitions, in the original work[START_REF] Pierce | Typing and subtyping for mobile processes[END_REF].

The type system is defined as a refinement of input/output types (we inherit the first five rules of Figure 2.2 in Section 2.3), and is given by the rules of Figure3.4. There is a dedicated typing rule for every kind of prefix (free, ρ b , or bound, ρ(x)), according to the sort of the involved name. We write Γ(a) for the type associated to a in Γ. T ↔ stands for T where we switch the top-level capability: (c s T ) ↔ = c s T where o = i, i = o, = . We sometimes write Γ P, Q to mean "Γ P and Γ Q". Γ a : i r T Γ, x : T P Γ a(x).P Γ a : o r T Γ, x : T ↔ P Γ a(x).P Γ a : o r T Γ b : T Γ P Γ a b .P Γ a : i e T Γ, x : T ↔ P Γ a(x).P Γ a : o e T Γ, x : T P Γ a(x).P

This proposition mainly applies on the input side of the process P , as the tester process is a sequence of outputs. We could have formulated Proposition 3.4.1 in the slightly less general case where c j = i for all j < n, and we would not have lost much of its meaning. That said, tracking inputs is the best we can do: we cannot ensure any such notion in depth on the output side. For example it is possible to get a : oiT P and P | a(x).x(y).w ⇓ w at the same time, since P can be the process (νx : T )(a x .x(y).0). More generally, type guarantees only apply on input processes; this comes from the fact that the contracts imposed by types are only carried by input processes, combined with the fact that no free name can be transmitted to a third party.The effect of the duality on typesThe symmetry of πI is not reflected in the structure of typing judgements. Indeed, looking as the typing rule for the output and the restriction:

Types and subtypingWe consider typed versions of languages with fusions. We show that in such languages it is impossible to have a non-trivial subtyping, assuming a few simple and standard typing properties of name-passing calculi.We consider only basic type systems and basic properties for them. Like in all the calculi that we have seen so far, we assume that processes are only well-typed in type environments, which assign types to names; more sophisticated type systems exist where processes have types too, but our setting does not apply to them. In particular, we assume the standard typing rules for the operators of parallel composition and restriction in name-passing calculi (they are rules T-PAR and T-RES in the π-calculus):

the same as in rule T-INP of π: we look up the type of the object of the prefix, say T , and we require iT as the type for the subject of the prefix. To understand the typing of an arc a/b, recall that such an arc allows one to replace b with a. Rule T-ARC essentially ensures that a has at least as many capabilities as b, in line with the intuition for subtyping in capability type systems.T-NAME Γ(a) ≤ T Γ a : T T-NIL Γ 0 T-PAR Γ P Γ Q Γ P | Q T-RES Γ, a : T P Γ (νa)P T-OUTΓ a : oT Γ b : T Γ P Γ ab.P T-INPFREE Γ a : iΓ(b) Γ P Γ ab.P

Definition 4.3.1 (Preorder on names). Conditions ϕ are defined by the following grammar:ϕ ::= a ≺ b a b .Condition a ≺ b is read "a is below b", and condition a b is read "a and b are joinable". In both cases, we have n(ϕ) = {a, b}. We first define a judgement Γ ϕ, meaning that the set of conditions Γ implies condition ϕ, as follows:-REFL Γ a ≺ a -IN ϕ ∈ Γ Γ ϕ -MIRROR Γ b a Γ a b -TRANS Γ a ≺ b Γ b ≺ c Γ a ≺ c -JOIN Γ a ≺ b Γ c ≺ b Γ a c -EXTJOIN Γ a ≺ b Γ b c Γ a cWe then define a judgement P ϕ on processes (we use notation P Γ to mean that P ϕ for all ϕ in Γ):-ARC

we can build a LTS such that τ -→ = -→ea together with a bisimulation ∼ that is sound (∼ ⊆ ea) but it is not obvious to reach completeness ( ea ⊆ ∼).

given a process, this is the relation on names that relate a to b when an input on a can communicate with an output on b. In πP, it is P . In π and implicit fusions, it is the identity relation.

It can be noted that the axiomatisation of fusions given in[START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF] relies only on free input and output, and treats bound prefixes as derived operators. We think that, for πP, handling prefixes for bound and protected actions as derived operators would introduce further technical complications that would make the axiomatisation more obscure.

Preorders. Laws L1-L4 express basic properties of relations ≺ and , and actually provide an axiomatisation of ∼ for preorder processes.

Indeed when P =⇒ P we have |Φ(P ) = | ≤ |fn(P )| 2 ≤ |fn(P )| 2 . Note that visible transitions α(x)-→ create new names, so in general in a bisimulation, these sets are not bounded (if we add the replication operator).

In the strong case, [ϕ]τ is not necessary: it is enough to install a tester of the form α.w 1 | β.w 2 such that ϕ = α β and to count the number of reductions before both w 1 and w 2 appear as barbs

Going further, Pous[START_REF] Pous | Techniques modulo pour les bisimulations[END_REF] has abstracted, when possible, the powerset lattice of relations to any complete lattice, deriving techniques for coinduction itself.

In[START_REF] Barendregt | The Lambda Calculus Its Syntax and Semantics[END_REF] the notation for redexes is ∆ instead of δ.

One could object that we should first try simpler contexts that do not use pieces of context from the environment Γ (which is the role of [•] i in C i ). However, the compatibility of such simpler contexts demands the compatibility of the more involved contexts. For example, the simple context [•] | a(X).C[X] will add C[Γ] in parallel of the tested process.

Lemma 4.5.7. If ϕ 1 , ϕ 2 ϕ then ϕ ⊆ ( ϕ1 ϕ2 ∪ ϕ2 ϕ1 ).

Proof. By case analysis on the predicate (see proof script in [START_REF] Madiot | Coq proof scripts for some results on pi with preorders[END_REF].)

Relations and relate the same conditions: Lemma 4.5.8. If ϕ 1 , ϕ 2 ϕ 3 then ϕ 1 , ϕ 2 ϕ 3 . Conversely, if Γ ϕ then ψ ψ1 . . . ψn ϕ for some reflexive ψ and for some ψ 1 , . . . , ψ n ∈ Γ.

Proof. The first part is trivial: each rule for is simulated by (three) rules for . The second part follows from the fact that ( ϕ ) ⊆ ( ψ1 . . . ψn ζ ) for some ψ 1 , . . . , ψ n ∈ Γ and some reflexive ζ, which we prove by induction on Γ ϕ (Lemma 4.5.7 covers the rules -TRANS, -JOIN, -EXTJOIN).

Any number of iterations of relation P can be reduced to two: Lemma 4.5.9. ( P ) * ⊆ ( P P ).

Proof sketch. Suppose ϕ 1 P . . . P ϕ 3 . One obtains ϕ 3 from ϕ 1 by appending ψs such that P ψ at the left or at the right of ϕ 1 . We can in fact append all ψs that go to the left at first (an operation that can be done in one P step), and once this is done, appending all ψs that go to the right (the other P step). (See proof script in [START_REF] Madiot | Coq proof scripts for some results on pi with preorders[END_REF].)

In fact, we need to refine Lemma 4.5.9 with a better control on names: Lemma 4.5.10. Suppose ϕ 1 * P ϕ 4 and n(ϕ i ) = {a i , b i }. There are ϕ 2 , ϕ 3 such that ϕ 1 P ϕ 2 P ϕ 4 and ϕ 1 P ϕ 3 P ϕ 4 , with n(ϕ 2 ) = {a 1 , b 4 } and n(ϕ 3 ) = {a 4 , b 1 }.

Proof sketch. The proof follows the lines of the proof of Lemma 4.5.9.

Relation P |Q can be decomposed into P and Q . Lemma 4.5.11. P |Q ⊆ ( P ∪ Q ) * .

Proof. We prove by induction on P | Q ϕ 2 that for all ϕ 1 and ϕ 3 , if ϕ 1 , ϕ 2 ϕ 3 then ϕ 1 ( P ∪ Q ) * ϕ 3 . There are three cases. For -PAR-L we know that P ϕ 2 so ϕ 1 P ϕ 3 and for -PAR-R we get in the same way ϕ 1 Q ϕ 3 . The case for the rule -COMBINE is handled using Lemma 4.5.8. On the relation. Lemmas 4.5.12, 4.5.13 and 4.5.14 are proved using simple inductions on the predicate.

Lemma 4.5.12. If P ϕ and n(ϕ) \ fn(P ) = ∅, then ϕ is reflexive.

