Lecture Notes in
Computer Science Edited by G. Goos and J. Hartmanis
36 Sheila A. Greibach
Theory of Program Structures: Schemes, Semantics,Verification IIII
II
Springer-Verlag Berlin-Heidelberg-New York 1975
I
Editorial Board: P. Brinch Hansen • D. Gries C. Moler • G. SeegmLJller • N. Wirth
Author: Prof. Sheila A. Greibach Department of System Science University of California Los Angeles, CA 90024 USA
Library of Congress Cataloging in Publication Data
Greibach~ Sheila, 1939Theory of program structures. (Lecture notes in computer science ~ 36) Bibliography: p. Includes indexes. i. Electronic digital computers--Programming. 2. }~ecumsive prog~amm±n~. 3- Compute~ programs. I. Title. II. Series. QA76.6.G7~} 1975 OOl. 6' %2 7~-}1780
AMS Subject Classifications (1970): 68 XX CR Subject Classifications (1974): 5.24
ISBN 3-540-07415-5 Springer-Verlag Berlin • Heidelberg • New York ISBN 0-387-07415-5 Springer-Verlag New York • Heidelberg • Berlin This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically those of translation, reprinting, re-use of illustrations, broadcasting, reproduction by photocopying machine or similar means, and storage in data banks. Under § 54 o{ the German Copyright Law where copies are made for other than private use, a fee is payable to the publisher, the amount of the fee to be determined by agreement with the publisher. © by Springer-Verlag Berlin • Heidelberg 1975. Printed in Germany. Offsetdruck: Julius Beltz, Hemsbach/Bergstr.
FOR ~
PARENTS AND JACK
PREFACE
The material in these lecture notes offers an exposition students rather than resemrchers in ~he field schemata" or "schematology"
-
-
aimed at graduate
of a topic often called "program
The subject matter represents one approach to for-
realizing the elusive notion of the "semantics of programming languages".
The idea
is to model an "abstract flowchart" and study the interrelation between the syntax of programs (what can be said about their behavior from their format) and the semantics (what they actually "do", depending on the interpretation, the progrmmdr~g language, and perhaps even the implementation) and examine the application of formal proof systems to verify properties of progra~. ~among the goals of such studies are to determine which constructs of programruing languages are "essential" and what is the relative power of various features, and to develop general methods for checking or verifying a given program against its specifications. The approamh t~<en here through program and recursion schemes follows naturally from the methods of the formal language theory and the theory
of computation.
The
results are studied not just for their own sake but for their assistance in casting light on problems such as program verification.
Topics treated in this book include:
program schemes and their basic properties; structured programs including block stmucture and WHILE programs; correctness and program verification~ decision problems; recursion schemes, augmented schemes and verification of programs with recursion; and monadic reeursion schemes. These represent the notes for the current version of Engineering 223F, Theory of Computation, given jointly by the Department of System Science and the Department of Computer Science at the University of California, Los Angeles. material has been (or could be) given in any one quarter.
Not all of the
Asterisks in the Table
of Contents represent material which can be omitted without ~terfering with continuity. The course is intended for first or second year graduate students who have had a basic one quarter course in formal language theory (covering finite state mmchines and graphs, context-free languages~ and the idea of Turing machines, algorithms and procedures), and sufficient exPerience with p r o g r & ~ n g languages to appPeciate the motivation and understand the relevant jargon.
The emphasis is on constructions
and examples, although most proofs are given in full detail. Los Angeles August ii~ 1975
S. A. Greibaeh
ACKNOWLEDGEMENTS
Grateful thanks are due my secretaries without whose assistance this volume could never have been produced.
The dedication and professiona3~ competence of my
former secretary, Mrs. Nancy Grey, is evident in the diagrams she drew and in the bulk of the manuscript.
Ms. Susan Frank most ably completed the job.
7~nks are also owed to various colleagues and students with whom I discussed the material in these notes.
Particular acknowledgement is due to Professor E. P.
Friedman ana to Mr. J. Gallier who offered numerous correetions to the previous version of this manuscript and provided many helpful suggestions for the present version.
Needless to say, all remaining difficulties in the manuscript are solely
due to the author's negligence. I should also like to thank my Chairperson, Professor J. W. Carlyle, for advice and encouragement in all my work and for exhortation to get this volume finished and published. Although this volume is not a research monograph, one's research, advanced graduate teaching and expository writing are often i n e ~ i e a b l y intertmTined. During the period in which t]mis manuscript was prepared, the author's research in automata and formal languages was supported in part by the National Science Foundation under Grants GJ-803 and DC~7415091 and this support is acknowledged with appreciation.
NOTES 2D THE P,FADER This book is written to be read sequentially from first chapter to last. However, sections marked in the Table of Contents by an asterisk can be skipped without affecting continuity.
To assist browsing, an Index of Notation and an Index of
Terms appear at the end. Each chapter is numbered separately and theorems, lemmas, propositions and corollaries are numbered consecutively within each chapter; thus Theorem 6.7 is the 7th numbered result, but not necessarily the 7th theorem, in Chapter VI. of a proof is indicated by the symbol:
•
References appear, at the end organized by chapters. also organized by chapters. not been consumer tested.
The end
The set of exercises is
The reader is warbled that some of the exercises have Any one using any of ti~e exercises does so at b~s/her
own peril. The book is self~contained as to knowledge of program schemes ~ but ~ few sections are more meaningful for meaders with an elementary knowledge of formal language theory.
The background material can be found (for example) in Chapters
1-7 of Hopcroft and Ullman, "Form~! Languages aLnd their Relation to Automata", Addison-Wesley, 1969. Most of the material can be read without this background. More specifically, the basic notions of a Turing Machine, of computable functions and of ~ndecidable properties are needed for Chapter VI (Decision Problems); the definitions of reeursive, primitive recursive and partial recursive functions are helpful for Section F of Chapter IV and two of the proofs in Chapter VI.
The basic
facts regarding regular sets, conte~et-free languages and pushdown store automata are helpful in Chapter VIII (Monadic Recursion Schemes) and in the proof of Theorem 3.14. For Chapter V (Correctness and Program Verification) it is useful to know the basic notation and ideas of the first order predicate calculus; a highly abbreviated version of this material appears as Appendix A.
TABLE OF CONTENTS Page I.
INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E X A M P L E I-i - " S T R O N G
i-i
EQUIVALENCE ~ . . . . . . . . . . . . . . . . . . .
E X A M P L E 1-2 - C O R R E C ~ E S S
. . . . . . . . . . . . . . . . . . . . . . .
E X A M P L E I-3 - IN'I]~RPRETATIONS
. . . . . . . . . . . . . . . . . . . . .
E X A M P L E I-~ - E X P R E S S I O N OF F L O W C H A R T C A S A " W H I L E - S C H ~ "
II. P R O G R A M SCHEMES - BASIC D E F I N I T I O N S A N D C O N C E R T S
1-3 1-6
......
. . . . . . . . . . . .
1-7 1-8
2-1
A.
SYNTAX - THE MODEL . . . . . . . . . . . . . . . . . . . . . . . . .
2-1
B.
SL-MAK~ICS - IN~EPCPRETATIONS A N D C O M P U T A T I O N S
2-5
C.
. . . . . . . . . . . .
E X A M P L E II-i . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2-9
L I N E A R DEFINI~]~ION OF P R O G R A M SCHEFES
2-10
. . . . . . . . . . . . . . . .
E X A M P L E II-2 - LIIk~&R F O R ~ O F S C H ~ ] E II-i
. . . . . . . . . . . . .
2-13
EX:~iv]PLE II-3 - A SCHEME W H I C H H A L T S U N D E R A L L F I N I T E I N T E R P R E T A T I O N S ]~JT N O T U N D E R SOHE I N T I N I T E I N T E R P R E % k T I O N D.
EQUIVAL~{CE
. . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
2-14 2-16
E X A M P L E II-4 - SOME L O C A L E Q U I V A L E N C E P R E S E R V I N G TP4kNSFORY~%TIONS . . 2-23
l°
E.
I n t e r c h a n g i n g a s s i g n m e n t and t e s t s t a t e m e n t s
2.
Interchanging assignment statements
3.
El~mation
4.
D e t e c t i o n and e x p l i c i t d i s p l a y o f t i g h t loops
5,
Loop unwinding
CORRECTNESS
. . . . . . . . . .......
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
B.
TREE, SCHEMES A N D A L W A Y S H A L T I N G SCHEMES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E X A M P L E I I I - I - A L W A Y S PT_ALTING PROGIkA~i SCH]iPE
2-24
2-25 2-25
. . . . . . . . . . . . . . . . . . .
PIERBRAND O R F R E E I N T E R P R E T A T I O N S
2-23
2-24
. . . . . . . . . . . . . . . . . . . . . .
A.
FREE SCHEMES
2-23
. . . . . . . . . . . .
of "overprinted" assignments
III.PROGR6J~ SCK]}~ES - B A S I C P R O P E R T I E S
C.
.......
P . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
3-1 3-1 3-10 3-14 3-18
E X A M P L E III-2 - A SCHEME N O T S T R O N G L Y E Q U I V A L E N T TO A N Y F R E E P R O G R A H . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3-25
E X A M P L E III-3
. . . . . . . . . . . . . . . . . . . . . . . . . . .
3-27
E X A M P L E III-4
. . . . . . . . . . . . . . . . . . . . . . . . . . .
3-31
SCH]9~iE
*D.
L I B E R A L S C H E M E S A N D A G L O B A L TRANSFO]kMATION E~LE
. . . . . . . . . . . .
111-5 - A F R E E SCHEME W H I C H IS N O T S T R O N G L Y E Q U r V A ] ~ f ANY LIBERAL SC~
CAPd{IES S C H ~
TO
. . . . . . . . . . . . . . . . . . . . . .
E X A M P L E III-8 - T O "FREE" A L I B E R A L SCF~HE; T R A N S F O R M A T I O N P
E Q U I V A L E N T TO t(P)
I~,~0 S C P ~ 4 E
t(P);
P
3-32
3-33
t
IS S T R O N G L Y
. . . . . . . . . . . . . . . . . . . . . .
3-35
XII
IV.
STRUCTURED PROGRAMS *A.
. . . . . . . . . . . . . . . . . . . . . . . . . .
4-1
CANONICAL FORMS . . . . . . . . . . . . . . . . . . . . . . . . . .
4-1
EXAMPLE IV-I - S O ~ ISOMORPHISM B.
TRANSFOP~IATIONS PRESERVING COMPUTATIONAL . . . . . . . . . . . . . . . . . . . . . . . . .
BLOCK STRUCTURE . . . . . . . . . . . . . . . . . . . . . . . . . . EXAMPLE IV-2 : A PROGRAM SCHEME THAT IS NOT TREE-LIKE EXAMPLE IV-3 - A TRE~-LIKE PROGRAH SCH~JE
......
............
4-8 4-11 4-21 4-22
EXAMPLE IV-4 - BLOCK STRUCTURE - THE SCHEME OF EXAMPLE IV-3 DIVIDED INTO MAJOR BLOCKS C. *D. E.
WHILE S C H ~ S
]~
. . . . . . . . . . . . . . . . . .
GOTO-LESS PROGRAMS
. . . . . . . . . . . . . . .
4-35
EXTENSIONS OF THE DEFINITION OF A WHILE S C ~ { E
4-44
IV-5 - A S C ~
..........
NOT STRONGLY EQUIVALENT TO ANY SIMPLE
WHILE SCHEME . . . . . . . . . . . . . . . . . . . . . . . . . *F.
WHILE PROGRAMS, STEP PROGRAP[S, AND PRIMITIVE RECURSIVE FUNCTIONS
*G.
UNIVERSALITY OF WHILE SCHEMES - SWITCH VARIABLES THE STRONG EQUIVALENCE CONStrUCTION
EQUIV~,L~I~ TO THE F R O G R ~ NEW VARIABLES ARE NEEDED
.........
. . . . . . . . . . . . . . . .
EXAMPLE IV-6 - CONSTRUCTION OF A WHILE SCHEME
*I.
4-29
LINE-LIKE SUBGRAPHS . . . . . . . . . . . . . . . . . . . . . . . .
E~PLE
H.
4-25
SCH]~4E
P
P'
4-47 . 4-49 4-52 4-53
STRONGLY
I~,~ EXAMPLE IV-4 . . . . .
. . . . . . . . . . . . . . . . . . . . .
4-57 4-62
EX~JIPLE IV-7 - A PROGRAM SCHEME NOT STRONGLY EQUIVALENT TO ANY WHILE SCHEME ~ITHOUT MORE VARIABLES
V.
CORRECtnESS AND PROGRAH VERIFICATION A.
PATH VERIFICATION
C.
PROGRAH VERIFICATION ~URTHER EXAMPLES
4-63
. . . . . . . . . . . . . . . . .
5-1
. . . . . . . . . . . . . . . . . . . . . . . . .
EXAHPLE V-I - A SCHEME B.
.............
5-1
P . . . . . . . . . . . . . . . . . . . . .
5-5
. . . . . . . . . . . . . . . . . . . . . . .
5-9
. . . . . . . . . . . . . . . . . . . . . . . . .
5-18
EXAHPLE V-2 - VERIFICATION OF A WHILE PROGk&~ TO CO}{PUI~ A BINOMIAL COEFFICIENT
. . . . . . . . . . . . . . . . . . . . .
EXAvPLF V-3 - VERIFICATION OF A F O R ~
INTERCHANGE SORT . . . . . . . . . . . . . . . . . . . . . . . EXAMPLE V-4 - VERIFICATION OF A PIECE OF DECIDID~G IF *D.
VI.
AXIOMATIC APPROACH
N
5-19
SUBROUTIKE FOR A N
PL/I
5-22
CODE FOR
IS PRIHE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5-26 5-28
DECISION PROBLEMS . . . . . . . . . . . . . . . . . . . . . . . . . . .
6-1
A.
TWO TAPE FINITE STATE ACCEPTORS
6-3
B.
UNDECIDABLE PROPL~,TIES OF SCHEMES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6-6
XIIL
EXAMPLE VI-I - CONSTRUCTION OF SC~9{ES
P'I(M) £n
from a t~.~o-tape one-way d e t e ~ i s t i c accepter
finite state
H : (~K2~{0,1},~,qo,qa, ~)
EXAMPLE VI-2 - Construction of
P2(M)
S2
...........
6-8
which is NOT always
halting (diverges under some interpretation) if and only if
Ld(M)
N D ~ %
..................
EXAMPLE VI-3 - Construction of (w,w)
whenever
w
P3(M) .
If
M
6-9
halts on
is ultimately periodic, then
P3 (M)
halts for all finite interpretations if and only if LaGer) n
n : ~ . . . . . . . . . . . . . . . . . . . . . . .
EXamPLE VI-4 - Construction of
P4 (H)
is NOT strongly equivalent to Ld(H)
equivalent to M
Z2
(w,w)
P5(H)
if and only if
P5(M)
for
La(H) w
A D = ~ .
ultimately
is finitely equivalent to
La(M) A
Z2
D : % ...............
VI-6 - Special Schemes
ZI
and
EZ~}{PLE VI-7 - A SPECIAL WHILE PROGRAM EXAMPLE VI-8 - CONSTRUCTION of
6-11
which is weakly
if and only if
converges on
periodic, the
EXamPLE
P4 (M)
if and only if
~ D ~ % . . . . . . . . . . . . . . . . . . . . . . .
EXAMPLE VI-5 - Construction of
If
such that
Z2
6-I0
Z2 .
..........
.............
P6(H)
6-12 6-13 6-19
from deterministic
two-tape one-way finite state accepter H = (~,K2,{0,1},6,qo,qa~r)
C. *D.
VII.
A
DECIDABLE SUBCLASSES
RE~SION A. B.
................
UNDECIDABLE PROPERTIES OF PROGRAMS
SC~JES
-
...............
IANOV S C H E ~ S
~ ............
. . . . . . . . . . . . . . . . . . . . . . . . . .
DEFINITIONS AND EXAMPLES
....................
COMPARISON OF FLOWC}[ART AND RECURSION SCHEMES . . . . . . . . . .
6-21 6-26 6-29
7-1 7-3 7-13
EXAMPLE VII-I - CONSTRUCTIONS TO PROVE THAT FLOWCHARTABILITY IS NOT DECIDABLE . . . . . . . . . . . . . . . . . . . . . . A.
PROOF THAT " R
B.
CONSTRUCTION OF PROGRAM SC~JE~
C.
PROOF THAT ~' R
DECIDABLE
. . . . . . . . . . . . . . . . . . . . . . .
LINFAR RECURSION S C ~ S
P(H) . . . . . . . . . .
7-19 7-20
IS NOT FLOWCFL~RT_A3LE" IS NOT
PARTIALLY DECIDABLE C.
7-19
IS FLOWCHARTABLE '~ IS NOT PARTIALLY
..................
ARE N~OWCI£ARTABLE
...........
7-21 7-22
EXAMPLE VII-2 - FLOWCHA~RT SCHEME STRONGLY EQUIVALENT TO LINEAR RECURSION SCHEME
..................
EXAMPLE VII-3 - CONSTRUCTION OF FLOWCHART TO A LINEAR RECURSION SCHEME
S
P
7-25
EQUIVALENT
..............
7-28
XIV
I.
Straight simulation mode
II. Restart subsehemes
the u-computation
position
-
i
and
7-29
carries the y-computation k
is the next restart
. . . . . . . . . . . . . . . . . . . . . . .
IV. END OF CYCLE AND RESTART MODE D.
7-28
. . . . . . . . . . . . . . . . . . .
lll.Clod< simulation mode j
................
RECURSION AUGMENTE9 FLOWCHART SCHEMES
- i
or
j
in
T ....
..............
7-30 7-32 7-34
EXAMPLE VII-4 - A RE@JRSION AUGMENTED PROGP~%M FOR (~) AND SOME COMPUTATION STEPS . . . . . . . . . . . . . . . . .
7-38
EXA~IOLE VII-5 - A COPPLETE FIRST LEVEL MACROEY$~,$SION OF EYJ~JPLE VII-4 *E. F.
. . . . . . . . . . . . . . . . . . . . . . .
PUSHDOWN STORES, LABELS ~ND ARRAYS VERIFICATION
...............
OF PROGRAMS WITH RECURSION
7-44 7-50
.............
7-66
EXAMPLE VII-6 - EXAMPLE VII-4 EDITED FOR VERIFICATION PROCEDURE
*VIII.
. . . . . . . . . . . . . . . . . . . . . . . . .
H0~A~IC RE~ORSION SCHEMES
A.
. . . . . . . . . . . . . . . . . . . . . .
A MONADIC RECURSION SCHEME WHICH IS NOT FLOWCHARTABLE. EXAMPLE VII-I - WHILE SCHEME TO I M P L ~ N T RECURSION SCP~iE . . .
B.
VALUE LANGUAGES
.....
8-1 8-1
A HONADIC
. . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . .
EXAMPLE VIII-2 - Monadie flowchart schmne translatable
7-74
P1
8-5 8-6
is not
Jmto any strongly equivalent monadie
recursion scheme . . . . . . . . . . . . . . . . . . . . . . EXP}IPLE VIII-3 - Flowchart scheme
P2
into any monadic recursion scheme EXAFPLE VIII-4 - Flowchart
scheme
P3
8-15
is not t~anslatable .............
8-17
is not strongly
equivalent to any monadic reeursion scheme even though (L#(Ps))R
is deterministic
context-free
EZ~I~PLE VIII-5 - CONSTRUCTION of flowchart t~wo-tape one-way deterministic M : (KIK2~E pretation La(H)
•
D
D.
: wRx
8-18
from
For any free inter-
t I = w$t'
(tl,t I) s
, w s L , and
. . . . . . . . . . . . . . . . . . . .
FREE M011ADIC RECURSION SCHEMES b~AK TRANSLATABILITY
.
if and only if
and in that case
val(P(H),I,x)
C.
(P(M),I,x)+
......
P(H)
finite state acceptor
<9 {$~0,1},~qo,qa,qr) I ,
scheme
. . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
8-20 8-23 8-25
EX~dPLE VIII-6 - ~r{K I~,~SLATION OF A RECURSION SCH~'-~
S II.
I~O
FLOWCHART SCB]iE
. . . . . . . . . . . . . . . . . .
8-26
Subsehemes for updating the Pushdown store Simulation
. . . . . . . . . . . . . . . . . . . . . .
8-27
XV
III.
Subschemes
APPENDIX A - PROGRAM EXA~LE
EXERCISES
for SLmulatLng
the R e c u r s i o n
Scheme
SCHEMES A}~ THE FIRST ORDER PREDICATE
A - I - T O T A L CORRECt%lESS F O R A N A L W A Y S
.......
CALCULUS
BL%LTIS~ S C H e m E
.... .....
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8-29
A-1 A-9
E-I
C}B_PTER II
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E-I
CHAPTER
III
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E-8
C
IV
~
CHAPTER V C
~
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E-q
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
E-6
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E-7
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E-9
VI
CHAFFER VII CHAPTER VIII
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E X A M P L E E-I - D I A G R A M 1
. . . . . . . . . . . . . . . . . . . . .
D IAGR~]~ 2 . . . . . . . . . . . . . . . . . . . . . . . . . .
E-14
DIAGRAM
E-15
EXAMPLE
3 . . . . . . . . . . . . . . . . . . . . . . . . . .
E-2 - D I A G R A M
1
. . . . . . . . . . . . . . . . . . . . .
DIAGRAM 2 . . . . . . . . . . . . . . . . . . . . . . . . . . DIAGRAIi 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . E X A M P L E E-3 - D I A G R I J DIAGRAM
1
. . . . . . . . . . . . . . . . . . . . .
2 . . . . . . . . . . . . . . . . . . . . . . . . . .
EXAHPLE E-4 - DIAGRAM
!
. . . . . . . . . . . . . . . . . . . . .
D IAGPgZM 2 . . . . . . . . . . . . . . . . . . . . . . . . . .
BIBLIOGRAPHY
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
CIiAFI~RS II A N D III CHARTER
IV
CHAFIIR V
E-II E-13
. . . . . . . . . . . . . . . . . . . . . . . . . .
E-16 E-17 E-18 E-19 E-20 E-21 E-22
B-I B-I
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B-I
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B-2
CHAPTER Vl
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B-2
C}{Q>TER V I I
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B-3
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B-4
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B-4
CHAFFER VIII APPENDIX A
INDEXES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
INDEX OF NOTATION INDEX OF TERMS
I-i
. . . . . . . . . . . . . . . . . . . . . . . . . . .
I-i
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
1-5
I-i
I.
~0~JCTION The subject of these notes might be described as "abstract flowcharts '~ -
the
study of mathematical models for programs and f~±oweharts, and of the interrelation between the syntax of programs (what can be said about their behavior from their very format) and the semantics (interpretations and the functions computed under varying interpretations) and the application of formal proof systems to verify properties of programs. The basic thrust of studies in this area has been to devise theories that would, for example, pemmit proofs that programs are correct, that programs terminate, that programs are optimal, and so on.
The ultimate goals (somewhat
utopian) include error-free compilers, automatic subroutine validation, mechanical aids to debugging, and detection of infinite looping.
Not too surprisingly, the
theoretical study began in the late fifties by Russian mathematicians such as lanov, brought to the attention of Western computer scientists by Rutledge, McCarthy and others and then reformulated and developed further by Manna, Paterson, Karp, Miller, and Floyd among others, has not yet made truly significant progress toward these eventual aims, although there bave been many interesting and useful developments. The alert reader will object that we are dealing with problems that are unsolvable in full generality and this of course is true.
We shall see how often we do indeed
end in the "Turing swamp" of undecidable properties.
However ~ the hope is that in
applications of interest we can try to skirt the swamp and concentrate on what can be done
-
and in particular what can be achieved using heuristic methods or
interactive systems. One of the models we shall examine in detail is the Luckham-Park-Paterson definition of program schemes.
The study of program schemes has several goals.
One
is to present a precise formal model of the notion of a computer program in a way that is entirely independent of features or workings of any (real or abstract) computing machinery.
The schemes ~±nder consideration are to embody just those
features or constructs of programming languages that appear "essential"
-
to
determine whether or not they are in some real sense essential and what is the relative power of different features is one of the objects of the study.
A second
purpose is to develop a basic theory of progsam optimization again independently of any particular machine or program~iug l~nguage.
