Abstract. The simply-typed, call-by-value language, RML, may be viewed as a canonical restriction of Standard ML to ground-type references, augmented by a "bad variable" construct in the sense of Reynolds. By a short type, we mean a type of order at most 2 and arity at most 1. We consider the O-strict fragment of (finitary) RML, RML O-Str , consisting of terms-in-context x1 : θ1, · · · , xn : θn M : θ such that θ is short, and every argument type of every θi is short. RML O-Str is surprisingly expressive; it includes several instances of (in)equivalence in the literature that are challenging to prove using methods based on (state-based) logical relations. We show that it is decidable whether a given pair of RML O-Str terms-in-context is observationally equivalent. Using the fully abstract game semantics of RML, our algorithm reduces the problem to the language equivalence of visibly pushdown automata. When restricted to terms in canonical form, the problem is EXPTIME-complete.

Abstract. The call-by-value language RML may be viewed as a canonical restriction of Standard ML to ground-type references, augmented by a "bad variable" construct in the sense of Reynolds. We consider the fragment of (finitary) RML terms of order at most 1 with free variables of order at most 2, and identify two subfragments of this for which we show observational equivalence to be decidable. The first subfragment, RML P-Str 2⊢1 , consists of those terms in which the P-pointers in the game semantic representation are determined by the underlying sequence of moves. The second subfragment consists of terms in which the O-pointers of moves corresponding to free variables in the game semantic representation are determined by the underlying moves. These results are shown using a reduction to a form of automata over data words in which the data values have a tree-structure, reflecting the tree-structure of the threads in the game semantic plays. In addition we show that observational equivalence is undecidable at every third-or higher-order type, every second-order type which takes at least two firstorder arguments, and every second-order type (of arity greater than one) that has a first-order argument which is not the final argument.

Abstract. We present HECTOR, an observational equivalence checker for a higherorder fragment of ML. The input language is RML, the canonical restriction of standard ML to ground-type references. HECTOR accepts programs from a decidable fragment of RML identified by us at ICALP'11, which comprises programs of short-type (order at most 2 and arity at most 1) that may contain free variables whose arguments are also of short-type. This is an expressive fragment that contains complex higher-order types, and includes many examples from the literature which have proven challenging to verify using other methods. To our knowledge, HECTOR is the first fully-automated equivalence checker for higherorder, call-by-value programs. Both sound and complete, the tool relies on the fully abstract game semantics of RML to construct, on-the-fly, visibly pushdown automata which precisely capture program behaviour. These automata are then checked for language equivalence, and if they are inequivalent a counterexample (in the form of a separating context) is constructed.

We present HOMER, an observational-equivalence model checker for the 3rd-order fragment of Idealized Algol (IA) augmented with iteration. It works by first translating terms of the fragment into a precise representation of their game semantics as visibly pushdown automata (VPA). The VPA-translates are then passed to a VPA toolkit (which we have implemented) to test for equivalence. Thanks to the fully abstract game semantics, observational equivalence of these IA-terms reduces to the VPA Equivalence Problem. Our checker is thus sound and complete; because it model checks open terms, our approach is also compositional. Further, if the terms are inequivalent, HOMER will produce both a game-semantic and an operational-semantic counter-example, in the form of a play and a separating context respectively. We showcase these features on a number of examples and (where appropriate) compare its performance with similar tools. To the best of our knowledge, HOMER is the first implementation of a model checker of 3rd-order programs. Theory and ImplementationMotivation. Higher-order functions are commonly used in functional programming. The functions map and foldr are standard examples of 2nd-order programs. 3rd and higher-order functions arise naturally in language processors [10]. Higher-order programs also crop up in imperative / object-oriented languages. E.g. any algorithm or data structure parameterised by, say, a comparison function is 2nd-order. A program that relies on such a 2nd-order function (being defined in an external library, say) is 3rd-order. Perhaps the most significant higher-order program is Google's MapReduce system [11]. Here we present the first model checker for 3rd-order programs.Reynold's Idealized Algol (IA) [9] is a higher-order procedural language that combines imperative constructs (such as block-allocated assignable variables, sequencing and iteration) with higher-order functional features. It is essentially a call-by-name variant of (core) ML. E.g. the imperative term while !X > 0 do {Y := !Y * !X ; X := !X − 1; } and the lambda-term λf A→B→C .λg A→B .λx A .f x (g x) are both valid in IA.Here we consider the fragment of IA containing up to 3rd-order terms over finite base types. I.e. we allow functions of types ((b 1 → b 2 ) → b 3 ) → b 4 , say, where each b i is one of the base types: com (commands), exp and var (expressions and variables respectively, with values taken from a finite prefix of the natural numbers). In addition, we allow while-loops but not full recursion. We denote this fragment IA * 3 .We thank A. Murawski for useful discussions and Microsoft Research PhD Scholarship Programme for funding this work. HOMER builds on and extends Hopkins' dissertation [7].