Below, C ranges over contexts with one hole. Proof. By induction on the derivation of P ≡ Q. In most cases we show Φ(P ) ⊆ Φ(Q) and Φ(Q) ⊆ Φ(P ) separately, and by induction on (we assume the last rule is not -COMBINE, since this case is immediate).

We focus on the following cases involving restrictions:

1. (νa)P ≡ (νb)P {b/a} when b / ∈ fn(P ): the last rule is -RES. To prove (νb)P {b/a} ϕ we can then apply -RES and we end up proving that if P ϕ then P {b/a} ϕ when a, b / ∈ n(ϕ). More generally P ϕ ⇒ P σ ϕ σ for all substitutions σ (injective or not).

(νaP

If the last rule is -PAR-R, coming from Q ϕ, we conclude easily. If the last rule is -PAR-L, coming from νaP ϕ, we get P ϕ from which (νa)(P | Q) ϕ follows. It is worth noting that if a ∈ n(ϕ), ϕ must be trivial (a a or a ≺ a).

νa(P

∈ fn(Q). Intuitively, we need to put together all contributions from P to the condition ϕ so that they are independent of Q. First, as before, from νa(P | Q) ϕ we get P | Q ϕ.

We treat the case where ϕ = b 0 c 0 (the other cases are simpler). The derivation of P | Q ϕ is built using several usages of -COMBINE involving processes P and Q, which we summarise as follows: there exist b 0 , . . . , b n and c 0 , . . . , c m such that for each ζ ∈ {b n c m , b 0 ≺b 1 , . . . , b n-1 ≺b n , c 0 ≺c 1 , . . . , c m-1 ≺c m }, we have either P ζ or Q ζ. We eliminate occurrences of a in the b i s and the c j s. For this, we proceed as follows:

(a) when a ∈ n(ζ) we replace Q ζ with P ζ (using Lemma 4.5.12 as a / ∈ fn(Q)).

(b) Hence, if b i = a then P b i-1 ≺ a and P a ≺ b i+1 , so using -COMBINE we replace these two judgements with P b i-1 ≺ b i+1 . If i = n, since P b n c m and a = b n , we deduce P b n-1 c m (the case i = 0 is not possible since a / ∈ n(φ)).

(c) We continue as long as a appears in any of the b i or c j .

We are left with a set of formulas ζ (entailing ϕ) such that a / ∈ n(ζ) and either P ζ or Q ζ, and hence (νa)P | Q ζ. From this we get (νa)P | Q ϕ by applying rule -COMBINE n + m times.

On the relation.

Definition 4.5.16. We define a relation ϕ between labels as follows: (i) α 1 (x) ϕ α 2 (x) and α 1 (x) ϕ α 2 (x) when ϕ = α 2 ≺ α 1 , and (ii) [ϕ 1 ]τ ϕ [ϕ 2 ]τ when ϕ 1 , ϕ ϕ 2 .We write P for the smallest preorder containing all ϕ when P ϕ.

Intuitively, η P µ means that label µ is less general than η, given some condition (ϕ above) enforced by P . For instance, we have {a}(x) 0 a(x). This notion is used in Lemma 4.5.25 to reason about the transition of processes.

Similarly as for ϕ , when ϕ can be decomposed, so can ϕ : Lemma 4.5.17. If ϕ 1 , ϕ 2 ϕ then ( ϕ ) ⊆ ( ϕ1 ϕ2 ) ∪ ( ϕ2 ϕ1 ).

Proof. We suppose µ ϕ η. If µ is a conditional τ , Lemma 4.5.7 is enough to conclude. Otherwise, we make an exhaustive case analysis on ϕ 1 , ϕ 2 ϕ and µ ϕ η, for instance: if a ≺ c, b ≺ c a b and {a}(x) a b b(x) then {a}(x) a≺c c(x) and c(x) b≺c b(x). (The complete case analysis appears in the proof script [START_REF] Madiot | Coq proof scripts for some results on pi with preorders[END_REF].)

We show that on extended names, ≺ is transitive and can be extended on the left (or on the right), but cannot in general be derived from ≺. From this lemma, we get tools to manipulate the P relation. 1. If α ≺ β and β ≺ γ are defined, then so is α ≺ γ and α ≺ β, β ≺ γ α ≺ γ.

2. If α ≺ β and β γ are defined, then so is α γ and α ≺ β, β γ α γ.

3. In general α ≺ β and γ ≺ β do not imply α γ.

Proof. The first two items are trivial after a case analysis on α, β, γ, we give an example for each. For (1), when (α, β, γ) = (a, {b}, {c}) we need a b, c ≺ b a c (which holds by right extension of ). For (2) (α, β, γ) = ({a}, {b}, c) we need b ≺ a, c ≺ b c ≺ a (which holds by transitivity of ≺). Finally a counterexample for (3) is for α = a, β = {b} and γ = c, since α ≺ β = a b and γ ≺ β = c b do not entail α γ = a c ( is not transitive). (See proof script [START_REF] Madiot | Coq proof scripts for some results on pi with preorders[END_REF].) Corollary 4.5.19. If α(x) P α 1 (x) and α β is defined, then α 1 β is defined and [α β]τ P [α 1 β]τ . Lemma 4.5.20. P |Q ⊆ ( P ∪ Q ) * .

Proof. For visible prefixes, we conclude by transitivity of ≺ on extended names (Lemma 4.5.18). For conditional τ 's, this is a consequence of Lemma 4.5.11. Proof. We use Lemma 4.5.20 to obtain a sequence µ 0 , µ 1 , . . . , µ n with µ = µ 0 and µ = µ n and µ i ϕi µ i+1 with for each i, P ϕ i or Q ϕ i . W.l.o.g. we can suppose when a ∈ n(ϕ i ) that P ϕ i (indeed, if instead we had Q ϕ i , then ϕ i would be trivial and thus P ϕ i ).

We then put together all subsequences ϕ i , . . . , ϕ j entailed by P , and do the same with Q, to obtain after some reindexing: µ j1 P µ j2 Q µ j3 P . . . so that for all k, a / ∈ fn(µ j k ). We can then write µ j1 νaP µ j2 Q µ j3 νaP . . ., and we are able to conclude that µ (νaP )|Q µ.

Lemma 4.5.22. If µ P |Q µ and a / ∈ fn(µ) ∪ fn(Q) then for some λ such that a / ∈ fn(λ), µ (νaP )|Q λ P µ .

Proof. As in the proof of Lemma 4.5.21, we obtain µ = µ j1 P µ j2 Q . . . P µ jn = µ , except that a may appear in µ = µ jn , but not in any other µ = µ j k if k < n. We choose λ = µ jn-1 , the rest of the proof is similar.

Lemma 4.5.23 is a tool to "shortcut" usages of preorder rules when reasoning by transition induction, to focus on the other rules. We use it frequently in the following, especially in Section 4.5.4. Lemma 4.5.23. If P µ -→ P and η P µ then P η -→ P . Conversely, whenever P η -→ P , there exists µ such that η P µ and P µ -→ P , of which there is a proof, not bigger than the one for P η -→ P , that does not end with a preorder rule.

Proof. Both directions are proved by simple inductions.

The characterisation theorem

Results about transitions. Lemma 4.5.24. If (νa)P µ -→ P 1 then P 1 = (νa)P for some P such that P µ -→ P .

Proof. Using Lemma 4.5.23 we know that (νa)P µ1 -→ P 1 for some µ 1 such that µ νaP µ 1 , and that this transition is coming from P µ1 -→ P with P 1 = (νa)P . Since Φ(νaP ) ⊆ Φ(P ), we know that µ P µ 1 , so we can derive P µ -→ P .

The proof of the next lemma, stating that transitions commute with ≡, follows from an analysis similar to the proof of Lemma 4.5.15. Notation We adopt the following notation in writing derivations, to denote either an application of the first part of Lemma 4.5.23 (i.e., an application of several preorder rules), or a recursive case analysis on the rules deriving P µ -→ P until a non-preorder rule is reached, by application of the second part of Lemma 4.5.23. Proof. More generally, we prove by induction on the derivation of P ≡ Q that for all µ, ((P

Thanks to this formulation, precongruence is handled by transition induction and equivalence properties are trivial.

We give the remaining most complicated cases, one for associativity and one for extrusion. Then we perform an induction on P µ -→ P . We factor out the cases corresponding to preorder rules using Lemmas 4.5.23 and 4.5.15, and so we assume that the last rule is not a preorder rule.

(P

what is more tricky is to get the label µ right: for that we use again Lemma 4.5.23 thanks to the fact that

) by rule -PAR-L and Lemma 4.5.15).