A third objective is to develop
general methods (e.g. systems of rules of inference or transformations on programs) for checking or verifying a given program against its specifications.
This last
statement is a little circular since one must provide a formal definition of the "specifications" of a program and if by a "reasonable" specification of a program you mean a "recursively definable" one or a "computable program" you f~nd that you are indeed checking two programs (probably in different languages) for equivalence. So a study of formal notions of program equivalence is an important part of the theory
-
both for its own sake and for its importance when eonsidering optimization
1-2
and correctness problems.
Another theme is the question of translating programs
having one set of features into programs having different properties. translatability theorem
-
A
one which says that any scheme in one class can be
translated into an equivalent scheme in another class
-
how to replace certain features of programs by others.
results in our knowing This may provide normal
forms, it may help optimization and it may reduce a comrectness problem to one we already know how to solve.
A nontranslatability theorem
features cannot be replaced by others
-
-
saying that certain
provides us with some insight into the
elusive notion of the "power of expression" of a progrmv~.ing language.
EXAMPLES Let us examine a few sample flowePmrts to illustrate further the sort of questions we shall be studying.
Later we shall give formal definitions of schemes
and of other concepts, but right now let us rely on an intuitive understanding of "flowcl~mrt" , "interpretation" ~ "equivalence". First look at Flowcharts A and B in Example I-i.
~ch
contains one START box
where the program starts with some initially defined value of consider
x
-
There is one STOP box which indicates when the program halts~
at that tLme the current contents of registers arrows represent the flow of control.
y
÷
f
+
u
are the outputs.
The
y .
x
and the
Similarly
f(y)
indicates t~mt y
and
is to be applied to the contents of register
result is placed in register
y
y
Now a statement such as
f(x)
indicates t~mt function
y
is updated by applying function
f
to the current contents of
and the resmlting value is stored as the new contents of register
Statement
P(y)
function.
If the result of this test is positive, i.e. if property
P
we may also
to be the name of a register or location whose initial contents is the
input to the program.
register
x
y .
can be regarded as a predicate or test statement or a Boolean
or statement
P
is t ~ e
of the current contents of register
R
or expression
y , then control
flows along the arrow labeled I~UE and otherwise along the FALSE arrow~ it is implicit that one or the other must occur. Hotice tbmt and predicate
P
A
and
B
are "abstract" flowcharts because functions
are undefined and represented by abstract symbols.
consider these as places for, insertion of subroutines specifying We are interested Ln tm~ aspects of this situation. about flowcharts
A
and
B
f
f
and
g
and
P .
One may and
g
I%ie study of what can be said
without inserting the subroutines or actual operation
1-3
~LE
I-i "SIRONG EQUIV~NCE" No matter what functions you substitute for "f" and "g" , no matter what stater~o~ntyou use for .p:T ~ for each initial value of x ~ either both A and B loop or both A and B halt wi~h the same values in registers y and u .
FLOWCI-I~RT A
FLOWC}{A~RT B
START l)
START
)
,
u + g(x) l.'.l] y ÷ f(x)
1
>< \
/
h j
~
FALSE
~sE
I y + f(y)
u + g(x) I
u ÷ g(u)
l
I
]
,L y ÷ f(x)
I
< |
/
u ÷g(u)1 u ÷g(u)
(
STOP
k
) STOP
)
I y f(Y)
1-4
symkols for
f , g
and
choices for
f
g
and
P and
the examir~tion of what holds for all possible P
over all possible input do~r~ins
-
might be
considered the study of the syntax of abstract flowcharts or program schemes. we consider varying the interpretation
-
varying subroutines for
g ,
f
If
and
P
and alternative input domains, e.g. integers, real n~ombers, complex numbers, arrays, lists, natural language data
and their effect on the flowcharts we are in a
sense studying the semantics of flowcharts.
So the study of program schemes is
related to the s~ady of both the syntax and the semantics of progr&~ing lam~guages. There are other things to observe in these sample flowcharts. chart
A
is started with some value
placed in register
y .
If
a
P(f(a))
in input register
is true, then
(which we s~hall take the liberty of abbreviating now to
f2(a) .
If
P
is true of each
fn(a)
y
x .
is updated to
f2(a) ) for all
and test
m
is the least nonzero positive integer ~¢ith P
f(a) f(f(a))
P
is reapplied~
false for
On the other ~nnd, fro(a) ,
computation finally proceeds along the FALSE arrow with the contents of fm(a)
and places
updated to P
g(a)
g2(a)
is not tc~e of
g(a)
computation retests again followed. g(a)
in register
u .
If
P
then first
y .
Next
u
u
false for
P
is changed to
is not true for
fro(a) ,
in register
u
integer with
g(a)
u = g2(a)
and
is updated to
Since the value of
y
g(a) .
g(a)
and
fm(a)
in register
false.
A
then
at u
is
y : fro(a) .
If
P
is applied to
is in a:u un~rea]
or if there is no
y
y
and then the
But now when
the computation never halts.
P(fm(a))
g2(a)
then the
is unchanged, the FALSE arrow is
the same, F~LSE, path must be follov~d and
Thus if either
is true of
and the computation halts with
is
n , then there is no way
to leave this loop and the computation cannot reach the STOP box. if
Suppose flow-
First
m -> I
such tb~t
0therwise~ it halts with
where
m
P
is
g2(a)
is the least nonzero positive
This ~ I d s regardless of the actual functions and
values involved. Examining g(a)
B
we see that under input
and then applies test
computation loops. If
P
f2(a)
is false for and
P
an.swer resets false for Hence
P
Otherwise,
to
g(a) .
u
is set to
a
the computation specifies
If
P(g(a))
as
is fa!se~ then the
g2(a) . Then
f(a) , the computation halts.
u
y
is set to
Otherwise
y
f(a) .
is reset to
is again applied and again a false answer causes a stop and a true y
to
f3(a)
and reapplies
P .
If there is a
m
such that
P
is
fro(a) , m -> i , the computation halts, but otherwise it loops forever.
B
halts if and only if
when it i~alts u
is set to
P
g2(a)
nonzero positive integer for which
is true of and
y
to
P(fm(a) )
g(a)
and false for some
fm(a)
where
m
a ,
either both
A
-and B
is the least
is false.
So we observe that for any choice of interpretations for for any input
fro(a) and
f , g
and
P
and
enter infinite loops (in which case
there is no output and we are not interested in the succeedLng register contents) or both
A
and
B
terminate with the same values for the
u
and
y
locations.
1-5
So we shall say that
A
and
B
are strongly equivalent
-
for all interpretations
they e±ther both diverge (loop infinitely) or else both converge (halt, terminate) with the same outputs. We shall study the question of the strong equivalence of flowcharts at length, ~d
in particular examine when the strong equivalence problem is decidable.
We
shall see that in the general case it is undeeidable and not even partially decidable
one eannot even find an algorithm to list by exhaustion all pairs of
strongly equivalent schem~s. Example I-2 illustrates another theme of our discussion. the input location or variable Initially
u
and
y
x
are set to the input value, say
and the program halts vrith output u
to
n - i
set to
0 .
traversed
and
u
n
times.
z = 2n .
is again tested for
%uis occurs after
u +u y
Hence we can say that for any input n ,
If
y
u = 0
then
is reset to
n = 0
n + I
This process continues until
is applied
is set to
n .
n .
Otherwise, 0 .
- I
At this point
%~en the program halts with output
program halts on input
Here we assume that
is always set to some no,negative integer.
n
and u
is
times and the loop is
n + i + ... + i = n + n = 2n .
1~is is the only way the program csan halt.
n ~
if
n
is a nonnegative integer and the
then the value of the output register is
z = 2n .
Formally we shall say that the program is partially correct for input predicate " x
is a normegative integer" and output predicate
"z = 2x"
whenever the input criterion is true for the input
x
in the sense that
and the computation halts,
then the output criterion is true for the output value of register initial input value of register
x .
z
and the
Further we can see that whenever the input
statement is true, the computation must halt.
We shall express both conditions
together by saying that the pz~grmm is totally co_~ect for the particular input sand output predicates cited.
We shall investigate at length the concepts of partial and
total correctness and examine systems for prov£ng programs ~ t i a l l y To illustrate the concept of interpretation, exm~tine flowchart Example 1-3.
f(n) = n ,
g(n) = n - i
we have the program in E x a ~ l e
and
P(n)
1-2 which computes
the same input domain and the same "meaning" for
interpretation -
C
computes
z = 2Xx .
z = 2x . g
and
f(w) = wb
then under this interpretation a's "
for any string C
P(w) w
if we set y
g(a n) = a n-I
a's
"z = xb Ixl''
w
for any
is totally correct for input predicate
and output predicate
f(n) = 2n ,
and so under this
is true if and only if and
f
n = 0 ,
On the other ha~d, with
P ,
If the domain is strings of
including the empty string, if
empty string, and
string of
in
is true if and only if
then each time around the loop we double the current value of
a
C
If we assume tlnat our inputs are all nonnegative integers~ and that
is the function
of
correct.
members is the n >_ i ,
" x
is a
We shall frequently be dealing
with statements that start "For all intez~oretations ... " or "There exists an interpretation sueh that ..."
In some eases such as in the study of program correctness
we shall be concerned with the behavior of a flowchart under specific interpretations.
1-6
E~LE
1-2
'Re
CORRECTNESS
program bel~7 is totally correct for
Z:
2X
and input
nonnegat ive integer.
START'")
li ] U ÷X
I
U
I,, ...z.... ,,I
0?
y÷y+l u÷~-I
I
I
(sTop.)
X
a
1-7
EXAMPLE 1-3
-
INTERPRETATIONS
FLOWCHART
C
START
!
Y + × U
÷
X
/
1
\!
|
! z
and
x
y
,I
( Let
+
STOP
I !
and
1
u + g(u)
]
t
.)
be the input variable and
g(n) d e f n - i
Y + f(Y)
P(n)
z
the output variable.
is tm~e if and o n l y if
n = 0 ,
If
def f(n) = n + i
and the inputs are
norm.egative integers, then C computes z = 2x . If P ~nd g are t h e same but def * f(n) = 2n , then C computes z = 2Xx . If inputs are m e m b e r s of a , P(w) def = a is true if and only if w : e (the empty string), f(w) = x b and g(a n) def n-i for
n -> i ,
then
C
takes
x = an
into
z = anb n .
1-8
Flowchart
C
illustrates another topic of study.
It can be considered a
graphical translation of the English program on the next page. kind of fl~cbmrt called a "WHILE scheme". has no "GOTOs"
-
This is a special
One of its salient points is that it
the only loops are subsumed by the WHILE state~nents. We shall
examine special structural properties of schemes, such as block form, and convemsions to such forms; these may really be considered syntactic properties of flowcharts since they depend primarily on the grapln struc~are.
However they are very useful
in discussing semantic considerations.
EXAMPLE I-4
EXPRESSION OF FLOWCHART C AS A "WHI~-SCH~JE"
START y+x U÷
X
WHILE
P(u)
is
FALSE
DO y + f(y) u + g(u)
EqDWHILE z + y STOP
2-1
II. A.
PROGRN~ SCHEMES SYNTAX
-
BASIC DEFINITIONS ~ND CONCEPTS
-
THE MODEL
We give ~ D
closely related definitions of program schemes, one in the for~
of flow diagrams or abstract flowcharts and the other a linear representation of this form. Program schemes are sequences of expressions in a m~1~ticular formal metalanguage and we define them in parts as follows. ALPHABET a.
Function letters
-
for each
n a i
there are an infinite number of
n-placed or n-ary function letters (we use f~g,h,.., b.
Predicate letters -
with or without subscripts)
for each
n z i
there are an infinite number
of n-placed or n-ary predicate letters (we use T,P,Q,p,q,... c.
Variables
with or %ithout subscripts)
there are an infinite number of individual variables or, locations or registers x,y,z,u,v,...
d.
auxiliary syrr~is -
n~0merals (or
e.
augmented symbols
!
START 0
or
STOP T
constants (we use
-
subscripts),
(we use
~eith or without subscripts)
:
(
)
+
,
TRUE
FALSE
F ) a,b,c,..,
with or without
(equality)
TERMS a.
A variable
b.
If
f
then c.
If then
d.
u
or constant
f(xl,... ,xn) T
c
is a functional term.
is an n-ary function letter and
x l,...,x n
is a functional term.
is an n-placed predicate letter and T(Xl~... ,xn)
are variables,
Xl,... ,xn
are variables,
is a predicate term.
The auxiliary symbols
START
and
STOP
are terms.
STATemENTS a.
ASSI~NME~f
STATEMEWfS
if
t
is a functional term and
a variable then
oeo 1
l is an assignment statement
t
u
is
2-2
b.
TEST STATEMENTS
if
t
is a predicate term then
i..i
is a test statement (we caan substitute for c.
TRUE
START
and
!
0
or
T
F
FALSE ) STOP
statements :
I i i Thus assignment statements can have any number of entries but only one exit, test statements can have any number of entries but two exits, START statements have no entries and one exit and STOP statements have any number of entries but no exits.
DEFINITION
An interconnection of statements such that each entry point leads from
an exit point and each exit point leads to some entry point is a FLOW DIAGRAM.
DEFINITION I.
P
A
FROGRA/~ SCHEME
is a finite flow diagram
P
such that
contains well-formed assignment and test statements, exactly one START
statement and at least one STOP statement. 2.
Every statement is connected to (lies on a path from) the START statement.
3.
The variables are divided into three not necessarily disjoint sets, - input variables,
Y - program variables,
and
Z - output variables,
such that : a.
A variable in
X - Y
never appears on the left hand side of an
assignment statement b.
A variable in
Z - Y
appears on the left hand side of an assignment
statement only if that statement is L~r~diately connected to STOP~ a variable in
Z - X - Y
never appears in a test statement or the right
hand side of an assignment statement, and.
2-3
on every path from START all variables not in
c.
X
are assigned to
before they are computed upon; i.e. for each variable any path from S'I~RT to any statement involving assignment statement ~ith
u
There are several p i n t s to notice. a p~rticular kind of graph.
u
u
not in
must contain an
on the left hand side.
This definition is really a definition of
Later we shall give a linear definition.
Notice that
the sets of input, output and program variables need not be disjoLnt and tbmt and
b.
X
3a.
could just as well be taken as a definition of the concept of input,
program and output variables.
If every variable is simultaneously an input, output
and program variable then we generally will not designate these sets.
Quite often
we sJm~ply ass'~me that ever~y variable is a program variable ~nd only observe whether theme are program variables that are not input variables and also wlmt are the output variables. The definition of program scheme is "reeursive" or "computable" in the sense that we can decide whether a given flow diagram (finite of course) meets this definition. diagram.
Conditions i and 3a and b are clearly verifiable by inspection of the
Since accessibility is decidable for finite state graphs, we can determine
whether a given statement lies on a path from START and so verify condition 2. Condition 3c says that every variable nTast either be an ira.put variable or else be specified before being used on every path from the START. u
not in
X .
Consider any variable
For our present purposes, regard the diagram as a finite state graph,
with START as the initial node, and as final nodes, each place in which program variable ment with
u
of the form b .
-
every test statement involving
on the right band side. u ÷ t
where
t
u
u
is a
and every assign~ment state-
Label each arrow from an assignment statement
does not involve
u
by
a
and every other arrow by
Now we can construct a regular expression for the set of all m~d only label
sequences on paths from START to the final nodes and determine whether it designates any member of
b
a usage of
without passing through an assignment of
u
notice that if
;
P
if it does, this stands for a "bad" path
has
n
is a bad path o~ length
u .
one from START to Equivalently, one can
statements then there is a bad path if and only if there n
or less.
Frequently we avoid the problem by assuming all
variables to be input variables. Function letters are sometimes called computation or operator, symbols.
Test
statements are also referred to as conditional transfers (if the branches go to different next statements) or unconditional transfers or GOTOs (if the branches go to the same place). There are various ways of augmenting the program schemes.
For example, a test
may have more than two exits, an assigmment statement might update several variables simultaneously (e.g. variables (e.g.
(u,v) ÷ (tl,t2))
or
u ÷ f(g(f(xl),g(ul,u2)))
a or
term might have functional terms as T(g(x,f(y)))
.
Questions such as
2-4
strong equivalence, termination, correctness and freeness can generally be answered for such augmented schemes by answering the same questions in our. simpler language; these additions may provide notational convenience but do not affect the power of schm~es. There are other methods of augmenting schemes which may or may not increase the power of the language in certain cases. -
zero-placed functions.
test
-
For example one can add constants or resets
One can also consider the effect of adding an equality
a special two place predicate, say
interpreted as equality
-
E(x,y)
E(x,y)
-
which is restricted to be
is true if and only if
x : y . Yet another
is to add a counter w b i o h a s we shall see later means addLng special ~nary functions and predicates which are always restricted to be interpreted as for zero arrays.
-
the counter operations.
+i ,
-I
or test
Similarly one might add pushdown stores or
We shall postpone all such definitions and considerations for later.
A minor notational point is that, strictly speaking, one should fix once and for all what symbols are to be 1-place functions, 1-place predicates, 2-place functions, variables, etc.
This would lead to an unpleasant degree of subscripting.
So we shall try to play both games.
That is, for the formali~nand the proofs we
shall assume that this has been done and everything is clearly marked and ~unambigdous mnd consistent.
For example~ if we have a subsch~me:
0
v ÷
(x)
¢ then we kn~i that
u,v,x,y
2-placed function letter, letter and nothing else.
I
$
are used as variables and nothing else, t
a monadic function letter and
Q
c
is a
a unary predicate
So that particular scheme could also have a piece:
2-5
x + t(u)
~ y ÷ c(u,v)
but must not have pieces such as:
i
$
B.
SEMANTICS
-
A
x ÷ x(t)
t ÷ c(x)~
INTERPRETATIONS AND COMPUTATIONS
INTERPRETATIONS Now that we have ou~ f o r ~
!angumge in hand, we ~mst see how it is used.
First we must discuss the concept of interpretation.
DEFINITION
An. interpretation
I
for a p ~ g r m n scheme
i.
A nonempty set of elements
D
called the domain of the interpretation.
2.
An assignment to each n-ary function symbol I(f)
3.
from
into
from
{TRUE,FALSE}
Dn
into -
For any constant
{0,I}
I(T) c
f
consists of:
of a total n-ary function
D .
An assignment to each n-ary predicate symbol I(T)
4.
Dn
P
in
T
of a total n-ary function
(or equivalently, into
{T,F}
is a Boolean function). P ~ a member
l(c)
of
D .
or
2~6
A pair
(P,I)
where
I
is an interpretation of a scheme
program.
Suppose the input vector for
register
xi
we assign a member
for input vector (P,I)
ai
a = (al,...,a k) .
on input
a .
P
is
P
is called a
X = (Xl,.~.,x k) , and to each input
of the domain Then we use
D
of
I . We often write
(P,I,~)
for the eomputation of
Occasionally the interpretation also includes the input
values; both approaches are useful and a matter of taste; the notation should make our definition clear. If the dommin interpretation. by
I
D
If
of interpretation D
I
is finite, then
I
is a finite
is a reeursive set and all functions and predicates assigned
are total recursive functions, then
I
is recursive.
C01~U~ATi0N Now we must give a precise definition of the computation of program input
~ .
(P,I)
on
The intuitive meaning should be clear, although the formalism is a bit
cumbersome.
We consider a computation to be a sequence of vectors, each a
computation state. A computation state consists of a statement or instruction P
currently being executed
P
at that stage in the computation.
-
-
the statement of
and a vector of values assigned to the variables of We can let the symbol
A
correspond to those
variables (program or output variables ~lich are not also input variables) which are undefined at this stage.
The statement being executed could also be denoted by its
address or position in the flow diagram. states, let
s(i)
ment executed in tP~
i-th
value assigned to variable s
If
be the statement in the
s
is the sequence of computation
i-th
state of
s , that is, the state-
step of the computation, and let u
after
s(i)
is exeeuted.
va!(u,i)
Thus the
denote the
i-th
state of
can be represented as
(s(i),val(ul,i),...,val0~,i))
if
Ul,...,u r
is the list of all variables used in
P .
We define the computation states inductively~ letting i)
Initially we ~have s(1) = START , xj
is the
j-th
an input variable.
s(2)
be the domain of
the start stateme_nt, and
input variable and Then
D
val(u,l) = A
va!(xj,!) : aj
(is undefined) if
u
I . if
is not
is the statement entered by the arrow leaving
the exit of the START statement. 2)
If
s(i+l)
is the assignment statement
y + f(v I .... ,vn) and
l(f)
I , then
is the f~nction from
Dn
into
D
assigned to
f
by interpretation
2-7
val(y,i+l) : I(f)(val(vl,i),...~val(vn,i)) val(u,i+l) : val(u,i) s(i+2)
,
for
is the statement entered by the arrow leaving the exit point of
2')
If
s(i+l)
y
where
If
~
V
y
and
v
are variables, then
val(y,i+l) : val(v~i)
,
val(u,i+l) : val(u,i)
,
÷
for
is the same as in
s(i+l) y
s(i+l) .
is the assignment statement
s(i+2)
2")
,
u ~ y , and
and
u ~ y ,
2) .
is the assignment statement e
for constant
c
interpretation
and I ~
l(c)
is the member of
D
assigned to
e
by
then
val(y,i+l) : l(c) val(u,i+l) = val(u,i) s(i+2)
3)
If
s(i+l)
,
for
is the same as in
u ~ y
and
2) .
is the test statement
T(v 1 . . . . . v n) and
I(T)
i s t h e f u n c t i o n from
Lnterpretation
into
{O,l}
assigned to
for all variables
l(T)(val(vl,i),...~val(vn,i))
: 0
u ,
then
s(i+2)
arrow labeled i leaving
If
by
and
s(i+2)
statement entered by the arrow labeled 0 leaving and otherwise
4)
T
I ~ then
val(u,i+l) : val(u,i) if
Dn
s(i+l) = STOP
is the s(i+l)
is the statement entered by tlne s(i+l) .
th~n
val(u,i+l) : val(u,i) for all variables u , s(i+2) is undefined, and computation sequence s has i+l states and is a complete terminated computation.
2-8
DEFINITION
Let
If there is an
s i
be the computation sequence for program such that
s(i) = STOP ~
halts or ter~Linates or converges in of
P
under
i
with input
val(P,l,a-)
where
~
on input
then we say t2mt computation
steps~ written
(P,I,~)+ ,
a .
(P,I,~)
and the output
is denoted by
: (val(zl,i),...,val(zm,i))
Z : (Zl~...,z m)
is the vector of output variables of
infinite, then the computation In this case
i
(P,I)
val(P,l,~)
(P,I,~)
is undefined,
P .
If
di_verges or loops, written indicated by
val(P,l,a)+
s
is
(P,l,a)+ .
.
EX~V~LE II-i Let us use t}~ flowchart in Example II-i to illustrate the concept of interpretation and computation.
Consider azl interpretation
D
l(T)(n) = 0
is the nonnegative integer.s,
l(g)(n) = n z i
(where
n ~ m = n - m
for
if and only if n z m
~nd
I
for which the domain n = 0
n z m = 0
otherwise)
~nd
l(f)(n,m) = n + m • We can write out explicitly the computation states for computation where the initial value of
xI
is
2
and of
x2
is
(P,l,(2,3))
3 . We have attached letters
to the right of the statement boxes except for the u~.ique START and STOP statements for convenience in n a m ~ g
STA~%
the statements executed at each step.
i
(S T ~ T , 2,3 ,A)
2
(A,2,3 ,A)
3
(B,2,3,2)
4
(C,2~3,2)
5
(D~2~4,2)
6
(E,2,4,1)
7
(F,2~4,1)
8
(G,2,6,1)
9
(E,2~6~0)
I0
(F~2,6,0)
ii
(STOP,2,6,0)
2-9
KXAI~PL~II-i Input variables
-
Output variable
xI , x2
-
x2
A
x 3 ÷ g(x 2)
\/
I,x2 + f(~l'x3 j
H
I×! ~ f(~l,h) L¢-
I
! + g(x 3)
O
(,,STOP)
x2 ÷
f(xl,x 2) r
2-10
Thus, for example, Finally,
val(P,l,(2,3))
s(5) = D ,
val(x3~7)
= val(x2,11)
= i ,
= val(x2,10)
= n ,
val(P,l,(n,m))
= nm .
