Classical realizability as a classifier for nondeterminism

05/29/2018
by   Guillaume Geoffroy, et al.
Aix-Marseille Université
0

We show how the language of Krivine's classical realizability may be used to specify various forms of nondeterminism and relate them with properties of realizability models. More specifically, we introduce an abstract notion of multi-evaluation relation which allows us to finely describe various nondeterministic behaviours. This defines a hierarchy of computational models, ordered by their degree of nondeterminism, similar to Sazonov's degrees of parallelism. What we show is a duality between the structure of the characteristic Boolean algebra of a realizability model and the degree of nondeterminism in its underlying computational model. ACM Reference Format: Guillaume Geoffroy. 2018. Classical realizability as a classifier for nondeter-minism.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

07/17/2019

Degrees of Randomized Computability

In this survey we discuss work of Levin and V'yugin on collections of se...
01/19/2018

Boolean constant degree functions on the slice are junta

We show that a Boolean degree d function on the slice [n]k = { (x_1,...,...
01/19/2018

Boolean constant degree functions on the slice are juntas

We show that a Boolean degree d function on the slice [n]k = { (x_1,...,...
03/13/2018

Semi-BCI Algebras

The notion of semi-BCI algebras is introduced and some of its properties...
10/07/2019

Revisiting the duality of computation: an algebraic analysis of classical realizability models

In an impressive series of papers, Krivine showed at the edge of the las...
09/09/2021

Degrees of randomized computability: decomposition into atoms

In this paper we study structural properties of LV-degrees of the algebr...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1. Introduction

Classical realizability

Realizability is an instance of the formulas-as-types/proofs-as-programs correspondence in which each formula is interpreted as the specification of a certain computational behaviour. Initially, this correspondence (and hence realizability) was limited to intuitionistic reasoning, until Griffin noted a connection between control operators and classical reasoning (Griffin, 1990), which lifted this limitation. Classical realizability is an extension of Kleene’s realizability to accommodate classical reasoning: using control operators, Krivine developed a theory capable of interpreting all classical reasoning within second-order arithmetic ((Krivine, 2003, 2009)) and Zermelo–Fraenkel set theory with dependent choice ((Krivine, 2001, 2011, 2012b, 2012a, 2014)). Subsequently, Miquel adapted this framework to higher-order arithmetic (Miquel, 2011).

Following intuitionistic realizability, Krivine’s framework is made of three ingredients:

  • A computational model (in Krivine’s setting, it is called a realizability algebra). In general, it is a set of programs (with an operational semantics);

  • A logical language (for arithmetic, higher-order arithmetic or set theory), together with a realizability relation expressing the fact that a given program realizes a given formula. The essential result is the adequacy lemma which states that classical realizability is compatible with deduction rules;

  • A realizability model (in the usual sense of model theory), which satisfies all formulas that are realized. Such a model must exist by the completeness theorem. Krivine noted that this construction may be seen as an extension of Cohen’s forcing construction (Cohen, 1966). Here, we will not look at it directly, nor even define it explicitly: we will look at realizability theories (i.e. consistent sets of realized formulas) rather than realizability models.

In Krivine’s framework, each realizability model comes with a characteristic Boolean algebra (“gimel ”) (Krivine, 2012b) whose structure encodes interesting properties of the model. In particular, forcing models correspond to the degenerate case where .

In order to emphasise the central role of the characteristic Boolean algebra, let us recall that classical realizability gives rise to surprising models of set theory (such as the model of threads (Krivine, 2012b)), whose strange set-theoretic properties are mostly direct consequences of the structure of their characteristic Boolean algebras.

As noted above, classical realizability can be seen as an extension of forcing. However, while there are plenty of theoretical results connecting the properties of a forcing model to the structure of the underlying forcing set, there is currently a severe lack of general results connecting the properties of a classical realizability model to the properties of the underlying computational model. The goal of this paper is to start addressing this state of affairs by two means. First, by proving new results of this kind (namely, results which connect the presence of nondeterminism in the computational model with the size of the characteristic Boolean algebra in the realizability model), and second, by introducing a new framework which should make it easier, in the future, to find such results.

Nondeterminism

The logical language can be extended by adding realizability connectives (such as union “” and intersection “”), which may in particular be used to express various forms of nondeterminism in the computational model.

For example, we will see that the formula specifies the may-nondeterministic choice operator “”, which takes two programs as arguments and does whatever either does. Dually the formula specifies the must-nondeterministic choice operator “”, which takes two programs as arguments and only does what both do.

It is known that adding a must-nondeterministic choice operator does not change the realizability model (no new formulas are realized), and that adding a may-nondeterministic choice operator collapses it into a forcing model.

However, we show that adding more subtle nondeterministic instructions corresponding to different mixes of may and must has the effect of altering the properties of . To this end, we define an abstract notion of multi-evaluation relation which can express arbitrary mixes of may- and must-nondeterminism such as Kleene’s “parallel or(Kleene, 1952), Berry’s “Gustave’s function(Berry, 1976), and Trakhtenbrot’s “voting function(Trakhtenbrot, 1974), as well as generalisations thereof.

Outline

We recall Krivine’s formalisation of classical realizability – in the context of second-order arithmetic – (sections 2 and 3). Our presentation follows closely those given by Krivine and Miquel, except that, instead of individual poles, we consider sets of poles (which we call realizability structures), a formula being realized if it has a common realizer for all the poles in the structure. The rationale behind this is that realizability structures are a notion dual to multi-evaluation relations.

Then, we define the notion of multi-evaluation relation (section 4) and show that each multi-evaluation relation defines a unique realizability structure.

Next, we analyse in detail particular examples of such mixes, to notice that they are organised in a hierarchy, in terms of both their computational expressiveness and the properties of to which they correspond (sections 6 and 5). This hierarchy is reminiscent of Sazonov’s degrees of parallelism (Sazonov, 1976).

Finally, we prove that this hierarchy does not collapse: each level is indeed strictly more expressive than the levels below (section 7). To this end, we prove that can be made elementarily equivalent to any finite Boolean algebra with at least two elements. The case of Boolean algebras with elements was stated and proved by Krivine (Krivine, 2012a), but the method used here is new.

The contributions of this paper are:

  • The dual notions of realizability structures and multi-evaluation relations,

  • The results connecting the size of to voting functions, parallel or and Gustave’s function (the result about fork is due to Krivine),

  • The method presented in section 7, which fits nicely in the framework developed here, and will be used in some future work to prove the same result about all Boolean algebras, not just the finite ones.

2. Classical realizability semantics

Following Krivine (Krivine, 2012b), we define the model of computation and the logical language which will be used throughout this paper, and we connect them through the classical realizability interpretation.

2.1. The computational model: the -calculus

The -calculus is a model of computation which extends pure -calculus (with a specific evaluation strategy, namely: weak head -reduction) by the addition of a control operator (call-with-current-continuation). It is made up of three kinds of syntactic entities: -terms, stacks and processes.

Definition 1 ().

Let us fix a countably infinite set of variables. The sets of -terms, stacks and processes are defined by the following grammars, modulo -equivalence (free and bound variables are defined as usual, abstraction being the only binding construction):

-terms:

Stacks:

Processes:

The additional instructions (i.e. and ) will serve as customizable instructions: the evaluation relation of the -calculus, which we will define in this section, gives no evaluation rule for them, and therefore treats them as inert constants. On the other hand, in section 4, we will define multi-evaluation relations

, which can specify evaluation rules for these instructions: thus, the meaning of a given additional instruction will depend on the particular evaluation relation which we are considering at the moment. Typically, they will represent nondeterministic choice operators.

Intuitively, restricted instructions correspond to privileged instructions of real-world processors (which cannot be called directly be the user), while unrestricted instructions correspond to system calls (through which the user can access privileged instructions, in a controlled fashion).

From now on, closed -terms will be simply called terms.

The set of terms is denoted by , the set of stacks by and the set of processes by .

If is a process, we call its head term and its stack.

Application is left-associative (so means ) and has higher priority than abstraction (so means ). We write for applied times to .

Substitutions (Krivine, 2002) (0).

Given any list of -terms and any list of distinct variables , we will denote by the -term obtained by replacing simultaneously each free occurrence of by in for .

Definition 2 ().

The evaluation relation of the -calculus, denoted by , is the smallest preorder on satisfying the following rules:

The one-step evaluation relation of -calculus, denoted by , is the smallest binary relation on satisfying these rules.

The push and grab rules simulate weak head -reduction; they will make the realizability interpretation compatible with intuitionistic logic. The save and restore rules allow a program (i.e. a term) to save its evaluation context (i.e. the stack), and restore it later; they will make the realizability interpretation compatible with classical logic.

Remark 0 ().

The one-step evaluation relation is deterministic: for all , if and , then .

2.2. The realizability language

The realizability language is a second-order logical language, whose first-order terms are intended to represent integers.

Definition 3 ().

We fix a set of first-order variables, and for each natural number , we fix a set of -ary propositional variables. Those sets are taken pairwise disjoint and countably infinite. The sets of first-order terms and of formulas are described by the following grammars, modulo -equivalence (the binding constructions being first- and second-order universal quantifications).

First order terms:

Formulas:

All formulas can be interpreted as describing program behaviours. In addition, formulas which only contain first-order terms, propositional variables, , , and also have a logical meaning: they can be interpreted in (or any model of second-order arithmetic). These formulas are called arithmetic formulas.

The construction is called equational implcation. As we will see later, it is logically equivalent to regular implication (), and its interest lies in the fact that realizers of are easier to read, write and understand than realizers of (they involve less “red tape”).

We write for .

Caution: we use the same letters for first-order variables and variables of -calculus. It will always be clear from context which is which.

Additional connectives (0).

Equality and additional logical connectives are defined by the usual second-order encodings:

  • means ;

  • means ;

  • means ;

  • means ;

  • means ;

  • means ;

  • means .

Connectives are, from highest to lowest precedence: , , , , , , , , , , and . In addition, , and are left-associative, and is right-associative.

First-order substitutions (0).

Given any formula or first-order term , any list of first-order terms and any list of distinct first-order variables we denote by the formula or the first-order term obtained by replacing simultaneously each free occurrence of by in for .

Second-order substitutions (0).

Given any two formulas , any -ary propositional variable and any list of distinct first-order variables , we denote by the formula obtained by replacing by in . Specifically, each free occurence of of the form , is replaced by .

Formulas and terms with parameters (0).

Given any formula or first-order term and any list of distinct first-order variables containing at least all the free variables of , we will sometimes denote by (the point of this notation is to order the free variables of ). In that case, given any list of first-order terms we will write for .

When writing first-order terms, we will use all sorts of abuses of notation, such as writing instead of , or instead of , etc.

In addition, if are formulas and is , , or , we will write for .

2.3. Classical realizability

Definition 4 ().

A pole is a set of processes which is closed by anti-evaluation, that is to say, a set such that for all , if and , then . The set of all poles is denoted by .

Definition 5 ().

Let be a closed first-order term. The value of , written is the integer defined (inductively) by

Definition 6 ().

Let be a pole and a subset of . The dual of with respect to , denoted by , is the set .

Definition 7 ().

Let be a pole and a closed formula. The falsity value of with respect to , denoted by , is the subset of defined below, and the truth value of with respect to , denoted by , is defined as .

Falsity values of closed formulas are defined as follows:

  • , ;

  • ;

  • ;

  • ;

  • ;

  • .

Notation 0 ().

Let be a closed formula. We denote by the function which maps to , and by the function which maps to .

Definition 8 ().

Let be a closed formula, a term and a pole. If , we say that realizes with respect to , and we write .

Definition 9 ().

Let be a closed formula and a term. We say that realizes universally if realizes with respect to every pole.

Remark 0 ().

Let be a pole. For all , if , then . Therefore, for all closed formulas and , if , then – in particular, the identity term realizes .

Semantic equivalence and semantic subtyping (Rieg, 2014) (0).

Let and be two closed formulas. If is a pole, we write if and if . Moreover, we write if for all , and if for all .

2.4. Adequacy

2.4.1. Typing -terms

We type -terms with (non-necessarily closed) formulas of the realizability language.

A context is a finite set of hypotheses of the form (with a variable of the -calculus and a formula) such that no variable of the -calculus appears more than once. Variables of the -calculus which appear on the left of an hypothesis are said to be declared in the context, and variables of the realizability language which appear freely on the right of at least one hypothesis are said to be free in the context.

Typing judgments are sequents of the form , where is a context, is a -term whose free variables are all declared in , and is a formula.

A typing derivation is a tree formed with the following typing rules. Its root is called its conclusion:

[left label=(Axiom)]0 Γ, x : A ⊢x : A


[left label=(Peirce)]0 Γ⊢c: ((A →B) →A) →A



[left label=(-intro)]0 Γ⊢t : ⊤

Γ⊢t : ⊥ [left label=(-elim)]1 Γ⊢t : A


Γ, x : A ⊢t : B [left label=(-intro)]1 Γ⊢λx. t : A →B


Γ⊢t : A →B Γ⊢u : A [left label=(-elim)]2 Γ⊢t u : B


Γ⊢t : A [left label=(-intro)]1[( not free in )] Γ⊢t : ∀x  A



Γ⊢t : ∀x  A [left label=(-elim)]1 Γ⊢t : A[x := a]



Γ⊢t : A [left label=(-intro)]1[( not free in )] Γ⊢t : ∀X  A


Γ⊢t : ∀X  A [left label=(-elim)]1 Γ⊢t : A[X(y_1, …, y_n) := B]


These are the usual rules of intuitionistic natural deduction, plus the rule that is typed by Peirce’s law.

A sequent is said to be derivable if it is the conclusion of some derivation.

The following lemma states the compatibility of classical realizability with respect to deduction rules:

Proposition 10 (Adequacy lemma).

Let be a pole, a derivable sequent with closed, and terms such that realizes w.r.t. for all . The term realizes w.r.t. .

The proof can be found in (Krivine, 2012b) (although in a set-theoretical rather than second-order-arithmetical setting).

2.5. Realizability structures

So far, we have considered realizability with respect to a fixed pole and uniform realizability across all poles (i.e. universal realizablity). However, in order to state the results of this paper, we will need to consider uniform realizability across arbitrary sets of poles:

Definition 11 ().

A realizability structure is a set of poles.

Definition 12 ().

Let be a closed formula, a term and a realizability structure. If for all , we say that realizes with respect to , and we write .

Remark 0 ().

To simplify notation, when we have fixed a realizability structure but no individual pole, we shall say that realizes and write to mean , and when we have fixed a pole , we shall say that realizes and write to mean .

Now, we might be tempted to define the theory of a realizability structure as the set of all formulas which have a realizer with respect to this structure. However, an important feature of classical (as opposed to intuitionistic) realizability is that, given any non-empty pole , there are terms which realize with respect to . Indeed, take and form the term : when evaluated, this term ignores its context and replaces it with the “winning” context , therefore it realises with respect to . As a result, to avoid getting inconsistent theories, we will consider the following restriction:

Definition 13 ().

The set of proof-like terms, denoted by , is the set of all terms which do not contain any continuation constant () nor any restricted instruction ().

We also exclude restricted instructions because in some cases (e.g. in section 7), it will be convenient to require some of them to realize (or other inconsistent formulas), and we want to do so without breaking the logic.

Definition 14 ().

Let be a realizability structure. The theory generated by , denoted by , is the set of all closed formulas such that there exists a proof-like term which realizes with respect to .

Intuitively, the adequacy lemma means that is closed by the rules of classical deduction. Therefore, we will write for , and we will say that is inconsistent if it contains , and consistent if it does not. Likewise, we will say that the structure is consistent (respectively, inconsistent) if is.

From now on, we will say that a formula is universally realized if it is universally realized by a proof-like term.

Definition 15 ().

Two formulas and are universally equivalent if the formula is universally realized.

Remark 0 ().

A realizability structure is consistent if and only if there is no proof-like term such that for all and all .

Remark 0 ().

It is well-known that if , then the truth value of an arithmetic formula is if is true in , and else (Miquel, 2009). In particular, an arithmetic formula which is universally realized must be true in . However, the converse is false, as we will shortly see.

Theories of the form , which we will call realizability theories, will be our main object of study: what are their properties, and how do these relate to the properties of the generating realizability structures?

2.6. Equations, inequations and equational implications

Equations and inequations are preserved by classical realizability, in the following sense:

Lemma 16 ().

Let and be closed first-order terms.

Proof.

Both facts can be checked by expanding the definitions on either side of the equality. ∎

Moreover, as mentioned above, equational implication is equivalent to regular implication:

Lemma 17 ().

Let be a formula and and two first-order terms. The formulas and are universally equivalent.

Proof.

By the previous lemma and the definition of , we see that universally realizes the left-to-right implication and the right-to-left implication. ∎

In particular, formulas which contain the construction can also be read as arithmetic formulas.

2.7. Horn clauses

An other important class of formulas which are preserved by classical realizability is the class of Horn clauses:

Proposition 18 ().

Let be a Horn clause, i.e. a closed formula of the form , with of the form for all , and of the form either (definite clause) or (goal clause). In particular, is arithmetic. If is true in , then is universally realized, and if not, then is universally realized.

Proof.

Let us first assume that is false in . Let be values for which invalidate it (i.e. the are true and is false). Then universally realizes for all , so universally realizes either (if is a goal clause) or (if is a definite clause).

Now, let us assume that is true, and let us fix a pole and some . To simplify notation, we will write for , etc. Let be terms such that realizes for all . If all the are true, then is true (and therefore, of the form ), so realizes . If any of the is false, then realizes , therefore, if is of the form , it is realized by , and if it is , then it is realized by . ∎

However, as we will see in section 7, a universal () formula which is not a Horn clause (i.e. which is not of the form described in proposition 18) is generally not universally realized, even if it is true in .

2.8. The axioms of arithmetics in the realizability model

Let denote the successor function: for all . The first two axioms of Peano, which can be written as and , are universally realized (by proposition 18). However, the axiom of induction, which can be written as , is not, as we will see later.

Notwithstanding, we can define a predicate such that all three axioms are realized when relativized to : let denote the formula Intuitively, says “ is a natural number”.

Proposition 19 ().

The following formulas are universally realized:

  • ;

  • ;

  • ;

  • ;

  • .

Proof.

The third and fourth are consequences of their non-relativized versions, and the other three are provable in second-order logic (and therefore realized, by the adequacy lemma).∎

3. The characteristic Boolean algebra

In this section, we define the characteristic Boolean algebra and prove some general properties about it.

Intuitively, is a unary predicate (i.e. a set of individuals) present in each realizability model. Since we are dealing with models of second-order logic, must be thought of as a “first-class” object in the realizability model. However, for simplicity, we will define it as a formula with one parameter, i.e. a purely syntactic object.

The predicate is designed so that and are both true (i.e. universally realized) and are all false. Moreover, and crucially, it is designed so that and are true in the same way, i.e. . In that respect, it is very different from the predicate , which represents the set .

In fact, we can define a predicate for all , although only is a Boolean algebra:

Notation 0 ().

For all integers and , we denote by the greater of the two, and by the lesser. For all first order terms and , we write for .

Definition 1 ().

Let be a natural number and a first-order term: we denote by the formula .

By lemma 16, is universally realized if , and is universally realized otherwise.

However, whenever , the formula is not universally realized, even though it is true in . This means that the predicate does not represent the set . We will prove this for in section 7.

Relativized quantifiers (0).

Let be an integer, a first-order variable and a formula. We write for .

Now, we show how to equip with the structure of a Boolean algebra, inherited from the set :

Notation 0 ().

For all natural numbers and , let

  • if or , otherwise,

  • if and , otherwise,

  • if , otherwise,

Definition 2 ().

The language of Boolean algebras is the subset of the realizability language defined by the following grammar:

Terms:

Terms and formulas of this language can be interpreted in any Boolean algebra. In particular, they can be interpreted in the Boolean algebra .

Note that we use the same notations , and for operations in Boolean algebras and for logical connectives: the context will always make it clear which is which.

Notation 0 ().

If is a formula of the language of Boolean algebras, we denote by the formula relativized to (i.e., with all turned into ).

We choose this notation, rather than the more conventional , in order to emphasise that we think of as a first-class object of the realizability model which, from the point of view of the realizability model, happens to be a Boolean algebra (i.e. a first-order structure on the language of Boolean algebras satisfying all the axioms of Boolean algebras).

Note that the formula is true in if and only if is true in .

The following proposition establishes that is indeed a Boolean algebra (with at least two elements):

Proposition 3 ().

Let be a closed formula of the language of Boolean algebras. If is true in every Boolean algebra with at least two elements, then is universally realized.

Proof.

The theory of Boolean algebras with at least two elements can be axiomatised by a list of formulas, where each is of the form and is of the form or .

For all , denote by the formula : it is a Horn clause, and it is universally equivalent to the formula , which is true in (because is true in ). Therefore, by proposition 18, is universally realized.

The proposition follows by the adequacy lemma and the completeness theorem of first-order logic. ∎

The cardinality of

An important property of a realizability model is the cardinality of its characteristic Boolean algebra. This subsection develops the basic tools that we will need in order to state and prove facts about this cardinality.

If is a Boolean algebra and a positive integer, then formula is true in if and only if has fewer than elements. This justifies the following notation:

Notation 0 ().

Let be a positive integer.

  • We denote by (or ) the formula

  • We denote by the formula ,

  • We denote by the formula .

Remark 0 ().

The cardinality of a finite Boolean algebra is always a power of two. Therefore, for all , the formulas are universally equivalent, and in particular, the formula is universally equivalent to .

In general, a Boolean algebra has at least element if and only if it contains a sequence of pairwise-disjoint non-zero elements. Therefore, by proposition 3, the sentences “ has at least elements” and “ contains a sequence of pairwise-disjoint elements” are equivalent (see (Givant and Halmos, 2008), chapter 15). We will favour the latter, because because its formal statement (as a formula of the realizability language) has a better-behaved falsity value:

Notation 0 ().

For all positive integers , let us denote by the following formula of the language of Boolean algebras:

If is a Boolean algebra and a positive integer, then the formula is true in if and only if it is not possible to find pairwise-disjoint non-zero elements in .

The following lemma describes the falsity value of and shows that it is indeed quite simple:

Lemma 4 ().

Let be a positive integer, a pole, and . Then if and only if at most one of the does not realize .

Proof.

For all , one can check that if and only if at most one of the is not equal to . Therefore, if and only there exist such that realize for all and at most one of the is not equal to .∎

The following notation provides a third way of expressing tha cardinality of . In a way, it is the most important one, since it is the one which provides the connection with non-determinism (as we will see in section 5):

Notation 0 ().

Let be a positive integer. We denote by the formula .

Its falsity value is quite similar to that of (which is why they are equivalent):

Lemma 5 ().

Let be a positive integer, a pole, and . Then if and only if there is at most one such that .

Proposition 6 ().

Let be a positive integer. The formulas , and are universally equivalent.

Proof of proposition 6.

The formulas , are universally equivalent by proposition 3.

By lemmas 4 and 5, is universally realized by (because ) and is universally realized by (because for all , and , implies ). ∎

As a side note, we would like to bring the reader’s attention on the following result (which is due to Krivine, but does not seem to appear in any published work):

Proposition 7 ().

The formulas and are universally equivalent.

Proof.

By proposition 6, it suffices to realize .

Let us denote by the -term and by the -term . For all and all , .

Let denote the term (i.e the Church numeral ) and the term (i.e. the Church successor function). Using the adequacy lemma, one can check that universally realizes and that universally realizes .

To simplify notation, let us denote by . We prove that the left-to-right implication is universally realized by . Let us fix a pole , and let . For all , . Therefore, , and for all such that , (because realizes ). By induction, realizes for all .

Let us prove that the right-to-left implication is universally realized by . First, note that and . Let us fix a pole , and let , and , which means that , and or realizes . If realizes , then, since realizes , realizes . If realizes , then realizes , realizes and realizes , so again realizes . In both cases, . ∎

4. Multi-evaluation relations

This section defines a correspondence between realizability structures and a certain notion of multi-evaluation relations which extend the evaluation relation of -calculus: this notion is powerful enough to express arbitrary mixes of may- and must-nondeterminism.

Then, we will explore some of the connections between the properties of the theory generated by a structure and the properties of the corresponding evaluation relation.

While the evaluation relation of -calculus is a relation between processes, multi-evaluation relations are relations between sets of processes which satisfy certain axioms. Using “” generic symbol for evaluation relations, the following intuitions should be kept in mind:

The statement “ and ” specifies that, under “”, reduces nondeterministically to or , according to an oracle which “favours” being in the pole: this is may-nondeterminism. One can also imagine that the program tries both branches in parallel, to find out if one eventually meets the condition for being in the pole. Meanwhile, “” specifies that reduces nondeterministically to or , according to an oracle which “favours” being out of the pole: this is must-nondeterminism.

Additionally, we can mix may- and must-nondeterminism by writing, say, “ and and ”. This kind of two-out-of-three nondeteministic choice will be studied in detail in the next section, under the name of -voting instruction.

Finally, statements like “” allow interaction between different branches of execution: if one branch evaluates to and another to , then they merge and evaluate must-nondeterministically to or .

Definition 1 ().

A multi-evaluation relation, or simply evaluation relation is a binary relation on such that

  • For all such that , ,

  • For all , (identity),

  • For all , for all , if and , then