We can sum up the reasoning above as follows:

After an application of Lemma 4.5.23 we have µ P |Q µ 1 with a transition µ 1 that we can break into transitions from P and/or Q, depending on the last rule: we treat the case for →-PAR-L and the case of →-COM-* (the case for →-PAR-R being simpler) and use Lemma 4.5.23 multiple times.

(a) →-PAR-L: action µ 1 (coming from P ) may contain a. We use Lemma 4.5.22 to obtain a transition along λ (a / ∈ fn(λ)), such that µ 1 can be transformed into λ (using only P ) and then into µ (using both Q and νaP ). The following derivations illustrate the reasoning exposed above.

Definition 4.5.27 (Bisimulation up to ∼). A relation R is a bisimulation up to bisimilarity if it validates the clauses in the definition of ∼ (Definition 4.5.5), except that we require P ∼R∼ Q instead of P R Q and

Lemma 4.5.28. If R is a bisimulation up to bisimilarity, then R ⊆ ∼.

Proof. We prove ∼R∼ is a bisimulation. The only unusual transition µ is when µ = [ϕ]τ , but from P ∼ P 1 R Q 1 ∼ Q and P µ -→ P we know:

We conclude by transitivity of ∼ since Proof. We prove R {((νa)P, (νa)Q) | P ∼ Q} is a bisimulation up to bisimilarity (Lemma 4.5.28), which is relatively easy using Lemma 4.5.24. The only interesting case is for a conditional τ transition.

If (νa)P

[ϕ]τ --→ (νa)P then P

[ϕ]τ --→ P and using ∼,

Since we want to relate (νa)P | ϕ and (νa)Q | ϕ we ∼-rewrite them into (νa)(P | ϕ) and (νa)(Q | ϕ) (using Lemma 4.5.26) which are indeed related through R. The condition about is ensured by compositionality of (Lemma 4.5.13).

Definition 4.5.31 (Bisimulation up to ∼ and ν). A relation R is a bisimulation up to restriction and bisimilarity if it validates the clauses of the usual bisimulation, except that the outcomes of the transitions, P 1 and Q 1 , are requested to satisfy

where a stands for a (possibly empty) tuple of names. Lemma 4.5.32. If R is a bisimulation up to restriction and bisimilarity then R ⊆ ∼.

Proof. We write R ν for {(νã)P, (νã)Q) | P R Q}. We know that R ⊆ S ∼ R ν ∼ so it is enough to prove that S is a bisimulation. Suppose P ∼ (νã

We start from a transition P µ -→ P , we use the bisimulation game on ∼ and Lemma 4.5.24 to deduce (νã

We now compose what we have: (P | A) ∼ ((νã)P 1 | A) and (P 1 | A) ∼ ((νc)P 2 ). We can get from the latter ((νã)P 1 | A) ∼ ((ν ãc)P 2 ) using Lemmas 4.5.26 and 4.5.30, and then compose them using transitivity of ∼; similarly for Q:

• We now decompose ϕ when A ϕ. We know by Lemma 4.5.20 that there are some ϕ 1 , . . . , ϕ n ∈ A and a reflexive ψ such that ϕ = ψ ϕ1 . . . ϕn so in fact we only need to prove the result when ϕ is actually in A or when it is reflexive:

ϕ is reflexive and α(x) a≺a α(x): nothing to do (idempotence of +) -ϕ is reflexive and {a}(x) a a a(x): law L10 ϕ is reflexive and [ϕ 1 ]τ ϕ [ϕ 2 ]τ : we exploit L8 or idempotence of +.

ϕ ∈ A and [ϕ 1 ]τ ϕ [ϕ 2 ]τ when ϕ 1 , ϕ ϕ 2 : this yields several cases again, we can decompose into usages of , reasoning up to transitivity. (We use instances of laws L16, L9, L15, L13.)

Laws L8-L16 can be used to "saturate" the topmost prefixes in sums. We express this using the equivalence below, and rely on Lemma 4.6.3 to prove Prop. 4.6.5: Definition 4.6.4 (Head sum normal form, h ). Given two sum processes S and T , we write S ≺ h T whenever for any summand π.P of S, there exists a summand π.Q of T with π.P ∼ π.Q. We let S h T stand for S ≺ h T ∧ T ≺ h S. Proposition 4.6.5. Whenever A , S 1 ∼ A , S 2 , where S 1 , S 2 are two sum processes, there are S 1 , S 2 s.t. A , S i = A , S i (for i = 1, 2) and S 1 h S 2 .

Proof. We first use law L5 to replicate A under all prefixes in S 1 and S 2 , which is useful later in the proof. We therefore suppose that for any summand π.P of S 1 or S 2 , P = A | P 0 for some P 0 .

We prove the following property:

by running the bisimulation game with a label µ such that π and µ differ only on their object (that should be fresh in µ): π.P We have now (4.5). Equation (4.5) implies that A , S 2 = A , S 2 + T 2 with S 1 ≺ h S 2 + T 2 and T 2 ≺ h S 1 .

By reasoning symmetrically about S 2 + T 2 , we obtain T 1 such that A , S 1 = A , S 1 + T 1 with S 2 + T 2 ≺ h S 1 + T 1 and T 1 ≺ h S 2 + T 2 . Since we also have S 1 ≺ h S 2 + T 2 , we can conclude S 1 + T 1 ≺ h S 2 + T 2 and thus S 1 h S 2 with S i = S i + T i . Remark 4.6.6 (On the definition of h ). In the definition of ≺ h , we impose π.P ∼ π.Q, and not simply P ∼ Q. The equivalence induced by the choice of the latter condition would indeed be too discriminating. To see why, consider Q 1 = a(x).c/x and Q 2 = a(x).0. Obviously, c/x ∼ 0. On the other hand, we have

---→ transition on both sides, we must compare (νx)(c/x | y/x) and (νx)(y/x), and both are bisimilar to 0. In order to derive Q 1 = Q 2 , we rely on the following property, which explains the shape of laws L17, L18: a(y).P ∼ a(y).Q iff (νy)(x/y | P ) ∼ (νy)(x/y | Q).

Proposition 4.6.8 expresses that restrictions can be pushed inwards in processes. It refers to the following notion of measure on processes (which is useful to reason by induction on processes in the completeness proof): Definition 4.6.7 (Measure on processes). Given a πP + process P , we define |P | as the maximum number of prefixes in summands of P , i.e., | i π i . Proof. Using name extrusion, we pull all toplevel restrictions of A, S in order to derive A, S = (ν a)(A 0 , S 0 ), for some A 0 , S 0 without toplevel restriction.

We then reason by induction over the number of names in a. We apply laws L25-L24 from left to right, until name a does not appear free in any topmost prefix of the sum. At that point, since the restriction on a has been pushed under prefixes, a has no free occurrence in the sum. We can thus use name intrusion, so that law L23 can be applied to get rid of the restriction on a on the preorder part of the process.

This operation is iterated until restrictions are pushed under all prefixes, and law L22 can be used to get rid of the restriction.

Establishing completeness. The grammar P ::= A, i π i .P i (νa)P defines what we call |-free processes: only arcs are composed, and the non-preorder part of processes is a sum. Proposition 4.6.9 (Characterisation, without parallel composition).

For all |-free processes P and Q, P ∼ Q iff P = Q.

Proof. The 'if' part follows from Lemma 4.6.1 and congruence of ∼.

Suppose now P ∼ Q. We reason by induction on |P | + |Q|. By Proposition 4.6.8, there are sum-only processes P 0 , Q 0 with no toplevel restriction such that P = P 0 and Q = Q 0 .

We then reason up to associativity and commutativity of parallel composition to write P 0 = A 1 , S 1 and Q 0 = A 2 , S 2 . We have A 1 , S 1 ∼ A 2 , S 2 , which gives, by Proposition 4.6.2, A i , S i = A , S i for i = 1, 2, for some A .

We can then apply Proposition 4.6.5 to deduce A , S i = A , S i , for i = 1, 2, for some S 1 , S 2 s.t. S 1 h S 2 .

To sum up, we have proved until now P = A , S 1 , Q = A , S 2 , and S 1 h S 2 .

We now prove, by induction over the number of summands in S 1 , that for any such summand π.T 1 , there is a summand π.T 2 in S 2 s.t. π.T 1 = π.T 2 . Once this will be proved, we shall establish the same way the symmetrical property, which will allow us to deduce S 1 = S 2 .