C.
val(P,l,(0,m))
= 0
for
= 4 ~
etc.
= 6 o
In this case it is not difficult to see that val(P,l,(n,l))
val(x2,5)
val(P,l,(n,0))
n,m ~ 0
and for
: O , n,m ~ i
LINEAR DEFINITION OF PROGRAM SCHEMES Instead of representing
can represent
a program scheme in graph form as a flow diagram, we
it in linear form b y h a v i n g
each statement proceeded by a numeral
called the address of the statement and having each test statement followed by two numerals, the transfer addresses. Well-formed
Assignments
statements now are:
k.
y ÷ f(vl,..o~v n)
where
of the statement,
k
is a numeral, the address
Y,Vl,...,v n
are variables and
f
is an n-placed function letter
Tests
k°
y ÷ v
for
y,v
kl
y ÷ c
for
y
k.
T(Vl,...,v n)
variables a variable and
r,s
of the statement, addresses, Vl,...,v n
STOP
k.
STOP
where
statement.
T
where r
and
k
o
a constant
is a numeral~ the address s
are numerals, the transfer
is an n-placed predicate letter and
are variables
k
is a numeral, the address of the STOP
2 -ii
A p r o ~ a m scheme
DEFINITION
P
is a finite sequence of statements such that:
(I)
the address of each statament is its position in the sequence,
(2)
all transfer addresses are addresses in
(3)
there is at least one STOP statemer£c, the last statement is either, STOP
P ,
or a test statement ~ and each statement lies on some path from i, and (4)
the variables of , [
and
path from
Z 1
P
are divided into three not necessarily disjoint sets
such that any variable not in
X
is assigned to in any
before it is computed on, any variable in
assigned to, any variable in
Z - Y
STOP statement, and no variable in
X - Y
is never
is assigned to only just before a Z - X - Y
is computed upon.
Condition (4) is decidable in the same way" and by the same reasoning as condition (3) in the other model. variable not in
X
Some authors use the weaker condition that any
is assigned to in any computation before it is computed on.
Since it is undecidable whether a particular statement can ever be reached in any computation under any interpretation for any input, this condition undeoidable and thus in our view undesirable.
will be
We prefer definitions to be
effective, particularly definitions of the basic object under discussion.
So this
problem is avoided either by using the condition we have given which obviously implies the alternative one, or by always ass~mLng all variables to be input variables, w~hich shortouts the whole problem. We assume that computations always start at statement
i
and so we did not
need a START statement in this model. We define interpretation in this model exactly as in the flow diagram model. However, the timing of computations is now off by ½~ step. computation sequence stage
i
and
£nstruction
s ,
val(u,i) s(i-l)
s(i)
For this model, in a
is the address of the statement to be executed at
is the value of variable
u
before stage
We nov give an inductive definition of computation sequence interpretation I.
2.
Let
I
and input
a , and let
val(y,l)
If
and we have
k. then
but after
if
x
f~r scheme
is an input variable with initial value
be undefined if
y
is not an .input variable.
y ÷ f(vl,...~v n)
s(i+l) = k+l ,
s
a .
s(1) = i , val(x,l) = a
s(i) = k
i
has been executed.
val(u,i+l) : val(u,i)
val(y,i+l) = l(f)(val(vl,i),..~,val(vn,i))
for .
u ~ y , and
P ,
2-12
2'.
If
s(i) : k k.
y÷v
for variable and 2".
If
s(i) = k
If
s(i+l) = k+l , val(u,i+l) : val(u,i)
for
u ~ y ,
s_nd we have
c ,
then
s(i+l) : k+l , val(u,i+l) : val(u,i)
for
u ~ y
val(y,i+l) = l(c) . s(i) = k
then
and we have
T(Vl,.°. ,v n)
k.
r ~ S
val(u~i+l) = val(u,i)
s(i+l)
4.
then
y+c
for constant
3.
v
val(y,i+l) = val(v,i) .
k.
and
and we have
:
for all variables
i
and
t r
if
I(T)(va2(vl,i),...,val(Vn,i))
i s
if
l(T)(val(vl,i) .... ,val(vn,i)) : 0
If
s(i) = STOP, then
s(i+l)
if
Z=
then
(Zl,...,z n) ,
is undefined,
s
=1
has exactly
i
steps and
val(P,l~a-) = (val(zl,i),...,val(zn,i))
.
Thus except for timing this definition is essentially the same as the previous one.
It is obvious that the two models are the same.
Going from the linear to the
flow diagram model is obvious~ in the reverse construction note that if we must make a correspondence betm~een nodes and addresses such that the statement in the flow diagram given address given address
k
is an a s s i ~ m e n t tlnat does not lead Lnto the statement
k+l , then we add a forced transfer as
k+l
and readdress the rest
of the statements.
For example, it is obvious tbmt Example II-2 is a sequential form of Example II-l. back to line 6.
Notice the extra test added in line 8 to provide a forced transfer
2 -13
EY~]~PLE 11-2 LI],[}IAR FOP&I OF S C H E ~ i.
T(x 2 )
2.
x3
3.
T(x 3 )
4.
x2
+
f(xl,x I)
5.
x3
÷
g(x 3)
6.
T(x 3 )
7.
x2
8.
T(x 3 )
9.
x2
i0.
÷
II-i
10,2
g(x 2)
9,4
10,7
÷
f(xl,x 2)
6,6
÷
f(xl,x 3)
STOP
EXhaLE Let us consider Example II-3, a classic example of a schmne which ihalts for all finite interpretations but fails to inalt for some infinite interpretations.
Let us
see why this is true.
Suppose the initial value of registers
xI
and
x2
auto~mtically halts. which xI
P
is
a . After the first two assignments,
f(a) .
If
halts so
T(f(a)) : i ,
the program
If we are trying to find an interpretation and input for
diverges, we know that we ~ast have
is updated as
we must have P
xI
both contain
f2(a) .
If
T(f2(a)) = i . T(f3(a)) = 0 .
T(f(a)) = 0 .
T(f2(a)) : 0 , Next
xI
Reassigning
then
P
is reassigned as xI
as
we see by the previous reasoning that we must have
f4(a)
In the next step,
halts.
In order to diverge
fS(a) . a~d
x2
If as
T(fS(a)) = i , f(x 2) = f2(a)
T(f4(a)) = I . The next choice
point is determined because to be consistent with our previous assumptions regarding the interpretation of
T ,
we must have
T(x 2) = T(f2(a)) = i .
We summarize some stages of the interpretation and computation in Ekamp!e 11-3 '.
2-14
EXAMPLE 11-3 A SCHEME WHICH HALTS UNDER ALL FINITE INTERPRETATIONS Bt[f NOT UNDER SOME INFINITE INTERPRETATIONS .... ,L,,,
$ Xl + f(xI)
I Xl ÷ f(xI)
x I ÷ f(x I)
I STOP
]
x I + f(xI) x 2 ÷ f(x 2)
i!
2-15
EY~I~
II-3 ' SOME STEPS IN A C01¢Pt~ATION OF EXAMPLE II-3 WHICH NEVLR HALTS
ASSIGh~{ENT BOX
xI
T(x I)
A
f(a)
0
B
f2(a)
i
C
f3(a)
0
D
f4(a)
D
x2
T(x 2)
f(a)
0
I
f2(a)
i
f5(a)
i
f3(a)
0
C
f6(a)
0
D
f7(a)
i
f4(a)
I
D
f8(a)
i
fS(a)
i
D
f9(a)
i
f6(a)
0
C
fl@(a)
0
D
fll(a)
i
f7(a)
I
D
fl2(a)
i
f8(a)
i
D
fl3(a)
i
f9(a)
i
D
fl4(a)
i
~0(a)
0
C
flS(a)
O
Ex~min£ng the list in Ekample II-3', one can see that the assigned
fn(a)
in
C
(or in
definition and tPmse for ~ i ~ . T(fn(a)) = i . The
n
for which
xI
for which
progression and in ~ c t we have k
A ) must have
T(fn(a)) = 0
is first assigned T(fn(a))
must be
T(;~(a)) = 0
fn(a) 0
n
for which
is
xI
in any nonhalting in
D
must have
form an arithmetic
if and only if there is an integer
n = k(k+l)/2 . Clearly if the set of values
f(a),f2(a),f3(a),...,fr(a),...
is infir~ite then no two are the same and so there is an interpretation of causes
P
Lntegers,
to diverge. l(f)(n) = n+l
For example ~ if the domain of and
T(n) = O
I
T
which
is the nonnegative
if ~nd only if there is an integer
k
for
2-16
which
n : k(k+l)/2
and the input is
a = 0 , then
On the other b~nd, suppose that domain Let
fI
stand for
l(f) . Since
D
D
(P,I,0)
will diverge.
of interpretation
I
is finite.
is finite, the sequence
fl(a),f2(a) ,fi(a),... 3 ,f[(a) ,... contains only finitely many distinct values and hence Cnere are 4 ( a ) = f~+m(a). repeats forever. specify
xI
Thus after If
as some
n , the sequence of values
l(T)(~+i(a))-- = i ~+i(a)~
in
C
for
will halt.
0
will repeat "too often" in the sequence
sueh that
f~(a),~l+l(a) .....~l+m(a)
O ~ i ~ m , then eventually we will
for w%£ch the value of
P
n,m ~ i
On the other hand, if one of these
m
I(T)
values of
will be
I(T)
is
I O
and then
l(T)(f~(a)),...~l(T)(f~+r(a)) ....
and hence at some p i n t after of
xI
and halt.
1~nus P
So
P
D
we shall have
I(T)
as
0
for the current value
will eventually halt.
baits on all finite Lnterpretations but diverges for certain infinite
interpretations.
D.
EQUIVALENCE It is clear that any interpretation
general interpretation
I'
of a scheme
P
can be extended to a
of all schemes by using the same d o m a ~ and. assigning
functions over the domain of
I
to the function and test symbols of the language
that were not assigned meanings under (P,I')
I
are obviously identical.
I . The interpreted programs
(P,I)
and
For convenience we shall for the most part in the
following discussion restrict our attention to those interpretations that assign a meaning to every functior~ and test symbol of the language.
Such interpretations,
which we might call universal Ln~erpretatJons, are interpretations of every scheme.
DEFINITION
Suppose a program scheme
domain of an interpretation
converges everywhere) if for all inputs
DEFINITION if
(P,I)
problem for
A program scheme
P
has
I . We say tlmt
P
a
in
n
input variables and
(P,I) Dn
the computation
baits for all £nterpretations or
halts everywhere for all interpretations P
D
is the
halts everYwhere (or
is the problem of determining whether
(P,I,7)
P
always halts
I . The termination P
always halts.
halts.
2-17
Equivalently, if every interpretation I ),
P I
the computation
has
n
Lnput variables, then
and every input (P,l,a)
a
in
P
always halts if for
D n~ (where
DI
is the domain of
halts.
Loosely speaking~ two schemes are said to be equivalent if under all interpretations they compute the same values.
Znere are several different possible
notions of equivalence.
P
Assume now that
has the same input variables as
P'
and the same output variables.
DEFI2{ITION domain
D
%~
interpreted schemes (programs)
are strongly equivalent~ written
vectors
a
(P,l~a)
end
DEFINITION
over the common domain either (P' ,I' ,a)
11~0 schemes
for all interpretations
both halt and
P
and
I ,
P'
(P,I)
(P~I)
and
(P' ,I' ) with the same
(P,I) - (P',I') , (P,I,~)
and
if for all input
(P' ,I' ,a)
both diverge or
val(P,l,aT) : val(P' ,I',~) .
are strongly eqdivalent, written and
(P' ,I)
P =- P' , if
are strongly equivalent.
Strong equivalence requires' that for any interpretation and input either the values of the cc~putations of defined rand are equal.
P
and
P'
are both undefined or they are both
Several no~ions of ecfaivalence may be defined in, a similar
way by restricting the set of interpretations.
DEFINITION
Two schemes
and only if
(P,I)
pretation
P
and
P'
are finitely equivalent, written
is strongly equivalent to
I . Two schemes
P
P R- P' if and only if (P,I) recursive interpretation I .
and
Thus:
P'
(P' ~I)
P ~ P'
if
for every finite i~nter-
are recursively equivalent, written
is strongly equivalent to
These equivalence :relations are not the same.
(P' ,I)
for every
Obviously slmong equivalence
implies ree~mosive equivalence and reeursive equivalence implies finite equivalence. None of the reverse inclusions hold.
We are already in a position to show that
finite equivalence does not imply recursive equivalence.
Consider the scheme of
of Example II-3 which halts for. all finite interpretations but diverges for some infinite hut recursive Lnterpretations (for the Lnterpr~tation of caused divergence is obviously recursive).
We can diagram
P
as:
P
we saw that
P
2-18
ST/{RT
(
)
_i
stop
p'
Now let us alter
P
to
PI :
START )
'
x 2 ÷ f(x 3) ~
STOP
Now very end.
PI So
just like
P
output ~m-ll be
(f(x3)~f(x3),x 3)
meantime.
PI
But
,,,
)
has a new input variable PI
P'
x 3 which is never computed on until the
will halt for all finite interpretations and the regardless of input or
f
or w~}mt P
will diverge for some infLnite Lnterpretations.
consider the trivial scheme
P2 :
~ms
did in the if we
2-19
START
,i
Xl ÷ f(x3) 1 x 2 ÷ f(x 3) ]
l, )
( we see that
PI
and
P2
are equivalent for' all finite interpretations (and indeed
for all interpretations wherein forwhich
P2
halts and
PI
FI
halts) but there is a rec~rsive interpretation
diverges.
Now of course these counterexample schemes are not of great interest in themselves.
'Their purpose is to exhibit a pathology which one must watch out for
in any "real" scheme.
There ere many other possible notions of equivalence, depencttng on the m~derlying phenomena one wishes to model and study.
In our later discussfon of block
stm~eture and transformations to structured form we shall meet some definitions yet more rigorous than "strong equivalence"
-
notions of computational equivalence or
structure preservation where one dm~na~nds that not only the end result be the same but that the outputs be obtained in roughly similar ways.
One stronger notion is
total equivalence which only holds between always halting schemes.
DEFINITION halt and
Scheme P
R
is totally equivalent to scheme
is strongly equivalent to
R'
if
P
and
P'
always
P' .
Now we intr~Jduoe some "weaker" definitions of equivalence~ relaxing some of the demmnds of strong equivalence°
2-20
In some cases
- notably in considerations of program verification
-
one is
seeking something less than complete equivalence; one might be willing to settle for a "fail-safe" condition..
That is~ one might agree that the program might Dave
bugs and fail to halt but when it halts it must do the right tln£ng. 11~is notion leads to the definition of weak equivalence.
DEFINITION domain
D
vectors
We say that interpreted programs are weakly equivalent, written
a
(P',I' ,a)
over domain halt, then
D ,
weakly equivalent to
If
P
and
same thing. that
P
P'
(P~I)
I
and
I'
and I ,
P'
are
(P,I)
if
(P,I) ,
P
P
is
does a little more
are interpretations with the same domain. (P' ,I') ,
written
(P' ,I' ,a)
We say that
P' < P )
P
if for all interpretations
-
does but perhaps halts in some other places.
extends program
is included in
P ,
if fop all input
(P,l,a-) and computation
= val(P' ,I' ,a) . We say that
P ~- P' ~
P'
equivalent and whenever
in
,
with the same
are weakly equivalent, then whenever both halt, they do the
Suppose
that program
vice versa.
(P,I) = (P',I')
We Kay be interested in knowing that, say~
DEFINITION
(P' ,I')
(P' ,I) .
halts whenever
(P',I')
and
whenever both computation
val(P,l,a-)
weakly equivalent, written
(P,I)
halts~
(P,l,a)
is an extension of
We say
(P,I) > (P' ~I') ,
(P',I') < (P,I))
is an extension of
(P,I)
written
or
if they are weakly
halts, but not necessarily
P' ,
P > P'
(P',I)
(or
P'
is included
for every interpretation
I .
DEFINITION if
P ~ Q
and
Q
A relationship
~
always implies that
between schemes is a reasonable equivalence relation P
is weakly equivalent to
are strongly e~Jivaient then
Q
and if Whenever
P
P ~ Q .
Weak equivalence requires that for any interpretation and input the computations of
P
and
P'
yield the s ~
values whenever both computations halt.
If one
computation diverges it does not matter what the other one does. The term 'Tweak equivalence" is somewhat unfortunate
since weak equivalence is
not in fact an equivalence relationship in the usual meaning of the t ~ . obviously symmetric but it is not transitive, to any scheme that never Imlts.
It is
since every scheme is weakly equivalent
For example, consider
PI '
P2
aild P3
below:
2-21
PI
(
P2
)
START
START
P3
l,,
I
x + f(x)
x + f(x)
x + f(x)
,l < >
0
<
STOP
f
STOP
Obviously
PI
)
START
)
and
P3
0
)
are weakly equivalent to
but are not weakly equivalent to each other (i.e. denote situations such as
P2
<sToP)
P2
(i.e.
PI ~ P2
and
P2 = P3 )
PI ~ P3 ) " We shall frequently
where an infinite loop must occur in all ~nter-
pretations by:
Now weak equivalence, finite equivalence, recursive equivalence and strong equivalence are all reasonable equivalences although the first is not a true equivalence relationship and the last three are. between weak and strong
-
Reasonable equivalences stand
they Mast held between schemes that behave identically
for all interpretations and must fail between schemes which oan ~ produce different results on the same interpretation.
demonstrated to
Total equivalence is not a
reasonable equivalence because it does not hold for schemes which can diverge~ and
2-22
although transitive and symmetric is not reflexive and so it is not an equivalence relationship.
Notice that if
PI
and
strong equivalence between
P2 PI
contain different function or test letters then and
P2
implies a kind of degeneracy~ in that
certain functions and predicates are not really needed.
We need a different type
definition of equivalence to handle the ease in which different schemes compute the same function under varying interpretations of the functions they do not have in COFC~Ion.
DEFINITION
Call interpretations
I
and
compatible if for any n-place function I(f)(a) = I'(f)(~)
I'
f
with domains
I' , l(T)(a) = l'(T)(a)
for any
assigned in both
I' , l(e) = I'(o) .
I
and
in
and
interpreted by both
&nd for any n-place predicate a
D
Dn
Suppose we call a~n interpretation of
P
T
and
I
D' and
respectively I' ,
Lnterpreted by both
I
&rid
(D')n , and for any constant
c
minimal if it inte_~prets only function
letters and predicate letters actually present in
P . Then one might define a
relation
PI
~
P2
if and only if for each minimal interpretation of
P2
I1
of
P1
there is a compatible
mJm~Lmal interpretation
12
strongly equivalent to
(P2 'I2) and for each ~inimal interpretation
with the same domain such that
there is a compatible minimal interpretation that
(PI,II)
is strongly equivalent to
I1
of
P1
(PI~II) 12
is
of
P2
with the same domain such
(P2,I2) .
LOCAL TRANSFOR~[%TIONS We shall be particularly concerned with transformations on schemes Which preserve strong equivalence.
Some of these will be global transformations acting
on the scheme as a unit and others will be local~ replacing parts of a scheme with other strongly equivalent subschemes. A few examples of local transfor~mtions appear in Example II-4. verify for each pair of subsch~mes by replacing subscheme
S
is replaced by entry point of
R
(or
es0
by
eR0
R
by subscheme 1R and
of eSl
R by
and R
S , that if a scheme
is <7~ansformed
in such a way that entry point
and exit point eRl
P
The reader earl
eS
of
S
iS
if there are twn corresponding
points after a test) then the resulting scheme
P'
of
by exit point
is strongly equivalent to
eR
exit P .
These trmnsformations can be used to trace equivalences rand sometLmes obtaLn s~ p l i fioations.
S
2-23
EXAMPLE 11-4
i.
SOME LOCA]~ EQUIV TA!I~CE PRESERVING TP~{SFORMATIONS
Intercb~ngLng assignment ~ d
rest statements Valid for
~
u ~ v iR
is
>
v~tl
es0
2.
Iv~tl
eSl
Interchanging assignment statements Valid if
u
does not appear in
and
v
does not appear in
Iv~tl f
eS
eR
t'
2-24
3.
Elimination of "overprinted" assignments Valid if u does not appear in t' or in a test statement of B or the right hand side of an assignment of B : iS
k~J
< I ~ )
I
>
[u~t,] eS
4.
eR
Detection and explicit display of tight loops Valid if u does not appear on the left hand side of an assignment of
f
<
iR ,
iR
>
"I
B
\ '
B
eS
,k eR
L0 0P
) 0
e R,
)
2-25
5.
Loop ~n~einding
I
R
17
es
I
B
I
< \!
B H
I
i
eR
E.
CORRECTNESS ~en
we say that some program wa have just ~mitten is ~'correct~T, w ~ t
really mean?
We do not mean "comrect 'T in some absolute sense
in this case an ethical judgment.
do we
correctness is not
We s~,mply mean t_hat it does what we w.a~nt it to do.
In other words, it fits some ~re-arranged condition or relationship between £nput and output values.
If we later decide that we really wanted some other output, then the
program m~y no longer be "correct" for our purposes. Mathematically it would make no sense to define an absolute concept of correctness.
We define only a relative ooncept.
%he definition of pax~ial correctness is
designed to capture the idea that a program when fed with a proper input or inputs an input veotor satisfying some input criterion
-
will give, if and when it halts,
an output or outputs fulfilling some designated criterion.
-
2-26
In the next definitions, let us assume that variables, denoted by disjoint and that
into
DEFINITION A(X) and
Dn
into
{TRUE~F~SE}
Program
output variables, demoted by
Program
and output criterion
then
(P~l,a)
halts and
P
with domain
and
B(X,Z)
7
D .
n
input
with Let
X
and
A(~)
be a
a total function from
is p~tially correct with respect to input criterion if for all
B(~val(P,l,a))
(P,I)
A(X)
{TR~,FALSE}
B(X~Z)
halts, then
DEFINITION
m
is a scheme with
.
(P,I)
and output criterion (P~l,a)
and
is an interpretation of
total f~nction ~rom D n × Dm
X ,
I
P
K
in
D n , whenever
A(a) = TRUE
= TRUE .
is totally correct with respect to input criterion B(X,Z)
if for all
a
~u
D n , ~,~nenever A(a) = TT~u%
B(a,val(P,l,~)) = TRL~ .
If we omit the input criterion in discussing partial or total correctness it is understood that we take as input criterion the function which is TRUE on all of Dn
-
i.e., all possible input vectors are regarded as legitimate input.
There are several points to notice.
We have not said how functions
A
and
B
are to be described, although for all practical considerations this is exlrremely important.
Next, notice that
function, i.e.,
B(a)
B(X) = {~ I B(X,Z) = TRUT}
need not correspond to a
could have no m~mbers or more than one member for input
~ .
Thus there could be more than one function computed by programs totally correct for B
if
B(a,b) = B(a~b') = TRUE
for' b ~ b' . This situation might occur if, for
example, one wants the program to retrieve certain data but does not care about the order in which they are presented~ or the program is to find a person or object meeting certain specifications and if more than one "correct" object exists, no preference is expressed as to wl~ch should be selected. Partial correctness is &nalogous to weak equivalence in that it is a sort of fail-safe condition.
If
A(a) = FALSE
the input criterion is invalid and
a
presumably never occurs as input and so we make no claims as to the behavior of program
(P,I)
with "bad" input.
If
(P,I,K)
this is also regarded as a don't-care situation.
does not halt there is no output and There are fairly realistic
situations where we would be perfectly satisfied with this sort of "correctness" f~r example, in data security or protection systems. ev~pirical evidence
-
We presume
-
-
or have
that the system does not fail often or catastrophically and
wish to know that when it is ~ r k i n g and output is given (of whatever kind, for the output could be just internal transfer of data) then the result is "good" or, more likely, nothing "bad" bappens.
2-27
In other situations we might wish
-
or hope
-
for total correctness
that our program halts for all valid inputs and gives the right answer.
-
Total
correctness is analogous to total equivalence and only applies to programs that always halt over the subdomain of va]~id inputs and to candidates for specify at least one "good" output input
a
(with
b
(with
B(a,b) = TRUE )
B
which
for each "good"
A(a) = TRUE ).
Statements of either partial or of total correctness can be rendered meaningless by choice of
A
or
B .
partially correct for any if
B
A
For example, any program that always loops is and
B
while any program is partially correct for
B
is defined as TRUE everywhere, and any program is totally correct with
respect to
A
and
B
if
A
is defined as FALSE everywhere.
