We consider a syntactic restriction for higherorder grammars called safety that constrains occurrences of variables in the production rules according to their typetheoretic order. We transpose and generalize this restriction to the setting of the simplytyped lambda calculus, giving rise to what we call the safe lambda calculus. We analyze its expressivity and obtain a result in the same vein as Schwichtenberg's 1976 characterization of the simplytyped lambda calculus: the numeric functions representable in the safe lambda calculus are exactly the multivariate polynomials; thus conditional is not definable. We also give a similar characterization for representable word functions. We then examine the complexity of deciding betaeta equality of two safe simplytyped terms and show that this problem is PSPACEhard. The safety restriction is then extended to other applied lambda calculi featuring recursion and references such as PCF and Idealized Algol (IA for short). The next contribution concerns game semantics. We introduce a new concrete presentation of this semantics using the theory of traversals. It is shown that the revealed game denotation of a term can be computed by traversing some soupedup version of the term's abstract syntax tree using adequately defined traversal rules. Based on this presentation and via syntactic reasoning we obtain a gamesemantic interpretation of safety: the strategy denotations of safe lambdaterms satisfy a property called Pincremental justification which says that the player's moves are always justified by the last pending opponent's move of greater order occurring in the player's view. Next we look at models of the safe lambda calculus. We show that these are precisely captured by Incremental Closed Categories. A game model is constructed and is shown to be fully abstract for safe IA. Further, it is effectively presentable: two terms are equivalent just if they have the same set of complete Oincrementally justified playswhere Oincremental justification is defined as the dual of Pincremental justification. Finally we study safety from the point of view of algorithmic game semantics. We observe that in the thirdorder fragment of IA, the addition of unsafe contexts is conservative for observational equivalence. This implies that all the upper complexity bounds known for the lowerorder fragments of IA also hold for the safe fragment; we show that the lowerbounds remain the same as well. At order 4, observational equivalence is known to be undecidable for IA. We conjecture that for the order4 safe fragment of IA, the problem is reducible to the DPDAequivalence problem and is thus decidable.
