TAPSOFT'87: Proceedings of the International Joint Conference on Theory and Practice of Software Development

, applied on the type scheme 1;, is defined ~s in Definition 7.iii), with Le(B,%) replaced by Le(~,%), where ~ is the empty set. In what follows we w i l l use "expansion" to denote indifferently the two operations, since the meaning will be clear from the context.

3.The unification semi-algorithm. The unification problem for type schemes belonging to T could be stated in the following "syntactic" way: - Given 6,1~T, find, if it exists, a chain c (of expansions and substitutions), such that

c(6)=c('~). But in this formulation of the problem the particular role of the universal type scheme is not taken into account. In fact, it is natural to impose that o can be unified with any type scheme.Then, we can give a "semantic" version of the problem:

42

- Given 5,~eT, find, if it exists, a chein c such that c(6)~c(~;). But this formulation is too generel, ~nd it exels our 8ires. So, we will define e new equiwlence relation between type schemes: Definition 9.i) A (~-type scheme is a type scheme in which only the symbol ~ occurs. ii) ~ is inductively defined as follows: ~,t~ ~-type schemes ~ ~i~

(Note that o~^B~t~A~). We can now try to give a third formulation of the unification problem:, -Given 6,s;eT, find, if it exists, a chain c such that c(6)~c('d). But now the problem has always a solution,the trivial one c(6)~c(i;)~. The correct formulstion of the unification problem must impose thet the trivial solution csn be choosen only in the case no other solution exists. Then the final formuletion of the problem is: -Given 6,1;eT,find, if it exists, 8 ch6in c such that c(6)~c(I;)~. This problem is semi-decidsble. In fsct, in the following section it will be possible to see that it is equivslent to the problem: -~.BI-~;X? which is clearly semi-decidable (by Theorem I.i). The semi-~Igorithm UNIFY we will show solves the problem in the most generel way, i.e.,it finds the most general unifying chein, if it exists, otherwise it does not stop, es will be proved in Theorem 3.

Seml-olgoritflm UNIFY UNIFY(6,1;)=U(6,6,~;,~), where U(6,6,~;,~')--c(if defined) ,.where: I.if 6 is a type variable then if ~--6 then s--~ else if 6 occurs in ~ then c'--s,where s--{<tp,~>,<6,o>I~poccurs in ~} else c'=s,where s={<6,1;>}; 2.if 6-- ~ then c'=s,where s={<~,~>I~ occurs in'(;}; 3.if 6--61-,62 then 3.1.if "d is a verisble then if I; occurs in 6 then c'=s, where s={<~,~>,<1;,~>I~ occurs in 6} else c'--s,where s--{} 3.2. if %=o then c'--s,where s=(<~p,w>I~poccurs in ~} 3.3. if ~--~:i-~I;2then if ci=U(61,6",%1,1;')end c2--U(cI(52),cI(6"),cI(~2),ci(~')) then c'=cl.c2 3.4.ifI;~i;I^~2 then let e=<6>, then if c1=U(e(6'),e(6"),e(Ic?),e(~')) then c'--e.cI

43 4. if 6:6 i^62 then: 4.1. [ identical'topoint 3.1 ] 4.2. [ identical to point 3.2 ] 4.3. if 1;:%1-~%2 then let e,.<1;>then if c l-U(e(5'),e(6'),e(1;'),e(1;')) then c':e.cI 4.4. if I;:%1^%2 then if ci:U(61,6',1;i,%')and ifc2:U(c1(62),c1(6'),c1(%2),c1(%')) then c'-cl.c2.

Example 2. Let o~,[~,~',S,(4,v be type variables. i) If (~-(x-,~-~[~and ~;-(~-,6)-*(14-~v)--~¥,UNIFY(~,%)-C-Sl.S2.S3, where: s1={,<8,o>),Sz:{<14,(~>,},s3={<~,~'>},and c(6)~c(%)~(~-~(~-~'. ii) If 6:C~A(~-*I3)end 1;:((JL^(t4-~v))-~v,UNIFY(6,1;) does not stop. In fact: UNIFY(6,%):UNIFY(e(6),e(%)) (where e:<%>):UNIFY(6,%'A%") (where %' and %" are instances of %):UNIFY(s(oc-~[B),s(%")) (where s--(<(z,%'>}): :UNIFY(1;'-~t~,%"):UNIFY(I;'-~t~,6"-~v')(where ~" is an instance of 6 and v' is a new type variable) : if c:UNIFY(%',6 ")then UNIFY(c(#),c(v')) and this function is undefined since %' and 6' are instances of 6 and %. To prove that this semi-algorithm is correct and (in some sense) complete, we need a further definition: I)efinitIoI~ lO.i) Let 6,1;~T,and let 6" and %' be subtypes respectively of 6 and %. Two occurrences of 6' and I;'in 6 end % are corre~cpandingiff: -6--6' and %--%' -6-~-,t3 and %-~'-~' (6-~^t~ and %-c~'^[s')and the accurrences of ~' end %' are corresponding either in o~ and ~' or in t~and is'. ii) Let c--oPl....op n be a chain such that c(6)~,c(%), c is a praper chainunifying 6 and % iff ¥i (1~i~n). there exist no two corresponding occurrences of subtypes of OPl....oPi(6) and oPl...oPi(%)(say 6 i and "~i) such that: 6i,%i-~(~and 3j>i. OPl..Opj(6i)~OPl...opj(%i)~(~. Roughtly speaking, a proper chain unifying two given type schemes is a chain in which a substitution of a type variable with the constant ~ is used only in order to unify two subtypes one of which is ~. Then we are able to prove: Theorem 3.i) (Correctness) If UNIFY(6,'(;)=c,then c(6)~c(I;). ii) (Completeness) Let 6,%ET be such that there exists a proper chain c unifying 6 and I;.Then UNIFY(6,%)~c', where c' is a proper chain unifying 6 and 1;, and cs~c'.c" for some c"(i.e.,c' is the minimalchain unifying 6 and %,in the sense that every other

44 some c"(i.e.,c' is the minimalchain unifying 6 and ~;,in the sense that every other proper chain unifuing 6 and i; must contain (an instance of) every operation occurring inc'). Proof. i) Easy, by induction on the lenght of c. ii) By induction on the pair (we assume the lexicographical order between pairs), where: l(c) is the lenght of c, i.e.,the sum of the number of expansions occurring in c and the cardinality of the union of all the substitutions occurring in c. - n(6,~;) is the total number of symbols occurring in 6 and "C. The case l(c)=o and I(c)=I are obvious. Let l(c)>1.1n the case 6 is a type variable, we must distinguish two cases, according to ~: contains or not occurrences of 6. In the first case obviously there is no a proper chain unifying 6 and ~;. Otherwise, UNIFY makes the substitution s={<6,~c>}.Obviously this is the minimal between all the proper unifying chains composed only of substitutions ( see [Robinson, 1965]). It easy to see that every proper chain unifying 6 and "d in which some operations of expansion occur is at least of length 2 (it must contain at least one substitution, since the expansion generates new type variables) and it is always equivalent to a chain composed by a single substitution. In the case 6 ~ , UNIFY(d,~;)=s, where s={I~ occurs in "c}. Obviously s is the minimal chain, since every chain unifying 6 and I: is such that c(6)=c(~)~. In the case 6=61^6 2 and ~;=s;i^I;2, the proof follows directly from the induction -

hypothesis. In the case 6=61-~6 2 and ~=~:1-~:2,if c is such

that c(6)=c(61)-~c(62) and

c(I;)=c(%1)-~c(I;2), the proof follows directly from the induction hypothesis. In the case c(6)=c(~;)=B^~, by Theorem 2.ii),there exists Cl--e.c2,where e=<6^I;>, such that ci(6)=ci(I;) and c==c I. So c 2 is e proper unifying chain for e(6) and e('~), and, by induction (since I(c2)
c". So

c1==e.c'.c"==c, and the proof is given, since UNIFY(6,1;)=e.c'. Consider now the case 6=61^62 and ~;=I;i-~I;2. If there exists a proper chain c unifying 6 and "~, c must contain an operation of total expansion with respect to %. Let e=<~;>; by Theorem2.ii) there exists c I such that c1=e.c2 end cI(6)=cI(~) and c1==c. Then c 2 is e proper chain unifying e(6) and e(-c),and l(c2)
Moreover, the semi-algorithm UNIFY is conservative unification algorithm R. More precisely: Property I. Let 6,'c be type schemes without occurrences of the symbols ^ and e. If R(6,~;)=s, where s is some substitution, then UNIFY(6,'C)==s; if R(6,~) fails, then UNIFY(6,~)==s, where s contains only pair~of the shape:<~pi,~>, so s(6)~s(1;)~,(a.

45 Proof. Easy []

4.Principal pairs. Let us introduce the notion of principalpair,as defined in [Ronchi et. aI,1984]. First of all, the notion of approximant of a term must be introduced. Definition 112)The set N of approximate normal formsis defined from the set of variables plus a new constant symbol ~ in the following way: - ~ N , x~Nfor all variable x - if x is a variable and A~N(A~), then ~x.A~N - if x is a variable and A I.....Ap~N(p~O), then xAI...Ap~N ii) Let X be a term and A E N A is on epproxirnant of X (A_~X) iff ~X'=pX such that A matches X" except at occurrences of Q in A. iii) A~X)={AIA_~X}. iv) the type assignment rules of Definition 4 are generalized to elements of N simply by adjoining the following rule: (~') BI-~A for all A ~ N The following theorem holds: Theorem 4.[Ronchi et ei.,1984]. is e suitable peir for M E A iff is 6 suiteble pair for some A~ACM) We con define, for an approximate normal form A, o unique princ.ipalpair (pp(A)) (modulo the relation ~) as follows: Definition 12. Let A ~ N i) if A=~, then pp(A)~ (zp is the empty set) ii) if A=x, then pp(A)~<{~x},~p>, where ~ is 8 type variable iii) if A=~,x.A', end pp(A')~,then: I) if x occurs in A', pp(A)~,where ~ is the intersection of the predicates of B' whose subject is x 2) otherwise, pp(A)~ Iv) if A=xAI...An and pp(Ai)~ (i~i_~n) (we choose a trivial variant of them such that they are pairwise disjoint), then pp(A)~, where ~ is a type variable which does not occurs in Bi6fi(1_ is suitable for A ,then there exists a chain c of operations of substitution, expansion and rise, such that ~c(pp(A)), where the operation of rise is defined as follows: Definition 13.A riser is 8 pair of pairs <,<~1,~2>>, where ~i~2 and B 2 is such

46 that, for every 6x~B I, there exists 6'xEB 2 with 6"~6. Then: i) r(~;)= if ~;~~I then ~2 else r(B)= if Yx.6ix~B (1~i~n) and "Cjx~B I (1~j~m) ~ 61^...^6n~~;1^...'Cm, then 82 else B ii) r()-~. In [Ronchi et ai.,1984] it is proved thet the operation of rise preserves suitable pairs: namely, if is such that there exists D:BI-'~X, and r is any rise, there exists a deduction D':r(B)I-r('~),and D" is obtained from D by adjoining to D some applications of rule (~). Let II(X)--{I3AEA~X).~pp(A)}, and ,~{I3A~N~pp(A)}. On Pis possible to define the following preorder relation: E_~ <=> 3~i...~n. =--IIll(X),where ~P: then is the pp of X. Otherwise, LIll(X)does not exist in P, and then X hes an infinite set of pp's, as shown in the following: T h e o r e m 5.i)A[X) is finite. --LII'I(X)is such that, if is suitable for X, then there exists a chain c such that ~c(). ii)A(X) is infinite. For ever U suitable for X there exists ~II(X) such that ~c(), for some chain c. [] In order to compute the principal pair of a term X, if it exists, the semi-algorithm PP will be shown. PP uses the unification semi-algorithm UNIFY, defined in the preceding section. In this semi-algorithm, the operation ~ between basis schemes, with at least one statement on every subject, is used. ~ is so defined: B~B'={~A6'xl 6x~B ~nd 6'x~B'}U{6xI(6x~_B and B' has no a statement on x) or (6x~B" and B has no a statement on x)}.

Semi-algorithm PP. PP(X)= (if defined), where: I) if X is a variable then --<{~X},~> where ~ is a fresh type variable. 2) if X--~,x.X'the..n if PP(X')= then if B' contains a premise on x,let 6x, then --else _ . 3) if X--XIX2 then if PP(X1)~- and PP(X2)-- ~hen if UNIFY(If16f2-+~)--c (~ is a fresh variable) then --

47 Remember that e term X is called s~'~ronglynormalizingiffX, and every its subterm, possess a normal form. T h e o r e m 6.PP(X)= ~ X is strongly normalizing and pp(X)~. The proof will be given in the following section. It is possible to define e set of unification algorithms UNIFY i (i;~O),each one unifying with o, st every step, ell the subtypes occurring at depth 2i, where the depth of an occurrence of a subtype in a type scheme is defined as follows. Definition 14. Let 6eT. The depthd(o(~),5)of an occurrence o(I;) of I; in 6is: i) if ~; does not occurs in 5 then d(o(~:),6)isundefined ii) if 6--~ then d(o(1;),6)~-O iii) if either 6~-61-~62 or 6---6i^62 then if d(o(~),d i)--ithen d(o(~;),6)--i+1 if d(o(%),62)=i then d(o(~:),6)--i+1.

Algorithms UNIFY i. UNIFYi(6,1;)=Ui(6,6,~,~;,O)where Ui(6,6",1;,1;',j)--cwhere i_!fj >i then c--U(~,6',~,~;')el.se I.if either ~ or I; 8re either a type variable or ~ then c--U(6,6',~,'I;') 2.if 6--6i-+62 then 2.1.if "C--I;i-+"c2 then let Cl--Ui_1(~1,6",~i,1;',j+I)and c2--Ui_1(c1(62),c1(6'),c1(~;2),c1(~;'),j+1)then C=Cl.C2 2.2. ifs;--~;1^~;2 then let e=<6> then let Cl--Ui~ (6),e(6 ),e(~;),e(~;),0) then c=e.c I 3. if 6--EII^62 then 3.1. if "d=~;1-~;2 then let e--<1;>,then let Cl--Ui(e(6"),e(6"),e(1;'),e('C'),O) then c=e.c I 3.2. if'c='c;1^~;2 then let ci=Ui_i(61,6",~:I,'C',j+I)and c2=Ui_1(c1(62),c1(6'),c1(1;2).c1(~'),j+1) then c--cl.c2. Let PPi be the 81gorithm obtained from PP by replacing UNIFY with UNIFY i (i>O). The following theorem holds:

48 Theorem 7.i) PPi(X)=~ ~II(X).

ii) ~ll(X) ~ ~i.PPi(X)=8nd _~. Proof_ Immediste from Theorem 5 8nd from the definition of the 8pproximsnts of term. []

4.Proof of Theorem 6.

(~)By induction on the structure of ×. For X vsriable, obvious. For X=;~.x.X'or X=YZ, where Y does not reduce to ~x.Y',forsome Y',the proof follows directly from the induction hypothesis. For X=(~x.Y)Z, PP(X) =~PP(;k×.Y)= end PP(Z)= and --,where c=UNIFY(6-~6f2~p). It essy too see , by exsmining the

semi-algorithm

PP,

that, if ~~~-,~

and

~If2-,~P

and

UNIFY(~,~)=c',

~.Then the proof is given by induction on the normsl forms of ~x.Y and Z, which exist since X is strongly normalizing by hypothesis. (~) Let B be 8 basis scheme, ~ be 8 type scheme ?g,snd M be 8 ~.- term. Let us define the predicgte: P(B,o~,M)C=>PP(M)is defined and 3c.~c(PP(M))8ridM is strongly normslizing. Let x-M denote xMI...Mn, for n;~O,8ridlet FV(M) denote the set of vsrisbles occurring free inM. Property 3.i) P(B,o~-~,xM) 8nd P(B',oCN) ~ P(SUB',~,xMN). ii) P(BU{o~x},I~,Mx)8nd x~FV(M) 8nd B does not contsin premises on x P(B,oc-~I~,M). iii)P(B,61^e2,M) ¢ P(B,61,M) 8nd P(B,62,M). iv) P(B,6,M) 8nd 6<'~ :=>P(B,I;,M). Proof_ i) Let xi~=xM1...Mm.

P(B',o~,N)~PP(N)= 8rid 3c.~c(PP(N)).

p(8,~-~ts,x~)¢pp(x~)=<{Tf1-~...-~fm-~x}VBiV...VBm,~p>, where ke is 8 fresh wrisble end

PP(Mi)=, and

~c'.~c'(PP(x~))

So

UNIFY(~p,~f'-+~)--s, where

s={<~,~f'-+~>} (~t is fresh),which pp(xi~N)=<{~f1-~...-+~fm-+~f'-~?x}~BI~...VBm~IB',~>.Let c"--c.c'.s', where

impli es s'--{<$,~>}.

-c"(PP(x~N)),smce PP(N) and PP(x~) 8re disjoint,then P(BUB',~,x~N). ii) P(BU{ccx},~,Mx)~PP(M)= ~nd PP(x)=<{~px},~> ~nd UNIFY(~fI,~-+?)=c' end pp(Mx)=where ~tis fresh and B I does not contsin premises on x, and moreover ~c.~c(.Notethst c' does not contsin any expansion involving the type v~riable ?. Then =c()(since B I does not contain premises

on

49 x)=c()=c'.c() , and ~,henP(B,E-~B,M). iii)and iv) ere immediate. Then define by induction on the ~tructure of type 8cheme~ ~, computability predicate:

the follo~ing

Comp(B,~,M) <::>P(B,~,M) Comp(B,6-)%,M) (=> (Comp(B',6,N)~Comp(BUB',%,MN)) Comp(B,d I^62,M) ~=> Comp(B,61,M) and Comp(B,62,M). it is easy to prove, by induction on the structure of M, that Comp is invoriont under B-convertibility. L e m m 8 I. i) P(B,6,xM) ~ Comp(B,~,xM). ii) Comp(B,6,M) =~ P(B,6,M). Proof.i) and ii) by simultaneous induction on 6. 6 is a type variable, i) and ii) follow from the definition of Comp. i) Comp(B',c~,N)~ P(B',E,N) (by induction hypothesis). P(B,~-~Ie,xM) and P(B',~,N) ~ P(BUB',B,xM-'N)(by Property 3) ~ Comp(BUB',B,xMN) (by induction hypothesis). Then Comp(B',o~,N) and Comp(BUB',B,x~IN) ~ Comp(B,c(-~B,x~) (by def. of Comp). ii) Let x~FV(M) and let {o;x}~BL P(B',~,×)~ Comp(B',~,x) (by induction). Comp(B,~-~B,M) and Comp(B',o~,x) ~ Comp(BUB',B,Mx) (by definition) ~ P(BUB',I3,Mx)(by induction) => P(B,(~-*I~,M)(by Property 3). 6=61^62 . ii)by definition of Comp ond by induction hypothesis. i) P(B,61^62,xM) ~ P(B,61,×M) and P(B,62,xM) (by Property 3)0 Comp(B,61,xM) and Comp(B,62,xM) (by induction) ~Comp(B,61^62,xM) (by definition).

EI

Lemmo 2. Let {Xl,...,Xm}DFV(M),and let B be such that {6ixi}~B (1~i~m}.Comp(B',6i,Ni) (1~i<m) and PP(M)= and 3c.~c() ~ Comp(BUB',~;,M[xi/Ni]). ProeLBy induction on M. The only not trivial case is M=~,x.M'. Then PP(M)=<_8,(~-~{3>=> PP(M')~<_BU{Ex},~>,whereB does not contain premises on x. PP(M')~ and 3c.~c()and Comp(B",6,N) and Comp(B',6i,Ni) (1.~i<m)

=>

Comp(BU{6 x}UB'UB",~;,M'[x/N,xi/Ni)

(1~i~m)

(by

induction)

=>

Comp(BU{6x}UB'UB",~;,(;~x.M'[xilNI])N)(since Comp is invoriont under {~-convertibility) Comp(BUB',d-)~;,~x.M'[xI/Ni])(by definition). El Then let PP(M) be defined, ond let {xl,...,Xm}=FV(M),and let ~c(PP(M)) and let {6ix}EB (1
50 5. The intersection type discipline without ~. In [Coppo et ei.,1980 a], for the first time 8n intersection type discipline was introduced, built from 8 set of type variables, without sny constant. More precisely, the type schemes ere defined as in Definition I ,without the constant ~, end the assignment rules are as in Definition 4, without the rule (~). The definition of pairs, equivalence relation ~, and operations of pairs remain unchanged. It is possible to define a principal pair in this discipline, in the following way: Definition 15. Let X be e normal form. pp'(X) is so defined: i)if X=x then pp'(x)~-<{~px},~>where ~ is e fresh type variable ii) if X--~x.X'end pp'(X')~,then: I) if × occurs in X' then pp'(X)~,where 6 is the intersection of the predicates in B' whose subject is x 2) otherwise pp'(X)~,where ~ is fresh. iii) if X=xXI...Xn and pp'(Xi)~then pp'(X)~~px},~>,where is fresh. The proof that pp'(X) is really the principal pair of X, in the sense that ell and only the type scheme deducible for X are obtained from pp'(X) by means of chains of substitutions, expansions and rise, is 8 particular case of the proof that, for A~N, pp(A) is the prlnclpal pelr of A, given in [Ronchl et ai.,1984]. Moreover an algorithm PP" can be define, which differs from PP only in the point 2), which must be replaced by: 2) if X=~,x.X'then if PP'(X')=then if B' contains a premise on x, let ~x, then PP'(X)- else PP'(X)=,where ~ is e fresh type variable. Then we obtain, as corollary of Theorem 6, the following: Theorem 8.1n the intersection type discipline without the constant ~), there exists e polr suitable for X iff X is strongly normalizing. [] This result is stated, but not proved, in [Coppo et el., 1980 o]. Aknoledgments.The author is very grateful to Paolo Busse and Mauro Berta, who gave an essential contribution in designing end implementing the semi-algorithms UNIFY end PP.

51 References.

[Borendregt,1984]

Berendregt H., The Lambdo Calculus: its syntax and semantics, North Holland, (Amsterdam). [Barendregt et ai.,1981]Borendregt H, Coppo M,,Dezeni M., A filter ~,-model and the completeness of type assignment,Journal of Symbolic Logic,84,4. [Coppo et ai.,1980 a] Coppo M., Dezanl M., An extension of the b6sic FL!nctionalityTheory for the L-calculus, Notre Dame Journal of Formal Logic, 21,4. [Coppo et ai.,1980 b] Coppo M., Dszani M.,Vonnori B., Principal type scheme and ~,-celculussemantics,in: J.P.Seldin,J.R.Hindleyads, To N.B.Curry.Essays on Combinatory Logic, ~-celculus end Formalism, Academic Press,London,1980,pp 535-560. [Curry et ai.,1958] Curry H.D., Feys R., Combinetory Logic, vol.1, Nort Holland (Amsterdam). [Hindley,1969] HIndley R.,The principal type scheme as an object in combinatory logic.Trans. Amer. Math. Soc,,146. INindley,1983] Hindle 9 R.~ The completeness theorem for typing A-terms, Theoretical Computer Science, 22. [Milner,1978] Milner R., A theory of type polimorphism in programming, J. Comput. System Sci.,17. [Milner et ai.,1982] Milner R., Domes L,Principal type schemes for functlonal programs, 9-th Syrup. on Prlnciple of programming languages. [Robinson,1965] Robinson J.A., A machine oriented logic based on the resolution principle,Journal of ACM, 12. [Ronchi et 81.,1984] Ronchi Dell8 Rocce S., Venneri B., Principal type scheme for en extended type theory, Theoretical Computer Science, 28.

O P T I M A L

RUN

TIME

O P T I M I Z A T I O N

P R O V E D BY A N E W L O O K A T A B S T R A C T I N T E R P R E T A T I O N S

B e r n h a r d Steffen Institut f~r Informatik U n i v e r s i t ~ t Kiel, D-2300 Kiel

Abstract

A two stage run time optimization algorithm is p r e s e n t e d that combines two w e l l - k n o w n techniques in a Herbrand optimal manner: - Kildall's iterative m e t h o d for data flow analysis and - M o r e l / R e n v o i s e ' s partial redundancy elimination algorithm. To combine these techniques in such an optimal way, we firstly have to elaborate Kildall's approach. This is done by means of a new classification method for abstract interpretations which has to be i n t r o d u c e d before S e c o n d l y we have to extend M o r e l / R e n v o i s e ' s technique, which is only conceived to treat the o c c u r r e n c e s of a single term, to work on the value equivalence classes d e l i v e r e d by the K i l d a l l - l i k e data flow analysis a l g o r i t h m m e n t i o n e d above. Our algorithm being optimal with respect to the Herbrand interpretation, it is a w e l l - f o u n d e d basis for the c o n s t r u c t i o n of further algorithms using special p r o p e r t i e s of a given interpretation. These can be o b t a i n e d by t r a n s f o r m i n g the K i l d a l l - l i k e analysis stage only.

I. P r e f a c e

High-level languages support a convenient and reliable programming, but the r e q u i r e d c o m p i l e r s often produce i n e f f i c i e n t codes. For example the p r o c e d u r e m e c h a n i s m and the macro expansion m e c h a n i s m lead to run time c o m p u t a t i o n s being too c o m p l i c a t e d or even redundant. To avoid this, modern compilers are c o n s t r u c t e d using optimizing techniques. Here the f o l l o w i n g m e t h o d s are very important: - loop invariant - common

code motion

subexpression

and

elimination.

Usually optimizers operate on nondeterministic flow graphs d e l i v e r e d by the compiler front ends. Based on this r e p r e s e n t a t i o n it is p o s s i b l e to combine and to improve the optimization techniques mentioned above in a systematic manner, to receive an algorithm which transforms prog r a m s into a m i n i m a l form w.r.t, the Herbrand interpretation [Gr]. This algorithm mainly consists of a two-stage iterative analysis process:

53 Firstly, we have a data flow analysis algorithm w h i c h is b a s e d on Kildall's iterative analysis technique [Kil and Ki2]. It partitions the o c c u r r e n c e s of the p r o g r a m terms in a Herbrand optimal manner. This optimality is p r o v e d by a new classification approach for abs tra c t in terpre tations. Secondly, we use an algorithm which determines the optimal locations for the c o m p u t a t i o n s of the source program w.r.t, the equivalence relation d e l i v e r e d by the first analysis stage. This algorithm is a g e n e r a l i z a t i o n of the partial redundancy elimination process stated by M o r e l / R e n v o i s e in 1979 [MR]. Our a l g o r i t h m being optimal w.r.t, the Herbrand interpretation, it is a well-founded basis for the c o n s t r u c t i o n of further algorithms using special p r o p e r t i e s of a given interpretation. These can be o b t a i n e d by t r a n s f o r m i n g the first analysis stage only. We now v i s u a l i z e

Here:

basis

and goal

of our algorithm:

(----]

- The arrows denote the n o n d e t e r m i n i s t i c this p r o g r a m part. -

The nodes

characterize

parallel

branching

structure

of

assignments.

This non reducible p r o g r a m part (it is a minimal the g e n e r a l i t y of our concept) has the following

example to d e m o n s t r a t e specific property:

while staying w i t h i n this general loop ( w i t h o u t leaving in the meantime ) the c o m p u t a t i o n s of "a+b" and "x+y" d e l i v e r the same values. This

motivates

the following

optimization:

I h:x+y I

i

i I

i

abc):-<xy h,

1

][ I Xy z :=

I

h )] D i a g r a m

This -

optimization

is r e a l i z e d

R e c o g n i z i n g the "equality" the first analysis stage.

in three of "a+b"

1.2

steps: and

"x+y".

This

is

done

within

- D e t e r m i n i n g the computation points ( see the i n s e r t e d nodes for the i n i t i a l i z a t i o n of h ) and the computation forms ( here "x+y" and "a+b" ). This is realized by solving a Boolean equation system i n i t i a l i z e d by means of the first analysis stage. -

T r a n s f o r m i n g the p r o g r a m on basis of the a n a l y s i s results, i.e. moving the c o m p u t a t i o n s (here "a+b" and "x+y") to the c o m p u t a t i o n points.

54

Previous optimization t e c h n i q u e s fail in t r e a t i n g the s i t u a t i o n m e n tioned above. I n d e e d m e t h o d s e x i s t w h i c h are a b l e to determine the r e d u n d a n c y if the v a r i a b l e h is a l r e a d y i n i t i a l i z e d [Kil, Ki2, KU, F K U and RL], b u t t h e s e m e t h o d s are e i t h e r too w e a k to m o v e any c o m p u t a t i o n at all [Kil, Ki2 a n d KU], or t h e y are r e s t r i c t e d to s p e c i a l l o o p s [FKU and RL]. On the o t h e r given fails

hand,

a technique

exists

which

is c o n c e i v e d

to m o v e

a

term w i t h i n an a r b i t r a r y f l o w g r a p h [MR], but this technique to r e c o g n i z e the " e q u a l i t y " of "a+b" a n d "x+y". Our approach combines and generalizes Kildall's t e c h n i q u e for the

r e d u n d a n c y e l i m i n a t i o n [Kil and Ki2] a n d the m e t h o d to l o c a t e computat i o n s w i t h i n a f l o w g r a p h s t a t e d by M o r e l / R e n v o i s e [MR]. T h e r e s u l t is a u n i f o r m a l g o r i t h m w h i c h d e l i v e r s the o p t i m a l computation points and

computation

forms

the Herbrand

w~r.t,

interpretation.

After presenting the b a s i c c o n c e p t s of this p a p e r in s e c t i o n II, we a n a l y z e the r e l a t i o n s b e t w e e n d i f f e r e n t abstract interpretations [CCI] s e c t i o n Ill. T h e s t u d y of t h e s e r e l a t i o n s d e l i v e r s classification criteria for abstract interpretations w.r.t, a given observational level. T h e s e c r i t e r i a c a n be u s e d to p r o v e the Herbrand optimality of the first analysis stage of o u r o p t i m i z a t i o n a l g o r i t h m as s k e t c h e d in section IV. A f t e r w a r d s , w e s h o r t l y d e s c r i b e the second analysis stage in s e c t i o n V a n d the r e s u l t i n g optimization in s e c t i o n VI.

in

If. Preliminary Definitions We d i r e c t l y introduce graph structure over occurrences G = -

of e l e m e n t a r y

(N, E, s,

(N,E) edge

- s

e )

E ~ N

resp.

LFG =

! G

This

composed

and

structure

allows

flow graphs

as f o l l o w s :

directed

graph

with

node

set

N ~ N

and

× N.

no predecessor write P(G) flow graph

for

of our p r o g r a m m i n g l a n g u a g e as a f l o w w h i c h r e p r e s e n t s the entire set of

statements. are

( start resp.

e

Further, we e of a g i v e n

5F~

which

is a c o n n e c t e d set

possessing

and

the s y n t a x a set N,

end n o d e resp.

I

denotes

a special

element

of

N

nodes.

for the set of all f i n i t e p a t h s f r o m s to G, F G for the s e t of all f l o w g r a p h s o v e r N

linear

the set of all

~ F~

)

successor

IP(G) l =

I

flow graphs

o v e r N,

i.e.

}

Remark II.1 P(G)

characterizes

identify

P(G)

with

a special this

subset

of LFG.

In the

following,

we

subset.

T h e semantics for flow graphs G over N, w i l l n o w be i n t r o d u c e d the MOP-solution in the s e n s e of Kam/Ullman [KU]. For t h a t p u r p o s e n e e d a complete semi-lattice (C, n, ~, ±, T) with bottom element

as we ±

55

and

top

element

T.

The

elements

of

representation of the situations a r b i t r a r y p r o g r a m p o i n t of G. Definition II.l a) Let ~ ~i : N node n c N a V T s C: (~ ~l , C) b)

, (C ~ C~ distributive

~ FG, G

possibly

be a function, function ~n~l

c

I ~nk~i ..... ~n1~l (c),

(~ ~, C) is (~ ~i , C)). delivers semantics

~P~1 (C)

- an i n t e r p r e t a t i o n - a set of s t a t e s the p o w e r s e t (boole,

called

( global )

a

a uniform of state

In

this

~

~

is

the

I =

(D,

~D w i t h

io)

data

lattice

d

(nl .... nk)

c LFG

abstract

semantics

frame, which is appropriate transformations belonging to

the

abstract

complete

to an

semantics

semantics

of a

and ~ D

POT([D)

for C a n d n o d e s

n of

the

form:

instruction)

- V [ ~ [~: ~n~([) =d~ {~ I B o c Zbool, Xbo~le

an

otherwise,

For example, we are a b l e to s i m u l a t e programming language w.r.t.:

- n =dr

and

if G =

imperative programming language as w e l l as the w h i c h is i n d u c e d b y a d a t a f l o w a n a l y s i s a l g o r i t h m .

using

as

at

c C:

] (c) =dr

This approach describe the

goto

serve

occur

w h i c h r e l a t e s to e v e r y from C to C ( i.e.:

local abstract semantics ~ ~l to the d o m a i n FG:

{ PEP(G) then (w.r.t.

semi-lattice

will

~n~! ([~ T) = ~ { ~n~l (c) Ic E T } ). In this case, w e c a l l an abstract interpretation or a local abstract semantics.

When (~ ~l , C) is a f o l l o w i n g e x t e n s i o n of V G

this

which

is the s u b s e t situation,

of we

n [:

~instruction~(m)=sl,

XD l e a v i n g

the

Boolean e x p r e s s i o n

are

to

translate

able

s t a t e m e n t of ~oto programs "if boole s u b f l o w g r a p h of the f o l l o w i n g form:

boole;

then goto

] goto skip [

L1

the

where

boole T R U E .

characteristic

else goto

L2"

in a

L1

predecessor

I goto L2 nboole; T h i s c o n c e p t p r o d u c e s the [Nil, w h i c h is e q u i v a l e n t

skip

~

Diagram

II.l

.

collecting semantics in the s e n s e of Nielson s e m a n t i c s for flow charts.

to t h e u s u a l

It is a l s o p o s s i b l e to s i m u l a t e a v e r y g e n e r a l with formal procedure parameters (see sec. IV). The treatment of semantics induced r i t h m s f o l l o w s i n the n e x t s e c t i o n .

by

procedure concept, e v e n data

flow

analysis

algo-

56

Finally,

we

present

semantics,

which

Definition Let G =

II.2 (N, E,

semantics a)

A

and

s,

Cs

=

V i

c IN

hl :

every

(hl)

induces

b)

Two cs

c)

A

(~

(K

3 nl

if

exists, -

(~i)

is

- a node occurs d)

We

The

~®

=dr

of

node

whereas

fulfils

the

following

sequences

two

(hl)

in

designate

of

=

G

(~i)

of

G

w.r.t. (~i)

Cs

of

is

G

exists,

states

the be

that

every

node

belonging G

~

to ( c~

(~i).

wise)

the

well-known found

in

abstract

(~ ~l , C), G c FG, of G w.r.t, cs Then

we

=

S®

( e

Especially: the end semantics

~®

is

computation

)

(global)

sequence.

n

~ N

end semantics

of

the

(hl).

frameworks

may

so

coincidence ( here [CCI,

the

CC2,

of

MOP- a n d

the

terminology Kil

or

Ki2]

semantics cs c C, and ~®

w.r.t,

results

the

(~,) a f a i r the end

fol). respon-

the

abstract semantics computation sequence

cs

properties:

(component

distributive

Coincidence Theorem L e t (~ ~, C) be the

called

w.r.t,

coincidence

for

w.r.t.

[~0 , fix .... } .

of t h e s e t w o globalization concepts is practical a p p l i c a b i l i t y of t h e theoretical global abstract semantics proved in section III.

The

the

(nl).

sequence

proofs

and

sequence

c NS(SI)

often hl

We

(hl).

(nl)

~

(Si)

{h0 , ~1 .... }

sequence

to

(nl).

sequences.

sequences if

following

theorem for

(~i)

:

(hl)-node

~l , C ) - c o m p u t a t i o n

[KU],

about

NS(~,)

infinitely

following

sible

=

sequence

MFP-solution lows

the

([ ~l , C ) - c o m p u t a t i o n

called

[( [ ] End, ((gi-1 (n))) n ~I-i (n), | n predecessor ~ of n if n = ni | [ ~i - i (n) otherwise.

equivalent

call

(K

is if

(~ ~l , C ) - c o m p u t a t i o n

with

abstract

n = s

equivalent,

a

a local

c N:

~l , C ) - c o m p u t a t i o n

fair,

¢ N

C)-computation

called

(6 ~i , C)

otherwise,

N S ( h i ) as

~L ,

are

graph,

C cs ,

, if

a set

of

flow

N ~ n

T

Sl (n)

elements

the

a

w.r.t,

I Cs

[ ii)

be

G

for

g0 (n)

)

to

(h~) , of

properties

e

globalization of a l o c a l a b s t r a c t MFP-solution of K a m / U l l m a n [KU].

alternative

¢ C.

sequence

sequence

i)

an

corresponds

local

(K ~, ,C)semantics

have: ).

independent

of

the

underlying

(~

El , C ) -

57

III

Levels of Abstract

During

the

- are

two

Interpretations

construction given

terms

of

optimization

representing

the

- is a p r o g r a m p o i n t r e a c h a b l e ? - d o e s a p r o g r a m p a r t c h a n g e the are

of m a i n

able

to

that ~z

interest.

treat

(~ ~z,

C~)

characterize

AI

: CI

and

: C2

describe

ally and

a complete

with

abstract

run

questions

time

some of

special

levels

~i

C3.

abstraction,

variables?

semantics,

of

semantics

are

we

are

abstraction.

For

=

and

(~ ~I , CI)

These

which

like

values?

abstract

semi-lattice

of

three

objects

connected

by

two

abstraction functions:

surjective V n

c N,

c

c CI

: ~n~2 oA~ (c)

~ AI 0~n~1 (c)

.......~ C3.

the

mutual

introduce

the

A2 a d e f i n e d

V c

two

levels

of

concept

on various

take

~ C2,

A2

questions

and

and

values

the

we three

distributive

To

such

purpose,

=

Using

algorithms same

relationship

between

adjoint

two

these

levels

we

addition-

concretization ) functions

or

A~ a

by:

c C,+l : Aia (c)

=dr

I

{ C

I Ai (C)=C

}-

Remark I I I . 1 This

specifies

semantics

~I

the

and

we

following are

semantics

(formalized

determine

automatically.

(iteratively) enough

( typical questions This w.r.t.

completely examples mentioned

section

semantics ~I

and

fixes

- ~2 - C3

this C3

of

abstract

the

inspected the

illustrate

this

properties

of

Cs),

semantics

~z

properties are

to d e c i d e ( i.e.

following

of

are

whether

is

this

want

to

for

an

to s e a r c h

suggested

~2

abstract

we

which we

whether

III.l.(c))

given

which

we h a v e

properties

criteria

the

a

special

purpose

the

property

detailied

interested by

the

a given

in three

abstract

is g l o b a l l y

optimal

) or not°

notations:

treatment.

programming

It

stands

language

for

(compare

the

complete

seo.

iI).

computation level.

question

- A~ and Az characterize l e v e l s of a b s t r a c t i o n . To

that

b a s i c level of o u r the

characterizes identifies

For

(Definition

motivates

the

semantics

elements

for such above ) ~

We h a v e

in s o m e

the

determine

delivers

~2 h a s

Remark I I I . l - ~i

as

computable

to

situation.

interested

situation,

(or

observation)

the

degree

we

~i :

Ci

~ C~

~2 :

C2

~ C2

Cs

C3

use

the

of

level.

abstraction

diagram

below:

Diagram III.1

between

these

58

Furthermore, w e d e n o t e t h e r e l a t i o n b e t w e e n :9~ a n d as :9, )~2 o~ Cs resp. :9~ -----~2 C~ and the and ~z as :gz
a)

case

following

Lemma

following

~G~2 oA,

¢ FG:

In t h i s The

the

:gz -
( ~ Cl ,c~

are called isomorph, iff a function A~ ::9, ~ :92 e x i s t s ,

:91 a n d :gz abstraction

= A, oEG~, . ~

~,

collects

b)

:gz
c)

~


Diagram

and

~

:9~

some

<,x

~ C, : A~ (c~) A,

. A, a • A~

:9~ ~

:9*

i) ii) ^

III.l

~ G ~ G

:9* < ~

suggests

characterized

or o n l y

immediate

by

:91 . T h e n

= A, (c2)

:92 ~ :9~. results:

want

w.r.t.

Definition

Let

= AI (c~))

e FG: e FG: ~

¢==>

:9~

two

~G3z ~At EG~z

_= AI 0~G~, -= A~ o ~ G ~ oA, a .

:92 ~

different

:9* •

functions

to s o l v e

the

question

f o r t h e basic level o p t ( G , c ) = Az oat oKG~, a A 1 a . A 2 ~ (c)

function given by the computation level ) C~ with c o m ( G , c ) = Az 0~G~z oA2a (c).

to a n a l y z e Cs

A, (c~)

Cs :

and secondly, the c o m : F G × Cs We now

we h a v e :

~

= A,°

Firstly, the function optimal o p t : F G × C3 ) C3 with

a)

Cs :9~

III. 1

Let

:91

:92 a n d between

property:

we write lemma

Cs r e s p . relation

( i.e.:

in w h i c h V G

cases

~ FG,

c

:92 is d e t a i l e d e C3 : c o m ( G , c )

enough =

to

simulate

opt(G,c)

).

I I I . 9.

:92 -
and

:92

~-A2 C3.

Then

we

introduce:

RI(:91 ,Ai ,:92 ,A2 ,C3 )=dr {c~C2 13 G e F G ,

C__cC3 : c = AI o~G~, oAt a oA2 a (C__)} ,

RH(:9* ,A* ,:gz ,Az ,C3 )

complete semi-lattice closure

denotes

the

RI(~I ,At ,:92 ,A2 ,C3)

RS(:91 ,A1,:92,A2 ,C3)=df (K h , RH(:91 ,At ,:92 ,A2 ,Cs)), d e f i n e d as f o l l o w s : V c

of

and where

~ h

is

c C2: , if R H ( ~ I ,At ,:92,A2 ,C3) is c l o s e d u n d e r ~ ~2 Ech

b)

=dr

{ I~c~2 IRH(:GI'AI 'CS)otherwise. ':gz 'A2

weakly expressive Cz is called following equation holds for every

for G1 , G2

~, w.r.t. e LFG:

A2 oAi o~G1 ~i gAla oAt o ~ G 2 ~ l o A 1 a oA2 a = Az oAz ~ G ~ 1

C3 ,

if

o~G2~i gAla oAz a .

the

59

c)

~

d)

locally optimal

is c a l l e d V n

~

¢ N:

is

A~ o ~ n ~

Cs.

In t h i s

III.2 trivial

Remark

a)The

following b)The

case,

"l"-case

.

@i,

if w e

have:

. w.r.t.

we w r i t e

~z

%z

in D e f i n i t i o n

and

Cs,

if

~

simulates

~i

¢ g l o b ( ~ i ,C~).

III.2(a)

never

occurs

in

the

considerations.

weakly expressive

term

only

w.r.t

~n~

globally optimal

called

w.r.t.

oA, ~ =

have

to p u t

~

as

is

the

suggested

semantics

by

Hoare Logic

the

induced

by

an

[Co].

We

interpretation

I

sets of states w h i c h are characterized b y first order logic formulas. In t h i s case, we a r e a b l e to d e s c r i b e the expressiveness (of the l o g i c f o r m u l a s ) w.r.t, the p r o g r a m m i n g and

C2

as

language V G That

the

FG

set

and

c FG,

C

means

for

of

the

¢ C2 :

those

interpretation ~G~i gAla (c)

every

program

a strongest postcondition postcondition(G,c)

=

G

[Co]

I

as

= A1a ~A~ 0 ~ G ~ ~ FG

and

exists

A~ o ~ G ~

follows: gAla (C).

precondition

every

( in Cz

c ~ Cz

), here:

oA~ ~ (c) .

~ is locally optimal w.r.t. ~ then ~ ~z is the best upper approximation of ~ ~ in the s e n s e of Cousot/Cousot [CC3].

c)If

Thus

our

considering the d)The but

concept

extends

a third

level

optimality

A first

will

problem

studied

abstraction

( C~

by

Cousot/Cousot

) and

by

by

strengthening

requirements.

global optimality d o e s we

bally

see

optimal

that

property

of

~ glob(~i,

the

C3)

not

this

abstract

Transitivity Theorem Let ~2 ~AI ~2 ~Ai ~s

the

of

semantics

global

~i.

imply

Then

holds

<............ ~..... (B2

for

( Equivalence

optimality

we

local optimality in g e n e r a l ,

the

implication

will

every

Theorem

be

minimal

glo-

).

delivered

by

the

have: c glob(~i,

C3)

^ ~2

¢ glob(~2,

C3))

Proof

"~":

Let

S~

Lemma

I I I . 1 (b) :

c

g l o b ( ~ 1 ,C3)

A2 oA* o ~ G ~ 2 oA* a oAz ~

"~":

Let

~

for

every

c

g l o b ( ~ 1 ,Cs ) G

and

G

E FG.

this

case

we

=-

A2 0 L G ~ z oA2 ~

=

A2 aA* oAt • ~ G ] I 0At a oA, a 0Az ~

-=

A2 oA* o~G~z 0A* a oA2 a

and

~z

E

g l o b ( ~ 2 ,C~) .

get

from

q.e.d. Then

we

have

¢ FG:

A2 .At .At o~G~1 oAt a oAt ~ cA~ a = =

and

In

therefore

~

c

A2 0At o~G~2 oAt a oA~ a Az o ~ G ~ z o A2 a ,

g l o b ( ~ 1 ,C3) .

q.e.d.

60

The local property

optimality ( w.r.t. ~ ) is a v e r y n a t u r a l and e a s y - t o - p r o v e for an a b s t r a c t i n t e r p r e t a t i o n @2 w h i c h is constructed to

simulate ~ . T h u s for the (practical) a p p l i c a t i o n ( in p a r t i c u l a r the a p p l i c a t i o n in s e c t i o n I V ) the f o l l o w i n g c h a r a c t e r i z a t i o n of g l o b a l o p t i m a l i t y is v e r y i m p o r t a n t : Simulation

Let

Theorem

~z be a l o c a l

optimal

~2 is g l o b a l l y C2 The

for the

is w e a k l y

defining

abstract

optimal

expressive

equation

semantics

w.r.t.

~

for

w.r.t.

for the

~

and

w.r.t.

~ . T h e n we have:

C~

¢==>

C~.

global optimality

is too w e a k

for

an

inductive extension, so that we c a n n o t d i r e c t l y p r o v e the Simulation Theorem (by i n d u c t i o n ) . F o r that r e a s o n we i n t r o d u c e a s p e c i a l c l a s s of a b s t r a c t s e m a n t i c s ( the fully abstract models ) to characterize the global proofs

optimality. This by induction.

Definition III. 2 Let ~I , C a n d A f u l f i l

of

~l w . r . t .

~2

-<~

C

and

~i , ~

~

i)

A = A2

ii)

~2 = R S ( ~

iii)

~2 is l o c a l l y

iv)

~ c,,c2 A~ (c~)

We d e n o t e

C~

class

is

restricted

enough

to

allow

easy

~I ---~A C. ~2 is c a l l e d a fully abstract model A, if abstraction functions A, a n d A2 w i t h and the

following

four

properties

exist:

~ A~, ,A~ , ~ ,A~ ,C), optimal

w.r.t.

RS(~

,identity,~

~ RI(~, , i d e n t i t y , ~ , A z oA~ ,C): = A1 (cz) ¢==> ~ G ~ LFG: A2 oA~ 0 ~ G ~

the set of all

those

fully

abstract

,A2 oA~,C),

(c~)

= A~ 0A~ 0KG31 (c~) .

models

as FAM(~I ,A,C).

R e m a r k III. 3 a)Two data flow

informations cI a n d c2 are g e n e r a l l y c a l l e d observably (w.r.t. C) if A(cl ) = A(c2 ). T h e n c o n d i t i o n iv) s t a t e s ~z o p e r a t e s on the largest congruence c o n t a i n e d in this e q u i v a -

equivalent that lence. of

Hence

Milner

~z c h a r a c t e r i z e s

a

fully abstract model

in the

sense

[Mi].

b)A fully abstract model of ~i w.r.t. C and A depends only on RS(%, , i d e n t i t y , ~l ,A2 oat ,C), C and A. This allows us to assume ~i= R S ( ~ , i d e n t i t y , @ 1 ,A2 ~AI ,C) d u r i n g the f o l l o w i n g c o n s i d e r a t i o n s . N o w the d i s t r i b u t i v i t y of all the f u n c t i o n s lity" of the fully abstract models deliver: Lemma Let for

mentioned

and t h e

"minima-

III. 2 ~2 c FAM(~I ,A2 .At ,C3 ) w i t h ~2
AI (cl)

= A1 (c2)

Especially, V GI ,Gz

we have ~ FG:

~

V G

~ FG:

Ai o~G~1 (ci)

as a c o n s e q u e n c e

AI .~G~ ~i o~G2 ~I (cI)

of

= AI ~ G ~ I

AI oAt a pAl

(c2) .

= AI :

= AI oEGI ~i oA~ a oAi oEG2 ~i (Cl) .

holds

61

This

enables

us

to s t a t e

the

E x i s t e n c e and U n i q u e n e s s T h e o r e m Let ~i , C and A fulfil ~t ---~A C. Then ( with = ) a unique fully abstract model i s o m o r p h i s m ..... and A e x i s t s .

the

exception

of

~I

of

w.r.t.

C

Proof To p r o v e the e x i s t e n c e , we only have to c o n s i d e r the l o c a l optimal abstract interpretation induced on the largest congruence b y RS(~I , i d e n t i t y , ~1 ,A2 0Ai ,C) . The u n i q u e n e s s w i l l be derived by using L e m m a I I I . l ( a a n d b), Lemma III.9. a n d R e m a r k . I I I . 2 ( b ) . T h e s e l e m m a t a d e l i v e r the r i g h t h a n d s i d e c o n d i t i o n of L e m m a I I I . l . (c). q.e.d. The next an e a s y

theorem

is a c o n s e q u e n c e

induction

of

Lemma

III.l.

It can be p r o v e d

by

argument.

T h e o r e m III.l L e t ~2 c FAM(~I ,A2 0At ,C3) with ~2 -
Simulation

the a r g u m e n t a t i o n for the the f o l l o w i n g t h e o r e m :

Theorem

con-

T h e o r e m III. 2 Let ~i )A~At C3, ~2 (
this

9~ : A* A

9~ :

result,

C~

,,,

1

II :i~,

we c o n s i d e r

I

'

~

/--

/

~ C~

A~

=af

(~ ~ ,

C~)

~ FAM(~

,A~ 0A, ~A~,C~)

/

C~ Here side

situation:

C~

~

C~

the f o l l o w i n g

C~

Diagram

the i d e a of the a r g u m e n t n e e d e d c o n s i s t s c o n d i t i o n of L e m m a I I I . l ( c ) for ~ and

~ ~ ~ to obtain s e n t e d in [St] ).

the

pre-

After this p r e p a r a t i o n we are a b l e to p r o v e the m a i n t h e o r e m of section. We p r o d u c e this p r o o f in m o r e d e t a i l to g i v e an i n s i g h t s o m e t y p i c a l a r g u m e n t a t i o n s in this c o n t e x t .

this into

~2

¢ glob(~1 , C3)

~I

..........~AOA1

stated

(

a

of d e r i v i n g the l e f t h a n d ~. T h u s we m a y c o n c l u d e is

Equivalence Theorem Let ~2 ~AI ~ and

assertion

IiI. 2

complete

proof

C3 . T h e n we have:

¢==~ FAM(~2,A,C3)

= FAM(~I ,AoAt ,C3)

62

Proof

"~"

follows

To prove with ~ flow

immediately

the converse = (| h , Cz)

graphs

by

applying

Theorem

III.l

twice.

let ~z ~ g ! o b ( ~ ,C3), A = A2 oA, ~ F A M ( ~ z ,A2 oA* ,C3). Then we have

G~ p G2 ~

= =

Az oKGI |2 oEG2 12 oA2 a Az oaf o~G, ~2 oA* a oKGz ~

2)

Az ~Ai 0EG~ ~z oAi a oA* ~A~ oEG~ ~

3)

A~ oA* oA~ o EG~ ~

4)

Az ~A1 oA~ oKG* ~* ~ G ~ requires

get

from G

This

I)

and

equality

yields

I I I . 3 . (b)

"

c_

of

local

is

A~ .A, oA, . Now the Existence

~

(

)

"

)

_~

3)

and

obtain

the

Furthermore

we

oA~ ~ oA* ~ oAz ~ . of

Theorem

~a

w.r.t.

III.2

we

fully abstract model

Uniqueness

we

4).

III.9.(iv):

optimality with

a

and

Therefore

by

Definition

Together )

cases.

oA~ ~ = A* oA~ o ~ G ~

the

).

all

w.r,t.

because

( e F A M ( ~ z ,Az o A , , C s ) and

oA~ ~ oA* ~ oA~ a

in

C~

A* oA* a o K G h

obviously

Remark

of 2)

III.l(b))

~- {

~ ~A* ~ ~Ai ~ oA~ ~

the

¢ FG:

oA~ a

~A~ a 0A, ~ oA* oA~ o ~G~ ~* oA~ a oA* a oA~ a

expressiveness

(glob. o p t . ) (Theo. I I I . l )

_= ( L e m m a

I)

This

~2 -<** ~z arbitrary

FG:

A2 0At oAt o~G1 ~i o ~ G 2 ~ 0A1a oAta 0Az a A2 +A, o~G, ~2 o~G~ ~2 oAf ~ QA2 a

weak

and for

Theorem

~

( notice

obtain

of

~i

delivers

that

w.r.t.

the

assertion

stated, The

q.e.d. Theorem ( which delivers t h e optimality of t h e (sec. IV) ) is c l e a r l y an i m m e d i a t e consequence

Simulation

analysis stage last Our

two

of

frame

three levels of abstract interpretations

the for

illustrate

example

first of

the

theorems.

concept

uniform To

~ Cs

the

the

which

is

classification

meaning

of

concentrated

of

these on

iterative

three

this

delivers

analysis

levels,

we

a

algorithms.

finish

with

an

phenomenon.

Example:

Let

us

have

a look

at

the

following

concretization

of

the

general

situation: -

N

-

~i

-

C3

-

A

This

=

[ nl,

=

(~

n2,

n3

~, , CI)

with:

- CI

=

{ M

-

=

"x:=

=

is

~ni~I { I,

the

3ix,

},

I M

i(3~x),

abstraction

situation

is

s IN },

x+l",

~nz~1

"x:=

2",

~ns~,

=

"x:=

x*3",

},

T

function

suitable

=

for

belonging

studying

the

to

CI

and

question

C3. whether

x is d i v i s i b l e b y 3. In t h i s section we have treated such situations to ria for an abstract semantics ~z to p r o v e w h e t h e r ~z optimal w.r.t. ~, and C3. T h i s m e a n s h e r e , whether

the

value

of

question

of

the

divisibility

of

x by

3.

obtain criteis globally ~ solves the

63 In our

case,

following ~2

=

it is s u f f i c i e n t

choice (E

I12.

C2

=d f

of

C2)

to c o m p u t e

modulo 3 . That

leads

to the

~z : with

Enid2

I0 rood 3.... I

=d~

.

.

.

Ent ~i

.

.

and

"mod 3"

.

/\

It

is

w.r.t.

easy C3

I~ 2 s o d

31 ~

1 mod

to s h o w

that

~z

3~ 11 0 m o d "3

is e v e n

a

fully

abstract

model

of

~I

and A.

Remark III.3 S m a l l c h a n g e s to N, ~, and Cs l e a d to s u b s t a n t i a l a l t e r a t i o n s For example, a l l o w i n g a s t a t e m e n t of the f o r m "i_ff x = 7 then r a i s e s the c o m p l e x i t y of a g l o b a l o p t i m a l a b s t r a c t s e m a n t i c s

to ~2 ° x : = 3" enor-

mously.

IV T h e F i r s t

Analysis

Stage

The data flow analysis of two c o m p o n e n t s :

algorithm

implemented

by

us c o n s i s t s

I) A local d a t a f l o w a n a l y s i s p r o c e s s to a n a l y z e e l e m e n t a r y or basic blocks [He]. This process defines a local s e m a n t i c s (E ~i , C).

as

usual

statements abstract

2) A s c h e d u l e r r e a l i z i n g f a i r n e s s by m e a n s of a w o r k l i s t [Kil, Ki2 or He]. It p r o v i d e s for the i t e r a t i v e g l o b a l i z a t i o n of the local d a t a f l o w p r o c e s s g e n e r a t i n g fair (E ~L , C ) - c o m p u t a t i o n s e q u e n c e s only. T h i s a l g o r i t h m s p e c i f i e s a p r o c e s s for s u c c e s s i v e l y c o n s t r u c t i n g a fair (E 21, C)-computation sequence. Using the Compositionality Theorem (sec. II), we l e a r n that this p r o c e s s a p p r o x i m a t e s the g l o b a l a b s t r a c t semantics ~j b e l o n g i n g to (E ~l, C). To p r o v e the H e r b r a n d o p t i m a l i t y of this p r o c e s s , we o n l y h a v e to s h o w that: - the e n d s e m a n t i c s of steps - ~a is Let

characterizing

~2

is r e a c h e d

in a

finite

number

H e r b r a n d optimal.

therefore:

- T be the H e r b r a n d u n i v e r s e d e t e r m i n e d by the v a r i a b l e s and o p e r a t o r s of the u n d e r l y i n g p r o g r a m m i n g l a n g u a g e , - Part(T)

be the

set of

- Part(T)

=dr { p

I 3 T

all p a r t i t i o n s s T: p

~ Part(T)

over ^

T

ITI

s T, E ~ }.

64

Then

we

have

to

analyze

the

~i :

C~

~ C~

~2 :

C~

~ Cz

~

C,

~ C~

:

C,~ Here:

- Let

~i

Cs

be

the

set

- Let

of

( In

AI :

CI

partition

p

~ Part(T)

p reduces

the

detailed

the

- ~2

be to

is

with

the

any

(data

induced

Ci

states

....... ~ Part(T)

equality

=dr

-

(~ ~z, C2 K ~2

- Let

to

states if

- Let the

{ p

being

A, : C2

relates

by

the "n"

of

=dr

"u"

~

be

~ C2);

......~. P a r t ( T )

be

the

partition the

p

Simulation

in

V n

given

by

Z

to

= p

partition

analogy

Theorem

to

(sec.

III)

we

- ~2

is

optimal

w.r.t.

~z

and

C3 .

p

~n~21 = A I Q ~ n ~ I , A I defined

function

to

of

a set

E Part(T)

are

able

cl

these

a . which

Herbrand

describing

to p r o v e :

and

T r a n s i t i v i t y T h e o r e m (see. III) this ~2 w.r.t. ~I a n d C3. On the other hand, it is p o s s i b l e to s h o w t h a t C2 d e s c e n d i n g chain c o n d i t i o n ( i . e . : f o r e v e r y C~-sequence, with

and

~2 o

Cs

the

optimality

}

exists.

and

globally

c N:

belonging

~i

Combining

the

Partition

of:

partially

~ C2

smallest

a partition formed

I B ~ c CI : Ai (~)

globalization

w.r.t.

c ~:

relates

~ CI.

terms.

optimal

(V i

of

with:

~ (C2

~ E Ci

~

program

is g l o b a l l y

global

lattice

).

which

states

information

- ~2

Together

Herbrand

the

powerset

function,

set flow)

~ Part(T) the

N

any

such

between Cz),

=dr

E ~21:

Applying

case,

viewpoint:

value

[,

IV. 1

semantics

this

Herbrand

all

situation:

Diagram

abstract

interpretation the

following

yields

the

fulfils

the

of

~ two

el÷l)

~

properties

(3 i we

~ ~

V

j

c ~:

cl

=

we

el÷j)

have: ).

get:

Optimality Theorem The implemented algorithm computes exactly the partition of C~, w h i c h is o p t i m a l to d e s c r i b e t h e s e t of Herbrand states related to a given program point. Alternatively: The algorithm determines all value equalities between program terms for every program point valid for every interpretation.