Suppose then π.T 1 is a summand of S 1 . We reason by case analysis on the shape of π, and suppose π = a(x). We know, since S 1 h S 2 , that there is a summand a(x).T 2 of S 2 such that a(x).T 1 ∼ a(x).T 2 . We have a(x).T i = a(y).(νx)(y/x | T i ), for i = 1, 2, by law L17, induction hypothesis (on (νx)(y/x | T 1 ) ∼ (νx)(y/x | T 2 )) and congruence using the context a(y). [•].

Moreover, since a(x).T 1 ∼ a(x).T 2 , we know, by definition of bisimilarity with the transition labelled by a(y), that (νx)(y/x | T 1 ) ∼ (νx)(y/x | T 2 ). This allows us to rely on the induction hypothesis to show Lemma 4.6.13. For any P, a, b, we can derive EF P | a=b = P {a/b} | a=b.

Proof. Every b in top-level object position can be rewritten into an a, using the last three prefix rules, and we propagate the fusion a=b in depth using the first prefix law.

Following the proofs of soundness and completeness for the axiomatisation of πP + , we derive the same result for explicit fusions: Proposition 4.6.14. For any P, Q, we have P ∼ ef Q iff EF P = Q.

Expressiveness of πP

We compare πP with other calculi, both as examples of the use of the calculus and as a test for its expressiveness. We study the explicit fusion calculus (Section 4.7.1) and two versions of the π-calculus (Section 4.7.2).

We will study πP, and not πP + , as we do not need to assume the constructs of Sections 4.5 and 4.6, i.e. sums, conditional τ s, extended names and bound prefixes. We revert back to the first syntax (Section 4.1) with the by-need semantics (Section 4.3).

When useful, we work in a polyadic version of πP; the addition of polyadicity goes as for other namepassing calculi in the literature. Polyadic πP can be encoded into the monadic calculus along the lines of the analogous encoding for the π-calculus.

Explicit fusions

Bi-directional arcs, e.g., a/b | b/a, work as name fusions (cf, Lemma 4.3.14(3)). We thus can encode calculi based on name fusions into πP. As an example, we consider the explicit fusion calculus presented in Section 3.2.3.

The encoding from explicit fusions to πP is defined as follows for prefixes and fusions, the other constructs being encoded homomorphically (names w and y are chosen fresh in the encodings of the output and, respectively, input prefixes below. We also adopt a polyadic notation for prefixes: a ṽ and a ṽ .):

In explicit fusions, a reduction step introduces a name fusion, say a=b. In the πP encoding, this is mimicked in two steps, so to be able to produce, correspondingly, two bidirectional arcs, a/b and b/a. The first step installs the first arc. The second step is a communication on a private name, and has the effect of installing the reverse arc. We do not know whether the encoding is fully abstract. We present an operational correspondence result, given by Theorem 4.7.6 below.

In order to derive Theorem 4.7.6, we present a series of technical results. In the following, unless otherwise stated, P and Q range over πP processes, except when they appear inside encodings (e.g. in [[P ]]), in which case they range over processes of the explicit fusion calculus. We let P a = b stand for P a ≺ b and P b ≺ a. We write P = a,b Q iff P {b/a} = Q{b/a}, i.e., P and Q only differ in some occurrences of names a and b. We recall that Φ(P ) is the set {ϕ | P ϕ}. Lemma 4.7.1.

Proof. First, as a consequence of the definition of the judgement P ϕ, we can remark that Φ is monotonic (in the sense that Φ(P ) ⊆ Φ(P | Q)), and that there is a function f such that Φ(P

We prove the lemma by induction on P . The case where P does not contain any prefix is proved by establishing the simple laws Using idempotence and Lemma 4.5.15, we deduce that Φ(P

. This observation allows us to treat all other cases of the induction.

We extend the definition of = a,b to conditions: ϕ = a,b ψ iff ϕ{b/a} = ψ{b/a}. Lemma 4.7.1 can be slightly generalised: Lemma 4.7.3.

Proof. By an easy induction on |P |. The case for prefixes is important, but is easily handled using Lemma 4.5.23: since if µ 1 = a,b µ 2 then µ 1 a=b µ 2 (to prove the continuations bisimilar, we use the induction hypothesis).

When Lemma 4.7.5. For every process P of the explicit fusion calculus, if

a by induction on the derivation of the first judgement. The only interesting case is when we use an arc b/a: by definition of the encoding, we know that the arc a/b is present as soon as b/a is, which gives the expected property.

We then exploit this property in the case where [[P ]] a b. We know that there is a name u such that a ≺ u and b ≺ u and we use the first part of the proof to deduce u ≺ a and u ≺ b, which yields a ≺ b and b ≺ a.

We recall that -→ ef is the reduction relation in the explicit fusion calculus, defined in Section 3.2.3. Theorem 4.7.6 (explicit fusions, operational correspondence). Let P , Q be processes of explicit fusions.

If

for some P such that P -→ ef P .

A similar result holds for the fusion calculus [START_REF] Parrow | The fusion calculus: expressiveness and symmetry in mobile processes[END_REF]. The present statement is simpler, because in explicit fusions the triggering of a reduction step does not depend on the presence of a restriction.

Proof. 1) We prove [[P ]] ∼ [[Q]

] by induction on the derivation of P ≡ Q. The standard base cases like associativity are treated easily, because the translation yields structurally congruent processes.

The other base cases are those dealing with fusions processes:

] follow by Lemma 4.7.4.

Behavioural properties of constrained calculi

By Lemma 4.1.3, a πP1 process can only reduce to a πP1 process. This allows us to adapt (weak) behavioural equivalence ( bn , Definition 4.3.7) to πP1, yielding πP1bn , where in the last clause, we only allow contexts which, when applied to the processes being compared, yield πP1 processes. Similarly, ea , the eager equivalence (Definition 4.1.1), yields πP1ea .

We show that the constraint makes certain differences between calculi or semantics disappear. First, in the eager semantics for πP1, reduction steps where arcs are used to rewrite prefixes are deterministic.

Lemma 4.8.1 (Eager reduction in πP1). Consider P ∈ πP1, and write P / -→ P whenever P -→ ea P where the reduction is a rewrite step involving an arc. Then P / -→ P implies P πP1ea P .

Proof. In πP1, every name has at most one father in the partial order, by definition of πP1, which has two important consequences. The first consequence is that P and P have the same barbs when P / -→ P . The second is that / -→ satisfies the diamond property in πP1. This allows us to show that R = {(P, P ). P / -→ P } ∪ {(P, P )} ⊆ πP1ea . The interesting cases arise from the reductions of P . If P / -→ P 1 , then the diamond property allows us to conclude. If P -→ ea P 1 through a communication, then either P / -→-→ ea P 1 (in the case where the communication involves the prefix that has been rewritten using / -→), or P -→ ea P 1 with P 1 / -→ P 1 . In both cases, we close the diagram.

Our proof actually shows that P expands P (expansion being the efficiency preorder of [START_REF] Arun-Kumar | An efficiency preorder for processes[END_REF], defined precisely in Definition 5.1.17). In addition to Lemma 4.8.1, we can also observe that in πP1, we have the law (νa)a/b πP1ea 0, which follows from Theorem 4.8.2 and Example 4.3.10.

In fact, since reduction steps involving rewritings in the eager semantics do not correspond to commitments, the two versions of weak equivalence in πP1 coincide: Theorem 4.8.2 (Coincidence of eager and by-need semantics in πP1). πP1ea = πP1bn .

Proof. We first prove two commutation properties, where we write, like above, P / -→ P when P -→ ea P follows from a rewriting step involving an arc, and P • -→ P when P -→ ea P follows from a communication step. We have the following:

. (Here we write R = for the extension of R with the reflexive relation.) The interesting case is when / -→ rewrites a name a to b, and a is involved in the communication taking place in the -→ bn step (which exploits a c). In this case, the -→ bn step can simulate the rewriting step (since b c), because / -→ makes no commitment.

(

Using the same kind of reasoning, if / -→ rewrites a name a into b that is used afterwards in the communication step of -→ bn (using b c), then -→ bn can use the property a c.

To establish πP1bn ⊆ πP1ea , we prove that R = ( / ⇐= πP1bn / =⇒) satisfies the following stability property under eager reductions: (←ea R) ⊆ (R⇐= ea ). Consider P , P 1 , Q 1 , Q and P such that P -→ ea P and

We must show that we can find some Q to close the diagram.

• The case P / -→ P is straightforward (we choose Q = Q).