EXAMPLE Let
P
be the scheme in Example II-l.
and interpretation l(T)(n) = 0
I
over
if and only if
totally correct for
A
and
D
n = 0 . B
nonzero positive integers) and Now let but set
I'
where
A(n,m) = TRL~
B'((n~m),z) = TRUE
I
(P,I') n
if and only if
D
is the non~-~egative integers l(f)(n,m) = n+m
Then we have already seen tbmt
B((n~m) ,z) : TRUE
Then
if and only if
Suppose
l(g)(n) = n -" i ~
have the same domain as
I'(f)(n,m) = nm .
A'(n,m) = ~ U E
assigns
and
if and only if
if and only if
z : n
are integers with
(P,i) n
is
and
m
are
z = r~vL .
and the same values for
is totally correct for m
and
A'
T and
arid g B'
n _> i , m _> 2
where and
m
Appendix A contains a brief summary of some relevant ideas of satisfiability and validity of well-formed formulas in the predicate calculus.
Using these ideas
it gives a definition of partial and total correctness of a scheme with respect to a well-formed formula as output criterion.
The treatment is cursory and nonrigorous.
Readers who have not seen these ideas before should examine this appendix before we retmrn to the treatment of correctness and program verification in Chapter V, and finally conclude this treatment in Chapter VII.
3~1
III. A.
PROGRAM SCHEMES
-
BASIC PROPERTIES
HERBRAND OR FREE INTERPRETATIONS We have seen that there are schemes which halt on all finite interpretations
but not on some infinite interFretations.
Can we carry this any further?
APe there
any schemes which halt on all countable interpretations but diverge on some uncountable interpretations
-
say under interpretations with domain the real
n~s? The answer is no and the method of zroof provides us with a powerful technique for dealing with questions on the power of various models of schemes, with questions on t e r ~ a t i o n ~
equivalence and extension~ and with the justification of program
verification procedures. The basic idea is that if we are concerned with a problem such as "Does halt for all interpretations say,
f(x,g(y,z))
I ?"
(P,I)
it is quite irrelevant whether the value of,
is 2 or 3 or 4.75 or John Jones or anything else; what matters is
that there is some interpretation
I
under which its value is different from the
value of scme other term (although under other interpretations all values might coincide). value
If we know that under certain circumstances both
f(x,g(y,z))
considering the actual value of
f(x,g(y,z))
f
and
g
and
and
P'
halt with
under any particular interpretation.
If a certain sequence of outcomes of tests leads f(x,g(y,z))
P
, then we know that they have identical outputs, without
P'
with" g(f(x,x),y)
would lead to
P
and
P'
P
to halt with output
, then we know that some specification of
halting with different outcomes.
For these purposes one might as well consider just those interpretations in which a functional term denotes its own value. interpretation to be a formal language. string in this language.
We are considering the domain of an
We view, for example,
f(x,g(y,z))
as some
Notice that in effect we adopted this strategy when we
studied Example 11-3 to determine when that scheme diverged.
For a scheme
P
we can define a language
U(P)
(sometimes called a Herbrand
Universe) over the alphabet of all variables, constants and function letters appearing in
P
plus parentheses and commas as special symbols.
We define
U(P)
£nductively as foliows : i)
If
v
is a variable used in
P , v
is in
U(P) .
P , c
is in
U(P) .
2)
If
c
is a constant used in
3)
If
f
is an n-placed function letter used ~n
4)
U(P)
are in
U(P) , then
f(tl,... ,tn)
is in
P
and
t l,...,t n
U(P) .
is the smallest language satisfying (i), (2) and (3).
The interested reader can easily check that
U(P)
is a context-free language.
3-2
We can always extend
U(P)
to add any finite number of variables, constants
and function letters we choose subject to the rule of formation 3) above. are dealLng with two schemes U(P) = U(P') letters in
P
and
P'
If we
we shall always tacitly assume that
and that we have included all variables, constants, and function P
or
P' .
A free interpretation, loosely speaking, is a minimal one
-
one in which we
make as few decisions as possible in fulfilling the definition of an intergretation of
P .
In p~rticular, we establish no relations whatsoever among members of the
domain and establish no connections between objects, functions, and the values of functions on those objects, except t ~ s e r e q u J ~ e d
by formal identity.
Thus
f(x,g(y,z))
must be equal to itself and must be the result of applying
and
-
g(y,z)
but we assume that it is distinct from, say,
there is no relationship whatsoever between
DEF~TTION
7~ interpretation
Herbrand interpretation) of is
I
of a scheme
The domain of
2)
If
e
is a constant symbol,
3)
If
f
is ann-placed f~nction symfDol in
If
T
from
(U(P)) n
into
l(c) = c
U(P)
into
or
g(x,x) .
is a free interpretation (or
m~d if
x
is a variable,
P , n ~ i , then
l(f)
l(x) = x . is the
defined by
is an n-placed test letter in (U(P)) n
f(x,x)
x
U(P) .
I(f)(tl~...,t n) : f(tl,...,t n) 4)
P
and
to
and that
if:
i)
function from
I
P
g(y,z)
f
g(f(x,x),y))
for all P , then
tl,...,t n I(T)
im
U(P) .
is any function
{0,i} .
When we looked for an interpretation to make the scheme in Example 11-3 diverge, we constructed a free interpretation of that scheme under which it diverged.
In fact this was the correct procedtme, as the next series of results
we will show. We distinguish between a path through a scheme
P
(which is any sequence
of boxes, or addresses of insrmuotions which follows the arrows from the START box) and an execution sequence (which is the series of addresses of instruction actually followed during some computation under some interpretation).
We now
show that every execution sequence is the execution sequence of some computation under a free interpretation. Our first result yields a very useful technique for handling schemes.
Its
method of proof depends on ideas we shall need later when we provide justification for program verification procedures. some detail.
For this reason, we shall give the proof in
3-3
LEMMA 3. i
Every execution sequence is the execution sequence of a computation
under some free (Herbrand) interpretation. an interpretation , and computation
a
an input vector, and if
s
execution sequence for computation
s
and
(P,I*,X)
a
for
is a scheme,
I
such that
(P,I,[)
s
is an
halts with
halts with complete exeoution
val(P,I,a) = l(val(P,l*,~))(a)
obtained as the result of substituting val(P,l*,X)
I*
(P,I*,X) , and if
s , then
P
is an execution sequence of
(P,l,a) , the_re is a free interpretation
complete execution sequence sequence
In particular, if
X
i.e.,
val(P~l,a)
can be
in the formal fmnction
and then evaluating the functions according to
I .
PROOF We shall regard execution sequence s(1),s(2), ... ,s(i),... part of computation
s
as being defined by
the sequence of statements or instructions executed by the
(P~l,a)
denoted by
s . We shall assume that scheme
P
is
described in linear, form. We shall simultaneously construct the free interpretation computation letter of
U(P)
T
I*
and the
(P,I*,~) . As we go along we construct for each n-placed predicate two disjoint sets,
and define
Q(s,T~0)
I*(T)(~) = j
and
if
~
Q(s,T,I) , of n-tuples of members
is in
Q(s,T,j) .
The procedure for constructing the Q-sets can be roughly described thus. i)
Follow the execution sequence
s , recording the values of the
variables at each point but, instead of using an interpreted value of a function, use its name; thus 2)
Whenever k.
s(i)
f(x)
substitutes for
T(u I .... ,un)
r , ~
r ~ ~
and the current value of the list of variables, functional form, is Q(s,T,I)
if
l(f)(a) .
is a test or conditional transfer instruction:
~ : (tl,... ,tn) , each
s(i+l) = r
and place
{
in
tj
(Ul,... ,un) , recorded in in
Q(s,T,@)
U(P) , place if
~
in
s(i+l) = ~ .
3)
E~
4)
At the "end", if
all Q-sets empty. ~
has been placed in neither
Q(s,T,0)
nor
Q(s,T,I) ,
plaee ir in either one arbitrarily. We shall give a somew~mt more fox,hal and detailed explication of the procedure and its justification.
First~ as a point of notation, we shall compose interpreted
functions in the usual way.
Thus
I(f(g(x)))(a) = l(f)(l(g)(a))
I((f(xl),g(x2)))(al,a2)) = (I(f)(al),I(g)(a2)) •
and
3-4
Let
s(i)
(P,l,a)
and
(P,I*,~)
.
be the statement plus adcL~ess executed at step s*(i)
For each variable
before executing as step
i
s(i)
starts
-
u ,
and let
u ,
is defined at step
if
u
statement
T(u I ..... u n) , then
desire at the conclusion
i
i ,
is placed in
l(T)(val(ul,i),... ,val(un,i))
I*
val(u,i)
of computation
then
s(i) : s*(i)
and for each variable
val(u,i) : l(val*(u,i))([) at step
i
val*(u,i)
=
Thus at each step we shall have the relation we
s ,
and the
and
Q
s ~ , val(u,i)
and
sets will hold for all
finite and the computation halts. well-defined.
P~ther~
(if it halts) and the computation on the free interpretation
These relations between ,
.
during execution of a test
will exactly parallel the original computation on interpretation
val(u,i)
u
i.e., after step i-i and just
j = I*(T)(~) = I(T)(I(~)(~))
.
of
be the corresponding value in computation
that
Q(s~T,j)
i
be the value of variable
(P,l,a)
val*(u,i)
We show by induction on
T : (tl,... ,tn)
let
in computation
(P,I~'~,X) .
if
i
be the statement plus address executed at step
I .
val*(u,i) i
Further., the Q-sets and
and bei~een
whether or not I*
s
is
always exist and are
However, the procedure we are about to define is an algorithm and
actually halts and constructs the Q-sets only if
s
is finite.
We proceed by induction as follows. i)
Initially~ val*(xj,l)
s(1) = s*(1) = i = Xj "
All the sets
Clearly
Q(s,T,O)
and
and for each input variable l(val*(xj,l))(a~ Q(s,T,I)
xj ,
= aj .
are empty initially.
Suppose that we have carried out our program successfully up to the execution of statement
s(i)
in
following possibilities
2)
s(i)
for
is the assignment k.
and
s*(i) = s(i)
in
(P,I*,X)
.
There are the
s(i) .
statement
y ÷ f(u I, ....,un)
Then val*(u,i+l) for
(P,l,a)
v ~ y
unchanged. val(y,i+l)
= f(val*(Ul,i),...,val*(un,i))
and
val*(v,i+l)
= val*(v,i)
by definition of a computation, and the va_~ious Q-sets are left Since = l(f)(val(ul,i) ,... ~val(un,i)) = I(f) (l(val* (uI ,i) ) (~) ,... ,l(val*(u n ,i) ) (~)) = l(f(val* (ul,i),... ,val* (un,i) ) (a) = l(val* (y,i+l)) (a)
we have the desired relation for v ~ y .
Under any interpretation,
s(i+l) = s'*(l ~" "+i) : k + l .
y . if
Clearly the situation is ~Lcha~nged for s(i) = s*(i) = k ,
we must have
3-5
2' )
s(i)
is the assignment statement k.
y
÷
for variable for
v ~ y
u u .
and
Then
val*(y~i+l) : val*(u,i)
s*(i+l) = s(i+l) = k+l ,
and
val*(v,i+l) : val*(v,i)
and we leave the Q-sets unchanged.
It should be obvious that we still maintain the desired relations. 2")
s(i)
is the assignment statement k.
y
÷
e
for a constmnt v ~ y
c .
~nen
val*(y,i+l) = c
l(c)(a) = I(val*(y~i+l))(~) s*(i+l) = s(i+l) = k+l 3)
s(i)
an~d val*(v,i+l) = val{~'(v,i) for
and we leave the various Q-sets umohanged. ~ we
Since
val(y,i+l) = l(c) =
have the desired relation for
y .
and we maintain the desired relations for
Clearly
v ~ y .
is the test statement k.
T(Ul,...,u n)
r , ~
and
r ~
There are two subcases. (a)
If
s(i+l)
is the stateme~t with address
the n-tuple
r ,
then we place in
Q(s,T,I)
and define for interpretation
(val*(Ul,i) ,... ,val*(un,i))
I* : l*(T)(val*(Ul,i) ,... ,val~'~(Un,i)) = i In this case, obviously
s*(i+l) = r = s(i+l) ,
computation under
The fact that
I* .
by definition of a
s(i+l) : r
91Lplies~ by the
definition of a computation: i = I(T) (val(ul,i),... ,val(un,i))
= I(T) (I (val* (u I ,i) ) (a) ..... I (val* (un ,i) ) (a)) = l(T)(l((val*(Ul,i),... ,val*(un,i))([) as desired, taking For each variable corm~eting (b)
If
s(i+l)
Q(s,T,0)
~ = (val*(Ul,i),...,val*(Un,i)) u ,
val*(u,i+l) = val*(u,i)
val*(u,i+l)
and
val(u,i+l)
is the statement with address the n-tuple
for interpretation
•
so the equation
still holds. ~ ,
then we place in
(val*(Ul,i) ,... ,val*(un,i))
and define
I* :
I*(T)(val*(Ul,i),...,val*(un,i)) In this case~ obviously
= 0 .
s*(i+l) = ~ = s(i+l) .
The rest of the argument can be pursued as in (a). 4)
s(i)
is the forced transfer k.
T(Ul,...,u n)
We make no cbmnges in are likewise unchanged. s*(i+l) = s(i+l) = r .
r , r Q(s,T,0)
or
Q(s,T,I)
and all values of the variables
Under any interpretation we must have
3-6
5)
s(i)
is the STOP statement.
Then
s
and
s*
are completed execution sequences.
Under any interpretation
Lhe computation must halt at this point and the values of the variables are unchanged.
In particular,
val(P,l,a)
if tlne output variables are
z I ,... ,zn
then
= (val(zl,i),...,val(zn,i)) : (l(val*(Zl,i))(a),... ,l(val*(zn,i))(a)) = l(val(P,l*,X))
(a)
.
Now case 5) tells us that if (P,l,a)
converges, then
sequence
s* = s
s
(P,I*,X)
is a complete finite execution sequence and so also converges with complete terminated execution
and the outputs have the desired relations,
i.e.,
val(P,I,a)
=
l(val (P~ I* ,X) ) (a) . Let is in
T
be an n-placed predicate letter, and let
Q(s,T,0)
some step
i
or
of
Q(s,T,l)
s ,
or
~
be in
[U(P)] n .
Then
if and only if either it is placed there by 3) during it is never placed in
Q(s,T,0)
U
application of 3), in T,hich case it is arbitrarily placed in
Q(s,T,l)
Q(s,T,0)
.
by any -Notice that
under this convention the Q-sets are always well-defined but the placement of Q(s,T,0)
or
only if
s
Q(s,T,l)
is algorithmic
-
~
done effectively by our procedure
in
-
is finite.
It remains only to verify that particular that the definition of need only verify that if e (U(P)) n ,
then
must show that
~
~
is a legitimate interpretation is consistent for each test
is an n-placed predicate letter in
l*(T)({)
Q(s,T,0)
Now we place
T
I* l*(T)
P
-
in
T .
Thus we
and
is uniquely defined as a value in
{0,i} .
So we
Q(s,T,l) : ~ .
in, say,
Q(s,T,0)
only in two circumstances.
We can assign
it arbitrarily at the "end" in which case we place it in just one of these sets. Or we place it in placed
~
in
m : s(i+l)
Q(s,T,O)
and
this point: val(uk,i)
Q(s,T,O)
because
val*(uk,i)
i
s(i)
: tk ,
of the computation. was the test
i -< k -< n ,
0 : l*(T)(t-) = l(T)(I(T)(a))
= I(val*(Uk,i))(a)
j , then
at step
s(j)
val*(Vk,J)
= z(m)(I(T)(~))
= tk
T(Ul, .... u n)
T = (tl,...,tn)
.
If we placed
k' . for
~
T(Vl,...,v n) I -< k £ n .
in
Q(s,T,l)
r',m'
i
we
r,m
Then we had at
= l(T)(val(ul,i),...,val(Un,i))
i s k -< n .
must have been some test
and further we must have
i = I*(T)(T)
,
k.
Suppose at
,
and at step s(j+l) = r'
Then by construction:
= !(T)(val(vl,J) .... ,val(vn,J) )
= I(T)(l(val*(Vl, j))(a),... ,l(val*(Vn, j))(a)) = l(T)(l(tl)(a),... ,l(tn)(a--)) = l(T) (l(val*(u l,i) ) (a) .... ,l(val*(Un,i) ) (a)) = l(T) (val(Ul,i) ,... ,val(Un,i)) =
0
which is a contradiction, and hence
l(T)
since
I
is supposed to be a legitimate interpretation
must be single valued.
3-7
Thus we ~ast have
Q(s,T,0) ~
Q(s,T,I) = @
for each test
T
a legitlmaZe fr~e interpretation with the desired properties,
and so
I*
is
m
We can rephrase the previous lemma to provide in effect a syntactic definition of what it romans for a path to be an. execution sequence. s
from START through a scheme
for each test following
T
s
as before.
and place
{
If we are given aroy path
P , we can build the sets
Q(s,T,0)
We construct the various values in
Q(s,T,j)
and
val*(u,j )
when demanded by the algorithm, step (3)~
but do not worry as to whether this is a consistent definition.
As before, this is
an actual construction only for
s
DEFINITION
from ST~a~T is consistent if for each test
Q(@,T,0)
N
A path sequence
s
Q(s,T,I) as before
finite.
T
Q(s,T,I) = @ .
COROLLa~RY 3.2
A path in
P
from ST~_RT is an execution sequence for
P
if and
only if it is consistent.
We can carry on the algorithm simultaneously for paths s2
in
P2 ~
DEFINITION sn
"'" ' and
sn
in
P
A set of paths,
sI
in scheme
in scheme
Pn '
appearing in any
Then ~
sI
in
PI '
can extend our definition:
PI '
s2
in scheme
P2 '
"'" '
each starting from START, is consistent if for any test
T
Pi ~
m
m
( ~ Q(si,T,O)) i=l
S
( U Q(si,T,I)) i=l
=
¢
EXAMPLE Let us return once again to Example 11-3, and test two paths for consistency using our algorithm.
As we did before, we only put down the names of the boxes with
assignment statements~ this uniquely determines each path.
3-8
Path s = A
B C D D C STOP
We find that BOX
s forces us to make the following assignments: Value of U(P) tested Q-set placement
A
f(xI)
Q(s,T,0)
B
f2(xl)
Q(s,T,I)
C
f3(xI)
Q(s,T,0)
D
f4(xI)
Q(s,T,I)
f2(xI)
Q(s,T,I)
fS(xl)
Q(s,T,I)
f3(xI)
Q(s,T,0)
f6(xI)
Q(s,T,I)
D
C STOP
We made only assignments Q(s,T,0) = {f(xl),f3(xl)} and Q(s,T,I) = {f2(xl),f4(xl),f5(xl),f6(xl)} . Since Q(s,T,0) ~ Q(s,T,I) = @ , the path is consistent. It corresponds, for example, to free interpretation I* with l*(T)(fn(xl )) = 0 for n = i or n = 3 and l*(T)(fn(xl )) = i elsewhere. Notice that since only values of f~(xI) through n = 6 were computed, the value of I*(T) elsewhere is irrelevant. Path s' = A
B C D D C D C STOP
We find that s' forces the following assignments: BOX Value of U(P) tested Q-set placement
A
f(xl)
Q(sT T,0)
B
f2(xl)
Q(s',T,I)
c
f3(×l)
Q(s',T,0)
D
f4(xl)
Q(s',T~I)
f2(xI)
Q(s',T,I)<
fS(xI)
Q(s',T,I)~
f3(xI)
Q(s',T,0) I
C
f6(xI)
Q(sI,T,0) J I N C O N S I S I I N T
D
f7(xl)
Q(s',T,I)/
C
fa(xl)
Q(s',T,I)
D
STOP
@%¢&@@
3-9
We notice tbmt and then to
f'(x I)
was first assigned to
Q(s',T,0)
in going fr~n
D
Q(s',T,I)
to
in going from. D
C . This is inconsistent.
to
interDretation can make both decisions mnd so no computation can follow path Hence
s'
D
No s' .
is a path which is not an execution sequence.
Since any execution sequence must be an execution sequence under some free interpretation, any infinite execution sequence must be an ~ i n i t e sequence under some free interpretation.
So if
P
execution
fails to halt for some inter-
pretation and some input, there is a free interpretation under which it fails to halt.
Thus we can characterize the condition of always b~Iting in terms of
consistent paths or in terms oS 9mlt£ng under all free interpretations.
THEOREM 3.3 path through
(i) P (2)
A scheme
P
is always halting if and only if every consistent
from START is finite. A scheme
P
is always halting if and only if it halts
everywhere under all free interpretations.
We can clnaraeterize strong equivalence in a s J ~ l a r fashion. consistent path (execution sequence) through (execution sequence) through
P'
our algorithm simultaneously to of paths
so for all tests
((Q(s,T,0) U
Q(s',T,0)) N
a free interpretation
Is,s,
before.
For n-place test
Q(~,T,0) U Q(s',T,0)
THEOREM 3.4
and
and
and
s'
and if
{s,s'}
Q(s',T,I)) = ¢
under which
P
and
~
in
s
is a
is a consistent set
P
and
-
then we can construct
follows execution sequence U(P) : U(P')
if
P'
F
is in
Q(s,T,I) U
with the same list
s
and
P'
as discussed
[U(P)] n , Is,s,(T)(~) = 0
Is,s,(~) : i
For two schemes
If
is a consistent path
T ,
s' . Namely we assume T
s'
(each beginning at START of course) we can apply s
(Q(s,T,I) U
follows execution sequence
P
~
if
~
is in
Q(s',T,I) .
of input
variables the following statements are equivalent: (i)
P
is strongly equivalent to
P' .
(2)
For every free interpretation
(3)
For all consistent pairs of sequences
I ,
val(P~Is,sT,X) = val(Pi,ls,s~X)
(P,I) s
is strongly equivalent to tPrough
P
and
s'
through
(P',I) . P' ,
whenever either is defined.
PROOF By the definition of strong equivalence, implies (3) since
Is,s,
(I) implies (2).
is a particular free interpretation.
Evidently (2)
3-i0
Suppose (8) holds.
Consider computations s
through
is a consistent pair.
P' ~ clearly
is finite.
{s,s'}
through
This is true if and only if
P
(P,l,a)
first corresponds to some path
and
(P':I,~) . If the
and the other to some path
(P,I,~)
s'
Suppose one path, say
converges.
s
But then by (3) and
lemma 3.1:
val(P,l,a) : l(val(P,Is,s,,X))(~) : l(val(P',Is,s,,X))(a) : val(P'~I,~)
Similarly, if
(P' ,l~a)
converges~ so does
Hence for every interpretation so
P
I ,
is strongly equivalent to
(P,!,~)
(P,I)
P' .
mud the outputs are the starve.
is strongly equivalent to
(P',I)
a~d
•
SimJ_lar results can be shown for other definitions of equivalence.
T H E O ~ M 3.5 (i)
P
(2)
P
and
I ,
P
P
(P' ,I) .
is totally equivalent to
P'
(P' ,I) .
are recursively equivalent if end only if for every recursive free I ,
is an extension of
(P,I)
P' '
are totally equivale~t if and only if for every free interpretation
interpretation (4)
and
is weakly equivalent to
P'
(P,I)
and
P
are weakly equivalent if and only if for every free interpretation
(P,I)
and
I , (3)
For, schemes P'
(P,I) P'
is e.n extension of
and
(P' ,I)
are strongly equivalent.
if and only if for every free interpretation
I
(P~ ~I) .
Thus free interpretations will be one of our primary tools for handling such questions.
Notice that in a free interpretation the domain is recursive and the
functions assigned to function letters are reeursive but the £nterpretations of the predicate letters may not be recursive.
B.
~
SCHEMES AND ALWAYS HALTING SCHEMES The next result, on always halting schemes, requires use of what has been
variously known as K'6nig's L ~ m m or the Fan Lamma or the Infinity Lemma.
KONIG'S LEHMA (INFINITY LEHMA, FAN L~EHMA) If
T
is a finitely branching tree (each node is directly co~nected to finitely
many sons) and T
T
is infinite, then there exists at least one infinite path through
starting at the root of
T .