65 R e m a r k IV.I This t h e o r e m d o e s n o t h o l d for the a n a l y s i s a l g o r i t h m s o c c u r r i n g in the l i t e r a t u r e . F o r e x a m p l e m o s t of the computational levels considered there were not even locally optimal w.r.t, the Herbrand

interpretation. As

stated

in

section

If,

our

approach

is q u a l i f i e d

for

the

analysis

of

arbitrary goto programs, but this does not l i m i t its applicability. U s i n g an a d d i t i o n a l p r o c e s s , ( s i m i l a r to our s t a n d a r d p r o c e s s }, we are a b l e to e x t e n d the a n a l y s i s to a n interprocedural level. By this means, source

it is p o s s i b l e to r e a c h the Herbrand optimality even if the p r o g r a m is p r o v i d e d w i t h formal procedure parameters ( to p r o v e

this, it h a s to be a r g u e d b y m e a n s T h e o r e m a g a i n }. The

additional

We

lift

process

the

is b a s e d

functionality

of

the S i m u l a t i o n

on the of o u r

and

following

idea:

standard

process.

Transitivity

That

means,

instead of C, we u s e C =dr { Z ~ Z: C ~ C } as the complete s e m i - l a t t i c e of d a t a f l o w i n f o r m a t i o n s . T o d o this, we h a v e to c h a n g e our semantic function ~ ~ as f o l l o w s : ~ :

N ...... ~ ( C ---~ C

)

with

~ n ~

( Z )

=

~ n ~ 0 Z.

B y this m e a n s , w e a r e a b l e to u s e o u r s t a n d a r d p r o c e s s to approximate the c o m p l e t e state transformation of a p r o c e d u r e . This approximation p r o c e s s is s u p e r p o s e d b y a control iteration d i s t r i b u t i n g the a p p r o x i m a t e state transformations of the d i s t i n c t p r o c e d u r e s .

Remark a)C

IV.2

does

not

fulfil

the

descending

chain

condition.

Nevertheless

we

are able to p r o v e the termination of our interprocedural process, b e c a u s e a g i v e n p r o g r a m G o n l y a l l o w s v e r y s p e c i a l descending chains. Indeed an e f f e c t i v e finite set of terms

construction process exists which delivers T(G), so that Part(T(G)) × Part(T(G))

powerful e n o u g h to e x p r e s s all the e l e m e n t s of o c c u r d u r i n g an i n t e r p r o c e d u r a l a n a l y s i s of G. Thus

our

algorithm

preserves

its

optimality

C even

which in

a is

possibly

the

inter-

procedural c o n t e x t . b)The

c o n c e p t of the superposed control iterations l e a d s to a Herbrand t r e a t m e n t of local variables. T h i s p r o p e r t y d i s t i n g u i s h e s it

optimal

f r o m the p r o c e s s p u b l i s h e d b y B a r t h [Ba], w h e r e it is u n c l e a r h a n d l e l o c a l v a r i a b l e s of r e c u r s i v e p r o c e d u r e s at all. c)Our

process

tation,

allows

we have

first order procedures only.

To r e m o v e

this

how

to

limi-

to u s e

a preprocess which transforms programs with higher order procedures i n t o t h o s e w i t h first order procedures only. S u c h a p r e p r o c e s s e x i s t s w h e n e v e r the g i v e n p r o g r a m G possesses a regular formal call tree [O1] or more specificially, whenever G p o s s e s s e s no global formal procedure parameters [La]. L a n g m a a c k [La] r e s p . O l d e r o g [O1] has s h o w n ( b y u s i n g the t e c h nique of accompanying parameters [La] ) t h a t such programs can e f f e c t i v e l y be t r a n s f o r m e d i n t o e q u i v a l e n t o n e s w i t h o u t a n y procedure

66

nesting. med

into

S u b s e q u e n t l y the r e s u l t i n g p r o g r a m s can be e a s i l y programs w i t h first order procedures only,

transforwhich are

equivalent to the p r o g r a m s Thus

we h a v e s t a r t e d with. to o b t a i n Herbrand optimal

it is p o s s i b l e

whole

class

of

those

programs

which

possess

a

results

for

the

regular formal call

tree.

V.

The

Second

Analysis

Stage

T h e s e c o n d a n a l y s i s s t a g e is a l s o b a s e d o n the g l o b a l i z a t i o n of a l o c a l a b s t r a c t s e m a n t i c s of a g i v e n f l o w g r a p h G, b u t h e r e we use bit vectors r e p r e s e n t i n g the t r u t h v a l u e of s o m e p r e d i c a t e s i n s t e a d of partitions over a s e t of terms. Thus giobaiization means solving a Boolean equation system i n d u c e d b y t h e s e p r e d i c a t e s . The solutions of this equation system d e l i v e r the (optimal) computation points b e l o n g i n g to s p e c i a l systems of value equivalence classes ( these systems represent an abstract value, the computations of w h i c h w e intend to locate optimally

within

the

flow graph

The whole

location process

G

).

abstract value) is o r g a n i z e d

(for o n e

in s i x

steps: l)Insert

a node

potential alence

into

each

computation

e d g e of

points

G

of

{ these

artificial

the d i s t i n c t

systems

nodes

mark

of v a l u e

the

equiv-

classes).

the first analysis stage to d e t e r m i n e for e v e r y n o d e n of G a pre- a n d postpartition to d e s c r i b e the value equivalences between

2)Use

the p r o g r a m

terms

at t h e s e

program

points

of G.

3 ) C o n s t r u c t the value flow graph V F G = (VN,VE). N o d e s e q u i v a l e n c e c l a s s e s of the prea n d postpartitions Edges

e EVE

lence of -

class

G,

fulfilling

preone of

(V,W),

where

V

resp.

W

is a e q u i v a -

postpartition of a n o d e

resp.

the f o l l o w i n g

n

resp.

m

two p r o p e r t i e s :

n = m a n d w h e n e v e r an e l e m e n t v ¢ V has a special value x bef o r e the e x e c u t i o n of n, then every element w c W has the same value x a f t e r the e x e c u t i o n of n ( this r e l a t i o n is a l s o to be determined

-

are t h e p a i r s of the

n E VN are the m e n t i o n e d above.

n

b y the

first analysis stage ).

is a p r e d e c e s s o r

of

m

and

V ~ W.

4)Determine the systems of value equivalence classes which are c h a r a c t e r i z e d as the maximal connected subgraphs (N~E) of V F G w i t h : for all pre- a n d postpartitions V d e t e r m i n e d in s t e p 2: I ~ n { K I K is an e q u i v a l e n c e c l a s s of V } 1 ~ i. Each

system

of

this

kind

Boolean equation system

serves

for a

mentioned

special

initialization

s u c h a system of equivalence classes to i n i t i a l i z e equation system.

5)Choose

6)Solve

the

(already

intialized)

optimal computation points.

of

the

above.

Boolean equation system

the

Boolean

to o b t a i n

the

67

Remark V.1 This a p p r o a c h is b a s e d on the m e t h o d s t a t e d by M o r e l / R e n v o i s e [MR], which is c o n c e i v e d only to treat the o c c u r r e n c e s of a single given term. Our c o n c e p t of the value flow graph leads to an e x t e n s i o n of this m e t h o d w h i c h solves the location problem for a whole class of Herbrand equivalent terms ( i.e. it d e t e r m i n e s the best computation

points

w h i c h are v a l i d for every i n t e r p r e t a t i o n

After having determined

).

optimal computation points

the

in this way,

we

r e c e i v e the optimal computation forms as m i n i m a l r e p r e s e n t a t i v e s of the value e q u i v a l e n c e c l a s s e s b e i n g r e l a t e d to the c o m p u t a t i o n points.

VI. The Optimization Having G

f i n i s h e d the

analysis stage, we are able to o p t i m i z e our p r o g r a m value equivalence classes by the i n s e r t i o n of

for every s y s t e m of

an a u x i l i a r y v a r i a b l e h as follows: we i n i t i a l i z e h at every computation point by means of a computation form b e i n g valid at this point.

Firstly,

- Secondly,

we s u b s t i t u t e

every o c c u r r e n c e of a term b e i n g r e l a t e d

to

the i n s p e c t e d s y s t e m by h. These o p t i m i z a t i o n s i n d u c e d by the v a r i o u s s y s t e m s of value equivalence classes are l a r g e l y i n d e p e n d e n t . This allows us to determine the c o m p u t a t i o n forms and p o i n t s c o m p l e t e l y in parallel. O n l y the program transformations make some d i f f i c u l t i e s b e c a u s e the v a r i o u s systems of value e q u i v a l e n c e c l a s s e s overlap. For that reason, it is a d v a n t a g e o u s to do all the i n i t i l i z a t i o n s in parallel, b e f o r e g o i n g on to s u b s t i t u t e the p r o g r a m terms u s i n g the a u x i l i a r y v a r i a b l e s . these substitutions on the r e s u l t s of an extra

(It is best to base run of the first

analysis

even those o c c u r r i n g

stage

to e l i m i n a t e

all the r e d u n d a n c i e s ,

b e t w e e n the terms we just have inserted.) This procedure transforms a given program form G

w.r.t,

the Herbrand interpretation

G

~ FG

into a m i n i m a l

and the b r a n c h i n g

structure

of G: Every path computations

of G c o n t a i n s a m i n i m a l number of w.r.t, to the b r a n c h i n g s t r u c t u r e

Herbrand

equivalent

of G.

That means that the e x p e n d i t u r e of the c o m p u t a t i o n s of G reducible by c h a n g i n g the b r a n c h i n g s t r u c t u r e or by u t i l i z i n g p r o p e r t i e s of the u n d e r l y i n g i n t e r p r e t a t i o n . Our a p p r o a c h is not q u a l i f i e d program, but it s u p p o r t s the given interpretation.

is only special

to change the b r a n c h i n g s t r u c t u r e of a u t i l i z a t i o n of special p r o p e r t i e s of a

68 VII. Literature

[Ba] [CCl]

Barth, G. "Interprozedurale DatenfluSsysteme", Habilitationsschrift, U n i v e r s i t ~ t K a i s e r s l a u t e r n ~ 1981 C o u s o t , P. a n d C o u s o t , R. '~bstract interpretation: A

unified Lattice Model for static Analysis of Programs by Construction or Approximation of Fixpoints",

[cc2]

[cc3]

[co]

4th POPL, Los A n g e l e s , C a l i f o r n i a ~ 238 - 252, 1977 Cousot, P. a n d C o u s o t , R. '~utomatic Synthesis of Op-

timal Invariant Assertations: Mathematical Foundations", A C M S i g p l a n N o t i c e s 12, 1 - 12, 1977 C o u s o t , P. and C o u s o t , R. "Systematic Design of Program Analysis Frameworks", 6 t h POPL, San A n t o n i o , Texas, 269 -282, Cook, S.

1979 A.

Axiom System for [FKU]

Computing, Fong, A. C.,

of

[Gr]

7 : i, 70 - 90, 1978 Kam, J. B. a n d U l l m a n ,

Lattice Algebra

"Applications

J. D.

to Loop Optimization",

2nd POPL, P a l o Alto, C a l i f o r n i a , 1 - 9, 1975 Greibach, S.A. "Theory of Program Structures: Schemes, Semantics, Verification"~ L N C S 36, Springer-Verlag,

[He]

1975 Hecht,

[KU]

Elsevier, Kam, J.B.

M.

Analysis [Kill

"Soundness and Completeness of an Program Verification", SIAM Journal

1975 Kildall,

"Flow Analysis

S.

of

Computer

Programs",

N o r t h - H o l l a n d , 1977 and Ullman, J.D. "Monotone Frameworks", A c t a I n f o r m a t i c a , 7,

G.

A.

Data 309

"Global Expression Optimization during

Compilation", ty

of

T e c h n i c a l R e p o r t No. 7 2 - 0 6 - 0 2 , Washington, C o m p u t e r S c i e n c e Group,

[Ki2]

Washington, Kildall, G.

[La]

194 - 206, 1973 L a n g m a a c k , H. "On Procedures

[Mi]

A c t a I n f o r m a t i c a 2, 311 - 333, 1973 M i l n e r , R. "Fully Abstract Models of Typed

[MR]

T C S 4, N o r t h H o l l a n d , 1 - 22, Morel, E. and Renvoise, C.

[O1]

[RL]

[st]

UniversiSeattle,

1972 A. "A Unified Approach to Global Program Optimization", ist POPL, Boston, Massachusetts,

Suppression of

[Ni]

Flow - 317,

as Open Subroutines.

I "

~-Calculi",

1977

"Global Partial Redundancies",

Optimization by CACM,

22

: 2,

96 - 103, 1979 Nielson, F. "A Bibliography on Abstract Interpretations", A C M S i g p l a n N o t i c e s 21, 31 - 38, 1 9 8 6 O l d e r o g , E.-R. "Charakterisierung Hoarescher Systeme f~r ALGOL - ~hnliche Programmiersprachen", Dissertation, Christian-Albrechts-Universitat Kiel, 1981 Reif, J.H. a n d Lewis, R. "Symbolic Evaluation and the Global Value Graph" , 4 t h POPL, Los A n g e l e s , California, 238 - 252, 1977 S t e f f e n , B., doctoral dissertation, to a p p e a r , 1987

Transformation ordering F. BELLEGARDE and P. LESCANNE CRIN CENTRE DE RECHERCHE EN INFORMATIQUE DE NANCY BP 239 54506 Vandoeuvre les Nancy CEDEX FRANCE

ABSTRACT We define an ordering called transformation ordering which is useful for proving termination of rewriting systems. A transformation ordering is defined using two relations: a relation which transforms terms and a relation which ensures the well-foundedness of the ordering. A property between these two relations called cooperation is required. Cooperation is similar to confluence and thus may be localized. Therefore, if relations are rewrite relations, it is possible to decide the cooperation by looking at critical pairs. Transformation orderings prove termination of rewriting systems that cannot be proved by the classical methods.

Introduction We describe an ordering called

transformation ordering for proving termination of rewrit-

ing systems. Let ¢ be a transformation, i.e. a mapping of terms onto terms. In order to prove that a rewriting system R terminates one proves that when t l rewrites to t2 , ¢(tl) related to ¢(t2) by a well-founded relation. Other termination proof methods [7] are based on the same idea but the mapping is usually required to be a morphism which is not the case in this paper. Indeed since ¢ is obtained by a rewriting system T many other transformation systems T are

70

allowed usually. The well-founded relation used to prove termination is also a rewriting system S. A similar idea appeared recently in proofs of termination of rewriting modulo equational theories such as associative and commutative theories [1,2,8].

Simple proofs of termination

based on transformation techniques can also be found in [5]. We define transformation orderings in the first section. The transitivity and the wellfoundedness of these orderings come from properties mentioned in [1]. In the second section, we show t h a t the properties t h a t are necessary to have a well-founded ordering may be localized and checked by looking at critical pairs between S and T. We extend the ordering in the fourth section.

Notations We suppose the reader is familiar with the basic features and notations of term rewriting systems [9]. Let 17 be a set of operators symbols and V be a set of variables, T(F,V) is the set of terms with symbols in F and variables in V. The relations on terms _..~-l, or *-- denote the inverse of the relations --~ between two terms. ---~" and --~+ respectively denote respectively the transitive closure and the strict transitive closure of --*. We write

--*Rto--*n2 for the composition of the two relations --*R2 and --~Rt-

We write --*R1C--*R2 if {(x,y)llx--*Rly}C{(x,y)~lx--~RzY} as sets. --~ is

noetherian if and only if there is no infinite sequence of terms tl,t2,..., such t h a t

tl--*t2--~ .... The relation --* is

confluenl if for all terms t, t l and t2 such t h a t t - - * ' t l and

t-+*t2, there exists a term t ' such t h a t tl--**t' and t2--~*t'. In terms of inclusion we have

.--*o---+*C--~*o*---*. If -'*R is noetherian and confluent the normal-form of a t e r m t, written t.[R, exists and is unique. A rewriting system is a set R of rules t h a t are ordered pairs of terms, written 1--~r, such that V(r) C V(1) (V(t) is the set of variables occurring in t). The rewriting relation is written "~R or ~

if there is no ambiguity. We say t h a t the rewriting system R is confluent or noeth-

7] erian when the rewriting relation -'+R is confluent or noetherian. A noetherian ordering which is F-compatible, i.e. s - * t implies f(...s...)-+f(..°t...) for the symbols of F, is called a

reduction

order-

ing. 1. T R A N S F O R M A T I O N

ORDERING

Two relations -'*s and ---~r are considered. -'*s or --*T are not always rewriting relations. This means t h a t when we say --*r is confluent or "-*z is noetherian, we state properties on abstract relations.

Definition 1 [1] = > s , r is the relation

-*~o--*so(--*sU--~r)'O~-- ~, t

Two terms u and v are related by = > s , r if there exists u' such t h a t u --+r u' and v ' such t h a t v --+T v ' which are related by any sequence of --*s and --*T containing at least one --*s-

Definition 2 a:7"s,r is the relation

~---~o---~so(--*sU--~T)*.

As we have seen the confluence of " ~ r is the property ~---~,o--*T C_.--~T0~--T, We now define the

cooperation

of " ~ s with "-+T which is a kind of confluence.

Definition 3 "-+s c o o p e r a t e s w i t h -'~T if and only if ~ s , r

F i g u r e 1:--~ S c o o p e r a t e s w i t h --~T

C

=>s,r

(Fig. I).

72

Basically --*r is noetherian and confluent and -'*s cooperates with T then two terms u and v are related by = > s , r

if their transformations by T, namely U i r and vJ. r are related by

any sequence of -'~s and --~r containing at least one --*s-

Definition 4 >S,T is the relation = > s , r tO --~7~.

Lemma 1 If - * s O - - ~ r is noetherian, "-*r is confluent and "-*s cooperates with --*T then > s , r is a partial ordering on terms. Proof: •

- * s and "-*T are noetherian, thus they are irreflexive. Then --*~ is irreflexive and =>S,T

is irreflexive. Thus >S,T is irrefiexive.

• >S,T is transitive. Recall t h a t a relation --~ is transitive if and only if ~ o - + C_ ---~. We get the result by the confluence of " * r , by the hypothesis of cooperation and by definition of

>S,T" Lemma 2 If -~.gU-"~T is noetherian, --+r is confluent and " * s cooperates with " * T , then >S,T is a w e l l - f o u n d e d partial ordering. Proof: --*~ is noetherian since "-*sU--'*r is noetherian.

Therefore, if an infinite sequence t l > s , r

t2 >S,T ... exists, then an infinite sequence =~>s, T O = ~ s , T O = ~ s , T 0 .,, which is, by definition, an infinite sequence "'+TO"'*sO("'*S[.J""~T) O+'-TO ... exists. Thus we use the confluence of - ' * r and the cooperation of ---~s' with --~T and show (Fig. 3) t h a t an infinite sequence of rewriting with

--*To---*sO('-*sU"+T) 0---~r exists which is a contradiction with the well-foundedness of ---~ s U---~ T .

73

.Figure 3. --'~T 0 -"~S 0 -"~SUT 0 ~-'T 0 "'~T 0 "'+S 0 -"~SUT 0 + ' T 0 "--~T 0 -'+S 0 -'~SuT""

UT

UT"

Lemma 3 If --~r and -'*s are F-compatible and stable by substitutions then >S,T is F-compatible and stable by substitutions. Theorem I If "-'*s cooperates with -'*T, "~SU--*T is noetherian and --*r is confluent then > s , r is a well-founded ordering and moreover when -'~s and " ~ r are F-compatible and stable by substitution, > s , r is F-compatible and stable by substitution. Since rewriting relations on T(F,V) are F-compatible and stable by substitutions, we may state the following result: Corollary 1 Let S and T be two rewriting systems. Suppose S cooperates with T~ SUT is noetherian and T is confluent then >S.T is a reduction ordering stable by substitution. F a c t : With the condition of Theorem 1, a rewriting system that satisfies l>s, T r for all rules 1--~r is noetherian. Example 1 The following example comes from [4,5]. a: (x*y)*z --* x*(y*z)

b: f(~)*f(y)-~ f(~*y) c: f(x)*(f(y)*z) --+ f(x*y)*z. a, b and c are the rules of a rewriting system R. Proving that R is noetherian is not easy since the classical methods namely simplification orderings [7] such as recursive path ordering (RPO) or recursive decomposition ordering (RDO) methods fails. We choose T to be

74 rl: f(x)*y --* f(x*y) r2: x*f(y) --+ f(x*y) a: (x*y)*z --* x*(y*z) in order to push up f and put down *. We choose S to be f(f(x))--~ f(x). T U S is noetherian. S and T satisfy the condition of the forthcoming Theorem 3, we will see that this implies S and T cooperate. Thus we m a y use

>S,T

to prove the termination of R.

W e have l >S,T r for all rules of R: proof

• (x*y)*z ---~fix*(y*z) (by a E T) (x*y)*z >s,~" x*(y*z) (by definition) • f(x)*f(y)JcT=f(f(x*y)) and f(f(x*y))-*s f(x*y). Thus f(x)*f(y) =>S,T f(x*y) (by definition) and f(x)*f(y) >s,r f(x*y) (by definition) • f(x)*(f(y)*z)J.T=f(f(x*(y*z))), f(x*y)*z.[ T=f(x*(y*z)) and f(f(x*(y*z))) -'~s f(x*(y*z)). Thus f(x)*(f(y)*z) =>s,T f(x*y)*z (by definition) and f(x)*(f(y)*z) >S,T f(x*y)*z (by definition) 2. L O C A L I Z A T I O N OF T H E C O O P E R A T I O N Thus if we have two rewriting systems S and T such that S cooperates with T, T is confluent and SDT is noetherian and 1 >s,T r for all rules 1 -+ r of R, then R is noetherian. The confluence of T may be tested using the Knuth-Bendix procedure. The termination of S U T may be tested using other well-founded orderings [7]. Only the cooperation of S with T has to be checked with appropriate methods, for instance using the solution proposed in this section.

75

Like confluence, cooperation may be localized, and we are going to prove a Newman-like theorem for cooperation.

Definitioon 5 " * s l o c a l l y c o o p e r a t e s w i t h -'+T if and only if +-To---~s C =>s,T (Fig. 4). F i g u r e 4: S l o c a l l y c o o p e r a t e s w i t h T

,~

Theorem 2

~

L ~

"~

..........

~ kS"~ ¢~

If "-*sU"~T is noetherian and --*T is confluent then the local cooperation implies the cooperation of -'*s with --*TProof: We use a noetherian induction on "-*SU'*T. Let us have y ~:Ts,T z thus y ~ - ~ x -'*s s (--~sU--~T)* z, we have to show t h a t y =>S,T z* If in = 0, we have y = x --*s s (--+sU'-*T)" z thins y ---->S,T z. o If m > 0 , we have y l such t h a t y +_~-1 y l +-T x. F r o m the local cooperation, we get y l

=>S,T s. Thus we have x l and sl such t h a t y l --*T x l , s --+~ sl and xt --*sO(-.+sU--*T) sl. a

F r o m the confluence of -'+T, there is an y2 such t h a t y "--~T y2 and x l "-+T y2. We notice t h a t (-~5U-~T)" = -~;U-~;O-~sO(-~sU-~)',

and thus we find two subcases. a

(1)

Suppose s (-+sU--*r)* z means s--+Tz. With the confluence of --*T, there is a zl such t h a t sl--+TZl

and

Z--+TZl.

Thus

we

xl--*so(--*sU--+T) O--+TZl

get

X1--+so(--+sU-+T) z l (by "-*T -- (-'~sU-'*T)

and

thus

and transitivity of (--+sU--+T))- Now we

have y2mrs, TZl. So by noetherian induction y 2 = > s , TZl and therefore, by transitivity of --*T, we conclude t h a t y = > s , Tz (Fig. 5). (2)

If

("-+sU--*T)*

= "-*ro-'*sO("*sU-'*T)*,

t

thus

s--+ T z0 --*sO(-+sU-*T)'z

and

the

confluence of --*T provides a zi such t h a t st - * r zl and z0 - * r zl. Now by noetherian

76 induction, we get zl =>S,T z. Moreover by noetherian induction, we get y2 - - > s , r zl. i

Therefore by transitivity of -+s,r, we get y2 =:>S,T z and by transitivity of "*r, we conclude that y =>s,r z (Fig. 5). .Figure 5.

%z

. . . . .

:::-

:~,

b4.

If S and T are rewriting systems, by looking at critical pairs between S and T it is possible to decide that S locally cooperates with T.

Definition 6 A critical pair p4--ro--* s q between a rule of S and a rule of T is cooperative if and only if p = > s , r q.

Definition 7 A rewriting system is variable preserving if and only if all rules are variable preserving i.e., variables that occur on the lef~hand side 1 do not disappear on the right-hand side r and thus V(1)=V(r).

Definition 8 A rewriting system is left-linear if and only if all rules are left-linear i.e. , variables occur only once on the left-hand side.

Theorem 3 Suppose T is a left-linear rewriting system and a variable preserving rewiting system. A rewriting system S cooperates locally with T if and only if all the critical pairs between S and T

77

are cooperative. The proof looks like the proof of the similar theorem on confluent critical pairs.

3. E X T E N D E D

TRANSFORMATION

ORDERING

Results of Section 1 are useful in many cases like Example 1 and relations T and S can be easily found. In this section we w a n t to go again further and to show t h a t T can be extended by using any ordering t h a t contains S and T. This way, we expect to prove termination of more rewriting systems The problem with T usually arises when both sides of a rewrite rule are transformed by T into the same term. We now use a well-founded ordering > > such t h a t - * s -----> > and - ' * r _C > > to define a relation between terms, written >>

-'+Err(T)" This relation extends -"*r in the sense t h a t - * E r r ( r ) C

and -'*EXr(T} C =T, The last condition is necessary to ensure the confluence of

- ' * r is confluent and the cooperation of

-'~EXT(T) if

"~EXT(T) with -"~s if -"~r cooperates with " * s . There-

fore, we define "*ZXT{r) as = T N >:>.

Definition 9 Let "~T be a confluent and noetherian and let >:> be. a well-founded ordering on terms t h a t contains ---*sU---~r. S--*EXT(T)t if and only if s~ r = t~T and s > > t .

Proposition 1 Suppose -'~s cooperates with a confluent and noetherian relation " * r , > > founded ordering on terms t h a t contains --~sU--~r then

is a well-

-"~EXT(T) i8 confluent, ---~sU---~xr(r) is

noetherian, -'*z cooperates with --*Exr(r). Fact-. Therefore

~S,EXT(T) c a n be used to prove termination.

L~mma ~: Suppose t h a t

-"t'TI~--'~T2 and --',sIC_---+s2 then = > s , r l ----- = > s , r2 and > s , r l C >s, r2,

=>SI,T C -- = > s 2 , r and >Sl,T C -- >S2,T, =>sl,rlC_=>s2,r~ and >S1,TIC_ >S2,TS.

78

Lemma 5: --*r -- --*ZXr(T) F a c t : >S,T C_ >S,EXT(T) (direct consequence of Lemma 4 and 5). Proof of Proposition 1: • --+SU--~E)CT(T) is noetherian: obvious since "-~s _C :>> (by hypothesis) and -'~EXT(T) C_ > > by definition.

• -+EX:P(T)is confluent: If t--+EXT(T)tl and t --+EXT(T)t2, by definition, we have t l S r = t$:r = t2,tT = t'. Since "*T a

"+EXT(~) by Lemma 5, we get t l "*EXT(T) t' and t2 --+EXT(T) t' thus --*EXT(T) is locally confluent. Since --*EXT(T) C ~

by definition, --+EXT(T)is noetherian. Now -'*EX~'(T) is locally

confluent and noetherian. Therefore it is confluent. • "-'~s cooperates with --+EXT(T)" Since "-*E):T(:") is confluent and "~SU--+EXT(r) is noetherian, "*s cooperates with -'*/~XT(I") if it locally cooperates with --+EXT(T) (by Theorem 2). Suppose t h a t tl+--EXT(T)t--+St2. Since tl,[T=tJ, r (by definition of --~EXT(T)) and t~T-----~s, Tt2 (by cooperation of --~s with "+w), we get

tl--*To=)s, Tt2. Then t l = ~ s , Tt2 (by definition) and tl=:>s,ExT(~)t2 (by Lemma 4 and 5).

Example 2 [10] The termination of the rewriting system R rl: f(s(x)) --+ f(p(s(x))) ~2: p(s(o)) ~

o

r3: p(s(s(x))) --~ s(p(s(x))) is not provable by simplification orderings since f(s(x)) is embedded in f(s(p(x))). But with the transformation rule T': p(8(x)) - * x

79

we get a rule S': f(s(x)) --* f(x) T' is confluent, regular and left-linear. S~UT' is noetherian. S' cooperates with T' (there is no critical pair). For the rules r2 and r3, we get l ~

-- rSz~. So let us take a recursive path ord-

ering based on the precedence p > s to extend T'. Then p(s(0) >S.EXT(r') 0 and R terminates.

4. C o n c l u s i o n The transformation orderings allow us to prove termination of rewrite systems where methods based on simplification orderings fail. We are currently looking way to implement it in REVE and to a d a p t it to the proofs of other systems. Reference8 i. L. Bachmair and N. Dershowitz, "Commutation, Transformation, and Termination," in Proc. 8th Conf. on Automated Deduction , Lecture Notes in Computer Science, vol. 230, Springer Verlag, Oxford (England), 1986. 2. L. Bachmair and D. Plaisted, "Associative P a t h Orderings," in Proc. i8t Conference on .Rewriting Techniques and Applications, Lecture Notes in Computer Science, vol. 202, pp. 241254, Springer Verlag, Dijon (France), 1985.

3. J. Backus, "Can Programming Be Liberated From the Von Neumann Style? A Functional Style And Its Algebra of Programs," Comm. o f A C M , vol. 21, no. 8~ pp. 613-641, 1978. 4. F. Bellegarde, "Utilisation des Syst~mes de R~gcriture d'Expressions Fonctionnelles comme outils de Transformation de Programmes Itgratifs," Th~se de doctorat d ~ t a t , Universit~ de Nancy I, Dept. Math~matiques Appliqu~es, 1985. 5. F. Bellegarde, "Rewriting Systems on FP Expressions to reduce the number of Sequences Yielded." Science of Computer Programming, vol. 6. pp. 11-34, North-Holland, 1986.

8O 6. F. Bellegarde and P. Lescanne, "Termination Proofs Based On Transformation Techniques," Submitted To Information and Control, 1986. 7. N. Dershowitz, "Termination," in Proc. lrst Conf. Rewriting Techniques and Applications , Lecture Notes in Computer Science, Vol. 202, pp. 180-224, Springer Verlag, Dijon (France), May 1985. 7. I. Gnaedig and P. Leseanne, "Proving Termination of Associative Commutative Rewriting Systems by Rewriting,"

Proceeding8 8th International Conference on Automated Deduction ,

Oxford (England), 27-31 July 1986. 9. G. Huet and D. Oppen, "Equations and Rewrite Rules: A Survey," in Formal Languages: Perspectives And Open Problems, ed. Book R., Academic Press, 1980.

10. S. Kamin and J.J. Levy, "Attempts for Generalizing the Recursive Path Ordering," Inria, Rocquencourt, 1982, University of Illinois Report.

ON PARAMETRIC ALGEBRAIC SPECIFICATIONS WITH CLEAN ERROR HANDLING

martin gogolla I n f o r m a t i k B, TU Braunschweig P o s t f a c h 3329,

D-3300 Braunschweig

ABSTRACT Usual a l g e b r a i c s p e c i f i c a t i o n partially

ordered s o r t s .

s u p e r s o r t s as w e l l tures

(e.g.

t e c h n i q u e s can be e x t e n d e d t o t r e a t

This a l l o w s t h e i n t r o d u c t i o n of

as o v e r l o a d e d o p e r a t o r s ,

existence

of

initial

a l g e b r a s and

a l g e b r a i c and o p e r a t i o n a l s e m a n t i c s ) o f tion

method

handling is

are preserved. studied.

On t h i s

proach tric

1.

equivalence

of

the equational specifica-

basis error

and

exception

a l g e b r a s which a r e o k / e r r o r -

and o k / e r r o r - c o m p l e t e ) a r e

considered.

a l l o w s t o p r o v e an e x t e n s i o n lemma f o r

specifications

fea-

For each s o r t an ok and an e r r o r s u b s o r t i s

i n t r o d u c e d and c l e a n a l g e b r a s ( i . e . consistent

sub- and

while pleasant

T h i s new

ap-

p e r s i s t e n t parame-

which p e r m i t e r r o r h a n d l i n g .

INTRODUCTION

During

the

promising

last

method f o r

programming approaches

tics

and p h i l o s o p h i e s f o r

final

[ 8 8 M 76,

opment

of

[EFH 8 3 ] ,

Partially treated etc.].

the specification

Among them a r e i n i t i a l [Wa 79, WPPDB 83, Ga 83] ST 8 5 ] .

specification

proved t o

be

There a r e

many such

[ADJ 76, ADJ 81, EKMP 82, and o b s e r v a t i o n a l seman-

Research i n t h e f i e l d languages l i k e

a

a b s t r a c t data types in

the a l g e b r a i c semantics of

led to the

OBJ [FGJM 8 5 ] ,

develACT

ONE

ASL [SW 83] and many o t h e r s .

ordered

sorts first

introduced in

i n a s e r i e s o f p a p e r s EGo 83, They a r e t h e b a s i s f o r

handling,

of

languages and s o f t w a r e e n g i n e e r i n g .

specifications. K1 84]~

years a l g e b r a i c s p e c i f i c a t i o n s

a t o p i c which i s

Po 84,

[Go 78] 8M

84,

have G~M

been 85,

our approach t o e r r o r and e x c e p t i o n

studied extensively in the literature

82 [ADJ 76, etc.].

Go 77, The

clean

Go 78,

BGP 82,

GDLE 82, Bi 84~ Po 84, BBC 8b,

fundamental new n o t i o n s i n t r o d u c e d h e r e a r e t h a t

a l g e b r a s and c l e a n s p e c i f i c a t i o n s ,

ok/error-consistency allows

and

where c l e a n r e f e r s

ok/error-completeness.

t h e use o f pure e r r o r v a r i a b l e s ,

before.

In

the

specifications

literature

o n l y [Po

This

approach possible

84]

considers

i m p o r t a n t because s p e c i a l problems a r i s e h e r e .

to

the

exception

extension

lemma

By t h i s

[Eh 81] and use i t

approach, guaranteeing the w e l l

parametric

which i s q u i t e

[Po 84] works w i t h

whereas we c a r r y o v e r p e r s i s t e n c y

h a n d l i n g case.

of

to

which was n o t

in connection with e r r o r handling,

non p e r s i s t e n t s p e c i f i c a t i o n s ,

of

we can a p p l y

for

definedness of

our

the

clean

R-

algebra

the a p p l i c a t i o n of

parametric specifications.

The paper i s o r g a n i z e d as f o l l o w s . i d e a s by means o f tal

definitions

fications.

some examples.

Chapter 2 i n t r o d u c e s t h e b a s i c Chapter 3 r e v i e w s t h e fundamen-

and f a c t s c o n c e r n i n g s u b s o r t s i n a l g e b r a i c s p e c i -

Chapter

4 t r e a t s c l e a n a l g e b r a s and c l e a n s p e c i f i c a -

tions.

Chapter

5

d i s c u s s e s p a r a m e t r i z a t i o n and

lemma.

Chapter

6

g i v e s some s h o r t c o n c l u d i n g remarks.

space l i m i t a t i o n s

2.

all

our

extension Due

to

p r o o f s are omitted.

THE BASIC IDEA

Our

main new c o n c e p t f o r

a clean algebra. for

the

ok

e r r o r and e x c e p t i o n h a n d l i n g i s

T h i s means t h a t our a l g e b r a s have two

and e r r o r p a r t o f each s o r t and

ok/error-consistent

(there

the

error).

The approach i s e x p l a i n e d b e s t by an example. Here i s our of

t h e n a t u r a l numbers.

s o r t s Nat opns

0 : - > Nat-Ok Succ: Error

Nat-Ok - > Nat-Ok : ->

Nat-Error

ok

and

and

spe~ N a t u r a l N u m b e r s W i t h E r r o r H a n d l i n g =

either

ok

are

error)

specification

( e v e r y element i s

subsorts

carriers

i s no element which i s b o t h

ok/error-complete

t h a t of

or

83

Succ,

Pred

:

Nat - > Nat

Plus,

Times :

Nat N a t - > Nat

vats

n : N a t n+,m+:Nat-Ok n - : N a t - E r r o r

e~

Succ ( n - ) Pred(O)

= n= Error

Pred (Succ ( n + ) ) Pred
= n+

= n-

Plus(O,n+)

= n+

Plus(Succ(n+),m+) = Succ(Plus(n+,m+)) Plus(n-,n)

= Plus(n,n-)

= n-

Times(O,n+) = 0 Times(Succ(n+),m+) = Plus(Times(n+,m+),m+) Times(n-,n) = Times(n,n-) = n-

The

semantics of

riers

for

Nat-Ok t h e n a t u r a l

tinguished

error

specification implicitly Succ

constant.

numbers and f o r

be m e n t i o n e d .

declared twice Succ y i e l d s

in

the signature.

second o c c u r r e n c e i n d i c a t e s

all

Nat v a l u e s , (3)

the three

but

sorts

into

in

kinds of

recovery. (line

functions

(line

4-5 of

Succ(n-)

=

assures error

The

of

(5)

I-3

of

opns bod~ s o r t s o pns

variables

is

-> Entry-Error

Tree :

has

(2)

function

The

The f i r s t

occurrence such

one.

Entry-Ok ->

Tree-Ok

to the

corresponding to

(4)

important to

It

is

= O, o t h e r w i s e t h i s

(6)

and

axiom

for

derived

variable

the function

essential

use

can be c l a s s i -

The e r r o r

propagation for

Entry

Leaf

the

variables

as t h e n e x t e x a m p l e shows.

NoEntry :

in Nat

the opns-part)

~e~ec P a r a m e t r i c B i n a r y T r e e s = parm s o r t s

dis-

The s o r t

The f u n c t i o n s

t h e o~pD_s-part).

pure error

specifications,

one

Succ may a l s o be a p p l i e d

t h e axiom Times(O,n+)

constructors

n-

that

and s u b s o r t s a r e u s e d .

c a u s e an e r r o r

use

(I)

car-

makes no s t a t e m e n t a b o u t t h e n a t u r e o f

Three d i f f e r e n t

an ok v a r i a b l e

fied

Nat-Error

an ok v a l u e when a p p l i e d t o

The

would

an a l g e b r a h a v i n g as

T h e r e a r e some p e c u l i a r i t i e s

above w o r t h t o

that

result.

is

t h e s u b s o r t s N a t - O k and N a t - E r r o r .

is

assures

the specification

in

Suet.

parametric

84 Node :

Tree-Ok Tree-Ok - > Tree-Ok

NoTree : - > T r e e - E r r o r Leaf : E n t r y -> Tree Node : T r e e T r e e - > T r e e GetEntry :

Tree -> Entry

GetRight, GetLeft :

Tree -> Tree

vare

e+:Entry-Ok e-:Entry-Error

e_~ns

Leaf(e-)

t:Tree

tl+,t2+:Tree-Ok

= NoTree

N o d e ( N o T r e e , t > = N o d e ( t , N o T r e e ) = NoTree G e t E n t r y ( L e a f ( e + ) ) = e+ G e t E n t r y ( N o d e ( t l + , t 2 + > ) = NoEntry G e t E n t r y ( N o T r e e ) = NoEntry GetRight(Leaf(e+)) = GetLeft(Leaf(e+)) GetRight(Node(tl+,t2+))

= NoTree

= GetLeft(Node(t2+,tl+))

= t2+

G e t R i g h t ( N o T r e e ) = G e t L e f t ( N o T r e e ) = NoTree end spec The

specification

leaves sists

when it in

function t h e use o f If

is

builds

binary trees with given entries

applied.

the resulting GetEntry is the error

The g i v e n p a r a m e t e r s o r t

specification,

well

defined.

variable

e-

struction

the

T h i s can o n l y be a c h i e v e d by

in

would n o t be p e r s i s t e n t

per-

because

t h e axiom L e a f ( e - )

one would s p e c i f y o n l y L e a f ( N o E n t r y ) = N o T r e e ,

more e x c e p t i o n s t h a n t h e s i n g l e of

especially

the

at

Entry

for

error

=

NoTree.

then the con-

parameter algebras NoEntry.

Again,

having

lines

i-3

t h e 9 ~ D ~ - p a r t can be c o n s i d e r e d as t h e s i g n a t u r e s p e c i f i c a t i o n

for

t h e c o n s t r u c t o r s and l i n e s

ideas

4-7 f o r

the derived functions.

s k e t c h e d above a r e now made p r e c i s e i n

the (ollowing

The

chap-

ters.

3.

REVIEW OF ALGEBRAIC SPECIFICATIONS WITH SUBSORTS

The facts

following

remarks

r e v i e w the fundamental

and o u r n o t a t i o n c o n c e r n i n g a l g e b r a i c

subsorts.

Readers

etc.]

find

will

~amilar with

[Go 78,

many common d e t a i l s .

definitions

and

speci÷ications

Go 83,

Po 84,

and

SM 84,

85 3.1De÷inition A

signature

partial

(S,~,E)

c o n s i s t s of

(1) a s e t S of

sorts,

(2)

a

o r d e r ~ on S and (3) a f a m i l y Z=w~S* ssS of Bets of

function ~:v->r.

(Signature~ Algebra~ Morphism)

symbols Name(E)

such

that

(4) ~:w->s,

v~w

and

r~s

implies

= {~w'sl~eEw~s} denotes t h e f u n c t i o n names and

Symb(Z) = {~Id~Zw, s} the f u n c t i o n symbols of Z. A E - a l g e b r a (A,F) c o n s i s t s of that

(1) a f a m i l y A=s~S of s e t s such

(2) s~r i m p l i e s Asia r and (3) a f a m i l y F-< _ ~A w , s>~W'SsName(Z)

of f u n c t i o n s w i t h ~ ' S : A w - > As such that~

(4) i f

~:w->s,

~:v->r

and a~AwnAv, then ~ ' s ( a ) --~A v'r(a) A

Z-morphism

s~S

of

f:A->B

mappings such t h a t

a~Aw and (2) a~AsnAt

3.2 D e f i n i t i o n The

E-term

seS

of

s1...sn->s

between

E - a l g e b r a s A and B (i)

algebra

and

(I)

least

family

the for

d

:

functions ~:->s

and

f o r ~ : s l . . . s n - > s and t i E T s i .

of the term a l g e b r a )

E-term a l g e b r a TZ i s i n i t i a l

i n t h e c a t e g o r y ALGZ of a l l

E-

Z-morphisms between them.

(Congruence, Q u o t i e n t ) s on a E - a l g e b r a A i s a f a m i l y <~s>seS of

t i o n s ~s on As such t h a t implies

for

d : - > s i m p l i e s ~ T s and (2)

are determined by (3) ~ , s : = ~

(Initiality

Z-congruence

the

t i ~ T s i i m p l i e s d ( t l . . . t n ) ~ T s and

algebras with a l l

A

fs(~'S(a))=~'S(fw(a))

(Tz,F Z) has as c a r r i e r s

sets s a t i s f y i n g

3.4 D e f i n i t i o n

family

implies fs(a)=ft(a).

(4) ~ ? 1 " ' ' s n ' s ( t l . . . t n ) : = ~ ( t l . o . t n )

The

a

(Term a l g e b r a )

K~'S>dw,SEName(Z)

3.3 Fact

is

rela-

(1) ~s = [~EQ n AsXAs ] and (2) ai ~EQ bi

~ l"''sn's(al"''an)

~EQ ~ i ' ' ' u n ' r ( b l " ' ' b n )

for alibi

E

AsinAui ,

d : s l . . . s n - > s and d : u 1 . . . u n - > r , where ~EQ i s the e q u i v a u lence on sasAs generated by ~.

The q u o t i e nt A/~ of a E - a l g e b r a A by a E-congruence ~ has (1) the c a r r i e r s A/E s = { [ a ] l a e A s } ~ the

where [ a ] = { b ~ U-A la~-~b}

f u n c t i o n s <~}~>~w,S~Name(Z)

[~l'''sn's(bl...bn)],

and

(2)

sl"''sn,s([al]...Zan]):= w i t h ~A/~

where [ a i ] ~ A / ~ s i ~ [ a i ] = [ b i ]

and b i ~ A s i .

86 3.5 D e f i n i t i o n

(Equation~ S a t i s f a c t i o n ,

A

L=R i s a p a i r o f

~zeguation

signature Z Z-algebra cide.

Z(V)-terms,

having a d d i t i o n a l l y

A satisfies

A specification

L=R~ (Z,E)

Specification)

if

where

Z(V)

is

the

t h e v a r i a b l e s V as c o n s t a n t s . all

e v a l u a t i o n s o f L and R

A

coin-

c o n s i s t s o f a s i g n a t u r e Z and a s e t E

of E - e q u a t i o n s .

3 . 6 Fact A

(Induced Congruence)

s e t of E - e q u a t i o n s E i n d u c e s u n i q u e l y a s e t o f c o n s t a n t

tions

E(Tz) ,

which

a g a i n i n d u c e s a l e a s t congruence ~E

equaon

TZ

c o n t a i n i n g E(Tz)°

3 . 7 Fact

(Initiality

of

t h e q u o t i e n t term a l g e b r a )

The q u o t i e n t term a l g e b r a TZ/E E i s of a l l

(Z,E)-algebras satisfying

3 . 8 Example ( B i t s t r i n g s The

h a v i n g as s u b s o r t s

and s i n g l e b i t s

i n t h e c a t e g o r y ALGz, E

t h e e q u a t i o n s E.

handling)

error

following lines define bitstrings

String*)

~

avoiding

initial

of

arbitrary

non empty b i t s t r i n g s

length

(sort

( s o r t S t r i n g +)

(sort Bit).

B i t S t r i n g s A v o i d i n g E r r o r H a n d l i n g= sorts Bit

< String+ < String*

opns

: -> B i t

0,1

: -> S t r i n g

.

.l.

: S t r i n g * S t r i n g * -> S t r i n g *

.I.

: Bit

.l.

: String* Bit

First,

S t r i n g * -> S t r i n g + -> S t r i n g +

L a s t : S t r i n g + -> B i t

vats

b:Bit

e~ns

s l l ( s 2 1 s 3 ) = ( s l l s 2 ) Is3

e,sl~s2,s3:String*

sl~ = his = s First(bls)

= Last(slb)

= b

end spec Please

note

t h a t the s p e c i f i c a t i o n

s o r t s and v a t s has n o t r e a l l y determines

p a r t between t h e

t o be a s i g n a t u r e ,

but i t

a s i g n a t u r e i n t h e sense o f our d e f i n i t i o n .

more t h e f u n c t i o n s F i r s t

key

and L a s t r e t u r n i n g t h e f i r s t

words

uniquely Further-

respective-

87 ly

last

cally

bit

are well

defined,

because a l l

a l l o w e d by t h e s i g n a t u r e e i t h e r

applications syntacti-

yield

0 or

1.

3 . 9 Remark ( D e c l a r a t i o n s ) One can a l s o use so c a l l e d d e c l a r a t i o n s i n s p e c i f i c a t i o n s Go

83].

A d e c l a r a t i o n c o n s i s t s of

that

the

term w i l l

sort

(e.g.

a term and a

sort,

a l w a y s e v a l u a t e t o an element o f

i * i : N o n N e g a t i v e ~ where i

is

a v a r i a b l e of

[Go 787 assuring

the sort

given int).

4. CLEAN SPECIFICATIONS

4.1 D e f i n i t i o n A

signature

(Clean, o k / e r r o r - c o n s i s t e n t , (S,~,Z)

S-OKuS-ERROR,

is called

ok/error-complete)

(ok/error-)clean,

S-OK={s-OklsES-MAIN},

if

S=S-MAINu

S-ERROR={s-Error~sES-MAIN}

and ~ = { s ~ s l s s S } u { s - O k ~ s , s - E r r o r ~ s l s s S - M A I N } . A Z - a l g e b r a A w i t h Z a

clean s i g n a t u r e i s c a l l e d

As_Error and (3) A

= 0,

A is

specification is

ok~error-consistent,

(2~ o k / e r r o r - c o m p l e t e ,

clean, if

algebra

(I)

A

eeE(T~) i m p l i e s e i t h e r s u i t a b l e s o r t s.

As_Ok n

As_ok u As_Error

=

As,

o k / e r r o r - c o n s i s t e n t and o k / e r r o r - c o m p l e t e .

(Z,E)

clean.

if

if

is

called clean,

if

the

s e t E of e q u a t i o n s i s

initial

called

(E,E)-

clean,

eeTs_okXTs_Ok o r eeTs_ErrorXTs_Error

ALGz,E,CLEA N d e n o t e s t h e c a t e g o r y o f

(Z,E)-algebras with all

all

if

for

a

clean

morphisms between them.

4 . 2 C h a r a c t e r i s a t i o n ( S p e c i f i c a t i o n s w i t h c l e a n term a l g e b r a s ) Given the

a specification specification

(Z,E)

(~,E)

is

w i t h a c l e a n term a l g e b r a clean,

if

and o n l y i f

TE,

then

the set E

of

equations is clean.

4 . 3 C h a r a c t e r i s a t i o n (Clean s p e c i f i c a t i o n s ) A specification (I)

T~, E i s

(2)

there is

(E,E)

is clean, if

and o n l y i f

o k / e r r o r - c o n s i s t e n t and a subspecification

(a) ZG c o n t a i n i n g a l l ok o r e r r o r

result

(b) EG c o n t a i n i n g a l l

(ZG,EG)~(Z~E)

s o r t s and s u b s o r t s and s o r t s and c l e a n e q u a t i o n s o f E and

with all

operations with

88 (c)

there is

a unique s u r j e c t i v e

morphism f:~G,EG->U~_>EG(T%,E ) .

4 . 4 Remark ( S u r j e c t i v e morphiem i n If

t h e morphism f

of

(~B,EG)

then t h e r e a r e terms t l

that

TZG,EG ~ [ t l ] ~ [ t 2 ]

maximal s e t o f additional ok

is also injective,

above) then

(Z,E)

i s an e n r i c h m e n t

: T~G,ES and U~_>EB(T~, E) a r e i s o m o r p h i c . I f

injective, such

(c)

:

identification

and TZ, E ~ [ t l ] = [ t 2 ] .

in

t3eTs-(Ts_okUTs_Error), can

also

tl=t3

be done c h o o s i n g

involving

o n l y ok o r e r r o r t e r m s . this

establish

not

error

But EG i s

T~, E i s done v i a a term t 3

rule

out

is

a

e q u a t i o n s a p p l i c a b l e t o ok and e r r o r t e r m s , so t h e

identification

nor e r r o r

it

and t 2 b o t h ok o r b o t h

It

is

and

t3=t2.

different

a l s o much

neither

equations

smoother

case from a m e t h o d o l o g i c a l p o i n t o f view

a clear distinction

between ok and e r r o r

This

and

to to

constructors

and d e r i v e d f u n c t i o n s .

4 . 5 Concept ( P r a g m a t i c s f o r A

clean

specification

clean s p e c i f i c a t i o n s )

(Z,E)

should

(ZG,EG) w i t h T~B and EG c l e a n such t h a t

have

a

subspecification

(Z,E)

is

an e n r i c h m e n t o f

(ZG,EG).

4 . 6 Example ( B i t s t r i n g s This

with error handling)

clean s p e c i f i c a t i o n

defines bitstrings

of

arbitrary

E r r o r s a r e i n t r o d u c e d by t h e f u n c t i o n s Head and T a i l t o t h e empty s t r i n g . BitStrings = sorts Bit, cons

0,1

String : -> B i t - O k

NoHead : -> B i t - E r r o r : -> S t r i n g - O k • t.

: S t r i n g - O k B i t - O k -> S t r i n g - O k

NoTail : -> S t r i n g - E r r o r runes . I .

: String Bit

-> S t r i n g

Head : S t r i n g - > B i t Tail

: S t r i n g -> S t r i n g

vats

s:String s+:String-Ok b:Bit

eqns

N o T a i l l b = sINoHead = N o T a i l

length.

when a p p l i e d

b+,b1+,b2+:Bit-Ok

89 H e a d ( s + I b l + I b 2 + ) = He~d(s+Ib1+) Head(~ib+) = b+ Head(~) = Head(NoTail) = NoHead Tail(s+Ibl+lb2+) = Tail(s+Ibl+)ib2+ Tail(~Ib+) = T a i l ( ~ ) = T a i l ( N o T a i l ) = NoTail end spec The

p a r t s f o r t h e ok and e r r o r = o n s t r u c t o r s and f o r t h e

functions general

are

indicated

there will

by t h e keywords cons

be an e q u a t i o n p a r t f o r t h e

and

derived

funcs.

In

constructors

as

w e l l . For t h e s u b s o r t s t h e f o l l o w i n g e q u a t i o n s h o l d : T~,E,Bit_Ok ~{0,1},

T E , E , B i t _ E r r o r ~ { N o H e a d } v TE,E,String_Ok ~ ( { 0 ~ i } ) *

and

T E , E , S t r i n g _ E r r o r ~ { N o T a i l } . On t h i s b a s i s t h e f u n c t i o n s Head and T a i l a r e d e f i n e d such t h a t t h e s u b s o r t s a r e r e s p e c t e d .

5. CLEAN PARAMETRIC SPECIFICATIONS

5.1 D e f i n i t i o n A

( S i g n a t u r e morphism, s p e c i f i c a t i o n morphism)

s i g n a t u r e morphism f : Z 1 - > Z 2 between s i g n a t u r e s ( S I , ~ $ I , [ 1 ) and

($2,~$2,E2) Symb(E2)

consists

implies

forgetful

mappings

f:SI->S2

such t h a t s ~ S l r i m p l i e s f ( s ) ~ s 2 f ( r )

f ( ~ ) e £ 2 f ( w ) , f ( s ). s<Slr

of

A

s i g n a t u r e morphism f

f(s)<s2f(r).

functor

A

Uf:ALG~2->ALGEI.

and d~Elw~s i m p l i e s

is called

strict,

if

induces

A s i g n a t u r e morphi~m

e q u a t i o n o f E l , when t r a n s l a t e d by f , morphism

f:Symb(~l)->

s i g n a t u r e morphism f

c a l l e d s p e c i f i c a t i o n morphism from (Z1,EI) t o

specification

and

(E2,E2),

if

f

a is

every

b e l o n g s t o E2 : f ( E I ) ~ E 2 . A

i s c a l l e d simple,

if

$1~$2,

Symb(El)~

Symb(E2) and f : S I - > S 2 and f:Symb(El)->Symb(E2) a r e i n c l u s i o n s .

5.2 D e f i n i t i o n A

(Parametric s p e c i f i c a t i o n ~ p e r s i s t e n t )

p a r a m e t r i c s p e c i f i c a t i o n c o n e i s t s of a p a r a m e t e r s p e c i f i c a t i o n

{ZP,EP) EP~EB.

and The

a body s p e c i f i c a t i o n

(ZB~EB) such

c o n s t r u c t i o n F:ALGzp,Ep->ALGEB~EB [ADJ 78, specification rally"

that

EP~ZB and

semantics of a p a r a m e t r i c s p e c i f i c a t i o n i s t h e

is called persistent~

[WE 85] i s o m o r p h i c f o r

all

if

Po 8 4 ] .

free

A parametric

A and U(F(A)) a r e " n a t u -

(ZP~EP)-algebras A,

where U i s

90 the f o r g e t f u l

f u n c t o r U:ALGEB->ALGzp induced by t h e s i g n a t u r e s EP

and EB.

5.3 D e f i n i t i o n The

( A p p l i c a t i o n of a p a r a m e t r i c s p e c i f i c a t i o n )

r e s u l t of a p p l y i n g a p a r a m e t r i c s p e c i f i c a t i o n w i t h parameter

(ZP,EP) means

and body (~B,EB) of

a

t o an a c t u a l s p e c i f i c a t i o n

s p e c i f i c a t i o n morphism

specification

(~R,ER),

IF ssSP THEN h(s)

(ZA,EA)

h:(~P,EP)->(~A~EA)

is

by the

where ER=EA+hR(EB), ER=EA+hR(EB), hR(s) =

ELSE s FI

and hR(d) = IF ~sSymb(EP) THEN h(~)

ELSE d F I . (ZP~EP) . . . . ~ - - - >

(EB~EB)

I I h

I I

I

I hR

I

I

(ZA,EA) The

sR

> (ER~ER)

r e s u l t s p e c i f i c a t i o n i s t h e pushout of t h e a c t u a l s p e c i f i c a -

tion the

(ZA~EA) and t h e body s p e c i f i c a t i o n

(ZB~EB) w i t h r e s p e c t

parameter (EP,EP) and t h e s p e c i f i c a t i o n morphisms h

where

s

is

t h e s i m p l e s p e c i f i c a t i o n morphiem

induced

and by

to s, the

i n c l u s i o n of t h e parameter i n t h e body.

5.4 D e f i n i t i o n

(Clean p a r a m e t r i c s p e c i f i c a t i o n )

A

specification

parametric

(ZB,EB) the free

is called clean,

if

with

parameter

(EP~EP) and

f r e e c o n s t r u c t i o n F i s p e r s i s t e n t on ALBEp~EP~CLEAN and construction

i m p l i e s F(A)

body

t h e s i g n a t u r e s ZP and ZB a r e c l e a n ,

F p r e s e r v e s cleanness :

A

~

the

ALSEp,EP,CLEAN

E ALGEB,EB,CLEAN.

5 . 5 E x t e n s i o n Lemma ( f o r c l e a n p a r a m e t r i c s p e c i f i c a t i o n s ) Let

t h e r e be g i v e n a c l e a n p a r a m e t r i c s p e c i f i c a t i o n w i t h parame-

ter

(EP~EP) and body (~B,EB)~

(EA,EA)~

a

strict

actual

clean

specification

s p e c i f i c a t i o n morphism h: (EP~EP)->(EA~EA) and

the r e s u l t s p e c i f i c a t i o n (I)

an

(ER,ER) as d e f i n e d above.

The r e s u l t i n g p a r a m e t r i c s p e c i f i c a t i o n w i t h p a r a m e t e r (EA,EA) and body (ZR,ER) i s c l e a n : FR i s p e r s i s t e n t on ALGEA,EA~CLEAN and i t

preserves cleanness.

91 (2) F o Uh = UhR o FR. . . . . E___> ALG~p,EP,CLEAN ALGZB,EB,CLEAN

t

I

l

Uh ;

i UhR

l i

i I

ALGEA,EA,CLEAN . . . . ~ - - >

ALG~R,ER,CLEAN

5 . 6 Remark ( c o n c e r n i n g t h e e x t e n s i o n lemma) The p r o o f o f [Eh

81].

our e x t e n s i o n lemma a p p l i e s t h e R - e x t e n s i o n lemma o f

The

restriction

of ALBzp,EP t o c l e a n a l g e b r a s can

e x p r e s s e d as p r e d i c a t e f o r m u l a r e q u i r e m e n t s . clean

algebras

method,

because

neither

ok

morphism

the

underlying

The s t r i c t n e s s

o f t h e parameter

i m p l i e s t h a t ok o r e r r o r o p e r a t i o n s will

also

be ok o r e r r o r o p e r a t i o n s

to

specification

one does n o t want t o c a r e a b o u t e l e m e n t s

nor e r r o r .

h

parameter

is essential for

This r e s t r i c t i o n

be

being

passing

of

the

formal

in

the

actual

parameter.

5 . 7 Concept

(Pragmatics f o r

Analogously

to

clean parametric s p e c i f i c a t i o n s )

t h e case w i t h o u t p a r a m e t e r s a c l e a r

distinction

between ok and e r r o r c o n s t r u c t o r s and d e r i v e d f u n c t i o n s s h o u l d be established.

Therefore

parameter (ZP,EP) (ZP,EP)

a

clean parametric

~ (ZB,EG) ~ (ZB,EB)

all

w i t h T~G(A) and EG c l e a n such t h a t G

A~ALGEp,EP,CLEAN,

where G i s

duced by t h e p a r a m e t r i c s p e c i f i c a t i o n body

is

an e n r i c h m e n t o f B(A)

the f r e e c o n s t r u c t i o n w i t h p a r a m e t e r (EP,EP)

inand

(ZG,EG).

5 . 8 Example ( P a r a m e t r i c s t r i n g s

with error handling)

This clean parametric s p e c i f i c a t i o n trary

with

and body (ZB~EB) s h o u l d have a s u b s p e c i f i c a t i o n

i s p e r s i s t e n t on ALGzp,EP,CLEAN and F(A) for

specification

parameter

s o r t Char.

f u n c t i o n s Head and T a i l

o v e r an a r b i -

Again e r r o r s a r e i n t r o d u c e d by

when a p p l i e d t o t h e empty s t r i n g .

s pec P a r a m e t r i c S t r i n g s = parm s o r t s Char o~ons

defines strings

NoHead : -> C h a r - E r r o r

the

92 bod~ s o r t s S t r i n g cons

A : -> S t r i n g - O k .I.