• Suppose then P • -→ P , which implies P -→ bn P . By property 2 above, we get P 1 -→ bn P 1 and P 1 / =⇒ P . This allows us to play the πP1bn game, and obtain

The reasoning is depicted on the following diagram:

Reversible eager reductions One of the inconveniences of eager reduction is the commitments it performs, as seen in the beginning of Section 4.3. This prevents the hope of implementing the more compelling by-need semantics using smaller-steps eager reductions, as shown in Example 4.3.10. One way would be to try to revert these eager reductions, exploiting ideas from backtracking in reversible process calculi [START_REF] Danos | Reversible communicating systems[END_REF] (note that we are in a much simpler setting, as we only need to backtrack rewritings, and not communications).

Indeed, at the cost of a more convoluted description of processes, there is a mean to decompose by-need reduction into reversible small-step reductions. We extend the grammar of the subject of prefixes to sets of extended names, as follows:

The first two rules are "careful" rewriting rules, that leave the possibility for other arcs to intervene on the prefix and increase the corresponding set. The last two rules tell us that a reduction is possible when the two sets in subject positions intersect (we do not allow a reduction between two protected prefixes, as it is the case in by-need).

Such a reduction would indeed never make commitments, except when doing by-need reductions. If P -→ P then we would have either P bn P or P -→ bn P . Moreover any -→ bn reduction can be decomposed into one -→ reduction or more. We believe that the corresponding weak bisimilarity would coincide with bn .

Note that this would have an interest only at an implementation level-and not for expressiveness or for discriminative power-as those prefixes can be encoded using sums:

Note how with this interpretation, the first two reduction rules correspond to prefix laws in the axiomatisation of πP, Table 4.2. actions (or labels), and -→ ⊆ Pr × Act × Pr is the transition relation. As usual, we use P, Q, R to range over the processes of the LTS, µ over the labels in Act, R and S over relations on Pr, and write P µ -→ Q when (P, µ, Q) ∈ -→. We assume that Act includes a special action τ that represents an internal activity of the processes. We derive bisimulation from the notion of progression between relations: Definition 5.1.1 (Progression). Relation R progresses to relation S, written R S, if In yet other words, bisimulations are relations R such that R ⊆ b(R). Consequently, bisimulations are the post-fixpoints of b, which is a monotone function. The proof of the Knaster-Tarski theorem on the powerset lattice then tells us that the union of post-fixpoints of b is the greatest fixpoint of b.

Writing gfp(f ) for the join of the post-fixpoints of a monotone function f , we know that gfp(f ) is the greatest fixpoint of f , which trivially implies that gfp(f ) itself is a post-fixpoint of f . Instantiating f with b, the latter states that bisimilarity is a bisimulation. Summing up, we have:

The equivalence of interest often is weak bisimilarity instead of strong bisimilarity. Instead of making similar proofs for the two cases, we handle both of them in a uniform manner: we generalise b to any monotone function b, proving results for other instances 1 of b (one of which corresponding to weak bisimilarity): We want for 'simulation up to' to be a proof method for similarity, i.e. we want that b-simulations up to f are included in b-similarity. This is equivalent to saying that (b • f )-similarity is also included in b-similarity. Hence, the desired property for techniques-called soundness-is a simple inclusion: Definition 5.1.5 (Soundness). We say

As discussed above, this definition of soundness implies that

which is the proof method that we will use in the following. For (5.1) to imply that f is b-sound, we only need for gfp(b • f ) to be a post-fixpoint of b • f , which is true when b • f is monotone. This monotonicity condition is satisfied for most functions f and b of interest, including b and all the techniques of this chapter.

In the particular case of b = b, bisimulations up to f are relations R such that R f (R). This means that those relations satisfy the "bisimulation up to" diagrams in Figure 5.2. If f (R) contains R, satisfying those diagrams is easier than satisfying those for plain bisimulation (Figure 1.1). However, R f (R) does not necessarily imply that R ⊆ b(f (R)) since the latter requires in addition that R ⊆ f (R), which might not be satisfied-for example by functions in Section 5.1.1. This technicality is of little concern

In general, soundness is not closed under composition, pointwise union of functions (see Chapter 6.3.3 of [START_REF] Pous | Enhancements of the bisimulation proof method[END_REF]), or other algebraic operators. As a remedy to this, a stronger notion, compatibility, is introduced (⊆ is lifted to functions:

As desired, the set of compatible functions is a subset of that of sound functions: Lemma 5.1.11 enables some modularity in proofs of compatibility. It is especially useful for Section 5.1.1, where the context closure function C is decomposed into a set of functions each corresponding to an operator, and C = u ω is indeed idempotent, and then C is itself compatible. Lemma 5.1.14 gets rid of the idempotence condition, with a bigger and more complex compatible function. This does not matter much, since when f ⊆ g and g b g, since g is sound and substitutive, then f is, too: S, but also with the additional hypothesis R ⊆ S, which is important when some transitions emanating from f (R)-related processes do not correspond to transitions emanating from processes in R. (We also have to prove f (R) ⊆ f (S) but f has to be monotone anyway.)

For example, take a(R) = {(a.P, a.Q)

In passing, we have a b id b id, and a is b-compatible up to id. Definition 5.1.16 (Weak progression). For relations R, S on the processes of an LTS, we say that R weakly progresses to S, written R w S, if P R Q implies:

Weak bisimilarity

The weak progression operator wb is defined as follows:

Again, R is a weak bisimulation iff R ⊆ wb(R), and weak bisimilarity indeed coincides with the union of all weak bisimulations: ≈ = gfp(wb).

Certain closure properties for compatible functions hold in the strong case (i.e. for b), but not for the weak case (i.e. for wb). The main example is the chaining operator , which implements relational composition:

where f (R) g(R) stands for the composition of the two relations f (R) and g(R). Using chaining we can obtain the b-compatibility of the function 'up to transitivity' mapping any relation R onto its reflexive and transitive closure R . In contrast, in the weak case bisimulation up to bisimilarity (R → ≈R≈) is unsound, whereas strong bisimulation up to bisimilarity (R → ∼R∼) is b-compatible. This is a major drawback in up-to techniques for weak bisimilarity, which can be partially overcome by resorting to the expansion relation [START_REF] Arun-Kumar | An efficiency preorder for processes[END_REF]. Expansion is an asymmetric refinement of weak bisimilarity whereby P Q holds if P and Q are bisimilar and, in addition, Q is at least as efficient as P , in the sense that Q is capable of producing the same activity as P without ever performing more internal activities-the τ -actions (we recall that

Definition 5.1.17 (Expansion progression). We write R e S when P R Q implies: Up to expansion yields a function (R → R ) that is wb-compatible. As a consequence, the same holds for the 'up to expansion and contexts' function. In fact, we care less about compatibility properties for e than those for b and wb, as is mainly used as a technique for ≈. (Though we will sometimes consider e-compatible functions, for example R → R∼.)

More sophisticated up-to techniques can be obtained by carefully adjusting the interplay between visible and internal transitions, and by taking into account termination hypotheses [START_REF] Pous | Techniques modulo pour les bisimulations[END_REF][START_REF] Pous | Enhancements of the bisimulation proof method[END_REF].

Some further compatible functions are the functions b and wb themselves (indeed a function

hence trivially f can be replaced by b itself). Intuitively, the use of b and wb as up-to techniques means that, in a diagram-chasing argument, the two derivatives need not be related; it is sufficient that the derivatives of such derivatives be related. Accordingly, we sometimes call functions b and wb unfolding functions. We will use b in the example in Section 5.4.1 and wb in Sections 5.3 and 5.4, when proving the wb-compatibility of the up to context techniques. Terminology We will simply say that a function is compatible to mean that it is both b-compatible and wb-compatible; similarly for compatibility up to.

Initial contexts

In this chapter, we establish LTSes for which bisimilarities (b-and/or wb-similarities) capture the equivalences of interest. We inherit all the theory of up-to techniques, along with the functions already proved (b-or wb-) compatible. These functions, although useful, are not specific to each LTS, and hence we want to establish the compatibility of the techniques specific to the syntax the corresponding calculus. Hence, we consider the "up to context" techniques, which are particularly useful. Those techniques can typically be decomposed into smaller functions.

In languages defined from a grammar, an n-ary context C is a term with numbered holes [•] 1 , . . . , [•] n , and each hole [•] i can appear any number of times in C. When P is a sequence of n processes P 1 , . . . , P n , we write C[ P ] for C where each [•] i is replaced with P i . Using the same notation for Q, we write P R Q when

and indeed, b ≥ fn(P ) ∪ fn(Q ), and R 1 is a weak bisimulation.