3-ii
This lemma is nonconstructive.
It only says that there is an Lnfinite path,
but gives no formula or algorithm for constructing the path.
Whether the proof can
be made constructive in ~n individual case depends on the inZLnite tree T
is specified.
An infinite path in
T
of nodes,
n0,nl,... ,ni,.,.
(2)
is a son (direct descendant) of
ni+ I
such that
(i)
nO ni
is the initial node for each
existence of this path consists in showing that given lying in this path. nO one
m0j
is infinite~ let
mooted at
ni
is infinite.
nI
{m01,...,m0k0} be this son,
Then
ni
and how
~nd
i . The proof of the
n i , there is an
The argument starts by saying that since
has some finite set of sons,
T
can be described by an infinite sequence
T
ni+ I
is infinite and
, the subtree rooted at least
m0j . At each step, the subtree
has finitely many sons,
{rail,,.. ,mik .} , i ni+ I be that son.
and the su~tree rooted at one son must be infir~ite; we let
To make this proof constructive, the names of nodes should form a recursive set, there should be a total recursive function sons of node
f
such that
n , and the predicate "l~e subtree rooted at
f(n)
lists all the
is
infinite" should
n
be total recursive. Let
P
be any program sch~ne.
Using our algorithm for testing whether a path
is an execution sequence, we const~ct a tree
T(P)
sequences for
The tree
infinite ; o ~ if
P
P
under free interpretations.
main result on the subject will say that
is always halting.
sequences. T(P)
of all possible execution
At level
n
The nodes of
T(P)
T(P) T(P)
may be finite or is finite if and only
are labelled with execution
(declaring the root or initial node to be at level I)
will have exactly one node for each execution sequence of length
containing
n
n
(i.e.
statements) ~nd each node will be labelled with the corresponding
execution sequence. The root or initial node will be labelled by the unique execution sequence of length l, containing just the initial or start statement. is labelled with execution sequence exactly those nodes such that
s ,
q
at level
it is directly connected to (has as sons)
labelled with execution sequences
T(P)
is a proper tree.
s'
of length
An execution sequence
is consistent with exactly one execution sequence
namely, if
s
consists of statements
(kl,k 2 ..... kn_ I) .
~ne tr~ee T(P)
sequence of length
n
for statement
]% .
and
s'
(kl,k 2,...,k n) , then
is finite branching for if
s = (kl,... ,kn)
s
n+l
of length
of length s' s
n-i
is is ~n execution
we need only consider the possibilities
If it is a STOP statement,
s
is a complete execution sequence
ard has no consistent extensions so it labels a node with no sons.
If
kn
assignment statement, or a forced transfer, there is exactly one statement such tlmt .
If
n
{ s, s ']~ is a consistent pair.
Notice that n -> 2
q'
If node
(kl,k2,... ,kn,kn+ I) kn
is an kn+ I
is consistent, namely the unique statement following
is a conditional transfer (test) then~ since our tests are binar~y,
3-12
there are at most two statements
kn+ I
s ;
s
at least one must so extend
valid.
and
kn+l'
which can consistently extend
since either the 0 or the i branch must be
In this case the node labelled
s
has either i or 2 sons.
So
T(P)
is
certainly finite branching. If
T(P)
is finite then there are only finitely many possible execution
sequences for Then
P
P
is always halting and there is a uniform bound
computation in
If
and a uniform bour~ on the length of any execution sequence exists.
T(P)
N
on the length of any
P .
is infinite, then, sinee it is finite branching, there must be an
infinite path through
T(P) .
Since node
execution sequence of length
i
i
in such a path is labelled with an
and the sequence labelling node
consistent extension labelling node
i+l
infinite execution sequence of
Hence
P .
P
is not a3~ways halting.
it is infinite and so
P
P
has at least one infinite execution
not always halting.
THEOREM 3.6
If
N
P , T(P)
T(P)
So if
T(P)
is
has infinitely many levels
If there is no uniform boumd
has infg~itely many levels and
N
P
is
Tnus we have established:
P
any interpretation
If the tree
is not always halting.
on the length of computations in
~ms a
in this path, the path ~:st represent an
sequence and hence at least one computation that divem~ges. infinite,
i
is always halting, there is a uniform bound I
and any input
a ,
computation
(P,I,~)
N
such that for
contains at most
steps.
This result is "partially constmuctible" in the sense that if be finite, then tree T(P)
from
P
P
is known to
P
is an
However, as we shall see later, there is no way of deciding
is always h~itLng.
We can construct given
T(P)
a tree T*(P)
-
some sense can be considered equivalent to scheme T(P)
P
is known to be finite and we can actually construct
since it is decidable whether a given finite path in
execution sequence. whether
T(P)
is labelled with execution sequence
finite or infLnite P .
If node
s = (kl~...,k)
a label containing the statement or instruction named by
, replace label k
will have as labels the instructions of
gives the proper sequence of statements executed by an appropriate P . We can almost consider P .
If a node
has t-~o branches to nodes
ql
q and
simply label the branches in ql
T' (P)
q2
s
in with
to be a scheme strongly T(u I~... ,un)
labelled with statements T(u I,... ,un)
n
ordered so that a path thnough
is now labelled with a test
must correspond to the 0 branch from
only one son
T' (P)
which in
Thus our new tree
T' (P)
equivalent to
-
on level
T' (P)
computation in
P
q
and one with
rI t
and
r 2 , one
to the 1 bra~nch;
by 0 and 1 in appropriate fashion,
there is only one consistent outcome to the test
and
if
q
has
T(Ul~... run )
at
3-13
this point. from
q
rooted at T' (P)
We can either treat this as a forced transfer and label the branch
to
ql ql
by both 0 and i, or else "pinch out" node becom~ the subtree rooted at
q
q . The tree
and let the subtree
9~':(P) formed from
by this process oan be regarded as a scheme strongly equivalent to It is evident that if
But if
T(P)
T(P)
is finite, we can carry out this process and now
program scheme strongly equivalent to
DEFINITION
A scheme
P
P ;
T*(P)
T*(P) .
really is a
its graph is a tree.
is a tree program scheme if its graph is a tree.
COROLLARY 3.7
Any always halting scheme
program scheme
T*(P)
oonstrueted from
P .
is infinite we cannot really "constr~ct"
and if
P
P
is totally equivalent to some tree
is known to be always halting,
T*(P)
can be
P .
EXAMPLE Consider the program schen~
P
STOP boxes, all statement boxes in
in Example III-I. P
Except for the START and
l~ave been ~%%med by integers for convenience.
On the second page of Example llI-l, we display the execution sequence tree T(P) .
Statements are named by the appropriate numbers.
Thus the only execution
sequence of length i consists of just the START statement, the only one of length 2 consists of START followed by statement i, the only one of length 3 consists of (START,I,2) while there are two execution sequences of length 7" and
(START,1,2,3,4,5 ,STOP)..
For convenience the diagram of
(START,!,2,3,4,5,6)
T(P)
also shows the
labels 0 and i on the appropriate branches from test statements and also exhibits the values of
Yl
and
Y2
when either is updated.
example, when we return to the test in box 6 in path are applying test applying test
T
T to
to
Yl = f(x)
Y2 = f(x)
This helps show that, for (START,I,2,3,4,5,6,7,6)
, we
while earlier in this path we took branch i on
in box 3; hence we are now constrained to follow
branch i again. Following
T(P)
through in detail we see that it is finite arid there are 4
possible complete execution sequences: (START,I,2,3,4,5,6,8,3,STOP) computation in
P
, and
(START,I,2~3,STOP)
,
(START,I,2,3,4,5,STOP)
(START,I,2,3,4,5,6,7,6,8,3,STOP)
. Thus no
can take mope than 12 steps.
On the next page of Example III-i, we construct
T' (P)
from
T(P)
by
substituting for the full list of each execution sequence the statement named in the last step
of the sequence.
Finally we build
T*(P)
from
T' (P)
by eliminating single exit test statements
whioh obviously eannot affect the outcome of the computations.
3-14
EXAMPLE III-i
ALWAYS HALTING PROGRAM SCHEME
P
°
)
START
i Yl ÷ x
2 Y2 ÷ f ( x )
\
4 ,
STOP
Y2 ÷ f(Y2 )
~f
<
STOP
/ l
Yl ÷ f(Yl )
I
\ Yl ÷ f(Yl )
[__
3-15
EXAMPLE III-i
CO~%ED THE EXECUTION SEQUENCE TREE T(P) (with values added at assignments) (START)
1 I (START,I,2) I (START,l)
(START,1,2,3,ST@?)
(x,A) (x,f(x))
(x,f2(x))
(START, 1,2,3,4)
l (START ,i ,2,3,4,5 ,STOP)
(START, i ,2,3,4,5,6)
(START,I, 2,3,4,5,6,8 )
I °l
(START ,i ,2,3,4,5,6,7 )
(f(x),f2(x))
(START, 1,2,3,4,5,6,8,3 )
(START,1,2,3,4,5,6,7,6)
(STriCT,i, 2,3,4,6,8,3 ,STOP)
(START ,i ~2,3,4,5,6,7,6,8 ) (f2(x),f2(x))
(START, i ,2,3,4,5,6,7,6,8,3 ) 0 (START ,i ,2 ~3,4,5 ,G ,7,6,8,3 ,STOP)
3-18
EXA]MPLE III-i
c@~r~IIED THE STATEMENT LABELLED EXECtFfION SEQUENCE TREE T'(P)
START
Yl + X
Y2 + f(x)
T(y2 )
STOP
Y2 ] f(Y2)
T(Y 2 )
STOP
T(YI)
Yl + f(Yl)
h
f(YP
I
T(Y 2)
T(Yl)
qo
STOP
+
~L h
÷ f(YP
L
T(z 2)
°E
STOP
3-17
EXAMPLE III-i
CONCLUDED TREE PROGRAM SCHEME T*(P) STRONGLY EQUIVALENT TO P
,
STOP
START
)
Y2 ÷ f(Y2)
,\ IYl
+ f (yl)
Yl + f(Yl)
I Yl
÷ f(Yl)I
$
3 -18
We can easily test tree program schemes for strong equivalence. P'
For if
P
and
are tree program schemes, there are at most finitely many paths through these
two schemes and hence finitely many consistent pairs consistent path through
P
consistent path through
P'
find all paths
s
through
{s~s'}
and hence an execution sequence in P
and
s'
through
Is,s,
{s,s'}
is a s'
is a
P' . So, let us {s,s'}
we
for consistency.
If
is a consistent pa~r, we construct the corresponding free interpretation and follow the paths
whether
s and
P' . For each pair
can construct the Q-sets as in the algorithm and test {s,s'}
where
and hence an execution sequence in. P
s
and
s'
(which of course are finite) and see
val(P,Is,s,,X) = val(P',Is,s,,X) .
Schemes
P
and
P'
are strongly
equivalent if and only if this equation holds for every consistent pair
s,s'
So we have sho~:
THEOREM 3.8
Strong equivalence is decidable for tree program schemes.
A scheme which is known to be always halting can be effectively transformed into a strongly equivalent tree program scheme.
COROLLARY 3.9
C.
Hence:
Strong equivalence is decidable for always halting program schemes.
~REE SCHEMES A useful property for schemes to have is "freeness".
DEFI}.~ION
A program scheme
P
is free if every path from ST~XI' is an
execution sequence.
Using our results concerning consistent paths, we can given alternative defLnitions of free schemes.
THEOREM 3.10 (I) (2)
P
The following statements regarding a program scheme
P
are equivalent:
is free.
For each path
s
through
P
and each predicate
T
in
P
Q(s,T,0) ¢~ Q(s,T,I) : ~ . (3)
Under any free interpretation same n-placed test
T
I , the computation
(P,I,X)
twice to the same n-tuple of members of
never applies the U(P) .
3-19
EXAMPLES : The flowcharts A and B in Example I-i are not free. from
P(y) = FbJ~SE through
P(u) = FALSE
retests
so the same path must be followed afterwards. around
P(u)
P(y)
In flowchart A the path without updating
y
and
Flowchart B contains the tight loop
which is not free.
An always looping scheme is one with no consistent paths from START to STOP, i.e. a scheme all of ~nose computations diverge.
A simple example is:
START
\
'
I
T~e scheme above is not free.
If we remove the requirement tbmt a scheme contain at
least one STOP statement, there are free always looping schemes such as:
START
If we use:
3-20
We usually assume that this is to be replaced by a "free" subseheme such as:
÷
,,,,f(x)
Flowchart C in Example 1-3 is free. of
u
Every time
P(u)
is applied, the value
in a free interpretation has been changed to a new one.
traces out the loop P(fn(x)) = TRUE
n
but
times,
n > O ,
P(fk(x)) = FALSE
the path which
corresponds to a free interpretation with for
0 -< k -< n-i .
For similar reasons,
the flowchart of Example II-i is clearly free. We have already seen that the flowchart of Example 11-3 is not free saw that for example path The flowchart
P
START
tests.
B
C
D
D
C
D
C
STOP
-
we
was inconsistent.
in Example III-i is obviously not free since it contains
infinite paths but no i n f ~ t e tree program scheme
A
T*(P)
execution sequence.
However the strongly equivalent
is clearly free since we ~mve eliminated the useless
This situation is general as we now observe.
Following the usual arguments for finite state graphs, we can determ/ne whether
P
contains any infinite path.
If
P
has
n
statements, clearly
contains a loop if and only if it contains a path with
n+l
P
or more statements.
A free scheme always halts if and only if its graph contains no loops since in a i~ee scheme a loop corresponds to an infinite path and hence to an infinite execution sequence.
THEOREM 3.11
For free progrmn schemes (i.e. if a "birdie" tells you a scheme is
free) it is decidable whethen
P
is always inalting.
Now our construction of tree scheme T(P)
~'~(P) from
happens to be finite, be organized so that
elimJJmte single exit tests.
THEOREM 3.12
If
P
T*(P)
P
and
T(P)
is free
-
could, if we merely
Hence we again show:
is an always halting scheme we can construct a strongly
equivalent free tree program scheme.
I~HEOP~ 3.13
If
P
is a tree scheme we can construct a strongly equivalent
free tree program scheme.
3-22
We have seen examples of schemes which are not free. are not even strongly equivalent to any free scheme. Example 111-2.
There are schemes which
Such a scheme appears in
Intuitively speaking, Example 111-2 cannot be "freed" because we
must use the two tests as a clock, to see how long it takes to find P(fn(x)) = 0
and then to run through this cycle again and update
fn(x) x
to
with gnfn(x) .
To justify this statement formally, we need some additional notation and results.
DEFINITION in
P
A program scheme
P
is monadic if all functions and tests appearing
are monadic (1-placed).
When dealing with monadic program schemes we oftm~ omit the parentheses in ~ginctional descriptions, so e.g.
f(g(f(f(x))))
is written as
fgffx .
This is
always done in defining value languages.
DEFINITION
For' a monadic scheme
la~$e
P
of
L(P)
where each
P
with a single output variable, the value
is the language
:
{val(P,I,X)
val(P,l~X)
II
free interpretation,
(P,I,~)
halts}
is written ~/thout parentheses.
We shall return to the concept of value languages later in our study of monadie reeursion schemes~ this concept is a powerful tool in studying the relative power of monadic program schemes and ~nnadic recursion schemes.
For the present we need only
the following simple fact.
THEOREM 3.14
Let
the value language
P
be a monadie free scheme with one output variable
L(P)
z . Then
is regular.
PROOF We can assume that
P
is in linear form, that
z
is not an input or a
program variable and that no input variable is a program variable. assum~ that all statements are of the forms:
where
c
k.
U ÷ f(u)
k.
u+v
k.
U÷C
k.
T(u)
r,s
is a constant and
u
and
v
are variables.
Also we can
3-22
Since there is only one output variable~
z , and all functions are monadic,
at any given time at most one variable in the computation under a free interpretation can contain a value which ultimately affects the final output value. Since
P
is free, all paths are execution sequences under some free interpretation.
Thus if we concentrate on just the contents of that register which we believe will ultimately be transferred to
z ~
into following a "bad" path.
If
the current value of
v ,
and ignore other values, we cannot be trapped v
is our "guessed" variable and we have stored
that suffices.
All continuations of the etu~rent path
must be valid (consistent). We slnall construct a right linear context-free gr&mmar This suffices to show that f~_ms
(k,O)
and
(k,v)
L(P) where
is resalar. k
G
to generate
The nontemminals of
is an address and
v
G
L(P) .
are of the
is a variable.
~ne
presence of nonterminal
(k,O)
currently in address
but have not yet started computing the ultimate output
The presence of address
k
k
(k,v)
indicates that we are simulating a computation
indicates that we are simulating a computation currently in
and have guessed that the contents of
v
will ultAmately be transformed
into the desired output. Let i be the start address of and
G
÷
Then the initial symbol of
(l,x)x
for each input variable
k.
G
P .
contains a production
(i,0)
T(u)
x .
For any statement
r,s
contains productions
(k,0)
÷
(r,O)
(k,0)
÷
(s,0)
(k,u)
+
(r,u)
(k,u)
+
(s,u)
for every variable
k.
u
u .
÷
z .
f(u)
FoP any statement
G
is
(i,0)
3-23
G
contain, s
(k,0)
+
(k+l,0)
(k,u)
÷
(k+l,u)f
(k,v)
÷
(k+l,v)
for every variable
k.
where
y
For any statemeat
u
+
y
is a variable
contains
G
(k,O)
÷
(k+l,O)
(k,y)
+
(k+l,u)
(k,v)
÷
(k+l,v)
for every variable
v ~ u .
k°
where
e
u
+
G
(k,0)
+
(k+l,0)
(k,0)
+
(k+l,u)e
(k,v)
÷
(k+l,v)
k.
G
c
is a constant,
for every variable
For any statement
V
~
U
•
contains
Finally, for any statement
STOP
contains
(k,z)
where
e
+
e
is the empty str~ng
1~Ks construction works because interpretations. path
-
G
is free and we are dealing with free
When we come to a test we can nondeterministically select either
s~me free interpretation will take either p~th.
any free interpretation must be either
fl...fnX
else
In the fir,st ease,
fl...fne
for some constant
occur by the production
e .
(i,0) ÷ (l,x)x
Yhe final output under
for some input variable G
x
or
guesses this will
and records the fact that the grammar is
3-24
generating values currently stored in nonterminals
(k,0)
x .
In the second case,
and if it eveP encounters
k.
u ÷ c
G
decide that the ultimate output is started here and so use mule When statement produced
k.
(k,Z)fl...fnX
STOP or
the proper output in place.
earlier.
uses
can nondeterministically (k,0) ÷ (k+l,u)c .
is reached, a series of right guesses will have (k,Z)fl...fne
and the
(k,z)
is now erased, leaving
Otherwise, the derivation blocks at this point if not
1
1~nis result allows us to conclude that the scheme strongly equivalent to any free scheme since
P
in Example 111-2 is not
L(P) = {gnfnx ] n _> i}
is not
regular. Unfort~nately, "freeness" is not itself a decidable property. first umdecidability result we encounter.
This is the
The proof employs the Post
Correspondence Problem.
DEFINITION
Let
~
be a vocabulary_ and let
be two ordered lists of [+
n
nonempty members of
The Post Correspondence Problem for
m ~ i ,
il,...,i
si I
in
{l,...,n}
. . ~i . . m
A : (el,...,~n)
and
~+ , n ~ I ,
(A:B)
B = (Bl,...,@n)
each
~i '
Bi
in
has a solution if there exists
such tb]t
@i± ~
"'"
Bi m
An alternative formulation is that given two finite code sets, the Post Correspondence Problem inquires whether any word is coded alike in both codes.
We use the following well-known result due to Post:
THEOREH 3.15
For
#~ >- 2 ,
it is undecidable whether the Post Correspondence
Problem has a solution.
Now we want to show that given a pair alphabet, say P(A,B)
(A,B)
of lists over a two symbol
{a,b} , we can effectively construct a scheme
is free if ar~ only if the Correspondence Problem for
solution.
It will then follow that freeness is us.decidable.
P(A,B) (A,B)
such tb~t has NO
For it if were
decidable whether a scheme is free~ then we could decide the Correspondence Probl~m as follows: whether solution
Given
P(A,B) -
(A,B) ,
is free; if
construct HA,B)
P(A,B) , turn on the machine which decides is free print the answer NO
and otherwise print the answer YES
-
(A,B)
-
(A,B)
has a solution.
has no
3-25
EXAMPLE 111-2 A SCHEME NOT STRONGLY EQUIVALF~NT TO ANY FREE PROGRAM SCHEME
START )
u
÷
f(x)
v
+
f(x)
"
J< 0
1
f(u)
i
z +
g(u)
v u
÷ +
f(v) g(u)
1
3-26
The K m ~
idea is as follows.
For convenience let
±no distinct monadic function letters so functions. example,
a(x)
abaa(x)
instead of
l(a)(l(b)(l(a)(l(a)(x)))) of
a
and
b
a(b(a(a(x))))
.
For each sequence
built up as
a ....
6i (x)
Clearly
and all values of
b(x)
b
be regarded as
are formally distinct
. We also let interpreted functions
Is
e. (x)
of
l(abaa)(x)
l(wl)(x) : l(w2)(x) x
s = ( i , . . . , i I)
he a free interpretation
@il . . .
&nd
We shall again omit parentheses in composing functions, and use, for
compose in the usual way so that, for example,
I
and
a
P(A,B)
i~ ~nd only if
T
for all interpretations
wI = w 2 .
of integers from
{l,...,n}
,
there will
under which the value of variable
and the value of variable
and t h e n a t e s t
=
is applied to
u
v
u
is
is built up as
and
v
in s u c c e s s i o n .
If the
m
Correspondence Problem for
@im
ai I ~id
s = (in,... ,il)
val(u) = ell
~
(A,B)
has a solution
@im
~l I
under the free interpretation
Is
we shall at this point b~ve
8 (x) = val(v) and then apply test T twice to ~il "'° im the same value of the variables u and v . If that occurs, P(A,B) is not free. "'"
(x)
im
=
Hence if the correspondence p-nnblem for P(A,B)
is not free.
only way in which (A,B)
(A,B)
P(A,B)
can he "unfree" so that if the Correspndenee
has no solution then
P(A,B)
assignment statements for convenience. to meet our definition.
Problem for
is free.
The constraction appears in Example III-3.
We allow composite functions in
This can. be simulated by simple ftunctions,
That is, we now allow a statement such as
which can he simulated by applying ill o~der and finally
i~as a solution, we can ensure that
The rest of the work consists of ensuring that this is the
u ÷ a(u)
, u + a(u)
u + abaa(u) , u + b(u) ,
u ÷ a(u) .
Since the scheme in Example 111-3 could obviously not appear in one page or be conveniently represented as a whole, we describe it by subschemes, a useful abbreviation technique we spell frequently employ.
The triangles such as:
k/ P(A,B)
is obtained by pasting
the triangles with the same name on top of each other and then substituting a straight line.
3-27
~LE
111-3
For A = (~i .... 'an) and B = (~l,°..,Bn) ~ each ~i,Bi in (a,b) + construction of scheme P(A,B) such that P(A,B) is free if and only if the Correspondence Problem fom
(A,B)
b~s no solution.
I Y ÷ g(Y) I \I
u + ~l(U) v ÷ Bl(V)
Subscheme for
u ÷ ~i(u) v + 6i(v)
I
i , 2 ~ i ~ n
\
V
±~/
( ToP )
3-28
EXAMPLE III-3 Subsch~
for
CONTINUED I'
Subscheme for
y
i'
2 < i < n
V 0
i
u ÷ ~i(u) V
0
÷
i
l U÷C~
2/
<
Subscheme for
(n+l)'
Y )
L
tz i ul Z <- V 1
,t
< ~o~ )
I Z "~
(-
t
yl
STOP )
3-29
We assume that for each letter and that Further,
g
T
i ,
i s i s n ,
Zi
is a different monadic predicate
is a mmnadic predicate letter distinct from all the
is a monadic function letter distinct from
Given a sequence interpretation
Is
s : (il,...,i m)
a
and
Zi .
b .
we can define a (not unique) free
by the correspondence:
Is(Z i )(g~(x))
:
0
i ~ r s m
r
Is(Zk)(gr(x))
:
i
Is(Zk)(gm+l(x))
1 S k S %
:
The values of the
Is(Z k)
specified arbitrarily. I
and
k ~
I -< k -< n ,
Is(Z i )(gr(x)) : 0
=
i
Is(T)
are unimportant elsewhere and can be
It is clear that this cor~,espondence works both ways
is a free interpretation
all
1 s r s m
1 ~ k s n
1
Is(T)(~im ... ~il(X))
- I ,
such that for some
and for each
and
r -< m
Is(Zk)(gr(x))
m+l > 2 ,
there is an
: i
for
I(~)(gm+l(x))
~
e {l,...,n}
i s k s i-i
,
= i
-
if for
such that
then clearly
I
r
can be represented as Let
Is
for
s = (il,...,~)
.
s = (il,...,i m) •
Under
Is ,
P(A,B)
will apply each
in succession, returning answer I, until finally for u
becomes
subscheme
~il(X) i'
and
v
becomes
and
with
Zk
applied to
computation enters s~mbscheme So in particular,
~i I
y
y = g2(x) y
val(v) = B im ... ~il(X)
This time all the tests
then if
i'
.
as
:
Then
(n+l)'
with
will be
i
y = g(x)
This continues until
y
and
u
as
is reassigned as
gm+l(x)
.
