Restricted demonic choice for modular probabilistic programs

It is argued that one approach to modularity in programs containing both demonic and probabilistic choice is to allow variations on the former: `restricted demonic choice', written u L , is not allowed to use the value of variables named in the set L as it resolves its nondeterminism; ordinary demonic choice u is then just the special case u fg in which the set of hidden variables is empty. The intention is that when variables L are declared inside a module, demonic choices outside the module are decorated u L and then cannot `see' the values of L. Our contribution is to explain why such an operator might be necessary in the presence of probability (recalling that ordinary sequential semantics does perfectly well without it), and then to expose | unfortunately! | some of its more unruly properties. We hope by doing so to make progress towards a proper theory of modularity in the presence of both demonic and probabilistic choices.