For the converse, proving that

is a weak early bisimulation (Definition 2.2.4) needs a little more care, are there are more labels to handle. Suppose P R 2 Q, which means there is a c ≥ fn(P ) ∪ fn(Q) such that (c, P ) ≈ (c, Q). We analyse the transitions of the form P (We used Lemma 5.2.2, proved in the following.)

if µ

The above full abstraction result allows us to import the theory of up-to techniques for first-order LTSes and bisimilarity, both in the strong and the weak case. We have however to prove the soundness of up-to techniques that are specific to the π-calculus. These include two up-to techniques that allow us to apply injective substitutions to the names, and the up to context technique. Function isub implements 'up to injective name substitutions':

fn(P σ) ∪ fn(Qσ) ≤ d, and σ is injective on fn(P ) ∪ fn(Q) } .

A subtle drawback is the need of another function manipulating names, str, allowing us to replace the index c in a named process (c, P ) with a lower one:

Lemma 5.2.2. The set {isub, str} is compatible up to.

We analyse the transition (c, !P ) µ -→ (c , P ). We adapt Lemma 5.17 from [START_REF] Pous | Techniques modulo pour les bisimulations[END_REF] characterising the transitions from a replicated process, to the π-calculus: if !P µ -→ π P then one of the following holds: In each case, we obtain, since R S with (c,

) with Q of the same shape, so we only need to relate (c , P ) to (c , Q ) knowing (b, P i ) S (b, Q i ). First, remark that (b, P ) isub(S) (b, Q). We have now the following pairs in f (S) where f = (C ! ∪ id) • isub:

we apply now C | several times to obtain the three pairs (with

The first two pairs handle cases 1 and 2. For case 3 we need to apply C ν to add (νb)and then str to get back from (b, (νb)-) to (c, (νb)-). We apply and hence, putting back together all the cases, the following evolution:

We have established evolutions from all functions in

(there are two iterations in the evolution of C ! ). We conclude by establishing the idempotence of u ω . Each of the functions in F is continuous in the sense of Remark 5.1.12 (note that C i is continuous, too: (c, P ) C i (R) (c, Q) can only use a finite (bounded by c + 1) number of "requests" to R), so the union is continuous as well and u ω is idempotent.

Weak bisimilarity is not preserved by sums, only by guarded sums, whose function is

Note that we use the 'up to bisimilarity' function R → ∼R∼ which is wb-compatible.

Theorem 5.2.6. The set {C

larger one; w(R) is the smallest relation that includes R and such that, whenever (V, Γ, M ) w(R) (W, ∆, N ) then also (Γ, M ) w(R) (∆, N ), where V and W are values. In other terms:

Here w stands for 'weakening' as, from Lemmas 5.1.8 and 5.

The technique "up to permutation" contains (Γ π , ∆ π ) (respectively ((Γ π , M ), (∆ π , N ))) when (Γ, ∆) (respectively ((Γ, M ), (∆, N ))) is in the base relation, writing Γ π for (V π(1) , . . . , V π(n) ) when Γ = (V 1 , . . . , V n ) and π is a permutation of {1, . . . , n}. We use this technique without explicitly mentioning it, which is easily proven compatible and Scott-continuous.

Lemma 5.3.3. Function w is compatible.

Proof. Rather immediate: τ transitions do not alter the environment, and as for a i, C transition (writing

where C +n is the shifting of each hole

=⇒ (∆, N ), and so from R w S we can build w(R)

Somehow dual to weakening is the strengthening of the environment, in which a component of an environment can be removed. However this is only possible if the component removed is 'redundant', that is, it can be obtained by gluing other pieces of the environment within a context; strengthening is captured by the following str function:

is a value context when the outermost operator of C v is an abstraction). We derive the compatibility up to of str in Theorem 5.3.8.

For up to context, we need to distinguish between arbitrary contexts and evaluation contexts. There are indeed substitutivity properties, and corresponding up-to techniques, that only hold for the latter contexts. For example, with Ω (λx.xx)(λx.xx), since we have Ω -→ n Ω, we get (Γ, Ω) ∼ (∆, Ω) for all environments Γ and ∆. If we could apply substitutivity with context C = (λxy.y)[•] to it, then we would obtain (Γ, C[Ω]) ∼ (∆, C[Ω]) which implies (Γ, λy.y) ∼ (∆, λy.y) (and then Γ ∼ ∆ using w), which is false for example with Γ = (λx.x) and ∆ = (λx.Ω).

Soundness also does not hold for arbitrary contexts, for similar reasons: relation R {((Γ, Ω), (∆, Ω)), ((Γ, (λx.x)(λy.Ω)), (∆, (λx.x)(λy.Ω)))} is a bisimulation up to arbitrary contexts (the first pair progresses to itself, the second pair progresses to the first one using the context λy.[•]) but R ⊆ ∼ would imply (Γ, λy.Ω) ∼ (∆, λy.Ω) and then Γ ∼ ∆ using w.

A hole [•] i of a context C is in a redex position if the context obtained by filling all the holes but [•] i with values is an evaluation context. We define below C ("up to arbitrary contexts, on values") and C e ("up to evaluation contexts") as follows:

.

Above, C ranges over arbitrary contexts, whereas E ranges over contexts whose first hole is in redex position.

In the following, we prove that these functions are compatible up to. First, we establish two technical lemmas that we will use several times in the compatibility proofs. We reason similarly for e and wb .

Note that b, b , e, e , wb and wb are Scott-continuous when {(µ, P ) | P µ -→ P } is finite for all P , even if =⇒ is not image-finite. Unfortunately, this is not the case for ΛN 1 , so we will resort to Lemma 5.1.14 instead of Lemma 5.1.11 and have a more intricate witness. We use wb in the following lemma: Lemma 5.3.5. In ΛN 1 (and in ΛR 1 of Section 5.4), if (Γ, y) ∈ wb (S) then y =⇒ ∆ with (Γ, ∆) ∈ wb ( S ).

Proof. We know that there is a label µ = 1, C 0 (where C 0 is some context of arity |Γ|, for example the context λx.x with no hole) such that Γ µ -→ x 0 , that y must catch up with y µ =⇒ y 0 for some y 0 . Since µ is a transition that only configurations of values can make, there must be some ∆ such that y =⇒ ∆ µ -→=⇒ y 0 . Note also that Γ and ∆ have the same arities, and hence the same transitions.

We prove now {(Γ, ∆)} w (S⇐=). We analyse the transitions labelled with µ = i, C from both sides.

1. Suppose that Γ In the end {(Γ, ∆)} weakly progresses to S⇐= which is included in S since =⇒ ⊆ in a deterministic setting.

Remark 5.3.6. Note that Lemma 5.3.5 is highly specific to the LTS: it works for ΛN 1 in this section and for ΛR 1 in the next, but the proof uses the fact that reduction is deterministic, and that values can have roughly the same sets of transitions. A more robust approach would be to have a label to declare that the configuration is composed of values:

This would get rid of the need of Lemma 5.3.5, and would tolerate nondeterminism. After all, "being a value" is the only observable in the equivalence we capture, so it is sensible to have the corresponding label. Lemma 5.3.5 holds whenever the actions of the LTS are split into τ actions, for non-value configurations, and disjoints classes of visible actions, for value configurations, such that all the labels in each class are triggered at the same moment. In ΛN 1 , this is exemplified by the following property:

where i ≤ |Γ| and C is |Γ|-ary. This requires that the information of arity of the context is present in C (otherwise, we resort to adding the transition λ from Remark 5.3.6 to the LTS).

The following lemma holds, with a similar proof:

Lemma 5.3.7. In ΛN 1 (and in ΛR 1 of Section 5.4) if (x, ∆) ∈ e (S) then x =⇒ Γ with (Γ, ∆) ∈ e ( S).

We will use Lemma 5.3.7 in Section 5.4.

separately, with similar proofs. Moreover the two cases of contexts (arbitrary contexts and evaluation contexts) had to be considered at the same time, within the same proof. Here, in contrast, the machinery of compatible functions allows us to split the proof into simpler proofs.

Remark 5.3.12. A transition system ensuring full abstraction as in Theorem 5.3.2 does not guarantee the compatibility of the up-to techniques specific to the language being considered. For instance, a simpler and maybe more natural alternative to the second transition in (5.5) is the following one:

(5.6)

With this rule, full abstraction holds, but up to context is unsound: for any Γ and ∆, the singleton relation {(Γ, ∆)} is a bisimulation up to C: indeed, using rule (5.6), the derivatives of the pair Γ, ∆ are of the shape

), and they can be discarded immediately, up to context [•] i C. If up to context were sound then we would deduce that any two terms are bisimilar. (The rule in (5.5) prevents such a behaviour since it ensures that the tested values are 'consumed' immediately.)