(n+l)'
6ii
val(u) = val(v) = s . . . .
T
on
T
is applied twice to the same value.
(A,B)
has the solution
~im
~I u
to
return answer i and finally the
s = (im,...,i I) , the computation under
subscheme
.
gm(x)
if the Correspondence Problem for
sm m
~
the answer is 0 whereupon
and the computation proceeds to
and now applies these tests to
finally the computation returns to aim ... ~il(X)
6il(X)
Z. 11
Is
will ultLmately enter
e. (x) .
Then the result of test
~m
and so the output of the next test is constrained to be Hence
P(A,B)
eannot be free.
i
as
3-30
On the other band, until we reach
(n+l)'
are all distinct and are applied only after, y y + g(y) .
we only apply the tests
there is no ~my of violating the definition of a free seheme.
out
i
on some
I
can enter
gm+l(x) , m+l >- 2 ,
(n+l)'
for the first time.
and
8ira ... Bil(X) .
u
will have as value
(A,B)
~
have tested
As we mentioned above,
Is
for some and
eim ... ~il(X)
If the Correspondence Problem for
(n+l)' ,
But the computation
only after all the
this can be seen to correspond to a free interpretation s = (i! ..... mm)
which
has been updated by assignment
Thus until and unless the computation reaches subseheme
on free interpretation
Zk
v
as value
has no solution, these
values must be distinct and so we do not violate the definition of freeness.
Hence
if the Correspondence Problem for
Thus
P(A,B)
(A,B)
has no solution,
P(A,B)
is free if and only if the Correspondence Problem for
is free.
(A,B)
has no
solution.
We have just shown that:
THEOREM 3.16
It is undecidable whether a program scheme is free.
We can extend this result a little. we have altered f
and
g
P(A,B)
to form
P(A,B)
If we examine Example III-4, we see that by ehanging subscheme
are assumed to be distinct from the function letters
_~/om each other, if we enter
(n+l)'
~eith different values for
subseheme will not violate the definition of freeness. with
val(u) = val(v) ,
(n+l)' a
and
b
and
u
and
v
the
But if we enter
(n+l)'
then the subscheme behaves llke the scheme in Example III-2,
which we have seen is not strongly equivalent to any free scheme. arguments will show that now
P(A,B)
Hence, similar
is strongly equivalent to some free scheme if
and only if the Correspondence Problem for
THEOREM 3.17
Since
(A,B)
has no solution.
It is undecidable whether there is a free scheme which is strongly
equivalent to a given scheme.
3-31
EXAg{PLE 111-4
If we replace subscheme following subschmne, the
~n+l)/ ~
in Example III-3 by the resulting scheme P(A,B) is
strongly equivalent to a free scheme if and only if the Correspondence Problem for (A,B) has no solution.
u
0
+
T
(
g(u)
......
STOP )
3-32
D.
LIBERAL SCHEMES AND A GLOBAL TRANSFORMATION We shall briefly examine a condition on schemes which implies freeness and
which can be tested.
We do this primarily because it gives us our first example
of an equivalence preserving global transformation on schemes.
%his is a topic we
study more closely in the next chapter.
In the next definition and for the rest of this chapter we assume that only assignments of the form
u
÷
f(v I .... ,vr)
are allowed where
u and the v. are variables. Some of the results are in fact 1 not true if we allow, e.g., composite assignments such as
u
+
f(g(x)~g(y))
DEFINITION
A scheme
computation
(P,I,X)
P
is liberal if for each free interpretation
never computes the santo member of
assigns twice the same member of
U(P)
U(P)
I , the
twice,
i.e., never
to a variable.
We shall show that every liSeral scheme is strongly equivalent to a free scheme.
The converse is not true.
Exauple III-5 contains a free scheme
is not strongly equivalent to any liberal scheme. if
2n+l = Min {k -> 3 I k
output compute
(fn(x),f2n+l(x)) fn(x) ,
odd, .
l(T)(~(x))
To compute
and store it until
f2n+l(x)
(P,I,x)
-
I ,
halts with
and test it, we must first is tested; the time lag
becomes arbitrarily large so either w~ need arbitrarily many registers the definition of a program scheme
which
Under free interpretation
= 0} , then
f2n+l(x)
P
or else we must reeompute
fn(x)
n+l -
violating -
violating the definition of a liberal scheme.
We demonstrate the fact that every liberal scheme is strongly equivalent to a free scheme by describing a transformation
(i)
If
P
is liberal,
t(P)
t
on schemes such that:
is liberal.
(2)
Scheme
t(P)
is free if and only if it is liberal.
(3)
Scheme
t(P)
is strongly equivalent to scheme
The tr_~nsformation scheme is not liberal.
t
P
in all cases.
does not _necessarily preserve freeness if the original
The basic idea is that a test should occur only after one of
its variables has been assigned to.
This is accomplished by performing all possible
3-33
EXAMP~111-5 A FREE S C H ~ WHICH IS NOT STRONGLY EQUIVA/£~IT TO ANY LIBERAL SCHH~{E
C
START >
I ,,, f(x)1
Yl ~Y2 ÷ f(Yl )
'l
Y2 ÷ f(Y2 )
Yl ÷ f(Yl) I Y2 ÷ f(Y2 )
C
STOP
)
I
INPUT VARIABLE - x
OUTPUT VARIABLES - Yl 'Y2
3-34
tests involving a variable
u
directly after assigning to variable
the results in the addresses of statements. as states in a finite state control.
u
and storing
Thus we are really using the addresses
This is a very useful technique in
constructing schemes with preselected properties.
The construction appears in Example 111-6 for a particular subclass.
The
construction for the full class is similar bat vastly more complicated.
The transformation in certain proofs
-
t
is not itself of great significance
-
although useful
but it does illustrate reasonably well the concept of a
global equivalence preserving transformation on schemes.
In this trar~sformation
t
we have cbmnged the order of appearance of tests
but the application of assignment statements is unchanged. sequence in
P
there is one in
t(P)
For each execution
in which the order of applications of
assignment statements is the same.
If
Now in
t(P)
only after either another test
Q ~ Q'
or an assignment to
we have a test
without assigning to
u .
Q(u) u .
is liberal, obviously
Hence we cannot test
Thus if
other hand, every assignment in
P
t(P)
t(P)
t(P) If
P
THEOREM 3.18
If
P
has length
twice in a row On the
is directly followed by all possible tests P
is not liberal it cannot be free.
t(P) m .
length less than
t(P)
is liberal arj so free.
Obviously
P
is
t(P) .
is liberal we can effectively construct a free liberal scheme
strongly equivalent to
Suppose
Q
is free if and only if it is liberal. is liberal, then
always strongly equivalent to
t(P)
by
is liberal.
Q'(u) ,
is liberal it must be free.
involving the variable assigned to and so if Hence
u
t(P)
P .
is not liberal mud the smallest "illiberaF execution sequence
If we examine the tree scheme corresponding to paths in m
this must be free.
t(P)
of
Hence if this execution sequence has a
subpath passing twice through the same address we can "snip" out the subpath and still have a legitimate execution sequence. By our conditions on the form of assignment statements in
P
and so in
this first occurrence of "illiberality" mmst be due to an assigrment at time u ÷ f(vl,...~v s)
foll~{ed at t~mne i+j
val(Yk,i+ j ) all
k ,
i -< k <- s
to this execution sequence. and each
val(Yk,i+ j ) , Vk = Yk '
by
Y + f(Yl''"'Ys )
with
t(P) , i
val(vk~i) =
~nder the particular free interpretation leading
But we mmst have computed previously each
val(vk,i)
so if this is the first violation of liberality, then formally
i.e., they are the same variables.
we cannot recompute any
vk
Further, between
or we shall have to reassign
vk
end
i
and
val(vk,i)
i+j again
3-35
EXAMPLE III-6
TO "FREE" A L I B ~ TRANSFORMATION P
Here we construct one input variable altogether,
x
t
SCHEME
CARRIES S~iEME
P
INTO SCHEME
IS STRONGLY EQUIVALENT TO
t(P)
by subschemms from
P
and t~7o monmdic predicates
t(P)
t(P)
for The special ease of TI
and
T2
and
r
variables
Ul~...,ur . The transformation can be extended to any n~0mbem of
predicates ~£nich need not be monadic; however~ the subscripting becomes formidable.
We assume
P
to be in linear form.
to all possible addresses Jk
is in
{0,I,A}
For an address i)
with
p
A
in
We let an address
(P,il,...,ir~Jl~... ,jr )
in
p
t(P)
in
P
correspond
where each
ik
and
standing for "unassigned".
P , define function
F(p,il,...,ir,Jl,...,j r) : p
if
p
F
by:
is not the address of a test
statement
2)
F(p,iI .... '~'Jl ..... Jr ) = ~
if
p
is the address of a test
statement and
p
is the address of
the first nontest statement entered from
p
if
T2(Uk) : Jk
TI(U ) : ik
for each ~ssigned
(i.e. for each
3)
F(p,il,...,ir,Jl,...,jr) = LOOP
and
k
with
uk
ik ~ A ~ jk ).
if neither (I) nor (2) holds.
3-36
EXAMPLE III-6
CONTINUED
INITIAL SUBSCHEME
For
i,j • {0,i} ,
if
F(p,i~A .... ,A,j,A,...,A) : ~
S.. = (p,i,A ..... A,j,A ..... A) ~ then
if
then
F(p,i,A ..... A,j,A,...,A) = LOOP
S.. = LOOP ij
In
P
we have:
In
t(P)
we have:
START START
<J
)
O/
~
\i
3-37
EXAMPLE III-6 ASS IGN%~N~ S U B S C H ~ S
~br [~
= m
m,n e {0,i} , if
,
~
=
n
: (~'~l""'ir'Jl let
S m
: LOOP
If
P
then if
[k = ~
and i f
contains a statement:
u~ + f(vl,...,v s)
for
k ~ ~ , 1 s k ~ r ~
F(q,i I ..... im,Jl .... ,jr ) = q
.... ,yr )
7
' ~k = Jk
F(q,il,...,%,jl
let . . . . ' J P ) = LOOP
Then t(P) contains for all possible w = (P,il,... ~ir,Jl ..... jr) subsehemes:
Y
u~ ÷ f(vl,...~v s)
3-38
EXAMPLE 111-6
In
t(P)
CONCLUDED
we also have a subscheme
LOOP
where
LOOP
)
stands for any free but always looping subscheme.
u I + f(uI)
An example is:
3-39
violating the definition of a liberal scheme. s~opath from
i
to
i+j .
Hence no
If th~s s u b p a t h ~ s s e s
vk
~ice
is altered during the
through the same address
we can snip out that section ~nd obtain an execution sequence of length strictly less than
m
in which this same instance of "illiberality" occurs.
impossible, so the subpath from address.
i
Also, the subpath from
the value of the
Vk = Yk at
to i
i
to
tam,not pass twice through the same i+j
is "illiberal" regardless of
i . Hence, if the subpath from START to
twice through the smme address~ t ~ n sequence from S % ~ T to
i+j
through
Tnis is
i+j
of length less than
of "illiberality" contradicting the min~mality of or between
i
i
passes
el£m~nating this cycle results ~m~ an execution
and
i+j .
m.. If
m , which is ~n £nstance Thus no cycle can occur
between START and
i
t(P)
then we must have
m ~ 2N+2 . Hence we can decide whether
contains t(P)
N
statements,
is liberal by
tryiI~g all paths and hence all execution sequences of length less than or equal to 2N+2 . So we c~n decide liberality and so freeness for if and only if
THEOREM 3.19
t(P)
t(P) .
is liberal and free.
It is decidable whether a scheme is liberal.
Dat
P
is liberal
4-1
IV. A.
SIRUCITJRED PROGRA]~ CANONICAL FORMS We define a canonical form for schemes as a class
~
of schemes such that
theme is an algorithm which transforms any scheme into a strongly equivalent member of
~
.
where
~
Thus one has:
is the whole class of schemes,
is a total recursive function takg]g any sche~
t(P)
in
~
We call
equivalence preserving since if t(P)
and
t(P' )
t P
~ scheme
is the canonical subclass and P
~to
t
a strongly equivalent
a canonical tra~nsformation; it is strong and
P'
are strongly equivalent, obviously
are strongly equivalent.
The transformation
t
we saw at the end of the last section, which changes
liberal schemes into free schemes, is such a canonical tra~nsformation.
1~ne
corresponding canonical class of schemes is the class of schemes such that tests are applied initially on the input variables and are applied after assignment statements on the program variables involved, and at no other time.
This
transformation
The class of
t
is clearly recursive and equivalence preserving.
free schemes is not a c~noniea! form class, since, as we saw, the~re are schemes not strongly equivalent to any free scheme. In this chapter we study two ~ o n i c a l associated with structured progra~mttng GOTO-less schemes.
forms for schemes and programs
-
block structure and WHILE-schemes or
Our approach is anal~tic rather than synthetic.
We do not study
directly the question of how to write a progmam in structmoed form~ but rather explore the conditions on the syntax of a program implied by such a form and the techniques of trarlsforming a pre-existing program into this form.
In a later
chapter we see the utility of such forms in simplifying program verification techniques. Just transforming a program or scheme into a given canonical form may not be enough if the transformation preserves strong equivalence but nothing else.
We may
also mequire canonical transformations to preserve "structure" in some sense of this rather vague notion.
For example, we may wish blocks or modules already existing in
the original program to remain blocks or s~schemes in the new program.
We may wish
parts of the program already in ea~onical form to remain so in the new program. we may wish to preserve "loop structure" any new cycles.
-
We might also be interested not just in preservation of final
outcome, but also in the intermediate values of program variables. transformation
0r
map cycles into cycles and not produce
t
For example, the
in the last chapter changed only the application of Test state-
ments ~ the sequence of nontest instructions performed in any computation was
4-2
unchanged and all program variables ran through the same sequence of values during a computation. We can consider the preservation of structure in either semamtic or syntactic terms
-
either in terms of the sequence of values of registers or in terms of the
sequence of instructions performed. One basic idea is that strueturally akin schemes
P
and
P'
should not only
do the same thing when output is given, but also should compute the same output in roughly the "same way".
One fairly strong way of expressing this coneept is that
under the same interpretation and input they should have the same "computation record". DEFINITION program
Let
P
be a program scheme,
(P,I) . Let
of the computation
:
(P,l,a)
Pi
:
have
(P,I,[)
O(P,I,~) finite if
P
r
~i = Pi
Pi if
i
i ,
(val(Ul'i)"" ~val(ur'i))
if
=
i
(P,l,a)
(p'l,...,p'i,...)
is the sequence
is not the execution of a test statement, and
((val (ul'i) ' """ ~val (UP :i) 'T(val (vl'i) '" " " 'val (Vs 'i) ))
{Ul,... ,ur )
where
(P,l,a)
relative to
{Ujl,...~Ujk} , and
i
{Ujl ,... ~Ujk]
{Ujl,... ,Ujk)
P'i : (val(Ujl'i)"'''val(Ujk'i))
(F' l ..... F' i .... )
if
T(Vl,... ~vs) . If
is any
including all input and output variables, the computation
test added computation record relative to
~'i : P'i
an input to
converges and otherwise infinite, such that for each
record of the computation
where
~
Ul,... ,ur . The computation record
(Pl .... 'Pi .... )
is the execution of test statement
subset of
an interpretation and
is the sequence
The test added computation record for
where
I
variables,
{Ujl,... ,U.]k}
is the sequence
for each
i , and the
is
,
is not a test statement involving only mem]~ers of
4-3
P'i
if
i
:
(val(U.]l,i),...~val(Ujk,i),T(val(vl,i),...,val(Vs,i)))
is a test statement
T(Vl,... ~vs)
and
{Vl,...,Vs} C_ {Ujl,... ,Ujk }
Thus the compu
-
it is the listing of computation states minus
the name of the instruction executed at time
i . The test added computation record
contaLns this list of values plus the formal record of tests applied. is applied at step
i
contaLns for step
i
If test
T
to, say: values I and 5, the test added computation record the formal statement
"T(I,5)" , identifying the parti@alar
test applied ar~ the values to w9ich it is applied.
The eomguta~ion record or test
added computation record relative to some subset of variables considers only values of those variables and tests applied to those variables.
It is useful when
comparing programs with different program variables but the same input and output variables.
DEFINITION
Two computation records are equivalent if they are identical when
consecutive duplications have been removed from each record removed if
-
i.e.
Pi+l
Pi = Pi+l "
There are several ways in which we can try to capture the idea that P'
is
have the same structure".
We now assume that
P
and
P'
" P
and
have the same set of
variables.
SEMANTIC i)
P
and
input 2)
P' a
are computationally equivalent if for every interpretation the computation records
P
and
P'
I
and input
p(P,l,a)
and
I
and
p(P' ,l,a) are equivalent.
are strongly computationall~ equivalent if for every interpretation a
the test added computation records
~(P,l,a)
and
~(P' ,1,7)
are equivalent. 3)
P
and
£nput 4)
P' a
are computationally isomorphic if for every interpretation the com~tation records are identical, i.e.
P
~nd
P'
I
and input
I
and
p(P,l,a) = p(P',l,a) .
are s~ongly computationally isomorphic if for every interpretation a
the test added computation records are identical, i.e.
~(P,I,a) : ~(P' ,I,a) .
4-4
If any one of relations P'
are strongly equivalent.
hold for
P
and
P'
(i) through (4) hold for
P
and
P' , then
P
and
However none of these relationships need necessarily
strongly equivalent.
either (2) or (3) imply (i).
Clearly (4) implies (2) and (3) and
No other implications hold.
One can construct schemes
computaticnally equivalent but not strongly computationally equivalent say, the order of some tests are interchanged) or computationally
(because,
isomorphic
(because, say, some value is computed twice in a row); schemes strongly computationally equivalent but not computationally
isomorphic;
schemes both
computationally
isomorphic and strongly computationally equivalent but not strongly
computationally
isomorphic.
The transformation
t
studied in the last chapter preserves computational
isomorphism but not strong computational equivalence
-
s~tr~ongly equivalent but also computationally isomo~nhic. computationally equivalent since the transformation application of tests or introduce new tests or only tests
-
eliminate tests.
are not computationally
-
t
P
and
t(P)
are not only
They may not be strongly can rearrange the order of
in the case of a cycle involving
(Strictly speaking, whether
t(P)
and
P
are or
equivalent can depend on the subscheme substituted for tight
LOOPs; if we are not concerned with making this subscheme free we can use one which will not affect computational isomorphism.) We now consider some similar concepts which can be regarded as more syntactic than semantic in nature. SYNTACTIC 5)
P
and ,
P'
are structurally similar if for each interpretation
the sequence of nontest instructions executed during
I
order of execution, is identical to the same list for computation
6)
P
and
input
P'
and input
(P,l,a--) ,
listed in
(P',I,~)
are strongly structurally similar if for each interpretation
a ,
the sequence of instructions executed during computation
.
I
and
(P,I,~)
,
listed in order of execution, is identical to the same list for computation (P',l,a) 7)
P of i
.
is a homomorphic image of P' and
into the addresses of h(i)
and input
P'
if there is a function
P ,
h
from the addresses
such that (i) for each address
i
in
name identical instructions and (2) for each interpretation
a ,
if
(kl,... ,ki,...)
I
lists in order of execution the addresses
of nontest instructions executed during computation (h(kl),... ,h(ki),... )
P' ,
(P' ,l,a) ,
then
lists in order of execution the addresses of nontest
instructions executed during computation
(P,l,a)
.
4-5
8)
P
is a strong homomorphic ima@_e_of P'
addresses of i
in
P'
P' , i
interpretation
if there is a function
into the addresses of and I
h(i)
P ,
h
from the
such that (i) for each address
name identical instructions and (2) for each
and input
~ ,
if
(kl,...,ki,...)
lists in order of
execution the addresses of all instructions executed during computation (P',I,a) ,
then
(h(kl),...,h(ki),...)
lists in order of execution the
addresses of all instructions executed during computation
(P,I,7) .
The lattice of implications among (i) - (8) and strong equivalence appea~s below. hold.
No implications shown can be reversed and no implications not in the diagram Conditions (7) and (8) represent an attempt to formalize the idea of
preserving loop structure, since cycles in cycles in
P'
correspond to cycles in
P , if repeated often enough, correspond to cycles in
P
and
P'
7 ~ / 8 x~6 ~5 ~/
x~ 4
~3 / "'2 ",.1 j strong equivalence
The strongest definition of structural similarity is the concept of graph isomorphism which is, of course, tantamount to complete identity.
This concept
can be defined for subschemes as well as for schemes.
DEFINITION
A flow diagram
under graph homomorphism into the address set of h(i)
P
h , P
is a graph homomorphic imag_~eof flow diagram if
h
such that
name identical instructions and
to statement
j
the arrow from
in i
j
h(i)
If the function P'
h
i
to
is labelled, then the arrow from
same label. and
(i) for each address
in
P'
i
P' P' and
(2) if there is an arrow from statement
P' , there is an arrow from to
and
P
is a function from the address set of
is one-one and onto, then
h(j) h(i) h
in to
P h(j)
i
and if has the
is a graph isomorphism
are graph isomorphic.
Graph isomorphism is a completely syntactic concept and is clearly testable. The methods used later in Chapter VI can be adapted to show that none of (i) - (8) are decidable two schemes (i)
it is not decidable whether any of these relations hold between P
and
P'
and if
(i)
does not always imply
is known to hold, it is undecidable whether
(j)
holds.
(j) , then even if It can also be noted
4-6
that even if
P
is a strong homomorphic image of
homomorphie image of isomorphic.
P ,
P'
and
it is not necessarily true that
P' P
is a strong and
P'
are graph
Essentially the reason is that in condition (8) we place restrictions
only on the parts of the schemes that are reachable
-
on those instructions
actually executed during some computation. We can also consider restricted or among schemes.
relativized versions of these relations
For example, a restricted version of (i) to (8) can be obtained by
eliminating all mention of variables that do not appear in both Instead of assuming that
P
and
P'
P
and
P'
have identical variable sets, we only assume
that they have the same sets of input variables and of output variables.
Thus, for
example, we could define: P
i')
and
P'
are computationally equivalent in the restricted sense if for
every interpretation
I
and input
K
the computation record of
relative to the c o m o n
variable set of
computation record of
(P' ,l,a)
P
and
P
and
P'
(P,l,a-)
is equivalent to the
relative to the c o m o n
variable set of
P' .
Alternatively, one can consider strong equivalence relative to some fixed subinterpretation.
Suppose
I
is an interpretation over some fixed domain
D
which interprets all function letters, predicate letters and constants appearing in either
P
or
P'
P
or
P' .
Suppose
with domain
D' .
If
not in either and
P'
l(T)(a)
or
or constant
l(c) c
is defined
and
l'(T)(a) = l(T)(a) of
I
to all of
DEFINITION
P
Scheme
interpretation
but not in both
I'
D -
I'
P' ~
it can also interpret symbols
is an interpretation of all letters in D'
and whenever
for a function letter
a vector over
or
l'(c) = l(c)
P
and
is a subset of
a
and
P
D
-
then
l(f)(a)
f , predicate letter
l'(f)(~) = l(f)(a)
respectively, then we call
I'
P
or T
or an extension
P'
is strongly equivalent to
extending
I
strongly equivalent to program
to all of
P
P'
and
relative to
P' ~ program
I
if for any
(P,I')
is
(P' ,I ') .