: S t r i n g - O k Char-Ok -> S t r i n g - O k

NoTail : -> S t r i n g - E r r o r funcs

.I.

: S t r i n g Char - > S t r i n g

Head : S t r i n g -> Char Tail vats

: S t r i n g -> S t r i n g

s:String

s+:String-Ok

c:Char c + ~ c l + , c 2 + : C h a r - O k t - : C h a r - E r r o r eqns

NoTaillc = slc-

= NoTail

Head(s+Icl+Ic2+) = Head(s+Icl+) Head(Ale+) = c+ Head(A) = H e a d ( N o T a i l ) = NoHead Tail(s+Icl+Ic2+)

= Tail(s+Icl+)Ic2+

Tail(AIc+) = A Tail(A)

= T a i l ( N o T a i l ) = NoTail

e n d sp,ec The

parts

keywords for

the

it

is

for

the

parameter

p a r m and b o d ~ , parameter

and t h e

essential for

Char-Error algebra

In

and t h e

general

body are

there

constructors

will

indicated

be an e q u a t i o n

as w e l l .

= NoTail.

algebra

F(A)Char_Ok

F(A)

will

have

the

the part that sort

parameter

given~

following

note

c - of

I÷ a c l e a n

A w i t h s e t s AChar_Ok and AChar_Error i s

resulting

Please

p e r s i s t e n c y t o use t h e v a r i a b l e

in the equation s l c -

by

then t h e

carriers

:

~

AChar_Ok, F(A)Char-Error ~ AChar_Error , )* F ( A ) s t r i n g _ Ok ~ (AChar_Ok and F ( A ) s t r i n g _ E r r o r ~ { N o T a i l } . F u r t h e r m o r e t h e c o r r e s p o n d i n g f r e e c o n s t r u c t i o n i s n o t p e r s i s t e n t on ALG~p,Ep,

if

no r e s t r i c t i o n

t o c l e a n a l g e b r a s i s made.

5 . 9 Remark ( P o i n t e d a l g e b r a s and s p e c i f i c a t i o n s ) All

c o n s i d e r a t i o n s p r e s e n t e d here can be s p e c i a l i z e d t o

a l g e b r a s [Go 8 6 ] , sort.

In t h i s

pointed

where t h e r e i s o n l y one e r r o r element f o r

case e r r o r r e c o v e r y i s n o t s u p p o r t e d t o o w e l l ,

e s p e c i a l l y e r r o r p r o p a g a t i o n can be done a u t o m a t i c a l l y .

each but

93 6.

CONCLUSION

The

notion

algebra

of

a

clean algebra i s

satisfying

certain

a special

case

of

s o r t e q u a t i o n s which e s p e c i a l l y

sense i n t h e c o n t e x t o f p a r t i a l l y considered

just

an make

o r d e r e d s o r t s and which can

as a n o t h e r c o n s t r u c t f o r

algebraic specification

guages. For example i n c l e a n a l g e b r a s t h e s o r t

be lan-

equations

s-Ok n ~ - E r r o r = ~ and s-Ok u s - E r r o r = s are v a l i d f o r sort like

all

s o r t s s.

terms b u i l t union,

over the g i v e n s e t of

intersection,

An a l g e b r a s a t i s f i e s u a t i o n s of

A s o r t equation c o n s i s t s of a p a i r of s o r t s and s e t

operations

d i f f e r e n c e ~ complement and empty s e t .

a sort equation,

if

the set theoretic eval-

t h e two e x p r e s s i o n s w i t h r e s p e c t t o t h e g i v e n

coincide. This t o p i c

is

algebra

subject to f u t u r e research.

7. REFERENCES

ADJ 76

J.A.Goguen/3.W.Thatcher/E.S.Wagner : approach t o t h e s p e c i f i c a t i o n , tation

of a b s t r a c t data types.

gramming Hall, ADJ 78

methodology,

Englewood C l i f f s

H. E h r i g

/

R.T.yeh (ed),

tion

:

lOth STOC~ 1978,

/

1982,

C.Choppy :

tions. BGP 82

Proc.

F.Boisson / L.R.I.

/

pp.322-369.

Abstract

r e c o v e r y by means o f llth

ICALP 1984,

types

of

To a p p e a r .

exception handling

e q u a t i o n s and

declara-

LNCS 172, p p . 9 5 - 1 0 9 .

G. Guiho / D.Pavot :

R e p o r t , Orsay 1982.

data

approach based on a

between e x c e p t i o n s and e r r o r s .

M.Bidoit : Algebraic specification error

E.G. Wagner

Parameter p a s s i n g i n a l g e b r a i c s p e c i f i c a -

B . B e r n o t / M. B i d o i t

and

specification

San Diego.

w i t h e x c e p t i o n h a n d l i n g : An i n i t i a l

Bi 84

Prentice

Data t y p e s p e c i f i -

3~W.T h a t c h e r /

languages. LNCS 134, B e r l i n

distinction

pro-

i978~ p p . 8 0 - 1 4 9 .

H.-J.Kreowski /

J.B.Wright

BBC 8b

V o l . IV~

P a r a m e t r i z a t i o n and t h e power o f

t e c h n i q u e s . Proc.

algebra

Current trends in

J.W.Thatcher/E.S.Wagner/~.B.Wright : cation :

ADJ 81

An i n i t i a l

c o r r e c t n e s s and implemen-

Multioperator algebras.

94 Eh 81

H.Ehrig

:

A l g e b r a i c t h e o r y of parametrized

specifica-

t i o n s w i t h r e q u i r e m e n t s . Proc. b t h CAAP 1981, 8enova. EFH 83

H. Ehrig/W.Fey/H.Hansen : ACT ONE : An a l g e b r a i c s p e c i f i cation

language w i t h two l e v e l s

Report No. 8 3 - 0 3 , TU B e r l i n , EKMP 82

of

semantics.

Techn.

1983.

H. E h r i g / H . - J . K r e o w e k i / B . M a h r / PPadawitz . :

A l g e b r a i c im-

p l e m e n t a t i o n o f a b s t r a c t d a t a t y p e s . TCS, V o l . 2 0 1982. FGJM 85

K°Futasugi / J.A.Goguen /

J . - P . Jo u a n n a u d / J.Meseguer :

P r i n c i p l e s o f OBJ2. Proc. POPL 1985, p p . 5 2 - 6 6 . Ga 83

H.Ganzinger

:

Parametrized s p e c i f i c a t i o n

:

Parameter

passing and i m p l e m e n t a t i o n . ACM TOPLAS, V o l . 5 1983. GSM 76

V . G i a r r a t a n a / F . O i m o n a / U . M o n t a n a r i: cepts

in a b s t r a c t data type

Observability

specification.

Proc.

con5th

MFCS 1976, Gdansk, LNCS 45. SDLE 82

M . G o g o l l a / K . D r o s t e n / U . L i p e c k / H . - D . E h r i c h : A l g e b r a i c and operational

semantics o f s p e c i f i c a t i o n s a l l o w i n g e x c e p -

t i o n s and e r r o r s . TCS, V o i . 3 4 1984, pp.289-313. Go 83

M. G o g o l l a

:

specifications. cells Go 86

Partially

ordered

sorts

in

algebraic

Proc. 9 t h CAAP 1984, Bordeaux, B. Cour-

( e d ) , Cambridge U n i v e r s i t y Press, pp.139-153.

M.Gogolla : Ober p a r t i e l l

g e o r d n e t e Sortenmengen und d e -

t e n Anwendung z u r F e h l e r b e h a n d l u n g i n A b s t r a k t e n

Daten-

t y p e n . D i s s e r t a t i o n , TU Braunschweig, 1986. 8o 77

J.A.Goguen Proc.

:

Abstract e r r o r s f o r a b s t r a c t data

Conference

on Formal D e s c r i p t i o n o~

types.

Programming

Concepts 1978, E . J . N e u h o l d ( e d ) , North H o l l a n d . 8o 78

J.A.Goguen : Order s o r t e d a l g e b r a s : E~ception and e r r o r s o r t s , c o e r c i o n s and o v e r l o a d e d o p e r a t o r s . Semantics and Theory of Computation Report No.14, UCLA, 1978.

SM 84

J.A.Goguen/J.Meseguer : Order-sorted a l g e b r a I : P a r t i a l and o v e r l o a d e d o p e r a t o r s ,

e r r o r s and i n h e r i t a n c e . Tech-

n i c a l R e p o r t , SRI I n t e r n a t i o n a l , GJM 85

K1 84

1984.

J.A. Goguen/J.-P.Jouannaud/J.Meseguer :

Operational

m a n t i c s f o r o r d e r - s o r t e d a l g e b r a . Proc.

12th ICALP 1985.

se-

H . K l a e r e n : A c o n s t r u c t i v e method f o r a b s t r a c t a l g e b r a i c software specification.

TCS, V o l . 3 0 , No.2 1984.

95 Po 84

A.Poigne

:

Modularization

specifications ST 85

with subsorts.

D.Sannella/M.Wirsing : specification

Wa 79

M.Wand : sions.

WE 85

for

algebraic

I m p e r i a l C o l l e g e , London.

D . S a n n e l l a / A ~ T a r l e c k i : On o b s e r v a t i o n a l e q u i v a l e n c e and algebraic specification.

SW 83

techniques

l O t h CAAP 1985, B e r l i n .

kernel language f o r

Final

a l g e b r a s e m a n t i c s and d a t a t y p e

~CSS, V o l ~ l g ,

data types.

exten-

No. 1 1979, p p . 2 7 - 4 4 . Canonical constraints

for

parame-

Research R e p o r t RC 11248, IBM, 1985.

WPPDB 83 M . W i r s i n g / P . P e p p e r / H . Partsch/W. Dosch/M.Broy : a r c h i e s of

algebraic

and i m p l e m e n t a t i o n . P r o c . FCT 1983.

E.G.Wagner/H.Ehrig : trized

Proc. A

abstract data types.

On

hier-

A c t a I n f o r m a t i c a 1983~

Toward formal development of programs from algebraic specifications: implementations revisited (Extended abstract) Donald Sannella 1 and Andrzej TarIecki2 Abstract The program development process is viewed as a sequence of implementation steps leading from a specification to a program. Based on an elementary notion of refinement, two notions of implementation are studied: constructor implementations which involve a construction "on top of" the implementing specification, and abstractor implementations which additionally provide for abstraction from some details of the implemented specification. These subsume most formal notions of implementation in the literature. Both kinds of implementations satisfy a vertical composition and a (modified) horizontal composition property. All the definitions and results generalise to the framework of an arbitrary institution.

1

Introduction

There has been a lot of interesting work done on notions of refinement (see e.g. [GTW 78], [GB 80], [Ehr 81,82], [EKMP 82], [SW 82], [GM 82], [Gan 83], [Lip 83]). In [SW 83] and then in [ST 85b,86b] we used a very simple notion of specification refinement which seems appropriate for loose specifications: a specification SP refines to a specification SP', if every model of SP' is a model of SP; this extends to a notion of refinement of parameterised specifications. This looks suspiciously oversimplified, especially in comparison with most previous work in this area. In this paper we elaborate on how this simple notion can provide a basis for realistic and non-trNial program development. Roughly speaking, first we allow an implementation of a specification SP by another specification SP t to consist of a "program" or construction written in terms of SP t to compute the functions specified in SP. This subsumes most previous notions of implementation in the literature, e.g. [GTW 78], [Ehr 82], [EKMP 82] and [SW 82]. Then we incorporate ideas concerning behavioural equivalence of algebras as discussed in [GGM 76], [Rei 81], [GM 82], [ST 86b] (and elsewhere), by allowing the construction to deliver a result which realises SP not "exactly" but only up to an equivalence on algebras. This subsumes the notions of implementation in [Ehr 81], [GM 82], [Sch 82] and [BMPW 86]. These notions extend to parameterised specifications as before. In order to be useful for stepwise and modular program development, implementations should compose vertically and horizontally [GB 80]. The simple notion of refinement enjoys both of these properties. The first extended notion composes vertically and satisfies a (modified) horizontal composition property; similar results for the second notion hold only under certain additional conditions. We present these ideas in the framework of partial algebras [BrW 82]. This is mainly to take advantage of the reader's intuition, since all of the main definitions and results as well as method* ological remarks may be directly restated in the framework of an arbitrary institution [GB 84]. This means that they can be used to develop programs from specifications in a wide variety of logical systems. Thus, a user of the presented program development methodology may choose the logical system which is most suited to his particular task. Moreover, different logical systems may be most suitable at different stages of the development of even a single program, for example when developing an efficient imperative program from a high-level algebraic specification. We enable this by allowing specifications to be implemented by specifications in a different institution using what we call a semi-institution morphism [Tar 86]. 1Department of Artificial Intelligence, Universityof Edinburgh and Laboratory for Foundationsof Computer Science, Department of Computer Seience~ University of Edinburgh 2Institute of Computer Science, Polish Academyof Sciences, Warsaw

97 Unfortunately, for lack of space we are not able to cover this topic here; the interested reader should consult [ST 87] for a detailed treatment of this subject as well as for all the proofs, examples and full discussion which we are forced to omit here.

2

Algebraic preliminaries

Due to lack of space we omit the definitions of the following standard algebraic notions: signature (E), signature morphism (a), the category S i g n of signatures with initial (empty) signature ~.¢; partial E-algebra A, (closed) E-subalgebra, (weak) E-homomorphism, the category P A l g ( E ) of partial E-algebras; the a-reduct functor _[~: P A l g ( E ' ) --* P A l g ( E ) for any signature morphism a: E ~ E; terms t, equations VX.t = t', definedness formulae D(t), partial (first-order) sentences ~, and their translations (a(t), etc.) under signature morphisms. All these definitions may be found in [ST 87] and elsewhere. We write A ,~ ~ to denote that the algebra A satisfies ~, defined in the usual way (generalised to classes of algebras and sets of sentences as usual). For any signature ~ and S C_sorts(E), we say that a E-algebra A is reachable on S if it contains no proper E-subalgebra with carriers of sorts not in S the same as in A. In other words, every element of A is the value of a E-term with variables of sorts not in S (for some valuation). Notice that any E-algebra A contains exactly one ~-subalgebra which is reachable on S and has carriers of sorts not in S the same as in A, denoted ]~s(A). We omit qualification by S in these definitions if S =

sorts(E).

Let A e P A l g ( E ) . A congruence on A is an equivalence relation =- C tA[ × ]A[ such that for any f : s l , . . . , s n --~ s in Z and al,bl E )A)s,,...,a,,,b,, e ]A[,., if al =-s, bl . . . . ,an -=,. b. and fit(a1 . . . . . an) and fA(bl . . . . . bn) are defined, then fA(al . . . . . an) =, fA(bl . . . . . b,,). The quotient of an algebra by a congruence is defined as usual.

3

Specifications and r e f i n e m e n t

We are not going to formally define precisely what specifications are; they are just finite syntactic objects of some kind. Every specification describes a certain signature and a class of algebras over this signature. This semantics is made explicit using two mappings which assign to each specification SP a signature Sig[SP] E [Sign[ and a class Mod[SP] C [PAlg(Sig[SP])] of Sig[SP]-algebras. Algebras in MocI[SP] are called models of SP. We call a specification consistent if it has at least one model. This rather general description covers high-level user-oriented loose specifications admitting nonisomorphic models as well as low-level detailed specifications or even programs which for us are just very tight specifications. We adopt a purely model-theoretic view here and stop the analysis of the notion of a program at this level. Any application of the methodology we outline would require some further syntactic constraints on the notion of a program. D e f i n i t i o n 1 For any signature ~, S p e c ( ~ ) denotes the collection of all E-specifications, i.e. specifications SP such that Sig[SP] = ~,, preordered by the inclusion of model classes. For any two specifications SP1 and SP2, a specification morphism a: SP1 --* SP2 is a signature morphism a: Sig[SP1] --~ Sig[SP2] such that for any model A2 C Mod[SP2], A2I~ e Mod[SPl]. We assume that S p e c ( E ) contains at least basic specifications. That is, given a signature E and a (finite, recursive, r.e.) set ¢ of E-sentences, (E, ¢) is a specification with:

Sig[(E, ~)] = Z Mod[(Z, ~)] = {A e P A l g ( E ) ] A ~ ¢} If the sentences are all (universally quantified) equations or definedness formulae we call (E, ¢) an equational specification.

98

Specification-building operations are used to put together little specifications in nice ways to make progressively bigger ones [BG 77]. Any specification-building operation, given a list of argument specifications, yields a result specification; semantically, a specification-building operation is a function on classes of algebras. The only assumption we make about these functions is that they are monotonic; intuitively, less restrictive argument specifications yield a less restrictive result. Specification languages like CLEAR [BG 77,80] may be viewed just as sets of such operations plus some syntactic sugar. E x a m p l e 1 ( t r a n s l a t e ) [ST 86a] Given a specification SP and signature morphism a: SigISP ] --+ E', t r a n s l a t e SP b y a is a specification with semantics defined as follows:

Sit[translate SP b y a] = ~' Mod[translate SP b y a] = {A' e P A l g ( E ' ) i A'I~ e Mod[SP]}

[]

T r a n s l a t e is actually a family of specification-building operations, t r a n s l a t e = {translateo: z~r.,: S p e e (E) --+ S p e c (E')}oeStgn For any specification-building operation w we will write w: S p e c ( E ) --+ S p e c ( E ' ) , meaning that w takes Z-specifications to E'-specifications. Note that we have tacitly assumed that ~o is a unary operation; to simplify the presentation we make the same assumption throughout when convenient. A specification language usually provides a way for the user to define his own specificationbuilding operations, i.e. a mechanism for constructing parameterised specifications. There are different approaches to parameterised specifications; in this paper we use the approach of [ST 86a]. Semantically, any parameterised specification can be viewed as a function taking any specification over a given parameter signature ~par to a specification over a result signature Er,s- Syntactically, we write a parameterised specification as a )~-expression, ~X: Zpar.SPr,~[X], where X is an identifier and SPr~[X] is a Zr~s-specification built using specification-building operations which may involve X as a variable denoting a Ep~,-specification. For any Epar-specification SP, (~X: Ep~,.SPr~,[X])(SP) is a specification with semantics defined (essentially as 13-conversion) as follows: 5g[(~,X: r~o,.SP, o,[Xl)(SP)] = E~o, Mod[(~X: Ep~.SP,,,[X])(SP)] = Mod[SF~,,[SP/X]] We sometimes write ()~X: ~p~.SP,~[X]): Spec(Zp~) --* Spec(H~,,) to indicate the paxameter and result signatures explicitly. The programming discipline of stepwise refinement suggests that a program (which is a specification) be evolved from a high-level specification by working gradually via a series of successively more detailed lower-level intermediate specifications. A formalisation of this approach requires a precise definition of the concept of refinement. D e f i n i t i o n 2 Given two specifications SP and SP' such that Sig[SP] = Sig[SP'], we say that SP refines to SP', written SP ,.,.,'> SP', if Mod[SP'] C_ Mod[SP].

Given two parameterised specifications P and P' with the same parameter signature Epic, we say that P refines to P', written P ~ P', if for any Epic-specification SP, P(SP) ~ P'(SP). Intuitively~ SP ~ SP' if SP' incorporates more design decisions than SP. An important issue for any notion of refinement is whether refinements can be composed vertically (SP ~ SP' and SP' ~ SP" implies SP ~ SP") and horizontally (P ~ P' and SP ,..-.> SP' implies P(SP) .....> P'(SP')) [GB 80]. The above notion of refinement has both these properties since specification-building operations are monotonic. These properties allow large structured specifications to be refined in a gradual and modular fashion.

99 The development of a program from a specification consists of a series of refinement steps SP1 ~ ... ~ SP~, where SPo is the original high-level specification and SPn is a program. Vertical eomposability guarantees the correctness of SP, with respect to its specification SPo. This views each of the specifications SPo,..., SP, as a single indivisible entity. If, however, we decompose any of them using a parameterised specification, say SP~ = P(SP), then the further developments of P and of SP may proceed separately. Horizontal composability guarantees that the results of these developments may always be combined to give a refinement of SPk and so of SPo as well. Of course, these (sub)developments may themselves involve further decomposition.

SPo ~

4

Constructors and

implementations

The simple notion of refinement is mathematically elegant but perhaps a bit oversimplified from a practical point of view. In the sequel, we wilt develop notions of implementation built on top of this simple notion of refinement which are more suited to practical use. We start with a notion of implementation which involves a construction from the implementing specification to the implemented specification. What is a construction? Model-theoretically, the characteristic feature of a construction is that it transforms an algebra over one signature to yield another algebra over a (possibly different) signature. Thus, we can identify a construction a with a functions a: PAlg(E) -~ PAlg(E'). This determines a specification-building operation denoted (ambiguously) by the same symbol. We call specification-building operations of this kind constructors. D e f i n i t i o n 3 A constructor determined by a/unction ~: PAId(E) ~ PAlg(E') is a specificationbuilding operation ~¢: Spee(~.) --~ Spec(E'), where for any E-specification SP, Sig[~(SP)] -- E' and

Mod[~(SP)] = {~(A) I A e Mod[SP]}. Fact 1 Constructors are monotonic, preserve consistency of specifications, and are closed under

composition.

[]

E x a m p l e 2 (derive) For any E'-specification SP' and signature morphism ~r: E -~ E', the semantics of the specification derive f r o m SP ~b y a is as follows: Sig[derive f r o m SP ~ b y a] = E Mod[derive f r o m SP' b y a] = (A]~ [ A e Mod[SP']) The derive specification-building operations (one for each a: E - , E') are constructors determined by the corresponding reduct functors --In. Intuitively, derive can be used to hide and/or rename some of the sorts and operations of a specification. [] E x a m p l e 3 ( r e s t r i c t ) For any E-specification SP and set S c_ sorts[Z] of sorts, the semantics of the specification r e s t r i c t SP o n S is as follows:

Sig[restrict SP o n S] = E Mod[restriet SP on S] = {)~s(A) t A e Mod[SP]} The r e s t r i c t specification-building opera, ions (one for each E and S C sorts[E]) are constructors determined by the corresponding restrict functors ~s. :Restrict is used to remove "junk", i.e. to restrict to the reachable part of Mgebras. [] aFrom the category-theoretic point of view, it is natural to assume that this is a functor (all our examples are) but since we do not use the morphismpart in this paper we take this simplifiedview here.

100

E x a m p l e 4 ( q u o t i e n t ) For any T-specification S P and congruence ~ on ground ~-terms, the semantics of the specification q u o t i e n t S P w r t ~ is as follows: Sig[quotient S P w r t ~1 = ~ Mod[quotient S P w r t ~] = { A / ~ f A e Mod[SP]} The q u o t i e n t specification-building operations (one for each Z and ~ on Z-terms) are constructors determined by the corresponding quotient functors _ / ~ . Intuitively, q u o t i e n t is used to identify the values of certain terms; usually the congruence ~ is presented via a set of equations. [] E x a m p l e 5 ( e x t e n d ) If we have a signature morphism a: Z --* ~' then constructors from Spec (~) to $ p e c ( ~ ' ) will be called synthesizing constructors along a. The intuition is that they just build new stuff on top of the existing algebras without forgetting anything. One standard way to define such a synthesizing constructor is using the free extension. Namely, for any signature morphism a: Z --+ ~f and equational Et-specification S P ~, there is a free functor F~: P A l g ( ~ ) ~ Mod[SP'] (the left adjoint to the reduct funcLor _In: Mod[SP'] --. PAlg(~,)). That this functor always exists is a well-known fact. For any E-specification SP, e x t e n d SP t o S P ~ v i a a is a specification defined as follows: Sig[extend SP t o SP ° v i a a] = ~' Mod[extend SP t o SP' v i a a] = {Fo(A) ] A e Mod[SP]} Note that S P may be an arbitrary specification here, not necessarily equational. In general F~ does not have to preserve all the properties required by S P (so a was not required to be a specification morphism a: S P --* S P ~) although it does preserve ground equations deducible from SP. [] Non-example ( t r a n s l a t e ) The t r a n s l a t e specification-building operation defined in the last section is not a constructor. Consider for example any a: ~¢ --* ~, where ~ is non-empty or any a': ~ --* ~' which is non-injective on sorts. [] D e f i n i t i o n 4 A synthesizing constructor ~: S p e c ( E ) --* S p e c ( ~ ' ) is persistent along a signature rnorphism a: ~ -+ E', written ~: Spec(r,) -~+ S p e c ( ~ ' ) , if ~: P A l g ( Z ) -+ P A l g ( E ' ) is (strongly) persistent with respect to o, i.e. for any ~.algebra A, to(A)[~ = A. E x a m p l e 6 ( a m a l g a m a t e d u n i o n ) Given two persistent constructors *;1: S p e c ( E ) - - ~ Spec(E1) and ~2: S p e c ( ~ ) - ~ Spec(E2), let ol "El

ty2t be a pushout in Sign. For any E-algebra A, define ~(A) to be the unique E*-algebra such that n(A) J~l, = ~I(A) and n(A)In2, = ~2(A). ~(A) is well-defined since nl(A)In1 = A = n2(A)la~. Thus, we have defined a function ~: P A l g ( E ) --* P A l g ( E ' ) . We denote this function and the corresponding synthesizing constructor (along a l ; a l t = a2;a2 t) by ~;1 + ~2; if any doubts may arise, we add a l , a2 as subscripts to +. Intuitively, ~1+f¢2 "puts together" the constructions n l and ~2. The assumption of persistency guarantees that this is possible. (See the notion of amalgamated sum in [PB 85] and [EM 85].) [] F a c t 2 If a l : S p e c ( Z ) - - ~ S p e e ( ~ l ) and a2: S p e c ( E ) - ~ S p e c ( ~ 2 ) are persistent constructors then ~1 + ~2: S p e c ( E ) - - ~ S p e c ( ~ ' ) is a persistent constructor along a =~el a l ; a l ' = a2;a2'. []

t01

E x a m p l e 7 ( t r a n s l a t i o n o f a c o n s t r u c t o r ) There is another operator on constructors connected with the pushout in Sign. Namely, reconsider the pushout diagram of example 6 and suppose ~;1: S p e c ( E ) - ~ - + S p e c ( ~ l ) is a persistent constructor. Then for any A2 e P A l g ( ~ 2 ) , define ¢2(~1)(A2) to be the unique ~'-algebra such that o2(~1)(A2)In1, = ~l(A2]a2) and a2(~l)(A2)In2, = A2. Thus we have defined a function a2(~:1): P A I g ( ~ 2 ) --+ PAlg(G') which we call the translation of ~1 along a2. We use the same notation and terminology to refer to the corresponding synthesizing constructor (along a2'). Notice that a2(¢~1) is persistent. Intuitively, cr2(~1) performs ~1 on the up. part" of ~2-algebras and leaves the other components unchanged. Notice that the translation of a constructor is a more elementary operation than the amalgamated union. Namely, using the notation of example 6, ~1 + ~2 = t~2;a2(~l) = ¢:1;a1(~2). [] D e f i n i t i o n 5 ( c o n s t r u c t o r i m p l e m e n t a t i o n ) A specification SP is implemented by a specification SP' via a constructor x~: Spec(Sig[SP']) --* Spec(Sfg[SP]), written SP ~ SP', ff SP .....> ~(SP'). Intuitively speaking, if we want to evaluate a function in SP, we are able to do this provided we can evaluate any function in SP' since the constructor ~ puts together functions in SP' to obtain all functions in SP. In this sense, ~ may be viewed as a program parameterised by the (possibly not yet executable) specification SPq Notice that, using the constructors introduced in examples 2-5 above, we can reduce many of the notions of implementation in the literature (e.g. [GTW 78], [Ehr 82], [EKMP 82], [SW 82]) to the one above. For example, the implementation notion of [EKMP 82] assumes that ~: is the composition of e x t e n d , d e r i v e , r e s t r i c t and q u o t i e n t constructors (in that order). Our definition of constructor implementation resembles the notion of implementation given in [Ehr 81] for single algebras. In [Ehr 81], A is implemented by B via a construction F if A is (isomorphic to) a quotient of a subalgebra of F(B). When generalising to loose specifications, the requirement that some quotient of some subalgebra of F(B) be isomorphic to A may be regarded as a construction only if the subalgebra and quotient are taken uniformly on all models B of the implementing specification. If we do not require uniformity then this amounts to a non-constructive step which will be fully subsumed by the notion of abstractor implementation defined in section 5. There are even closer similarities with the notion of implementation of (parameterised) specifications in [Lip 83]; see section 6.1 for details. T h e o r e m 1 ( v e r t i c a l c o m p o s i t i o n ) /f SP ~

SP' and SP' ~

SP" then SP ~

SP".

~ []

Notice that since ~';~: is an acceptable constructor, there is no reason to require that it has (or may be transformed to) the same form as either ~ or ~:'. In general this will not be the case. However, in some special cases it turns out that such normal form theorems may be obtained, often under some additional assumptions about the specifications involved (see e.g. [Ehr 81], [EKMP 82], [8W 82], [EWT 83], [Ore 83]). It seems to us that the requirement that the composition of constructors must be forced into some given normal form corresponds to requiring programs to be written in a rather restrictive programming language which does not provide sufficiently powerful modularisation facilities for the job. In some situations, putting a constructor into a normal form can be viewed as an optimization process. The following simple fact allows us to mechanically strip off outermost constructors if the specification we want to implement happens to be built in this way. F a c t 3 For any constructor ~: S p e c ( ~ ) -+ S p e c ( ~ ' ) and ~-specifieatfon SP, ~(SP) ~., vided that SP ~, SP'. An interesting special case of this is the amalgamated union of specifications.

SP' pro[]

102

D e f i n i t i o n 6 For any two specification morphisms a l : SP ~ SP1 and er2: SP --~ SP2, the amalgamated union of SP1 and SP2, written SP1 + SP2 (decorated with subscripts SP, trl,a2 on + if necessary}, is a specification with semantics defined as follows:

sig[sP1 + sP2] = ~; Mod[SP1 + SP2] = Mad[translate SP1 by al'] U Mad[translate SP2 by aT] where the following diagram is a pushout in S i g n : ol

Sig[SP]

Sig[SP2]

= Sig[SP1]

a2'

" ~'

T h e o r e m 2 If SP1 ~ SP and SP2 ~ SP where both ~1: Spec(Sig[SP]) - ~ Spec(Sig[SP1]) and ~;2: Spec(Sig[SP]) -el+ Spec(Sig[SP2]) are persistent constructors, then SP1 + SP2 ~ SP. D This theorem allows us to implement the independent components of a specification separately and then combine their implementat;.ons provided that they do not affect the common part. In the above theorem we required ~1 and t¢2 to be persistent on all Sig[SP]-algebras as in the definition of the amalgamated union of constructors. However, in this context (as well as in similar situations in the sequel) it is sufficient to require that ~;1 and ~;2 are persistent only on models of SP (which may be easier to achieve in practice). Of course formally, ~I + ~;2 is then only a constructor on Mad[SP] rather than on PAlg(Sig[SP]) since it may be undefined on some Sig[SPl-algebras. T h e o r e m 3 Let E

E2

al

.

a2'

E1

" El

be a pushout in S i g n , tel: S p e c ( E ) -el+ Spec(E1) be a persistent constructor, and SP1,SP2 be E1and E2-speeifications respectively. [f SP1 ~ d e r i v e f r o m SP2 b y a2 then S P I + S P 2 ~ SP2. [] This gives another way of decomposing a specification and implementing the components separately. Namely, we implement one component using (a part of) the other and then we can proceed with the implementation of the other component. Summing up, the development process using this notion of implementation would consist of a sequence of steps SPo ~ SP1 ~ "" ~ SP,. Intuitively, SPo, SP, etc. do not "grow" as happens when we use the simple refinement notion, where this development would look like: SPo ~-~

~l (sP,)

---~

. . . ~.~> ~

(. . .

~.CSP.)...)

Using constructor implementations, we gradually reduce the specification by implementing its parts. Our goal is to end up with an empty specification over the empty signature, i.e. SPn = (T,¢, 0). Then, the composition of constructors to,;-.. ;~I forms a program which implements SPo.

103

5

A b s t r a c t o r s and i m p l e m e n t a t i o n s

It is often possible to abstract away from some of the details of the user's original specification without violating the real intention behind it. This is the idea behind the specification technique known in software engineering as abstract model specification [LB 77], in which the user defines in a more or less concrete fashion a model which gives the desired results with the intention that any program giving the same answers is acceptable. This theme has been discussed in [GGM 76], [Rei 81], [GM 82], [Kam 83], [ST 85a] and elsewhere; the idea goes back (at least) to work on automata theory in the 1950's [Moo 56]. To formalize these ideas we will consider another class of specification-building operations called abstractors. Intuitively, any equivalence relation on Z-algebras determines a specification-building operation which relaxes interpretation of any E-specification SP by admitting as a model any Zalgebra which is equivalent to a model of SP. Definition 7 An abstractor determined by an equivalence relation =_-C PAlg(E) × PAlg(~) is a specification-building operation a~: Spec(~) --* Spec(E) where for any Z-specification SP, S i g [ a ~ ( S p ) ] = r.

Mad[a~(SP)l

=

{A e

PAlg(E) I 3A' e

Mod[SP].A =__A'}

In the sequel we will omit the subscript =- when there is no danger of confusion. Also, if a is known we denote the abstraction equivalence which determines it by =_-~. F a c t 4 Abstractors are monotonic, idempotent, and preserve and reflect consistency of specifications. [] In general, abstractors are not closed under composition. This fact is neither surprising nor disturbing; we will not in fact have occasion to compose abstractors. E x a m p l e 8 ( o b s e r v a t i o n a l a b s t r a c t i o n ) For any E-specification SP and set W of ground Zterms, the semantics of the specification a b s t r a c t SP w r t W is as follows [SW 83]: Sig[abstract SP w r t W] = Z Mad[abstract SP w r t W] = {A E PAlg(Z) I 3A' E Mad[SP].A =w X ) where for any two algebras A , A ' E PAlg(Z), A --=-wA' iff: • for all t e W , A p D(t) iff A' p D(t), and • for all s E 8orts(E) and all t,t' E W,, A ~ t = t' iff A' ~ t = t'. Intuitively, W is the set of G-terms which represent computations the user is allowed to perform. We do not want to distinguish between algebras in which all these computations give the same results. A similar idea in the context of concurrent processes appears in [deNH 84]. [] E x a m p l e 9 ( b e h a v i o u r a l a b s t r a c t i o n ) An important special case of observational abstraction is behavioural abstraction. For any E-specification SP and set OBS C sorts(E) of sorts, the semantics of the specification b e h a v i o u r SP w r t OBS is as follows [SW 83], [ST 86a], [ST 86b]: Sig[behaviour SP w r t OBS] = Z Mad[behaviour SP w r t OBS] = {A E PAlg(Z) I 3A' e Mad[SP].A =OBS A'} where the equivalence =-OBS is just ~-w for W the set of all ground E-terms of sorts in OBS. Intuitively, OBS is the set of external sorts, visible to the user. []

104

D e f i n i t i o n 8 ( a b s t r a c t o r i m p l e m e n t a t i o n ) A E-specification SR is implemented by a E'-spceification SP' wrt an abstraetor a: Spec(E) --* Spec(Z) via a constructor ~: Spec(E') -~ Spec(E),

written SP ~

sP', if ~( sP) ~

~( sP').

If in the above definition, a is behavioural abstraction, then intuitively speaking we are implementing the behaviour of SP rather than SP itself. This subsumes the notions of implementation in [GM 82], [Sch 82] and [BMPW 86]. Notice that the abstractor a cannot be chosen arbitrarily; the choice depends on the specification SP and the context in which it is to be used. If a abstracts too much then the implementation will be useless - - for example if -= is the total equivalence on P A l g ( E ) then SP 2~> SP' for any SP' and constructor ~: Spec(Sig[SP']) ~ Spec(Sig[SP]). Suppose SP ~ SP' and SP r ~ SP". We would like to be able to conclude that SP ~ SP". According to the above argument we assume that a was chosen appropriately for the context in which SP is to be used and so we do not want to change it even when composing implementations. In general, there is no hope for such a result. If a I is too "liberal", there is no reason to expect that transforms any a'(SP')-model to a model of a(SP). However, the following theorem does hold: T h e o r e m 4 ( v e r t i c a l c o m p o s i t i o n ) I] SP ~ SP s and SP' ~ , SP then SP ~ SP" provided preserves the abstraction equivalences, i.e. for any two algebras A1, A2 E P A l g ( Sig[SP']) if A1 =--~, A2 then a(A1) ---~ a(A2). [] A methodological conclusion from this theorem is that the development process should proceed as follows: starting from a specification SP considered in a context for which an abstractor a is appropriate, we (abstractor) implement SP, say ST' ~ SP'. The next step should be to establish the appropriate abstractor up to which SP' may be considered by "pushing ~ through a". Namely, this should be the abstractor determined by the equivalence a - ~ ( - , ) where for A, A' E PAlg(SIg[SP']), A a - l ( ~ a ) A t iff a(A) ----~~(A'). Then, we can proceed with the development of SP' in the context of the abstractor determined by ~-~(-~). (Actually, any equivalence finer than a - ~ ( = , ) will do.) Similar ideas in the context of concurrent processes appear in [Lar 86]. C o r o l l a r y 1 If SPo ~ SPo ~ SP,.

"" ~

SP, and -a2 C _

Ell(-----ai)

and ... and - ~ . C _ a ,-i_ l ( =_a . _ , ) then []

Note that in practice, it is often convenient to sharpen the above results. They hold if the constructors preserve the equivalences between models of the appropriate specifications (e.g. in the vertical composition theorem it is sufficient that ~(A1) ~ ~(A2) for any A1 e PAlg(Sig[SP']) and A2 E Mod[SP'] such that A1 =-~, A2). In the rest of this section, we show that vertical composition and the above methodological remarks may work in practice. On one hand, the constructors we have introduced do preserve appropriate (observational) equivalences; and on the other hand, we show how to push standard observational equivalences in a satisfactory way through the constructors we have defined. L e m m a I ( d e r i v e ) For any signature morphism a: E1 --+ E2 and set W of ground E2-terms, P j l ( - w ) : ---aCW), where P~: Spec(E2) --+ Spec(E1) : d 4 ~X: E2. d e r i v e f r o m X b y a. [] L e m m a 2 ( r e s t r i c t ) For any signature E, S C sorts(E) and set W of ground E-terms, A - w ]~s(A) for all E-algebras A, where Rs: S p e c ( E ) -* Spec(E) =~el AX: E. r e s t r i c t X on S. [] The above lemma gives directly a characterisation of the result of pushing observational equivalence through r e s t r i c t constructors. Moreover, it directly implies that r e s t r i c t steps may be skipped if we use abstractor implementations. C o r o l l a r y 2 Under the assumptions of lemma P, ]~l(=-w) = - w .

[]

105

C o r o l l a r y 3 Under the assumptions of lemma 2, if a is the abstractor determined by n-w, then for any E-specifications SP and SP', SP ~~s SP' implies SP ~t a SP'. [] It is worth pointing out that the above corollary also allows us to throw out r e s t r i c t steps "in the middle" of the development process (provided that the intermediate equivalence used in this step satisfies the assumptions of lemma 2). This means that corollary 2 becomes superfluous since instead of using it to push equivalences through r e s t r i c t steps we can just skip these steps entirely. The situation with q u o t i e n t steps is similar although we need slightly more restrictive assumptions (see [ST 87] for details). Definition 9 For any signature morphism a: Z ---* Z', constructor ~: Spec(~) --~ Spec(Z') and sets W and W' of ground Z- and ground ~'-terms respectively, ~ is observably sufficiently complete (wrt W , W ' ) if for any term t' E W', either for any A E PAlg(Z), ~(A) ~ D(t') or there exists a term t e W such that for any A e PAlg(Z), ~¢(A) ~ t' = or(t). Typically, we will consider sets W and W' such that observable sufficient completeness is a weaker condition than sufficient completeness, which corresponds to the case where W' is the set of all ground }]'-terms of the sorts a(S) for S =a,f sorts(P.) and W is the set of all ground E-terms. Definition 10 For any signature morphism a: ~ --* ~', constructor ~: Spec(Z) --~ Spec(I]') and set W of ground E-terms, ~c is observably persistent {wrt W ) if for all terms tl,t2 E W of the same sort and anu A E PAIg(Z), ~(A) ~ a(tl) = a(t2) iff A ~ tl = t2 and ~(A) ~ D(a(tl)) iff A ~ D(tl). Notice that observable persistency is a weaker condition than the standard persistency. L e m m a 3 (synthesize) For any signature morphism a: Z --* Z' which is injective on sorts, structor t~: Spec(Z) --, Spec(~') and sets W and W' of ground Z- and Zt-terms respectively, is observably sufficiently complete wrt W, W ~ and observably persistent wrt W then ~¢-i(-~w,) 3 Moreover, if in addition W is a minimal set such that observable sufficient completeness holds '~- ~ ( - w , ) = - w .

conif =w. then []

As remarked already, constructor implementation using the derive, restrict, quotient and e x t e n d constructors subsumes many of the notions of implementation in the literature. The above lemmas imply that the extension of any of these notions to a corresponding notion of abstractor implementation goes through smoothly. L e m m a 4 ( a m a l g a m a t e d union) Let ~1: S p e c ( Z ) - - ~ Spee(Z1) ands:2: S p e e ( B ) - ~ Spec(E2) be persistent constructors, W, W 1 , W 2 be sets of ground Z-, ~1- and ~.2-terms respectively such that ~1 is observably sufficiently complete wrt W, W1 and ~2 is observably sufficiently complete wrt W, W 2. Recall that ~ =def ~;1 + ~2: Spee(P,) ~ Spee(Z'), where al Z • ZI

Z2

' P,,'

is a pushout in Sign, is a persistent synthesizing constructor (along a l ; a l ' = a2;a2'} such that for A e PAlg(Z), ~(A) is the unique E'-algebra such that ~;(A)1ol, = ~I(A) and to(A) o~, = ~;2(A). Under these assumptions, ~ is observably sufficiently complete wrt W , W ' where W I =def e l (W1) U ~2' ( w 2 ) .

[]

C o r o l l a r y 4 Under the assumptions of lemma 4, ~c-l(-w ') 2 - w .

[]

106

L e m m a 5 ( t r a n s l a t i o n of a c o n s t r u c t o r ) Consider again the pushout diagram from lamina 4. Let W, W1, W2 be sets of ground E-, E l - and E2-terms respectively, and let s l : Spec(E) _z2+Spec(E1) be a persistent constructor. If ~1 is observably su~ciently complete wrt W, W1 and cr2(W) C_ W2 then o2(~1): Spec(E2) --* Spec(E') is observably sui)~eiently complete wrt W 2 , W ~ where W' =

o1'(w1) u ~2'(w 2).

[]

C o r o l l a r y 5 Under the assumptions of lemma 5, o2(~1)-1(~w ,) ~ ~w2.

[]

6

Parameterisation

and

implementations

In the same way as the simple notion of refinement on specifications gave rise to a notion of refinement for parameterised specifications, the definitions of constructor and abstractor implementation extend to notions of constructor and abstractor implementation for parameterised specifications.

6.1

Parameterisation and constructor implementations

Definition 11 For any parameterised specification P: Spec(Ep~r) --* Spec(Er,~) and specificationbuilding operation w: Spec(E,~,) --~ Spec(E), w(P) is a parameterised specification defined by w(P) ~-def ~X: Ep~.w(P(X)): Spec(Ep,r) ~ Spec(E). Definition 12 ( c o n s t r u c t o r i m p l e m e n t a t i o n ) For any parametcrised specifications with a com-

mon parameter signature P" Spec(r~po,) -- Spec(~) and P': Spat(r po,) -- Spec(~') and constructor ~: Spec(E t) --~ Spec(E), P is implemented by pw via tc, written P ~ g~, if P .....-> tc(P'). This subsumes the notion of implementation of parameterised specifications in [SW 82]. It resembles the one in [Lip 83], where a parameterised specification is a (strongly) persistent functor. According to [Lip 83], P is implemented by P' via a construction F (another persistent functor, obtained by composing certain specification-building operations) if there is some P" and (persistent) natural transformations i: P" -~ P';F and s: P" -~ P such that i and s are componentwise injective and surjective respectively. In our framework, this corresponds roughly to an implementation via the composition of a persistent constructor, a restrict step and a q u o t i e n t step (in that order). Although there are several other definitions of implementation of parameterised specifications in the literature (see e.g. [EK 82], [GM 82] and [Gan 83]) it is difficult to compare them with ours because our definition extends the definition for the non-parameterised ease in the usual way that a relation is extended from elements to functions (that is, pointwise). In contrast, [EK 82] defines implementation of parameterised specifications by comparing their bodies and then proves that this implies our notion of implementation. This is arguably preferable from the point of view of proving correctness of implementations but we prefer to adopt the natural definition and treat the problem of proving correctness separately. T h e o r e m 5 (vertical c o m p o s i t i o n ) For any parameterised specifications P, P t p , parameter signature Epa~, if P ~ P~ and P~ ~ P" then P ~ P'.

with common []

As in fact 3, we can strip off outermost constructors from parameterised specifications: Fact 5 For any parameterised specifications P and P~ and constructor ~ on the result signature of p, ~(p) ~ P~ provided that P ~ P'. [] Constructor implementations do not compose horizontally. In fact, the standard formulation of the horizontal composition property is not even well-formed in this case. Namely, if P: Spec(Ep,r) --* Spec(Ere,) is a parameterised specification, SP is a Ep,r specification and SPitz"> SP', then in general Sig[SP'] ~ Evar and so P(SP') is not even well-defined. However:

107

T h e o r e m 6 ( h o r i z o n t a l c o m p o s i t i o n ) Given a parameterised specification P with parameter signature Ep~r and a Ep~r-speeifieation SP, if P ~ P' and SP ~ SP' then P ( S P ) ~ P'(tt(SP)). [] Although this is not horizontal composition as formulated in [GB 80], it is perfectly adequate for our purposes. It guarantees that in the case of a specification formed by applying a parameterised specification P to a E-specification SP, the developments of P and SP may proceed independently and the results be successfully combined. If P ~ P1 ~ "'" ~ Pn and SP ~ SPx u ~ ... ~ SPa then P ( S P ) ~ P~((#,~;..-;#,)(SP~)). We aim at reducing the parameter specification to the empty specification and the parameterised specification to the identity. If SP~ = <E$,~) and P , = ).X: E . X then the composition of constructors tt,~;..- ; # 1 ; ~ ; " " ;gl implements P(SP). 6.2

Parameterisation

and

abstractor

implementations

D e f i n i t i o n 13 ( a b s t r a c t o r i m p l e m e n t a t i o n ) For any parameterised specifications with a common parameter signature P: S p e c ( ~ p ~ ) -~ S p e c ( E ) and P': Spec(Ep~r) -+ S p e c ( E ' ) , abstractor a: S p e c ( E ) --* S p e c ( E ) and constructor to: S p e c ( E ' ) -+ S p e c ( E ) , P is implemented by P ' wrt a via ~, written P ~ P', if a(P) ~ ~(P'). T h e o r e m 7 ( v e r t i c a l c o m p o s i t i o n ) For any parameterised specifications P, P~, P" with common parameter signature Ep~,, if P ~ P ' and p, ~~' p , then P ~ P" provided that t; preserves the abstraction equivalences. [] Applicability of this result in program development requires proving that the constructors we use preserve the appropriate abstraction equivalences. For this, lemmas 1-5 of section 5 are applicable just as in the non-parameterised case. Unfortunately, the horizontal composition theorem for abstraetor implementations does not hold, even in the form suggested by the horizontal composition theorem for constructor implementations; parameter specifications cannot in general be abstracted from since parameterised specifications can make essential use of non-observable parts of the parameter. One way to circumvent this is to restrict attention to parameterised specifications which use their arguments in an abstract way, so that if we change the argument to an equivalent one we get a result which is equivalent. D e f i n i t i o n 14 Let a: S p e c ( E ) -~ Spec(E) be an abstraetor. We say that two E-specifications SP1 and SP2 are a-equivalent if Mod[a(SP1)] = Mod[a(SP2)]. T h e o r e m 8 ( h o r i z o n t a l c o m p o s i t i o n ) [[ P ~ P , and SP ~~' SP , then P(SP) ~ p,(,~,(SpO ) provided that P preserves a~-equivalenee, i.e. for any specifieatior~ S P 1 , S P 2 over the (common) parameter signature of P and p,, P(SP1) and P(SP2) are a-equivalent whenever SP1 and SP2 are a'-equivalent. [] The requirement that P preserves aLequivalence in the above theorem is guaranteed in either of the following three cases: 1. P has the form ~X: E.SPI[a'(X)], i.e. P abstracts from its argument before using it. 2. P is built entirely from constructors which preserve the relevant abstraction equivalences. 3. The abstractor a' is trivial, i.e. for any specification SP, Mod[a'(SP)] = Mod[SP]. The last c~se amounts to the following: Corollary 6 I/P

~ P ' and SP ~

SP' then P ( S P ) ~

P'(td(SP')).

[]

108

A constructor implementation SP ~ SP ~ is an abstractor implementation SP ~ SP ~ where the abstractor ~ is trivial. Notice however that when we push the corresponding equivalence through ~ and the constructors used in the further implementation of SP ~, the resulting abstraction equivalences may determine non-trivial abstractors again and so the use of techniques of abstractor implementations may be essential further on.

7

Concluding remarks

A number of important problems connected with the ideas presented here remain to be considered. First, we do not discuss here any methods for proving correctness of refinements; methods for proving theorems in specifications, especially in the context of observational abstraction [ST 86a,86b], are relevant to this problem. This would be especially important in the case of parameterised specifications. There is a large body of technical work in the literature on different specific notions of implementation. Viewed in our approach, each of these notions corresponds to a restriction on the choice of constructors and abstractors which may be used. We have tried to unify and generalise the many different notions of implementation in the literature. This quest for generality yields a uniform framework in which we can compare different approaches. We can investigate which of the problems encountered under different notions of implementation are inherent to the very concept of what an implementation should be and which are just technicalities caused by the imposed restrictions, and conversely, which results and properties are consequences of such restrictions and which are inherent to the nature of implementations. We have not yet tried to pursue this line of investigation in a systematic manner. According to our definition, any inconsistent specification refines any specification over the same signature. But if we succeed in refining a specification to a program then the original specification must have been consistent. This means that checking consistency is not necessary to ensure correctness of the development process. However, an inconsistent specification is a blind alley. On the other hand, even a consistent specification may have no computable model and so we cannot in general avoid blind alleys in program development anyway. In what we have presented here, constructors are just functions rather than actual pieces of programs in ~he usual sense. We did not give any particular syntax for defining constructors. It would be interesting to develop a programming language which would provide facilities for defining and composing constructors (this would probably require restricting the notion of constructor we use, as implied in section 3). A good starting point seems to be Standard ML [Mil 85] with modules [MacQ 85 I, where constructors could be defined as Standard ML functors (i.e. parameterlsed modules}. Acknowledgements Many of the ideas in this paper evolved in close collaboration with Martin Wirsing. Thanks to Oliver Schoett for many relevant discussions, to Hartmut Ehrig for his criticism which stimulated us to write these ideas down, and to an anonymous referee who directed our attention to [Lip 83]. Thanks to Teresa for (gastronomic) care. This work was supported by grants from the Alvey Directorate and the Polish Academy of Sciences.

8

References

[ B M P W 86] Broy, M., MSller, B., Pepper, P. and Wirsing, M. Algebraic implementations preserve program correctness. Science o/Computer Programming 7, pp. 35-53. [ B r W 82] Broy, M. and Wirsing, M. Partial abstract types. Acta In/ormatica 18 pp. 47-64.

109

[BG 77] Burstall, R.M. and Goguen, J.A. Putting together theories to make specifications. Proc. 5th Intl. Joint Conf. on Artificial Intelligence, Cambridge. [BG 80] Burstall, R.M. and Goguen, J.A. The semantics of Clear, a specification language. Proc. of Advanced Course on Abstract Software Specifications, Copenhagen. Springer LNCS 86, pp. 292-332. [deNH 84] de Nlcola, R. and Hennessy~ M.C.B. Testing equivalences for processes. Theoretical Computer Science 34, pp. 83-133. [Ehr 81] Ehrich, H.-D. On realization and implementation. Proe. lOth Intl. Syrup. on Mathematical Foundations of Computer Science, Strbske Pleso, Czechoslovakia. Springer LNCS 118. [Ehr 82] Ehrich, H.-D. On the theory of specification, implementation~ and parametrization of abstract data types. Journal of the Assoc. for Computing Machinery 29 pp. 206-227. [ E K M P 82] Ehrig, H., Kreowski, H.-J., Mahr, B. and Padawitz, P. Algebraic implementation of abstract data types. Theoretical Computer Science 20 pp. 209-263. [EM 85] Ehrig, H. and Mahr, B. Fundamentals of Algebraic Specification I: Equations and Initial Semantics. EATCS Monographs on Theoretical Computer Science, Springer. [EWT 83] Ehrig, H., Wagner, E.G. and Thatcher, J.W. Algebraic specifications with generating constraints. Proc. lOth Intl. Colloq. on Automata, Languages and Programming, Barcelona. Springer LNCS 154, pp. 188-202. [Gan 83] Ganzinger, H. Parameterized specifications: parameter passing and implementation with respect to observability. TOPLAS 5, 3pp: 318~354: [GGM 76] Giarratana, V., Gimona, F. and Montanari, U. Observability concepts in abstract data type specification. Proe. 5th Intl. Syrup. on Mathematical Foundations of Computer Science, Gdansk. Springer LNCS 45. [GB 80] Goguen, J.A. and Burstall, R.M. CAT, a system for the structured elaboration of correct programs from structured specifications. Technical report CSL-118, SRI International. [GB 84] Goguen, J.A. and Burstall, R.M. Introducing institutions. Proe. Logics of Programming Workshop (E. Clarke and D. Kozen, eds.), Carnegie-Mellon University. Springer LNCS 164, pp. 221-256. [GM 82] Goguen, J.A. and Meseguer, J. Universal realization, persistent interconnection and implementation of abstract modules. Proe. 9th Intl. Colloq. on Automata, Languages and Programming, Aarhus. Springer LNCS 140, pp. 265-281. [ G T W 78] Goguen, J.A., Thatcher, J.W. and Wagner, E.G. An initiM algebra approach to the specification, correctness, and implementation of abstract data types. Current Trends in Programming Methodology, Vol. 4: Data Structuring (R.T. Yeh, ed.), Prentice-Hall, pp. 80-149. [Kam 83] Kamin, S. Final data types and their specification. TOPLAS 5, 1 pp. 97-121. [Lar 86] Larsen, K. Context-dependent bisimulation between processes. Ph.D. thesis, Dept. of Computer Science, Univ. of Edinburgh. [Lip 83] Lipeck, U. Ein aIgebraischer Kalkiil ffir einer strukturierten Entwurf yon Datenabstraktionen. Ph.D. thesis, Abteilung Informatik, Universit~t Dortmund. [LB 77] Liskov, B.H. and Berzins, V. An appraisal of program specifications. Computation Structures Group memo 141-1, Laboratory for Computer Science, MIT. [MacQ 85] MacQueen, D.B. Modules for Standard ML. Polymorphism 2~ 2. [Mil 85] Milner, R.G. The Standard ML core language. Polymorphism 2, 2. [Moo 56] Moore, E.F. Gedanken-experiments on sequential machines. In: Automata Studies (C.E. Shannon and J. McCarthy, eds.), Princeton Univ. Press, pp. 129-153.

110

[Ore 83] Orejas~ F. Characterizing composability of abstract implementations. Proe. Intl. Con/. on Foundations o/ Computation Theory, Borgholm, Sweden. Springer LNCS 158, pp. 335-346. [PB 85] Parisi-Presicce, F. and Blum, E.K. The semantics of shared submodules specifications. Proe. 10th Colloq. on Trees in Algebra and Programming, Joint Conf. on Theory and Practice of Software Development (TAPSOFT), Berlin. Springer LNCS 185, pp. 359-373. [Rei 81] Reichel, H. Behavioural equivalence - a unifying concept for initial and final specification methods. Proc. 3rd Hungarian Computer Science Conference, Budapest, pp. 27-39. [ST 85a] Sannella, D.T. and Tarlecki, A. Some thoughts on algebraic specification. Proc. Srd Workshop on Theory and Applications of Abstract Data Types, Bremen. Springer InformatikFachberichte Vol. 116, pp. 31-38. [ST 85b] Sannella, D.T. and Tarlecki, A. Program specification and development in Standard ML. Proe. 12th ACM Syrup. on Principles o/ Programming Languages, New Orleans, pp. 67-77. [ST 86a] Sannella, D.T. and Tarlecki, A. Specifications in an arbitrary institution. Report CSR184-85, Dept. of Computer Science, Univ. of Edinburgh; to appear in In/ormation and Control. [ST 86b] Sannella, D.T. and Tarlecki, A. On observational equivalence and algebraic specification. Report CSR~172-84, Dept. of Computer Science, Univ. of Edinburgh; to appear in Journal of Computer and Systems Sciences. [ST 87] Sannella, D.T. and Tarlecki, A. Toward formal development of programs from algebraic specifications: implementations revisited (full version). Research report, Dept. of Computer Science, Univ. of Edinburgh (to appear). [SW 82] Sannelta, D.T. and Wirsing, M. Implementation of parameterised specifications (extended abstract). Proc. Oth Intl. Colloq. on Automata, Languages and Programming, Aarhus. Springer LNCS 140, pp. 473-488. [SW 83] Sannella, D.T. and Wirsing, M. A kernel language for algebraic specification and implementation (extended abstract). Proe. Intl. Conf. on Foundations of Computation Theory, Borgholm, Sweden. Springer LNCS 158, pp. 413-427. [Sch 82] Schoett, O. A theory of program modules, their specification and implementation (extended abstract). Report CSR-155-83, Dept. of Computer Science, Univ. of Edinburgh. [Tar 86] Tarlecki, A. Software-system development - - an abstract view. Information Processing '86. North-Holland, pp. 685-688.

FINITE ALGEBRAIC SPECIFICATIONS OF SEMICOMPUTAB-LE DATA TYPES(*) G. Marongiu D p t . o f Mathematics, U n i v e r s i t y of Bologna, Italy S. Tulipani D p t . o f Mathematics and Physics, U n i v e r s i t y of Camerino, Italy

0-I n t r o d u c t i o n For many y e a r s computer s c i e n t i s t s have looked at data objects in terms of axioms which g o v e r n the beilaviour of data s t r u c t u r e s .

Data Type S p e c ~ c ~ o , l .

Such an attempt is called

)~bsL'Lac~

A b s t r a c t i o n is i n v o l v e d in the fact that only p r o p e r t i e s

which are i n d e p e n d e n t of data r e p r e s e n t a t i o n are c o n s i d e r e d . In the a l g e b r a i c a p p r o a c h , initiated in the p a p e r of LISKOV-ZiLLES [1974], data s t r u c t u r e s are t h o u g h t of as algebras in the s e n s e of g e n e r a l a l g e b r a (see also [ Zi 79] and specifications are g i v e n in terms of equations or conditional e q u a t i o n s . But, only p a r t i c u l a r models of the s p e c i f y i n g axioms play a special role. Data s t r u c t u r e s are u s u a l l y finite, sometimes potentially infinite. T h e r e f o r e , the significant models of a data t y p e specification E in a s i g n a t u r e Z a r e g i v e n b y the class Algm(Z,E) whose members are the models of E which are finitely g e n e r a t e d b y elements named as const_ ants in Z. The initial a n d final objects in Aigm(Z,E), which a r e g i v e n up to isomorphism, determine the initial and final a l g e b r a semantics, r e s p e c t i v e l y . More p r e c i s e l y , assuming t h a t two closed terms t , s of s i g n a t u r e

Z are g i v e n , t h e n , the equation

t=s is t r u e when the terms t , s are e v a l u a t e d in the initial a l g e b r a if and only if the formal equation t=s can be p r o v e d from E. Moreover, the equation t=s is c o n s i s t e n t with E if and only if it is t r u e in the final a l g e b r a . Both initial and final a l g e b r a semantical a p p r o a c h e s have been widely d i s c u s s e d (see [ADJ 75,78,82], book

~/a 79], the

~-M 85].

BERGSTRA and TUCKER [1983 ] c~scussed the problem of c h a r a c t e r i z i n g semicom~ utable (cosemicomputable, computable) data t y p e s by means of finite conditional s p ecification with h i d d e n f u n c t i o n s and no additional s o r t s plus initial a l g e b r a semantics (*) R e s e a r c h p e r f o r m e d u n d e r the auspices of the Italian CNR and MPI. This is a r e v i s e d v e r s i o n of p r e v i o u s ( u n p u b l i s h e d ) p a p e r which circulated u n d e r the title: Finite Specification of Data T y p e s with e x t r a Operations.