Beta-reduction is included in expansion

Lemma 5.3.15 shows that the full β reduction, → β (whereby an arbitrary redex in a term is consumed) is an expansion. This is a useful property in applications of up-to techniques. The proof of the lemma requires results of confluence between → β and -→ n , and the standardisation theorem [START_REF] Barendregt | The Lambda Calculus Its Syntax and Semantics[END_REF].

and M are of the following forms, where u i → = β u i for all i (we write for later usage the unifying term N ):

depending on the position of the β-redex of M → β M . In the case M = M the confluence is trivial. Otherwise, we see as well M -→ n N and M → * β N . We supposed M → β M instead of M → * β M : we conclude by induction. Lemma 5.3.14. If M → * β V and V is a value, then for some value W , M -→ * n W . Proof. By the standardisation theorem (Theorem 11.4.7 from [START_REF] Barendregt | The Lambda Calculus Its Syntax and Semantics[END_REF]), there is a standard reduction M → * s V from M to V . Since "being a value" is preserved by β-reduction, there is a first W such that M → * s W → * s V . We prove M -→ * n W . Inducting on the first → * s we need only to prove that in a standard reduction from a non-value to a value, the first step is a call-by-name step.

From a non-value term N = (λx.u 1 )u 2 u 3 . . . u n (with n ≥ 2), consider the standard reduction N → s N → * s W and let us prove N -→ n N . Let δ be the cbn redex 2 (λx.u 1 )u 2 . In the standard reduction there must be a redex δ j residual of δ, otherwise W would be of the form (λx.u 1 )u 2 u 3 . . . u n with u i → * β u i and W would not be a value. Let δ 1 be the first redex. Suppose by contradiction that δ 1 = δ. Then: 1. either δ 1 is in u 1 or in u 2 : then δ contains δ 1 , 2. or δ 1 is in u i for some i ≥ 3: then δ is to the left of δ 1 .

In both cases, δ 1 and δ are in forbidden configurations for a standard reduction as δ j (residual of δ) is triggered after δ 1 . We conclude δ 1 = ∆, i.e. that the first redex of a standard reduction to a value is a cbn redex.

We can derive the corresponding (weak or not) transition labelled with i , C , cod(v) from the RHS (t; ∆, N ) which will reduce to (t ; ∆ W ) and then (t ; ∆ V v , N ) knowing that (s ; Γ V v , M ) S (t ; ∆ V v , N ). We can then replace Γ V v and ∆ W v with Γ rV u and ∆ rW u up to permutation.

2. Suppose i ∈ {|Γ| + 1, . . . , |Γ| + 2|r|}. Then Γ rV i is either get or set with ∈ dom(r).

(a) if Γ rV i = get then s is not modified and M = r[Γ r ] is a context of Γ r and hence of Γ V v using the same v as above. Hence the transition goes to

x . Using Lemma 5.3.5 we get (t; ∆, N ) =⇒ (t ; ∆ W ) related to (s, Γ V ) through S 1 = wb ( S ). Note that when running e progressions instead of wb, we use Lemma 5.3.7 when N is a value W to get (s; M ) to reach (s ; V ) with ((s ; Γ, V ), (t; ∆, W )) ∈ e ( S). Finally we can relate x to

] for a trivial C 1 , so we progress again, using the same notations as before, to C(store(S 1 )).

Finally we get that store b store ∪ C • store • g b with:

g e S → e ( S∼) .

We will make reference to g b in the evolutions for the other functions:

1. We prove w b w along the same lines as for Lemma 5.3.3.

str

(a) As long as M is not a value we stay in str(S).

(b) If M is a value V , and we run V itself or any of the Γ i , then we run the same transition i, C, cod(r) on the original configuration (s; Γ, V ) and we still stay in str(S). ) for some context D (indeed, C 1 Γ can contain some get and set ). In fact we prove the stronger result (using weakening w) that the resulting configurations with the context D (using C) are still related if get 's and set 's are available (using store). Below, we write Λ for getset( ). We now suppose that µ is visible, i.e. µ = i, C, cod(r) and (s; Γ, M ) µ -→ (s ; Γ , M ) for some s , Γ , M satisfying ( * ) below. It also means that M is a value V and thus (s; M ) ⇓. By choosing E = [•] 1 and u = ∅ in (5.8) we know that (t; N )⇓ and thus (t; N ) =⇒ R (t ; W ) for some value W . Then, we get the weak transition (t; ∆, N ) µ =⇒ (t ; ∆ , N ) through (t ; ∆, W ), satisfying ( * * ) below.

We prove now (s ; Γ , M ) R (t ; ∆ , N ). Let E be any location-free evaluation context, we prove:

(5.9) Backtracking one step using ( * ) and ( * * ) it is enough to prove

which we do by exhibiting an evaluation context F for which we already have (by instantiating the definition of R with F ) the equation (5.11) below, and we also know that each member of (5.10) is a derivative of the corresponding member of (5.11).

For (5.11) to imply (5.10), we instantiate F as follows:

where r is the collection of i → C i , and D • is the context D, in which:

1. the holes [•] 1 (to be filled with values V and W ) are filled with x.

2. the holes corresponding to getset(r) are already filled with the corresponding get i 's and set i 's, the remaining holes are to be filled with Γ (and not Γ ) in (5.11).

Note that substitutivity of bisimilarity is restricted either to values (C), or to evaluation contexts (C e ). Lemma 5.4.6 provides a sufficient condition for a given law between arbitrary terms to be preserved by arbitrary contexts. We first establish weaker results, useful to complete the proof of Lemma 5.4.6.

In the following, we use to denote any of the relations ∼, ≈, and .

Lemma 5.4.4. Suppose that for all s and Γ, we have (s; Γ, L) (s; Γ, R). Then for all s, Γ and evaluation context F which might contain free locations, (s; Γ,

(F might contain free locations, contrarily to above in descriptions of transitions and up to context functions, where contexts are restricted to have no free locations.)

Proof. Let A be the list of set and get for all location in F . Then it is easy to get F from F such that F = F [-, A] and F is location-free. By hypothesis we know (s; Γ, A, L) (s; Γ, A, R) on which we apply substitutivity for evaluation contexts C e to get (s; Γ, A, F [L, A]) (s; Γ, A, F [R, A]) (Lemmas 5.4.2 and 5.1.9). By weakening w we get (s; Γ, F [L, A]) (s; Γ, F [R, A]).

Lemma 5.4.5. Let L, R be ΛR terms with (s; Γ, L) (s; Γ, R) for all environment Γ and store s. Suppose C is a multi hole context, such that no hole is in evaluation position in C. Then for all Γ and s we have

Proof. We do the proof for the most interesting case, = , and we discuss the other cases at the end of the proof.

Let R relate each configuration ((

) to the one where R replaces L:

) for all (C v ) and Cv families of value contexts (of the form λx.C ), and where C ranges over contexts where no hole occur in evaluation position. For short we write s L , s R , Γ L , and Γ R for the corresponding stores and environments. We run simultaneously the transitions from both sides (s L ; Γ L , C[L]) and (s R ; Γ R , C[R]) as they keep having the same shape.

We prove R is an expansion relation up to expansion (i.e. R e ( R)). We rely on the fact that L and R will never be run directly in this proof.

Silent action

) is not in evaluation position, both sides will do the same kind of transition, being completely oblivious to L/R. The resulting configurations will be

). (Even if a set or a get is involved, and some L/R come from or go to the store, the configurations keep the same shape.)

The only part of the invariant of the relation that is not preserved is that L/R may appear in evaluation position, if C [L] = E[L, L] (where [•] 1 is in evaluation position and [•] 2 may appear everywhere).

In this case, we remark that F E[-, L] is an evaluation context, on which we can apply Lemma 5.4.4 to have (s

) and we have closed the diagram.

Note that it may happen that even if E[L, -] does not have holes in evaluation position, E[R, -] does. In this case, we just use Lemma 5.4.4 to transform L's into R's one at at time, as long as there are still such holes in evaluation position. The progression to R still holds, since is transitive.

2. Visible action. First, C[L] is a value iff C[R] is a value so they have the same visible actions of the form i, D, cod(r). We end up in the same shape of configurations we had for the τ transition above, and proceed the same to close the diagram.

Finally we have proved that R progresses to R (expansion up to expansion). In the strong case, we need to prove that R progresses to ∼R, and in the weak case we need that R weakly progresses to both ≈R and R≈, which is necessary because in the weak case, one can use "up to ≈" only when ≈ is not on the same side as the challenge.