We now examine two very useful structure preserving transformations.
To assist
in the discussion, we introduce the concept of a single entry subgraph.
DEFINITION call
G'
Let
(2)
be a directed labelled graph and
a single entry subgraph of
entry node of (i)
G
G'
Every node in
G
G'
if there is a node
a subgraph of n
in
G' ,
called the
such that G'
lies on some path from
n .
There is no direct connection (single step path) from any node in to any node in
G . We
G' - {n} .
G - G'
4-7
The exit node set of (i)
pairs
(k,r)
G' ,
where
E(G')
k
can be described as the set of all
is a node in
G' , r
is a node in
G - G'
has exactly one branch and that branch is uI~labelled and leads to (2)
triples
(k~r,i)
G - G'
and
k
where
k
is a branch rode in
is directly connected to
We are interested in the case where is in
E(G')
,
k
r
G
G' , r
and
k
r , and
is a node in
by an arrow labelled
is a flow diagram.
i .
If a pair
(k,r)
is the address of an assignment statement which is followed by
the instruction in node
r , while if
(k,r~i)
node of a test statement and the outcome
i
is in
E(G') , then
k
leads to node (or address)
is the r
in
G - G' .
The first transformation illustrated in Example IV-I is the Duplicate Operation. It is a local operation, applied to a s u b g r a ~ n o f a scheme. that and
A nB
and
B
are single entr~y subgraphs in a scheme
respectively.
a triple
(k,nB,i) .
The exit node set We construct
E(A)
B' ,
exit node from by
A
(k,h(nB))
untouched.
to
or
B
We form
(k,nB,i)
by
The exit node set of
E(B') = {(h(k),r)
It is clear that
P'
B'
to
B'
f
the homomorphism h(n)
this transformation
is in -
B' )
B'
-
to
B ;
B'
nA
(k,n B)
or
let
h
which
P ~ replacing the
so that
(k,n B)
is replaced
leaving the other nodes of
A
is the set
{(h(k),r,i)
is strongly equivalent to
image of
P' {
by adding
I (k,r) c E(B)} U
P
(which means
A
onto the nodes of
(k,h(nB),i)
relations (I) - (8) hold between
B
B
P'
by one from
P , with entry nodes
contains either a pair
a graph isomorphic copy of
be the one-one function from the nodes of establishes this isomorpb£sm.
To apply it, we assum~
and
P' .
P .
In fact~ all the other
Moreover,
is defined by letting and
f(m) : m
the duplicate operation
I (k,r,i) • E(B)}
P
is a graph homomorphic f(h(n)) = n
for any node ~n
for
n
P' - B' .
in So
preserves structure in a very
strong fashion.
Notice t~mt tlne duplicate operation is valid in ms~y cases where
B
is not a
single entry subgraph~ however, in such cases it is often harder to state precisely and justify.
The second illustration in Example IV-I gives one such case.
have a single node ~ i " ' " '~r "
n
Subgraph
which is connected to a node B
m
scheme
P'
is formed by adding a node
and a graph isomorphic copy by one from
n
to
m'
and possibly to other nodes
contains all and only nodes reachable from
not be single entry and there may be connections from
B'
of
m'
B .
Here we
B
back to
with the same label The eormeetion from
m .
m . (X(m)]
n
to
m
It may
The new as
m ,
is replaced
with the same label, if any; the connections between
m'
4-8
EXAMPLE IV-I
SOHE TRANSFORMATIONS PRESERVING COMPUTATIONAL ISOHORPHISH
DLrPLICATE
OFL?ATION
,,,'~ f
A
B
coo1 c~I -,,
an
81
"'"
8m
(~1
• • •
81
~n
•••
1, !DOQ1 B'
• ..
A
B'
and
B
are
s£ngle entry subgraphs
is graph isomorphic to
B
8m
8m
4-9
~ L E
IV-I
CONTINUED
SPECI~/~ CASE OF DbTLICATE O P ~ A ~ O N
f
l(m)
/[ ~i "'" °r
/
B'
Node B B'
n
is connected to
~l"~''~r
and
contains all nodes reaekmble from node is graph isomomphic to
B
m m
4-10
EXAMPLE IV-I
CONCLUDED
UNWIND
LOOP
OPERATION
f
2
>
)
Ij...\ ""......
A
Im
al "" " ~n
) ~i • • • an
\
)
ooe~ O~I "',
Gn
I
AT
I
/...\Im ~l
"" "
an
4-Ii
and
B'
B' B' P
are isomorphic to the connections between
forms a graph isomorphic copy of except from
m
plus
m
B ).
and
B
(so that
m'
m' . All other connections in the scheme are unchanged.
is a strong homomorphic image of
P'
plus
There are no connections into
and so a f o r t i o r i
P
and
P'
Again~
are
strongly equivalent.
The last operation depicted in Example IV-I is the Unwind Loop Operation. Here
A
nA .
We now add a single entry subgraph
A
to
is a single entry subgraph with entry node
nA, ,
the entry of
was connscted to
nA ,
A' .
A'
Both possibilities are shown.
and a self-loop back to
graph isomorphic to
_There ape two possibilities.
then the corresponding node
either back to the entry node of
nA
A
or
Scheme
A' P
m'
in
A
and cormect
If node
A'
m
in
A
can be connected
or to the entry node
nA
of
A .
is a strong homo~nrphic image of each of
the two resulting schemes; all three schemas are strongly equivalent. In the rest of this chapter we shall generally describe transformations and operations on schemes and subgr_a~s pictorially, rather than giving the formal description as we just did for the Duplicate Operation.
B.
BLOCK STRUCTU~S We shall give two equivalent definitions of a block stm~cOared scheme and
demonstrate their equivalence.
Then we shall describe and illustrate a procedure
for converting a scheme (or prmgr_am) into block structure. is really a restriction on graphs.
The first definition
We shall need some purely graph oriented
definitions.
DEFINITION
Let
G
he a directed labelled graph and
of
G
G'
if every path from
with entry node
ancestor of
m
or
DEFINITION
A graph
connected to a node of
n
or
n
:
m
e . A node e
n
to
m
domir~tes
G m ,
n
in
G'
passes through
G'
is a G'-ancestor of a node n ~
if
G = G'
then
m n
in is an
m .
is tree-like if whenever a node either
a single entry subgraph
n
is an ancestor of
n m
in or
m
G
is directly is an ancestor
.
Let us illustrate the concept of "tree-like" with a f½w simple examples. Suppose n
to
G m .
is tree-like with entry node
e
and there is a direct connection from
Situations (i), (2) and (3) below are permissible:
4-12
(i)
n
is an ancestor of
m
(2)
m
is an ancestor of
eo
(3)
n = m
e,
e •
•
e--
e
m-,~
no
• me •
n
•
n:m~
0
•
•
ne
e
~
The situations which violate the definition of "tree-like". involve a "diamond" as in (4) or a triangle as in (5):
(4)
"Diamond"
(5 )
"Triangle"
e •
e •
no
pe
!
~e
|
m •
me
Of course, there can be many nodes between
e
and
p
and
p
and
m
between
e
-
n
in (4) and (5) or
in (4).
A program scheme whose graph is tree-like entry node
~nd
is sometimes said to be in n o r m ~
We can list some obvious consequences
-
taking the START node as the form.
of the definitions
of "ancestor" and
"tree-like".
LEMMA 4.1
In any graph
G ,
the ancestor relationship
is transitive.
PROOF If
m
is an e~ncestor of
an ancestor of
p
and hence through
n
and
n
is an ancestor of
since any path from the entry node to m .
m
reaches either
and n
m or
then
m
must be
must pass through
n
•
Obviously the ancestor relationship ancestor of
p
p ~
an ancestor of m .
cannot be symmetric; we carmot have n
n
u~nless no path through the entry ever
aP~
4-13
LEMMA 4.2
In any graph
G ,
tony node on any path ~rom
m
if
m
to
is an ancestor of
p
p ,
m
is an ancestor of
that does not pass through
m
en route.
PROOF Suppose
m
is an ancestor of
which does not pass through ancestor of
n ,
pass through
m
p
Sm
n ~ m
n
which does not pass through
m
If a graph
subgraph
mud
if we add on the path from
is an ancestor of
LEMMA 4.3
p
lies on some path from
except at the start or finish.
then there is a path from the entry node to
m ;
entry node to that
m
p .
G
m
,
p
n
m
m
to
is not mn
which does not
we have a path from the
contradicting the hypothesis
•
is tree-like and
consisting of
to
If
m
is any node in
and all its descendants
G ,
then the
(all nodes of which
an ancestor) is a tree-like single entry subgraph with entry node
m
is
m .
PROOF First note C~at any sJ]igle entry sub~.aph of a tree-like graph must itself be tree-like for if the ancestor relationship fails to hold in a subg-raph it cannot hold in the whole graph. definition of
is a node in
p .
G If
Sm ,
s
is a node in
is an ancestor of
is an ancestor of
ancestor of
m p
m e
s ~
is an ancestor of
G - Sm
m
by
and or
m ~
s
and so
s
if it passes through
e - s - m - p .
is an ancestor of to
s
s
Suppose
directly cormected to or
s
p p .
is an ancestor of
is in
m
e
S m of
If G
to
s p
is an must pass
only once it must go either
If the first case ever oceurs~ then by and so
and then directly to
s p
and so contradicts the fact that
We define blocks inductively.
s
m .
then by the transitivity of the ancestor
them~ every path from the entry node s
e - m - s - p
m
is single entry with entry node
p
tb~ough both
through
p ~ m
Sm and
p
path from
lies on some path from
is tree-like, either
relationship,
Lemma 4.2
Sm
Sm .
Now we must show that
Since
Next, every node in
is in
S In the second case the m is a path from e to p not passing m
is an ancestor of
p .
•
A block is a particular kind of flow diagram.
4-14
DEFINITION i) The following are blocks:
f < ~
1
""~
i 0
\
where ~ is any assignment stateme~t and T is any predicate statement.
2) If BI and B2 are blocks, so is their block composition B3 :
f
l
I
BI
..1...
J..-I1 i
n
n+l
i
< B2,1
B3
Bt ooo
i'
m'
1 ooD
1
n
I'
m t
4-15
3)
If
B
is a block so is its block iterate
LB
I
B'
\I
f
B' \1 B
jooL
i
DEFINITION
n
\
n+l
i
n
A single entry flow diagram is a block if and only if it can be built
up from the basic blocks in (I) by a finite number of applications of block composition and block iteration.
DEFINITION
A program
(P,I)
is a block structured program if
P
is a block
i.e., if its graph is a block.
DEFINITION
If
B
is a block~ then a subblock of
B
is ar~y subgraph of
B
which
is itself a block.
The definition of a block given here is really a bottom-up definition, building large blocks from smmller subb!ocks. structured program, one proceeds top-doT~m
-
Z~en one actually const~Jcts a block first d e f y i n g the role of the outer-
most block (what process it is to realize), then that of its immediate subbloeks, and so forth.
A single node (labelled by a process for Which one intends to build a
submodule) cam be considered a block.
The equivalence of the top-doom and bottom-up
definitions can be justified by the block replacement I m m m ,
BLOCK REPLACEMENT ~ If
G
other block
4.4
is a block with a subblock B2
stated without proof.
B I ~ the result of replacing
with the same exit cor~nections is a block,
G' .
BI
by any
Pictorially:
4-16
i
i
G X
>
BI
/
1
n
I 1 ~
'
n
m'
m'
m T
i'
Now we show that the concepts of a block and of a tree-like flow diagram are the sa~le.
THEOREH 4.5
Every block is a s~;gle entry tree-like flow diagram &nd every single
entry tree-like flow diagram is a block.
PROOF Obviously a block is a single entry flow diagram arid the basic blocks are tree-like.
We need only see that the operations of block composition and block
iteration preserve the property of being tree-like. connecting node B2 ,
n
of block
BI
n
is an ancestor of
like, clearly
B
is tree-like.
a descendant of
n
eI
entry node of
G .
Let
B , G
e2 ~
If
of Block
in
Now suppose that
B
is formed by directly
by block composition to entry node
clearly
connecting exit node
If
B BI
so if
so that if both
and
eI
is tree-like then
of B
be the number of direct connections in
to either itself or an ancestor.
If
dG = 0 , dG .
G
Suppose
n
remains
is also tree-like.
is a single entry tree-like flow diagram; let dG
of block are tree-
B I , then
G
e
be the
from a node
is a tree and a tree is obviously
a block.
We proceed by induction on
that
is a block for every single entry tree-like flow diagram
G'
e2 B2
is formed by block iteration by directly to entry node
~
BI
d G = d >- i
a~nd we have proven G'
with
4-17
dG, _< d-i to
.
For a node
n
,
let
A
contain each node
a(n)
be the l e n g t h of the shortest path f r o m
e
n . Let
k
in.
G
such that either
connected to itself or there is a direct c o n n e c t i o n Since Let
d G >- i , m
A ~ ~ .
be a descendant
Let
of
n
n
be a m e m b e r of
(or
n
k
is directly
from a descendant
A
for w h i c h
of
a(n)
k
to
k .
is minimal.
itself) d i r e c t l y connected t o
n
and let
S be the set containing n plus its descendants. By our previous observation, n Lenmm 4.3, S n is a single entry tree-like subgraph of G . Let e be the e n t r y node of
G .
There are two cases.
changing the connection entry tree-like
from
m
Since
n ~ e .
If
e
,
,
e )~
were in
of e in S n a contradiction.
e
G ~ S
and n to
G - Sn
is an ancestor of
p
shows that
p
then
p
e
n
A to
k .
of
p
is in
and
Sn
,
an ancestor of
n .
then two ancestors the fact that G - Sn
and
connection
G Sn
entry tree-like G'
s
n
Form s
to
G' n
G - Sn
p
SJ~larly,
p
,
G
Sn
G'
G
is formed from
G' •
and
~
G G'
a to
.
The
containing k
.
Since
is an ancestor
n ;
s
Sn
must be
a contradiction
n of from
and r e p l a c i n g the is clearly a single
and hence by the induction hypothesis
is a single entry tree-like flow diagram.
is a single entry tree-like flow d i a g r a m w i t h
thus is a block.
n
from
by changing the direct connection
to
n
, k
a(n)
k
a n ancestor of
Then
Sn
m
Sn
is formed b y block c o m p o s i t i o n
S'n
(reconnect
is in
to
in If
were directly connected to
from
by the induction hypothesis
e
By Lemna 4.2
G - Sn
Essentially
dG, -< d G - 1
p
k
n ).
H e n c e there are no exits f r o m
b y r e m o v i n g all of
Sn
with is a closed
by the m i n i m a l i t y of
Then
iteration
and so
d i r e c t l y connected to
by an exit out of
subgraph with
is a block.
in
A
S
m a y or m a y not be
would be directly connected to
is tree-like.
from
e - n - p - k .
a contradiction.
by
(connecting
The direct c o n n e c t i o n f r o m
a(n) <- a(p)
If any other node in
of
( k
can be extended to a p a t h from
the path must go
G'
is a single
n For suppose node
G - Sn
and so
,
p
w o u l d be in
,
e x a c t l y once; this extended path must contain
There is at least one node
e
n
a(n) -< a(p)
G'
is a b l o c k b y the
We c l a i m that
is an ancestor o f
is an ancestor of
is in
shortest path from n
p ,
Hence
in
G'
If we f o r m
then
then there w o u l d be a direct connection
back to
p
,
b y block iteration
,
So
= G .
n
G'
so
is a block.
Sn k
,
Sn
Sn
is d i r e c t l y connected to node
S
G'
G
subgraph in that there are no exits from
contradiction.
then
to an exit f r o m
is formed from
from some descendant a(e) = 0 < a(n)
e = n
n
dG, = d-i ( d
G
to the entry node
Suppose
If
to
flow d i a g r a m w i t h
induction hypothesis. exit node
m
from
m
to
n
to an exit from
Form m
S'n
.
ds, = d S - I _< d e~ - i and n n S' is a block. Then S is formed f r o m S' b y block n n n n , the entry node of S n ) and is a block. Finally,
Sn
by block composition
(reconnect
s
to
n )
and
4-18
Notice that our proof that a tree-like single entry flow diagram is a block actually gives an algorithm for dividing such a graph one finds
A ,
equal to
G ,
selects then
n
G
to minimize
a(n)
formed by block composition from to these smaller blocks. Sn
into subblocks.
G - Sn
and
S' . If G ~ S , then G is n n Sn and we c~n apply the algorithm
We could instead replace
and treat that version of
G - Sn
Namely,
S If S is n n Sn' which is Sn minus
is formed by block iteration from
one connection~ the algorithm is now applied to
by
G
and separates out
S
by a single node labelled
n
separately and
Sn
separately.
If we
follow such a procedure we get a division into major blocks, a concept we shall re~u~, to later. Now that we have shown that tree-iLk~ single entry flow diagrams are blocks and vice versa and in the process given a construction for expressing any Tree-like single entry flow diagram as a block construction of tree subsehemes, we are in a position to show how to convert a program to block structured form.
THEOREM 4.6
BLOCK STRUCTURE THEOREM
Every p ~ g r a m program scheme
scheme
P'
P
can be converted into a strongly equivalent block
with the same set of variables, such that
homomorphic image of
P
is a graph
P' .
PRO0 F We shall convert a program scheme program scheme
P'
7here are t ~
possible approaches,
execution sequence tree for (k,r)
P
will be at level
instruction named by
r
k .
in
P'
place node to
(p,r+l)
to date.
(p,r+l)
(p,r+l)
If
k P'
is strongly equivalent to In fact
taking each
(k,r)
P
labelled START.
p
k
in
in P
P
A node
is connected by an arrow
and t~mt we have constructed node
has no ancestor, of the form
(p,r') , r' < r ,
tem~inate in a scheme
h
(k,r)
labelled by statement
also on the armow from
is a bloc]<.
of the new tree-like structure and be labelled with the Suppose statement
but instead add an arrow from
preserving.
(i,0)
p
to
p .
(k,r)
(k,r)
If
P
with at most P .
of
k
N
p .
If there is
(p,r')
containing any label
statements, this process must
levels.
Clearly
P'
is tree-like and
This transformmtion is global and structure
is a strong homomorphic image of back into
to
on the tree, then do not create
back to
has N
(p,r') , r' < r ,
on the Tree, with an arrow from (k,r)
which contains any label on the arrow from
already an ancestor
P'
in one approach we in effect build the
P . We start with node
(with or without a label) to statement (k,r)
into a strongly equivalent tree-iLke
~nd use Theorem 4.5 above to assert that
P'
under the homomorphism
k .
An alternative method of proof uses repeated applications of a local Transformation, the duplicate operation, which also preserves graph homomorphic images.
Call a direct connection in
P
from
n
to
m
anomalous if
n ~ m
and
n
4-19
is not an ancestor of node of
P .
m
and
For any node
nodes reachable from
nodes of
G
we can write
is not an ancestor of
G
e
P ;
P
a(P)
we can construct a flow diagr.am
a(P) : 0 ,
P'
and
P'
there is nothing to prove.
and
P
such tlhat the direct corm.ection from
Let
GI
a(G) <- d-i
f
m
because
is either not present in
connection from
f-l(n)
GI
GI
to
is the en<my node of
connection anomalous in Hence
and that
be a graph isomorphic copy of
mapped by the graph isomorphism
m . n
f-l(m) = m I
GI
Sm
Now we carl form
m2 .
Since the connection between
PI
If
n
replaced by one from
n
m2
and
m
P'
and
a(P') = 0 .
Hence
PI
of
~nd
PI
with
P
P' .
P
to
GI
because
any other direct
to
m
P .
GI .
a(G 2) = 0 ;
by adding
for PI
k
G2
Thus
let
hI
with entry
by one from
in
G2
onto
are in
P
such that
already.
n
to
P .
n
n
and
h2(k) : k
SLnce
G2
to
is
m
is
is an ancestor of
Hence
We can now apply the induction PI
is a graph homomorphic
is a graph homomorp.hic image of This completes the proof.
Although we did not give the details which are tedious, from
n
is anomalous, no nodes are
a(P I) = a(P,P I) + a(G2,P I) = a(P~P I) -< a(P) - i' . P'
GI
or has become a d~rect
The direct connection from
PI
hypothesis and obtain a flow diagram
is an image of
of
which is not anomalous since
other anomalous connections in
Linage of
mI
P
n
is a graph hommmorphism from
a(G2,P I) = 0 .
P
with entry node
f-l(n) ~
G2
h2(k) = hl(f(k))
tree-lii<e, cer~cainly
to
is
Sm
from
and replacing the direct connection from
disconnected by this process.
;
m
and we can. apply the induction hypothesis to
m2
h2
n
to
is the image of a direct connection anomalous in
node
otherwise~ clearly
Let
n
which is not anomalous in
is a graph homomorphic image of a £1ow diagram
be the graph homomorphism.
a(P) = d >- I .
Now the direct connection from
is not in
and so the ancestor of
GI
a(G I) <- a(P) ,- i ,
onto
P
Assume that we have shown the
with
be any two nodes in
such that
a(P') = O .
G
mI
G = P ,
that:
result for any flow diagram
anomalous.
if
a(P) = a(P,P) .
is a graph homomorphic image of
m
be the entry
i.e. , the number of direct connections between
Given a flow diagram
If
Let
w~ich are anomalous with respect to the whole scheme
We can show by induction on
CLAIM
n .
n ~ let S be the subgraph containing n and all n For &ny subgraph G , let a(G,P) be the number of
n .
anomalous connections in
m
P'
P'
since
[]
can be obtained
by a finite number of applications of the duplicate operation.
4-20
EY~HPLE The scheme in
P
Ln Example IV-2 is not tree-l~e.
(Here we let
A,B,C,D,E
stand for ambitrary assignment statements or sets of assignment statements~ in order to exhibit the structure of the example uncluttered by extraneous formulae. ) The direct connection from the node labelled up to the node labelled does not contain labelled
B
T(x I )
B
and the path START
following
D .
of the diagram, from test anomalous.
A
T(x I)
B
Scheme
A
T(x 2)
P
Scheme
which follows
to test
T(x I)
and from test
T(x 2 )
T(x I)
P'
is formed from
P
A
B
are
A
is not
A .
which follows
C
P'
in Exmmple IV-3,
by duplicating nodes when
is anomalous in
since any connection to
diagram loops back to
E
E For
Thus the direct connection from the node labelled
D , to
is r e ~ v e d and a direct connection to a copy of
need to duplicate
D
T(x I)
to
up to the node labelled
P . B
A
In
P' , this connection
is substituted.
leads into a copy of the subscheme reachable from
T(x 2 )
D
does not contain the node
is a graph homomorphic image of the scheme
anomalous connections occur.
of
T(x I)
is mn ~noest~r of every node in the graph except ST~IRT.
which is tree-like.
T(x I)
A
Similasly the two direct conm.eetions at the bottom
example, the direct connection from test
copy of
following the node labelled
The other direct connections in the graph are not anomalous.
anomalous since
T(x I)
T(x I)
is anomalous since the path START
B
until
A
The copy of
occurs.
must be acceptable{ hence the
Similarly, the anomslous direct connection from the node
to
E
is anomalous and is replaced by a connection to a
and the node following
E ~
T(x 2) ;
the connections from this instance
are now legal and so no duplicates aloe needed.
MAJOR BLOCKS The division of a tree-like scheme into major blocks will be important in the sequel~ so it is ~m~th stress£ng at this pint. scheme.
Notice that the fact that
P
ancestry or dominance ammng nodes of entry node ancestor of
n
P
e .
is tree-like means that the relationship of P
extends to subblocks
a subblock with m
if
n
is an
into blocks w~ich are themselves almost tz~ees -
Let
G
We call
be a graph and G'
m
or
m :
trees
Let us define:
G'
a single entry subgpaph of
a tree ~ith reinitializations if
direct connection from a node ancestor of
be a tree-like program
into major blocks will comrespond roughly spe~kLng to a P
with reinitializations.
node
P
m .
bottom-up parsing of
DEFINITION
Let
is an ancestor of a subblock with entry node
A division of
e
B
We do not
.
n
in
G'
to a node
m
G
with entry
whenever there is a in
G'
either
n
is an
4-21
EZAkE°LE IV-2
A PROGP~/~I SCHEME THAT iS NOT ~REE-LIKE
<,f
START )
i
A
B
F
[c
T<)
T
(
STOP )
4-22
EXAMPLE IV-3
A TREE-LIKE PROCured S C ~ M E
The scheme in Example IV-2 is a graph homomorphic image of tb_is scheme.
r
#
T
F
F
I'
#
T \'
I
F
4-23
Thus a tree with reinitializations is a tree-like subgraph in which we have strengthened the condilions on a direct connection from case
n = m
for
n ~ e
and substitute
"m = e"
for
n
to
" m
m
to eliminate the
is an ancestor of
n "
For example, (i) below is a tree with reinitializations while (2) and (3) are not although t~my are tree-like.