1t2

(plus final a l g e b r a semantics), plus both semantics, r e s p e c t i v e l y .

However, the

problem is solved only for cosemicomputable and computable data t y p e s . We have t r i e d to solve the problem for semicomputable data t y p e s g i v i n g a c h a r acterization which is weaker than that c o n j e c t u r e d in the p a p e r [B-T 83]. More

prec

isely, let us assume A is an infinite semicomputable a l g e b r a of s i g n a t u r e Z and finite l y g e n e r a t e d b y constants named in its s i g n a t u r e . T h e n , we can determine a finite conditional equation s p e c i f i c a t i o n ( ~ E ) where z ' is a finite s i g n a t u r e e x t e n d i n g z with no additional s o r t s so t h a t : g i v e n two closed terms t , s of s i g n a t u r e (1)

t=s

Z, then

is t r u e in A if and only if t=s is provable from E.

Moreover, our method p r o v i d e s an expansion A' to s i g n a t u r e Z' of the s t r u c t u r e h such that A ~ is a model of E. However, A' in ' o u r theorem is not t h e initial a l g e b r a of Alg m ( Z ' , E ) , as BERGSTRA and TUCKER c o n j e c t u r e d in the semicomputable case. In fact we cannot p r o v e for closed terms, t ' , s ~ of s i g n a t u r e z': (2)

t'=s' is t r u e in ~ if and only if t'=s ~ is pro~able from E.

This means that the specification (Z',E) is a c o n s i s t e n t e x t e n s i o n b u t not an enrichm ent of a specification for A extend

(see [E-M 85, Chap. 6 ]). F u r t h e r m o r e our r e s u l t s also

n a t u r a l l y to cosemicomputable and to computable data t y p e s (see Theorems

B and C). The agility of proof via Combinatory Logic does not consent comparison of the complexity of the s e t of conditional equations E to the complexity of the r e c u r s i v e functions which define A. This problem will be e x p l o r e d in f u t u r e work [M-T 86 ] where it has also b e e n p r o v e d that one single equation is s u f f i c i e n t f o r s p e c i f y i n g a computable a l g e b r a as a h i d d e n enrichment u n d e r both initial and final a l g e b r a semantics ( a c c o r d i n g to BERGSTRA and TUCKER Definition, see [B-T 83] and [B-T 8{)]. To simplify notation, we t r e a t the case of s i g n a t u r e

Z in a single s o r t . However,

the r e s u l t s can be easily e x t e n d e d to m a n y - s o r t e d a l g e b r a s . It is assumed that the r e a d e r is familiar with the p a p e r s of B e r g s t r a and T u c k e r [ B - T 83], [ B - T 86] and with the main p a p e r s on specification t h e o r y ; in p a r t i c u l a r

~ - M 85]. Moreover, the

basic notations of u n i v e r s a l a l g e b r a and r e c u r s i o n t h e o r y a r e assumed (see [Gr 78 ], ~ z 79] ). In p a r t i c u l a r , it is assumed an u n d e r s t a n d i n g of the notions of semicomputable, cosemicomputable and computable a l g e b r a which can be found t r e a t e d in full in MAL'CEV [1961] (see also [Ra 60]).

113

1-Preliminaries and Notations. Let Z be a finite algebraic signature having at least one constant symbol. We shal} denote

~ b Y { f l , . . . , fk' c 1 " " '

Cr} where f l , . . . , f k

are function symbols and cl ,

. . . , c constant symbols. If A is an algebra of carrier A and signature ~ we denote r the i n t e r p r e t a t i o n s of the symbols oi' Z in the a l g e b r a A b y # f~k CA A AS pointed out in the introduction, we shall consider only algebras of finite signature and in addition they are infinite and generated by elements named as constants in their signature. Hence, if an algebra is of signature E it is generated by the elA A ements c 1 , . . . , c r . For s u c h a l g e b r a s the definitions of semicomputable, cosemicomputable and computable can be g i v e n more simply than in the g e n e r a l case along the following lines (see [Ma 61] , [ B - T 86]). Definition 1.1

An a l g e b r a N is a r e c u r s i v e number a l g e b r a if and only if the c a r

t i e r of N is the set

N

of n a t u r a l numbers and the operations of N a r e r e c u r s i v e

functions. Definition 1.2

Let

same s i g n a t u r e and

A be an a l g e b r a and N be a r e c u r s i v e number a l g e b r a of the ~: N -~ A be a morphism. T h e n , ~ is

(i)

a r e c u r s i v e l y enumerable ( r . e ) morphism,

(ii)

a c o r e c u r s i v e l y enumerable ( c o - r . e . ) morphism,

(iii)

a r e c u r s i v e morphism,

if and only if k e r

n = p

is

(i)

a r e c u r s i v e l y enumerable relation,

(it)

a relation whose complement in N 2 is r e c u r s i v e l y enumerable,

(iii)

a r e c u r s i v e relation,

respectively. Definition 1.3

Let A be an a l g e b r a . T h e n ,

(i)

semicomputable,

(it)

cosemicomputable,

(iii)

computable,

A is

if and only if t h e r e e x i s t s a r e c u r s i v e number a l g e b r a N (of t~e same s i g n a t u r e ) and a surjective ~ : N -~ A such that ~ is (i)

a r.e epimorphism,

(it)

a co-r.e, epimorphism,

(iii)

a recursive epimorphism, respectively.

114

F o r t h e f o l l o w i n g d i s c u s s i o n we n e e d some f a c t s a b o u t c o m b i n a t o r y a l g e b r a s a n d c o m b i n a t o r y logic t h a t we r e c a l l i n o r d e r to f i x t e r m i n o l o g y a n d n o t a t i o n 0 f o r a c o m p r ehensive treatment see

[Ba 8 1 ] ,

[H-S 80] ) . L e t cl = { , , K , S }

be a signature

such that

- is a s y m b o l of b i n a r y o p e r a t i o n a n d K , S a r e c o n s t a n t s y m b o l s . A c o m b i n a t o r y a l g e b r a is a s t r u c t u r e

M = (M, • , K M , s M) of s i g n a t u r e

El.

Kox-y = x

E2.

S-xoy.z

= x-z,

(y,z)

cl w h i c h s a t i s f i e s t h e a x i o m s :

,

w h e r e t h e a s s o c i a t i o n f o r t h e o p e r a t i o n s y m b o l • is d o n e a s u s u a l f r o m t h e l e f t so t h a t MlOM {

...o

T(cl),

i.e.

Mk

m e a n s ( . . . ( ( M 1 - M 2 )-M 3) . . . .

a t e r m of s i g n a t u r e

cl w i t h

no

),M k

. A c o m b i n a t o r is a t e r m i n

variables.

Some c o m b i n a t o r s a r e c a l l e d

n u m e r a l s . More s p e c i f i c a l l y , if n is a n e t u r a l n u m b e r we d e n o t e b y rn~ a - c o m b i n a t o r w h i c h is c a l l e d t h e n u m e r a l r e p r e s e n t i n g r0~ = K*I

n a n d is d e f i n e d i n d u c t i v e l y a s follows:

r n + l1 = S , B o r n 7

(1.4)

w h e r e as u s u a l I is t h e c o m b i n a t o r S - K ° K a n d B is t h e c o m b i n a t o r S , ( K o S ) . K . denote the equational theory,

We

w h o s e n o n logical axioms a r e E1 a n d E2 a n d w h i c h is

n a m e d C o m b i n a t o r y L o g i c , b y CL. What we n e e d is t h e f o l l o w i n g ( s e e [ B a 81 ]) Faot 1.5.

F o r e v e r y r e c u r s i v e f u n c t i o n f t h e r e e x i s t s a c o m b i n a t o r F f w h i c h repres_

ents f in CL,

viz. for all natural

numbers

nl,...,n m

CL ~-- Ff

nI

...

m

rf(n I ..... nmf.

2-Semic0mloutable D a t a T y p e s . T h e o r e m A. a finite set all

Let

Main r e s u l t .

A b e a s e m i c o m p u t a b l e a l g e b r a of s i g n a t u r e Z . T h e n , t h e r e e x i s t s

E of c o n d i t i o n a l e q u a t i o n s i n a s i g n a t u r e

t l , t 2 e_ T ( ~ ) :

El--- t l = t 2

if a n d o n l y if

A~

X' e x t n e d i n g

~ such that for

tl=t 2 •

I n o r d e r to p r o v e T h e o r e m A we m u s t c a r r y o u t some c o n s t r u c t i o n s

a n d p r o v e two

Lemmas. Let

A b e a s e m i c o m p u t a b l e i n f i n i t e a l g e b r a of s i g n a t u r e

N be a recursive

n u m b e r a l g e b r a of s i g n a t u r e

Let us suppose that ml,...,m ~(m 1) = c A , . . . , a n d m.=m. 1

]

A A i f f c. = c.

Let p be ker ~

1

]

X and

Z = {fl'""

'fk'Cl"'"c~

~ : N -~ A b e a r . e .

,

epimorphism.

r are natural numbers such that A ~(m r ) = c r

for i,j=l, .... r.

and g be a recursive

f u n c t i o n of t h r e e v a r i a b l e s s u c h t h a t f o r

(2.1)

115

m,n ~ N , (m,n)~

p iff t h e r e is a n a t u r a l n u m b e r p s u c h t h a t g ( m , n , p )

= 0. When

f is a f u n c t i o n sz]mbol which is not c o n s t a n t of s i g n a t u r e Z, t h e c o m b i n a t o r which r e p r esents

in

CL

bet algebra

t h e f u n c t i o n fN w h i c h i n t e r p r e t e s

N is d e n o t e d b y Ff. F i n a l l y ,

t h e symbol f in t h e r e c u r s i v e nu_m

the combinator which represents

the rec

u r s i v e f u n c t i o n g w h i c h e n u m e r a t e s k e r ~ is d e n o t e d b y G. Let now ~' be t h e s i g n a t u r e {fl""'fk'cl i.e.,

Z' is

~ u

'''''cr'

° ,K,S,

Nat, Horn}

cl p l u s two u n a r y o p e r a t i o n symbols Nat,Horn.

list of c o n d i t i o n a l e q u a t i o n s in ~', w h e r e x , y , x l , x

2....

C o n s i d e r t h e following

d e n o t e v a r i a b l e s . To simplify

n o t a t i o n we mention o n l y one of t h e f u n c t i o n symbols f l ' " "

' f k ' s a y it f of m a r g u m e n t s

E l - E 2 axioms of CL. E3

is the conjunction for all f in ~ of

(1 ~ m

N a t ( x i ) = K ) ÷ Hom(Ff* x 1- . . . . Xm) = f ( H o m ( x l ) . . . . . Hom(Xm))

E4

l
E5

N a t ( r 0 ~) = K I, ( N a t ( x ) = K - + N a t ( ( S o B ) , x )

E6

( N a t ( x ) = K ^ N a t ( y ) = K /x Nat(z) = K A G . x o y ° z = r0")--+ H o m ( x ) = H o m ( y ) .

C.

] =K)

T h e s e t of axioms E l - E 6 is d e n o t e d b y E. The i d e a we h a v e e x p l o i d e d f o r w r i t i n g down t h e s e t of axioms E can be r o u g h l y d e s c r i b e d as follows. T h e a l g e b r a A may be e x p a n d e d to a s t r u c t u r e A' w h i c h also becomes a c o m b i n a t o r y a l g e b r a . structure

Therefore,

the

N can be c o d i f i e d in t h e e x p a n s i o n A' of A. T h e u n a r y o p e r a t i o n symbol Nat

is i n t e n d e d to be i n t e r p r e t e d

in t h e " c h a r a c t e r i s t i c f u n c t i o n " of t h e s u b s e t of n a t u r a l

n u m b e r s of A'. In t h i s w a y t h e s t r u c t u r e s

N a n d A a r e g l u e d u p in t h e s t r u c t u r e

A'

a n d t h e u n a r y o p e r a t i o n symbol Horn is i n t e n d e d to be i n t e r p r e t e d in t h e codification of ~ in A'. All t h i s is f o r m a l i z e d in t h e f o l l o w i n g Lemma. Lemma 2.2

S u p p o s e A is t h e a l g e b r a of s i g n a t u r e

Z previously described.

Then,

t h e r e e x i s t s an a l g e b r a A' w h i c h is an e x p a n s i o n of A to Z' a n d is a model of E. Proof.

Since A is i n f i n i t e , we may t a k e a non t r i v i a l c o m b i n a t o r y a l g e b r a

( M , ° , K M , s M)

M =

b i j e c t i v e to A. U s i n g one b i j e c t i o n from A to M we can t r a n s l a t e t h e

o p e r a t i o n s of M in t h e o p e r a t i o n s • , K A , s A on A so t h a t t h e s t r u c t u r e is i s o m o r p h i c to M. Let now Nat A, Hom A be u n a r y o p e r a t i o n s on A s u c h t h a t f o r a ~ A

( A , . , K A , s A)

116

I KA NatA(a) =

SA

HornA(a) =

{ 7 (n) sA

a = rn~A

if there is n ~ N such that otherwise

if there is n ~ N such that a = rnl otherwise

Here r n ' A is the interpretation in the s t r u c t u r e ( A , * , K A , s A) of the numeral rn~. This interpretation will be called the "codification" in the s t r u c t u r e ( A , * , K A , s A) of the natural

number

n.

The expansion A' is now defined as follows A' = (A,°,KA,s A, NatA, HornA) We

will now

show

that

A' is a model

of E. Axioms

E1 and

E2 are

true

in A' because

the reduct of A' to cl is a combinatory algebra being isomorphic to M. To prove E3, assume a l , . . . .

am are elements of A which satisfy

1
By the def_

inition of Nat A there are natural numbers n l , . . . , n m such that al= r n ,1A , . . . . a m=rn~A" m We must now show that a l , . . . ,am also satisfy the second member of the implication in E3.

Now

using

FfA By

Fact

rnlA-

the definition

1.5

• " "

we

have

• rnTA = yfN(nl, m

of Horn A we

have

qA " " ' 'nm)

that

HomA(rfN(nl, • . . , n m ),A ) . ~(fN(nl, . . . fA(HomA(al) . . . . . Since

(2.3)

'

Horn(am )

,nm))

(2.4)

and

= fA( ~(nl ) . . . . . ~(nm)) .

~ is a morphism

fA(HomA(al) . . . . , HomA(am )) = ~ ( f N ( n l , . . . ,nm) ) .

(2.5)

Therefore, from (2.4) and (2.5) we can conclude Hom That

A

E4 is true

A (Ffin

a I ....

• am )) =

A' follows

immediately

fA(HomA(al) from

'°'°'

HomA(am

the definition

))

of Hom A

" and

(2.1).

It is

117

easy

to prove

that E5 is true in A' from

Proof of E6. Assume by a, y by b and

that a,b,c z by

the definition

of numeral

& A satisfy the antecedent

c. This

means

that there

and

of Nat

of E6, when

exist natural

A

•

x is substituted

numbers

m,n,q

such

that a = r m ' A , b = r n ' A , c =rq "A

and

G A - r m ~ A - r n T A r q "A= ;0"A

(2.6)

B u t from Fact 1.5 we h a v e GA Fin~ A . r n l A ~ r q T A = r g ( m , n , q ) n A Since non

the interpretation

of numerals

trivial cembinatory

that g(m,n,q)

algebra

= 0. Hence, HomA(rm~A

Then,

by

(2.6)

Given

a term

ulation that must

2.8

rnTA )

HomA(a)

= HomA(b)

which

t ~ T(Z)

we now

N

For every

the complexity

= ~ (n!.

) = HomA(

Recall that the structure Definition

corresponding

to distinct natural

are distinct elements,

~(m)

be performed

(2.7)

is codified

means

that E6 is true in A'.

in (A,o,KA,s define

if t=f(t I ..... tm) , then ~ is Ff- E l, ...~ "tm For every there

(2.9ii)

n such

the calc-

that ~(n)

= tA.

via M. by induction

on

of t as follows:

(it)

(2.9i)

of Hem A,

describes

a term ~ in T(cl)

if t=c i, then ~ is rm~'1 for i=l~...,r.

2.9

number A)

(i)

Lemma

which

in a

(2.7) we have

by the definition

the natural

t in T(S)

(2.6) and

Therefore,

define a term "t in T(cl)

to obtain

term

from

numbers

term

t of T(z):

exists a natural

E b---Hom(~)

number

n such

that E k--'t = Cnn ,

= t.

Proof of ( 2 . 9 i ) .

B y i n d u c t i o n on t h e complexity of t. If t is the c o n s t a n t symbol c. ] t h e n ~ is ~m.~ . Hence, the n u m b e r m. w o r k s . Let t be f ( t l , . . . , t m ) . By i n d u c t i o n hy]2 ]

]

o{hesis we h a v e n a t u r a l n u m b e r s n l , . . . E F- "tl But Ff

=

rn l~

'""

,n m such that

Eb---~ m = ~n~m a n d ~ is Ff- ^tI.

..

.°~m "

(2.10)

represents f in CL. So w e have a fortiori

E F - - F f • r n ~ ° ...orn~m

= r f N ( n 1 , . . . , n m )~

(2.11)

Hence, w h e n n=f N ( n 1 . . . . . nm) we have (2.9i) from (2.10) a n d ( 2 . 1 1 ) . Proof of (2.9fi). By i n d u c t i o n on the complexity of t. If t is the c o n s t a n t symbol c. ]

118

t h e n ~ is rm7 . H e n c e , from axiom E3 we get E ~ - H o m ( t ) = t . ] Let now t be f ( t l , . . . ,tin). B y i n d u c t i o n h y p o t h e s i s we h a v e E }--- Hom(ti)=t i , for i=l . . . . . m.

(2.12)

T h e r e f o r e , u s i n g (2.9i) a n d axiom ES, we get Et----Nat(ti)=K,

for i = l , . . . , m .

(2.13)

T h e n , from (2.13} a n d axiom E3 we h a v e E F-- Horn(F} tl" . . . . t m ) = f ( H ° m ( t l ) . . . . . H°m(tm) )"

(2.14)

Hence, from (2.12) a n d from the d e f i n i t i o n of t we get Hom(t)=t. Proof of Theorem A. Given terms t l , t 2 in T(~) we have to p r o v e t h a t E~-- t l = t 2

if a n d o n l y if A ~ t l = t 2 .

(2.15)

T h e " o n l y if" d i r e c t i o n follows immediately from Lemma 2.2. To p r o v e t h e "if" d i r e c tion a s s u m e A~tl=t 2

(2.16)

By Lemma 2.9 t h e r e e x i s t n a t u r a l n u m b e r s n l , n 2 s u c h t h a t E ~

t.= rn~. a n d E ~-- Hom(ti)=t i 1 1

for i = i , 2 .

(2.17)

T h e n , from (2.16) a n d (2.17) A'~Hom(rn;

)=Hom(rn~ ) .

(2.18)

Hence, b y t h e d e f i n i t i o n of HornA we get (nl)= ~ (n2). T h e r e f o r e , t h e r e is a n a t u r a l n u m b e r q s u c h t h a t g ( n l , n 2 , q ) = 0 .

(2.19) Since G r e p r e s e n t s

t h e f u n c t i o n g we h a v e E ~ - - - G * r n -~.r I n 2%r q~ = r01

(2.20)

Now, u s i n g axiom E6 a n d ( 2 . 2 0 ) we get E~--Hom( r n ~1 )=Hom(rn~z ). Hence, from (2.17)

3.

E ~ - - t 1 = t 2.

Cosemicomputabte, Computable Data T y p e s a n d r e m a r k s We c a n also a p p l y o u r method to cosemicomputable a n d to computable d a t a t y p e s . S u p p o s e t h a t A is a cosemicomputable a l g e b r a of s i g n a t u r e

Z , N is a r e c u r s i v e

n u m b e r a l g e b r a a n d ~ :N--+ A is a c o - r . e , epimorphism. Let g' b e a r e c u r s i v e f u n c -

tt9

tion of t h r e e v a r i a b l e s which enumerates the complement of p=ker ~. T h e r e f o r e , f o r m,neN,

we have

(m)~ v ( n )

if and only if t h e r e is a n a t u r a l number q such t h a t g r ( m , n , q ) = 0 .

We denote the combinator which r e p r e s e n t s the r e c u r s i v e function g' b y G'. Moreo v e r , we let [' be the s i g n a t u r e c o n s i d e r e d in the semieomputable case, i . e . ~= Z w e l ~ { Horn,Nat } . Now, c o n s i d e r the set E F of conditional equations obtained from E b y r e p l a c i n g E6 with the new (E6) F

axiom = r01/~.Hom(x)~Hom(y))-+K=S.

(Nat(x)=K^Nat(y)=KANat(z)=KAG'.x,y,z

(The s u b s c r i p t F is f o r "final s e m a n t i c s " ) . Then we have Theorem B. Let g be a cosemicomputable a l g e b r a of s i g n a t u r e the finite s e t of conditional e q u a t i o n s in the s i g n a t u r e

E and let EF be

Z' as p r e v i o u s l y d e s c r i b e d .

T h e n , f o r all t l , t 2 ~ T ( Z ) t h e following holds:

A~

7(tl=t2)

if and only ff

EFkJ { t2=t2} }-- K=S

T h e proof of Theorem B can be g i v e n in complete analogy with the p r o o f of Theorem A. Now consider a computable a l g e b r a

A. Assume that N is as before and z :N->A

such that k e r ~ is r e c u r s i v e . T h e n , define the set E C of conditional equations

in

the s i g n a t u r e ~' b y E c = E V E F. We h a v e Theorem C. Let A be a computable a l g e b r a of s i g n a t u r e Z and let EC be the finite set of conditional equations in the s i g n a t u r e f o r all t l , t 2 e T ( Z )

[ ' as p r e v i o u s l y defined. T h e n ,

t h e following holds:

A~

tl=t 2

if and only if

Ec~--tl=t 2

A¢

tl=t 2

if a n d only if

EC•

and

{tl=t 2 } k--K=S.

The p r o o f follows immediately from Theorem A and from T h e o r e m B We conclude with t h e following two r e m a r k s . Remark 1. In the i n t r o d u c t i o n we said that we would t r e a t the case of s i g n a t u r e Z in a single s o r t in o r d e r to simplify notation. We now want to biefly explain how the method e x t e n d s to many s o r t e d a l g e b r a s . Let

[

be a many s o r t e d finite s i g n a -

t u r e with a finite s e t of s o r t s S. A S - s o r t e d a l g e b r a has a c a r r i e r A s of s o r t s f o r

t20

e v e r y s i n S. We s a y t h a t a S - s o r t e d a l g e b r a N is a r e c u r s i v e

n u m b e r a l g e b r a if

e v e r y c a r r i e r of s o r t s is t h e s e t N of n a t u r a l n u m b e r s a n d t h e o p e r a t i o n s of recursive functions (Cf. a l g e b r a of s i g n a t u r e and r.e. f

[ B - T 86 ] ). We s a y t h a t

/q a r e

A is a s e m i c o m p u t a b l e S - s o r t e d

Z if t h e r e e x i s t s a r e c u r s i v e S - s o r t e d a l g e b r a N of s i g n a t u r e

epimorphism

~ : N -+ A. When s ~ S

~

f

l e t ~ b e t h e s - c o m p o n e n t of

~

S

~.

If

c <s/. is a c o n s t a n t s y m b o l of s o r t s l e t m! s ) b e a n a t u r a l n u m b e r s u c h t h a t ]

]

s (m!sl):] (c~s)lAs =

w h e r e t h e r i g h t h a n d s i d e m e m b e r is t h e i n t e r p r e t a t i o n

of t h e s y m b o l c! s ) i n t h e ]

a l g e b r a A. Let ~ ffs b e a r e c u r s i v e f u n c t i o n of t h r e e v a r i a b l e s t h a t e n u m e r a t e s ker'~ and G

s

be a combinator which represents

s y m b o l f is of s o r t s ]m. . . st i o n of d o m a i n A

-+s i f f t h e i n t e r p r e t a t i o n

x...xA s1

sm

of t h a t s y m b o l i n

A is a f u n c -

and range A . s

I f t h e s e m i c o m p u t a b l e a l g e b r a is i n f i n i t e , t h e n t h e r e is So~ S s u c h t h a t A

is

S O

i n f i n i t e . Now t a k e Z' :

s

t h e f u n c t i o n gs" We s a y t h a t a f u n c t i o n

ZU{o

,K.S}U{Nat}U

{ Horns } s e S

where • is a function symbol of sort s s -+ s O o

O

,

K,S are constant symbols of sort So, Nat is a function symbol of sort s

O

-+So,

Horn is a function symbol of sort s -+s. S

O

Now the proof goes on by replacing, in a obvious manner, axioms E3, E4 and E6 of E. Moreover, the expansion A' of A to the signature Z' is constructed by translating a combinatory algebra in the carrier Aso and by interpreting Nat and Horns in order to codify the recursive S-sorted algebra N in A'. Then, Theorem A works also for many-sorted algebras. The same argument holds for Theorem B and Theorem C. Finally, we notice that if we allow s

O

to be a new sort, we get a result which is

analogous to Theorem 5.3 of [B-T 86] . Remark 2. Let E be a set of conditional equations in a signature Z' which extends the signature 2 . Consider the quotient structure T ( Z ' ) ~E , where -=E is the usual congruence defined by: tl-=Et 2 iff E ~--tl=t2.Then there exists an embedding

j:Z ~--~ T(Z')/~EIZ where the first algebra is the subalgebra of T(Z')/- E generated by the operations

121

of Z a n d the second algebra is the reduct of T(~')/~E~to the s i g n a t u r e ~ . The specification ( ~ ',E) is said to be a hidden e ~ c h m e ~ the initial algebra semantics of the a l g e b r a

Au Z

specification with respect to

A if

: T(Z')/-=EI Z

where the isomorphism into A is induced by the natural evaluation of the terms of

85],

T(Z ) in A (see [E-M Our

Theorem

A proves

ding ] is a retraction, this case we could The

term

Chap.

[B-T 86]). that there is such

i.e. there exists a morphism

say that the specification

consistent

extension

is used

6) in quite similar situations

Then,

according

an isomorphism

to Definition

h such

(Z',E)

3.4 of [B-T

that the embed-

that h o j = identity.

is a ao~istemt

in the literature

but involves

and

In

extension ~or A.

(for example

in [E-M 85 ]

two specifications.

86 ]

we

can restate

Theorem

A as

fellows,

Proposition. The specification method (for a b s t r a c t data t y p e s ) b y means of a finite conditional equation c o n s i s t e n t extension with no additional s o r t s , is complete for the class of semicomputable data t y p e s .

References [ADJ 75 ] J.A.

GOGUEN,

J.W.

THATCHER,

E.G.

WAGNER

and

J.B.

WRIGHT,

Abstract data t y p ~ as i n i t i a l (~gebras and correctness of d ~ a representations, i n Proceedings ACM Conference on Computer Graphics, P a t t e r n Recognition a n d Data S t r u c t u r e , NY 1975, 89-93. [A,DJ 78 ] J.A. GOGUEN, J.W. THATCHER a n d E.G. WAGNER,

An inZ~a~ ~gebra approach to the s p e ~ e a t i o n , correctness and implementation of abstract data types, C u r r e n t t r e n d s in Programming Methodology, Vol. 4: Data S t r u c t u r i n g ( R . T . Yeh, e d . ) , Prentice-Hall (1978), 80-149.

[ADJ 82 ] J.W. THATCHER, E.G. WAGNER a n d J . B . WRIGHT, Data type speaL~eation: parametrization and the power of specifAcation technique, TOPLAS 4(4), 1982, 711-732. [Ba 81 ]

H.P. RARENDREGT, The lambda ealcu~as, i$~ s y ~ a x and seman~cs, North-Holland, Amsterdam 1981.

[B-T 80 ] J.A. BERGSTRA a n d J.V. TUCKER,

~L~e

On bounds for the s p e c i ~ c a ~ o n of data types by means of equations and eondi~onal equations, p r e -

p r i n t IW 131/80 Amsterdam 1980. [B-T

83 ]

I ~ t ~ a ~ and ~ n a l a~gebe~ s e m a ~ c s two characterization theorems", SIAM J. of

J . A . BERGSTRA a n d J.V. TUCKER,

for data type s p e ~ c a t i o ~ : Computing 12 (1983), 366-387.

[B-T 8G ] J . A . BERGSTRA a n d J.V. TUCKER,

Algebraic s p e c i ~ c a ~ o ~ of Computable and Semicomputable Data Types, Department Computer Science Re-

122

search Report CS-R8619, Amsterdam (May 1986).

[E-M 85 ] H. EHRIG and B° MAHR, Fundamentals of Algebraic S p e c ~ c a ~ o n 1, Monograph EATCS, S p r i n g e r - V e r l a g 1985.

~Gr 78 ]

G. GRATZER, U~va~a£ Algebra, 2nd ed. S p r i n g e r - V e r l a g , 1979.

[H-S 80 ]

J.R. HINDLEY and J . P . SELDIN ( E d s . ) , To H.B. Curry: Essays on combinatory logic, lambda-calcal~ and fo~aL~m, Academic Press, NY 1980.

[L-Z 74 ]

B.H. LISKOV and S.M. ZILLES, Programming with Abs~act Data Type, Proc. ACM Symp. on v e r y high level l a n g u a g e s , SIGPLAN Notices 9, (1974), 50-59.

[L-Z 75 ]

B. LISKOV and S. ZILLES, S p e c ~ c a ~ o n teahniques for data abs~acL~o~, IEEE T r a n s a c t i o n s on Software E n g i n e e r i n g 1 (1975), 7-19.

[Ma 71 ]

A . I . MAL'CEV, ConsL~uc~ve algebras I, The Metamathemathics of Algebraic Systems, Collected p a p e r s : 1936-1967, North-Holland.

[M-~ S6 ]

G. MARONGIU and S. TULIPANI, computable types, in p r e p a r a t i o n .

[Mz 79 ]

J. MALITZ, I~L~oducA~on to Math~ma~ca£ Logic, S p r i n g e r - V e r l a g , 1979.

IRa 60 ]

M.O. RABIN, Colpu~able algebra, g e n i a l theory and the theory o~ computable ~eld~, T r a n s . Amer. Math. Soc. 95 (1960), 341-360.

[Wa 79 ]

M. WAND, Final algebra s e m a a ~ and data type extensions, J. Computer a n d Ststems Sciences 19 (1979), 27-44.

[Zi 79]

S. ZILLES, An l~Lzoduc~on to data algebras Lect. Notes 86, (1979), 248-270.

R ~ r k s on complexity ~n speai~y£ng

in Comp. Sci.

O n t h e S e m a n t i c s of C o n c u r r e n c y : Partial Orders and Transition Systems

G. Boudol & L Castellani INRIA

Sophia-Antipolis

06560-VALBONNE FRANCE

Abstract. We introduce an algebra of labelled event structures whose operations are sequential composition, sum, and parallel composition. A transition relation is defined on these objects, where at each step a process performs a labelled poser. It is claimed that the bisimulation relative to such transition systems brings out a clean distinction between concurrency and sequential non-determinism. 1. I n t r o d u c t i o n . This paper may be seen as proposing a tentative synthesis of various approaches to the semantics of concurrency. Milner's work on caIcuii of processes ([17,18,19]) provides our main source of inspiration. Let us recall the main features of such calculi (cf [1]): first there is a syntax which describes abstract programs as terms of an algebra; second there are behavioural rules according to which each term may perform some actions and become another term in doing so. This brings in a notion of tabeIled transitions denoted prog

act

~prof

Finally a semantic equality is defined by means of the well-known notion of bislmulation [21,18,33. This gives the scheme of the following technical material. Plotkin has advocated in [23] that labelled transition systems determined by structural operational rules provide a fairly natural setting to describe the operational semantics of programming languages. This is even more true with regard to parallel programming where one wants to program non-terminating processes, which may communicate during the computations: here functions from input to output can no longer be used as the semantical model. A symptom of this need of a more discriminating model is that a process is sometimes thought of as giving rise to a whole domain of computations rather than interpreted as a point in a domain; this point of view is exemplified by Winskel's work [20,32,34]. We shall entirely adopt Milner's standpoint [18,19] according to which any abstract notion of process must be based firmly upon operational semantics. As a matter of fact, one often uses informal behavioural arguments in order to decide whether some processes should or should not be distinguished. For instance (taken from [5]) one can "prove"

124

(at(b + ~)) + (aib) + ((a + c)ib) = (al(b + 4 ) + ((~ + ~)tb) (we use here a CCS-like notation) by saying that if the left-hand side performs a concurrently to the b of (alb), then the right-hand side is able to do the same thing by choosing a in ((a + e)Ib), and so on, so that no behaviour distinguishes the two terms. We shall give here a precise meaning to such a proof, by means of bisimulations. Bisimulations on transition systems provide a powerful concept (see [1,3] ), but many authors argue ([4,6,28], to mention but a few) that this yields an inadequate description of concurrency; specifically what is questioned is Milner's expansion theorem [17,14], expressing a simulation of concurrency by sequential non-determinism. Roughly speaking (a I b) = ab + ba, thus the parallel composition operator can be eliminated (from finite terms), whence it is not primitive. As a contribution to the theory of "true concurrency", our paper aims at solving

concurrency

#

sequentiality + non-determinism

More precisely our thesis is that this can be solved while still dealing with bisimulatlons on transition systems. Evolving from Petri's ideas [22], there is another way to approach the semantics of concurrency; following this way one thinks of sequentiality as causality, that is as prescribing an ordering on events. Dually, two events are concurrent if they are not causally related. Thus here a computation is a partially ordered set of events rather than a mere sequence. This is by now a widely held point of view; it appears in the early work of Mazurkiewicz on traces [15], which have been related to posets and algebraic structures (monoids) in [16] and [29]. Another generalization of words was proposed by Winkowski [30,31]. Grabowski sets up in [12] a theory of "partial words" that are labelled posets, what Pratt and Gischer call pomsets ([26,10,27], see also [29]). These are also the configurations of Winskel's (Iabelled) event s~ruc~ures, which are posets enriched with a notion of conflict [32,33,34] - a kind of object that Montanari & a/. also deal with [4,7,8]. Fairly close is the notion of process suggested by Petri [22], which is a partial unfolding of a net into an occurrence net (cf [9,11]). Reisig studies in [28] what can or cannot be distinguished according to various notions of computations. By the way, we must point out the fact that almost all the works we have just mentioned model more or less explicitely a process as a "language", that is a set of pomsets; this entails the linearity of sequential and parallel composition, that is their distributivity over the sum interpreted as set theoretic union. Roughly speaking, (a[(b + c)) = (a]b) + (alc) and a ; (b + c) = a ; b + a ; c, a kind of property that does not hold in Milner's calculi of processes. Let us now introduce our contribution: first of all, in order to solve ~ we must start with a formalism in which one can talk about sequentiallty, non-determinlsm and concurrency as distinct notions; this is why we adopt Winskel's (labelled) event structures which are built upon the exclusive relations of causal ordering, conflict and concurrency. Each of these relations gives rise to a way of constructing event structures: one simply juxtaposes two such structures and then sets the relation between their events. These operations are sequential composition, sum, and paralIeI composition; they provide us with a syntax for finite event structures (in this paper we shall treat neither infinite structures nor communication; to get some ideas about these subjects see the full version of the paper [2]). Here comes the main idea. We have already mentioned that an event structure determines a set of computations, what Winskel calls configurations. Then, defining "what remains of the structure" after such a computation we get a notion of labelled transition: here the action (= the computation) is a finite pomset and the reached state (= what remains...) is another event structure. The point is that we generalize what usually is "over the arrow"; a similar idea may be found in [5,8] and it seems that it could be applied to Petri nets where computations are processes (in the technical sense of [9,11]). As a matter of fact, we also extend Milner's idea ([18]) that actions should be elements of a commutative monoid (a similar notion is Winskel's synchronization algebra [33,34]): here we get elements of a "dioid", see below.

125

We also give a structural operational semantics (in Plotkin's style [23,24]) for our "abstract programs", and then show an exact correspondence between the semantical and syntactical notions of transition. Next we define our semantic equality, in the same way as Milner defines his strong congruence, and give an axiomatization for it. We claim that this notion of equality solves ~. Note: almost all the proofs are omitted; more details may be found in [2]. 2. A l g e b r a of L a b e l l e d E v e n t S t r u c t u r e s . As previously announced, our first concern is in labelled event structures. For some technical reasons that will become clear later, our definition is a slight variation of Winskel's one. At some points we shall assume knowledge of the work of Nielsen, Plotkin, and Winskel [20] which shows how to derive (labelled) event structures from some kind of (labelled) Petri nets; thus we shall feel free to use standard concepts of net theory (cf [9]) when dealing with such derived event structures. 2.1 Labelled Event S~ructures and Terms. Let as usual {0,1}* be the set of words over the alphabet {0,1}. The concatenation of two words u and v is denoted uv, whereas the product of two languages L and L' is

LL' = {uv/u e L & v E L'}

DEFINITION. Let A be a non-empty set. An A-labelled event structure (A-LES for short) is a structure (E, <, #, l ) where

(i) E c_ {0,1}*

is the set of events,

(ii) < is a partial order on E, the causaiity relation, (iii) #C_ E × E - (<_ U >_) is the symmetric conflict relation, Ov) A: E -+ A is the labelling function. Note that we do not require Winskel's axiom of conflict heredity. Two events in E are concurrent if they are neither comparable nor in conflict, that is ~=a~

ExE-(u#)

This is a symmetric irrefiexive relation. Note that by definition _< u >, #, and .~ set a partition upon E x E. We shall always draw structures up to isomorphism, that is omitting the name of events; in the figures the order < increases downwards and only one of the remaining relations is explicitely shown. For instance a ~-~ b

I

C

is a structure with three events e, er and e'f respectively labelled a, b and c such that e causes e", e and e' are concurrent and e' and er~ are in conflict. In what follows we let a, b, c,... range over A. We use £(A) °° for the set of A-labelled event structures and Z(A) for the set of finite ones. In this paper we shall only take finite structures into consideration (a more general study may be found in [2]). This set is naturally supplied with an algebraic structure: let V be one of _<, --J, # and So, $I be A-LES's; then So(V)S1 is the structure we get by juxtaposing So and $I and setting the V relation between the events of So and $1. When V is _< this is called sequential composition of So and $1 and denoted So ; $1, whereas if V is --~ this is the paralIel composition So ][ $t and

126

in the case V = # this is the sum So + $I. The formal definition is the following: assuming Si = (Ei,
So(V)SI to

for

i E {0,1}

be (E, _<, #, A) where

E = Eo ~ E1 i.e. E = { 0 } E 0 U {1}El ¢~ i = j a n d x < i y o r V = < , i = O a n d j = l ix <_iV ¢~ i = j a n d x # i y o r V = # a n d i # j ix # j y ~(i=) = ~,(=) These operations are naturally defined up to isomorphism. That is, denoting P ~ Q the relation up and Q are isomorphic",

{

P;Q~P';Q' P + Q ~ P' +Q' P li Q ~ P' II Q'

P ,-~ P ' and O ~ O'

Thus £ ( A ) / ~ inherits the algebraic structure. All that means is that we have a syntax to denote finite A-LES's. This abstract syntax is the set T(A) of terms built according to the following rules: (i) ~ is a term and every atom a £ A is a term, (ii) if p and q are terms then so are (p; q), (p [[ q) and (p + q). Let J(p) be the labelled event structure denoted by the term p, defined as follows: J ( ~ ) = (O,0,0,0)

(the empty structure)

j(~) = ({~}, =,0, ~)

with ~(~) =

:(p; q) = (:(p) ; J(q)) ;(p II q) = (:(p)tl :(q)) :(p + q) = (;(p) + :(q)) The symbol ~. wilI be used also for the empty structure and its isomorphism class. Let us see a few examples: the term (a + b) ; (c II d) denotes the structure a

b

IXI --~ d

c

This and the simpler term (a + b) ; c show why we cannot assume Winskel's axiom of conflict

heredity [32]. The term (a tl b) + c is interpreted as a#c#b (where a --- b, and there is no non-trivial causal dependency) and is an example of "symmetric confusion" (see [9,20]). In the next section we shall characterize both the set of structures which are interpretations of terms up to isomorphism and the interpretation equality

p =J q

*~do~

J(v) ~ ;(q)

127

2.2 Characterization. One may remark that in £ ( A ) ° ° / ~ the three operations previously defined axe associative and have 11 as neutral element; moreover the sum and parallel composition are commutative. This suggests the following definition: DEFINITION.

A trloid is an algebra (T, ;, H, +, l) satisfying the axioms

(i) (T, ;, 1) is a monoid:

A0: (v; (q; r)) = ((p; q) ; r) u0: (p; 1) = p = (1 ;p) (ii) (T, H, 1) is a commutative monoid: AI: (p I] (q ]l r)) = ((p ]l q) ]I r) UX: ( p i l l ) = p = ( l i l P )

c r (v II q) = (q I! v) (iii) (T, + , 1) is a commutative monoid: A2: ( p + C q + r ) ) = C ( p + q ) + r )

u2: (v + 1) = v = (1 + v) c2: (p + q) = (q + p) Let (9 be the equational theory whose axioms are A0 to A2, U0 to U2, C1 and C2, and let = e be the congruence on T ( A ) generated by these equations. Then we have an obvious soundness property: P=eq

~

P=jq

We now wish to check whether a converse compIeteness property holds. First we shall see that not all finite labelled event structures are interpretations of terms. As a matter of fact the structure a

b

c

d

(without conflict) is known to be the typical one that cannot be expressed by means of sequential and parallel composition, cf [10,12,27], We thus want to find a class of A-LES's which does not contain N. In order to define this class and state our characterization result we need to introduce some notations. Let R C E × E be a relation on a set E. (i) R e = R U R -1 U R e is the reflexive and symmetric closure of R, what we shall call the R-comparability relation. (ii) $(R) = (E × E) - R ~ is the symmetric, irreflexive R-incomparability relation. (iii) m R = (R U R - l ) * is the equivalence generated by R whose classes are the connected components with respect to the R-comparability relation. For instance the comparability relations determined by # and ,~ are simply their reflexive closure, whereas the <-comparability is _< U > what we denote (>. In order to avoid many useless repetitions ,he shall name each of the relations <, #~ -~ a connective of a given structure S. The first property we shall require is N-freeness; an A-LES S is N-free if it satisfies

N-freeness

for U a connective of S i[ eo U el and eo ~(U) e~ if e~ U ea and el $(U) e3 then eo U ea ~ e2 U el

128

This property, which is obviously preserved by isomorphism, may be drawn e2

eo

.-I

U

U

t..

U

\1

el

e3

This typically precludes a structure such as a # b # c # d (where a ~ e, b ~ d, and a ~-~ d) which is derived (see [20]) from the Petri net

a

b

e

d

N-freeness is also related to Petri's notion of K-density [22], see [13,25]. N-freeness is not enough by itself to characterize the class of A-LES's denoted by terms. Here we need another requisite which we may call the triangle property: a structure S satisfies this property if it does not contain a configuration A

e Q et # e tt,-~e

This precludes the typical situation of "asymmetric confusion" (cf [9,20] ). In fact the "behavloural" properties of N-freeness and triangle may be combined in a single one - which is less readable but somehow more natural when looking for a property preserved by the operations. LEMMA. An A-labelled event structure S satisfies N-freeness and the triangle property if and only if it satisfies the property

X

for U and V among <,#,~-~ with U • V if eo U ~ el and eo :~(U) e~ if e2 U ~ e3 and el $(U) es then eo V e3 ~ {eo, el} x {e2,e3} C_ V

In the course of the proof (see [2]) we use the fact that N-freeness implies

N'

for U among <>,#,,-, if eo U el and eo $(U) e2 if e2 U ea and el ~(U) es then eo U es ~ e2 U el

This fact will be also used later. We can finally define the intended class of structures as follows: DEFINITION.

The set X (A) is the set of finite A-LES's satisfying the X property.

The set of structures Z (A) is a generalization of Grabowski-Gischer's class of N-free pomsets [12,10]. Clearly the X property is hereditary; this means that if

s'cs

f s =

(~, <,~, ~)

and

3F c E

~,~o~ 1.S'=S[_~=(F, <_n(F×f),#n(F×F),~[F)

thenS'__.S&SCZ(A)

=~ S ' E X ( A ) .

129

We can now state the announced result~ which generalizes Grabowski-Gischer's one.

T~OR~M 1.

The structure (Z (A)/~, ;, it, +, ~ ) is the free trioid generated by A. One especially

has

(3) S E Z ( A ) (ii) p = j q

~, ~

3pET(A) J(p)~-S p =e q

The complete proof is rather long, involving some straightforward parts. Here we only sketch it; more details may be found in [2]. One has to prove that Z ( A ) / ~ - is a trioid isomorphic to T ( A ) / = e . We have already seen that the algebra ~(A)/~---- is a model of the theory ~. Thus the first thing to see is that the operations preserve the X property; an immediate consequence will be that X(A)/~-- is a trioid which contains the interpretation of every term. LEMMA 1.

II So, S 1 E X(A) then So ; S1, So + S1 and SoilS1 are in Z(A)

The proof proceeds by case inspection ,, Next one has to show that each element of f (A)/~-- is denoted by a term of T(A), univocally up to = e . As usual this completeness property lles upon the existence of normal forms for terms. These can be described as follows: let Xt(A) = {~} U ~ ( A ) where ~ ( A ) is the least set of terms built according to the rules

(i) every atom a E A is in ]~ (A) and has no head operator, (ii) i f p E )~(A) does not have ; (resp. II, +) as head operator and if q E ~ ( A ) then ( p ; q ) (resp,

(p II q), (p+ q))is in X(A) and has ; (resp. II, +) as head operator. One gets normal forms by cancelling the unit and using associativity to shift arguments to the right. PROPOSITION. Let F be the theory whose axioms are A0 to A2 and U0 to U2, and T be the theory consisting of A0 to A2, C1 and C2. Then

(i) for each term p C T(A) there exists a normal form t E )¢(A) such that p = r t, (ii) f o r t w o n o r m a I f o r m s t , ff E jg(A) t = o f f ,~ t = T t ' This is a standard result. The proof is omitted. The crux of the characterization theorem's proof is the following property: for every finite nonempty non-atomic labelled event structure satisfying the X property, the set of events is connected for exactly one of the connectives <:, ~ , # (in fact this is a purely graph-theoretical result); this relation gives the head operator of the term which denotes the structure. The existence of such a connective comes from the triangle property, whereas uniqueness comes from N-freeness (or more accurately from 1N'). LEMMA 2.

Let S = (E, <,#,A) be an A-LES in X(A). (i) there exists a connective U o r s for which E is connected, that is ~ ( E / ~ u ) = 1; (ii) moreover if ~ ( E ) > 1 then Z is not connected for the U-incomparability relation $(U), and thus is not connected for any of the other connectives. PROOF. We first show that there is one such relation U, for each S E f (A). Suppose not, and let C be a maximal (w.r.t. inclusion) subset of E connected for some connective. From our assumption C # E, so let e E E - C. Then e is connected in the same way (<>, # or ,--') with all the elements of C, otherwise E would contain a triangle. But then {e} tJ C is, for some connective, a connected subset of E which strictly contains C. Now to prove the second point let us assume that E is connected for both U and ~:(U) for U among <> (since E _<-connected ~=>E <>-connected), # and --~. Let F be a minimal (w.r.t. inclusion) subset of E which is both V and $(U) connected and such that # ( F ) > 1. Then ~ ( F ) > 2 since one cannot build a two element structure which is connected for two exclusive relations. So let

130 ea E F; since F - {ea} is not connected for both U and :~(U), let us assume for instance that F - {es} is not connected for U, that is (F-

{ea})/~u = {FI,...,F,~}

with m > 1

Then

~i (1 < i < m) ~e e F,

ea ~(U) e

otherwise F could not be :~(U)-connected. Similarly

Vi(l
SeEFi

eaUe U Fj. Since

es$(U) eandHbe

iCj 3eEGea:~(U)

e

and

3e I ~ G e a

Ue I

and

Gis U-connected

ODe has

es U e o a n d e o U e l a n d e l $ ( U ) ea

3eoEGSeleG

If we choose an e2 E H such that e3 U e2 we may figure the situation as

F

H

\ U

U e3

By definition of G and H, eo :~(U) e2 and el :~(U) e2, but this contradicts the N t property, which is a consequence of the X property. The proof is the same when F - {ea} is not :~(U)-conneeted a, We can now prove

v s e x(~) 3~ e ~(A)

j(t) ~- s

by induction on the size ¢~(E) of S (in fact the induction hypothesis states t h a t the head operator of the t e r m t corresponds to the unique connective, if it exists, for which E is connected). If • ( E ) < 2 then this is trivial: t is either 11 or an a t o m (given by the labelling function). Otherwise by the previous lemma there exists a connective U for which E is connected and not :~(U)-connected. Let

{ c 1 , . . . , C,,,} = E / - $ ( ~ ) T h e n 1 < m _< # ( E ) . F r o m the definition of the Cg's it cannot be the case that e$(U)e' for some e E Ci and e' E Cj (i ~ j). Suppose now that U is <_ (the other cases where U is # or --~ are similar, and even simpler). Let us see that if e < e I for some e E Ci and e I E C 1 then for all e rr E C a' e < e II whence Ci x Cj C < . Otherwise there would be e0 and el in Cj such that eo < e < el, thus eo < el, and eo # el or eo ~ el, which is a contradiction. Thus we may assume that { C 1 , . . . , C m } is enumerated in such a way that el < "'" < em for some ei E (7/. For all i (1 < i < m) s r o i E Z(A) since the X property is hereditary. Thus by induction hypothesis there are terms t l , . . . , t m of ~ (A) (whose head operators are not ;) such that

Then

s ~ j ( ( t , ; (... ; ~,,)...)) To conclude the proof of the theorem we must show

t,t' e J4(A) The proof of this last point is omitted --

=ez

J(t) ~- J(t') ~g- t =T t'

131

3. O p e r a t i o n a l s e m a n t i c s . 3.1 Transitions on labelled event structures. The interpretation equality = e is too dk~criminating; from a behavioural point of view we would llke to identify the terms p + p and p - in the introduction we have seen another example. Thus we cannot consider equality of event structures to be the equality of their domains of configurations (see [20] ). Nevertheless, the equality we look for is based upon a notion of computation which would be Winsket's notion of finite configuration if we had assumed the axiom of conflict heredity. Note that computations are deterministic: choices (or conflicts) are resolved while a ~program" computes. Computations bear some analogy with processes of Petri nets ([9,11]) or more accurately with l~eisig's abstract processes [28]. DEFINITION. Given an A-labelled event structure S = (E,<,#,A) a computation of S is a structure S [ F where

(i) F is a ~nite subset o r E , (ii) S I R is connict-free: e E F & e' e F ~ -~(e # e') (iii) S [F is closed under non-conflicting causes: eEF&e'<_e&e'¢F

=>

~e"EF

e"#e'

Note that we only allow finite computations, thus we cannot deal with fairness; an idea could be that fair computations are the - possibly infinite, but satisfying an axiom of ~finite causes ~' maximal computations, w.r.t, the ordering C. We shall name action an isomorphism class of computations. In this paper we restrict our attention to A-LES's of f (A). The computations of such structures are rather special: they are finite conflict-free (eiementary in Winskel's terminology) A-LES's satisfying the X property. We denote by 2(A) the set of these computations and by D(A) = ? ( A ) / , ~- the set of actions they determine. In fact D(A) is exactly the set of what Pratt and Gischer [10,27] call finite N-free pomsets. From a theorem of Grabowski-Gischer P(A) is the free "dioid" (Grabowski calls it "double monoid"), which is the same as a trioid but without sum. All that means is that actions are denoted by terms built without sum, up to the equational theory A whose axioms are A0~ A1, U0, U1 and C1. The set of these "deterrninistic" terms will be denoted D(A). For instance, making a confusion between terms and the structure they denote, (a ; c) and (b ; e) are computations of ((a + b) ; c), while ((a ; b) It c) is a computation of (a ; (b + d) IIe ; e). For F C E let

#(F) = {el3e' e F

# e}

From a computation P = S I F of S we build a structure called the residual of S by P which is

(8/P)

S [ ( E - (F u

This structure is "what remains of S after removing P while resolving the conflicts". Clearly S E X(A) implies (S/P) ~ X(A). We are now ready to introduce the main definition which brings a structure of transition system on event structures. Let us recall the terminology: a (labelled) transition system E = (Q, Act, T) is a structure where (1) Q is the set of states, (ii) Act is the set of actions,

(iii) T C_ Q x Act × Q is the transition relation, p ~ DEFINITION. S

-~ S'

p' will denote (p, a, p') E T.

The transition relation ~ between A-tabelled event structures is given by

4~def

P is a computation of S

and S' = (S/P).

Here one can see some analogy with the construction hi b e f o r e h2 g i v e s h of Degano and Montanari ([7]) ifone reads it h hi> h2 •

132

For instance, still using terms in place of the structures, we have

(a;c) '7

((a + b);c)

~l

((~ + b)II ~) ~

One may remark that from the definition a computation of a LES S cannot introduce causal dependencies which would not be already present in S. For instance (a ; b) is not a computation of (a I[ b). We could say that in our behavioural semantics causality =~ temporal ordering

for we have

But the converse is false (consider (a H b) +

b --~ 2-). Thus our semantics makes a strong

distinction between sequence of transitions and "transitions of a sequence" - compare with the CCS "action" a.p. One may also note that the behavioural interpretation of parallel composition is not interleaving, but contains it. This is clue to the fact that an A - L E S may always perform the empty computation; we may interpret 11 as "skip" - when regarded as a computation - or "termination" for instance in a transition S ~

ti. Our semantics of paraIleI composition is

a

generalization

of the MEUE"asynchronous" operator [1] - related to Milner's synchronous product [18] and to the notion of "step" transition of Petri nets [32,28]. 3.2 Transitions on terms. Since we are interested in labelled event structures denoted by terms of T ( A ) an obvious question is: is there any syntactic notion of transition which reflects the semantic one? In fact the (positive) answer is rather simple; let p be the least subset of T ( A ) x D ( A ) x T ( A ) satisfying the following clauses or rules 11 R0: }- p - - - + p RI: a E A

R2:p~v'

~- a a_+ 1]

~ (v;q) u ( / ; q )

(~ ;~),

R3: v ~ v' = e 2., q ~ q' ~ (p;q) R4: p u

p , , q v_+ q, ~_ (pliq)

R6: q v

q, a v ~ 4 e

q'

( u l ] v ) (P'Hq')

2. b ( p + q ) v

qt

(note that r = o 2. can be proved or disproved using only the axioms UO to U2). Since p is the least relation satisfying the given clauses, a transition p ~

p' cannot hold unless it has a proof or

133

construction according to these rules. For instance we have RI : - a

a -?--, 2RI

R5°

:

-

-

C

c72.

P

R3.

((a + b) ;c)

(a;c) P

2.

Now we state the adequation result making the correspondence between transitions on terms and transitions on event structures. THEOREM 2.

(i) p u q p

~

(ii) J(p) U,7 Q

2U J(u) ~ U SQ J(q) ~ Q ~

J(p) U Q 71

3u J(u) ~- U ?q J(ql ~ Q p -~ q

P

/

The proof lies upon an analysis of S --~ S when S is (So ;$1), (So + $1) or (So ][$1) for So # 2. # $1; here one meets a translation of the rules R2 to R6 m 4. S e m a n t i c s .

4.1 Equipoflence. Relative to any transition system ~ = (Q, Act, T) one may define the well-known Park and Milner notion of bisimulation [21,18]. Here we a d a p t Brookes and Rounds terminology (see [3,1]): a relation R C_ Q × Q is

(i) invariant with respect to T if and only if it satisfies pRq

and

p ~p~ T

=~

3q I p ' R q t

and

(ii) a blsimulation (w.r.t. T) if it is a symmetric invariant relation, (iii) an equisirnuIation if it is a bisimuIation and also an equivalence. The invariance property is usually drawn p

--

R

--

q

p~ ...

R

,.-

~

i

q - ~ a q~ T

134

The following fact is standard: LEMMA.

Given a transition system ~ let us define P ×~' q

*~def

3R

bisimulation

pR q

Then x T is an equisimulation and it is the coarsest one. The only point to check is that the composition of invariant relations is itself invariant m We shall call this equisimulation the equipollence with respect to T and sometimes use the alternative notation p × q (T) instead of p x T qWe are in fact interested in transitions labelled by actions, that is classes of structures or terms. Let us ambiguously denote ~PI and IP~ the isomorphism class of the A-LES P and the =e-class of the term p. Then we define the transition relations ~ and

s

s'

, dof

3Q=P

s

[u~ pj P----+

*~def

3v=eu

P V_+pr P

n

s'

We can show that there is an exact correspondence between the "syntactic" and "semantic" equlpoltences:

p × q (#)

¢~

J(p) × J(q) (FI)

(see [2] for a proof). Since isomorphism of A-LES's is an equisimulation a consequence is that P=eq

=ez

p×q(~)

Moreover these equipollences are also congruences with respect to the algebraic structure, that is compatible with the operations ;, + and II. The equipollence ×(~) is what we regard as defining the semantic equality of terms. Thus we just use × to denote it. For instance the three terms (att b), (a; b) + (b ; a) and (a; b) + (a I[b) + (b; a) are pairwise distinct with respect to × since the first cannot perform the action (a; b) whereas the second cannot perform (a ]] b). Another example is

Ca; b LIc)

Ca II ; b + a ; (b II c)

4.2 Axiomatiza$ion. In this section we aim to set up a "proof theory" of ×. It should be clear that F/-equipoltence of elements of P (A) is exactly ~,-~-,for

PeP(A) (P 11 ,Q=P) Thus any intended axiomatization essentially states properties of the sum. As a matter of fact there is a standard way to solve the problem, by means of sumforms as Hennessy and Milner have shown in [14] what we will briefly recall now. For any set Act of actions let K ( A c t ) be the set of terms built according to the following rules: (i) 11 is a term, (ii) for every a E Act if p is a term then a • p is a term, (iii) if p and q are terms then so is (p + q).

135

Let if2 be the theory whose axioms are A2, U2, C2, and I: ( p + p ) = p and g '~he least transition relation on K(Act) given by the rules R01: F a , p a% p

R5": p a_~p, I- ( p + q ) a

p,

R6*: q ~

q'

q' ~- ( p + q ) ~

Then the Hennessy-Milner theorem roughly states THEOREM. Any state of a ~nite acyclic transition system on Act is denoted by a term of K ( Act). For such terms p ×~ q ~ p =e~ q From this result, we just have to find a suitable translation from T(A) to K(Act) (that is an expansion of terms into finite acyclic transition systems) in order to solve our axiomatization problem. A first step is to extend our set of terms to T'(A) which is built as T(A) but with the additional formation rule: (iii) if a e D'(A) and p e T'(A) then (a * p) e T'(A). where D'(A) is the set of terms built from A using ; and ]1 (without ~.). We also extend the transition relation p to p' with the supplementary rule R0' and adopt the previous convention for the meaning of fi'. Axiom A2 allows us to use an ambiguous notation ~ pi for a (finite) sum of terms. Then our axiomatization is as follows: let ~ be the (heterogeneous) theory whose axioms are those of ® plus I and (omitting some parentheses)

BI:

a . ll. =: a for a E A

B2:

(E-,

B4:

J i (a.C~a{.pi));q=a.(Z(ai*pi);q) i i

Bs:

(Ea

i

i

• pi) ; q = E ( @

i

'p

i

• pi) ; q)

IiE*j'qA=Ea

i

J

'(p

IIEZj'qj) + i

E ( ( a ~ II Z~') * (p~ It qi)) + j

i

THEOREM 3. The congruence of algebra -=~ generated by • is invariant with respect to ~t Moreover for each p E T(A) there exists an r e K(D'(A)) such that p = ¢ r. Therefore for p, q E T ( A ) p×q(fi) ¢~ p----¢q The first statement, which implies soundness, namely p = ¢ q =~ p × q (7'), can be shown by a straightforward ease inspection. For the second one, we can prove by induction on p E T'(A) that such a term is convertible by means of the given equations into a "normaI form", which is here either ~. or a term ~-~ial • pi where each Pi is again a "normal form". A consequence is completeness: p × q (fi) =t, p =¢ q (note that ¢ contains the equality theory A for the actions, which is needed to apply Hennessy-Milner theorem) m One could have the idea that this result expresses a reduction of concurrency to sequential non-determinism; however this is not quite right, since actions are posets irreducibly involving parallelism. So the expansion theorem is not so bad. From a semantical point of view, the technique we used is still unsatisfactory since it gives no indication of how one could describe

136

the equipollence classes of A-LES's. Nevertheless our purpose is achieved: we can prove semantic equalities of terms, such as the distributivity properties foreachp~.andq~l~

(p+q);r×p;r+q;r

We can also prove

(a II (b + c)) + (a II b) + ((~ + ~) II b) ~ (~ II (b + c)) + ((~ + ~) II b) or other absorption phenomena (r is absorbed by p if p + r × p, cf [5]). This example can be arbitrarily complicated (see [5] ), so that the existence of a finite axiomatization without extending the syntax or introducing an absorption preorder is doubtful. Note: it can be proved that our equipollence is weaker than the notion of distributed blsimulation of [5]. M. Hennessy has found an example which proves that it is strictly weaker; namely (a IIb + c) + a ; (b + c) --I-(a Nb) + Ca [[ c)

×

(b + ~) + (~ 1tg) + (~ tt c)

but these two equipollent terms are not d-bisimilar. References [1] [2] [3] [4]

[5] [6] [7]

[8] [9]

[10] [11] [12] [13] [14] [15]

G. BOUDOL, Notes on Algebraic Calculi of Processes, in Logics and Models of Concurrent Systems (K. Apt, Ed.) NATO ASI Series F13, Springer-Verlag (1985) 261-303. G. BOUDOL, I. CASTELLANI, Concurrency and Communication, full version of this paper, in preparation (1986). S. BROOKES, W.C. ROUNDS, BehaviouraI Equivalence Relations Induced by Programruing Logics, ICALP 83, Lecture Notes in Comput. Sci. 154 (1983) 9%108. I. CASTELLANI, P. FRANCESCHI, U. MONTANARI, Labelled Event Structures: a Model for Observable Concurrency, in Formal Description of Programming Concepts 2 (D. BjCrner, Ed.), North-Holland (1983) 383-400. I. CASTELLANI, M. HENNESSY, Distributed Bisimulations, to be published (1985). Ph. DARONDEAU, L. KOTT, On the Observational Semantics of Fair Parallelism, ICALP 83, Lecture Notes in Comput. Sci. 154 (1983) 147-159. P. DEGANO, U. MONTANARI, Distributed Systems, Partial Orderings of Events and Event Structures, in Control Flow and Data Flow: Concepts of Distributed Programming (hi Broy, Ed.), NATO ASI Series F14, Springer-Verlag (1985) 7-106. P. DEGANO, 1%.DE NICOLA, U. MONTANARI, Partial Ordering Derivations for CCS, FCT 85, Lecture Notes in Comput. Sci. 199 (1985) 520-533. H.J. GENRICH, E. STANKIEWICZ-WIECHNO, A Dictionary of Some Basic Notions of Net Theory, in Net Theory and Applicatiens (W. Brauer, Ed.) Lecture Notes in Comput. Sci. 84 (198o) 519-531. J.L. GISCHER, Partial Orders and the Axiomatic Theory of Shuffle, Ph.D. Thesis Stanford University (1984). U. GOLTZ, W. REISIG, The Non-sequentialBehavlourofPetriNets, Information and Control 57 (1983) 125-147. J. GRABOWSKI, On Partial Languages, Fundamentae Inforn:mtlcae IV.2 (1981) 427-498. P.A. GRILLET, Maxima1 Chains and Antichains, Fund. Math. 65 (1969) 157-167. M. HENNESSY, R. MILNER, Algebraic Laws for Nondeterminism and Concurrency, JACM 32 (1985) 137-161. A. MAZURKIEWICZ, Concurrent Program Schemes and their Interpretations, Aarhus Workshop on Verification of Parallel Programs, Daimi PB-78, Aarhus University (1977).

137

[16] A. MAZURKIEWICZ, Traces, Histories, Graphs: Instances of a Process Monoid, MFCS 84, Lecture Notes in Comput. Sci. 176 (1984) 115-133. [17] R. MILNER, A Calculus of Communicating Systems, Lecture Notes in Comput. ScL 92

(198o). [18] P~. MILNER, CalcuIi for Synchrony and Asynchrony, Theoret. Comput. Sci. 25 (1983) 267310. [19] R. MILNER, Lectures on a CaIcuIus for Communicating Systems, Seminar on Concurrency, Lecture Notes in Comput. Sci. 197 (1985) 197-220. [20] M. NIELSEN, (3. PLOTKIN, G. WINSKEL, Petri Nets, Event Structures and Domains, Theoret. Comput. Sci. 13 (1981) 85-108. [21] D. PARK, Concurrency and Automata on Infinite Sequences, 5 th GI Conf. ,Lecture Notes in Comput. Sci. 104 (1981) 167-183. [22] C.A. PETRI, Non-sequentiaI Processes, GMD-ISF l~ep. 77-05 (1977). [23] G. PLOTKIN, A Structural Approach to Operational Semantics, Daimi FN-19, Aarhus University (x981). [24] G. PLOTKIN, An Operational Semantics for CSP, in Formal Description of Programming Concepts 2 (D. Bjcrner, Ed.), North-Holland (1983) 199-225. [25] H. PL[INNECKE, K-Density, N-Density and Finiteness Properties, in Advances in Petri Nets 84 (G. Rozenberg, Ed.) Lecture Notes in Comput. Sci. 188 (1984) 392-412. [26] V.R. PRATT, On the Composition of Processes, 9 th POPL (1982) 213-223. [27] V.R.. PRATT, The Pomset Model of ParalleI Processes: Unifying the TemporaI and the Spatial, Seminar on Concurrency, Lecture Notes in Comput. Sci. 197 (1985) 180-196. [28] W. REISIG, On the Semantics of Petri Nets, in Formal Models in Programming ((3. Chroust, E.J. Neuhold, Eds.), North-Holland (1985) 347-372. [29] M.W. SHIELDS, Concurrent Machines, The Computer Journal 28 (1985) 449-465. [30] J. WINKOWSKI, Algebras of Partial Sequences, FCT 77, Lecture Notes in Comput. Sci. 56 (1977) 187-196. [31] J. WINKOWSKI, Behaviours of Concurrent Systems, Theoret. Comput. Sci. 12 (198o) 3960. [32] G. WINSKEL, Events in Computation, Ph.D. Thesis, Edinburgh University (198o). [33] G. WlNSKEL, Event Structure Semantics for CCS and ReIated Languages, Daimi PB-159~ Aarhus University (1983). [34] G. WINSKEL, Categories of h~odels for Concurrency, Seminar on Concurrenc:~5 Lecture Notes in Comput. Sci. 197 (1985) 246-267.

CCS without "o's Rocco De Nicola* and Matthew Hennessy+ * Istituto di Elaborazione delrInformazione, CNR - Pisa +Computer Science Division, University of Sussex - Brighton

Abstract The main point of this paper is that one can develop an adequate version of CCS which does not use the special combinator z ¢br internal actions. Instead, the choice operator +, whose semantics" is somewhat unclear, is replaced by two new choice operators @ and [], representing internal and external nondeterminism respectively. The operational semantics of the resulting language is simpler and the definition of testing preorders is significantly cleaner. The essentialfeatures of the original calculus are kept; this is shown by defining a translationfrom CCS to the new language which preserves testing preorders.

1. Introduction In[MilS0], Milner introduced a calculus of communicating systems which is usually referred to as CCS. It consists of a language for defining communicating systems or processes, a semantic theory for these processes and a calculus for syntactically deriving semantic equivalences. The language is algebraic in nature; it consists of recursive definitions which use a small set of combinators. Each recursive definition or term in the language represents a process and each individual combinator represents an intuitive method for composing existing processes to form new ones. Since its publication CCS has been the focus of a considerable amount of research activity, mainly in the definition of alternative algebraic languages, lAB841, [BK84], [Miln851, [ISO86] and in the development of alternative semantic theories, [BHR841, [DH84], [dBZ82]. In fact these two activities are not unrelated: often the success and elegance of a tractable semantic theory depends on the syntax of the language to which it is applied. The purpose of the present paper is to show that by changing the syntax of CCS slightly, but retaining all of its essential features, we can obtain a much simpler semantic theory than both that originally presented in [MilS0] or in papers such as [DH84]. We start with a review of the language CCS and restrict our attention to the so-called pure version. The most complicated combinator is parallel composition 1: p t q represents a process which has two subprocesses running in parallel, p and q. To explain this construction we need to understand some conventions which are used in CCS. Communication takes place via ports, such ports can be barred, like 13-, or unbarred like t3. These pairs of ports are said to be complementary and processes communicate via

139

complementary ports: a communication or synchronization is taken to be the simultaneous occurrence of two actions: i) accepting a signal at a port such as [5; ~i) sending a signal at a complementary port such as ~-. Thus the combined process above, p I q, can either communicate with the external environment via any one of the ports of its subcomponents or there can be internal synchronizations between the subcomponents, one via the pair of complementary ports such as 13, 13-. There are other combinators which may be used to modify existing processes. For each action, say 15, there is a restriction operator ~ which hides the ports 13and 13% i.e. it makes them unavailable for external communications. There is also a relabeUing operation which simply relabels port names. The combinators we have seen so far do not allow us to define the dynamic behaviour of processes. To do so we have other combinators. For example for each port name a there is a unary combinator ~x.: o~.ris a process which can synchronize via a port labelled (x and then continue to act as process r. Thus processes can be viewed as machines which can perform certain kinds of actions. In pure CCS there is essentially one kind of action, synchronizing at a port. One possible definition of the processes p and q mentioned above, is given by the recursive defmitions: p <== a.lLy-.p

and

q <== l~-.8.y.q.

Conceptually processes can be viewed as black boxes with labelled ports at which they may communicate or synchronize. For example the combined process (p I q)~\y, can be represented by:

!

the only external synchronizations the process can perform are via a and 8. Moreover these are constrained by the internal synchronizations between 15and 15- and y and T- (represented by connected unlabelled ports since they are invisible to the external environment) in such a way that they can only be performed sequentially as in the process r defined by: r <== a.8.r. Indeed the semantics of CCS proposed in [Mil80] is such that these two different processes (p I q)k[]',7 and r are semantically equivalent and the Iaws of the calculus allow one to prove this equivalence using syntactic manipulations. However, two further combinators are needed both for expressiveness and for facilitating these syntactic manipulations. For example the simple process ct.p I 15.q exhibits nondeterministic

behaviour: it can either perform ct or 15. Semantically it is equivalent to the nondeterministic process c~.(p I 13.q) + 13.(cx.p I q). Here we have used the new combinator + : in general p + q can act either like p

140

or like q. So this term represents a process which can either do an o~and then do (p I 13.q), i.e. the residual of c~.p 113.q after performing ~, or do t3 followed by the residual after 13, c~.p I q. This new combinator is not sufficient to express all the forms of nondeterminism which CCS process can exhibit. For example the process (a.x + 13.y) 1(a-.x' + ?.z)\tx can either perform ~ or ? or there can be an internal synchronization between the ports c~ and oc-. To express this, a special action symbol, % is introduced which represents an internal synchronization which can not be influenced by the external world. Then we have the semantic equivalence: (o~.x + ~.y) [ (a-.x' + ?.z)\a = ~ .... + ?.... + z.(x I x'). (Here we have not included the residuals after 1~or 5). The extra term z.(x I x') indicates the possibility" of the process doing an internal move and then acting like the resulting process x I x'. Indeed, these two combinators + and "c play a fundamental role in the theory of CCS. They are used in the

Expansion Theorem of [Mi180] to show that every CCS process is equivalent to a purely nondeterministic process. In general specifications of process are given as nondeterministic processes while their implementations are usually built by combining subcomponents to run in parallel. The Expansion Theorem is used extensively to prove that specifications are equivalent to their implementations. Nevertheless the above mentioned combinators are unsatisfactory from many points of view. The semantic equivalences used in [MilS0] and [DH84], are not preserved by +: they are not congruences. Also + exhibits a rather complicated mixture of intuitively different forms of nondeterministic behaviour, often referred to as internal and external nondeterminism, see [Hoa85] or [OH861. In the process c~.p + J3.q there is external nondeterminism: if the user requests an c( synchronization the process will oblige and subsequently act like p whereas if 13is requested it will also be performed and the process will continue as q. Internal nondeterminism is exhibited in a.p + a.q and o~,p + ~.q. In the first cases the process will oblige when asked to perform an o~ synchronization but the user will have no control over which o f p or q the process will evolve to. The behaviour of processes such as c(p + "¢q is difficult to describe and the operational semantics given in [Mil80] is not very illuminating for such terms. Moreover the need for a special symbol "cto represent internal actions is counterintuitive; if the actions are internal and invisible there should be no need to refer to them in the language or calculus. The laws governing the manipulation of'c in the calculus [HM851 are rather mysterious and to date nobody has been successful in providing an intuitive and acceptable model which explains the nature of 1:. Our suggestion is to replace these two troublesome combinators + and "c with two new combinators [] and q3; intuitively [] represents external nondeterminism and @ internal nondeterminism. Both p[]q and p ~ q act either like p or like q but in the former the environment or the user decides whereas in the latter the decision is made internally and it can not be influenced by the user. The resulting language has all the desirable properties of the original CCS, at least if we base our semantics on the theory of Testing, [DH84], [DeN85b], and not on observational equivalence as in [Mil80]. The equivalence is preserved by all of the combinators, i.e. it is a congruence; we have a modified Expansion Theorem and a complete set of laws and the natural model Strong Acceptance Trees [Hen85b] provides a fully-abstract model. In particular this model gives an intuitive explanation of the two combinators [1 and q3 as functions over trees.

141

We now give an outline of the paper. We stm-t with a basic language BCCS (for Basic CCS) which con'~ins recursive definitions using the main combinators of CCS: * prefixing of actions, parallel composition, restriction and renaming. From this basic language we build two additional languages by adding new combinators. CCS (or more precisely "pure" CCS) is obtained by adding:

nondeterministic choice + and internal action ~. The new version of CCS, which we call TCCS for Testing CCS, is obtained by adding instead: external nondeterminism [] and internal nondeterminism @. For both CCS and TCCS we define a semantic preorder (which generates an equivalence in the natural way) denoted by -< and ~ respectively, In the case of CCS this coincides with the must version of the testing preorders defined in [DH841, and for TCCS it is the natural modification of this preorder. This semantic equivalence is quite different than that employed in [Mi180], observational equivalence, both in its definition and in the kinds of processes it equates. Indeed, to obtain our results it is essential to use testing equivalence rather than observational equivalence as in the latter setting the new operators can not express all the nondetermism expressible in the basic language BCCS. The definitions of the semantic preorders rely on an operational semantics for the languages and that for TCCS is somewhat simpler than the usual one for CCS. All of this is presented in Section 2. In Section 3, we recall the appropriate results for CCS from [DH84], show the modified Expansion Theorem for the new language TCCS and give a complete set of laws for the semantic preorder applied to this language. This last subject is merely sketched as it relies heavily on similar results in papers such as [Hen83], [DeN85b]. In Section 4, we give a translation from CCS to TCCS with the intention of showing that the use of the new operators does not change the essence of CCS. We hope that this is evident from the following properties of the translation , for every process p in the basic language, BCCS, p and its translation 1;r(p) are identical; for every pair of processes in CCS p _
2. Two Languages for Communicating Systems CCS and TCCS In this section we first present the two languages, then discuss the experimental setting for defining testinl equivalences, Both languages consist of a set of operators for constructing new terms from preexisting ones Agents of the languages will be closed terms (i.e. terms without free variables) which can be generated b3 the fotlewing BNF-like schema: ::= x I op(t 1..... tk), op E Y~kl rec x. t

142

where x is a variable and z k is a set of operators of arity k. We use Z to denote u {yk I k >_0}; the set of recursive terms which can be obtained once we have fixed Z will be denoted by REC Z. CREC E is used to denote the set of all closed terms. We will assume an uninterpreted set of elementary (atomic) actions which will be the basic constructors of our processes. In particular we will let • A = {a, 13,7... } be afixedset a n d A - = {cclc~e A }; A = A ~ A- (ranged over by X) be the set of visible actions.

.

The two language we will consider will share a number of constructors listed below together with a short comment on their intended meaning:

Inaction the term NIL is used to represent a process which never performs any action. Undefined the term f2 is used to represent the totally undefined process. Action if p is a term then Xp is a term which represents the process which can perform action ~ and behave like p.

Restriction ff p is a term then p\c~ is a term which represents the process which can perform the same actions as p apart for c~ and c~-.

Renaming if p is a term then p[qb] is a term which represents the process whose actions are renamings via qb of all the actions of p.

Synchronization if p and q are terms then p I q is a term which represents the process which can perform an arbitrary interleaving of the actions of p and q and additionally synchronize their complementary actions. We will call the language consisting of the above operators Basic CCS (BCCS) and use it to build both CCS and the proposed new language which we will call Testing CCS (TCCS). Terms of all the three languages will be built from the BNF-like schema above. In particular, when dealing with BCCS, we will have: ZOBccs = {~q, NIL}; ~;1BCCS = A w{ko~ I o~ e A} w { [~] I d) is a renaming of A which preserves complementation}; ]~2BCCS = [I]; 2 k c c s = 0 if k > 3.

2.1. C C S In this subsection we will give a brief summary of CCS and of the experimental setting and results presented in [DH84]. The resum6 will guide us toward defining experiments, preorders and equivalences on the modified version of CCS. CCS agents are closed terms which can be generated by the syntax above when we take E = ZCCS = EBCCS u [/, +} where z is a distinguished atomic invisible action not in A, and + is the so called choice operator, If t and u are CCS terms then t + u is a CCS term which denotes a process which can behave either like t or like u and the choice depends sometimes on the external environmem some others it is made internally. In the sequel we will let A u {'c} be ranged over by g. Moreover, we will let RECEccs denote the set of all CCS terms generated by the above syntax, ranged

143

over by t, u .... and CRECzccs will be used to denote the set of all closed CCS terms, with p, q .... as metavafiables. CCS has been equipped with an interleaving operational semantics based on labelled transition systems, the transition relation of which is defined by a set of transition rules over agents. A relation ----~--->,catled derivation relation, is defined, in the SOS style [Plo8t], with the intuition that agent t 1 may evolve to become agent t2 either by reacting to a X-stimulus from its environment (tl--X--~t2) or by performing an internal action which is independent of the environment (tl--Z--~t2).

Definltion 2.1.1 Milner's derivation relation tl---g---rt2 is defined as the least relation satisfying the following axiom and inference rules. Act)

ktt---~t---~t

Res)

t 1 ---~t--+ t2

implies t t ~ - - I . t ~ t2x,cx, ~t ~ {~,t~-}

Rel)

t 1 ---ix--> t2

implies tl[~] ---~(~t)---~ t2[qb]

Sum) t 1 ---kt--->t2

implies t l + t - - ~ t ~ t 2

and

t+t 1 ---tl--~ t2

Com) t 1 --Ix--> t2

implies tl!t---kt---~ t21t

and

tit1 ----~--* fit2

tl--X-->t 2 Rec)

and t'l--~.---~t'2

tl[rec x. tl/X]--kt--~t2

implies

implies

tllt'l--~--~t21t'2

rec x. Pl --'#"-> P2'

The derivation relation above completely specifies the operational semantics of CCS; a second level of CCS semantics is defined on top of this to obtain more abstract descriptions of system's behaviours. To this purpose, a notion of testing is introduced in [DH84] which is then used to define equivalence relations on CCS terms which allow one to identify agents which are "behaviourally" equivalent. In [DH84], processes which react in the same way to experiments performed by external observers are considered as equivalent. Observers are just terms over Y'CCS w {w}, where w is a distinguished action symbol, not in A, used as a special action which "reports success" of an experiment. This theory leads to three preorders on processes which are based on the possibilities processes have of always (must) or sometimes (may) satisfying observers. We will concentrate on one of the preorders discussed there, namely on the one which considers as satisfactory only those experiments (sets of interactions between a process and an observer) which always report a success. The outcomes of the interaction between processes and observers are obtained by studying the set of computations which take place because of synchrorfizations between processes and observers or because of silent transitions. To this purpose the notion of complete computation, i.e. of a computation which is either infinite or such that the terminal pair, <state of the process, state of the observer>, can not perform a further synchronization or silent move is very important. Also, to be able to describe the outcomes of experiments on partially specified objects and on terms specified via unguarded recursive definitions, [Mit80], a predicate .t, on CCS terms is also required:

144 Definition 2.1.2. Let $ be the least predicate on terms which satisfies i. 1"~L$, 3.p$, ii. p$ and q$ implies (p + q)$, (Plq)$, (P[q~])$ and (pko~)$ iii. (t[rec x. t/x])$ implies (rec x. t)$ The converse of $ is denoted by ]', i.e. p $ (read p diverges) if not p$ (read p converges). Based on the notions above and on CCS operational semantics we have: Definition 2.1.3 Ifo is an observer in RECEccs u (w} then: p must satisfy o if

whenever plo = Po[Oo-~-*PllOl-X-*.... is a maximal computation then there exists n > 0 such that On--W~ and PklOk]" implies Oh-W---~for some h < k.

¢

This predicate is the basis of the preorder on CCS terms reported below. In its definition and in the rest of the section, 0 is used to denote the set of all the observers in RECzccs u {w}" Definition 2.1.4. p _
2.2. Testing CCS an alternative to CCS The TCCS agents are closed terms which can be generated by the general BNF-like schema above with I; = Y--Tees= YBccs • {[], @} where @ and [] are two new binary operators called internal and external choice respectively. As with p + q we have that if p and q are TCCS terms then p @ q and p [] q are TCCS terms denoting processes which can behave either like p or like q. The choice in the case of p [] q depends on the external

t45

environment while in the case of p @ q is taken internally without the environment having any control over it. We will follow the same notational conventions of CCS also for TCCS terms but we will use capital letters instead of lower case ones. Namely, we will let RECETcC s denote the set of all TCCS agents, T, U .... will be used to range over it, and CRECETcc s will be used to denote the set of all closed TCCS terms, ranged over by P, Q ..... Also TCCS will be given a two level semantics; the first level is given by:

Definition 2.2.1 The n e w derivation relation consists of a pair of arrows, a labelled one, T 1-~N>T 2, and an unlabelled one, T 1 - - > T 2. It is defined as the least pair of relations satisfying the following axioms and inference rules. Act)

XT ~X~> T

Res)

T I ~)~> T 2

implies Tl\Ct -)~-> T2XR, 9~a {a,ot-}

T I - - > T2

implies TI",R - - > T2xR ,

TI-~->T 2

implies T I [~1 -~().)~> T2[~1

t I -~> T 2

implies T 1[~] ~ - > T2[~]

T 1 ~X~>T 2

implies TI[] T -)~~> T 2

and

T [] T 1 -~.-> T 2

T 1 ~~> T 2

implies TI[] TN~> T2 [] T

and

T [1 T 1 ~~> T [1 T 2

and

TIT 1 ~ , ~ > TIT2

Rel)

Ext)

Int)

TI@T 2~~> T 1 and

Com) T 1 -1~~> T2 T 1 N~_> T2 T 1 N~> T 2

Ree)

T 1 @ T 2 ~~> T 2

implies TllT ~)~~> T21T and T' 1 ~~,--> T' 2 implies T l t T - ~ > T21T

implies

T lIT' 1 - - > T21T'2

and TIT 1 - - > TIT2

rec x. T ~~> T[rec x, T/x]

Und) ~ ~ > The operational semantics of the two choice operators and the new invisible move, ~-->, which is different from -'~---~deserve some comments. We have that the two rules for ~ simply say that process P ~ Q could exhibit P's or Q's behaviour since it can perform an invisible move to any of them. In the case of [1 we have that process P [] Q can take a final decision as to which behaviour to exhibit only after performing a visible action; invisible moves leave the choice still open. As for the other operators, the above operational semantics is very similar to the one given in Definition 2.1.1 for CCS. Some differences are however worth noting. There is an axiom also for the undefined process fl and we take a different approach for determining the moves of recursive terms; instead of inferring the moves of a recursively defined term from the moves of their unwindings we simply have an axioms which allows unwinding. Note that they are the particular nature of the nondeterministic operator [] and the different kind of invisible moves which allow us to do this; had we done it for the original CCS and used "~to unwind recursive terms, the resulting semantics would have been very different because unwSnding could preempt occurrences of other actions.

146

As with CCS in the previous section, we can define a set of observers and a set of experiments to define a testing preorder on the new language. Observers are just terms over ZTCCS w{w). The set of all such observers will be denoted by 0 T. Now, the machinery outlined above for the original CCS and the operational semantics for TCCS allow us to have:

Definition 2.2.2. Given an observer O e 0 T we have: P M U S T SATISFY O if whenever PIO = PoIOo ~~> PIlO1 ~~>... is a maximal computation then there exists n _>O such that On--W->

*

Again, by using the above predicate a preorder on TCCS terms can be defined. Note that because of the new semantics for £2 and for recursive terms, we do not need to define any divergence predicate to be able to evaluate the effect of experimentations on underspecified processes or on processes specified via unguarded recursive definition. Indeed in these cases, we will always have an infinite computation from PIO which never reports success, and this means that for any observer O, which does not report success before starting experimentations, we have not( P MUST SATISFY O) whenever P is equal to ~2 or unguarded.

Definition 2.2.3. P <
Proposition 2.2.4. P <_
3. A l g e b r a i c

Characterizations

In [DH84] three sound and complete proof systems for CCS testing precongruences based on testing preorders are introduced which consist essentially of a set of axioms to manipulate process expressions, the usual rules about transitivity and commutativity and a form of m-induction. In [DH84] it is also proved that the set of axioms can be used to obtain three fully abstract models for CCS, i.e. models within which processes are distinguished if and only if they are distinguished by the associated set of tests. Moreover, the models, at first built in a very abstract way from the syntax of the language via a set of axioms [GTWW77], are proved isomorphic to a particular class of trees called Representation Trees. The complete set of axioms relative to the must based precongruence given in [DH84] can be ideally divided in two groups, namely those about the basic processes NIL and £2, the visible actions, the invisible action ~ and the choice operator + and those about restriction, relabeUing and parallel composition. Indeed, the axioms in the second group show that the last three operators are not primitive; every finite CCS term containing I, xt~ or [~] can be reduced to an equivalent one which does not contain these operators.

147

Also for the new language we are able to exhibit a complete proof system, which is based directly on the testing preorder and differs from the previous one only because of the axioms about the parallel composition operators and (obviously) because of the axioms about the new choice operators. Below, we show that the operator for parallel composition can also be expressed in TCCS in terms of more basic operators such as [], @, NIL, f~ and X. First, we fix some notation: If I = [il, i2 ..... in}, we will let o £ [Pi I i E I} denote Pil [] Pi2 [1 ... []Pin ifI ;~{} and denote NIL otherwise. ° I I { P i l i E I} denote PiI ~ P i 2 ~ ... @Pin whenever I e {}The new expansion theorem basically says that a process which can perform an internal communication can be seen as a process which can either perform one of these internal moves to become a new process or stay idle while all potential, visible and invisible, actions are possible. Theorem 3.1 (New Expansion theorem) ffP = ~ {XiPili~ I} andQ = ~ {vjQj Ij ~ J} then P I Q = EXT

if

= (EXT [] IICOM) ® I I COM

COM=~;

otherwise;

where COM= {PiIQj I X i = v j - a n d i e I, j e J))

and

EXT=Y. { ~ ( P i l Q ) l i ~ I}[]Z {vj(plQj Ij e J}

X [] X = X

EXT1

X [] Y = Y [1 X

EXT2

X [1 (Y [] Z) = (X [1 Y) [1 Z

EXT3

X [] NIL = X

EXT4

X@X:X

INTI

X@Y:Y@X

INT2

X@ ( Y @ Z ) : (Xff~Y) ~ Z

INT3

X@Y_<X

INT4

)~X @ IX,Y= X(X @ Y)

MIX1

LX [1 ~,Y = X(X @ Y)

MIX2

X if) (Y [l Z) = (X @Y) [1 (X @ Z) X [] (Y @ Z) = (X [] Y) @ (X [l Z)

MIX3 MIX4

~-~X

UND1

£~ [1X___

UND2 TABLE 3.1.: Axioms for primitive TCCS

148

We are now ready to give the set of axioms for the new language which are sound and complete with respect to the notion of testing defined in Section 2.2. As with CCS, we can define a complete proof system for TCCS and exhibit a concrete fully abstract model based on trees. The tree model turns out to be that of Strong Acceptance Trees discussed in [Hen85a] and [Hen85b]; it is also a subdomain of Strong Representation Trees of [DH84] which is obtained by removing some anomalies of the original domain, namely the dishomogeneity in the treatment of the labels for the root and the other nodes of the trees, which were introduced to deal properly with internal actions. The actual axioms are presented in Table 3.1 and Table 3.2, they have been split to separate those about TCCS primitive operators from those about the derivable operators.

NIL[dp] = NIL

REL1

(X [] Y)[~] = X[dp] [1 y[qb] (X @ Y)[¢] = X[~] q~ Y[q)]

REL2 REL3

~ x [ ~ ] = ~ ( ~)X[~l

I~IA

NILXa = NIL

RES1

(X [1 Y)\a = XXa [] Y'~

RES2

(X @Y)\(z = X~a@ Y'xa

RES3

(pX)Xa = ~(X',a ) NIL

RES4

if p v [ a , a - } otherwise

(X @ Y) 1Z = (X l Z) @ (Y t Z)

PAR1

l f P = E [ ~ i P i l i e I} andQ=Z {vjQj Ij e J} then P IQ= EXT if C O M = O ; = (EXT [] lqCOM) @ 1~ COM

otherwise;

where EXT = Y~ {)t.i(Pil Q) li e I}[] Y. {vj(P [ Qj I j ~ J} and

COM = {Pil Qj I k i = v j - andi ~ I,j E J})

PAR2

f~[¢] = ~

UND3

~\a

= D

UND4

PIg2 = ~

UND5

AlP=

UND6

f~

TABLE 3.2.: Axioms for TCCS derived operators

Indeed we have that the inequations in Table 3.1 are exactly those of [Hen85a], which are there used to characterize the initial algebra isomorphic to the domain of Strong Acceptance Trees. On the other hand we have that the laws in Table 3.2, apart for the expansion theorem, are the same as the ones given in [DH84]. These laws show that the axioms in Table 3.2 are sufficient to reduce every finite TCCS term containing I,

149

\(x or [(1)] to an equivalent one which does not contain these operators. The theorem below states soundness and completeness with respect to testing equivalence of the set of axioms contained in the two tables. We use A I- T _
4. T r a n s l a t i o n :

CCS

-4

TCCS

In this section we present a translation function, i v , which given any CCS term uses induction on its structure to translate it into a TCCS term. The translation leaves most of the language unchanged. In fact, t r , when applied to Basic CCS terms, is just ~ e identity function. It only erases "c actions and translates a term whose main operator is + to a term whose main operator is either [] or ¢ depending on whether + represents internal or external choice. In particular if the term which is translated can perform silent (internal) moves, both the internal and external choice operators are used for the translation; the internal choice operator is however the main one. If' the term to be translated can only perform initial visible moves then only the external choice operator is used to express it. Definition 4.1. t r is a function from RECEccs to RECZTcC s defined by structural induction as follows t r (N~L) = NIL tr(x) = x tr(~) = tr(~p) = ~r(p) t r ( ~ ) = t r (p) t r (p\a) = (tr(p))',a i v ( p i l l ) = (tr(p))[epl t r ( r e c x. p) = rec x. t r ( p ) t r ( p i q) = t r ( p ) I t r ( q ) t r ( p + q) = t r ( p ) [1 t r ( q ) if not ( p - - z - ~ p ' or q - - ~ - ~ p' for some p') t r ( p + q) = (tr(p) [] tr(q)) ¢ I I { t r ( p ' ) l (p--x-~p' or q--~-~ p'}. Some examples should help in understanding how the actual translation works.

150

Example 4.2 i) t r ( a N I L + ~ N m ) = ( a N m [] ~Nm) @ [~NIL; ii) t r ( ( a N I L + ~Nm) I ( a - N m + yqIL)) = ( a N m [] ~NIL) [ (~-NIL[] yNIL); iii) tr(rec x. ~x+ aNIL) = rec x. (x [] aNIL) @ x. Example i) above shows how we translate processes which can perform initial invisible actions. On the other hand, Example ii) shows that the translation of parallel processes is immediate, we simply translate separately the two parallel processes and put them in parallel. Finally, Example iii) shows how recursive terms which contain variables which are guarded by invisible actions are translated into terms defined via unguarded recursion; such terms will lead to diverging computations via infinite applications of the rule rec) of Definition 2.2. I. The translation given above does not change the essence of CCS. In fact, as we have already seen, the two languages share most of their operators, and we also have that the testing preorder defined for CCS and the testing preorder defined for TCCS induce the same identifications when applied to the common sublanguage BCCS. Moreover we can exhibit a theorem which shows that the use of new CCS operators for describing nondeterministic processes does not change the nature of the language whenever testing equivalence is used to describe abstract behaviours. In fact, we have that two CCS terms are identified by a testing equivalence based semantics if and only if also their translations in TCCS via t r are identified. Theorem 4.3. If p, q e CRECzBcC S and o ~ CREC~;BCCS ~ {w} then p must satisfy o if and only if p MUST SATISFY o. Theorem 4.4. If p, q are two CCS agents then p -
5. D i s c u s s i o n The main point of this paper is that one can can develop an adequate version of CCS which does not use the special combinator "~for internal actions. Instead we replace the choice operator +, whose semantics is also somewhat unclear, by two new choice operators @ and [], representing internal and external nondeterminism respectiveIy. The operational semantics for the resulting language is much simpler and the definition of the testing preorder is also significantly cleaner. The reader familiar with [Hoa85] will have already recognised our new operators: [] is the strict version, developed in [DeN85a], oft.he operator with the same name proposed in [BHR84] and @ is the version of fq discussed in [Hoa85] based on the operational semantics given in [Hen83]. In other words the purely nondeterministic part of our language more or less coincides with that of Hoare's language, TCSP. Both languages, TCCS and TCSP share this basis and differ only in the form of parallelism and abstraction they use. So here we have merely employed the theory developed in [Hen83], [Hen85a], [DeN85b] for

151

nondeterministic machines to explain the particular choices of parallelism and abstraction used in CCS (although the transition system on which our new operational semantics is based is somewhat different than that of [Hen831). We believe that this theory of nondeterministic machines is sufficiently powerful to explain many other choices such as those in [BK84], [Hoa85] and [Miln85], at least if one is willing to accept an interleaving semantics. Indeed, the semantics developed in [Hoa85] and [BHR84] for TCSP is entirely denotational and the choice of model has always remained formally unjustified. [Bro83] proposes a set of transition rules for TCSP, however there no account is given of the relationships between the induced operational semantics and the original denotational semantics based on refusal sets. [OH86] proposes another set of transition rules, very similar to ours, and uses the observational equivalence of [Mil80] to abstract from unwanted details, thus obtaining a new operational semantics for TCSP. The denotational semantics based on refusal sets is then proved consistent with respect to the obtained operational semantics, in the sense that it preserves all the operational equivalences between processes. However, no completeness result is given, which guarantees that the denotational equivalences between terms are only those operationally provable. Indeed, we have that the proposed denotational semantics is more abstract than the operational one. The testing preorder developed in Section 2 provides the necessary machinery for defining an operational semantics which is in full agreement with the denotational semantics in the sense that it identifies all and only the processes identified by the denotational approach'based on refusal sets. In fact, it is a simple matter to extend the testing preorder to the form of parallel composition used in TCSP. The domain of Bounded Refusal Sets [DeN85a], a modification of the original model dealing properly with diverging processes which is isomorphic to the Strong, Acceptance Trees of [Hen85b], is then fully abstract (consistent and complete) with respect to this behavioural equivalence. It is worth pointing out that the new operators [] and @ are no longer sufficiently expressive if we use observational equivalence in place of testing equivalence. One can easily argue that the term aNIL + xI3NIL can not be observationally equivalent to any purely nondeterministic process expressible in the language which has • and [1 in place of + and "¢, although we have not explained formally how observational equivalence is defined for the new language.

152

References [AB84] Austry,D. and Boudol,G. Algebre de Processus et Synchronization. Theoret. Comput. Sci. Vol. 30, No. 1 North Holland, Amsterdam, (1984). [dBZ821 de Bakker,J. and Zucker,J., Processes and the Denotational Semantics of Concurrency. Information and Control, Vol 44, Nos. 1-2, pp.136-176, (1982). [BHR83] Brookes,S.D. A Model for Communicating Sequential Processes. Ph.D. Thesis, University of Oxford. Also Carnegie Mellon University Internal Report, CMU-CS-149, (1983). [BHR84] Brookes,S.D,, Hoare,C.A.R. and Roscoe,A.D. A Theory of Communicating Sequential Processes. Journal ofACM, Vol. 31, No. 3, pp. 560-599, (1984). [BK84} Bergstra,J. and Klop,G. Process Algebra for Synchronous Communication, Information and Control, Vol 60, pp.109-137, (1984). [DH84] De Nicola, R. and Hennessy,M. Testing Equivalences for Processes. Theoret. Comput. Sci., Voi.34, pp. 83-133, North Holland, Amsterdam, (1984). [DeN85a] De Nicola, R. Two Complete Set of Axioms for a Theory of Communicating Sequential Processes. Information and Control, Vol 64, Nos. 1-3, pp.136-176, (1985). [DeN85b] De Nicola, R. Fully Abstract Models and Testing Equivalences for Communicating Processes. Ph.D. Thesis, University of Edinburgh CST-36-85, (1985). [GTWW77] Goguen,J.A., Thatcher,J.W., Wagner,E.G. and Wright,LB. Initial Algebra Semantics and Continuous Algebras. Journal ofACM, Vol. 24, No. 1, pp. 68-95, (1977). [Gue81] Guessarian,I. Algebraic Semantics. LNCS 99, (1981). [Hen83J Hennessy,M. Synchronous and Asyncbxonous Experiments on Processes. Information and Control Vol. 59, Nos. 1-3, pp. 36-83, (t983). [Hen85a] Hennessy,M. An Algebraic Theory of Processes. Lecture Notes, Aarhus University, (1985). [Hen85b] Hennessy,M. Acceptance Trees. Journal ofACM, Vol. 32, No 4, pp. 896-928, (1985). [HM85] Hennessy,M., Milner,R. Algebraic Laws for Nondeterminism and Concurrency. Journal of ACM, Vol.32, No. 1, pp. 137-161, (1985). [Hoa85] Hoare,C.A.R. Communicating Sequential Processes. Prentice Hall (1985). [ISO86] International Standard Organization, LOTOS - A Formal Description Technique. Internal Report Twente University of Technology and ISOfFC97/SC21 Draft Proposal 8807, (1986) [Mi180] Milner,R. A Calculus of Communicating Systems, LNCS 92, (1980). [Miln85] Milne,G. CIRCAL and the Representation of Communication, Concurrency and Time. ACM Toplas Vol. 7, No. 2, pp. 270-298, (1985). [OH86] Olderog, E-R, Hoare C.A.R. Specification-Oriented Semantics for Communicating Processes, Acta Informatica Vol. 23, pp. 9-66, (1986). [Plo81] Plotkin,G. A Structural Approach to Operational Semantics, Lecture Notes, Aarhus University, (1981).

A FULLY OBSERVATIONAL MODEL FOR INFINI'IE BEHAVIOURS

OF COMMUNICATING SYSTEMS Ph.

Abstr@~

This p a p e r

Darondeau

is concerned

with

*,

the

B.

Gamatie*

relation

of abstraction

between

operational

and

o b s e r v a t i o n a l m o d e l s for linear time semantics of C.C.S. We construct a compositional and f u l l y abstract model for CCS under infinite (program defined} experiments which gfve maximal power of separation. The construction is in two stages: In the first stage, we use a uniform procedure to translate structural inferential semantics into d e n o t a t i o n a l s e m a n t i c s ; terms a n d o p e r a t o r s a r e i n t e r p r e t e d b y sets of transition sequences and operators on sets of transition sequences. In the second stage, we derive the observational model from the operational model through an adequate homomorphism. The m o r p h i c images of transition sequences, or observations, a r e pairs finite The

<w,R>

or

<W, CO>, where R

(rasp infinite} observational

is a ready

set

sequence of transitions. m e a n i n g s of p r o g r a m s

observations for the order <w, RCYR'> C

<w,R> C

and

w

coincide <w, ~ >

(rasp

~

with

, is

the

visible

trace

of a

the a s s o c i a t e d set of maximal

.

I..~TRODUCTION This paper is concerned with the relation of abstraction between operational and observational models for 'linear' semantics of 'CCS' transition systems [26] [23]. O b s e r v a t i o n a l m o d e l s m e a n here 'fully abstract' m o d e l s for equivalences or preorders induced by (CCS) program defined experiments, such as 'tests' [22] [13,14]. The observational models are naturally homomorphic images of the operational models, but it is not so easy to find out the homomorphism induced by a family of experiments. Indeed, observational models cannot be defined by arbitrary homomorphisms ! A 'concrete' linear model for CCS is the operational model in which programs are rendered by sets of finite and infinite computations. An 'abstract' linear model for CCS is the observational model in which programs are identified if and only if no CCS experiment distinguishes between them. In spite of the effort on models

for testing preorders

[13,20], that very sensitive model has

not yet been worked out, for it has been shown in [10] that some infinite experiments are strictly more sharp than any family of binary tests (finite or infinite). There lays the motivation for the present paper, where we produce the expected model for the full version of pure CCS. Let us proceed to a rapid review of some existing approaches on the side of abstract models, independently of the h o m o m o r p h i s m s which induce them as quotients. First of all, one can distinguish between implicit quotient models and explicit models where explicit representations are dealt with [6] . Further separation may be observed between two classes of explicit models, namely the class of purely order theoretic models and the class of mixed space and order theoretic models. C l a s s i c ~-algebraic domains are most commonly used in models of the first class [7,13,19,20,24]. For the second class of models, the order relation is the reverse inclusion between closed subsets in some metric completion considered

(*)

rR;gA

of languages, trees or tree-languages [11,18,27], and since the spaces have denumerable bases, the resulting complete partial

- Camp,.,s

ae

r~ea.uL~eu

_

F 35o4z

RENNES

CEDEK

154 orders are again ~-algebraic. In the framework of explicit models, it is usually assumed that each element or open set of the denumerable base represents a property that may be tested under finite

finite time

experiments or

fail

[i] , i.e.

under experiments

[13]. Therefore,

identical

which either

meanings

are

succeed

in

necessarily

assigned to CCS programs which differ b y their ~-traces[10]. Notice that this situation is less frequent under the assumption of fairness, since fairness intensifies the separation power of tests, but it arises nevertheless. A possible way out is to work within the bounds of 'uniform' behaviours are then closed sets, and isomorphic semantics infinite streams and from finite observations particular, that property holds for the finite state

concurrency [12] : are obtained from

respectively [ii]. In subset of CCS, obtained

by forbidding the parallel composition and renaming of open terms[8]. There arises from the above review that no well known method is available for associating CCS programs with their compositional meanings under infinite experiments. We think of e x p e r i m e n t i n g on p r o g r a m u as running a maximal computation from the parallel system (t ~C[u]) for some testing program t and program context C. This definition, though a d e q u a t e to de Nicola and Hennessy's notion of testing, departs from it in the definition of the result of experiments. For us, the result of an experiment is the sequence of transitions of the testing program (along that experiment). On that basis, we equip p r o g r a m s with an 'implementation' preorder as follows: u is an implementation of v if and only if no finite or infinite experiment on u tells that it is not v [9,16,21]. The abstract model which we are looking for is the fully abstract model for this implementation preorder. Moreover, we argue that programs identified in that model must be identified in any other observational model, as soon as it relies on the above stated observation principles. Our approach towards the abstract model is progressive and rests entirely on the concrete model which we establish in a preliminary stage. The first stage is to discover the homomorphism which induces the abstract model. The second stage is to construct that model. The first stage amounts essentially to transfer the implementation preorder from programs to sets of computations and then to represent the latters by sets of pairs <w,~> or <w,R> where w is a 'trace' and R is a 'ready set'. On that way, we define an ordered algebra of abstract computations and prove that the abstract meaning of a program is the set of maximal representations of its concrete computations. The second stage amounts to supply a fixpoint characterisation of the abstract meanings of programs in the power algebra of abstract computations. Special difficulties are encountered here, for the 'suitable' fixed points are neither least nor greatest nor optimal fixed points. A plausible explanation for that misfit is the apparent contradiction between two opposite requirements imposed by full abstraction : inobservable actions (e.g.~) must be ignored in the domain of meanings, but they must be accounted for in the fixed point characterization of sets of infinitary traces. To solve the difficulty, we suggest to compute the 'suitable' fixed points as combinations of a least fixed point in the power algebra of abstract computations and of a greatest fixed point in the power algebra of coarse traces (with explicit ~'s). That m e t h o d has the default to split the meanings of open terms in two c o m p l e t e l y disjoint functions, but full abstraction is obtained at the level of closed terms which are given an ordinary compositional m e a n i n g in a single domain. The paper contains nothing about the proof theory for the equivalence in the resulting model. That issue will be considered in forthcoming papers.

155

2...~N OPERATIONALSEMANTICS.~ORPURECCS We p r e s e n t

here

a slightly

augmented

version

of M i l n e r ' s

'pure'

calculus

of

c o m m u n i c a t i n g systems [13,19,23]. The extensions affect u n g u a r d e d recursion and non d e t e r m i n i s t i c choice. As regards syntax, programs are the c l o s e d terms of a r e c u r s i v e t e r m algebra. As regards semantics, the o p e r a t i o n a l m e a n i n g s of p r o g r a m s are sets of t r a n s i t i o n sequences, d e f i n e d by a logical s y s t e m a la Plotkin

[25].

2. I. A syntax of programs We

assume

given

a set

X

(ranged

sets A and ~ of c o m p l e m e n t a r y { ( 1 ) = [ a n d ~ ( ~ ) = ~. A =A

u ~

action partial p(z)=z, The

rasp.

and ~

Throughout

M = Au{z}

(~M)

function

of our

(ranged over by oPi

~0

=

{NIL

Z 1

=

{~ / ~e M}

=

{I,

N

x)

= M~ We

where

call

and

two

almost

is

disjoint

bijections

~ rasp.

~ (~ A )

a renaming

p(9)=D

algebra

) are the following

variables,

we let k rasp.

{~},

such that

term

of

l i n k e d by reciprocal

unless both entities

recursive

Zi

by

names,

the paper,

inaction.

p from N to N

a n d p(~)= ~(p(~))

signature

resp.

is the

over

action

~:

9 range over

the

invisible

function

any

one-one

every-where,

Q(~)=~,

are undefined. is ~ = ~ 0 u

~I ~ ~

sets of i-ary symbols

' where

the

:

},

+,

u {p / p is a renaming

function},

e}.

Binary operators I, +, ~ are the u s u a l a s y n c h r o n o u s composition, choice a n d internal choice. The b i n a r y operators are u s e d in i n f i x e d

external form, the

guarding operators (~) are p r e f i x e d , and the renaming operators (p) are postfixed. O u r set of r e c u r s i v e open terms is the set T E R M with t y p i c a l e l e m e n t s t as follows : t = x In the

I o p i (tl,---t i ) I t wh above

function

D

valuations

line, with

(xl=t I ,...

finite

D(xi)=

ti

domain

(x i = tl,..,

xn

Xn=t n ) stands

= t n ). for

a

'declaration',

dom(D)={Xlt..~x n } ( c X

) and

i.e.for

a

corresponding

(6 TERM).

The o p e r a t i o n (.) wh D, when a p p l i e d to t e r m t, binds the free occurences of the x i to the t i in t and in the tj. R e c u r s i v e open terms are d e f i n e d up to the G - c o n v e r s i o n of t h r o u g h o u t the p a p e r no c o n f l i c t

arises

their bound variables. F o r all terms, that any two d e c l a r a t i o n s have disjoint

between

free v a r i a b l e s

and bound

we shall assume d o m a i n s and that

variables.

Owing

to

that

convention, the set theoretic union (D u D') of two d e c l a r a t i o n s occuring in a given t e r m is always a declaration. Terms without free v a r i a b l e s (i.e. closed terms) are c a l l e d p r o g r a m s . The m e t a v a r i a b l e s s, t, u, v will be u s e d to d e n o t e g e n e r a l terms, i n t e r e s t e d in programs

a n d in p a r t i c u l a r p r o g r a m s and in their computations.

(e

PROG).

We

are

mainly

156

2 . 2 . An operational semantics for programs A computation

is

between

programs.

visible

or

a finite

or

Transitions

invisible

actions

infinite are

sequence

either

(l or ~),

steps

or

of of

transitions

evolution

ti-Vi-gti+l

resulting

self-transformations

of

from

programs

with no a c t i o n involved. In the last case, label ~ appears as a w i t n e s s for the flow of time. According to P l o t k i n ' s method of structural inferential semantics, t r a n s i t i o n s are d e f i n e d b y a finite family of schemes of axioms a n d rules of inference

for relations

u _v_~ v in PROG x N

x PROG.

The set T of transitions

is the least subset of PROG x N x P R O G c l o s e d under f o l l o w i n g system, stated in G e n t z e n like style.

logical

inference

in the

AX I OM$. ~t -~-~ t t @ u -~-9 t ,

t @ u -$-) u

NIL wh D -~-~ N I L x W~ D

_C_+ D (x) w_h D

for D (x) d e f i n e d

(~t) wh D

-(;-+ ~(t wh D)

(tp) wh D

-(;--> (t wh D)

( t o p 2 u) W_h D

-(~-9 (t W_h D) oP2

(u ~th D)

(t w h D) w h D'

-~-~ t W/l (D u D')

RULES ( t+u -~-~ t')

(t -~-+ t')

( tlu

(t -~-~ t') ( (t-~-~

t')

, (u _l_+ u') (tp

(t -~-~ t')

Except

for

) ~

the

u-transitions

axioms are

( tlu -z-+ t'tu')

_p(D)_~ t'p)

( t oP2 u -~-)

(t -~-~ t')

, ( u+t -~-~ t')

-~-+ t'{u ) , ( ult -~-~ ult')

of

meant

i_~ p(~) defined

t'oP2

internal

to

give

u),

choice,

an

all

the

operational

d i v e r g e n c e due to u n g u a r d e d r e c u r s i v i t y are the c h a r a c t e r i s t i c m a r k of u n g u a r d e d

u oP2 t')

( u oP2 t -(~-9

axioms

flavour

to

: infinite sequences divergence.

and

rules

the

notion

for of

of u - t r a n s i t i o n s

2 . 3 . A concrete linear model A denotational c o m p u t a t i o n s can the

full

m o d e l w h e r e p r o g r a m s are i n t e r p r e t e d b y sets of i n f i n i t a r y be d e r i v e d from the above d e f i n i t i o n s (this is a c h i e v e d in

version

of

the

paper) . Such

a

model

is

a

bridge

between

the

o p e r a t i o n a l d e f i n i t i o n a n d the o b s e r v a t i o n a l m o d e l which we are l o o k i n g for, since the latter is n o t h i n g but a morphic image of the former. For the sake of conciseness, necessary

the

p r e s e n t a t i o n of the

description

We d e f i n e

*T

(resp.~)

that y6 .IN (resp. yE ~ u The f i n i t a r y functions,

resp.

operational

of the c o r r e s p o n d i n g as the

{~})

where t -)t means

set of sequences

and V i < y,

infinitary

model

domain

meanings

st or

(ti-Di-~ ti+l) of p r o g r a m s

t = £t or t =

is r e d u c e d

here

to the

of interpretation. (ti-Di-~ti+l)i
such

e T.

are given

(t -~-~ t')t':

by the

following

157

[I I] op : PROG -~ P (*T)

[I I]~ O p

: PROG -+ P

: [I t I] op = {re *T / t -+ t }, ~o

(~)

: [I t I] op = {t e ~ /

In the sequel,we let t range over ~ ,

t-> ~ }.

and we let Q range over P (~°T) .

The set oc~ m a y be o r d e r e d by. the p r e f i x order on sequences ; it may also be c o n s i d e r e d as a c o m p l e t e m e t r i c space, u n d e r the m e t r i c t o p o l o g y i n d u c e d by the u l t r a m e t r i o d i s t a n c e of [5].Limits in the Scott t o p o l o g y i n d u c e d b y the order p r e f i x coincide indeed with limits in that m e t r i c topology. Now, for t in PROG,

[ItN~op is prefix closed and t o p o l o g i c a l l y

closed,

and [Itl]*op is equal

to [Itl]~opc~ *T, whence [Itl]~op is the topological closure of [Itl]*opThe i n t e r p r e t a t i o n s Z-operators

9/~k : P(*T) k-) P(*T)

are the union additive

(*T) k -~ P(*T)

and ~ k

and ~ k

extensions

: (~)k_+p(~)

: p(~)k

of

'elementary*

of

the

convention

o p e r a t o r s are i m p l i c i t l y extended, w h e n e v e r necessary, extensions. However t h e r e is an e x c e p t i o n in the

(u-~-~v)"

:

w.r.t, c_ in the

that

functions

and

along union additive case of the 'funny

d e n o t e d ",", an operation which has a central

model and which is defined as follows

for the

operators D_llk :

(so they are continuous

complete lattices P(*T) and P ( ~ ) ) . In the sequel, we m a k e h e a v y use

concatenation'

_> p ( ~ )

importance

in our

• : T x c~]. __~ p(o~]r) :

~t = {~u' (u-~-+v) }'

(U-D--)V)" (ti-Di--)ti+l)iV) (ti-~)i--gti+!) i<~ / (V=to' ~
-+P(~),

and in the special case Q = O,

we set : (u-D-~v) "Q = {~u' (u-D-+v) }" The i n f i n i t a r y finitary continuous

operations

operations extensions

is as follows,

9-1~k :

~k

:(~)k

of the latter.

letting

CL(Q)

+p(~]-)

(*T) k _9 P ( * T ) , and

are strongly d e p e n d e n t

on the

for

as

The precise

Pref(t)

mean

they

are

statement

defined

the

of the dependence

respectively

the

topological

closure of Q and the set of finite prefixes of t : °P---k(~i' " " "~)

= CL(DIZk (Pref (ti) .... Pref (~)) ) .

The finitary operations 9 ~ k : (*T) k_+p(,][) are d e f i n e d by six families DI-D6 of inductive relations (drawn from the o p e r a t i o n a l d e f i n i t i o n of (2.2)). These r e l a t i o n s are also v a l i d for the i n f i n i t a r y o p e r a t i o n s ~ k , although they do not d e f i n e them. For that reason, the u n d e r l i n i n g or s u r l i n i n g of o p e r a t o r symbols is o m i t t e d from the f o l l o w i n g table. To keep r e a s o n a b l e notations, definitions,

we

let

ts =

(s-9-et)t t and

tu =

with t-+tt and v-->tv. The notation

(u-

"[cond,

cond then Q1 else Q2'" THE INTERPRETATI_Q~ OF E IN *T ~ ; D ~ NIL = {~NIL )

D_2 z(t t) = (~t - ~

t). tt

D-~ (~t)p = {£tp],

(ts) p = [D~ dom(p), D-{ ~t + ev = {~t+v } '

{~sp}~

-~v) tv

(sp _p(D)_~ tp) • (tt)p]

everywhere

in

the

QI, Q2]" reads as : 'if

158 (S+v _D_) t), t t ,

ts + 8v = [D~$, £t + tu = [D' #~, ts + t u = [D#~, u

(s + u _D_~ t)tt ' (s+u _D_~ t+u)°( t t + [~'~,(s

D ~ £t (9 gv = {Etev"

is(9 ~v

(S+V-~]-gt+v)'(tt + £v)],

(t + u _D'_~ v)" tv, (t+u _D'_~ t+v)°(Et + tv)] '

+ u -~'-~ v) tv,

(t(gv-~-9 t),

= {(s (9 v - ~

v}u

tu) ]

is+u -~'-~ s+v)-( ts + tv)]

(t(gv -~-~ v) ),

is (9 v - ~

s)ot s

(s (9 v -~-~ t (9 v)'( ~t(9 £v )' O],

U [ ~ = ~,

St (9 ~U = { (t (9 u -(~-~ t)} <9 (t (9 u -~-~ u)°t u U[D' = ~, t s (9 tu =

u - c o t • v).iete tv), 0],

(t

(s • u - ~

(s (9 u -O-~ s)° ts U U[D

=

u). tu

(s @ u - c ~ t e

C,

U [D' = ~,

(s • u - ~

u).( tt • tu), 0] s • v)o( t s G tv), O]

D6 ~t lev = {etlv}, ts [~v = ((s[vl - ~

itlv)).( ttJ~v~,

Et I ts = ((tlu) -%)'-') (tlv))'(E t I tv), tSl tu = ((S[U) _D__> (tIu))'( tt[ tU))

u

[~'=~eA,

The following propositions proposition [[ oPk(tl,---

hold

V oPk e ~

(is[u) -~-~ it[v)).( tt[tv),O]

:

, V ti6

PROG ,

tk)I]*op = 9/2k([I tl l]*op.... [I tk I]*op )-

DrODositiQn

V OPk e ~k, Vti 6 PROG

,

[[ oPk(tl .... tk)l]~op = ~k([l tl l]~op .... [[ tk l]~op) •

3.

AN OBSERVATIONAL PREORDER_WITH HIQH pOWER OF SEPARATION

Our f o r e t o l d objective was to develop for CCS a model in w h i c h programs identified

if

and

only

difference between them.

if

no

(CCS)

program

where u is said to be an implementation

only if no finite or infinite experiment 'experimenting'

parallel

system

on

program

(t ~C[u]),

result of the experiment

experiment

makes

the

In fact, we construct a model for an 'implementation'

preorder between programs,

of

defined

are

u

as

of v if and

on u tells that it is not v. We think

running

a maximal

for some t e s t i n g p r o g r a m

computation

t and context

on

the

C[?].

The

is the sequence of transitions

of the testing program

(along that experiment).

The introduction of infinitary

results,

the

"classical"

binary

results

of

tests,

is

motivated

by

as opposed to the

fact

that

159 infinitary results yield a strictly higher power of separation, highest possible $o,

any

power of separation

observational

model

quotient

(by some equivalence)

present

section,

implementation

we

give

between

as regards


on

and indeed the

CCS-programmed

CCS-experiments)

is

experiments.

necessarily

of the model which we are looking for. a

precise

definition

and

show

programs,

then

of

how

the

that

In the

relation

relation

a

of

may

be

transferred from programs to their associated sets of computations. We introduce

in this alinea precise terminology about computations.

denote some computation trN(t)

is the word (Di)i< ? of N ~, and the refined trace of t

is the projection on A ~.

If trA(t)

Let t

(ui -Di-) Ui+l)i< ~ in ~T. The coarse trace of t (denoted

~A(trN(~), is £

(denoted trA(t))

where N A is the usual morphism projecting N ~

(the empty

trace),

then

computation

t is said to be

s i l e n t . For t in PROG, we let MSC(t) be the family of M a x i m a l Sileni Commutations from t, that is to say, the set of computations which are maximal w.rot. ~ (the order prefix) a pair

of

minimal

computations

(w.r.t.

notation,

the

extensions, MSC

<2)

( t u ~ v)

in the

operations

is a p a r a l l e l

set

~k

{(~u, tv)

~rE

decomposition (tultv

: (~T) k -~ P ( ~ T ) ,

)).

and

of ~ if it is

(For the

their

union

ease

of

additive

are given the simpler notation oPk in the present section). For tE

(ulv), we let R2(~)

projecti~/l

in {t / t e [It l]~op A trA(t) = ~}. For ~ 6 MSC(ulv),

of

some

denote the set of computations tv which are the second

parallel

decomposition

(tu,tv)

of t.

Finally,

we

let

Twincomp be the set of parallel decompositions of maximal silent computations. definition Let u, v e PROG. Program u is observatienallv

le~_ than program v

(u ~< v) iff ~ t e PROG, ~ 2

(MSC(ult)) ~ H 2 (MSC(vlt)) . Program u is an implementation program

c o n t e x t s C[?]

,

where

Q~ program v a program

(u~v)

context

iff C[u] ~ C[v] is

a

closed

for all

term

with

possible occurences of the dummy constant "?". Examples • (u+v)~

The reader can convince himself that: u ~ u ~u + ~v,

~v+u~(u+v)

+ ~v,

• v,

(x w_hh x = ~x) ~

A natural way to find out a fully abstract model p r e o r d e r from p r o g r a m s to sets of c o m p u t a t i o n s resulting equivalence of sets of computations

u ~ ~ u,

(x w__hh x = x ) .

for_~< is to transfer that and then to analyse the

: the canonical morphism induced

by the equivalence yields the fully abstract model. This program is undertaken in the next series of statements. definition Let t, t' e ~ . Computation t is o b s e r v a % i o n a l l v _ ~ if kft"e ~]-, (t,t") 6 Twincomp

~

than computation t' (t~< t') if and only

(t',t") E Twincomp.

160 We let~< denote also the Hoare like extension of.~< to P(~°T) x P ( ~ T ) , the binary relation Q I ~ proposition 1

Let

of

¢~ (Vt 1 6

V u,v e PROG : u,~< v

definition property

Q2

t be

stabilitv

the

(Stable(t))

Q2, tl ~t2)oo

<=> [I u I] op ~< [I v H~°op

computation

e x t e n d e d b y any silent t r a n s i t i o n t is stable,

QI, 3 t2 e

that is

(ui-~]i-gui+l)i
if it is finite (for all

Then

(It 1= ~#£0)

t has

and cannot

(u-D-+v) e T, u = uy ~

De

A).

the be If

then ~ has a residue Res(t), defined as the ready set of u~{ r i.e.

as the set of labels

{}~6A

/(3 v,

(u?-l-)v)

e T)).

proposition 2 V t, t' e ~ , ~< t ' iff the following relations hold

:

- trA(t ) = trA(~'),

(Stable(t)

A

It' I ~£0)

~

(Stable(~')

^ Res(t')c_ Res(t)) .

The interest of propositions 1 and 2 is to suggest an abstract model for CCS, and a way to derive the semantics in that model from the operational semantics studied in section 2. In fact,

the observational

preorder~<

on programs

is not

p r e s e r v e d by all c o n t e x t o p e r a t i o n s a n d d i f f e r s f r o m the i m p l e m e n t a t i o n p r e o r d e r ~ ( o f course, the d i s c r e p a n c y between ~ a n d ~ s t e m s from the operation of sum (+)). In order to cope with the problem, we shall now try to guess the adequate transposition of the i m p l e m e n t a t i o n computations and sets of computations.

preorder

(from

programs) to

definition Let t, t' 6°~[. (~£t') -

if and only if the following relations hold

:

t~
- (Stable(t) A

Stable(t') A trA(t)

= £) ~

(Hz(trN(~'))

= £

P(~T)x P(=T), that is

We let ~ denote also the Hoare like extension of ~ to the binary relation Q I ~ Q 2

¢~

(Vile QI, 3 t2e Q2, t l ~ )

proposition 3 V u, v e PROG

:

One

the

of

the

main

proposition, that

goals

of

u ~v

i.e. the implication

result,

implementation

we

conclude

preorder

the

~

next

section

languages.

The variation

congruence

present

unguardedness

of

section

studied here coincides

recursive

to

[I v l]~op . establish

induced by

the

d e f i n i t i o n s from

on

a

u~v.

the

reverse

Anticipating

short

with a variant

w h e r e the inclusion

concerns the p h e n o m e n o n

relation

is

•

: [I u l]~op~ [I v I]~op ~

(see also [15] for a s t r o n g e r form), trace languages is r e p l a c e d by an the

[I u I]~op ~

[Iz (trN (t)) = ~).

remark: t h e

of that of

[17]

inclusion betweenfinitary between infinitary trace

of divergence. preorder "pure"

of

More precisely, [17]

divergence,

~eparates i.e.

the

presence of i n f i n i t e sequences of i n t e r n a l actions. This separation c o r r e s p o n d s to a further e x t e n d e d notion of t e s t i n g where t e r m i n a t i o n can be observed.

161

4. ABSTRACTCOMPUTATIONS

The s e c t i o n p r e p a r e s the c o n s t r u c t i o n of a m o d e l for the i m p l e m e n t a t i o n p r e o r d e r on p r o g r a m s . We d e f i n e 'abstract c o m p u t a t i o n s ' , which represent a c t u a l c o m p u t a t i o n s b y pairs e n c o d i n g their p r o p e r t i e s w.r.t, p r e o r d e r ~ . We then c o n s t r u c t an o r d e r e d Z - a l g e b r a of a b s t r a c t c o m p u t a t i o n s a n d lift the operators to the power algebra• We show the m o n o t o n y of the lifted operators, and s t u d y some p r o p e r t i e s of the r e s u l t i n g Z - i n t e r p r e t a t i o n . We then turn o u r s e l v e s to e s t a b l i s h a c o n n e c t i o n b e t w e e n the o p e r a t i o n a l i n t e r p r e t a t i o n (P(~), { ~ k } , E~ ) a n d the a b s t r a c t i n t e r p r e t a t i o n , and settle a morphic c o n n e c t i o n b e t w e e n the two ordered Z-interpretations. ~ e f i n i t i o n An

'abstract computation'

is a pair <w,R> of one of the forms

or or < z , i > or <~,S> where Z 6 A ~, The

set

(A, ~ ) of a b s t r a c t

z e A* and S is a finite subset of A.

computations

is p a r t i a l l y

order relation satisfying the following axioms,

ordered

by the

for z • A * and S " c

least

S'c S ~ A

< z , ± > E ~ E , . <£,S'>E<~,S'>~<~,S">E<£,~>.

The i n t e n t i o n s b e h i n d following statement. proposition follows : Itl = 0)

1 ~

that

(Vt, t' e ~T)

tc~'

$(t) =
Itl ~(0 A ~Stable(t)

~

definition

are

¢~ # ( t ) c @(t'),

^ (trA(t) ~g v

(Stable(t)

A trA(t)

completely

for ~ : ~ T - +

clear

A

in

defined

the

as

(0>

@(t) =
(Stable(t)

made

~(trN(t))

= g m ~%(trN(~))

i>

= £))

~(t) = (~(t) = < % R e s ( t ) >

~£))

PrOO[. The v e r i f i c a t i o n is straightforward, and we leave it to the reader as a useful exercise for a full u n d e r s t a n d i n g of the above definition• In all the sequel, we let a sets of abstract computations). on P ( A ) ,

(resp. A) denote abstract c o m p u t a t i o n s (resp. We also use c to denote the Hoare extension of

i.e. the relation A I ~ A 2 ¢~ ( V a l e

goal is to introduce

a series

OPk6E.

corresponding

Before

the

of e l e m e n t a r y

i n t r o d u c i n g an a u x i l i a r y operator (Q) which we define as follows• Let N = @

: N~x

(N × (£}) k2 ({~} × N)

N ~ -+ P ( N ~)

definitions on words,

<J {(l,~)

: N ~ -~ N ~ x

N~

morphisms ~;i :N*--}N* and ~/2 :N*-) N * X ~ *

• ~2(n) = n

for n e N,

3a 2e

are

n a m e l y the

/ ~ eA

is the function w ' O w "

for ~/i : N ~ -9 N°° and V2

AI,

operations

A2, a l ~ a 2 ) . oPk

Our next

: Ak--~ P ( A ) ,

given,

we

'parallel

}. The p a r a l l e l

need

for still

composition'

composition

= {w / (w',w") 6•2(•i-I(w)) }

defined as the continuous extensions oI as follows

:

162 ~2(nn')

=

(n]n'irn2n'2)

The e l e m e n t a r y

for

operations

of statements,

where

oPk

~;2(n)=(nl,n2}

: A k --> P ( A )

set brackets

and

~2(n')=(n'irn'2)

are given

are o m i t t e d

by the

from s i n g l e t o n

following

table

sets.

OF _~ IN

INTERPRETATION

D'I NIL = <~,~>, D'2 ~<w~R> = [~ E A,
{~}>, ] k)

~

(R 6 ~hen

{±,C0}

v w ~

[~t = ~, <w,R>,

{g,~}) <~w,R>]

[~ =t, <~,R>, <~,R>], D'~ <w,R>p

= /d[ w ~

(dom(p)) ~ then O

else

[R 6 {±,0)}, , <w,R> + <w',R'>

=

[(w ~ e v R = CO), <w,R> [{w' ~ £ v

R' = ~),


, [R = i, <e,±>

<w',R'>,

[(w = £ A W' = £ A {R,R'}C~ D'5 <w,R>

(9 <w',R'>

= {<E,I>,

D'~ <w,R>

] <w',R'>

= ~

else

if

<w,R>,

(R = I v R' = I

{<w",l>

else

{
v

/ w" e[I A R kJ

, 0]]

u

[R' = ±, <e,±>,

{3_,(0} = ~ ) ,

~]]

<J

,

~],

<w',R'>},

(R = CO v R' = (0)

then

p(R • dom(p))>],

Lhen

3%, l e R

{<w",

A

~e

co> / w" elJA(W

O w')

R')

(w O w') }

R'> / w" ellA(W 6) w~)}~

letting h(w")

=

[IIA(W")#£,

IIA

(w"),

[IIg(w")#£,

g, el].

In o r d e r to c o n s t r u c t the i n t e r p r e t a t i o n of the f u l l y a b s t r a c t m o d e l in prospect, we lift the a b o v e d e f i n i t i o n s to sets. However, we put s p e c i a l r e s t r i c t i o n s on the l i f t i n g process, for we care to obtain a complete partial order with m o n o t o n e and continuous operations. D e f i n i t i o n s follow. Our

domain

of

incomparable D=

{A 6 P ( ~ ) /

Thus,

interpretation

elements,

( V a l , a 2 6 A)

/) is the image of P ( ~ ) = {a E A / (Va'£

The

interpretations

formula

:

oPk

oPk(Al,...Ak)

p~oposition

2

set

(al~_a 2 ~ through

A)(ac_a'

of

subsets

possibility increasing chain

(A' is

roof(U that,

O)-ehain

roof

'roof' : P ( A )

((<S,±>)

A / A e D)). some

abstract

can exist by the d e f i n i t i o n

a

e

u

upper

Let's A',

(L9 oPk

-=

on A .

generic

(al,...a k) / a i e Ai)) .

are stated below.

suppose

there

by the

~3

semi-lattice,

computations of

-~'-+ D :

in ~ are g i v e n

~

Z-interpretation

is a complete

for of

pairwise

a'=a) }.

(3i, A i = O)

of the resulting (~, c, O)

function

~

b o u n d of subsets given by ~ D = roof( k)A / A e D). pToof It is e n o u g h to e s t a b l i s h the simpler p r o p o s i t i o n (kfA' 6 D)

of ~ with

a I = a 2) }.

: ~ k __>i] of o p e r a t o r s = if else.

Some p r o p e r t i e s

/) is the

i.e.

is (a i)

with the least upper

:

it is false; in

(LJA/A

with

e

then the only D)

a o = a.

a But

strictly no

such

163

p/Lqp_~sition 3 (D, E ,{oPk} ) is a continuous E-algebra. proo~

The

lemma

given

afterwards

shows

Continuity follows by the implication

that

operations

: aeoP2(~D,

A') ~

OPk

are

monotone.

3 Ae D, aeoP2(A,A')

and variants of it. lemma For any oPk in Z, for any ai, a' i in A , (a ~ < £ , ~ )

A (Vi, a i ~

a' i) ~

proof by systematic examination

and for any a in oPk

(al,..a k) :

(3a' e opk(a'l,...a'k) , a ~ a'). of all the possible cases

(left to the reader).

We finally establish the m o r p h i c connection between the o p e r a t i o n a l E-interpretation of section 2 and the abstract Z-interpretation of the present section. proposition.

4 Let

computations,

and let ~ : P<(~T)

~(Q)=

P~(~T)

roof(U{#(~)/t

(P<(~T),

denote

the

-~ D

and (D,

of

prefix

closed

subsets

of

be the function:

• Q}) . Then $ acts

{ ~ k / OPk e Z}, ~ )

set

like

{oPk},

a morphism

between

structures

~ ).

5. FULL ABSTRACTION AND TRACE_SS Our present goal is to establish full abstractness (w.r.t. the observational A preorder ~<) of the function [l.l]obs : PROG -~ D : NtNobs = ~ [Itl]'opWe recall from equivalence

•-a)

[22]

that

full

abstractness

[lUl]obsc [IVl]ob~ ~

Due to propositions 3.1, property of m o n o t o n v :

~ON)

expressed

by

the

logical

V c[?], C[u] £ C[v].

3.3 and 4.1,

V c[?],

is

FA follows

[lUJ]ob~ =_ NVl]ob~ ~

easily

from the

following

[IC[u]i]obS m [IC[v]1]ob~-

Indeed, the general version of MON follows from the specialized version given below for declaration contexts D[?] : A A ~ A (MON-D) V D[?], ~[lul]~op c_ ~[]vH o p ~ ~[I x wh D[u] l]~op _~ ~[[x W]l D[v] []~op" In the operational

model

sketched in

(2.3),

[Ix wh D[u]

l]~op turns out to be

the p r o j e c t i o n along the x-component of the greatest solution of a parameterized system Gu(~) of Z-equations in P(~T) n. The parameter of that system is Nu I] op and the interpretation

of E is according to the definition

given in (2.3). Now, M O N - D is a direct consequence of the following two implications, where l.f.p. (g.f.p.) is the combinator of least (greatest) fixed point in (P(~T),_c) n, I]x is the projection along x, and k is the componentwise

difference between vectors of sets

:

A A A (MON-LFP) ~[~UN~op C ~[Iv~]~op ~ ¢(l]x(l.f. p. ~ U ( ~ ) ) ) C

A

(MON-GFP)

A ~(l]x(l.f. p. Gv(~))),

A

~[lul]'opm ~[Ivi]~op $(l]x(g.f.p.Gu(~)

k 1.f.p. ~u(~_))) c_ ~(l]x(g.f. p. ~v(~{))).

184 Relation

MON-LEP

fixed points of

the

follows

easily

(of continuous

l.f.p,

eombinator

Relation MON-GFP is not d e v o t e d to that task.

from the usual

operators) (using

the

so e a s i l y

properties

: the trick morphic

proved.

of m o n o t o n y

is to shift

properties

The

remaining

of least

~ on the

of of

~

right

w.r.t.

the

~) .

section

is

Tra~s

We introduce is

the

states which

as

for

omitted.

As

are

valid

operations Omk:

a Z power

same

~k

(N*)k

Z

for

(P(N~)r

algebra

computations

: (N ~ ) k _) p ( N ~) -) P ( N * ) ,

finitary

of ~races

power

regards c o n t i n u i t y

CL(9~Zk(Pref(wl),... The

algebra

the

and

fixed

remain are

the

according

{~k},

~)"

points,

valid

in

the

extensions

of

to

The c o n s t r u c t i o n

computations, bu{

of

the

all

with

the

new

framework.

finitary

formula

~k

program

properties The

operations

(Wl .... Wk)

=

Pref(wk))).

operations

9/Ik are d e f i n e d

by the

also valid for the infinitary

operations~

the function:

(~B) U

DoB = {£,D} u

THE INTERPRETATION

following

inductive

k, where • : N

x P ( N ~)

relations, ~

P ( N ~)

is

(DPref(B)).

OF Z IN N *

AND N ~

D"I NIL = (g} D"2 B(w) D"3

= Bo{w}

(e) p =

{e},

(Dw) p =

[D £ dom(p) , { g } ,

D/Li £ + e =

Dw + S = D e { w } 9w + D'w' = D"5

E~£

=

~w @ S

~ I E=

=

£ + 1]w,

[n=$,$e(w+D'w'),

n°w] U

[D'=G, ~°(gw+w')t 9'°w']

{e,G},

= Co{gw}

9w ~ 9 ' w '

aZl

p(~)-(w)p ]

{£},

= ~gw,

= ~ 0 {gw} u ~°{D'w'}

u

[~ = c, ~ - ( w @ ~ ' w ' ) ,

u

[9' = ~, ~°(9 w @

0]

w'),

0]

{~),

~w!~'w'

= ~.(wI~'w') U

u ~'.(~wlw')

[~ = D ' e A ,

~°(wlw'),

~

]

IZ-VeCSand substitutions We

introduce

denote the

a countable

respectively

set of finite

it has an infinite to

indicate

finite with

that

set

of

variables

by Z ~ the set of finite a n d infinite number

T is

trees

on Z~I.

of operators

a finite

[ITI] in N ~.

A tree

T in Z ~

m a y be

The interpretation

with

typical

A tree

of

syntactic

is c a l l e d

interpreted

by

of finite trees

T', order,

element

Z-trees,

G on each infinite

approximation

and is less than T' in the usual

NIL.

I,

and infinite

a good

branch.

which

a corresponding is defined

We

tree

if

We use T<~T'

means

where ~

i.

and by Z~(1)

that

T is

is identified set

as follows

of words :

165 [! NIL

I] = {e},

[E ~T i] = ~'[l T l], [I oPk(T1 .... Tk)

I] = 9/~k([} T1 I],

The i n t e r p r e t a t i o n

.

o

.

[I Tk i])-

of infinite trees is d e f i n e d by continuous

extension of the

: HTH = CL(k9 [IT'I] / T'<~T).

finitary interpretation

We call ~ u b s t i t u t i o n a m a p p i n g S from I to N =. For T in Z ~ ( I ) , denotes the result of applying substitution S to tree T.

Sub(T,S)

Towards a proof of MON-GFP The following property of the projection operator I]A:P(N ~ ) - ~ P ( A ~) proposition

1 For any finite tree T and for any substitution

~A[ISub(T, S)l]

is useful:

St

= I]A[ISub (T, I]AoS)I].

We state afterwards proposition

2

satisfying

I]AoS(i)

Let

two other propositions T be

a

= S'(i)

good

tree,

which entail MON-GFP. and

let

S

and

S'

be

substitutions

for all i 6 I. Then for any word w 6 [[Sub(T,S)]],

either we [ISub(T',S)H for some finite approximation

T' of T, or [IA(W) = IIA(W')

for some infinite word w' in NSub(T,S')[]. proposition satisfying

3 S(i)

[ISub (T, S) l],

Let

T be

a

good

= I]AoS'(i)

tree,

for all

[IA(W) = ~A(W')

and

i e

let

I. Then

S

and

for

S'

any

be

substitutions

infinite

w o r d w in

for some infinite word w' in [[Sub(T,S')I].

6. H E F U L L Y OBSERVATIONAL MODEL

The

declared

o b j e c t i v e of the p a p e r

was to supply

model,

where the gauge for the c o m p a r i s o n

family

of C C S e x p e r i m e n t s

function

with

[I.l]obs: PROG - + D ,

continuous

algebra

(D,

infinitary

results.

stated in section c

{oPk})

is

CCS with

of programs

the

a fully

abstract

is the largest

possible

The

5, allows

full

abstractness

us to assert

interpretation

of

such

of

that the a model

A

Further,

the

relation

construction the

of the

operational

transposition (X-9

D) . A

replacement

[[tHobs = #[ItN~op suggests

abstract

model

through

is a m e a n i n g simple

model. The m e t h o d the

abstraction

function

optimization

of

Vobs the

us a m e t h o d amounts

for the explicit

to a t r a n s p o s i t i o n

morphism

~. The result

: TERM --> (ENV -9 D ) ,

where ENV =

transposition,

the

of Vobs[It wh ~I] (e) by V obs[Itl](e)

namely

I.

V o b s [~ x l](e) = e(x), Vob s [I oPk(tl,---tk)

uniform

yields the following definition.

THE S~ECIF!CATION OF V o b s

2.

of

of the

~](e) = op k( Vobs[~ t I ~(e),...Vobs[Itkl](e)),

166

3. If D = (x I = Vl,... Let ~ = (Xl,...Xn), For X i •

D

x n = Vn) ' ~ = (Xl,...Xn),

and F i : ENV -9 D

F i (e) = Vobs[~Vi~ (e) , then

given by Vobs[It wh DI] (e) =

VobsNtl] ( e [ f i x D - r ( e [ ~ / ~ ] ) / = ~{rk:

The

everywhere There

specification

] ).

remains

in the d e f i n i t i o n of D

remains

• = (FI,...F n)

to give the

correct

if

<w,l>

is

converted

right d e f i n i t i o n

for the

f i x e d point

fix D , where the notation indicates a possible dependence

= {a e A / Va'e

omega(B)

A, a Ea' ~

= {<w,~> / w= ~A(W')

fixD.~(X)= ~OOF(I.f.p.

F(X

letting ~ = (F~ .... F~) and F~ : ( X

: ) %~ O ~ G A

(g.f.p. ~ ( ~ ) ) ) ,

--)P(N~))

P ( N ~))-9 P ( N ~ ) )

-+ P ( N ~ ) :

Vtr is o b t a i n e d

by

a transposition

However,

in the for

propositions of Vob s at

specification

all

proper

5.2 and 5.3. the

level

auxiliary m e a n i n g

of Vtr(t),

subprograms programs

function

and

operational

That

meaning

~(ti-Di-gti+l)i
we let ~A(Vobs(U))

u of t.

Furthermore,

of

= Vtr[IVil](e)

~w' for some <w',R'> ~A}.

of the

function through the abstraction morphism V: (~T)-gN~:

~([lul]~op)

Fq(e)

the auxiliary m e a n i n g function d e f i n e d

afterwards. Let ~ A : D - 9 P ( N ~) be the 'projection' ~ A ( A ) = { ~ A ( W ) / W function

s.t.:

:

- For closed declarations D, we state

The

functions

a' = a} and

for some w' 6 B ~ N ~ ] .

- For open declarations D, we state f i x D . ~ ( ~ ) = 1.f.p.F(~).

for Vtr: TERM -~ ( ( X - 9

combinator

on declaration D. The

results p r e s e n t e d in section 5 lead us to p r o c e e d as follows. Let roof : P ( A ) --> D and omega : P ( N ~) -9 D be the roof(A)

into

and the related operations.

play the role of

replacement

agrees

with

it affords a compositio]l~

expression

closed

though

declarations,

even

an

is called for. We also p r o c e e d to the optimization

of the transposition by reducing uniformly Vtr[It w h ~I](e)

to

Vtr[Itl](e).

T~E SPECIFICATION OF Vtr

0. If t6 PROG then otherwise

Vtr[It~](e) = [IA(Vobs[Itl](e')) VtrHtl](e)

for arbitrary e ~ •

is defined by relations

1 to 3.

I.

Vtr[IXl](e) = e (x) ,

2.

Vtr[~OPk(t 1 .... tk) l](e) = oPk(Vtr[~tll](e) .... Vtr[Itkl](e)),

3' .If D is a ¢losed declaration

(x I = vl,.., x n = v n),

let HDNob s = ( Vobs[IX1 wh Dl](e') ..... Vobs[IX n wh D] (e')), for arbitrary

e'e

(X-+

D),

and let ~ = (Xl...Xn),

Vtr[It W ~ D ~](e) = VtrHt~( e[[1A([IDnob s) / =]), 3" .If D is an ~ let

declaration

-~ = (Xl, ...Xn) ,

(x I = Vl,... Xn = Vn),

X = (Xl,...Xn),

F = (F I, ...F n)

then

( X -9 D),

167

for X ie

P ( N ~)

and F i : (X

-~ P ( N ~ ) )

g i v e n b y F i (e) = ~,Vtr[IVil] (e) , Vtr[It ~ h D l](e) The outcome 2heorem. and thus

V t e PROG, Vob s

then

= VtrHtl](e[g.f. p.

of the definitions

-9 P ( N ~)

F

(e[~

is t h e f o l l o w i n g

/ s]) result.

Vobs[Itl] (e) = #[Itl] op f o r a r b i t r a r y

is a f u l l y

abstract

model

/ ~])

environments

e

: X

-~ ~ ,

f o r CCS.

BIBLIOGRAPHY

[i]

A b r a m s k y S. Experiments, Power domains, and Fully Abstract Models for Applicative Multiprogramming FCT 83, Borgholm Springer-Verlag, LNCS 158 (83) pp. 1-13

[2]

A r n o l d A., D i c k y A. An Algebraic Characterization of Transition System Equivalence, Report 1-8603, Universit@ de Bordeaux {86)

[3]

B e k i c H. Definable Operations in General Algebras, and the Theory of Automata and Flowcharts, IBM Laboratory Vienna (69) also in: Programming Languages and their Definition, selected papers of H. Beki$ , Springer-Verlag LNCS 177(84)

[4]

B e r g s t r a J.A., K l o p J.W., O l d e r o g E.R. Readies and Failures in the Algebra of Communicating Processes, Report CS-R8523, CWI, ~ s t e r d a m (85)

[5]

Boasson

[6]

B o u d o 1 G. Notes on Algebraic Calculi of Processes, Logics and Models of Concurrent Systems, K. Apt. ed, NATO - ASI -Series, Springer-Verlag (85) pp. 261 - 304

[7]

B r o o k e s S, R o s c o e A. W. An Improved Failures Model for Communicating Processes Seminar on Concurrency, Brookes Roscoe Winskel eds. Springer-Verlag, LNCS 197(85) pp. 281-305

[8] [9]

D a r o n d e a u Ph. K o t t L. On the Observational Semantics of Fair Parallelism, ICALP 83, Barcelona, Springer-Verlag LNCS 154 (83) pp. 147 - 159 D a r o n d e a u Ph. About Fair Asynchrony, TCS 37 (85) pp. 305 - 336

[i0]

"

[ii]

d e B a k k e r J . W . , M e y e r J . J . C h . , O l d e r o g E.R. Infinite Streams and Finite Observations in the Semantics of Uniform Concurrency, ICALP 85, Naflion, Springer-Verlag LNCS 194 (85) pp. 149 - 157

[12]

de Bakker J.W., Meyer J.J.Ch., Olderog E.R., Transition Systems, Infinitary Languages and the 17 TM ACM STOC, Providence (85) pp. 252,262

[13]

d e N i c o l a R., H e n n e s s y M. TCS 34 (84) pp. 83-133

L.,

Nivat

M.

Adherences of Languages,

JCSS 20 (80) pp. 285 -309

Separating and Testing , STACS 86, Orsay, Springer-Verlag LNCS 210 (86) pp. 203 - 212

Z u c k e r J.I. Semantics of Uniform Concurrency

Testing Equivalences for Processes

168 [14]

de

[15]

Gamatie

Nicola R. Testing Equivalences and Fully Abstract Models Processes. Ph. D Thesis, University of Edinburgh (85)

for Communicating

B.

Observational Congruences of Non Determini'stic RR - 254 - IRISA Rennes (85)

and Communicating

Finite Processes

[16] Safe Implementation MFCS 86, Bratislava,

Equivalence

for Asynchronous

Springer-Verlag

LNCS

233

Non Deterministic

Processes

(86)

[17] Towards Specification and Proof of Asynchronous Systems, STACS 86, Orsay, Springer-Verlag LNCS 210 (86) pp. 203 - 212

[Z8]

Golson W., Rounds W. C. Connections Between two Theories Metric Spaces and Synchronization Trees Information and Control 57 ( 8 3 ) pp.102-124

[Z9]

Hennessy M., Plotkin G. A Term Model for CCS Springer-Verlag LNCS 88 ( 8 0 ) pp.261-274

[20]

Hennessy

[21]

Jorrand P h Specification of Communicating Processes and Process Correctness, 5 TM Int. Symposium on Programming, Turin Springer Verlag LNCS 137(82) pp.242-256

[22]

Milner

[23]

"

M.

R.

Acceptance

Trees,

Fully Abstract Models

A Calculus

of Communicating

JACM 32

(85)

pp.

of Typed lambda-calculi

Systems

,

Springer

of Concurrency

896 - 928

,

Implementation

TCS 4 (77) pp. 1 - 23

- Verlag LNCS 92

Hoare C.A.R. Specification Oriented Acta Informatica 23,1 (86) pp. 9-86

[24]

Olderog E. R., Processes ,

[25]

Plotkin G. A Structural Approach to Operational Semantics, Rept. DAIMI - FN - 19, Univ. of Aarhus, Computer Science Department

(81)

Pnueli A. Systems,

[27]

Rounds W. C. On the Relationships Between Scott Domains, Synchronization and Metric Spaces, Information and Control 66 (85) pp. 6 - 28

[28]

Tarski

A.

A Lattice Theoretic Journal

of Mathematics

Structures in the Semantics Springer - Verlag LNCS 194

for Communicating

E26]

Pacific

Linear and Branching ICALP 85, Nafplion,

Semantics

(80)

Fixpoint

Theorem

and Logics of Reactive (85) pp. 15 - 32

and its Applications,

5 (55) pp. 285 - 309.

Trees

SMOLCS-DRIVEN

CONCURRENT

CALCULI

Egidio Astesiano - Gianna Reggio Department of Mathematics, University of Genova Via L.B. Alberti 4, 16132 Genova, Italy Abstract It is shown how to derive, following the principles of the SMoLCS methodology, a family of calculi, suitable for the specification of concurrent systems and languages. A calculus consists basically of a language for expressing behaviours and their parallel composition together with the rewriting rules defining their semantics; formally it is a calculus associated to an algebraic parameterized specification: for every choice of the parameters we fix one calculus in the family. The distinguishing feature of our calculi is that the combinators for behaviours include functional abstraction and application, so that behaviours can be passed as arguments and obtained as results of functions; in general behaviours can be seen just as a data type and in this sense our calculi can be higher order calculi with behaviours as fast class objects. 0 INTRODUCTION 0.1 Generalities on the SMoLCS approach SMoLCS is an integrated methodology for the specification of concurrent systems and languages developed mainly by the authors (JAR1, AR3]), in cooperation with M.Wirsing ([AMRW, ARWl]). The typical fields of application of SMoLCS are large systems, multilevel architectures built from systems with different granularity, complex concurrent languages with modules and interference between sequential and concurrent features. For the specification of concurrent systems, SMoLCS has been applied to specify the internode communication architecture of the project Cnet (a local net of workstations) (see [AMRZ1, AMRZ2]). As a method for the specification of languages, it is the methodology chosen for the formal definition of the dynamic semantics of Ada ® in the CEC-MAP project ([AGMRZ, CRAI-DDC]). The roots of SMoLCS, both for inspiration and technical ideas, are in the work of Milner on CCS and SCCS [M1, M2], of Plotldn [P] on SOS, of Broy and Wirsing on partial data types [BW1, BW2] and of Wirsing and Sannella on algebraic specification languages [W, SW]. On these roots SMoLCS has grown into a precise coherent framework, whose distinguishing features we briefly summarize. The specification of a system is obtained as an instantiation of a parameterized data type, following a schema based on an operational intuition of a process as a labelled transition system and of a concurrent system as resulting from the composition of the component subsystems. The abstraction from the Workpartly fundedby CNR Italy and MP140%. ® Ada is a registeredtrademarkof the U.S. Government,Ada JointProgramOffice.

170

operational intuition is obtained by a schema ensuring the existence of an observational semantics, represented by an algebra. By concurrent system we mean a labelled transition system built from some subcomponents: these subcomponents are of two kinds: active, called process~, and passive, called global objects. Each active subcomponent is in turn modelled as a labelled transition system. A transition represents an action and the difference between the two kinds of subcomponents is that the passive ones cannot perform any transition by themselves; they change their states only as a consequence of a process transition. A state of a concurrent system is modelled as a set of states corresponding to its subcomponents; the transitions are inferred from the transitions of the active subcomponents in three steDs: synchronizatig~, narallelism, monitoring. This SMoLCS schema can be expressed in an algebraic parameterized way so that every instantiation on the appropriate parameters, defining the information for synchronization, parallelism and monitoring, is an abstract data type (see [AMRW, ARW3]). The definition of a SMoLCS specification of a system is modular and hierarchical. More precisely every composition step is a parameterized abstract data type specification: for example the synchronization step STS takes as parameters the specification of a transition system PROC-SYST (representing the processes) and an algebraic specification GOBJ (representing the global objects) and gives a labelled transition system STS(PROC-SYST, GOBJ) whose transitions represent the synchronous interactions between processes. Together with an initial algebra semantics, corresponding to an operational semantics, the SMoLCS approach supports, with explicit linguistic constructs, the definition of an observational semantics again via a parameterized abstract data type specification, where the parameters correspond to a formalization of the observations. Every instantiation of such schema admits a terminal model, called concurrent algebra, in which two states of the concurrent system are equivalent if and only if they satisfy the same observations; moreover every subcomponent of the state gets an observational semantics by closure with respect to state contexts (see [ARWl] for foundations). Note that this is just an existential definition, to guarantee consistency; for any instantiation such observational semantics has to be characterized more explicitly, by suitable equivalences on the derivation trees associated to states and subeomponents. The above schema permits to formalize observationally various semantics as inpuVoutput, streams semantics, strong equivalence, classes of bisimulation equivalences and test semantics. The SMoLCS semantic d..efinition of a langu.a.g~is compositional (i.e. is a homomorphism from a syntax algebra into a semantic algebra). It is done in two steps (see [AR1]): in the first a set of clauses, called denotational clauses, one for each syntactic clause, defines a translation into an intermediate language, with appropriate combinators for handling concurrency; in the second, a SMoLCS specification is given of the abstract concurrent system corresponding to program executions, with its semantics defined by an appropriate concurrent algebra. The denotational clauses can be given both in the Oxford continuation style ([AR1]) and in the VDM-like direct semantic style ([AR2]) also for a comparison; but note that they can be seen just as algebraic axioms, that the general semantic definition is just the specification of an abstract data type.

171

0.2 Concurrent calculi The main aim of SMoLCS is to provide a precise formal framework which can be adapted to the level of the system to be specified. Then, since the overall approach is that of partial abstract data types [BW2], in order to derive the properties of the specified objects we can use an adaptation of the usual machinery of partial abstract data type specifications. This machinery consists mainly of the proof techniques associated to a specification seen as a logical rewriting system and of the associated tools. In particular for the specifications we use in SMoLCS, an initial model always exists where equality and definedness coincide with provable equality and definedness. Hence a calculus is naturally associated to each of our specifications; because of the form of the axioms, it can be seen that this calculus corresponds to an operational semantics for the specified concurrent system. As for the tools a specific rapid prototyping tool has been developed for SMoLCS ([Mo]) which is a variation of the RAP system [H], specially tailored to the structure of SMoLCS. It consists of a concurrent symbolic intepreter, which can derive transitions for a specified concurrent system, and of a translator which, taken the denotational clauses specifying the semantics of a language, can convert a source program into a program written in the intermediate concurrent language. In the above sense a SMoLCS calculus is the one associated to a SMoLCS specification. In the ~ t ~ of the paper we illustrate this point of view by means of an example, which also introduces the use of processes as data types and of functional combinators. Correspondingly to the parameterization principle of SMoLCS, within a schema for defining synchronization, parallelism and monitoring, one can define for each specification appropriate combinators on processes. This possibility enhances flexibility and allows to write high level specifications, without the need of, so to speak, translating into a fixed language. However all this freedom has its own disadvantages, especially for deriving properties of the specified system. Indeed, to this end it is much easier to have a fixed set of combinators, with a well established set of properties. We propose in this paper a balance between these two attitudes, consisting in a family of calculi, where we have a fixed set of combinators for describing a kind of basic processes, called behaviours; but where there is room for fixing some parameters related to various data structures and to decisions about the interactions between processes. The result is a parameterized calculus, which is introduced in the 12~ of the paper. The two essential features of this calculus are the use of functional combinators and the possibility of having processes as data types. One of these calculi has been used as the intermediate language in the two steps SMoLCS definition of Ada [CRAI-DDC], a project where we have learnt, for example, that the use of functional combinators is essential for giving denotations to procedures as functions from values into processes, and for keeping high-level and modular the definition Then in the third Dart we begin to study the properties of our combinators w.r.t, a basic observational equivalence, corresponding to the strong bisimulation equivalence of Milner and Park. Under some restrictions, various properties of combinators are shown, nicely corresponding to our intuition. But all the given properties hold without restrictions for the full calculi and a generalized notion of strong equivalence; the complete theory will appear in a more technical paper.

172

1

SMoLCS S P E C I F I C A T I O N S AND C A L C U L I

Technical

preliminaries. In the following we refer to [BW2] for a precise definition of the concepts

related to abstract data type techniques; but let us give some informal expIanations. By an abstract data type specification we mean a signature and a set of axioms. Since we use a partial data type approach, i.e. the value of an operation can be undefined for some arguments, also definedness predicate symbols are used, one for each sort, to say that an object is defined; all are indicated by D (the sorts can be deduced from the context). Axioms are always first order formulas in positive conditional form, i.e. of the form A e i ~ e, where e can have form either D(t) or t 1 = t 2 and e i can have form either D(t i) or i

(D(ti) A ti = ti'). It is assumed that every axiom is implicitly universally quantified over all variables, but variables can only range over defined values in the interpretation. Terms and axioms are interpreted in partial algebras, which are structures consisting of a set of carriers, one for each sort in the signature, and a set of (.partial) functions corresponding to the interpretations of the operation symbols (including the definedness predicates, which are assumed to be total, i.e. either true or false on every element). There are two other important points about interpretation: first, t 1 = t 2 is true iff either both t 1 and t 2 are defined and equal or both are undefined; second, the functions are strict, i.e. if Op(tl,...,tn) is defined, then all t I .....tn are defined. In the following we will use some notations which we now explain. Let S, O, F be respectively a set of sorts, of operations and of positive conditional axioms and A = (ZA,FA), B = (ZB,FB) be two specifications: then -

sorts S o p n s O axioms F denotes the specification having for signature (S,O) and axioms F;

-

A+B denotes the specification having for signature (Sorts(ZA) u Sorts(ZB),Opns(ZA) u Opns(ZB))

-

enrich A by sorts S opns O axioms F denotes the specification

and for axioms F A U FB; A + ( sorts S u Sorts(ZA) opns O u Opns(Z A) axioms F ); - A[srtTsrt] denotes the specification A where the sort srt is renamed srt'. A r u n n i n g example. By means of a concrete example we first illustrate the main features of a SMoLCS specification, i.e. of a specification of a concurrent system obtained by instantiating the SMoLCS parameterized schema. The example is also meant to show how processes can be considered as data and later will be extended to handle parameterized process types, by introducing an algebraic version of function spaces. Finally we will discuss how a concurrent calculus is associated to the given specification. As an example we consider the formal description of a class of simple concurrent architectures, indicated by PD. Each architecture consists of (a varying number of) processes and (a fixed number) of buffers shared among processes. Each process has a local (private) memory and an instruction part defining its activity. Processes can communicate between them by exchanging messages in a synchronized way through channels (handshaking communication) and by writing and reading the buffers. The exchanged messages and the buffer contents are just values; values are natural numbers and also the processes

173

themselves. Processes execute their instructions in a completely free parallel way, except when they try to communicate between them or to get access to the buffers (several contemporaneous accesses to the same buffer are not allowed). First we define processes and then show how to compose them into concurrent systems representing PD architectures. 1.1 Processes A set of processes is described by an algebraic (labelled) transition system. An algebraic transition system is an algebraic specification with two sorts, state (the states of the system) and flag (the labels), and a boolean operation [] ..... []

> 0 : state x flag x state -~ bool defining the system transitions. In the

following the transitions will be defined by sets of axiom schemata of the form "condDs

f

> s ' = true "

to be interpreted: if the condition cond (a conjunction of equations) is true, then the transition s ,,f -> s' belongs to the system. Notation: s---f--f> s' = true is usually written s

(>

s'.

It is important to note that a transition has the following intuitive meaning: a process in a state s has the capability of moving to a state s' by an action whose interaction with the external environment is represented by the flag f; hence f is conveying both information on the conditions of the environment which allow the capability to become effective and on the transformation of the environment produced by the execution of that action. This meaning of Iabelled transitions has now become classical after its use in CCS [Mt, M2] and in SOS [P]; we will now illustrate it by few examples. A capability of reading the content of a shared buffer by a process pr can be written as pr READBI~(b,v) .>pf where b is a buffer identifier and v a value. Note that, as it will be defined later in the synchronization step, this capability will become effective only in an external environment where the content of the buffer b is exactly the value v. A capability of writing on a shared buffer by a process pr can be written as pr ,,,,WRITEBUF(b,v-)-->pr' where b is a buffer identifier and v a value. Analogously we can express the well known capabilities of handshake communication pr -,,-SEND(c'v) >pr' (sending) and pr ~REC(c'v) >pr' (receiving) where c is a channel identifier and v a value. An example of conditional rule is pr 1 -

f

> pr 1' D pr I ; pr 2----f--f> P r l ' ; pr 2

which defines, inductively, the capabilities of a process executing the concatenation of two statements. Example. As an example of algebraic transition system we give PD-PROC, which describes the PD processes, mentioned before. The s~tes of PD-PROC are defined by the following algebraic specification, which is an example of recursive specification. The use of recursive aigebralc specifications is quite natural, when trying to give specifications in a modular way. For example in the following specification we first say that processes are

t74

couples of instructions and local memories; after that we define local memories as finite maps from locations into values and then we say that values consists of processes as data and of natural numbers. Since we use a recursive definition, we expect that the resulting specification (signature and axioms) is in some sense, a well determinated fixpoint of the transformation associated to the definition. It is not difficult to see that, under some natural conditions, such fixpoint exists. For a more technical discussion we refer to the Appendix 1, where also a non recursive version ( i.e. the explicit fixpoint) of the following specification is given. As it should be clear from the intuitive explanations, given two specifications ELEMI, ELEM2 with main sorts elem 1 and etem2, PROD(ELEM1,ELEM2) indicates the parametric specification of the cartesian products with main sort prod(eleml,elem2) and operations < 71, Fq> (pair constructor) and Sell, Sel 2 (component selectors); MAP(ELEM 1,ELEM2) indicates the parametric specificatiqn of finite maps with main sort map(eleml,elem2) and operations [][ E]/[]] (substitution) and 71(D) (application). LOC (locations), BUFID and CHID (buffer and channel identifiers) are specifications which are not further defined here. The main sort of a specification is just a sort of the specification, used in defining parametric specifications. The use of the D's indicates that some operations have an infix syntax; "all total" stands for the set of axioms having form D(Opn(x I ..... Xn)) requiring the totality of all operations appearing in the opns part. PROC = enrich PROD(INSTR,LMEM)[proc/prod(instr,lmem)] by opns Nil: --> proc axioms •(Nil)

LMEM = MAPfLOC,VALUE)[lmem/map(loc,value)] VALUE = enrich PROC + NAT by sorts value opns Pval: proc --~ value Nval: nat --> value {Op: value x ... × value --->value I Op: nat x ... x nat --> nat ~ Sig(NAT) } a x i o m s D(Pval(pr)) D(Nval(n)) {Op(Nval(nl),...,Nval(nk))-- Nval(Op(nl,...,nk)) lop: nat × ... x nat --) nat ~ Sig(NAT) } INSTR ~ enrich LOC + VALUE + BUFID + CHID by sorts instr opns 1 Writebuf,Readbuf: loc × build 2 Send,Rec: loc × chid 3 Skip: 4 Start:proc 5 [] ; D, [] + E]: instr x instr 6 While D ~ 0 DoI'q: loc x instr 7 Seq-Instrl: ...

~ instr --->instr --) instr ---)inset --) instr --> instr --->instr

7+n Seq-Instrn: ...

--->instr

a x i o m s "all total"

i l ; ( i 2 ; i3) - - ( i l ; i 2 ) ; i 3 i I + i 2 m i 2 + il

Skip; i = i il+(i2 + i3) " (i 1+i2) +i 3.

175

Comments. 1.

Writing the content of a cell of the local memory in a buffer and reading the content of a buffer together with storing it in a cell of the local memory (buffers contain values).

2.

Sending and receiving messages (just values) through channels.

3.

Skip is the usual nuU instruction.

4.

Creation of a new process.

5.

Sequential composition and nondeterministic choice.

6.

While the content of the location is different from 0 execute the given instrucion.

7,.,7~-n. Sequential instruction, i.e. instructions whose executions do not require either interactions with other processes or with the buffers. Note that the processes can store into the buffers or into the local memory and exchange between them other processes because a value can be a process. En¢t of ¢~mments. Now we give the specification of the transition system of PD processes, indicated by PD-PROC. The flags of PD-PROC (specification PFLAG) are in correspondence with the executions of the concurrent instructions, exception made for TAU (Milner's internal action) which corresponds to the execution of sequential instructions. For simplicity we do not report the full specification PFLAG; it can be easily understood by looking at the axioms of PD-PROC. PD-PROC = enrich PROC + PFLAG by opns I:] [] ~ D: proc x pflag x proc --> bool axioms 1 <Writebuf(1,b),Im>WRITEBUF(1/~lkb)><Skip,lm> 2 ~a.F.,ADJ~v~L.I~L><Skip,Italy/t]> 3 <Send(t,e),lm>SEND(lmftkc'~> <Skip,Ira> 4 REC(v,c) > <Skip,lm[v/1]> 5 <Start(l~r~,]m~>S_TART(pr)-> <Skip,lm> 6 Nil ~ > pr 7 Pf > D Pf > 8 Pf > D Pf > 9 Iszero(lm(1))-" true ~ <While 1~0 Do i,lm> TAU > <Skip,lm> !0 Iszero(Im(1))= false ~ <Wh~e t ~ Do i,lm> TAU > { <Seq-Instrj(...),lm> TAU > I 1 _<j _, where i is an input instruction (Readbuf, Rec), can perform nondeterministically an action out of an infinite set, one for every possible value which can be received (axioms 2,4), Axiom 5 defines the capability of a process of creating a new process. Axiom 6 defines the capability of being created, which is represented by a transition of the process Nil into the initial state of the created process and is denoted by the flag CREATED(...). Axioms 7 and 8 completely define the sequential composition and the nondeterminisfic choice, because of Skip is the identity of ; and + is commutative (look at the axioms of INSTR). Axioms 9 and 10 def'me the While instruction. En~t 9f ~omments.

176

1.2 Concurrent systems Now that we have defined processes, we show how to compose them into concurrent systems, of which processes are subcomponents. In a concurrent system a state consists of the states of the processes plus the state of the global object; we choose to represent it as a pair <{Prl,Pr2,...,Prn},go> where go is the global object and {pr 1,pr2,...,prn} is a multiset of states of processes. Now, assuming that a transition system PROC-SYST, representing the subcomponent processes and an algebraic specification GOB J, representing the global object, are given, how do we specify the resulting composed system? Our idea is to split the composition in some steps. First the actions of the processes are composed producing new actions; this step is conveniently subdivided into two other steps: one (synchronization) defines the actions resulting from some synchronized cooperation between processes; another (parallel compo~i~ion) defines which are the synchronous actions that can happen in parallel. Then a third step (monitoring) defines which actions resulting after the second step are allowed to happen as actions of the whole system. PROC~SYST

GO~BJ

i

I

S STS M O L C

I

I PTS

S MONITORING

[

FINAL TRANSITION SYSTEM Example. As an example of concurrent system we report the definition of PD. Following the above schema the definition is split in four parts which are reported and commented in sections: 1.1 (the algebraic transition system given before and corresponding to the process subcomponents), 1.2.1 (synchronization), 1.2.2 (parallelism), 1.2.3 (monitoring). 1.2.1

Synchronization

We define the synchronous actions by giving a new transition system STS, where the transition relation ~ > corresponds to synchronous actions, starting from a transition system PROC-SYST (representing the

177

component processes with transition relation->) and an algebraic specification GOBJ (representing the global object). The states of STS are pairs <prms,go> where ms is a multiset of proces states and go a state of the global object. The synchronous actions are given by the a set of axioms having form ( A prj .Afj_> prj') A cond(sf,{f 1.....fn},go) = <{pr 1.....Prn},go> - s f - > <{Prl',...,Prn'},go'> l<j_ Prl',...,prn -fnf- > pr n' can synchronize. Note that the transformation of the global object associated to a synchronous action can be nondeterministic, i.e. it is possible to have also another axiom similar to the above one except that go' is replaced by a different go". We briefly illustrate the idea referring to the example capabilities of subsection 1.1. The effect of reading a shared buffer can be defined by: pr 1 _ READBUF(b.v~ > pr 1, A go(b) = v ~ <{Prl},go> -READBUF(b,v)-> <{Prl'},go> where in the global object are recorded the states of the shared buffers; note that the flag of the resulting action is still READBUF(b,v) (thus recording the kind of the action) since the effective happening of the action will still depend on the actions of the other processes because two contemporaneous readings of the same buffer are mutually exclusive; we will handle that in the parallet composition step. The effect of writing on a shared buffer is defined by: pr 1 WRITEBUF(b.v) > pr 1, ~ <{Prl},go> -WRITEBUF(b,v)-> <{Prl'},go[v/b]>, go[v/b] represents the state of the global object where the content of the buffer b has been changed in v. The effect of a handshaking communication is defined by pr I SEND(c.v~ > pr t, A pr 2 REC(e.v) > pr 2, ~ <{Prl,Pr2},go> - T A U t > <{Prl',Pr2'},go> where the synchronous flag TAU reminds IVlilner's symbol for an internal action, i.e. an action with no interaction with the external environment. Moreover no other synchronous actions involving SEND(c,v) or REC(c,v) are defined, thus a SEND(c,v) action of a behaviour can be executed only together with a REC(c,v) action of another behaviour. Note that also the process internal actions will become synchronous actions, as defined below pr 1 TA--T-A-U-->pr 1' ~

<{Prl},go> --TAU--> <{Prl'},go>.

Creation and termination of component processes are handled by defining a particular process state Nil with the property <{Nil,pr I .....Prn},go> = <{Prl,-.,Prn},go>, and synchronous actions such as Nfl ~REATED(pr~ > pr A pr 1 ~ > pr 1' ~ <{Nil,Pri},go> - T A U - > <{pr,Prl'},go>. Example. The synchronous interactions between the processes of PD are described by the following algebraic transition system PD-STS. The states of PD-STS are defined by the specification PD-STATE and its transitions are labelled by elements of sort pflag of the specification PFLAG (introduced in subsection 1.1). PD-STATE = enrich PROD(MSET(PROC),BUFFERS)[state/prod(mset(proc),buffers)]by axioms <{Nil}ubhms,bfs> = .

178

The global object records the contents of the shared buffers. MSET(ARG) indicates the parametric specification of multisets with operations { f-l} (singleton multiset constructor) and [] u [] (union). Notation {al} u ... u {an} is simply written {a 1..... an}. BUFFERS= MAP(BUFID,VALUE)[buffers/map(bufid,value)] PD-STS = enrich PD-STATE + PD-PROC by opns [:)=[~> Q: state x pflag x state --> bool axioms

pr TAU > pr' D <{pr},bfs>~TAU=><{pr'},bfs> pr READBUF(v.b) > pr' A bfs(b) - v D <{pr},bfs>-_READBUF(v,b)=><{pr'},bfs> pr WRITEBUF(v.b) > pr' ~ <{pr},bfs>~WRITEBUF(v,b)~><{pr'},bfs[v/b]> pr 1 SE~(~.c) > pr 1, A pr2 REC(v,c) > pr2, D <{prl,pr2},bfs>=TAU=><{Prl',Pr2'},bfs> pr I ~ > pr 1' A Nil ...~REATED(pr) > pr D <{Prl,Nil},bfs>=TAU=><[Prt',Pr},bfs>.

1.2.2 P a r a l l e l i s m Intuitively by means of this composition operation we define whether two actions can be executed in parallel (without synchronization). The actions to be considered for composition are, inductively, the actions of the synchronized system STS and the new actions already obtained by parallel composition. As before for synchronization we can describe the operation of parallel composition as producing a new system PTS from the system STS. PTS is simply given by augmenting the transitions of STS (indicated by ~>) with the new elements, which are given by a set of axioms having the following form <prms 1,g°> - s f l - > <prms l',go 1'> A <prms2,go> --sf2--><prms2',go2'> <prms lkJprms2,go> --sfl//sf2 - > <prms l ' u p r m s 2 ' , g o ' > provided we have given the partial (binary, commutative and associative) operation//on the flags of the synchronous actions. In our previous examples a writing action on a shared buffer and a handshaking communication can be executed together giving a new composed action, which in turn can be executed together with an handshaking communication of some other processes. On the converse a reading or updating action of a shared buffer does exclude whatever other access of the same buffer. Example. The allowed contemporaneous executions of the synchronized interactions between the processes of PD are described by the algebraic transition system PD-FTS. The states of PD-PTS are the same of PD-STS; the transition relation and the flags of PD-PTS are an enrichment of those of PD-STS. The transformation of the buffers associated to a parallel action in the system PD-PTS corresponds to execute the transformations associated to the component synchronous actions in some order; note that the result does not depend on the chosen order. In the specification PD-TS Eq indicates an explicit total equality operation of the specification BUFtD with functionality build x build --> bool.

179

PD-PTS = enrich PD-STS by opns []//[3: pflag x pflag ~ pflag Isacc: pflag x build -¢ bool axioms fl/tf2 = f2//fl (fl I/f2)/If3 = fl//(f2//f3) Isacc(TAU,b)~- false Isacc(READBUF(v,bl),b2)= Eq(bl,b 2) Isacc(WRITEBUF(v,bl),b2)= Eq(bl,b2) Isacc(fl/lf2,b)- Isacc(fl,b)v Isacc(f2,b) <mprl,bfs> =TAU=><mprl',bfs> A <mpr2,bfs>,=pf=><mpr2',bfs'>D <mprlumpr2,bfs> --pf//TAU=> <mprl'umpr2',bfs'> <mprl,bfs> -_READBUF(v,b~_><mprl',bfs> A <mpr2,bfs>=pf= > <mPr2',bfs'>A Isacc(b,pf)- false D <mprlu mPr2,bfs> =READBUF(v,b)//pf=><mprI' u mpr2',bfs'> <mprl,bfs> ~WRITEBUF(v,b)=><mprl',bfs[v/b]>A <mpr2,bfs>=pf=> <mpr2',bfs'> A Isacc(b,pf)- false <mprlu mpr2,bfs>=WRITEBUF(v,b)//pf=><mprl'u mpr2',bfs'[v/b]>. 1.2.3

Monitoring

Here we take into consideration any form of global control, by which only some of the actions which are locally possible in a system (i.e. those obtained by (synchronization and) parallel composition) are allowed to become actions of the overall system. It is at this step that we can, for example, define an interleaving mode, admitting only one synchronized action at time, or a mode in which all actions that can be executed together do so. Here we can also define that the buffer reading actions take precedence over the buffer writing actions (i.e. when in a state it is possible a reading action on a buffer, a writing action on the same buffer will never be allowed). As before we can define the monitoring operation by giving a new transition system MTS (with transition relation ===>) starting from a parallel system PTS (with transition relation -->). The states of MTS are the same of PTS. The transitions of the new system are defined by giving some axioms following this schema: <prms 1,go>-,.sf-> <prmsl',go'> h cond(sf,<prmsluprms2,go>,extf ) <prmslt..)prms2,go> ==exff==> <prmsl'toprms2,go'>. Note that this axiom schema specifies, as it was anticipated informally, that an action of the system is determined by an action of a part of the component processes; here the partial action is <prms 1,go>--sf-><prmsl',go'> and prms 2 is the multiset of the states that do not cooperate to that action. Moreover the monitoring decision must depend only on the action capabilities of the processes present in a system state and not on their states. Example. We specify a parallel mode for the execution of the processes of the PD architectures (i.e. every parallel action is allowed to become an action of the system) defining the concurrent transition system PD.

180

The states of PD are still defined by the specification PD-STATE and its transitions are labelled by elements of the following specification EXTFLAG. EXTFLAG = sorts extflag opns TAU: --~ extflag axioms D(TAU) PD = enrich PD-PTS + EXTFLAG by op ns [] == [3==>D: state × extflag × state ~ bool axioms <prmsl,bfs> ~----pf--><prmsl,bfs'> ~ <prrns1 u prms2,bfs> ==TAU==><prmsl~) prms2,bfs'>. 1.3 Semantics and calculi

To the specification of PD we can first associate a semantics, given by its initial model; this model indeed exists and corresponds roughly to an operational semantics modulo the initial congruence on the states of the system. Prooositionl. (see [ARW1]) There exists an initial model IpD of the specification PD such that IpD is term generated and for any t, t 1, t 2 ~ WSig(PD) IpD l= D(t) iff PD I- D(t) and PD I- D(t 1) A D(t2) implies ( IpD 1= t 1 = t 2 iff

PD [- t 1 = t2).

In particular for any st, st' ~ WSig(PD)lstate, pr, pr' ~ WSig(PD)lpro c and pf e WSig(PD)[pflag PD [- st =TAU=> st' iff IpD I= st =TAU=> st' and P D I - pr

Pf >pr' iff IpDl= pr

Pf > p r ' . [ ]

The proposition shows that the specification PD defines an associated calculus, which we indicate by PD, corresponding to an operational semantics, and formally consisting of the equality = and of the transitions, both of processes and architectures, provable in PD. In general for any specification SYST of a system, we will call SYST the corresponding calculus. (These are the calculi to which the rapid prototyping tool ([Mo]) developed for SMoLCS specifications applies). Assume now that we want to consider two architectures to be equivalent iff they have the same input/output relation, where the inputs and the outputs are respectively the initial numeric contents of the buffers and the lists of the intermediate numeric contents of the buffers. Then we have to define an observational semantics of PD. The paradigm under which an observational semantics is defined in SMoLCS for a concurrent system (here applied to PD) consists essentially of: - a specification, defining the observations on the system (here PD-PLUS), by means of boolean relations (here Res) stating that some observation values (here lists of numeric buffer contents) are true of some observed objects (here the states of PD) (see [ARWl]); OBS = enrich MAP(BUFID,NAT)lobs/map(bufid,nat)]by opns D^E]: obs x obs --~ obs axioms D(oblnob2)

181

PD-PLUS = enrich PD +OBS by opns Res: state x obs ~ bool Val: buffers ~ obs axioms Val(Empty_Map) = Empty_,Map Val(bfs[Pval(pr)/b]) = Val(bfSlb) Val(bfs[Nval(n)/b])-- Val(bfs)[Nval(n)/b] Res(<prms,bfs>,Val(bfs))= true <prms,bfs>==TAU==>st A Res(st,ob) = lrue D Res(<prms,bfs>,Val(bfs)^ob)= true. (bfsI b represents the map bfs where every association to b is dropped); -

a definition of a class of observationally equivalent algebras, each one containing the objects to be

observed together with the relations and moreover preserving, as a subtype, a fixed model of the observed values; - the definition of the observational semantics as the minimally defined and term generated algebra (here CALG) terminal in that class; a basic general theorem (in [ARWl]) shows that this algebra has indeed the properties required of an observational semantics. Then we obtain the following result qualifying CALG as the observational semantics of PD w.r.t, the observations, expressed by the operation Res (here we have chosen the initial model of OBS). Proposition 2,([ARWl]) There exists an algebra CALG with the following properties: for any srt ~ Sorts(PD-STATE-Sorts(OBS), ground terms t, t' e WSig(PD_STATE)Isrt 01 CALG t= D(t) iff PD I- D(t) 02

CALG 1= t = t' iff for any ob e WSig(OBS)iobs, any st e WSig(PD_STATE){X}lstate with x of sort srt [PD-PLUS I-Res(st[t/x],ob) = true iff PD-PLUS l-Res(st[t'/x],ob) = true]. []

If Z is a signature and srt a sort of Z, then WXlsrt represents the set of all terms of sort srt built on X. Proper~ 01 says that all the interesting objects of PD-STATE are defined in CALG; by property 02 two terms of sort srt are equivalent if and only if in every context of sort state they satisfy the same observations. It is most important to note that in this way every nonobserved subcomponent of a state gets an observational semantics: in PD, for example, this is true of processes. Hence CALG l= st I = st 2 iff st I and st 2 produce the same outputs. Correspondingly to the above observational semantics we could prove some useful identities between PD processes and architectures. However this may be in general rather unpractical, since it has to be done explicitly ad hoc for the specification PD. That is why in the second part of the paper we will develop a parameterized caIculus starting from a fixed set of combinators, in order to be able to give standard identities w.r.t, a basic observational semantics which is a generalization of Milner and Park's strong equivalence.

1.4

Multilevel

concurrent

systems

In the previous sections we have defined a three steps procedure that, given a transition system, specifying some component processes, and a synchronization, a parallel and a monitoring specification, produces a new transition system, specifying a concurrent system. Clearly the procedure can be iterated;

182

if some subcomponent processes (said .concurrent subcomponents) are themselves concurrent systems, then they can be specified by the same procedure. Consider for example a net of (workstations) nodes, such that in a node many processes can cooperate, possibly using a shared memory, while the nodes can exchange messages in a broadcasting or/and point to point mode. Then we can specify the net applying twice the SMoLCS procedure; in one application the subcomponents are the processes cooperating in a node and the resulting concurrent system specifies a node; in the other one the nodes, specified in the first level, become the new subcomponents and the resulting concurrent system specifies the net (as eg in [AMRZl, AMRZ2]). It can also be shown that the procedure can be applied inductively; hence it is possible to specify systems where a subcomponent process (said inductive cencurrcnt subcomponent) has the same nature of the composed processes, as in CCS, i.e. where states and transitions of the final system are embedded into the states and the transitions of the system describing the processes. 1.5 A specification with parametric process types We describe now an extension of PD, called PPD, obtained by enriching the values handled by PD processes, which already include the processes themselves, with parametric process types. Thus the PPD processes can exchange between them and store in the buffers and in their local memories values corresponding to parametric process types. The purpose of PPD is to introduce, on the top of the already given PD example, the use of functional combinators which will play a relevant role in the rest of the paper. The algebraic specification of functions. A parametric process type is just a function from some parameters into processes. In our algebraic setting it is convenient and feasible to give an algebraic specification of functions from elements of some sorts into the elements of some other sort; in [ARW2] (but see also [BW3]) we study the problem and present several solutions; here we briefly introduce some basic concepts and notations. Let ARG and RES be two algebraic specifications with main sorts arg and res respectively; by FUNCT(ARG,RES) we indicate the algebraic specification of functions from elements of sort arg into elements of sort res. The specification is nothing but an algebraic formalization of the usual rewriting rules of functional calculus with abstraction and application. The only tricky point is the following: in a term like )~ x . x+5, the first occurrence of x is the first argument of 9~and is only a symbol, while in x+5 x stands for a value of sort nat; thus we say that the first occurrence of it is an object of sort nat -var and we provide a merge operation Nat_Vat for considering a variable symbol as an object of type nat. FUNCT(ARG,RES) has sorts -

funct(arg,res) arg-var arg-res-fid

(the functions) (the "variables of type arg") (identifiers for functions from arg into res)

bool

(the boolean values)

--~ funct(arg,res)

(~abs~acfion)

and operations ;Llq, Vq: arg-var x res

183

Arg-Var: arg-var

-4 arg

(this operation embeds the "variables of type arg" into the elements of sort arg) [3(D) : funct(arg,res) x arg -4 res

(application)

if [] t h e n []else []: bool x res x res Arg-Res-Fid: arg-res-fid

-4 res

(conditional)

-4 funct(arg,res)

(this operation embeds the identifiers into the elements of sort funct(arg,res)) tee [ ] , I-l: arg-res-fid x funct(arg,res) -4 funct(arg,res)

(recursive function constructor).

Notation: the terms having form Arg-Var(x), Arg-Res-Fid(y), where x is a term of sort arg-var and y a term of sort arg-var-fid, are simply written x, y. The above framework allows to write the elements of sort funct(arg,res) following the usual ~.-notation; moreover the elements of sort funct(arg,res) have the basic usual properties of a functional calculus, eg cx-rule and 13-rule. For example %x,x+3

= ~.y, y+3

(~x,x+3)(2)

= 5.

Note that all the operations in a partial specifications are strict, i.e. D(Op(t 1..... tn)) D D(tl) A...A D(tn) and hence also the if [] then []else [3 operation is strict, but that does not pose problems in defining functions, because this operation is defined by cond(a) = true D ( ~. x , if cond(x) then r(x) else r'(x))(a) = r(a) cond(a) = false D ( )~ x . if cond(x) then r(x) else r'(x))(a) = r'(a). For example, consider f = ~, x . if x>10 t h e n x-10 else x, which is a term of sort funct(nat,nat) defined in FUNCT(NAT,NAT); then with the usual meaning o f - , the value of 5-10 is undefined; however f(5) is a defined term of sort nat. Functions with several parameters can also be defined using FUNCT and the parameterized specification PROD. For example, FUNCT(PROD(ARG1,ARG2),RES) is the specification of the functions with two arguments of sort argl and arg2 respectively into res. The example PPD. PPD is defined in the same way of PD, exception made for the specification of values; we assume that the process type parameters are just channel and buffer identifiers and, for simplicity, that each type has only one parameter. VALuEPPD= enrich FUNCT(CHID,PROC)+ FUNCT(BUTID,PROC)+ NAT by sorts value opns Pval:proc -~ value Nval: nat ---)value {Op: value × ... x value ~ value i Op: nat x ... × nat ~ nat ~ Sig(NAT) } Ptvalt: funct(chid,proc) --~ value Ptval2: fimct(bufid,proc)

-->value

axioms "all total'

{Op(Nval(nl),...,Nval(nk))= Nval(Op(nl,...,nk)) I Op: nat x ...x nat --~nat e Sig(NAT)}. Let us just to show two examples of the use of these process types. The P P D calculus can be used to describe architectures where several processes perform the same computation on different values (eg an array processor architecture).

184

Let pt = ~ b . , be a process type parameterized on a buffer identifier, where instr 1 ; ... ; instrk corresponds to a complex computation on the content of the local memory location 1. Then the PPD term <{pt(buf 1) ..... pt(bufn)},[bUfl--~Vl..... bufn-->vn] > describes a system where the above computation is performed in parallel on all the contents of the buffers buf 1 ..... bur n. Consider now the process type pt 1 = ~c. parameterized on a channel identifier; then the PPD term <{Po},[ b u f f 0 ] >, where Po = <Start(Ptl(el)) ;Send(ll,Cl) ;"" ;Start(Ptl(Cn)) ; Send(ln'en) ; ReC(Cl,ll) ;1:=1+11 ; ... ;Rec(cn,ll) ;1:=1+11 ;Writebuf(1,buO, [1-->0,11--->Vn,...,ln--+ Vn]> describes a concurrent system where the above complex computation is performed in parallel on the values v 1.....v n and the sum of the results is put into the buffer buf. 2 PARAMETERIZED CONCURRENT CALCULI In this section we restrict the SMoLCS specifications to those where processes are built on a fixed set of combinators; the new processes are called behaviours and are still parameterized on various data structures, but we can give once for aI1 various properties related to the given combinators.

2.1 Behaviours and varieties of calculi The calculi we introduce in this section are based on the notion of behaviours (a name suggested by Milner's behaviours in CCS and in SCCS). The peculiarity of behaviours compared to the models of processes used in the examples of section 1 is that they correspond to processes without local state; they are completely determined by the atomic actions they can perform, i.e. they correspond abstractly to trees only labelled by actions. Then in our approach the processes with a local state are modelled as functions from local states into behaviours; the advantage is that we combine the level of abstraction and the expressive power of behaviours and functions together. This technique is fundamental for giving high level semantic descriptions of languages as we have shown in [AR1, AR2, CRAI-DDC]. For exampIe, if we want to give a denotational value for a procedure, which usually involves some concurrent interaction among processes, (as it is in Ada for example), then we can model it as a function which, taken some values of the parameters, produces a behaviour. The role played by behaviours in practical applications will be illustrated by some later examples. Instead of presenting a single calculus, we will introduce a family of calculi, which may differ fundamentally in two respects: the family is parameterized on some data structures and moreover various families of subealculi are derivable, depending on the combinators used and on the assumptions about the parameters. For every complete choice we have a calculus corresponding to an operational semantics of a (multilevel) concurrent system, where the active subcomponents are behaviours with the corresponding peculiar properties. We can group the parameters as follows.

185

• An algebraic specification DATA will represent the structure of (hence the data recorded in) the global object, the data exchanged between the behaviours, the data elaborated internally by the behaviours, the behaviour atomic actions and the interactions of the concurrent system with the external world. Formally DATA will be an algebraic specification based on BOOL (a specification of boolean values) and such that its sorts include:

- gobj, for the states of the global object -

-

act, for the atomic actions of behaviours extflag, for representing the interactions with the external world.

We assume moreover that DATA is parameterized on an algebraic specification X, which will be in every instantiation the specification of behaviours. • Another parameter defines how the behaviour subcomponents of the system concurrently interact between them; that is described following the SMoLCS methodology as introduced in section 1. Formally this parameter, indicated by SMoLCS-SYST(PROC-SYST), is just a parametric algebraic concurrent transition system (with transition relation [[1==[]==> [[]:state x extflag x state--)bool), where the parameter PROC-SYST corresponds to the algebraic transition system (with transition relation []

[] > []: behaviour x act x behaviour ~bool) defining its active subcomponents (see

subsection 1.2). It will be instantiated with the transition system defining the behaviours. • In general the concurrent system described by the calculus is a multilevel system (see subsection 1.4); thus we need some parameter for describing the noninductive concurrent subcomponents, which are just other concurrent systems. For simplietly we consider only the cases where all the noninductive subcomponents are represented by a unique algebraic transition system (with transition relation []~~ []~~> [2]: sstate x act x sstate---)bool), indicated by SUB-SYST. Obviously SUB-SYST may be also an one-level concurrent system.

2.2 Introducing combinators Here we introduce the combinators for a calculus in our family, indicated by SYST, together with their informal meaning. In the following subsection, the calculus will be formally defined by an algebraic specification named SYST. The syntax of SYST is given as the signature of a specification STATE (the states of the algebraic transition system SYST) whose sorts include state (the terms of the calculus), behaviour and gobj (active and passive subcomponents); the combinators are just the operations of this signature and in what follows we use for them the same notations used for the operations. We use = to indicate the provable equality in a specification. First we give the combinators for expressing global objects and behaviours and then the combinator for composing them into a state of the concurrent system.

fzI,D2ukl.,£2NgA/T •

All the operations of the specification DATA with functionality srt 1 x ... x srtn ---) gobj (n _>0)

are the calculus combinators for expressing the global object.

186

The meaning of these combinators are given by the axioms of DATA. In what follows SORTS indicates Sorts(DATA) u {null}. BEHAVIOURS Drefixin~ of an action_ •

[] A I-1: act x behaviour

~ behaviour

a A bh represents the behaviour which performs the action a and then behaves as specified by bh. Behaviour atomic actions are represented by terms of sort act built on the signature of STATE. We recall that there is a special combinator for representing the action of creation of a new behaviour CREATED: behaviour --4 act. The A combinator is the basic tool for expressing the activity of a behaviour as a sequence of atomic actions; it corresponds to CCS dot. functional combhaators for every srt e SORTS •

)d--1. [-1: srt-var x behaviour ~ funct(srt,behaviour)

(X- abstraction)

The elements of sort funct(srt,behaviour) represent the (partial) functions from elements of sort srt into behaviours; while the elements of sort srt-var represent in some way the "variables of type srt". There is also an operator which embeds these "variables" into the elements of srt •

Srt Vat: srt-var -4 srt

and various combinators for expressing the elements of srt-var. Notation: for every term of sort srt-var x Srt Vat(x) is simply written x; every string of lower case letters corresponds to a term of sort srt-var. •

if []

•

Fl([]i: funct(srt,behaviour) x srt

•

ree V1. []: srt-behaviour-fid x funct(srt,behaviour) ~ funct(srt,behaviour)

then

[] else []: bool x srt x srt

~ srt

(conditional)

--* behaviour

(application) (recursive functions constructor)

The elements of sort srt-behaviour-fid represent in some way identifiers of functions of type funct(srt,behaviour); also in this case there is an embedding operation •

Srt Behaviour Fid: srt-behaviour-fid --4 funct(srt,behaviour)

and various combinators for expressing the elements of sort srt-behaviour-fick Notation: for every term of sort srt-behaviour-fid x Srt B e h a v i o u r F i d ( x ) is simply written x; every string of lower case letters represents a term of sort srt-behaviour-fid. ree f i . funct(fi) represents a function corresponding to a fixpoint of the functional ~.fi. funct(fi); that fixpoint is defined by the usual rewriting rule ree f i , funct(fi) = ( Xfi. funct(fi))( ree f i . funct(fi)). All these combinators are operators of the specification F U N C T ( D A T A < s r t > , B E H A V I O U R ) as introduced in section 1.1. and formally defined in [ARW2]. (If A is a specification and srt a sort of A, then A<srt> indicates that srt is now the main sort of A.)

187

fix•oint combinator~ for every natural number n > 1 *

~Xn: funct(prod(behaviour,...,behaviour), prod(behaviour,...,behaviour)) n tittles

n i-lYrics

-~

prod(behaviour,...,behaviour)

nti~ where the elements of sort prod(behaviour,...,behaviour) are n-tuples of behaviours; moreover on these n UYnes n-tuptes the component selection operations and a constructor operation are defined: 1 < i <_-n Sel i : prod(behaviour,...,behaviour) < [] ..... 13> behaviour × ._ × behaviour

~ behaviour --rprod(behaviour..... behaviour).

Considering for simplicity the case n = l , fixlbhfunct represents a behaviour whose activity is the same activity of bhfunct(fixlbhfunct). These combinators permit to represent behaviours with nonterminating activities and sets of mutually recursive behaviours. For example, fix 1 ~ x. a zX x represents the behaviour which goes on forever performing the action a. It is important to note that the fix combinators are total and that the above operational characterization allows to define completely the behaviours represented by them; moreover they are truly fixpoints, since we have that fixnbhfunct = bhfunct(fixnbhfunct). For example fix 1 ~. x . x is defined and represents the behaviour unable to perform any activity, which will be indicated also by stop. nondeterministic choice for every srt e SORTS •

choosesr t 13: funct(srt, behaviour) --r behaviour

choosesr t bhfunct represents the behaviours which can nondeterministically behave as specified by bhfunct(to) for every term of sort srt to, The importance and relevance of these combinators for representing behaviour subcomponents of concurrent systems should be clear (see, eg [M1, M2]). Following Milner's notations (see, eg [M2]) we would write these combinators as

+ bh(t) , where SRT is a set and bh(t) is a behaviour expression t ~ SRT

parameterized on t (i.e. an expression of type behaviour with a free variable t of type SRT). Here we are working in a fully algebraic setting, where the elements of SRT are defined by means of an abstract data type with a sort srt and hence

+ must be an algebraic operation. The solution we have adopted is to SRT

consider a combinator ehoosesr t applied to functions from elements of sort srt into behaviours; thus the parameterized dependence of bh(t) on t is formally expressed by means of a term of sort funct(srt,behaviour), whose elements correspond to functions from elements of sort srt into behaviours. Hence

+ bh(t) will be written t e SRT

choosesr t ~.t. bh(t).

Notation: ehoosesr t ~. t . bh(t) is also written choose t : srt in bh(t).

188

Our nondeterministic choice is neither local nor global; it could be local or global depending on the various alternatives: if for every term to of sort sit the first-step actions of bh(to) correspond to interactions with the other behaviours or the global object, then we have global nondeterminism (eg for bh = choose n: nat in RECnFROMpid A stop, where we use an infix notation for the receive action REC VIFROM [], if the behaviour named pid can send the natural number 1, then bh will choose the alternative REC1 FROMpid A stop); if for every term t o of sort srt the fLrst-step actions of bh(to) axe all intemal actions, then we have local nondeterminism (eg if bh = choose n: nat in TAU A SEND(n) A stop, then bh can choose one of the altematives independently from the external context). sequential composition of behaviour~ for every srt e SORTS •

defsr t [] in •: behaviour × funct(srt,behaviour)

--~ behaviour

•

r e t u r n s r t [3: srt

~ behaviour

The activity of defsr t bh in bhfunct consists of the activity of bh until it terminates, followed by the activity of bhfunct(to) ff bh terminates retuming a value to of sort srt and bhfunct(to) is defined; returnsr t to represents the final state of a behaviour which has terminated its activity returning to. The construct defsr t bh in bhfunct is a very general and powerful form of sequential composition because it allows also the preceding behaviour to pass some information to the following one; moreover there is also the possibility of (conditionally) escaping the following behaviour; if bh terminates mtttming a value t I of sort srt 1 ~srt, then the following behaviour represented by bhfunct will not be executed. In subsection 2.4 we show the use of these combinators for defining a variety of derived combinators. Notation: defsr t bh in ~. t . bh'(t) is also written defsr t t = bh in bh'(t); returnnull Null is also written skip (skip represents a null behaviour unable to perform any activity). multilevel structurin~ combinators •

i-enclose: state

--) behaviour

(for enclose concurrent inductive subcomponent)

•

n-enclose: sstate

--* behaviour

(for enclose concurrent noninductive subcomponent)

The elements of sort state represent the states of the system SYST; while the elements of sort sstate represent the states of the concurrent systems SUB-SYST taken as parameter. These two combinators are used for representing multilevel (structured) concurrent systems; the first for the case in which the internal concurrent structure of the behaviours is the same of the whole system (see eg CCS, SCCS), the second when the internal structure is given by means of the parameter SUB-SYST. The term i-enclose(st) represents a behaviour which is internally structured as the concurrent system represented by st and its activity is determinated by the activity of st. Precisely if st can perform some transition labelled by a becoming st', then also i-enclose(st) can perform a transition labelled by a becoming i-enclose(st') and these are all the transitions of i-enclose(st). Thus if the enclosed system st is unable to perform any activity also i-enclose(st) is unable to perform any activity; moreover if st represents a correct final state (all the behaviour subcomponents are equal to skip), then i-encLose(st) = s k i p . Note that this last property allows to compose sequentially concurrent

189

subcomponents with behaviours. Analogously for n - e n c l o s e . If the calculus include the combinator i-enclose, since now some transitions (with external flags) of the system may become also transitions, via i-enclose, at the behaviour level, then the external flags of SYST must coincide with the behaviour atomic actions (extflag = act); clearly also the external flags of SUB-SYST must coincide with the behaviour atomic actions. PAtLM.LEL COMBINATQR The calculus has a combinator which taken some behaviours (a multiset of) and a global object returns a term representing the concurrent system of the class, whose subcomponents are those behaviours and that global object: °

par: mset(behaviour) x gobj --estate

Notation: a term having form par({bh 1..... bhn},go ) is usually written bhll...[bhnlgO to suggest the fact that the various subcomponents are in parallel. 2 . 3 Formal definition of a calculus

First we give the specification of the transition system BH-SYST defining the behaviours and then of the transition system of the whole calculus (SYST). BEHA~OURS Remember that the paramenter SUB-SYST is an algebraic transition system (with transition relation f-l~~ El~~> E]: sstate x act x sstate --->bool) and that [3== [3==> [3: state × act x state --->boo1 wiIl be the transition relation of SYST (here we consider a calculus including the i . e n c l o s e combinator, thus act=exfflag). BEHAVIOUR= enrich + FUNCT~ATA(BEHAVIOU~R)<srt>,BEHAVIOUR) + srt ~ SORTS + FUNCT(PROD(BEHAVIOUR,..,BEHAVIOUR),PROD(BEHAVIOUR,..,BEHAVIOUR)) + n_>l n times

n times

SUB-SYST + NULL + STATE by sorts behaviour opns DA D: act x behaviour

--> behaviour { fiXn: funct(prod(behaviour,...,behaviour),prod(behaviour,_.,behaviour)) --, prod(behaviour..... behaviour)) ]n>l } -

-

%

,

--

-

n times { choosesr t R: funet(srt,behaviour)

-

,

¢

~¢-

n times

n times --> behaviour,

defsrt [] in 13: behaviour x funct(srt,behaviour)

--* behaviour,

returnsr t VI: srt

~ behaviour --->behaviour --> behaviour --> behaviour

i-enclose: state n-enclose: sstate seed: axioms "all total"

I srt E SORTS }

190

where NULL = sorts null opns Null : --* null axioms D(Null) STATE = enrich MSET(BEHAVIOUR) + DATA(BEHAVIOUR) by sorts state opns par: mset(behaviour) × gobj --->state axioms seed[bhmslgo = bhmslgo. Note that B E H A V I O U R and STATE are two algebraic specifications defined in a mutually recursive way (see A p p e n d i x i); note also h o w D A T A ( X ) is recursively instantiated on B E H A V I O U R , so that the behaviours b e c o m e parts o f the data type. The behaviours will be represented by terms o f sort behaviour o f the above specification B E H A V I O U R and their combinators will be operations o f the same specification. Notation: w e recall the abbreviations used: s t o p stands for fix 1 k x . x and skip stands for r e t u r n n u l l N u l l . BH-SYST = enrich BEHAVIOUR + SYST by opns [:3----~-D > D: behaviour × act x behaviour --->bool CREATED: behaviour --> act axioms D(CREATED(bh)) a Abh ..a_> bh { fixn bhprodfunct = bhprodfunct(fix n bhprodfunct) ] n > 1} {

bhfunct(t) __L> bh' D choosesrt bhfunct --~> bh' defsrt (returnsr t t) in bhfunct = bhfunct(t) bh -&-> bh' D defsrt bh in bhfunct ---~-> bh' { defsrt (returnsrtl tl) in bhfunct "" returnsrtl t 1 Isfreesrt(t,bhfunct ) - false D defsrtl (choosesrt ~.t, bh(t)) in bhfunct= choosesrt Xt .(defsrtl bh(t) in bhfunct) Isrtl e SORTS, srtlcsrt)

{

i-enclose(skipl...Iskiplgo) = skip, n-enclose(skipl...lskipibgo) = skip - - V

[srt e SORTS} [n > 0 }

V"

n times

n times

st ==a==>st' D i-enclose(st) ..a_> i-enclose(st') sst ~~a~->sst ' D n-enclose(sst) _0._> n-enclose(sst') seed CREATED(bh~ > bh.

Comments. s e e d is an auxiliary combinator used for allowing dynamic creations o f n e w behaviours. The

functional

combinators

are

defined

by

the

various

specifications

FUNCT(DATABEHAVIOUR<srt>,BEHAVIOUR). The axioms o f B H - S Y S T give the operational semantics o f the various combinators as it was suggested in subsection 2.2. Isfreesrt:Srt-var × funct(srt,behaviour) ~ bool is an operation o f F U N C T ( D A T A < s r t > , B E H A V I O U R ) ; Isfreesrt(x,bhfunct ) freely in bhfunct. T h e condition Isfreesrt(t,bhfunct) -

true iff the "variable o f type srt" x occurs

false in the axiom about d e f and c h o o s e is not

restrictive at all, because on the functions algebraically defined the a - r u l e holds and there exist infinite

191

different elements of sort srt-vart. End 0f~___nunents. THE CALCULUS In order to have a fuU calculus we need to define the synchronization, parallelism and monitoring steps. We recall that this is done by means of a parameterized specification SMoLCS-SYST(PROC-SYST), given as a calculus parameter, where PROC-SYST stands for the algebraic transition system of the component processes. Hence the full calculus will be here the one associated to the algebraic transition system SYST defined as follows: SYST = SMoLCS-SYST(BH-SYST). 2.4

Examples

THE FORMAL DEFINI'ITQN OF ADA Here we show how one of our calculi, denoted by AC, could be used for describing the underlying concurrent model of Ada programs, used in [CRAI-DDC] for giving a formal semantics to Ada. In this case the parameters are defined as follows: • The parameter DATA becomes now ADATA(X) = GLOBAL-INF(X) + ACT(X) + LOCAL-INnE(X), where GLOBAL-INF(X), ACT(X) (with the operations CREATE, CREATED: behaviour --r act) and LOCAL-INF(X) are large and complex specifications representing respectively the global object, the behaviour actions and the data handled locally by behaviours; in this case the sort extflag coincides with act. Recall moreover that X will be instantiated as the specification of behaviours, which corresponds roughly here to Ada tasks. • In AC the behaviours can interact between them only by reading and updating the global object; contemporaneous behaviour accesses to the global object are allowed if and only if they can also be performed sequentially in some order; moreover there is no form of global control on the behaviour actions.

These

assumptions

are

formalized

by

the

following

parametric

system

A-SMoLCS-SYST(PROC-SYST) defined following the SMoLCS three steps schema; where the parameter PROC-SYST will be instantiated with the algebraic transition system giving the operational semantics of behaviours. • AC is a one-level concurrent system, i.e. there are no behaviours which are in turn concurrent systems themselves; thus in this case we do not need other parameters. Here we givew the definition of A-SMoLCS-SYST(PROC-SYST). synchronization A-SSYST(PROC-SYST)= enrich PROC-SYST by opns []==[3==>[:]:state x act x state --~ bool axioms Cond(a,go) = trueA bh-L> bh' ~ bhlgo~a-.~->bh'lTransf(a,go)

bh CREATE(bhl~L.>bh'Aseed CREATED(bh!L>bh1 A Cond(CREATE(bht),go) = true D bh[ seedigo---CREATE(bhl)==>bh'lbhl[Transf(CREATE(bhl),go ). Cond: act × gobj -~ bool and Transf: act x gobj --> gobj are two operations of the specification ACT.

192

t~arallelism A-PSYST(PROC-SYST) = enrich A-SSYST(PROC-SYST) by opns DIID : actx act ~act axioms a 1//a2 = a2//a 1 a 1//(a2//a 3) " (a1//a2)//a 3 ~ai--> A~a~> A ~ a 2 ~

~ ,....,al//a2~> .

The condition part of the above axiom requires that the parallel action labelled by a 2 can be executed after the one labeUed by a 1. monitoring A-SMoLCS-SYST(PROC-SYST)= enrich A-PSYST(PROC-SYST) by opns [3== []==> [] : state x act x state --~ bool Ext: act -9 act axioms st ~---a_~_> st' ~ st ==Ext(a)==> st' Ext(aI//a2) = Ext(aI) /t Ext(a2) Ext-Ax, where Ext-Ax is a set of axioms defining the operation Ext having form cond D Ext(a) = a or cond D Ext(a) = TAU. The functional combinators of AC have been proved very useful in the Ada Formal Definition for expressing, for example, subprograms (Aria procedures and functions), task types and several other kinds of denotations. Moreover, in order to improve readability, other combinators have been introduced and we show how they can be derived from those of AC. ~equentiaI composition without value passing •

[ ] ; []: behaviour x behaviour

--* behaviour

•

nil:

~ behaviour

The activity of bh I ; bh 2 consists of the activity of bh 1 until it terminates followed by the activity of bh 2 if the final state of bh 1 is nil. Formally bh 1 a > b h l , D b h l i b h 2

a >bhl,;bh2

nil ; bh = b h .

These combinators can be derived in AC as follows (we indicate with = equality by definition): bh 1 ;bh 2 --- defnull n = bh 1 in bh 2

nil = skip = returnnull Null

and they have the properties listed above; indeed bh t g > bh 1' D bh t ; b h 2 - defnull n = bh 1 in bh 2 ~ >

defnu u n = bh 1' in bh 2 - bh 1' ;bh 2,

nil ; bh - defnull n = (returnnull Null) in bh = (~ n . bh )(Null) = bh. rec.ree t r a n . e x i t •

trap [] in V]: map(label,behaviour) x behaviour ~ behaviour

•

exit []: label

~ behaviour

where label and map(label,behaviour) are sorts of ADATA. The activity of the behaviour trap lmap in bh consists of the activity of bh; moreover if bh terminates performing an exit to the label 1 and 1 belongs to the domain of lmap, then the activity goes on as specified by Imap(1); otherwise the exit is propagated to some outer trap construct. These combinators are suggested by VDM combinators introduced for giving the so called direct semantics (see [BJ,AR2]).

193

Formally i)

i e dom(tmap) = true D trap lmap in exit 1 = lmap(1)

ii) i e dom(lmap) = false D trap lmap in exit 1 = exit(l) iii) bh a > bh' D trap lmap in bh --g--> trap lmap in b h ' . These combinators can be derived in AC as follows: trap 1map in bh --- deflabe 11 = bh in (if I E dom(lmap) then lmap(1) else returniabe 11) exit 1 -- returnlabe 11. • rec trap [] in [2]: map(label,behaviour) x behaviour ~ behaviour ree trap is similar to the trap, except that axiom i) is replaced by i')

1 s dom(lmap) = true D ree trap 1map in exit 1 = ree trap lmap in lmap(l).

It can be derived in AC as follows rec trap [11 --> bh 1..... 1n -~ bhn] in bh -= trap [11 -~ bhl', .... 1n --~ bhn'] in bh where for every 1_. It is easy to see that the derived combinators have the properties i), ii), iii) and i'), ii), iii) respectively. SEOUENTIAL CONSqNUCTS Here we show how it is possible to enrich our calculi with the usual sequential constructs, deriving them by the calculi combinators. We assume that each process has a local store whose states are represented by elements of sort store = map(loc,value); these processes will be represented by elements of sort proc = funct(store,behaviour) and a system whose subcomponents are the processes proc 1,'",Procn will be represented by procl(Empty_Map)I...iprocn(Empty_Map)[go (Empty_Map represents the initial empty state of the local store). The derived combinators are: •

[]:= [3: loc x expression -÷proc

(1 := exp = ~ st. TAU A returnstor e st[Evai(exp,st)/1]), where Eval: expression x store ---rvalue is an operation of DATA. •

If [] Then [] Else VI: expression x proc x proc --*proc

(If exp Then pr 1 Else pr 2 = )~ st. TAU A if Eval(exp,st) then Prl(st ) else Pr2(st)). Note that for simplicity we consider expressions without side effects. • •

[ ] ; [ ] : p r o c x p r o c - ~ p r o c ( P r l ; P r 2 : ~ s t . defstorePrl(st)inpr2). While [] > 0 Do [3: expression x proc ---~proc

(While exp Do pr -= ree w h , k st, TAU A if Eval(exp,st) > 0 then defstor e pr(st) in wh else returnstor e st). •

•

[]

:

act ~ p r o c

(a ~ 7~st. a A returnstor e st).

Choosesr t []: funct(srt,proc) --~proc (Choosesr t )~ v. pr(v) - ~. st. ehoosesr t )~ v. (pr(v))(st)).

194

3 PROPERTIES OF COMBINATORS Here we study the properties of the combinators introduced in the preceding section. Some of these properties are just equalities provable from the given specification; for other deeper properties we have to consider equivalences with respect to some observations. The most basic form of observation consists in observing the actions of a behaviour, which leads to the well known notion of strong (bisimulation) equivalence of Milner and Park. For our calculi we need to generalize that notion, since our flags may include hehaviours as subterms; moreover we would like to equate functional terms by extensionality. Since at the present stage of our investigation the theory related to such generalization looks a bit complicate we defer the presentation of the full theory to a more technical paper; hence we prefer to present the properties of combinators for subcalculi, in which the flags cannot have behaviours as subterms. But the properties we show do hold in the general unrestricted case and hence they give a rather good understanding of the properties of the calculi.

3.1 Strong equivalence properties of behaviour combinators Let BH-SYST indicate the transition system (with transition relation []

[] > Vl:behaviour x act x behaviour --~bool) defining the behaviours of one of our calculi.

In the following we consider only calculi of behaviours in which the flags do not have behaviour subterms, formally calculi such that the parameter DATA (see section...) is not a specification parameterized on behaviours, and such that BH-SYST is image finite. (A transition system with transition relation - - >

is said image finite iff for all states s and flags f the set {s' I s

f

>s'} is

finite.) By strong eouivalence we mean strong bisimulationequivalence, as introduced in [M2]. From the beginning we have to face an interesting problem: in our calculi of behaviours returnsrt v and

stop are two normal states, i.e. behaviours without action capabilities, and hence they would be equated in the strong equivalence associated to the behaviour transition system. But inserted in the context defsrt Ix] in bhfunct they wuold produce two behaviours which are not strongly equivalent and hence the strong equivalence wuold not be a congruence. Since clearly we are interested in a strong equivalence which is also a congruence, we simply distinguish the two behaviours by considering the strong equivalence associated to a modified behaviour transition system, obtained by BH-SYST by adding a set of (dummy) transitions defined by returnsrt t

~Nsrt

t-(LL->stop.

Thus we indicate by ~ the strong equivalence w.r.t, the new transition system of behaviours obtained by adding the above transitions. We give only some hints to the proofs, that will appear in a full version elsewhere. We can now give a basic result for behaviours without i-enclose and n-enclose combinators; in the next subsection we will extend it to the general ease. As Milner in [M2] extends ~ from agents to expressions, we extend ~ from behaviours to functions returning behaviours; given two terms fl and f2 of sort funct(srt,behaviour) fl ~ f2

fff for all terms tl, t2 of sort srt t 1 = t2 implies fl(tl) ~ f2(t2).

195

Theorem 3. ~ is a congruence on behaviours (without the i-enclose and n-enclose combinators). Pr99f. - bh 1' ~ bh 2' and a I = a 2 implies a 1 A bh 1' ~ a 2 A bh2'. Obvious. - For all srt ~ SORTS, bhfunct 1 ~ bhfunct2 implies choosesr t bhfunct 1 ~ chooses~ bhfunct2. Obvious. - bhfunet 1 ~ bhfunct2 implies fix 1 bhfunct 1 ~ fix 1 bhfunct2. Analogously to the proof of Proposition 4.6 of [M21. - For all sat ~ SORTS, b h l ' ~ bh 2' and bhfunct 1 ~ bhfunct2 implies defsr t bh 1' in bhfunct 1 ~ d e f str bh 2' in bhfunct 2. We show that R = (< defsr t bh' in bhfunct', defsr t bh" in bhfunct"> I bh' ~ bh" and bhfun~t' ~ bhfunct"} u Id, where Id indicates the identity relation, is a bisimulation up to ~ (i.e. ~R ~ is a bisimulation). IfR is a bisimulation up to ~, thenR c ~R ~ c ~. Let be an element of R, we prove, by cases, that if b h l ~ > ° bh'

bhl' , then bh 2

a > bh 2' and bh 1' R ~ bh2'.

a > bhl,, ' bh 1, = defsrt bhl,, in bhfunct' and a ~: RETURNsrt(..).

By the hypothesis bh"

~ > bh2" and bhl" ~ bh2", thus bh2---~--a> bh2',

bh2'= defsr t bh2" in bhfunct" and b h l ' R ~ bh2'. ° bh' = r e t u r n s r t t t and bhfunct'(tl)---~-> bh 1'. By the hypothesis bh" = r e t u r n str t2 and t 1 = t2; bhfunct'(tl) ~ bhfuncf'(t2) implies bhfunct,,(t2)

a > bh 2, and bh 1' ~ bh2'; thus bh 2

~t > bh 2, and bh 1' R ~ bh2'.

° bh' = returnsrtlt 1 with srtl~srt. Thus bh I = returnsrtlt I RETURNsrtl(tl)-> stop. By hypothesis bh" = returnsrtlt 2 with t 1 = t2, thus bh 2 = returnsrtlt 2 RETURNsrtl~2L> stop. Proposition 4, (clef/return properties). For every srt ~ SORTS 1) defsr t ( r e t u r n str t) in bhfunct ~ bhfunct(t). 2) For every srtl e SORTS such that srtl ~ srt defsr t ( returnsrtl tl) in bhfunct ~ returnsrtl t 1. 3) For every srtl e SORTS Isfree(tl,bhfunct) = false D defsr t (choose tl: srtl in bh(tl) ) in bhfunct ~ choose tl: srtl in ( defsr t bh(tl) in bhfunct ). 4) defsr t (a A bh) in bhfunet ~ a A (defsr t bh in bhfunct). Proof, 1), 2) and 3) Obvious, because - implies ~. 4) obvious. [] Proposition ~ (choose properties) 1) For every n,m.~>l, srt 1..... srtn,srtl',...,Srtm'~ SORTS [for all terms t 1..... tn of sort srt 1..... srtn respectively there exist tl',...,t m' terms of sort srtl',...,srtm' respectively such that bhl(t 1..... tn)~ bh2(ti',...,tm')] and [for all terms tl',...,tm' of sort srtl',...,srt m' respectively there exist t 1..... tn terms of sort srt 1..... srt n respectively such that bh2(tl',...,tm' ) ~ bhl(t I ..... tn) ]

196

implies choose tl: srt 1 in ... choose tn: srtnin b h l ( t 1..... tn) ~ choose tl': srt 1' in ... choose tm': srt m' in bh2(ti',...,tm'). 2)(Idempotence) For every srt e SORTS [ for all terms t of sort srt bhfunct(t) ~ bh] implies choosesr t bhfunct ~ bh. Proof. Obvious from the definition of ~. [] For simplicity we consider only the combinator fix 1, i.e. the unary fixpoint combinator. For expressing the properties of the fix 1 combinator we need the following definitions and lemmas. der bh indicates the derivation tree of bh, i.e. the labelled tree associated to bh in the transition system; given a derivation tree tr, ltrtn indicates the truncation of tr at depth n. Given a term f of sort funct(srtl,srt2), fn(t) indicates f applied n times to t. Similarly as in [M1] for CCS, we define that a variable x of type behaviour is guardf~[ in bh (i.e. x is preceded in bh by a A..., for some action a); we omit the trivial definition by induction on the structure of behaviours. Lemma 1. (basic fix lemma) If the variable x is guarded in bh(x), then given A = fix 1 )Lx . bh(x) and for m > 1 Am= ()~ x . hh(x))m(stop), we have that for all n > 1 Ider AIn = tder Anln = Ider An+qln (for all q >_ I), Proof. By arithmetic induction on n. [] Lemma 2. (fix-context lemma) For all terms bh(y) of sort behaviour with a hole of sort behaviour, if bhfunct = )~ x . bhl(X) with x guarded in bhl(X ), A = bh(fix 1 bhfunct) and for all p > 1 Ap = bh(bhfunctP(stop)), then we have that for all n > 1 Ider AIn = Ider A n In. Proof, By structural induction on bh(y). [] Proposition 6, (fix 1 properties) 1) For all terms bhl(Y), bh2(Y) of sort behaviour with a hole of sort behaviour, for all bhfunct = ;Lx. bh(x) with x guarded in bh(x) [for all n > 1 tder (bhl(bhfunctn(stop)))ln = Ider (bh2(bhfunctn(stop)))tn ] implies bhl(fix 1 bhfunct) ~ bh2(fix I bhfunct). 2) If x is guarded in bh(x), then Isfree(x,bhfunct) - false implies defsr t ( fix 1 % x . bh(x)) in bhfunct ~ fix 1 Xx. (defsr t bh(x) in bhfunct). Proof. Obvious, by Lemma 2. [] 3.2

Strong equivalence properties of parallel combinator

Here we use ~ ( ~ bold) to indicate the strong extensional equivalence of the algebraic transition system SYST (with transition relation D== [3==> [:]:state x extflag x state -¢bool) defining one of our calculi

197

and P-SYST and S-SYST indicate respectively the systems defined by the parallel and synchronous steps (recall that SYST has been defined following the three steps SMoLCS methodology ). Also in this case we need to distinguish the normal states of SYST and as in the previous section to do this we add some transitions to SYST; precisely skipl...Iskiplgc CORRECT_> stop[go; which allow to distinguish the correct terminal states from the incorrect ones.. Provosition 7. ( [ properties) 1) For every bh 111""[ bhlnlg °' bh21] ''-1 bh2n]g ° e WSig(SYST)lstate such that bhll ~ bh21 ..... bhln ~ bh2nwe have that bhl-1]...I bh~lnlgO ~ bh21[...I bh2nlgO; 2) for every bhms[go ~ WSig(SYST)lstat e seedlbhmslgo ~ bhmslgo ; 3) for every bhms[go ~ WSig(SYST)Jstat e, for every bh ~ WSig(SYST)Ibehaviou r such that bh ~ skip bhlbhmslgo ~ bhms[go. Proof. 1) By Lemma 3. 2) and 3) Obvious. [] ~mm~3_~(Monitofing step) For every bh111...I bhlnlgO , bh211...I bh2nlgO ~ WSig(SYST)lstat e, for every extf~ WSig(SYST)[extfl, ag such that bhll ~ bh 21,...,bhln ~ bh2n we have that i) for every bhll'l...I bhln'[go a WSig(SYST)lstat e SYST I - b h l l I...I bhlnlgo ==extf==> bhll'[...I bhln'lgo ' implies there exist bh 2 1'1... [b h2 n '[go' a W Slg(SYST) • Istate such that SYST 1- bh211...] bh2nlgo ==extf==> bh21'j...I bh2n'[go ' and bhll ' ~ bh21',...,bhln'~ bh2n'; ii) converse of i). Proof, By Lemma 4, recalling that in a SNIoLCS system the monitoring decision depends only on the possible actions of the behaviours and not on their states. [] Lemma 4, (Parallelism step) For every bh 111-.I bhlnlg o' bh21[-..I bh2n[gO ~ WSig(SYST)lstate' for every a~ WSiglSYST)[ac t such that bh11 ~ bh21 ..... bhln ~ bh2n we have that i) for every bh 1 l'l..-I bhln'lg o' e WSig(SYST)lstate P-SYST [ - b h l l I...I bhln[gO ~ a ~ > bh11'l...I bhl n'[go' implies there exist bh 2 1 '1'" I b h2 n 'lgo' ~ W Slg(SYST) • ]state such that P-SYST I- bh211...I bh2nlgO ~------a~> bh21'l...I bh2n'lgo ' and b h l l ' ~ bh21',...,bhln'~ bh2n'; ii) converse of i). Proof. By Lemma 5. [] Lemma 5. Under the same hypotheses of Lemma 3, we have that i) for every bhll'l...I bhln'lgo ' ~ WSig(SYST)lstate

198

S-SYST l - b h l l I..-I b h l n l g o ~ a ~ >

bhll'l...I bhln'tgo ' implies

there exist bh21't...I bh2n'lgo' ~ WSig(SYST)Istate such that S-SYST t- bh21I.-.I b h 2 n l g o = = = a ~ > bh21 I...I bh2nlgO and b h l l ' ~ bh21',...,bhln'~ bh2n'; ii)

converse of i).

Proof, By cases on the form of a. [] Proposition 8, (i-enclose, n-enclose properties) 1) For every n >--1 i-enclose(skipl...lskiplgo) ~skip n tir~es 2) For srt e SORTS for every n > 0

n-enclose(skipl...lskiplbgo) - skip. "v n times

A Isfree(t,bhi) = false A Isfree(t,go) = false D l
st ~ st' D i-enclose(st) ~ i-enclose(st'), sst ~ sst' D n-enclose(sst) ~ n-enclose(sst') where Z indicates the strong equivalence on the transition system SUB-SYST (parameter of the calculus) representing the noninductive concurrent components.

Proof, Obvious. [] Now we can extend Theorem 3 to all behaviours. Theorem 3,BIS, ~ is a congruence on behaviours. Proof. By Theorem 3, Proposition 7 and Proposition 8. []

Conclusion We have presented a proposal for a family of calculi, which are a partial instantiation of the SMoLCS parameterized schema. The novelties of these calculi lie in their high level of parameterization, in the possibility of defining functional modules and of considering processes just as data types. In this sense we personally see our calculi as a development for high-level specifications of the work started with CCS and SCCS, which we consider basic calculi, much as lambda-calculi are w.r.t, higher level languages. We are well aware that our presentation here is far from being satisfactory in many respects. We plan to come out with a more explanatory paper with full proofs. We are currently pursuing two directions of interesting research: first we are looking at a nice proof techniques for a generalization of strong equivalence handling labels with behaviours as subterms and including extensionality; second, we have already explored in part the possibility of calculi where the behaviour labels include, so to speak, the code for the interactions at synchronization, parallelism and monitoring level, while still keeping the fult expressive power of SMoLCS specifications; but it is not clear whether this calculus can be elegant and simple enough to be really useful. Finally we want to emphasize that the family of calculi AC we have used in the Ada Formal Definition

199

project can be seen as an upgrading of the V D M metalanguage Meta IV to handle concurrency and abstract data types.

Appendix

1:

Recursive specifications

Let SPEC = u {~,, Ax) I A x is a set of positive conditional axioms on Z}, where SIG is the set of all Z ~ SIG (classes o f isomorphic) signatures. A recursive definition of a specification has form (*) ID = S ( D ) , where S is a function f r o m SPEC into SPEC. After h a v i n g defined an ordering ~ on SPEC we can see (*) as defining ]J3 as the least fixpoint of S (if there exists). G i v e n S I = ( Z 1 , A x l ) and S2=(Z2,Ax2),

S 1 , S 2 iff Z 1 is a subsignature o f E 2 and Ax 1 ~ Ax2;

given E 1 = ( S o r t s l , O p n s l ) and E 2 = (Sorts2,Opns2), E 1 is a subsignature of E 2 iff Sorts 1 £2 Sorts 2 and Opns 1 £ 2 0 p n s 2. I f S is continuous, then (*) defines the specification ID in the following way: ID = 1.u.b. s n ( I D ± ) , n~0 where tD_L is equal to the specification with only one sort n a m e d id and neither operations n o r axioms. W h e n e v e r S is g i v e n by c o m p o s i n g constant specifications, the parametric specifications, P R O D , N~a.p, M S E T a n d the "+" and " e n r i c h ... by..." operators, then it is continuous. Clearly also sets o f mutually recursive specifications can be defined in the same way. W h e n e v e r the 1.u.b.of the chain { s n ( I D _ L ) } n > 0 is obtained as the k-th step for s o m e k, then the specification can be given in a n o n recursive way. Here as an example we report a nonrecursive definition of the specification PROC, defined recursively in subsection t.1. PROC = enrich NAT+ LOC + BUFID + CHID by sorts value, proc, instr opns < D, D>: instr × lmem Emptymap: [][D/D]: lmem x loc x value [ ( D ) : lmem x loc Nit: Pval: proc Nval: nat {Op: value x ... × value -~ value I Op: nat x ... × nat --~ nat ~ Writebuf, Readbuf: loc × build Send, Rec: loc × chid Skip: Start: proc ; V1, [] + [ : instr x instr While [] ~ 0 Do ~: loc x instr Seq-Instrl: ... Seq-Instrn: ...

~ proc ~ lmem ~ lmem --~ value -~ proc ~ value ~ value Sig(NAT) } --~ instr ~ instr ~ instr ~ instr --~ instr ~ instr --~ instr ~ instr

200

axioms "all total" {Op(Nval(n1),...,Nval(nk)) = Nval(Op(nl,...,nk)) I Op: nat x .. x nat --~ nat ~ Sig(NAT) } Eq(ll,12)= Irue~ (Im[v/ll])(12)- v Eq(ll,12)= false~ (Im[v/ll])(12)= lm(12) i 1;(i 2; i3) - ( i 1; i2); i3 Skip; i - i il+i 2 = i2+ i 1

i1+(i2+i3)- (il+i2)+i3.

Acknowledgements, We wish to acknowledge the invaluable cooperation of Martin Wirsing in building the foundations of the SMoLCS approach. Moreover we wish to thank all our friends of the Genoa-CRAI group (Alessandro Giovini, Franco Mazzanti, Elena Zucca), who have used, tested and improved our calculi in the Ada FD project. Many thanks also to Ombretta Arvigo for her patient Mac-typing and more generally for her cooperation at any time. REFERENCES (LNCS stands for Lecture Notes in Computer Science, Springer Verlag). [AGMRZ] E.Astesiano, A.Giovini, F.Mazzanti, G.Reggio, E.Zucca, The Ada challenge for new formal semantic techniques, in Proc. of the 1986 Ada International Conference, Edinburgh, Cambridge University Press, UK, 1986. [AMRW] E.Astesiano, G.F.Mascari, G.Reggio, M.Wirsing, On the parameterized algebraic specification of concurrent systems, Proc. CAAP '85 - TAPSOFT Conference, LNCS n. 185, 1985. [AMRZ] E.Astesiano, F.Mazzanti, G.Reggio, E.Zucca, Applying the SMoLCS specification methodology to the CNET architecture, CNET - Distribute Systems on Local Network, vol 2, pp. 255-267, ETS Pisa,1985. [AMRZ1] E.Astesiano, F.Mazzanti, G.Reggio, E.Zucca, Formal specification of a concurrent architecture in a real project, Proc. of ACM-ICS'85, North Holland, 1985. [AR1]

E.Astesiano, G.Reggio, A syntax-directed approach to the semantics of concurrent languages, in Proc. 10th IFIP World Congress (H.J. Kugler ed.), North Holland,p. 571-576, 1986.

[AR2]

E.Astesiano,G. Reggio, Comparing direct and continuation styles for concurrent languages, to appear in Proc. STACS 87', LNCS, 1987.

JAR3]

E.Astesiano, G.Reggio, The SMoLCS approach to the formal semantics of programming languages - A tutorial introduction - to appear in Proc. of CRAI Spring International Conference: Innovative software factories and Ada, 1986.

[ARWl]

E.Astesiano, G.Reggio, M.Wirsing, Relational specifications and observational semantics, in Proc. of MFCS'86, LNCS n. 233, 1986.

[ARW2]

E.Astesiano, G.Reggio, M.Wirsing, On the algebraic specification of function spaces, in preparation.

[ARW3]

E.Astesiano, G.Reggio, M.Wirsing, A modular parameterized algebraic approach to the specification of concurrent systems, in preparation.

[BJ]

D.Bjc~rner, C.B.Jones, The Vienna development method: The Meta-Language, LNCS n. 61, 1978.

201

[BWll

M.Broy, M.Wirsing, On the algebraic specification of finitary infinite communicating sequential processes, in Proc. WIP TC2 Working Conference on "Formal Description of Programming Concepts Ir', (D. BjCrner ed.), North Holland, 1983.

[BW2]

M.Broy, M.Wirsing, Partial abstract types, Acta Informatica 18, 1982.

[BW3]

M.Broy, M.Wirsing, Algebraic definition of a functional programming language and its semantic models, R.A.I.R.O. vok 17,1983.

[CRAI-DDC] E.Astesiano, C.Bendix Nielsen, N.Botta, A.Fantechi, A.Giovini, P.Inverardi, E. Karlsen, F.Mazzanti, J. Storbank Pedersen, G.Reggio, E.Zucca, Deliverable 7 of the CEC MAP project: The Draft Formal Definition of ANSI/MIL-STD 1815 Ada, 1986.

[HI

H.Hussmann, Rapid prototyping for Algebraic Specifications RAP system user's manual, MIP 8502, Universitat Passau, 1985.

[M1]

R.Milner, A calculus of communicating systems, LNCS n. 92, 1980.

[M2]

R.Milner, Calculi for synchrony and asynchrony, TCS 25, 267-310, 1983.

No]

F,Morando, An interpreter for concurrent systems SMoLCS specifications, Thesis (in italian) University of Genova, Italy, 1986.

[P]

G.Plotkin, A structural approach to operational semantics, Lecture notes, Aarhus University, 1981.

[sw]

D.T.Sannella, M.Wirsing, A kernel languagefor algebraic specifications and implementation, in Proc. Int. Conf. on Foundations of Computation Theory, Borgholrn, Sweden, LNCS n.158, 1983.

[W]

M.Wirsing, Structured algebraic specifications: a kernel language, TCS Vol.42 n. 2, 1986.

PARAMETERIZED HORN CLAUSE SPECIFICATIONS: PROOF THEORY AND CORRECTNESS M. Navarre Informatika Fakultatea Euskal-Herdko Unibertsitatea San Sebastian, SPAIN F. Orejas Facultat d'lnform&tica Universitat Polit~cnica de Catalunya Barcelona, SPAIN

Recently, "algebraic" equational Horn clause specifications (or, in some sense, conditional specifications) have been advocated by several authors as the solution to some of the problems of Prolog [see, for instance, 11]. Most of the work done in this field has been dealing only with the operational aspects of such specifications (e.g. rewriting, narrowing, etc.), perhaps assuming that other kind of results will be direct generalizations of those obtained for the equational case. However, there is an aspect that hinders, in many cases, this generalization: working with a (so-called) boolean constraint, i.e. having as admissible models for specifications algebras satisfying that a boolean sort contains only two values: true and false. Specifically, constructions that are almost trivial in the standard framework have to be approached with new techniques. In this paper we study two aspects of parameterized specifications, proof theory and correctness. We characterize the inductive theory of a parameterized specification generalizing some results obtained by P. Padawitz in [15] (in particular some restrictions have been removed, for instance the need to have equality operators explicitly defined for every sort, or the need for persistency: we only ask for "bool-persistency"). Then, we obtain a proof theoretical characterization of three conditions related to the correctness of a parameterized specification: bool~persistency, (i.e. the property that ensures that the booleans are not "destroyed" by the parameterization), persistency (i.e. protection of the actual parameter) and passing compatibility (i.e. the property that assures the compatibility of the functorial and pushout semantics for parameter passing).

203 Other previous work related with our results is [8,5,16,14]. In [8] Ganzinger obtained the proof-theoretical characterization of persistency for the equational case. The characterizations of bool-persistency and persistency presented here are strongly inspired in his, indeed, the only-if part of our proofs is a direct generalization of his, but the if part presented the kind of problems mentioned above. In [5] Ehrig dealt with parameterized specifications with arbitrary constraints (thus his work is more general), some of his results have been used in this paper, however his approach was model-theoretical due to the generality of his framework. In [16] Padawitz obtained conditions for checking persistency of parameterized equational specifications with a boolean constraint. Although the similarity of the framework, the results are quite different, he was mainly involved in obtaining sufficient conditions for persistency that were easily checkable using rewriting techniques. With respect to [14], the characterization of passing compatibility presented here is a straightforward generalization of the one presented there, once the new techniques used in the previous results are applied. The organization of this paper is as follows: In section 1, we introduce briefly the basic concepts. In section two, we characterize the inductive theory defined by a parameterized specification. Finally, in section 3 we obtain the characterization of boot-persistency, persistency and passing compatibility.

ACKNOWLEDGEMENTS The authors would like to thank P. Padawitz for showing us in [I5] the use of the Ultrafilter Theorem. This work has been partially supported by Comisi6n Asesora de Investigaci6n (ref. 2704-83)

1. Preliminaries Familiarity with the usual notions concerning (parameterized) algebraic specifications is assumed (for detail, see [7]).

Given a set of sorts S, an S-sorted signat~r~ ~ is an indexed family of sets of operation symbols, ~ = {~v,s}w*~ S,s~ S"

A z-algebra A consists of a family of sets (carriers or data domains) {As}seS, and a family of operations

204 ~A:AslX...xAsn--->As for every c in Zsl_.sn,s A ;~-homQmQr0hism h: A ---> B, where A and B are ~-atgebras is a family of functions {hs: A s ---> Bs}sc S which commute with the operations. ~-algebras together with their homomorphisms form the category Alga:, having as initial object (up to isomorphism) the term algebra T~:. Tz(X) stands for the _algebra of terms with variables in X, i.e. the free ~:-algebra generated by X. Given an assignment a: X ---> A, there is a unique z;-homomorphism a: T:~(X) ---> A, extending a.

A ~:-algebra A satisfies

a (conditional)

eauation.A I= XX.t=t' if t l = t l ' & ... & tn=tn', with

t,t',tl,tl',...,tn,tn' in Tz.(X), iff for every assignment a: X ---> A, if for every i (l_
A specification SP is a triple (S, z. ,E) formed by a set of sorts, a signature and a set of (conditional) equations. Given a specification SP = (S,~;,E), a ~>algebra satisfying E is called a SP-alaebra. SP-algebras together with their homomorphisms form the category Algsp with initial object TSp = T~/=-E, where ~-E stands for the congruence generated by E. Given a specification SP = (S,z,,E), a combination of SP and SP0 = (S0,~:0,E0), denoted SP+SP0, is defined: SP+SP0 = (S+S0,~;+:T..0,E+E0) where + denotes disjoint union. Note that SP0 does not need to be a specification (for instance, there may be a c~in ~0w,s with ws in (S+S0)+-S0 +, but SP+SP0 does.

A.specification morDhism h: SP1 ---> SP2 consists of a function h:S1--->S2 and a family of functions {hw,s:~;lw,s--->~;2h,(w),h(s)}w, S,seS (where h*(sl-.sn) denotes h(sl)...h(sn)), such that E2 ~_h(E1), i.e. every equation in E1 when translated through h belongs to E2. Specifications together with their morphisms form the category CATSP. Every specification morphism h: SP1 ---> SP2 induces a functor Uh: AIgsP2---> Algsp 1 called the forgetful functor associated to h, defined Uh(A2)=A1 iff

vseSt

A1 s = A2h(s)

205 VceZlw,s dA1 = (hw,s(•))A2

Uh has a left adjoint Fh: AIgsp 1 ~-> AIgsp 2, called the free functor associated to h.

From now on, we shall assume that every specification contains, as a subspecification, the boolean specification. Also, we will not allow non boolean operations having boolean parameters, i.e. if ~E:Se,bool-Z.BOOL, then wE(S-{bool})*. That is, we are considering booleans as special values: we may define boolean-valued functions (predicates) but they may not be parameters.

Moreover, we shall assume that equations take the form ~.X.t=t' if C where C is a Z.(X)-condition, i.e. a z(X)-term of boolean sort. Though the abuse of notation, conditions may denote, as above, boolean sorted equations of the kind: C=true. Equations of the kind:

;~X.t=t' if true will often be abreviated to:

XX.t=t'

Given a specification SP, the category LOGALG(SP) shall denote the full subcategory of Algsp, whose objects are algebras A satisfying that Ubool(A) = B (where bool is the inclusion morphism from the boolean specification BOOL to SP and B is the boolean algebra of two elements).

In [13] two proof systems, t- and I-L, were given satisfying:

SP t- ;~.X.t=t' if C iff vAeAIgsp A i= ;~.X.t=f if C SP I-L ~.X.t=t' if C iff vAe LOGALG(SP) A I= ~.X.t=t' if C

1- is just a generalization to the many sorted case of a proof system given by Selman in [17] using the technique devised by Goguen and Meseguer in [10] to deai with many-sorts. I-L is an adaptation of another proof system given by Selman in the same paper adding rules to cope with the boolean constraint.

Note that SP I- ~.X.t=t' implies SP I-L xX.t=t' but the converse is not true, even if the terms tl and t2

206 contain no variables. For instance, if SP contains the equations:

~.X.t=t' if C ~.X.t=t' if not(C)

then SP I-L ~.X.t=t' but not necessarily SP I- ~.X.t=t'.

A set of conditions COND is non contradictina with respect to a set of equations E iff

E+COND*I-/L true=false

where COND* is the same as COND, but considering its variables as constants. From now on, although the abuse of notation and if there is no possible confusion, we will not distinguish between COND and COND*.

A parameterized data type PDT is a triple (PAR,BODY,H), where PAR = (SPAR,~;PAR,EPAR) is the p~.r~.meter declaration. BODY = (SBODY,:~BODY,EBODY) = PAR + (S2,z2,E2) is called the taraet specification and H is a functor, H: LOGALG(PAR) ---> LOGALG(BODY) (we assume H equipped with a natural family of homomorphisms IA: A ---> Ui(H(A)), where i is the inclusion morphism from PAR to BODY). H is persistent (stronalv oersistent/iff for every A in LOGALG(PAR), IA is an isomorphism (the identity).

A paramet~rized specification PSP is a pair (PAR,BODY), where PAR and BODY are as in the previous definition and satisfy bool-oersistency, i.e. for every A in LOGALG(PAR), Ubooi(Fi(A))= B, where Fi is the free functor associated to the inclusion morphism from PAR to BODY. The semantics of PSP is considered to be the parameterized data type (PAR,BODY,Fi). We shall say that PSP is persistent if Fi is persistent or strongly persistent. Often, parameterized (conditional) specifications are not persistent if we consider as admissible parameter any PAR-algebra, although they are persistent when we do restrict to LOGALG(PAR). This happens with the following example: Example 1.1 Let PAR be the following specification: PAR = BOOL + sorts data ops

eq: data x data ---> bool

207 eqns

1) ~.x. eq(x,x) = true 2) X{x,y}.x=y if eq(x,y)

and let BODY be: BODY = PAR + sorts set ops

empty: set insert: set x data ---> set is in: set x data ---> bool

eqns 3) ;qs,x,y}. insert(insert(s,x),y)=insert(insert(s,y),x) 4) x{s,x}, insert(insert(s,x),x)= insert(s,x) 5) Xx.is_in(empty,x)=false 6) ;qs,x}.is_in(insert(s,x),x)=true 7) ;~{s,x,y}.is_in(insert(s,x),y)=is_in(s,y) if not(eq(x,y))

This parameterization, as we shall see Jater, works perfectly well (it is persistent) if we restrict admissible parameters to those in LOGALG(PAR), i.e. those in which the boolean values are {true,false} and eq is equality, but is not persistent (it may add "junk" to the parameter) if we do not restrict the class of admissible parameters. Changing the specification (for instance, adding more equations) would not help to solve the problem. •

Now, we may define standard parameter passing at the specification level: given a parameterized specification PSP = (PAR,BODY), with PAR = (SPAR,zPAR,EPAR) and BODY = (SBODY,~.BODY,EBODY)= PAR + ($2,~;2,E2), a specification ACT = (SACT,~:ACT,EACT) called actual parameter sDecificafion and a morphism hl : PAR ---> ACT, called oarameter passing morohism, the mechanism of psrameter passing may be described by the following pushout diagram:

PAR

il

ACT

#

B3E)Y

~ VAL i2

208 where il is the inclusion morphism. VAL is called the value soecification. More concretely, VAL = (SVAL,~VAL,EVAL) = ACT + ($4,~:4,E4), with S4 = $2, ,7_.4.= h2(~:2) and E4 = h2(E2), i2 is the inclusion morphism and h2 is defined: h2(s) = if seS2 then s else hl(s) h2w,s(~ ) = if ce;~2 then c else hlw,s(C )

Parameter passing is correct iff the following two conditions hold, for every A in LOGALG(ACT):

1) Actual oarameter orotection: Ui2(Fi2(A)) = A 2) Passina comoatibility: Fil (Uhl (A) = Uh2 ( Fi2(A ) )

A parameterized specification is correct (resp. satisfies passing compatibility) if for all possible actual parameter specifications (and parameter passing morphisms) parameter passing is correct (resp. satisfies passing compatibility). In [5] it is proved that PSP is correct iff it is persistent.

2.

The inductive theory of, e,,,pere, meteri.zed soecification

Given a specification SP, the theory defined by this specification consists of all the equations deducible from SP, which (if the proof system is sound and complete) coincide with the set of equations satisfied by all models of SP. However, often we are not interested in ~ models satisfying SPo For instance if the specification is not parameterized we may be interested only in finitely generated models, or if it is parameterized on models finitely generated from the actual parameter. The set of equations satisfied by all models finitely generated (from the actual parameter) satisfying a (parameterized) specification is called the inductive theory defined by the specification: Definition 2.1 Given a parameterized specification PSP=(PAR,BODY), we define the inductive equational theory defined by PSP: IND(PSP) = { XX.t=t'/vAe LOGALG(PAR) F(A)I = ;~X.t=t'} In Theorem 2.4 we will characterize IND(PSP) in terms of the (non-conditional) equations satisfied by

209 certain free algebras, but before that we have to see two lemmas: NOTE From now on, given two z(X)-terms tl, t2 and a z.(X)-condition C, we shall say that Et-L tl=t2 if C (instead of EI-L ~.X.tl=t2 if C) if from E we may deduce this equation considering the variables as constants, i.e. considering tl and t2 as ground terms and C as a ground condition. Lemma 2.2 Given SP = (S,T_.,E)and a set of :~(X)-conditions COND such that COND is non contradicting w.r.t. E, then there is a set of bool-sorted equations E(COND) such that Tz(X)/---E+E(COND) satisfies every condition in COND and belongsto LOGALG(SP). Proof

Let A = T:s(X)/~-Der(E), where Der(E) denotes the set of equations t=t' such that E I-L ;,~X.t=t'. Obviously, UBooI(A) is a boolean algebra. Let COND' be COND U {not(C)/SPI-L true=false if C}, COND' denotes a set of values in UBooI(A ) satisfying the finite intersection property (i.e. the conjunction of any finite subset of boolean values is not equal to false) since COND is non contradicting w.r.t. E, then, according to a corollary of the Ultrafilter Theorem (cf. [2]). there is an ultrafilter U containing all the vaiues denoted by COND'. Finally, we define E(COND) as {tl=true/tl denote a value inside U} U {tl=false/tl denote a value outside U}. By construction, Tz.(X)/-=E+E(COND) satisfies every C in COND and belongs to LOGALG(SP) since, on one hand, by construction in UbooI(T~,(X)/-~E+E(COND)) there wilt be at most two elements, true and false, and, on the other hand they are different because it may be proved that for any pair of boolean sorted terms, tl and t2 in T~,(X), T:~(X)/~E+E(COND)I= tl=t2 iff there is a ~:PAR(X)-condition C such that El-L xX.tl=t2 if C and e E(COND). But if Et-L ~.X.true=false if C then, by construction, only <not(C)=true> and belong to E(COND). • Lemma 2.3

Given SP = (~:,E), a set of ~:(X)-conditions COND and two ,~(X)-terms tl and t2 such that SP+COND*~/L tl =t2, there is a set of bool-sorted equations E.(COND,tl,t2) such that A=T:~(X)/-=E+E(COND,t1,t2) belongs to LOGALG(SP), A lCtl=t2 and A satisfies every C in COND. Proof

Let COND' be COND U {not(C)/SPI-Ltl=t2 if C}, by assumption COND' is not contradicting w.r.t. SP, thus

210 applying lemma 2.2, there is a set of equations E(COND') such that A=Tz(X)/~E+E(COND,) satisfies every C in COND' (and, thus, in COND) and belongs to LOGALG(SP). On the other hand A I~tl=t2, since otherwise a condition in COND' would be false in A, contradicting one of the two previous statements. • Theorem 2.4 Let PSP be the parameterized specification (PAR,BODY) and let XpA R be an (SPAR-{bool})-sorted denumerable set of variables then: ~.X.tl=t2 e IND(PSP) iff TzBODy(XpAR)/-_-Der(EBODY) I= ~.X.tl=t2.

Proof =>) Suppose T~BODy(XpAR)/=-Der(EBODY) Is a(tl)=a(t2) for a given assignment a: X-->, T;~:BODy(XpAR) then, according to the previous lemma there is a set of bool-sorted equations E(o,a(tt),a(t2)) such that A=T~BODy(XpAR)/-~E+E(o,a(tl),a(t2)) belongs to LOGALG(BODY) and A Is a(tl)=a(t2). Let U(A) be the PAR-algebra obtained after applying the forgetful functor to A. Obviously, U(A) is in LOGALG(PAR), moreover F(U(A)) Is a(tl)=a(t2) since otherwise a(tl) and a(t2) would be equal in A. Note, however, that we do not need F to be persistent (although, it is assumed to be bool-persistent).

<=) If T~:BODy(XpAR)/~-Der(E) I=tl=t2, then for every algebra A in LOGALG(PAR) and every assignment h: X ---> F(A) there is a (unique) homomorphism h : TzBODy(XpAR)/~Der(E) ---> F(A), thus F(A) I=tl=t2. ,

3. Correctness of parameterized specifications As we have seen in the preliminaries, three conditions are asked for the correctness of parameterized specifications: boot-persistency, actual parameter protection (persistency [5]), and passing compatibility. In this section we are going to characterize proof-theoretically bool-persistency (Theorem 3.1) and persistency (Theorem 3.3) in terms of consistency and completeness conditions. After, we will characterize passing compatibility in terms of persistency (Theorem 3.4). Theorem 3.1 PSP = (PAR,BODY) is bool-persistent iff PSP satisfies the following two properties:

1. Bool-consistencv: BODY I~ true=false

211 2. B0oi-comptetene$$: For every t in T~:BODy(XpAR) of boolean sort there are tl ,...,tn in T~:PAR(XpAR) and ~:PAR(X)-conditions C1 ..... Cn, such that BODYI- L ~.X.t=ti if Ci (for every i, l_i_
Proof =>) If PSP is not boot-consistent, obviously, PSP is not persistent w.r.t booleans. Assume PSP is not bool-complete, let t be the boolean sorted ~.BODY(X)-term for which there is not a finite set of terms tl ..... tn and ~:PAR(X)-conditions C1 ..... Cn such that BODYJ- L ;LX.t-ti if Ci (for every i, l_
<=) Let A be in LOGALG(PAR), for every t in T:~BODy(A)bool, since A is a LOGALG(PAR)-algebra and SP is bool-complete, there is a t i in TZ:PAR(A) and a ~PAR(A)-condition C i such that:

(*)

SP I-L t=ti if C i and Af= Ci=true.

This implies F(A)I= t=t i.

Assume F(A)J= t=t', with t,t' in TzPAR(A ), this means that there is a sequence of terms t 1 ..... t n such that t=t 1 , t'=t n, and for every i (lBODY+E A ti+l, we will define a sequence of r.PAR(A)-terms t l',.,.,tn', (with t l'=t 1 and tn'=tn) and of %PAR(A)-conditions C 1 ..... C n such that for every m (0_m
a) BODY I-L tm=tm' if Cm b) EA 1 l Cm=true

c) EA I-L tm'=tm+l'

it should be clear that if such sequences of terms and ~PAR(A)-conditions exist then AJ= t=t'.

212 In the definition of ti+ 1' and Ci+ 1 we have two cases:

case 1: BODY I-L ti=ti+l if C i' and BODY+EA i-L Ci'=true- By booI completeness, there are ~:PAR(A)-conditions Cil,Cil',...,Cik,Cik', such that BODY IL Ci'=Cij if Cij' for every j (l<j _
case 2: EA I-L ti=ti+l. This means that there are terms I,r ETa:PAR(A) and tET:F_.BODy(AU{x}) such that eEA, fl(t)=t i and f2(t)=ti+ 1, where fl and f2 substitute, respectively, x by I and x by r. Now, by sufficient completeness, there is a z;PAR(AU{x})-term t' and a :~PAR(AU{x})-condition C' such that BODY I-L t=t' if C' and AI= fl(C'). Let ti+ 1' and Ci+ 1 be, respectively, f2(t') and f2(C'), obviously

BODY I-L

ti+ l=ti+l' if Ci+ 1 and A[= Ci+l=true, moreover, AI= ti'=ti+ 1' since, by transitivity, BODY+EA I-L ti'=ti+l' if Ci&Ci+ 1 , and thus, by consistency, PAR+EA I'L ti'=ti+l' if Ci&Ci+ 1 . •

Example 3.2 It should be clear that the specification of example 1.1 is bool-consistent, let us see that it is also bool-complete. Every

term

t

in

T~:BODy(XpAR)bool-

is_in(insert(.._(insert(empty,xl),...),xn),y).

Tz. P A R ( X p A R )

We will proceed by induction:

case n=0 Trivial: BODY t-L ~.x.is in(empty,x)=false case n=k+l On one hand we have: BODY I'L ~.{s,x,y}.is_in(insert(s,x),y)=is_in(s,y)

if not(eq(x,y))

On the other using equation 2) and substitutivity: BODY I'L ;qs,x,y}.is_in( insert(s,x),y)= is in(insert(s,x),x) if eq(x,y)

is

of

the

form:

213 and by equation 6) and transitivity: BODY

IL ~{s,x,y}.is_in(

insert(s,x),y)=true if eq(x,y)

Finally, trivially: PAR I-L ~,{x,y} eq(x,y) v not(eq(x,y)= true

Theorem 3.3

PSP = (PAR,BODY) is persistent in LOGALG(PAR) iff PSP satisfies the following two properties:

t..O.9..Q~s'~ency: For every tl ,t2 in T}:PAR(X ) and every ~;PAR(X)-condition C we have PAR l-L ;LX.tl =t2 if C iff BODY I'L ~X.tl=t2 if C.

2. Sufficient comoletengss: For every t in T ~ : B O D y ( X p A R ) of sort in PAR, there are tl ..... tn in T•PAR(XpAR) and ]~PAR(X)-conditions C1 ..... Cn, such that BODY I-L ;~X.t=ti if Ci (for every i, l
Proof

=>) Assume PSP is not consistent, i.e. there are terms tl, t2 and a ~:PAR(X)-condition C such that BODY J'L ;LX.tl=t2 if C and PAR ~L ~.X.tl=t2 if C. Obviously PAR+C }'/'L tl =t2, since otherwise XX.tl=t2 if C would be trivially deducible from PAR. Hence, according to lemma 2.3 T~;PAR(X)/_--EPAR+E(C,t 1,t2) is in LOGALG(PAR), C is true in A and in A I¢ tl=t2. On the other hand, obviously, in F(A) l= tl=t2.

Assume PSP is not sufficiently complete, let t be the ~BODY(X)-term for which there is not a finite set of terms tl ..... tn and ~:PAR(X)-conditions C1 ..... Cn such that BODY I'L ;LX.t=ti if Ci (for every i, 1-
<=) Similar to the same part of theorem 3.1.

214 In [14] it was proved that for the equational case passing compatibility was almost persistency (persistency or trivial inconsistency), here, using similar techniques, we are going to prove that persistency is exactly passing compatibility. The reason is that we are assuming bool-persistency and, thus, avoiding trivial inconsistency. Theorem 3.4

PSP satisfies passing compatibility for every logical parameter iff PSP is persistent.

Proof

=>) Assume PSP is not consistent (but remeber that PSP is assumed to be bool-persistent), then there are two Y.PAR(X)s-terms tl and t2 and a ~:PAR(X)-condition C such that PAR ~L ;~X.tl=t2 if C and BODY I-L ~.X.tl=t2 if C. Let SP' be the specification PAR+(~,~:',E'), where ~;' consists of X (taken as constants of appropriate sorts) plus an operation c: s --> bool, and E" consists of the equations: c(tl) = true c(t2) = false Clearly, C is non contradicting w.r.t. EPAR+E', then, according to Lemma 2.2, there is a set of equations E(C) such that A = T~:PAR+~:,/~-EPAR+E,+E(C) is in LOGALG(SP), AI= C=true and AI~ tl=t2 (otherwise A would not be in LOGALG(SP'). Now, let ACT be SP'+(o, o,E(C)), let the parameter passing morphism hl be the inclusion morphism, then in Fi2(A) true is equal to false, but not in Fil(Uhl(A)).

Assume PSP is not sufficiently complete, let t be the ~BODY(X)-term for which there is not a finite set of terms tl ..... tn and ~:PAR(X)-conditions C1 ..... Cn such that BODY I-L ~.X.t=ti if Ci (for every i, l_ s' and Us: s' --> s, for every s in SPAR-{bool}, and E" consists of the equations:

UsCs(t) = t

for every s in SPAR-{bool} and every t in Tz:PAR+Z;,. Now, let COND be {not(C)/C is a ~;PAR(X)-condition

215 and 3t' in T~:PAR(X) PSP I'L ;~X.t=t' if C}, COND is non contradicting w.r.t EPAR+E' thus according to lemma 2.2 A = T~:PAR+~:,/---EPAR+E,+E(COND)is in LOGALG(SP') and every not(C) in COND is true in A (i.e. every C is false in A). Let ACT=SP'+(o,o,E(COND)), let the parameter passing morphism hl be the inclusion morphism, then Fil(Uhl(TACT) ) ~ Uh2(Fi2(TACT)). The reason is the following: Fil generates some junk on Uhl (TACT) (at least the term t would be junk, if we consider its variables as constant symbols from ~'), but on Uh2(Fi2(TACT) ) we have generated, at least, the double of junk: for every junk element t of sort s generated by Fil, in Fi2(TACT) we have the same element plus UsCs(t).

<=) See [5] • 4. Referenqe~

[1]

Arbib, M.E.; Manes, E.G.: "Arr0w._s. structures and functors: the categ0rics, I imperativQ",

Academic Press 1975. [2]

Bell, J.L.; Slomson, A.B.: "Models and Ultraoroducts: an IntroduqtJPn", North-Holland (1971)

[3]

Burstall, R.M.; Goguen, J.A.: "The semantics of Clear, a specification language",

Copenhaoen Winter Schq01 qn Abstract Software Speqification, Springer LNCS 86, pp. 292-332, 1980. [4]

Ehrich, H.-D.: "On the theory of specification, implementation and parameterization of abstract

data types", JA(~M 29,1 (1982), pp. 206-227. [5]

Ehrig, H.: "Algebraic theory of parameterized specifications with requirements", Pr0c. 6th.

CAAP, Springer LNCS 112, pp. 1-24, 1981. [6]

Ehrig, H.; Kreowski, H.-J.; Thatcher, J.W.; Wagner, E.G.; Wright, J.B.: "Parameter passing in

algebraic specification languages", Prqc. Aarhus Wqrkshoo on Pr0gr~m Specification, Springer LNCS 134, 1981. [7]

Ehdg, H.; Mahr, B.: "Fundamentals of alaebraic specification 1", Springer EATCS Monographs on

Theor. Comp. Sc., 1985. [8]

Ganzinger, H.: "Parameterized specifications: parameter passing and implementation with respect

216 to observability", TOPLA_S_5,3 (1983), pp. 318-354. [9]

Goguen,J.A.; Meseguer, J: "Universal realization, persistent interconnection and implementation

of abstract modules", Prec. IX ICALP, Springer LNCS 140, pp. 265-281, 1982. [10] Goguen, J.A.; Meseguer, J: "Completeness of many-sorted equational logic", ~igplan Notices 16,7 (1981) pp 24-32. [11]

Goguen, J.A.; Meseguer, J: "Equality, types, modules and (why not?) generics for logic

programming", The J.o_urnalof Logic Programming 1,2 (1984), pp. 179-210. [12]

Goguen,J.A.; Thatcher, J.W.; Wagner, E.G.: "An initial algebra approach to the specification,

correctness and implementation of abstract data types", in ' ~ t

Trends in Pr0gramminq Methodoloqy.,

V01 IV: Data Structuring', R.T. Yeh (ed,), Prentice Hall 1978, pp. 80-149. [13] Navarre, M.; Orejas, F.: "Proof rules for conditional equations", Res. Rep., Facultat d'informatica de Barcelona, 1986. [14]

Orejas, F.: "Passing compatibility is almost persistency", in 'Recenl; trend8 on data type

soecification' H.-J. Kreowski (ed.)Springer IFB 114, 1985. [15] Padawitz, P. : "Towards a proof theory of parameterized specifications", in 'Semantics of Data Types', G. Kahn, D.B. MacQueen, G. Ptotkin (eds.), Springer LNCS 173 (1984), pp. 375-391. [16] Padawitz, P. : "Parameter preserving data type specifications", in 'Formal Methods and Software Development, voll', H. Ehrig, Ch. Floyd (eds.) Springer LNCS 186 (1985), pp. 323-341. [17] Selman, A. : "Completeness of calculii for axiomatically defined classes of algebras", Algebra Universalis, 2, 1 (1972), pp. 20-32. [18] Thatcher, J.W.; Wagner, E.G.; Wright, J.B.: "Data type specification: parameterization and the power of specification techniques", Prec. 10th STOC, San Diego, Ca., 1978.

PARTIAL COMPOSITION AND RECURSION OF MODULE SPECIFICATIONS

Francesco Parisi-Presicce Department of Mathematics University of Southern California Los Angeles, California 90089-1113

ABSTRACT The basic interconnections of module specifications (union, composition and actualization) were studied in earlier papers. Here we introduce partial composition and partial actualization of module specifications, describe the connection with their "total" counterpart and prove that the result of successive partial compositions (or actualizations) is independent of the order. We also introduce a recursive construction first of a single module and then of two modules "recursivety calling" each other. A connection between these two recursions is established, along with compatibility properties with the basic constructions and the expected fixed point equation at the semantical level.

1. I N T R O D U C T I O N The algebraic approach to the formal specification of data types has been the most investigated one (fLZ 75/,/GTW 78/,/WPPDB 83/,/Ga 83/and many others), although there have been other interesting approaches in more general settings (/BMM 79/). The module specification introduced in earlier papers (fEW 85/,/BEPP 86/) is a formalization of a notion which is central to the modular approach to the development of large software systems (/qPa72/,/WE 85/). tt combines the main ideas of parametrized specification and of implementation of abstract data types along with the notion of information hiding, treated in/GM 82/by adding an export interface to a data type to represent its visible part. An abstract mc~tfle consists of four parts: an export interface, with the operations visible outside the module, an import interface, representing the operations to be provided to the module, a parameter part, shared by the interfaces, and a body, containing both interfaces and providing an implementation of the sorts and operations of the export interface in terms of those of the import. All four parts are described by algebraic specifications (see/EWT 83/,/EFPB 86/for extensions), the first three with loose semantics, while that of the body is the free consmaction over import algebras. Our notion of module reflects in part the structure of Ada packages and Modula-2 modules, both consisting of a "declarative" part, with the list of sorts and operations visible outside and either the list of those to be imported (Modula-2) or the name of another module

2t8

whose export operations are needed in the body (Ada), and an "implementation" part, with the module's own data type and defined operations. In both languages, the interfaces are purely syntactical, not allowing semantical conditions on the sorts and operations, as we do or as permitted in OBJ2 (/FGJM 85/) and in Extended ML (/ST 85a/). More detailed discussions on the relationship between our module concept and Ada and Modula-2 can be found i n / B E F P 86/, ~ W 86/. The interconnection mechanisms for building modules from other modules are an integral part of a stepwise modular development of software systems (/BG 77/). In previous papers, we have introduced four basic operations on module specifications:

union (/BPP 85/),

composition

(JEW 85/, ]BEPP 86/), actualization (]EW 85], ]PP 85/) and extension (/BEPP 86/). We have also shown that these operations are compatible (/PP 86/,/EFP 86/), guaranteeing that the correctness of a stepwise refinement strategy for module specifications is independent of the order in which the building operations are carried out. In this paper, we introduce two new operations on module specifications: partial composition/actualization, and recursion. Partial composition allows us to compose a module, whose import consists of two distinguishable parts I1 and I2, with another module which provides the data described, say, in I1, postponing the decision for I2 to a later time. This operation is proved to be well defined both syntactically and semantically and to produce the same result regardless of whether the successive partial compositions are carried out first through Ii and then through I2 or vice versa. Similar results are obtained for partial actualization. The single recursion construction defines a new module recf(M) from a given M, when the import of M is intended to be provided by the export of M itself. The mutual recursion operation provides a new module from two module specifications "recursively calling each other". The two constructions are syntactically correct but, unlike the other operations, additional conditions are required to guarantee their semantical correctness. Single recursion is shown to be compatible with union, composition, actualization and the "submodule" partial order. The paper is organized as follows: section 2 contains a review of the basic notions of module specification, its semantics and basic operations, along with a summary of their compatibility. Section 3 introduces partial composition and partial actualization, relates them to their total counterpart and shows how successive partial compositions (or actualizations) are equivalent to a union followed by a total composition (or actualization). Section 4 defines single recursion using coequalizers, and shows how its semantic satisfies a fixed point equation. Mutual recursion, defined independently, is shown to be related in a natural way to single recursion. Some conclusions are drawn in section 5. 2.

MODULE S P E C I F I C A T I O N AND T H E I R BASIC OPERATIONS We assume some familiarity with the basic notions of algebraic snecification SPEC = (S, OP,

E) and of specification morphism f = (fs, fop): SPEC1 --~ SPEC2. We use Atg(SPEC) to denote the category of SPEC-algebras and SPEC-homomorphisms. Any specification morphism f : SPEC1 --~ SPEC2 defines a forgetful functor Vf : Alg(SPEC2) --* Alg(SPEC1) whose left adjoint Ff : Alg(SPEC1) --~ Alg(SPEC2) is called the ~ n c t o r

associated with f.

219

The category CATSPEC of specifications and specification morphisms is dosed under the pushout construction (/EM85/) and SPEC1 + SPEcoSPEC2 denotes the pushout object of fj : SPEC0 --* SPECj, j = 1,2, when the specification morphisms are obvious from the context. For any pushout SPEC3 = SPEC1 + S P E c o S P E C 2 ,

any SPEC3-algebra A3 (resp.

SPEC3-homomorphism h3) is the amalgamated sum A1 + AoA2 (resp., hl + h0h2) of SPECi-algebras Ai (resp., SPECi-homomorphisms hi). Given pushout specifications SPEC3 and SPEC3' and functors Fi : Alg(SPECi) --~ Alg(SPECi'), i = 0,1,2, we use F1 + FoF2 to denote the functor F3: Alg(SPEC3) --~ Alg(SPEC3') defined by F3(A1 + AoA2) = FI(A1) + F0(A0)F2(A2). For more details, see/EM85L 2.1

Definition (Module Specification and Semantics) A module specification M is a four-tuple (PAR, EXP, IMP, BOD) of algebraic specifications

along with four specification morphisms i, v, s and e (s and e injective) making the following syntactical diagram commute e

PAR

--~

$

IMP

s

--~

EXP $

v

BOD

The semantics of M is SEM = V v • F s. The restricted semantics is RSEM = R e" SEM, where R e : Alg(EXP) --~ Alg(EXP) is given by Re(E ) = n {E'E Alg(EXP): g ' c E, Ve(E) = Ve(E)}. A semantical condition is imposed on the free functor Fs, which is required to be strongly persistent, i.e. that V s (Fs(A)) = A for all IMP-algebras A. Sometimes (in particular when dealing with composition of module specifications) we will add the requirement that F s preserves injective morphisms and call it, in this case, strongly conservative. I n t e r o r e t a t i o n The specifications IMP and EXP represent the import and export interfaces, respectively, PAR is the shared parameter part and BOD is the body of the module intented to contain an implementation of the EXP operations using the IMP operations. The semantics SEM is a transformation from IMP-interface algebras to EXP-interface algebras and the strong persistency guarantees that the PAR part of the IMP-algebra is not modified by this transformation. The restriction functor R e reduces the carrier of the EXP-algebra SEM(A) to those data reachable from its parameter part. 2.2

Definition (Submodule and Union) A module specification M0 = (PAR0, EXP0, IMP0, BOD0) is a submodule specification of

M 1 = (PAR 1,EXP 1, IMP 1, B OD 1) if there exists a fo ur-tuple m = (mp, m E, m I, m B ) of inj ective specification morphisms such that i) each square of the following diagram commutes

220

e0 v0 sO i0 PAR0 --> EXP0 --> BOD0 +-- IMP0 +- PAR0 mp

,l,

m E .1.

mB.i.

SmI

Stop

PARt --> EXP1 --> BOD1 +-- IMP1 +-- PAR1 el vl sl il ii) if VQ is the forgetful functor associated with mQ, then V B - F s l = F s 0 - V I a n d V E ' R e l = R e 0 " V E. We write M0 ~ M1 and call m : M0 -+ M1 a Mod-morphism. Given M0 < mj Mj,j = 1,2, the union M1 + MoM2 of M1 and M2 with respect to M0 is the pushout object of the morphisms mj: M0 --> Mj in the category of module specifications and Mod-morphisms (/PP86/).

Each

component of M1 + MoM2 is the pushout specification of the corresponding components of M0, M1 and M2. The operation of actualization of a module specification M= (PAR, EXP, IMP, BOD) consists of "replacing" the parameter part PAR by a (parametrized) specification PS 1 = (Parl, ACT1) with j: Parl --> ACT1 via a parameter passing morphism h: PAR --> ACT1. 2.3 Definition (Actualization) Given a module specification M = (PAR, EXP, IMP, BOD), a parametrized specification PS 1 = (Par1, ACT1) and a parameter passing specification morphism h: PAR --) ACT1, the actualization of M by PS1 via h, denoted by acth (PSI, M), is the module specification (Par1, EXP1, IMP1, BOD1), where EXP1 = ACT1 +PAREXP, IMP1 = ACT1 +PARIMP and BOD1 = IMPI +IMpBOD as in the following diagram PAR

....... "~

Parl IMP

N

ACT1 ....... IMP1

EXP ......,-~

"~

EXP1

BOD >

BOD1

The third basic operation on module specifications is that of composition, where the import interface of a module specification is "matched" with the export interface of another one. The "unused" interfaces will provide two of the components of the composite module specification. 2.4

Definition (Composition) The composition M1 * h M2 of two module specifications Mj = (PARj, EXPj, nVIPj,BODj),

j = 1,2, with interface morphism h = (hp, hE), where hp: PAR1 --~ PAR2 and hE: IMP1 --> EXP2 are specification morphisms such that e2 • hp = hE " il, is the module specification M3 = (PAR3, EXP3, IMP3, BOD3) as in the diagram

221

PAR3 =

PAR1 --+

EXPt = EXP3

h p /

I~MP1 -9

BO~Dt

PAR2 --9 EXP2

IMP3 = IMP2 --)

(1)

BOD2 -~

BOD3

where (1) is a pushout in CATSPEC. For each of the three operations, the semantics of the resulting module s~ecification can be expressed directly in terms of those of the arguments. The semantics and restricted semantics of M1 + MoM2 are SEM1 + SEMOSElVI2 and RSEM1 +RSEMoRSEM2, respectively (/BPP85/). The semantics of acth (PSI, M) is idA + idpSEM, with id the appropriate identity functors, and a similar characterization of the restricted semantics holds if either h factors through Parll(/PP85/) or the semantics of PS 1 is taken into account (/PP86/,/EFPB86/). Denoting by V h the forgetful functor of h E, the semantics of M1 "h M2 is SEMI -Vh -SEM2 while the restricted semantics is RSEM1 • V h • RSEM2, if Fst is strongly conservative (/EW85/,/BEPP86/). The compatibility of these operations on module specifications is necessary to guarantee that the order in which these operations are applied does not effect the final system. This allows the restructuring of large systems fo~ reasons of efficiency and gives more flexibility in updating specifications due to changes in system requirements. The interaction of these module interconnections has been studied elsewhere (/EW85/,/BEPP86/,/PP86/,/EFP86/). 2.5 .Theorem (Compatibility of the Basic Operations) 1)

The operations of union, actualization and composition are monotone in each of their arguments with respect to the "submodule" partial order.

2)

For i = 0, 1, 2, let Mi = (PARi, EXPi, IMPi, BODi) be module specifications, PSi = (Pari, ACTi) with ji: Pari -+ ACTi parametrized specifications and hi: PARi -+ ACTi parameter passing morphisms. If M0 <_miMi and (qip, qiA): PS0 --+ PSi are such that ji • qip = qi A • j0 and qiA " h0 = hi " mip, then aCthl + h0h2 (PSI+PsoPS2, MI+MoM2) = aCthl(PS1, M1)+acth0(PS0,M0)acth2(PS2,M2)

3)

For i = 0, 1,2, let Mi = (PARi, EXPi, IMPi, BODi) and Ni = (PARi', EXPi', IMPi', BODi') be module specifications and hi = (hip, hiE) interface morphisms from Mi to Ni. K M0 -<miMi and NO -
222

4)

Let M1 and M2 be module specifications with an interface morphism h =(hp, h E) from M1 to M2 and PS1 = (Par1, ACT1) a parametrized specification with a parameter passing morphism hi: PAR1 --+ ACT1. Then there exist PS2 =(Parl, ACT2) and h2:PAR2 -+ ACT2 such that aCthl(PS1, M1 *h M2) = aCthl (PSI, M1) *h+ididaCth2(PS2, M2).

3.

PARTIAL COMPOSITION AND ACTUALIZATION

In this section, we are going to investigate two somewhat different ways of combining module specifications. Suppose we have a module specification M, whose import interface can be decomposed as the union IMP1 + IMpoIMP2 of two subspecifications sharing a common part IMP0, and another module specification M1 whose export interface provides the operations described in IMPt. Given such a "matching", is it possible to compose the two modules now, postponing the matching of the remaining part IMP2 of the import interface? Under what conditions is such a composition well defined and how does it relate to the composition defined in the previous section? 3.1 Definition (Partial Composition) Let M = (PAR, EXP, hMP, BOD) be a module specification with PAR = PAR1 + PARoPAR2 and IMP= IMPI+IMP01MP2, M' = (PAR', EXP', IMP', BOD') another module specification and hl = (hip, hiE) an interface morphism with hlp: PAR1 -* PAR' and hl E : IMP1 --> EXP' satisfying e' • hip = hl E" il. If there exists a specification morphism k: IMP0 -~ IMP' such that IMP0 --) IMP' -+ BOD' = IMP0 -+ IMP1 ~ EXP' --> BOD', then the partial composition M • ~IM' of M and M' w.r.t, h! is the module specification (PAR, EXP, IMP' + IMPOIMP2, BOD' + IMP1BOD) as in the foUowing diagram PAR0 PAR 1

PAR2

hip/tie

// /

/

PAR'//--~

a, ~ 1 , IMP' -->

[

vj/

k

IMPI /

IMPO

x.~ IMP2

I/'IMt, ~_

,BOp

EXP' BOD'

~

BOD"

IMP" The condition on hl is exactly the one required in the (Nit) composition of Definition 2.4.

223

The existence and property of the morphism k state that the two "subimports" IMP1 and IMP2 can share only a specification which is preserved basically unchanged, from the import to the export of M'. The pushout property of IMP" guarantees the existence of a specification morphism s" : IMP" -4 BOD" while the universal property of PAR defines i": PAR --~ IMP". This universal property also guarantees the commutafivity v"" e = PAR ~ EXP ~ BOW' = PAR --~ IMP --~ BOW' = s" • i" of the diagram of M e ~ I M ' by proving that PARj ~ PAR ~ EXP --* BOD" = PARj --> PAR --> IMP" --> BOD" forj = 1,2,. The existence of the morphism k is necessary (in the basic algebraic case treated here) to insure a consistent handling of the shared subimport IMP0. The requirement on k could be dropped by allowing constraints along with the basic specifications (see/EFPP86/), thereby restricting subsequent compositions to module specifications not in conflict with the already matched IMP0. Instead of proving that the resulting module specification satisfies the semantical conditions of definition 2.1, we now show how to relate partial composition with the operations defined in the previous section. The basic idea is that leaving IMP2 unchanged is equivalent to composing it with a module specification which behaves like the identity. 3.2

Mitin L e m m a Let M, M', hl and k be as in definition 3.1, MIj = (PARj, IMPj, IMPj, IMPj) a n d

h = h i + idid. Then M .hPlM' = M* h (M' + MIoMI2) The first immediate consequence of the Main Lemma is that partial composition is well defined, that is, that the resulting four-tuples of specifications and specification morphisms satisfy the conditions in 2.1. 3.3 . T h e o r e m Let Mj = (PARj, EXPj, IMPj, BODj), j = 3,4, and M = (PAR, EXP, IMP, BOD) be module specifications with PAR = PAR1 + PARoPAR2 and IMP = IMP1 + IMPOIMP2. For j = 3,4, let hj be an interface morphism and kj: IMP0 ~ IMPj a specification morphism such that the partial composition of M and Mj is defined as in 3.1. Then M* h3+ j d h4 (M3+ MIOM4) = (M,, ~3 M3) *~4 M4. 3.4 C o r o l l a r v

With the notation of the previous Theorem, (M- ~3 M3) .hP4 M4 = (M. ~4 M4) .hP3 M3. We should point out that there are some compatibility properties enjoyed by partial composition, Their formulation and proofs can be reconstructed in a straigthforward manner using Thin. 2.5 and Lemma 3.2. For the remaining part of this section, we investigate the analog of partial composition for actualization. If we are given a module specification whose parameter part is the union of two subspecifications, we can actualize only one of the subspecifications, postponing the choice of the

224 remaining parameter part. The results parallel those of partial composition, including the relationship between partial and "total" actualization and the effect of successive partial actualizations. 3.S Definition

(Partial Actualization)

Let M = (PAR, EXP, IMP,BOD) be a module specification with PAR = PAR1 + PARoPAR2, PS 1 = (Parl,ACT1) a parametrized specification with fl: Parl --~ ACT1 and hlA: PAR1 --~ AC~I a parameter passing specification morphism. If there exists a specification morphism hip: PAR0 --~ Par1 such that PAR0 --~ Parl - , ACT1 = PAR0 --~ PAR1 --~ ACT1, then the partial actualization pacthI (PS1, M) of M byPS 1 w.r~t, h ! is the module specification (PAR', EXP', IMP', BOD') where, in the diagram

hlp / f I Parl

PAR0

~

PAR2

P

--~

PAR --* EXP

1 ~hlm

--~

ACT1

~ IMP --~ BOD

IMP' = IMP + PAR1ACT1,

EXP' = EXP +PAR1ACT1

PAR' = PAR2 +PAROParI,

BOD' = BOD +IMpIMP'

The new import interface is obtained by repIacing PAR1 in IMP with AC~I; similarly for the new export interface. The new parameter is the union of the untouched subparameter PAR2 with the parameter Par1 introduced by the actualization with PS 1. Their shared part PAR0 is not duplicated and could represent basic standard specifications, such as bool and nat, which are going to be shared by every specification and to be left unchanged by every module in the system. The universal property of PAR' induces a unique specification morphism i': PAR ' --~ IMP', compatible with the existing morphisms. Similarly, we can obtain a unique e': PAR' --~ EXP' and it can be shown, using the uniqueness of the induced morphism from PAR' to BOD', that PAR' --~ IMP' --* BOD' = PAR' --~ EXP' --~ BOD'. As was the case for partial composition, we can relate partial actualization to (total) actualization, thereby inferring the semantical correctness of the construction above. 3.6 L e m m a Let M, PSI and hl = (hlp, htA) be as in Definitiion 3.5 and, abusing the notation, let PARj be the parametrized specification (PAR_j,PARj) with id: PARj -~ PARj, j = 0,2. Then pacthl(PS1, M) = aCthl A + idid (PS1 +PARoPAR2, M) Since the free construction of the (totally) actualized module specification is strongly

225 persistent or conservative if the original free construction is, partial actualization is semantical!y correct in view of the above Lemma. The next result shows that successive partial actualizations by PS 1 and PS2 yields the same module as the total actualization by PS 1 + PARoPS2. As a corollary, we obtain the commutativity of repeated partial actualization.

3.7 Theorem Let M = (PAR, EXP, IMP, BOD) be a module specification with PAR = PARt +PARoPAR2, and, forj = t,2, PSj = (Parj, ACYj) a parametrized specification and hj = (hjp, hJA) a parameter passing morphism such that the partial actualization of M by PSj w.r.t hj is defined. Then pacth2 (PS2, pacthl(PS1,M)) = act h l + i d h2 (PS1 + PARoPS2, M). 4.

RECURSION OF MODULE SPECIFICATIONS The operations of union, actualization and composition are the basic mechanisms to build

module specifications from other module specifications. The construction which we are going to introduce next is be motivated by looking at the interface morphism f in the composition Mof M' as a "call" of the export of M' by M. A "recursive call" is then represented by an interface morphism from (part of) the import of a module specification M to the export of the same M, in such a way that the parameter part is left unchanged. The effect of such a recursive call should leave the parameter part and the export interface unchanged, remove the "domain" of the recursive calt f from the import interface and identify within the body each operation op of IMP with its counterpart f(op) of EXP. To make this i~ormal discussion precise, we need to review the notion of coequalizer (/HS 73/). Given two morphisms f,g: A --* B in a category CAT, the coequalizer of f and g, denoted by Coeq(f, g), is a pair (C, k), with k: B --4 C a morphism in CAT, such that k-f = k ' g and for any m: B -4 D in CAT satisfying m ' f = m-g, there is a unique morphism n : C ~ D in CAT such that m = n'k. (We will at times abuse the terminology and refer to the object part C as the coequalizer of f and g). Coequalizers are unique up to isomorphism and k is always an epimorphism (/HS 73/). In the category of sets, C is the set of equivalence classes of B generated by the pairs (f(a), g(a)) for a ~ A and k is the canonical projection sending each element of B into its equivalence class. If f=g, then Coeq(f,g)

= (B, id B). It is not too hard to show that any pair of specification

morphisms f,g: SPEC1 --~ SPEC2 has a coequalizer in CATSPEC. First construct $3 and OP3 in the c/~tegory of sets and then use k = (k s, kop ) to "translate" E2 into E3.

Given a SPEC2 -

algebra A satisfying Vf(A) = Vg(A), there is always a SPEC3 - algebra B such that Vk(B ) = A. The construction of B is similar to that of amalgamation (/BPP 8 5 / , / E M 85/) and can be summarized as follows. Since k is an epimorphism, for any s E $3, there is s' s $2 such that s = k(s'): define B s = As,. There is no ambiguity in the definition, since if"we also have s = k (s") for some s" e $2, then there exists, by definition of coequalizcr, sl e S1 such that f(si)=s' and g(sl)=s". But then, by assumption, As,= (Vf(A))si=(Vg(A))sI=As -. Similarly for op e OP3. Such an algebra B is ~ , of Vf and Vg and thus a monomorphism.

since Vk:AIg(SPEC3)--~Alg(SPEC2) is the equalizer

226

We are now ready to define recursion over a single module specification. Later in this section we will also discuss the case of two modules "recursively calling" each other. 4.1

(Single Recursion)

Definition

Given a module specification M=(PARI+PARoPAR2, EXP, IMPI+IMPOIMP2, BOD) and a specification morphism f : IMP2--,EXP such that (a) PAR2---)IMP2-+ EXP = PAR2-+PARI+ PARoPAR2 ---)EXP and (b) IMP0--)IMP2---)EXP--,BOD = IMP0---~IMPI+IMPOIMP2--~BOD, the recursion of M over f, denoted by re@M), is the module specification M I = (PARI+PARoPAR2, EXP, IMPI+PARoPAR2, BOD1) as in the following diagram PAR1 + PARoPAR2

e

1

i l +idid

>

EXP

vi

IMP1 +PARoPAR2

-+

IMP1 +IMPOIMP2 -+ BOD

-+

BOD1

s'

where (BODI,k) = Coeq(v'f, s-j2), with j2:IMP2-+IMPI+IMPOIMP2 the canonical inclusion. The conditions (a) and (b) are similar to those imposed in the definition of partial composition. It is easy to show that the diagram commutes and that s' is again injective. If f is such that IMP2---~EXP--~BOD=IMP2---rIMP1 + IMPOIMP2 -+ BOD, then the only effect of the construction is to remove from the import interface the part of IMP2 not in PAR2. This agrees with our definition, since if v'f=s-j2, then k=idBo D. The semantical conditions on the new module specification need not be satisfied in general as the following example shows. For simplicity, it is understood that all specifications contain BOOL with the appropriate if-then-else operator. Let M=(PAR, EXP, IMP1 +PARIMP2, BOD) be given by the following PAR =

sort

nat

opns

0: --~ nat SUCC:

IMP1 =.PAR +

opn

nat -+ nat

+ : nat nat --~ nat

eqn O + x = x SUCC(x) + y = SUCC(x+y) IMP2 = PAR +

opn g: nat --~ nat

EXP = PAR +

opn G : nat -+ nat

227

BOD = IMP u EXP +

eqn G(x) = i_fx = 0 then SUCC(0) else g(SUCC (x))

Let f: IMP2 --) EXP be the identity on PAR and fop(g) = G. Then recf(M)= (PAR, EXP, tMPl, BOD 1) where BODI=IMP1 u EXP + eqn G(x) = if x = 0 then SUCC(0) els___eeG~SUCC(x)) and the specification morphisms are the ob'4ous inclusions. Then the free functor associated with s':IMPI-+BOD1 is not strongly persistent. The problem is similar to that of termination of recursively defined functions (completeness). From the point of view of Term Rewriting Systems (fPD85]), persistency of the free functor F s, is equivalent to proving confluency and termination of the expanded TRS obtained by adding (in the above example) the equation G(x)=g(x) and removing terms containing g from the set of normal forms. The following theorem establishes the correspondence between the semantics of M and that of recf(M).

For simplicity, we restrict our attention to the case where PARI=PAR0 and

IMPI=IMP0 in def. 4.1. 4.2 Theorem

(Fixed Point Property)

Let M=(PAR, EXP, IMP, BOD), f:IMP--~EXP a specification morphism satisfying f-i = e and MI=recf(M)=(PAR, EXP, PAR, BODt). a) If F i and Fk are strongly persistent, then the flee functor F s, is strongly persistent b) If F k is strongly persistent, then SEM • Vf- SEMI = SEM1 c) If, in addition, F s is strongly conservative, then RSEM • Vf" RSEM1 = RSEM1 With one additional assumption, the recursive construction preserves the submodule partial order. 4.3 Theorem

(Submodule Compatibility)

Let M = (PAR, EXP, IMP, BOD), M'= (PAR', EXP', IMP', BOD'), M_~ m M', f: IMP --~ EXP and f: IMP' --~ EXP' be such that m E ' f = f ' m I, If Fk and Fk, are strongly persistent and V I • F i, = F i • V p , then r e c f ( M ) _ r e c f ( U ' ) .

We can show that the operation of single recursion is compatible with union, actualization and composition. All three compatibilities are based on different interpretations of the following Lemma. 4.4 L e m m a Let hj : A 0 - - ~ A j , k j : B 0 - - ~ B j , j=l,2, andmj, n j : A j ~ B j , j = 0, 1,2, besuchthat kj'n0=nj"

hjandkj'm0=mj'hj,

j=l,2.

Then

Coeq(ml + m0m2, n 1+ n0n2) = Coeq(m 1,n 1)+Coeq(m0, n0)C°eq(m2,n2)" We now state the compatibility of single recursion with the three basic operations. For simplicity, for union and ~tctualization we restrict our attention to the case considered in Theorems 4.2 and 4.3.

228

4.5 Th¢grem (Compatibility with Union) Let M0 -< Mj, j = 1,2 and fj: IMPj --~ EXPj, j = 0,1,2, compatible specification morphisms which are the identity on PARj. Then recfl +t9 f2 (M1 + MoM2) = recfl(M1 ) + recf0(M0 ) recf2(M2). 4.6 Theorem (Compatibility with Actualization) Let M = (PAR, EXP, IMP, BOD), f:IMP --~ EXP a specification morphism with f • i = e, PS = (Par, ACT) a parametrized specification and h:PAR --~ ACT a parameter passing morphism. Then acth (PS, recf (M)) = rec f + idid (acth (PS, M)). The third compatibility property we have investigated is that with partial composition, in which the IMP2 part of the import interface is matched by f with the export of the same module while the IMP1 part is matched via h with the export interface of another module. The next result states that the order in which these two operations are carried out is immaterial. 4.7 Theorem (Compatibility with Partial Composition) Let M = (PARI+PAROPAR2, EXP, IMPI+IMPOIMP2, BOD) be a module specification and f : IMP2 ~ EXP a specification morphism such that recf(M) is defined. Let M' = (PAR',EXP', IMP', BOD') be another module specification and h=(hp,hE) an interface morphism satisfying the conditions in definition 3.1. Then recf(M .hp M')= recf(M)-~ M' In Theorem 4.5, the single recursion over a union is the union of the corresponding single recursions provided that each specification morphism fj is within the same module. We want to consider next the case of two module specifications recursively "calling" each other as allowed, for example, in Ada (/B184/). Suppose that we have two module specifications M1 and M2 with imports IMPI+IMPOIMP1 ' and IMP2+IMPOIMP2 ', and exports EXP1 and EXP2, respectively, and we want to define a new module consisting of M1 and M2 only, where M2 provides the import IMPt' of M1 and M1 the IMP2' part of the import of M2. In the new module, IMPI' and IMP2' arc no longer in the import interface, while IMP1 and IMP2 are. The new body should contain not only the bodies of M1 and M2, but also the information that part of the import of M1 uses M2 and viceversa. Let us make this precise. 4.8 ~

(Mutual recursion)

Let Mj = (PARj+PAROPAR0, EXPj, IMPJ+IMPOIMPj ', BODj), j=1,2, be module specifications and let fl : IMPI' --~ EXP2 and f2 : IMP2' --~ EXP1 be specification morphisms such that (a) IMP0 ~ IMP1'-+ EXP2 --~ BOD2 = IMP0 --~ IMP2' --~ BOD2 and (b) IMP0 ~ IMP2' --~ EXP1 -~ BODI=IMP0 --> IMPI'-~ BOD1. Then the mutual recursion of M1 and M2 via fl and f2, denoted by recfl,f2(M1,M2), is the module specification (PARI+PAROPAR2, EXPI+IMP0 EXP2, IMPI+IMP0 IMP2, BOD*) where BOD* is the colimit object of

229

IMP1' --+ EXP2 ---~ BOD2 IMP0

BOD*

"a

A IMP2' ---> EXP1 --> BODI

and the specification morphisms are all induced by the appropriate universal properties. The assumption of fl and f2 guarantees that the module specification MI0 = (PAR0, IMP0, IMP0, IMP0) shared by M1 and M2 is not modified by the recursive calls. In particular, it implies that the interface morpliisms (idpAR0, fl) and (idpAR0,f2) provide a well defined partial composition of M I with M2, and of M2 with M1, respectively, in the sense of definition 3.1. The verification that the syntactical diagram of rec fl,f2(M1,M2) commutes is very tedious but direct. The strong persistency of the free functor from Alg(IMPI+IMPOIMP2) to Alg(BOD*) cannot be guaranteed in general for reasons similar to the single recursion case. The construction above can be generalized slightly to allow an arbitrary parameter PAR, the same for both IMPI' and IMP2', in place of PAR0, provided that fl and f2 are compatible with PAR --->EXPj. It is not surprising that mutual and singte recursion are closely related. The situation is similar to that of two recursive definitions, say of functions F and G, where F is defined by a polynomial in G alone and viceversa. The components of the solution of this recursive system can be also obtained by substituting one polynomial in the other one and then solve the single recursive definition in the oniy unknown function variable left. 4.9 Th¢0r¢m (Mutual vs. single recursion) Let Mj and fj be as in definition 4.8 and let MEj=(PARj, EXPj, EXPI+IMPoEXP2, EXPI+ IMP0 EXP2) , j=l,2, with the obvious specification moI~hisms.Tlien MEI • recfl,f2 (MI,M2) = recf2 (M1 • fPl M2) and ME2 • recfl,f2 (M1,M2) = recfl (M2 • fP2 M1) The previous Theorem allows us to exploit Theorems 4.5, 4.6 and 4.7 to obtain the compatibility of mutual recursion with union, composition and actualization. 5.

CONCLUSION In this paper we have introduced two partiat interconnections of module specifications: partial

composition and partial actualization. Although motivated by the intuitive idea of establishing interconnections as other module specifications become available, it is shown that both partial operations can be expressed in terms of their total counterpart and union (3.2, 3.6). Exploiting the algebraic laws expressing the compatibility of the basic operations, we have shown that successive partial compositions (or actualizations) are equivalent to a total composition (or actualization) with a union (3.3, 3.7). As a by product, the order in which partial compositions are carried out becomes immaterial.

230

A more interesting construction mechanism, recursion, was introduced in section 4. Unlike the other operations on module specifications, where the semantical correctness is a direct consequence of that of its arguments, the recursion construction (whether single or mutual) does not guarantee the strong persistency of its free functor, unless additional conditions are imposed on the original module. Lacking these, generating or logical constraints (fEWT 83/, fEFPB 86/) should be used to restrict the class of import algebras. Along the same lines, while the semantics of the basic operations can be proved to be compositional and can be explicitly described in terms of those of the arguments (fEW 85/,/BPP 85/), the semantics of recf(M) is reiated implicitly to that of M by a fixed point equation. Notice that the equation is at a semantical level and not syntactical: in CATSPEC (as in all categories) the emphasis is on. the morphisms, not on the objects. So, by composing M with recf(M) using f, the "information" that the module M is the same is lost. Even though our definition of BOD1 in 4.1 was motivated by an intuitive idea of the effect of "self reference" via f, we can find in fEL 83/that, in order to obtain the fixed point equation 4.2(b), the use of the coequalizer is, more or less, forced. Coequalizers are also used in the approach to the algebraic solution of recursive equations found in /BG 81/.

It should be pointed out that our solution for recursive

interconnections of modules is different than in ~184/, where partial orders within each algebra and on the set of algebras are introduced with the functors required to be monotone. Although the semantical funtors SEM and RSEM can be viewed as an observational behavior of the module specification, other notions of "behavioral" semantics of modules are being analyzed, giving rise to different "levels" of observabitity. We will discuss them in a forthcoming paper, along with comparisons with other observability concepts, such as in/GGM 76/,/Rei 81],/GM 82/,/ST 85b/. ACKNOWLEDGEMENTS I am grateful to E. Astesiano, E.K. Blum, H. Ehrig, W. Fey, H, Hansen, M. Lowe and B. Mahr for many helpful discussions. Many thanks also to Annette Mosley for her excellent job of typing an unreadable manuscript in record time. This research was supported in part by the National Science Foundation under Grant DCR-8406920.

REFERENCES /AMRW85/ /BG 81/ /BMM79/ /B1 84/ ~EPP86/ /BPP 851 /BG 771

Astesiano E., Mascari G.F., Reggio G., Wirsing M., On the Parametrized Algebraic Specification of Concurrent Systems, CAAP 85, LNCS 185(1985) 342-358 Benson D.B., Guessarian I., Algebraic Solutions m Recursion Schemes, LI.T.P. Tech,Rep. 81-66. Univ. Paris VII, Dec. 1981 Bertoni A., Mauri G., Miglioli P.A., A Characterization of Abstract Data as Model-Theoretic Invariants, ICALP 79, LNCS 71(1979) 26-37 Blum, E.K., An Abstract System Model of Ada Semantics, TRW Technical Report, Aug. 1984. Blum E.K., Ehrig H., Parisi-Presicce F., Algebraic Specification of Modules and their Basic Interconnections, to appear in JCSS 86. Blum, E.K., Parisi-Presicce, F., The Semantics of Shared Submodule Specifications, Proc. TAPSOFT 85 Vol. 1, LNCS 185 (1985) 359-373. Burstall R.M., Goguen J.A., Putting Theories together to make Specifications. Proc. 5th Intern. Joint Conf. on Artif. Intell., Cambridge 1977, 1045-1058.

231

Ehrich H.-D., Lipeck U., Algebraic Domain Equations, Theoret. Comp. Sci. 27 (1983) 167-196. Ehrig, H., Fey, W., Parisi-Presicce, F., Distributive Laws for Composition and /EFP 86/ Union of Module Specifications for Software Systems, Proc.IFIP TC2 Work. Conf. on Program Specification and Transformation, Bad Tolz, April 1986. Ehrig, H., Fey, W., Parisi-Presicce, F., Blum, E.K., Algebraic Theory of ~FPB 86/ Module Specifications with Constraints, Proc. Math. Found. of Comp. Sci, LNCS 233 (1986) 59-77. /EKTWW 81/ Ehrig, H., Kreowski, H.-J., Thatcher, J.W., Wagner, E.G., Wright, J.B., Parameter Passing in Algebraic Specification Languages, Proc. Aarhus Workshop on Prog. Spec., 1981, LNCS 134 (1982) 322-369. Ehrig, H., Mabx, B., Fundamentals of Algebraic Specifications 1: Equations and /EM 85/ Initial Semantics, EATCS Monographs on Theoret. Comp. Sci. Vol 6, Springer-Verlag, 1985. Ehrig H., Wagner, E.G., Thatcher, J.W,, Algebraic Specifications with FEWT 83/ Generating Constraints, ICALP 83, LNCS 154 (1983) 188-202. Ehrig, H., Weber, H , Algebraic Specification of Modules, Proc IFIP Working FEW 85/ Conference on Formal Models in Programming, Vienna 1985. Ehrig H., Weber, H., Programming in the Large with Algebraic Module ~ W 86/ Specifications, Proc. IFIP Congress '86, Dublin, Sept 1986. Futatsugi, K., Goguen, J.A., Joannaud, J.-P., Meseguer, J., Principles of OBJ2, /FGJM 85/ 12th ACM POPL, New Orleans, 1985, 52-66. Ganzinger, H., Parametrized Specifications: Parameter Passing and /Ga 83/ Implementation, ACM TOPLAS 5, 3 (1983). Giarratana, V., Gimona, F., Montanari, U., Observability. Concepts in Abstract /GGM 76/ Data Type Specifications, 5th Symp. Math. Found. of Comp. Sci. 1976, LNCS 45 (1976) 576-587. Goguen, J.A., Meseguer, J, Universal Realization, Persistent Interconnection /GM 82/ and Implementation of Abstract Modules, tCALP 82, LNCS 140 (1982) 265-281. Goguen, J.A., Thatcher, J.W., Wagner, E.G., An Initial Algebra Approach to the /GTW 78/ Specification, Correcmess and Implementation of Abstract Data Types, in Current Trends in Prog. Method., IV: Data Structuring (R.T. Yeh, Ed.), Prentice Hall, New Jersey (1978) 80-149. Herrlich, H., Strecker, G.E., Category Theory, Allyn and Bacon Inc., Boston, /t-IS 73/ 1973. Liskov, B.H., Zilles, S.N., Specification Techniques for Data Abstraction, IEEE /LZ 75/ Trans. on Soft. Eng., Vol SE-1, No. 1(1975) 7-19. Padawitz, P., Parameter Preserving Data Type Specifications, Proc. TAPSOFT /PD 85/ 85 Vol i, LNCS 185 (1985) 323 - 341. Parisi-Presicce, F., Union and Actualization of Module Specifications: Some /PP 85/ Compatibility Results, Techn. Report, Univ. of Southern California, 1985, to appear in JCSS. Parisi-Presicce, F., Inner and Mutual Compatibility of Basic Operations on /PP 86/ Module Specifications, Proc. CAAP 86, LNCS 214 (1986) 30-44. Full version: Techn. Rep. 86-06, Techn. Univ. Berlin, April 1986. Parnas, D.L., A Technique for Software Module Specification withExamples, /Par 72/ Comm. ACM 15, 5(1972) 330-336. Reichet, H., Behavioral Equivalence - A unifying concept for initial and final ~ e i 8t/ specification methods, Proc. 3rd Hungarian Comp. Sci. Conf., Budapest, 1981, 27-39. Sannella, D., Tarlecki, A., Program Specification and Development in Standard /ST 85a/ ML, 12th ACM POPL, New Orleans, 1985, 67-77. Sannella, D., Tarlecki, A., On Observational Equi~ alence and Algebraic /ST 85b/ Specification, CAAP 85, LNCS 185 (1985) 308-322. Sannella, D., Wirsing, M., A Kernel Language for Algebraic Specification and /SW 831 Implementation, Internal Report No. CSR-131-83, Univ. Edinburgh, 1-44. Weber, H., Ehrig, H., Specification of Modular Systems, IEEE Trans. Soft. /WE 86/ Eng., June 1986. /WPPDB 83/ Wirsing, M., Pepper, P., Partsch, H., Dosch, W., Broy, M., On Hierarchies of Abstract Data Types, Acta Inform. 20 (1983) 1-33.

/EL 83/

EFFICIENT

REPRESENTATION

OF TAXONOMIES

G. G a m b o s i (*) , J. N e ~ e t g i l (**) , M. T a l a m o (*) (*)

Istituto

(**)

Charles

di A n a l i s i

del C.N.R.~

11600

Viale

Manzoni

University

Prague,

dei S i s t e m i 30,

ed I n f o r m a t i c a

00185,

Malostransk~

Roma,Italy

Namest±

25,

Czechoslovakia

ABSTRACT In this dimension

paper,

representation nodes

the use

of p a r t i a l

(linear

ficiently

orders

of the c o n c e p t s is s t u d i e d

of t a x o n o m i e s . extensions

to such

Under

this

of p a r t i a l

queries

as

of d i m e n s i o n

for w h a t

approach,

orders)

"Is e l e m e n t

and b o o l e a n

concerns

the e f f i c i e n t

labelings

are u s e d

a related

of the

to a n s w e r

to e l e m e n t

efb?".

INTRODUCTION The sets

efficient

of c o n c e p t s ,

ample

in some

to be able (derived)

representation represents

sectors

to a n s w e r

In o r d e r

approach

the

[GNT],

seems both

This

studied

of such

introduced

to be c o n v e n i e n t in terms

In s e c t i o n troduction

a taxonomy

in p o s e t

out

a included

seems

as a p a r t i a l

theory)

and,

of a s t a t i c

(elements)

of p o s e t s

labelings

of u s i n g

[KT]

makes

in some

structure, to be w o r t h

order,

the

the c o n c e p t

of

it p o s s i b l e

to

cases,

I, some

partially

of the c o n c e p t

to o b t a i n

of d i m e n s i o n ,

and e x t e n s i v e l y

studied

to use

to O b t a i n

of q u e r y

time

definitions

of the c o n c e p t

w o r k was

for ex-

it turns

"Is e l e m e n t

in the case

of the n o d e s

a generalization

dimension,

formance

where

as

themselves.

Moreover, boolean

problem

and of d i m e n s i o n

the n u m b e r

labeling

this

If we c o n s i d e r

extensions

determine

as

free-structured

problem,

Intelligence,

to such q u e r i e s

labelings

(extensively

i.e.

interesting

b?".

to t a c k l e

of i n v e s t i g a t i o n .

linear

of A r t i f i c i a l quickly

from element

the use of s u i t a b l e

of t a x o n o m i e s ,

a rather

of b o o l e a n

supported

in o r d e r

in the

denoted full

a better

per-

and of space. are

given

together

with

the

dimension.

by the E S P R I T

Project

ALPES.

as

paper

in-

233

In s e c t i o n presented

2, a l a b e l i n g

which

allows

In s e c t i o n lized

3, s u c h a p p r o a c h

DEFINITIONS

Given lation

number sary

taxonomies

treatment

is e x t e n d e d

of

(rooted

trees)

inclusion

to t w o

types

is

queries. of genera-

ordered


dimension of P

of different

to d e t e r m i n e

linear

and Miller arbitrary

P itself.

a set

Note

have

partial

and can grow

a k-labeling

on

formula

where

N is a n o r d e r

sorting)

P itself,

(dim P)

i.e.

is d e f i n e d

of P w h o s e

re-

o n P JR]

such

that

for e a c h on t h e

shown,

among

i = 1,...,k dimension

others,

for

as n =

(fig.

the

is n e c e s -

k for w h i c h of P such

I).

of posets, dimension

INI

tends

Dushnik

of an

to i n f i n i t y

(*) it is p o s s i b l e

set N:

for e a c h

hence, and,

the m i n i m u m

extensions

theory

that

c a n be u n b o u n d e d

as O(n)

as

intersection

d i m P is the m i n i m u m

if d i m P = k,

~i ( n ) , ~ 2 ( n ) , . . . , I k ( n ) boolean

embeds

Hence,

paper

order

as f a s t

that,

(N,
(topological

i = { L I , L 2 .... ,L k} of l i n e a r

seminal

[DM]

L

extensions

t h a t n I