From Applicative To Environmental Bisimulation Vasileios - - PowerPoint PPT Presentation

¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ Research ¡supported ¡in ¡part ¡by ¡SFI ¡projects ¡ ¡13/RC/2094 ¡& ¡06/IN.1/1898 ¡ ¡

From ¡Applicative ¡To ¡ ¡ Environmental ¡Bisimulation

Vasileios ¡Koutavas ¡ Trinity ¡College ¡Dublin ¡ Joint ¡work ¡with ¡Paul ¡B. ¡Levy ¡and ¡Eijiro ¡Sumii ¡

QMUL ¡Program ¡Equivalence ¡Workshop, ¡April ¡2016 ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡based ¡on ¡[MFPS’11]

Two Versions of Progr Fragment

Version 2

Version 1 ...

C1 C2 C3 C1 C2 C3

... Is the behaviour preserved for any possible pair of programs? Contextual Equivalence

Contextual Equivalence [Morris ‘60s]

For all program contexts C: If then and vice-versa

3

e ≡ e’ C[e] 42 ...

Contextual Equivalence [Morris ‘60s]

For all program contexts C: If then and vice-versa

4

e ≡ e’ C[e] 42 ... C[e’] 42 ...

Contextual Equivalence [Morris ‘60s]

For all program contexts C: If then and vice-versa

5

e ≡ e’ C[e] 42 ... C[e’] 42 ...

Contextual Equivalence [Morris ‘60s]

For all program contexts C: If then and vice-versa

6

e ≡ e’ C[e] 42 ... C[e’] 42 ...

42 is unimportant

Contextual Equivalence [Morris ‘60s]

For all program contexts C: If then and vice-versa

7

e ≡ e’ C[e] 42 ... C[e’] 42 ...

how can we prove anything equivalent?

Theories of equivalence

We develop methods to prove contextual equivalence without the “forall C” Instead: describe the interactions of an expression with its environment Depends on

Language features Abstraction mechanisms

8

Theories of equivalence

Prevailing techniques

Bisimulations Game semantics Logical relations Trace semantics CIU Theorems Denotational semantics ...

9

Some history of bisimulations

Concurrency [Park’81,Milner’89, Sangiorgi’92,...]

CCS, π-calculus

Programming languages

Applicative bisimulation [Abramsky’90, Gordon & Rees’96] λ-calculus, object calculi Environmental Bisimulation [Sumii & Pierce‘04’05, Koutavas & Wand’06, Sangiorgi et al. ’07 …] Polymorphism, encryption, state update, Java,… Open Bisim [Sangiorgi’94,Lassen & Levy ’07, Jagadeesan et al. ’07]

10

Bisimulation Theories of Equivalence

Applicative Bisimulation (A.B.) [Abramsky’90]

+ Simple defjnition ∓Soundness is a deep result, shown by [Howe’96] − Works only for pure languages (recursion, nondeterminism, I/O)

Environmental Bisimulation (E.B.) [Sumii-Pierce’04]

− Complicated defjnition ∓Soundness is rather trivial: a convenient way of organizing the

concept of contextual equivalence

+ Works for a wide range of languages (store, names, exceptions,

polymorphism, concurrency)

11

A functional language

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

13

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

e.g. (λx. x) (λx. x x)

14

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

Operational Semantics:

e → e’

e.g. (λx. x) (λx. x x)

15

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

Operational Semantics:

e → e’

e.g. (λx. x) 3 (λx. x x)

16

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

Operational Semantics:

e → e’

e.g. (λx. x) 3 → 3 (λx. x x)

17

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

Operational Semantics:

e → e’

e.g. (λx. x) 3 → 3 (λx. x x) (λy. y y)

18

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

Operational Semantics:

e → e’

e.g. (λx. x) 3 → 3 (λx. x x) (λy. y y) → (λy. y y) (λy. y y) →...

19

The Lambda Calculus

Syntax:

Functions: λx. e Application: (e e’)

Operational Semantics:

e → e’

e.g. (λx. x) 3 → 3 (λx. x x) (λy. y y) → (λy. y y) (λy. y y)

20

+ tuples, numbers, ...

The Bisimulation Game

Player & Opponent

21

f1..fn f’1..f’n

The Bisimulation Game

22

f1..fn i, ui f’1..f’n

Player & Opponent fi ui →* w

Player & Opponent

The Bisimulation Game

23

f1..fn i, ui w↝g1..gm f’1..f’n

fi ui →* w

The Bisimulation Game

24

f1..fn i, ui w↝g1..gm f’1..f’n

Player & Opponent decompose w and collect all the functions

The Bisimulation Game

Player & Opponent

25

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m

The Bisimulation Game

Player & Opponent

26

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m

Same decomposition: w and w’ may differ only on functions

The Bisimulation Game

Player & Opponent

27

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m j, uj v’↝h’1..h’k

The Bisimulation Game

Player & Opponent

28

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m j, uj v↝h1..hk j, uj v’↝h’1..h’k

Player & Opponent O wins: when exists a play where P cannot match move P wins: otherwise

29

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m j, uj v↝h1..hk j, uj v’↝h’1..h’k

The Bisimulation Game

Player & Opponent O wins: when exists a play where P cannot match move P wins: otherwise

30

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m j, uj v↝h1..hk j, uj v’↝h’1..h’k

The Bisimulation Game

Coinduction

e.g.:

31

λx.(x, x) λx.(x x, x)

The Bisimulation Game

e.g.:

32

λx.(x, x) 1, λy.y y (λy.y y, λy.y y) λx.(x x, x)

The Bisimulation Game

e.g.:

33

λx.(x, x) 1, λy.y y (λy.y y, λy.y y) λx.(x x, x) 1, λy.y y

The Bisimulation Game

This is Applicative Bisimulation

The arguments to fi, f’i are the same closed value They do not contain the f1 .. fn, f’1 .. f’n Functional extensionality It forgets the functions of previous stages

34

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m j, uj v↝h1..hk j, uj v’↝h’1..h’k

The Bisimulation Game

Theorem [Howe’96]: for simple functional languages (λ- calculus) e, e’ are contextually equivalent iff e, e’ are applicative bisimilar

35

Applicative Bisimulation

Useful: Bisimulation gives us a proof technique

• 1. Construct R containing all the states of the bisimulation

game

• 2. Prove that from each state to the next the player cannot get

stuck

36

Applicative Bisimulation

Useful: Bisimulation gives us a proof technique

• 1. Construct R containing all the states of the bisimulation

game

• 2. Prove that from each state to the next the player cannot get

stuck

37

Applicative Bisimulation

f1..fn f’1..f’n R

Useful: Bisimulation gives us a proof technique

• 1. Construct R containing all the states of the bisimulation

game

• 2. Prove that from each state to the next the player cannot get

stuck

38

Applicative Bisimulation

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m R R

Useful: Bisimulation gives us a proof technique

• 1. Construct R containing all the states of the bisimulation

game

• 2. Prove that from each state to the next the player cannot get

stuck

39

Applicative Bisimulation

f1..fn i, ui w↝g1..gm f’1..f’n i, ui w’↝g’1..g’m R R

Does it scale to other languages?

[K,Levy,Sumii’11]

A.B. for a Pure Language

Consider equivalence at type (1→1)→Bool

Functions are applicative bisimilar if they map closed values of type (1→1) to the same boolean (or divergence) This encodes the notion of extensionality of functions

Is A.B. a sound reasoning principle for

state? names? existential types? exceptions?

40

No, but what changes would it take to make it work?

First Change: Generation

Consider contexts that generate fresh locations (or names, exceptions) used in arguments to functions

41

M, M’ : (Int→1)→1 M ≜ λf. f 1; f 2 M‘ ≜ λf. f 2; f 1 C ≜ new r:=1; [ ] (λx. r:=x); !r

Second Change: Accumulation

Applicative bisimulation contexts apply functions

• nce

With state: a function may give a different answer the second time it is called With names: a function may return a different name every time it is called With existential types: must allow to apply an old function of type α→Bool to a new value of type α With exceptions: the need is more subtle (see examples in [MFPS’11])

42

The bisimulation needs to accumulate functions as it goes along

A.B. w/ Generation & Accumulation

Main question: whether applicative bisimulation + generation + accumulation is sound for various language features

NO for names NO for state NO for existential types NO for exceptions

43

λ-calculus + bool store

λ-Calculus + bool store

T ::= 0 | A+A | 1 | AxA | A→A | X | recX. A V ::= ... M ::= ... | new ℓ:=b | !ℓ | ℓ:=b s ∈ Loc ⇀ Bool s, M ⇓ t, V

45

Example

M, M’ : (1→1)→Bool M ≜ λg. g(); true M‘ ≜ new fmag:=true. F’ F‘ ≜ λg. if !fmag then fmag:=false; g(); fmag:=true; true else false

46

closed stateful arguments of type V : (1→1)

• read global state & diverge
• read/write global state & return ()

Example

M, M’ : (1→1)→Bool M ≜ λg. g(); true M‘ ≜ new fmag:=true. F’ F‘ ≜ λg. if !fmag then fmag:=false; g(); fmag:=true; true else false

47

Applying the functions multiple times to closed (stateful) arguments will not distinguish them

Example

M, M’ : (1→1)→Bool M ≜ λg. g(); true M‘ ≜ new fmag:=true. F’ F‘ ≜ λg. if !fmag then fmag:=false; g(); fmag:=true; true else false

48

distinguishing argument: V ≜ λ(). r := [ ] dummy distinguishing context: new r:=true; let f = [ ] in f V[f]; !r

λ + Higher-Order Store

The same example is valid for languages that can store functions Similar examples for other languages

• λ + names
• λ + exceptions
• λ + existential types (!)

49

Example

50

M = λf:unit ￫ unit. f(); return true M’= new fmag=true in V’ V’ = λf:unit ￫ unit. if fmag then fmag:=false; f(); fmag:=true; return true else return false

Example

51

M = λf:unit ￫ unit. f(); return true M’= new fmag=true. V’ V’ = λf:unit ￫ unit. if fmag then fmag:=false; f(); fmag:=true; return true else return false

let g = [ ] in new record = true in g (λz.record:= g (λy.y); return z); return record C =

Example

52

M = λf:unit ￫ unit. f(); return true M’= new fmag=true. V’ V’ = λf:unit ￫ unit. if fmag then fmag:=false; f(); fmag:=true; return true else return false

let g = [ ] in new record = true in g (λz.record:= g (λy.y); return z); return record C = “resourceful” argument

Environmental Bisimulation

53

s; f1..fn i, (si, ui)[f1..fn/x1..xn] s,t; (w1..wk↝g1..gm), f1..fn s’; f’1..f’n i, (si, ui)[f’1..f’n/x1..xn] s’ ,t’; (w’1..w’k↝g’1..g’m), f’1..f’n

Example

54

M = λf:unit ￫ unit. f(); return true M’= new fmag=true. V’ V’ = λf:unit ￫ unit. if fmag then fmag:=false; f(); fmag:=true; return true else return false

Example

55

M = λf:unit ￫ unit. f(); return true M’= new fmag=true. V’ V’ = λf:unit ￫ unit. if fmag then fmag:=false; f(); fmag:=true; return true else return false

[]; M [fmag=true]; V’

Example

56

M = λf:unit ￫ unit. f(); return true M’= new fmag=true. V’ V’ = λf:unit ￫ unit. if fmag then fmag:=false; f(); fmag:=true; return true else return false

[]; M 1, s1, u1[M/g] []; (true,true↝ε), Μ [fmag=true]; V’ s1= [record=true] u1=λz.record:= g (λy.y); return z

Example

57

M = λf:unit ￫ unit. f(); return true M’= new fmag=true. V’ V’ = λf:unit ￫ unit. if fmag then fmag:=false; f(); fmag:=true; return true else return false

[]; M 1, s1, u1[M/g] []; (true,true↝ε), Μ [fmag=true]; V’ 1, s1, u1[V’/g] [fmag=true]; false,true↝ s1= [record=true] u1=λz.record:= g (λy.y); return z

So...

The obvious extension of A.B. with

Name generation Accumulation of functions

is not sufficient to achieve soundness in We need something more: “Resourceful” arguments

i.e. open arguments, closed with the related functions With this addition we get exactly Environmental Bisim.

58

λ + store (FO & HO) λ + names λ + exceptions λ + existential types

One more thing...

The obvious extension of A.B. with

Name generation Accumulation of functions

is not sufficient to achieve soundness in We need something more: “Resourceful” arguments

i.e. open arguments, closed with the related functions With this addition we get exactly E.B. λ + store (FO & HO) λ + names λ + exceptions λ + existential types

So...

60

UNSOUND! (see paper)

The obvious extension of A.B. with

Name generation Accumulation of functions

is not sufficient to achieve soundness in We need something more: “Resourceful” arguments

i.e. open arguments, closed with the related functions With this addition we get exactly E.B. λ + store (FO & HO) λ + names λ + exceptions λ + existential types

So...

61

No single answer...

A.B. + Acc. + Resourcefulness

Sound* for

Deterministic languages Countable nondeterminism + may testing Finite nondeterminism + must testing

Unsound for

Countable nondeterminism + must testing Finite nondeterminism + divergent-insensitive bisimilarity

62

* Have not proved this

One Last Example

M, M’ : rec α. Nm→1+α M ≜ accepts an unbounded number of fresh names M‘ ≜ chooses k and accepts up to k fresh names

63

λ + names + countable nondeterminism + ≣must

n1 n2 n3 n4

M

n1 () n1 n2 n3

M’

n1 n2 () ()

One Last Example

M, M’ : rec α. Nm→1+α M ≜ accepts an unbounded number of fresh names M‘ ≜ chooses k and accepts up to k fresh names

64

n1 n2 n3 n4

M + M’

n1 () n1 n2 n3

M’

n1 n2 () ()

Indistinguishable by contexts that pick (a fjnite number of) names only at the beginning

λ + names + countable nondeterminism + ≣must

One Last Example

M, M’ : rec α. Nm→1+α M ≜ accepts an unbounded number of fresh names M‘ ≜ chooses k and accepts up to k fresh names

65

n1 n2 n3 n4

M + M’

n1 () n1 n2 n3

M’

n1 n2 () ()

distinguishing context: provides fresh names as long as the function accepts them λ + names + countable nondeterminism + ≣must

Thanks!