Lemma 5.4.6. Let be any of the relations ∼, ≈, and . Suppose L, R are ΛR terms with (s; Γ, L) (s; Γ, R) for all environments Γ and store s. Then also

), for any store s, environment Γ and context C.

Proof. Using Lemma 5.4.4 and transitivity of , we rewrite first L into R as long as there is a L in evaluation position, and repeat until there is no such L (which can happen several times if L is not a value but R is, for example if L = II and R = I, then L is in evaluation position in LL on the right and in LR on the left). We then apply Lemma 5.4.5.

To get Lemma 5.4.6, we combine the results for evaluation contexts (Lemma 5.4.4) and for non-evaluation contexts (Lemma 5.4.5). This separation is critical, as handling all contexts together would yield a much bigger and error-prone bisimulation candidate as L and R in Lemma 5.4.5 would be replaced by all intricate combinations of E and E .

In the following R + is the transitive closure of R.

Lemma 5.4.7. Suppose that E and E are evaluation contexts and that for all value V and store s, we have

Then for all environment Γ and store s, we have (s; Γ, E[M ]) (s; Γ, E [M ]). Proof. For a given Γ we consider R = {(s; Γ, E[M ]), (s; Γ, E [M ]) | for any s and M } and the transitions from both sides:

1. when M is not a value, (s; M ) -→ R (s ; M ) and the only transition from both sides is a τ staying in the relation.

(left to right) when

) so the first transition from the left-hand side is a τ . We use up to expansion to reach (s; Γ, E [V ]) which is equal to the right-hand side, and conclude up to reflexivity.

s ; Γ , N ) and we conclude again up to reflexivity.

We proved R is an expansion relation up to expansion and reflexivity.

Corollary 5.4.8. Suppose that E and E are evaluation contexts and that for all value V value and store s, we have (s

Then for all environment s and context C, we have

Proof. Consequence of Lemma 5.4.7 and Lemma 5.4.6.

We use this lemma at various places in the example we present in Section 5.4.1. For instance we use it to replace a term N 1 (λx.E[x])M (with E an evaluation context) with N 2 E[M ], under an arbitrary context. Such a property is delicate to prove, even for closed terms, because the evaluation of M could involve reading from a location of the store that itself could contain occurrences of N 1 and N 2 .

An example

We discuss an example from [START_REF] Koutavas | Small bisimulations for reasoning about higher-order imperative programs[END_REF]. It consists in proving a law between terms of ΛR extended with integers, operators for integer addition and subtraction, and a conditional-those constructs are straightforward to accommodate in the presented framework. For readability, we also use the standard notation for store assignment, dereference and sequence: ( := M ) set M , ! get I, and M ; N (λx.N )M where x does not appear in N . The two terms are the following ones:

where incr λz. := ! + 2, and F λz.I. Intuitively, those two terms are weakly bisimilar because the location bound by in the first term will always contain an even number.

This example is also considered in [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF] where it is however modified to fit the up-to techniques considered in that paper. The latter are less powerful than those available here thanks to the theory of up-to techniques for first-order LTSes (e.g., up to expansion is not considered in [SKS11]-its addition to environmental bisimulations is non-trivial, because one needs to handle stores and environments).

We consider two proofs of the example. In comparison with the proof in [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF]: (i) we handle the original example from [START_REF] Koutavas | Small bisimulations for reasoning about higher-order imperative programs[END_REF], and (ii) the availability of a broader set of up-to techniques and the possibility of freely combining them allows us to work with smaller relations. In the first proof we work up to the store (through the function store) and up to expansion-two techniques that are not available in [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF]. In the second proof we exploit the up to transitivity technique of Section 5.1, which is only sound for strong bisimilarity, to further reduce the size of the relation we work with.

First proof. We first employ Corollary 5.4.8 to reach a variant similar to that of [START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF]: we make a 'thunk' out of the test in M , and we make N look similar. More precisely, let test λz.if ! mod 2 = 0 then I else Ω, we first prove that • M ≈ M λg.ν := 0; g(incr ); test I, and

It then suffices to prove that M ≈ N , which we do using the following relation:

In the definition of R, the initial pair of terms is generalised by adding any number of private locations, since M can use itself to create more of them. We prove that relation R is a weak bisimulation up to store, C and expansion.

We write (s; Γ ˜ ) for the left-hand side of a pair in R and (∅; ∆ ˜ ) for the right-hand side. Consider a transition 1, C, cod(r) from M and N . We write below Γ for Γ ˜ , getset(r) and ∆ for ∆ ˜ , getset(r).

• (s; Γ ˜ ) Now we apply C with the context D, then the weakening w to remove incr and test to reach the pair we wanted. Now that we handled M and N , let us look at any transition i, C, cod(r) coming from some incr (and F on the other side). It will result in I on both sides (the argument C is discarded), with s( ) being updated to s( ) + 2 which stays in the relation. The store is augmented with r[Γ ] and r[∆ ] and the environment with getset(r) which can be safely removed using the store technique as we did before. The same is done when a test is run: both sides reduce to I, the argument is discarded, and the r part of the transition is garbage-collected.

Second proof. Here we also preprocess the terms using Corollary 5.4.8 to add a few artificial internal steps to N , so that we can carry out the remainder of the proof using strong bisimilarity, which enjoys more up-to techniques than weak bisimilarity:

• M ≈ M λg.ν := 0; g(incr ); test I,

• N ≈ N λg.I; I; g(incr 0 ); test 0 I.

where incr 0 and test 0 just return I on any input, taking the same number of internal steps as incr and test .

We show that M ∼ N by proving that the following relation S is a strong bisimulation up to unfolding, store, weakening, strengthening, transitivity and context (a technique unsound in the weak case): where star : R → R is the reflexive-transitive closure function. This up-to technique, unsound in the weak case (transitivity is unsound), is powerful enough to make the bisimulation considerably smaller. Proving that the second member of S progresses to itself (up to store) is straightforward. We focus on the following transitions from M and N : where Γ = M , getset(r) and ∆ = N , getset(r). We use b as an up-to technique 3 twice to run two steps of reduction on both sides:

This way we trigger ν and := 0 and obtain two configurations H 1 and H 2 that can be related using a few up-to functions: To conclude, S, as a strong bisimulation up to (unfolding, store, weakening, strengthening, transitivity and context), is included in ∼.

About the two proofs

The difference between the relation R in the first proof and the proofs in [START_REF] Koutavas | Small bisimulations for reasoning about higher-order imperative programs[END_REF][START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF] is that R only requires locations that appear free in the tested terms; in contrast, the relations in [START_REF] Koutavas | Small bisimulations for reasoning about higher-order imperative programs[END_REF][START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF] need to be closed under all possible extensions of the store, including extensions in which related locations are mapped onto arbitrary context-closures of related values. We avoid this thanks to the up to store function. The reason why, both in [START_REF] Koutavas | Small bisimulations for reasoning about higher-order imperative programs[END_REF][START_REF] Sangiorgi | Environmental bisimulations for higher-order languages[END_REF] and in the first proof above, several locations have to be considered is that, with bisimulations akin to environmental bisimulation, the input for a function is built using the values that occur in the candidate relation. In our example, this means that the input for a function can be a context-closure of M and N ; hence uses of the input may cause several evaluations of M and N , each of which generates a new location. In this respect, it is surprising that our second proof avoids multiple allocations (the candidate relation S only mentions one location). This is due to the massive combination of up-to techniques whereby, whenever a new location is created, a double application of up to context (the 'double' is obtained from up to transitivity) together with some administrative work (given by the other techniques) allows us to absorb the location.

Conclusion: applicability of the method

In this section, we assess the relevance of first-order LTSes for a few common calculi, and give an account for each of them to say how the most straightforward approaches would work. We observe, as in Remark 5.3.12 for the lambda-calculus, that full abstraction is in general not sufficient if one desires to have up to context techniques (in fact, in this section, we do not talk about the full abstraction correspondences with the original calculi).

This section focuses on the problems we encounter when studying up to context functions in first-order LTSes, in the hope of providing the reader with a general intuition of what is likely to work, and what is not.

Asynchronous bisimilarities

In asynchronous process calculi, the continuations of output prefixes are always 0. The literature usually studies asynchronous variants of the π-calculus, but in this section we focus on a problem that is not related to name-passing. Therefore, we use instead an asynchronous variant of CCS, written ACCS and defined as the following subcalculus of CCS: P ::= 0 P | Q (νa)P a a.P P + Q .

To capture barbed congruence (as remarked in Section 2.1.2, there are no input barbs in this calculus since a.w is not a valid process) for this calculus, one need different notions of bisimilarities [ACS96, HT91]: