The five lectures at Marktoberdorf on which these notes are based were about the architecture of problem solving environments which use theorem provers. Experience with these systems over the past two decades has shown that the prover must be extensible, yet it must be kept safe. We examine a way to safely add new decision procedures to the Nuprl prover. It relies on a reflection mechanism and is applicable to any tactic-oriented prover with sufficient reflection. The lectures explain reflection in the setting of constructive type theory, the core logic of Nuprl.

This note gives a new proof of the `operational extensionality' property of Abramsky's lazy lambda calculus---namely the coincidence of contextual equivalence with a co-inductively defined notion of `applicative bisimilarity'. This purely syntactic result is here proved using a logical relation (due to Plotkin) between the syntax and its denotational semantics. The proof exploits a mixed inductive/coinductive characterisation of the logical relation recently discovered by the author.

this paper, it is necessary to examine the weak points of the status quo. We identify two which influenced the worked presented here. First, the construction of weak, branching-time congruences is not as simple Preprint submitted to Elsevier Preprint 20 April as one might wish. The gap between CCS observation equivalence and observation congruence in the presence of summation is the best known example of the difficulties we have in mind; but see also [6]. The use of a transition system in which externally unobservable behaviour is represented explicitly (by

This paper introduces an operational semantics for call-by-need reduction in terms of Milner's ß-calculus. The functional programming interest lies in the use of ß-calculus as an abstract yet realistic target language. The practical value of the encoding is demonstrated with an outline for a parallel code generator. From a theoretical perspective, the ß-calculus representation of computational strategies with shared reductions is novel and solves a problem posed by Milner [13]. The compactness of the process calculus presentation makes it interesting as an alternative definition of call-by-need. Correctness of the encoding is proved with respect to the call-by-need -calculus of Ariola et al. [3]. 1 Introduction Graph reduction of extended -calculi has become a mature field of applied research. The efficiency of the implementations is due in great measure to a technique known as `sharing', whereby argument values are computed (at most) once and then memoized for future reference. Both...

This paper shows how a fully abstract model for a rich metalanguage like FPC can be used to prove theorems about other languages. In particular, we use results obtained from a game semantics of FPC to show that the natural translation of the lazy -calculus into the metalanguage is fully abstract, thus obtaining a new full abstraction result from an old one. The proofs involved are very easy---all the hard work was done in giving the original games model. So far we have been unable to prove the completeness of our translation without recourse to the denotational model; we therefore have an indication of the worth of such fully abstract models. 1 Introduction Plotkin, in his CSLI notes [18], showed how denotational semantics can be viewed as a two-stage process. First one defines a metalanguage which describes elements of the intended semantic model, usually some category of domains. Then to give semantics to a language L it suffices to translate it into the metalanguage. While this is ...

a mis hermanas, Patricia y Paula, y a mi sobrino y ahijado, Nicol'as. Acknowledgements First of all, I would like to express my gratitude to my supervisor, Eike Ritter, for his wisdom, insight, uncountably many discussions, and invaluable friendship. I am indebted to my tutor, Valeria de Paiva, who also believed in me from the very beginning, encouraged me to work in this area, showed me the beauty of logic, and, above all, honoured me with her friendship. This thesis would not exist if it were not for their constant support. Thanks to my old friends, Cecilia C. Crespo, Santiago M. Peric'as, and, especially, Mat'ias Giovannini, for being always a wonderful critic of my work. Many thanks to Mathias Kegelmann for showing me the thrill of theorem proving; and to my former supervisor, Achim Jung, for introducing me to semantics.

The purpose of this paper is to report on our experiments to use Isabelle -- a generic theorem prover -- as a universal environment within which specification, development and verification of imperative programs can be performed. The use of a theorem prover for the programming tasks is most appropriate when the processes of program specification, development and verification can be presented as logical activities. In our case this is achieved by adopting pLSD -- a novel programming logic.

Initial structures are good for modelling constructor-based data types because they fit the intuition about these types and admit resolution- and rewrite-oriented inductive theorem proving. The corresponding specification and verification methods do not comply so well with non-free or permutative types such as sets, bags and maps and are still less appropriate when infinite structures like streams or processes come into play. Non-free and infinite structure are better modelled as dynamic objects, which are identified through reactions upon actions (methods, messages, state transitions) rather than through constructors they might be built of. Extensional, contextual, behavioural, observational or bisimilarity relations model object equality and the suitable domains are final structures that are conservative with respect to visible subtypes. Consequently, a collection of data types and programs should be designed hierarchically as a "swinging " chain of specifications each of which extends its predecessor by either constructor types or action types. Constructor types introduce the visible domains and come with inductively defined total functions, structural equality and safety predicates with Horn clause axioms, while action types provide the hidden domains together with coinductively defined partial functions, behavioural equality and liveness predicates with liveness axioms that are dual to Horn clauses. A swinging specification is interpreted as a sequence of initial and final models. General proof

Introduction The articles in this volume concern operational semantics of higher order programming languages, mathematical techniques for developing the properties of such operational semantics, and applications of those techniques. In this Introduction we set the articles in the wider context of research into programming languages and bring out some of the themes and techniques that recur throughout the book. Operational Semantics The various approaches to giving meanings to programming languages fall broadly into three categories: denotational, axiomatic, and operational. In a denotational semantics, the meaning of programs is defined abstractly using elements of some suitable mathematical structure. In an axiomatic semantics, meaning is defined indirectly via the axioms and rules of some logic of program properties. In an operational semantics, the meaning of programs is defined in terms of their behaviour, for example the steps of computation they can take during

The notion of contextual equivalence is fundamental in the theory of programming languages. By setting up a notion of bisimilarity, and showing that it coincides with contextual equivalence, one obtains a simple coinductive proof technique for showing that two programs are equivalent in all contexts. In this paper we apply these (now standard) techniques to interactions nets, a graphical programming language characterized by local reduction. This work generalizes previous studies of operational equivalence in interaction nets since it can be applied to untyped systems, thus all systems of interaction nets are captured.