Modal Logic, Linear Logic,
Optimal Lambda-Reduction
Stefano Guerrini1 , Simone Martini2 , Andrea Masini3
1
IRCS, University of Pennsylvania,
3401 Walnut Street, Suite 400A, Philadelphia, PA 19104-6228 – USA;
[email protected].
2
Dipartimento di Matematica e Informatica, Università di Udine,
Via delle Scienze, 206, I-33100 Udine – Italy; [email protected].
3
Dipartimento di Informatica, Università di Pisa,
Corso Italia, 40, I-56125 Pisa – Italy; [email protected].
1
Introduction
The paper will maintain and justify the following thesis:
A purist approach to modal proof-theory may have some (applied) benefits for the efficient reduction of lambda-terms, an important problem
in the implementation of functional programming languages.
1.1
Modal proof-theory
The quest for symmetry, concision, and generality is a distinctive trait of mathematics. Proof-theory is a remarkable example of this search. A large class of
logical systems may be described with few key ingredients, organized around
crucial symmetries (left/right; introduction/elimination). At first sight, modalities seem to spoil the scene. On one hand, the rules are seldom symmetric,
or, when they are, they involve global constraints on their applicability. Moreover, moving from one system to a more powerful one often means to radically
change the rules (and the proofs of the main metatheoretical properties, like
normalization).
To restore symmetry and locality one resorts to indexed systems, where formulas are annotated with additional information. The idea goes back to Kripke
[Kri63] and has been developed by many authors (a good review is [Wan94]).
What kind of information is added, the way it “codes” the structure of the
(Kripke) models of the logic, and the bookkeeping of this information, make
crucial differences among the several approaches. We focus here on 2-sequents,
put forward in [Mas92]. It is a class of formal systems where annotations are
non-negative indexes, introduced with the simple motivation to mimic the interplay of variables and quantifiers in first order logic. Different systems (in
the range K–S4) are obtained with simple side conditions on indexes of a single
(elimination) rule [MM96].
In Section 2 we will briefly recall the 2-sequent natural deduction calculus
for linear logic (which, as far as modalities are concerned, is similar to S4).
Section 2.1 will show how this proposal looks like in the context of linear logic
proof-nets.
1.2
Optimal reduction of lambda-terms
The λ-calculus is a paradigmatic functional programming language, whose operational semantics is given by β-reduction: (λx.M)N →β [N/x]M. Given a
normalizable λ-term M it would be interesting to determine the shortest reduction sequence starting from M and reaching its normal form. However, it is
well known that there is no recursive, one-step strategy for this. One has to resort to parallel strategies, reducing several redexes at once. It is a fundamental
result of Lévy [Lév78] that an optimal recursive parallel strategy exists. The
only known “implementations” of Lévy’s strategy are based on graph-rewriting.
A lambda-term M is represented as a graph in which special nodes express
the (partial) sharing of common subterms of M. Then, the graph-rewriting
rules for β-reduction are extended with rules for the explicit bookkeeping of the
sharing information. After Lamping’s original solution [Lam90], also [GAL92a]
and [Asp95b] have presented proposals. Interestingly enough, these approaches
may be interpreted as a particular way of performing reduction of linear logic
proof nets [GAL92b].
We discuss in Section 4 the improvements that may be obtained from our
approach to linear logic. More extended discussion may be found in [GMM96],
or [Gue95] for the specific problem of λ-calculus. The practical application of
these reduction techniques is in the implementation of functional programming
languages—see [AG97] for a detailed treatment.
2
Linear logic, from an indexed perspective
From a proof-theoretical point of view, linear logic [Gir87] arises by dropping the
structural rules of contraction and weakening from the standard formulation of a
sequent calculus for classical logic. This very weak system is then strengthen by
adding modalities (?, and its dual !) marking those formulas on which weakening
and contraction is allowed. As exemplification of the 2-sequent approach to
modalities, we present here a natural deduction system for a fragment of the full
logic, see [MM95].
Formulas are built out of atoms (ranged over by p), by means of the binary
connectives ⊗ and ⊸, and the (unary) modality !. Each formula is decorated
with a nonnegative integer (its level ); the formal system establishes judgments
of the shape Γ ⊢ Ak , where Γ is a multi-set of indexed formulas, A is a formula,
k is the level of A (the rules will ensure that the levels of the formulas in Γ are
less or equal to k). The propositional rules of this fragment are summarized in
Figure 1. To ensure linearity, in ⊸ I and ⊗E each discharging is compulsory
2
Ak
Γ
·
·
·
Ak
∆
·
·
·
Bk
A ⊗ Bk
Γ [Ak ]
·
·
·
Bk
⊗I
Γ
·
·
·
A ⊗ Bj
Ck
[Aj ] [Bj ] ∆
·
·
·
Ck
⊗E
∆
·
·
·
Ak
Γ
·
·
·
A ⊸ Bk
A ⊸ Bk
⊸I
Bk
j≤k
⊸E
Figure 1. Propositional rules.
and involves exactly one formula occurrence (note that this fragment is linear
also in modal formulas: no contraction or weakening is allowed at all).
We write Γ ⊢ Ak if there is a deduction whose conclusion is Ak and whose
open assumptions are exactly the formulas of Γ .
Modal (exponential) rules—Figure 2—uses the level machinery to formulate
the “context constraint” on the introduction rule. For a set of assumptions Γ ,
define #Γ = max{k | Ak ∈ Γ }; #Γ = −1 when Γ is empty.
Γ
·
·
·
Ak+1
!Ak
!I
Γ
·
·
·
!Aj
k≥#Γ
Ak
!Ek≥j
Figure 2. Exponential rules.
It is worth to compare the two exponential rules with the rules for universal
quantification:
Γ
Γ
·
·
·
·
·
·
∀x.A
A
∀E
∀I x6∈FV(Γ )
A[t/x]
∀x.A
Indeed, as the introduction of “!” decrements the level of the conclusion of exactly one, so the introduction of ∀ binds exactly one variable. The side condition
k ≥ #Γ , is the analogous of the usual constraint that x be not free in the active
premises of the derivation. Again, as the elimination of “!” raises the level of
3
the conclusion of an arbitrary increment, so the elimination of ∀ allows the introduction of a new term t with an arbitrary number (possibly zero) of new free
variables. This analogy has been a leading idea of the 2-sequents approach and
keeps holding when we consider reduction of proofs.
In linear proofs, exponential redexes and their reductions may be defined as
follows:
D
[j − 1]k−1 D
Ak
!I
reduces to
Ak−1+j
k−1
!A
!E
Ak−1+j
where the (meta) notation [n]k D means the result of incrementing of n all the
levels greater than k in the deduction D. Formally:
absorption:
If v ≤ i :
[n]i
D
D
= v
αv
α
[n]i
D
[n]i D
= v+n
αv
α
reindexing:
If v > i :
The side condition on !I ensures correctness of the reduction. Under the analogy “modalities are quantifiers”, this process of reindexing corresponds to substitution in first-order logic (the absorption case corresponding to a test on the
freeness of the involved variable).
2.1
Levels in a proof-net formulation
The system we are interested in adds contraction to the basic rules of the previous
section. It is best described using proof-nets, a formal system for linear logic
exploiting (and displaying at its best) the symmetry of the logic (see [Laf95] for a
lucid introduction). We only recall that multiplicative proof nets are formulated
for the logic based on atoms (propositional letters p and their duals p⊥ ), and
the two dual connectives tensor (⊗) and par (℘). Negation is primitive only
on atoms and defined on formulas by full double negation and DeMorgan rules.
Linear implication is defined as A ⊸ B ≡ A⊥ ℘B.
When exponentials are introduced, the elegance and simplicity of the nets
(and of their reduction rules) have to be spoiled by the notion of box—a sub-net
representing the context where an !-introduction is applied. Boxes are necessary
both for static (i.e., for soundness) and dynamic correctness (i.e., for keeping
track of the context during the reduction of an exponential redex). A sketch of
the general case (including contraction) is depicted in Figure 3 (forget for the
moment the levels of the formulas). Observe, first, that the box Π (on the left
in the first line) is duplicated. Second, after the reduction the different copies
of Π may have been put inside other boxes (this happens when the ?-node is
a secondary door of another box). (The notation Π[ki − k] means that all the
levels of Π have been incremented by ki − k.)
4
Πr
Π’s
Π’2
Π2
Π1
k+r
A
Π’1
k+s
Γ1
∆1
A
Γ2
∆2
...
...
∆s
Γr
Π
B
k+1
⊥
i
A
?
!
k
?
k
?B
!A
k
?A
cut
Π’s
Πr
Π2
Π[r-1]
B
i+r-1
Π’2
Π1
k+r
⊥
k+r
A
A
Π’1
Π [s-1]
Γ1
B
i+s-1
k+s
⊥
k+s
A
A
Γ2
∆2
cut
Γr
...
...
cut
∆1
∆s
?
k
?B
Figure 3. Box (global) reduction.
How does the system of the previous section relates to proof-nets? It is not
difficult to establish the following result.
Theorem 2.1. Let Γ ⊢ A0 , where all the assumptions in Γ have level 0. Then
there is a proof-net Π with conclusions Γ ⊥ , A.
Proof. (sketch) Let us first build the labeled graph underlying Π. Then we will
take care of boxes. Proceed by induction on Γ ⊢ A0 , as in the usual equivalence
between natural deduction and sequents: assumptions go to axioms; introduction
rules are mapped into the corresponding links; elimination rules are transformed
into cuts between the premise and a suitable proof-net. Now assign boxes: the
level of a formula is interpreted as the box-nesting-depth of the corresponding
link. The side condition on !I ensures that for each !-link (principal door of a
5
box) one can find suitable ? links acting as secondary doors of the corresponding
box.
This translation extends to normalization: any reduction of a natural deduction derivation is transformed into a valid cut-elimination step of the corresponding proof-net. The reindexing case in the definition of [n]k D corresponds
exactly to the fact that a box, after reduction, may be put inside other boxes;
absorption corresponds to the selection of the correct subnet to be reindexed
(the reindexing stops at the secondary doors), cf. Figure 3. This relation (which
was unexpected when we begun our work on levels is the starting point of the
technical contribution of the next section.
3
Leveled nets and their reduction
We have just seen that rewriting and reindexing of proof-nets may be done using
levels—a local information—instead of explicit boxes—a global information. The
last step we perform is the internalization of the meta-operation of reindexing.
That is, instead of having an external definition of [n]k D, we extend our nets
and their reductions as to incrementally and locally perform reindexing during
the process of cut-elimination.
We start with the formal definition [GMM96] of sharing sℓ-structures (sharing
leveled structures of links) and proof ℓ-structures, our level-based formalization
of proof-nets with explicit reindexing operators (the mux links).
Definition 3.1. An sℓ-structure is a finite connected hypergraph whose nodes
are labeled with indexed formulas and hyperedges (also called links) are labeled
from the set {cut, ax, ℘, ⊗, !, ?} ∪ {mux[i]| i ≥ 0} ∪ {demux[i]| i ≥ 0}; the integer i
in (de)muxes is the threshold of the link. Allowed links and nodes are drawn in
Figure 4. The source nodes of a link are its premises; the target nodes are the
conclusions. Premises and conclusions are assumed to be distinguishable (i.e.,
we will have left/right premises, i-th conclusion and so on), with the exception
of ?-links. In an sℓ-structure, each node must be conclusion of exactly one link
and premise of at most one link; those nodes that are not premises of any link
are the net conclusions; unary (de)muxes are also called lifts.
Definition 3.2 (proof ℓ-structure). A proof ℓ-structure is an sℓ-structure without (de)muxes.
We assume that any axiom of an sℓ-structure has only atomic conclusions.
Such a restriction does not decrease the expressive power of sℓ-structures. To
each (standard) proof-net P we may associate a proof ℓ-structure D[P], the decoration of P: D[P] is obtained by assigning to each node of P the level corresponding to the number of exponential boxes containing that node.
Definition 3.3. A proof ℓ-structure S is a restricted proof ℓ-net iff S = D[P] for
some weakening-free proof net P.
6
A
k
A
k
A?
cut
k
A +1
k
A
k
A1
k
k
k1 ;:::;kr
1
r
!
A
B
Ar
k
A1
k
?
k
}
A
k
k
1
1
r
A}B
A
k
k1 ;:::;kr
B
k
Ar
k
A
k
k
k
k
i
i
A
k
B
k
?
A
!
A?
ax
A1
k
k
1
k1 ;:::;kr
r
1
Ar
k
Figure 4. Links of sℓ-structures.
By using indexes it is possible to “recognize” exponential boxes:
Definition 3.4. Let S be a proof ℓ-structure and let Ak be a premise of an
!-link; we call box of Ak a sub-hypergraph bxS [Ak ] of S verifying the following
properties:
1. Ak ∈ bxS [Ak ] (Ak is the principal door of bxS [Ak ]);
2. bxS [Ak ] is a proof ℓ-net;
3. each net conclusion of bxS [Ak ] different from the principal door is a premise,
in S, of a ?-link with conclusion at level j < k (such ?-premises are the
secondary doors of the box);
4. for each Bj ∈ S, if Bj ∈ bxS [Ak ], then j ≥ k.
We denote by BX[S] the set of boxes of S. Because of the definition of ℓstructure, boxes are connected.
Restricted proof ℓ-nets are a complete system for weakening-free classical
linear logic; sℓ-structures captures in a local way the process of cut-elimination,
while muxes perform reindexing of boxes. (When weakening is allowed, proofnets become disconnected and there is no local way to perform cut-elimination;
in [GMM97] we propose a solution, calling for a simple modification of the proofnet syntax).
We distinguish the rules in two kinds: the logical (or β) rules (Figure 5),
where interaction happens through a cut-link (corresponding to a logical cutelimination step); and the π rules (Figures 6, 7, and 8), when one of the interacting nodes is a mux/demux (corresponding to a step of incremental duplication
and/or reindexing).
Observe, in particular, rule absorption (⊲abs ), corresponding to the case
when the mux reaches the border of a box (through one of its secondary doors)
and has therefore exhausted its job. It matches the absorption case in the
definition of [n]k D, in Section 2.
3.1
Optimality
Lévy’s parallel strategy (cf. Section 1.2) for lambda-calculus consists in reducing
at any step a certain number of redexes—those belonging to the same family,
7
Ak
}
Ak
Ak
cut
Bk
A
A}B k
A
?
k1
A
?
?
Ak
k
!A
cut
A
?
?
cut
A
?
?
?
k
k
k
Bk
cut
B
?
k
Ak+1
kr
k
Bexp
?
B
A k B
!
k
cut
Bmul
Ak+1
?
Ak
Bide
Ak
ax
?
Ak 1
Ak r
k
cut
A
?
cut
A
?
kr
k1
Figure 5. Logical (or β) rules. The symmetric cases are not shown.
[Lév78]. Main result of [Lam90] is a graph rewriting implementation in which,
representing lambda-terms as graphs with additional (partial) sharing operators
(fans, akin to our muxes), each β-reduction (that is reductions essentially similar
to those of Figure 5) corresponds to a parallel step of Lévy’s strategy.
An analysis essentially similar may be conducted for proof-nets [GAL92b,
AL93]: also in this case the number of β-reductions of the known sharing graph
implementations is equal to the number of parallel reductions in Lévy’s strategy.
Of course, not all the reductions of Figures 6, 7, and 8 may be freely applied
if we want an optimal reduction. Indeed, a free application of rule ⊲dup would
duplicate any redex in its scope. Intuitively, during an optimal reduction a mux
must be propagated only if otherwise it would prevent the formation of a new
redex. A moment’s thought shows that a mux “coming from above” on a logical
node must never be propagated. Among all the reduction rules, we thus isolate
the set πopt = π − ⊲dup containing the only rules allowed during an optimal
reduction. It is well known that proof-nets may encode typed lambda-terms
∼
(they may encode also type-free terms, if one forces the type isomorphism D =
∼ !(D ⊸ D), [Reg92]). If we now take the proof-net encoding of
!D ⊸ D, or D =
a lambda-term, its optimal reduction (as defined here) exactly corresponds to
its Lévy optimal reduction.
4
Coherence
The approaches to optimal reduction of proof-nets/lambda-terms discussed in 1.2
and the previous section, share a problem of coherence. Suppose that the proof8
Ak1
Ak ?
Akr
i
A
k
i
Bidup
cut
Ak1
A?
Ak1 ?
cut
k
Akr
Akr ?
cut
Ajn
Ak1
Akr
i
i
Aj1
Ak1
?
Ajn
Bdup
Ajn +k1
j1
Akr
Ajn +kr
j1
?
?
?Ak+k1
j1
?Ak+kr
j1
i
?Ak
where
i<k
?Ak
Figure 6. Duplication rules (I). The following cases are not shown: in ⊲idup
the dual rule (demux/ax); in ⊲dup the cases where interaction happens through
another premise of the ?-link; in ⊲dup the cases where the logical link is ⊗, ℘, !,
instead of why-not (?).
net (or lambda-term) N reduces by standard cut-elimination (beta-reduction) to
N ′ . Then, by reducing the graph corresponding to N we do not obtain the graph
corresponding (in the given translation) to N ′ . The recovering of the proofnet N ′ is instead obtained by the so-called read-back process, a semantically
based procedure external to the reduction system, which essentially computes
the equivalence quotient of all the sharing graphs representing the same proofnet (term). A first contribution towards the solution of this problem is the
notion of safeness in [Asp95a]. In presence of certain safety conditions (which
may be computed along the computation) some additional reductions may be
performed, allowing a further simplification of the net. We show here that this
problem is fixed in our approach.
The proofs of the theorems, or even an intelligible sketch of them, are well
beyond the page limits of this paper. The reader may see [GMM96] or [Gue96]
for a more detailed overview. Let an sℓ-structure G be correct iff there exists a
restricted proof ℓ-net N s.t. N ⊲∗ G.
9
Aj1
Ajn
Aj1
?
Bodup
Aj1 +k1
?Ak r
Ak r
i
An
k
Bswap
Ak1 +h1
?Ak 1
?Ak r
Ak 1
Ak r
Ak1+hs
n
i1
j
Ajn +kr
k
?
j1
Ah1
Aj1 +kr
k
?
i
Ajn +k1
k
Ak 1
i
i
?Ak
?Ak1
Ajn
jr
Akr +h1
n
n
Akr +hs
n
is
Ahs
Ah1
Ahs
where i1 = = is = i; and j1 = j + k1 n; : : : ; jr = j + kr n when i < j ,
i1 = i + h1 n; : : : ; is = i + hs n and j1 = = jr = j; when i > j .
Figure 7. Duplication rules (II). The following cases are not shown: in ⊲odup
the cases where the logical link is ⊗, ℘, !, instead of why-not (?).
Aj1
Ak1
Ajr
Akr
i
i
Ajr
Aj1
Ak
Babs
?Av
?
Banh Ak1
Ak
?
Akr
i
?Av
where
Ak1
i v
Akr
Figure 8. Simplification rules.
Theorem 4.1 (strong normalization). Let G be a correct sℓ-structure.
1. The π rules are strongly normalizing and confluent on G. The π normal
form of G is a restricted proof ℓ-net.
2. The β + π rewriting rules are strongly normalizing and confluent on G. The
β + π normal form of G is a restricted proof ℓ-net.
10
3. The π normal form of G reduces by standard cut-elimination to its β + π
normal form.
The third item of Theorem 4.1 ensures the soundness of the system. The
result can be stated in a stronger way, as in the following Lemma 4.3, which is
indeed a preliminary step in the proof of Theorem 4.1 (⊲∗std denotes a standard
cut-elimination reduction).
Definition 4.2 (read-back). The read-back R(G) of a correct ℓ-net G is the π
normal form of G.
Lemma 4.3 (soundness). Let G be a correct sℓ-structure and N be the restricted proof ℓ-net s.t. N ⊲∗ G. Then N ⊲∗std R(G).
According to Section 3.1, there is a strategy minimizing the number of ⊲β
rules.
Theorem 4.4 (optimality). The β + πopt rewriting rules are Lévy optimal.
Theorem 4.5. Let G be a correct sℓ-structure and N be its β + π normal form.
Let G ′ be a β + πopt normal form of G, then R(G ′ ) = N.
By Theorem 4.5, normalization of correct ℓ-nets may be performed in two
distinct steps: first optimal reduction (β + πopt ), then read-back reduction (π).
5
Conclusions
Our coherence results are made possible by the presence of the absorption rule.
In its turn, the rule could not be formulated without a way to recognize the
border of a box and, hence, its secondary doors. This is achieved via a clear
separation of the logical and control information in the representation of a net.
The logical information takes the form of levels on the formulas of the proofnet; control is expressed by muxes (unifying the fans and brackets of the other
approaches, which are also used to express levels), which may be viewed simply
as the internalization of the meta-operation of reindexing. It is this separation
to allow coherence.
References
AG97.
AL93.
Asp95a.
Andrea Asperti and Stefano Guerrini. The Optimal Implementation of Functional Programming Languages. Cambridge Univ. Press, 1997. To appear.
Andrea Asperti and Cosimo Laneve. Interaction systems. In Int. Workshop
on Higher Order Algebra, Logic and Term Rewriting, 1993.
Andrea Asperti. δ ◦ !ε = 1: Optimizing optimal λ-calculus implementations.
In Jieh Hsiang, editor. Rewriting Techniques and Applications, 6th International Conference, RTA-95, LNCS 914, pages 102–116, Kaiserslautern,
Germany, April 5–7, 1995. Springer-Verlag.
11
Asp95b.
GAL92a.
GAL92b.
Gir87.
GMM96.
GMM97.
Gue95.
Gue96.
Kri63.
Laf95.
Lam90.
Lév78.
Mas92.
MM95.
MM96.
Reg92.
Wan94.
Andrea Asperti. Linear logic, comonads and optimal reductions. Fundamenta infomaticae, 22:3–22, 1995.
Georges Gonthier, Martı́n Abadi, and Jean-Jacques Lévy. The geometry of
optimal lambda reduction. In Proc. of Nineteenth Principles of Programming
Languages (POPL), pages 15–26. ACM. January 1992.
Georges Gonthier, Martı́n Abadi, and Jean-Jacques Lévy. Linear logic without boxes. Proc. of 7th Symposium on Logic in Computer Science, (LICS),
pages 223–234. IEEE. Santa Cruz, CA, June 1992.
Jean-Yves Girard. Linear logic. Theoretical Computer Sci., 50:1–102, 1987.
Stefano Guerrini, Simone Martini, and Andrea Masini. Coherence for sharing
proof-nets. In H. Ganzinger, editor, Rewriting Techniques and Applications –
RTA’96, volume 1103 of Lecture Notes in Computer Science, pages 215–229.
Springer-Verlag, 1996.
Stefano Guerrini, Simone Martini, and Andrea Masini. Proof nets, garbage,
and computation. In R. Hindley, editor, Typed Lambda-Calculus and Applications 1997, LNCS. Springer-Verlag, 1997. To appear.
Stefano Guerrini. Sharing-graphs, sharing-morphisms, and (optimal) λgraph reductions. In 1st Tbilisi Symposium on Logic, Language, and Computation, Tblisi, Georgia, October 1995.
Stefano Guerrini. Theoretical and Practical Aspects of Optimal Implementations of Functional Languages. PhD thesis, Dottorato di Ricerca in Informatica, Pisa–Udine, TD 3/96, January 1996.
Saul Kripke. Semantical analysis of modal logic I. Zeitschr. f. math. Logik
und Grund. d. Mathematik, 9:67–96, 1963.
Yves Lafont. From proof-nets to interaction nets. In J.-Y. Girard, Y. Lafont,
and L. Regnier, editors, Advances in Linear Logic, volume 222 of London
Mathematical Society Lecture Note Series, pages 225–247. Cambridge University Press, 1995. Proceedings of the 1993 Cornell Linear Logic Workshop.
John Lamping. An algorithm for optimal lambda calculus reduction. In
Principles of Programming Languages (POPL), pages 16–30. ACM, 1990.
Jean-Jacques Lévy. Réductions Correctes et Optimales dans le lambda-calcul.
PhD Thesis, Université Paris VII, 1978.
Andrea Masini. 2-sequent calculus: A proof theory of modalities. Annals of
Pure and Applied Logic, 58:229–246, 1992.
Simone Martini and Andrea Masini. On the fine structure of the exponential
rule. In J.-Y. Girard, Y. Lafont, and L. Regnier, editors, Advances in Linear
Logic, volume 222 of London Mathematical Society Lecture Note Series,
pages 197–210. Cambridge University Press, 1995. Proceedings of the 1993
Cornell Linear Logic Workshop.
Simone Martini and Andrea Masini. A computational interpretation of
modal proofs. In H. Wansing, editor, Proof Theory of Modal Logics, pages
213–241. Kluwer, 1996.
Laurent Regnier. Lambda-Calcul et Réseaux. Thèse de doctorat, Université
Paris 7, 1992.
H. Wansing. Sequent calculi for normal modal propositional logic. Journal
of Logic and Computation, 4(2):125–142, 1994.
12