(1)
(2)
e~
e;~
n
n o,~,--
m
!~
(3)
eo
m~'~3
p!---~
mo
p°
1
po
1
A division of
P
into major blocks
(B0,...,Bn)
is obtained by first
isolating disjoint subgraphs which are trees with reinitializations (making these pieces as large as possible) and giving them names a~d placing isomorphic copies last (rightmost) in the list (among
Bn,Bn_ I
etc. ).
Then these subgraphs are
replaced with nodes labelled by their names and b~ving the same entry and exit conditions. applied to
This gives a new tree-like graph
Pi
and the same procedure is
PI' " Tb_is continues until we wind up with some
a tree with reinitializations and then
Pi
is
B0
P.l wh/ch is itself
and the list is complete.
For
convenience in later constructions~ we impose other conditions on our division ((4) and (5) below). Somewhat more formally:
DEFINITION
Let
(B0,...,Bn)
of graphs such that:
(i) each graph
P
Bi
be a block.
A division of
P
into major blocks is a list
is a tree with reinitializations, i.e. a single entry tree-like
graph with each arrow leading either out of the block
Bi
or from a node to
a descendant of that node or from a node hack to the entry node of (2) each node i n a b l o c k
B.
21.
the name of a block
Bj
in
it
Bi
with
j > i
is labelled
with
either
with a statement of
B. i P
i + i -< j -< n , and if the name of
appears exaetly
o n e e and d o e s n o t appear, i n
or with
Bj
appears
Bk
for
k~i
(3) blocks
Bi
can be substituted for their names in other blocks until each
becomes (graph isomorphic to) a subblock of isomorphic to )
P .
P
and
B0
becomes (graph
Bi
4-24
(4) in each block
Bi
every branch from a node labelled with a subblock name
leads either out of the blod<
B. l
or back to the entry node of the block
B. ] B. , i
and (5) any exit arrow from a block i -< j -< i-i ,
such that
name of a node in
Bj
Bi
B. i is labelled either with some block B.] , with is a subblock of Bj (i.e. B i is either the
or the name of a node in a subblock of
B~ ), or else
to STOP.
~Ib.e conver.sion of a tree-lJJ<e scheme into block form given by our algorithm will result into a division into major blocks. Bi
(and we take
B 0 = Be
where
we consider a node
p
descendant of
back to
of
p ,
p
At each stage, if we are considering
is the entry node to the original flow diagram)
such that there is a connection from some node
p ; we can leave in
always select
e
Bi
p ; we take as in place of
p
B
the node
p
P a node labelled
to be as close to the em~try node of
Bi
m , a
plus all descendants Bp
Since we
as possible, condition
(4) of the definition of major block will be automatically satisfied. We always try in a division into major blocks to make the individual subblocks as large as possible, and the number of subblocks as small as possible, consistent with conditions (i) - (5).
Our, algorithm will also make our subblocks as large as
possible.
COROLLARY 4.7
Every tree-like scheme can be divided into major blocks.
Example IV-4 gives a division of the scheme of Examples IV-2 and IV-3 into major blocks.
Exit nodes in these diagrams are those with arrows leading to figures
which indicate the connections in the larger diagram. labelled graph
Bi11
B0 ;
Thus in
which has both an exit back to the entry of
the former appears directly on the diagram of
corresponds to an arrow directed to
[B0] V
connections a_~e J~ndieated by arr
~
or
B
BII
BII BII
while the latter
On the diagram of ~
and one to
there is a node
and an exit to
Bi11 , both ~
will be explained and used in section H of this
chapter and should be ignored at present
4-25
EXAMPL~ IV-4 THE SCHEME OF
BLOCK STRUCTURE EXAMPLE IV-3 DIVIDED INTO HAJOR BLOCKS
BLOCK B0 START
)
A
E---\ TC
( N--
!
( Bll
,1
STOP
,) ,,)( STOP
)
B2
,.I
,I\
STOP )
4-26
CONTINUED
EXAMPLE IV-4
THE BLOCK STRUCTURE OF EY~KPLE IV-3
BLOCK
BLOCK
BII
,I
/
rT/~ !
/ C
Mi )
( s~oP )
Bi11
4-27
CONTINIIED
EXAMPLE IV-4
THE BLOCK STRUCTURE OF EXAMPLE IV-3
BLOCK
B2
BLOCK
\
\
F
/
\ STOP
/
I B21
__w
c~
B21
4-28
EXAMPLE IV-4
BLOCK BI2
CONCLUDED THE BLOCK STRUCTURE OF EXAMPLE IV-3
~I
BLOCK BI21
'
!
c
I
< stop}
<--~ F
<s~P}
<>,
>E>
4-29
C.
t~
a particular canonical form for schemes,
namely block structured schemes, £n w ~ c h in a tree-like fashion.
the program is built in modules connected
In this section we carry this idea one step forward and
exam~_ne schemes written in a "line-like" form
-
the so-called "%~K~ILE schemes" or
"GOTO-less schemes '~. The role of the "GOTO" statement has caused considerable controversy among progra~r~ing language experts.
Essentially such a statement is a transfer
(conditional or unconditional) which allows an exit from any part of a block to any other block or even into the middle of a block.
This feature can be extremely
convenient in constructing the program or algorithm~ but equally inconvenient when it comes to documentation of program behavior or analysis of program structure. We shall not discuss here whether programm/ng languages should or should not allow unrestricted "GOT0s". side.
We only make a few comments on the formal, mathematical
There is no doubt that " ~ I I Z schemes" are more elegant, easier to describe
and possibly easier to document.
As we shall see in the next chapter, they possess
certain formal advantages for program verification methods. we shall see shortly
-
However, since
-
as
they do provide a canonical form for schemes, restricting
programs to this format does not affect the decidability or undecidability of various problems.
Any property undecidable for general program schemes remains
undecidable for WHILE-schemes. There is no way to c ~ g e
undecidable properties to decidable properties
without a loss of power of expression.
So that sort of consideration cannot be ~n
ar~mment for or against the use of any particular canonical form.
However, when the
property happens to be decidable in general or for a particular subclass, use of a particular format may make life easier.
Fur~her ~ although WHILE schemes form a
c~nonical form for the whole class of schemes, they do not do so for many subclasses. Tbmt is, if we have a canonical transforma±ion
t
for a canonical form canonical form, then
~ t
may indeed be members of ~
~I
, and
~i
is a proper subset of
may not map members of ~i
~i
£nto
~i
that is NOT a ~
~I
and there
which are not strongly equivalent to any member of
" As we shall see, this is certainly true if
schemes, and
~ ~
-~
is the class of WHILE
the class of s£ngle variable schemes.
Finally, any format that does indeed assist program documentation should be given serious consideration.
?~metimes it is harder to determine how to use an
existing program or subroutine t ~ l
to construct a new one!
4-30
We shall give a definition of a "simple" WHILE scheme and then see that it must be enlarged somewhat to provide a canonical form.
Our definition is an
inductive one, like the definition of a block.
A WHILE scheme is a particular kind of single entry single exit subgraph.
DEFINITION subgraph
A single entry single exit subgraph of a graph G'
with a single exit node in
G'
G
is a single entry
such that:
(i)
For every node
(2)
There is no direct eonnection from any node in in
n
d
there is at least one path from G' - {d]
n
to
d .
to any node
G - G' .
DEFINITION
A subgraph
G'
of
G
is zero exit or closed if no arrow leaves
it is zero entry if no arrows enter
G' ;
G' .
As we give our definition of a WHILE scheme in graphical form, we shall simultaneously give a definition in a simple programming language which has as basic instructions: assignment statements START
and
STOP
statements
both positive and negative test statements NOT
-
T(Ul,... ,un)
and
T(Ul,... ,un)
and has three rules of composition: block or linear composition IF
...
WHILE
THEN ...
DO
... ...
ELSE
...
ENDIF
or
IF
...
THEN
and
FALSE .
ET~©IF
and
F
~wHILE
In this and the next chapter we let our tests have as outcomes TRUE
...
T
or
4-31
DEFINITION OF WELL-STRUCTURED SUBSCHEME
(i)
The following are well-structured subschemes:
< sTT ) ,
! C ;;o~ )
START
where
A
l $
S%!DP
is any assigrment statement and NULL
stands for any identity instruction such as
A
NULL
-
the straight arrow
-
u ÷ u . All are single entry
single exit blocks; the STOP statement is, of course, a zero exit block, and START is zero e~nt~y.
(A NIJLL node by convention disappears when
followed by any other node.)
4-32
(2)
If
BI
and
B2
are well-structured
is not zero entry, Then B 3 , is a ~,~ll-struct~oreed
subschemes,
BI
is not zero exit and
the block or chain composition of
su~seheme,
zero entry if
BI
BI
is so and ze'_~o exit if
is so.
B3 I
I
I
I B2 I
i In our "progrmmming language"
B3
is wmitten as:
BI or B2
BI ~
B2
and
B2 B2 B2
4-33
(3) If Q is any m-placed predicate letter, ~ = (Ul,....um) is any vector of m variables~ BI and B2 are single entry single exit well-structured subschemes and neither BI nor B2 is zero entry (begins with START) nor zero exit (ends with STOP), then the following IF-THEN compositions, B3 , B4 and. B5 ar~ well-strue~ared single envy sLngle exit subsehemes:
B4 ~
\!
B3
r~)~~
B5 ~ ~ ) ~
F
l
BI
B3: IF Q(u)
I
B2
'IHEN BI ELSE B2 ENDIF
\~
\/
\'
\/
B4: IF Q([)
THEN BI ENDIF
OP
IF N0~f Q(u) THEN B2 ELSE BI ENDIF
B5: IF NOT Q(u) THEN B2 ENDIF
4-34
(4)
If
Q
is any m-placed predicate letter,
variables~ and
B
~ = (Ul,... ,um)
is any vector of
m
is a single entry single exit well-str~ctured subscheme
which is not zero entry or zero exit, nor null then the following WHILEcompositions
BI
and
B2
are single entry single exit well structured
subscheme s :
t
)
B
.)
I
BI:
~]I~
q(u)
DO
B
I
~QWHILE
B2:
WHILE
NOT
Q(u)
DO
B
FA~D~ILg
~--35
Finally we can define:
DEFINITION
A finite graph or subscheme is well-structured if it can be built out
of the basic blocks in (i) by a finite number of applications of chain (block) composition,
DEFINTION
IF-THEN
composition and
WHILE
composition.
A simple WHILE progrmm scheme is a program scheme whose graph is
well-structured.
We shall usually describe %,~ilLg~ ~ schemes in terms of our little "programming language". language.
Notice that there is no need to provide semantics for our p r o g r m ~ g That is already done by the correspondence with the grapllical form whose
semantics have been given in detail. WHILE program scheme and
I(Q)
-
DEFINITION of
P
If we are given an interpretation
I
then we can substitute the interpreted functions
for a -
l(f)
into our language as well as into the graph representation.
If
P , then
P
is a simple W~ILE program scheme and
(P,I)
I
is an interpretation
is a simple WHILE program.
Our next main task is to consider extensions to our language.
Y~st of these
extensions are a matter of convenience but one of them does add expressive power. First, however~ we shall digress a little to provide an equivalent graph oriented definition of a simple WHILE scheme.
Just as we saw that a block could be defined
as a single entry tree-like flow diagram, so we shall notice that a well-structured subseheme can be defined as a single entry single exit line-like flow diagram. Readers uninterested in graph considerations can skip this section.
D.
L]]\FE-LIKE SUBGRAPHS First we add to the previous concept of ancestry or d o n a t i o n
the concept of
back domination and co~Jnine the two in the concepts of chain domination a~d of cycle domination.
These ideas also play an important role in graph oriented discussions
of program optimization.
DEFINITION exit node
Let d .
G
be a single entry single exit subgraph with entry node
For any nodes
(i)
n
dominates
e
to
(2)
n
back dominates
n
bdm),
m ,
m
( n
(abbreviated m
n
and
m
in
is an ~ncestor of
if
e
and
G , we say that: m )
if
n
n
d
n
lies on every path from
lies on every path from
m ) , m
to
d
(abbreviated
4-36
(3)
n
chain dominates
(abbreviated (4)
n
n
m
ch
cycle dominates
(abbreviated
n
if
n
m ) , m
ey
if
dominates
m
and
m
back dominates
n
and n
both dominates and back domJmates
m
m ) .
The concept of "back dominates" is really the reverse or "dual" of the concept of "dominates" or "is an ancestor of" in the sense that in graph entry n
e
( m
of
and single exit
d ,
n
is an ancestor of
n )
in the graph
G , making
d
back dominates
the entry and
e
G'
m
G
with single
if and only if
m
domir~tes
obtained by reversing the arrows
the exit.
Chain domination and cycle domination are illustrated below.
e.
e.
e.
~
~
k~o
p,
P'~I
m~
m~; --j
~
--m,
n
e
~
_
chain dominates
n k,; f
~
m
• ~
n
cycle dominates
p'
m
I
m
Using Lemma 4.1 and the "duality principle" (i.e. that domh~ation and back domination can be exchanged by reversing the directions of all the arrows on a single entry single exit graph) we have the following len~na.
4.8
The relationships of domination, back domination, chain domination and
cycle domiration are transitive.
Again using the duality principle, Lenma 4.2 becomes the following lemma.
LEMMA 4.2'
(a) If
from
n
m
(b)
If
.from m
to n to
n
dominates
back dominates n
m ,
not passing through m ,
n
not passing through
n
also dominates every node on every path
n . also back dominates every node on every path n .
Lenmms 4.8 and 4.2' can be used to s~mw the next results; the proof is left to the reader as an exercise.
4~37
LD{~A 4.9
Let p
G
be a graph with single entry
n,m
and
(i)
If
n
and
m
dominate
(2)
If
n
and
m
back dominate
dominates (3)
If n
(4)
e
and single exit
d .
For nodes
the following hold. p ,
either p ,
n
dominates
either
n
m
or
m
back dominates
domimates m
or
n .
m
back
n .
m
and
p
are directly connected to
n
is directly connected to both
n ,
m
and
p
cannot both dominate
p ,
m
and
.
If
dominate
m
and
p
emnnot both back
n .
Now we are ready for a formal definition of "line-like".
DEKNITION
Let
exit node (A)
d .
G
be a single entry single exit subgraph with entry node
Them~ G
n ~ m
and
chain dominates
m ,
or
(2)
n
cycle dominates
m ,
or
(3)
m
cycle dominates
n ,
or
(4)
n
dominates
dominates m
m
m ,
m
n
n
is directly connected to
p
such that
n
chain dominates
p
and
n
but does not cycle dominate
n
nor does
q
such that
n
~id
q
p
m
and
back
n
chain
chain dominates
m
and
n .
n ,
m ,
cycle dor~inates
and m
p , or
m
if
m
both cycle dominate
cycle dominates
p
n .
We can illustrate these concepts with some simple examples. graphs
m
or
and there is a node
dominates
for any nodes then
such that
but does not chain dominate or cycle dom/nate
back dominates
dominate q
m
and either
n
there is a node
(B)
n
(i)
(5)
and
is line-like if:
for every pair of nodes then
e
Each of the
(i) - (5) below are "line-like" and in graph (i) the direct connection
(arrow) from
n
to
m
satisfies condition
(i) of part (A) of the definition of
line-like.
e
e
e e
(i) n
n~
~.___~
m.
~
c~ha~n dominates
m
(2) n
cycle dominates
m ~._~,,n
m
(3) m
c~cle dominates
n
4-38
e
(4)
e
e
n
dominates
n
chain dominates
m
(5) p m
m
back dominates
q
chain dominates
n m
p
back dominates
q
dominates
n
does not back dominate
m
n
does not dominate
n m
m
does not back dominate
n
m
does not dominate
n
It is clear from inspection that graphs (i) - (3) above are blocks but (4) and (5) are not.
We shall see in the proof of the next le~ma that condition (i) of part
(A) of the definition of line-like corresponds to block composition, the WHILE construction necessitates conditions (2) and (3), and the I F - T ~
construction
requires (4) and (5); el£minating the IF-THEN construction would yield a much neater definition of line-like.
By way of contrast, here are three blocks (tree-like
graphs) which are not line-like:
e
~ me
pl----..n
(6)
(7)
(8)
In all three, the trouble lies in the connection from of (dominates) (6),
m
n
(7), n
to
m m
to
m ; m
so the definition of tree-like is satisfied.
chain dominates
so the arrow from
n
n
n ,
n
cannot dominate
m
nor can
is an ancestor
However, while in m
back dominate
to
m
violates part (A) of the definition of line-like.
chain dominates
p
and
p
cycle dominates
n ~
but again the arrow from
cannot satisfy any of (i) - (5) of part (A) of the definition of line-like.
On the other hand, (8) satisfies part (A) of the definition of line-like donates
p
and both
m
and
p
cycle dominate
the definition of line-like since neither of other.
n , In
m
n . and
p
-
m
chain
But (8) violates part (B) of can cycle dominate the
The situation illustrated in (8) is the reason for part (B) of the definition
of line-like~ graph (8) eannot be ~ne graph of a T~ILE sohem~.
4-39
The proof of the first half of our oh~raoterization theorem is not difficult. The demonstration that a well-structured subscheme is line-like
clearly motivates
the definitions of chain dom~mtion and cycle domination.
L ~ I A 4.10
A well-structured subscheme is line-like.
PROOF It is obvious that the basic blocks in paz~t (I) of the definition of wellstruotmoed subscheme are line-like, if we allow the NULL node graph to be so described.
We need only examine the three forms of composition of blocks in
(2) - (4) of the definition of well-structured, to see that they take line-like graphs into line-like graphs. In (2)
B3
is the block or chain composition of
direct connection added is from the exit node B2 .
The only entry to
the only exit from dominates
~
BI
e2
in
B3
B1
is from
of
dI
so
is via the con_nection from
and in fact all of
is line-like if
dI
and
B2
B1 .
Hence
and
~
to the entry node
dI dI
dI
~
dominates
e2 ;
e2 ~
e2
to
is formed by connecting a query node
entry node
e2
of
p
and
eI
e2
but neither (of
dominate d2 p
eI
or
q
chain dom/m~tes
of
similarly back
e2 .
Thus
B3
dI
of
B1
which is now the exit for and
e2 )
eI
and the eormeetions from
q
and to
e2 eI
and finally
and
e2
q p
eI
and
B3 .
back dominates
e 2 . However~ the common exit node
by definition and hence
In the first subcase
to the entry node
B 2 , while the exit nodes
connected to a NULL node
so
e2
are so.
There are 3 subcases in (3); we only examine the first. BS
B 2 . The only
of
d2
~
of
_Then q
and the B2
nor does
q
q
e1
back
back dominates
q . Thus
are
dora/mates
dI
and
chain dom~ates
satisfy (4) of part (A) of the
definition of line-like while the connections from
dI
and
d2
to
p
satisfy (5)
of part (A) of the definition of line-l~_ke. Finally the two compositions in (4) are graphically similar, and so we discuss only the first.
Graph
B1
is formed by connecting a query node
to two nodes, the entry node for
B1 {
enter so q ;
q
B1
the exit node from
dominates thus
q
q
and e
d B
and
of
B
and the NULL node
q
e
of
p
B
is directly connected hack to
a branch node
which is the exit q . We can only
can only be entered by the connection from d .
back dominates
We can mnly leave e and
d . Hence
B q
q
to
e ,
via the connection from. d cycle dozdmates
e
and
the connection from
q
to
e
satisfies (2) of the definition of line-like while
the connection from
d
to
q
satisfies (3). Notice that
exit node
p ~
exit node to
alternatively one might omit
B1 .
p
and regard
q
to
d
chain dominates the q
as both entry and
4-40
Block composition, domination
(2), and IF-THEN composition,
(3), do not affect cycle
so we need consider part (B) of the definition of line-like only for WHILE
composition,
(4).
But the query node
the only cycle dominations added in line -like.
q BI
cycle dominates all of so if
(B)
B
and these are
is line-like then
BI
is
•
To reverse Lermm 4.10, we need a few additional .implications of our definitions. First, we have a result true for any single entry single exit graph
G .
LEMMA 4. ii
e
d .
Let
(i)
If
Let n,m
n
(2)
If
n
and
If
n
ch
(4)
If m
be a single entry single exit graph with entry
and
p
m
and
cy
(3)
G
m m
n
and
cy
n .
be three different nodes in m
oh
p ,
then
n
G .
cy
p ,
oh
p ,
then
n
ch
m
or
m
ch
p .
and
p ,
then
m
eh
p
or
p
ch
m .
cy
p ,
then
n
ch
m
or
m
ch
n
m
and exit
or
n
cy
m
or
PROOF Part (i) is an obvious consequence of Len~a 4.8 and the definitions of chain and cycle domination. n d m
or
m d n .
path from
e
to
n
~mve this property). from
n
to
through
d
p .
In (2~, if
n eh p
and
The cases are sy~netrie, not passing through If
m
mch
p ,
so suppose
m
m
;
Thus there is a
(the shortest path from
did not back dom/nate
not passing tb_~ouy~
by Lemma 4.9(1) either n d m .
since
n ,
p bd n
e
to
n
must
then there would be a path this path would pass
Putting the two paths together we would get a path from m d p .
Hence
e
to
m bd n
p
passidg through
m ,
contradicting the fact that
clnain dominates
m .
ZY:en (3) is obtained by the dual of the arguments in (2);
not
and so
n
details are left to the reader. Finally, for (4), notice that if n
and
m
d©minates n .
n
dominate and back dominate m
or
m
dominates
n
and
p .
and
n
m
both cycle dominate
p
then both
Thus by Lem~m 4.9(1) and (2), back dominates
This yields exactly the four possibilities mentioned
m
or
m
in (4).
n
back dominates •
Notice that part (B) of the definition of iLne-like is needed to eliminate two of the four possibilities mentioned n
and
m
cycle dominate
p ,
then
in L e ~ m n
4.11(4).
If
cycle dominates
G m
is line-like and both or
m
cycle dominates
n . We wish to show that if is well-structured.
P
is a flow diagram with a l£ne-like graph, then
The plan of attack is to divide
P
pieces and proceed by induction on the number of nodes in the graph of facilitate this division of
P ,
P
into smaller line-like P .
To
we introduce another definition a~nd a:qother leu~a.
4-41
DEFINITION
For nodes
and
m
in a single entry single exit ~raph, let
S(n,m)
=
{n,m} t; {k ! n
Let
G
be a single entry single exit line-like graph with entry
LEMMA 4.12 and exit
n
d .
Let
clnmLn dominates (i)
S(n,m)
(2)
If
n
and
m .
m
domZJnates
and
and
m
back dominates
be distinct nodes such that either
n = m
k}
e
or
n
Then :
is line-like with single entry
n ~ m
k
e ~ d ,
S(e,n)
n
and single exit
m .
Fh S(m,d) = ~ .
PROOF Whether, by
n
n : m
or
n chm
rand every member of
S(n,m)
has single entry
back dominance true in satisfies
(B)
Let
r
n G
and
s
it does so in
dominates
(AS)
s ,
If
m .
are certainly true in
be in
S(n,m)
r
is dominated
- {n)
m
.
All relations of dominance and S(n,m) G
.
Clearly
S(n,m)
does.
with a direct connection from
r
.
So it rezmins to consider (4).
chain dominates we c~n~not have
p
and
r = n
of the definition of line-like.
p
G
rcy
r ~ n ,
s
m
and
p
n ~ m
n
s .
r
dominates
dominates
m .
p ~
r
r .
If
m
by Le~ma 4.9~
to
G
d
in
by Lermm 4.2',
Hence the arrow from
r
r
must go
to
s
I~nee we can conclude that in all cases e ¢ d ,
and
S(m~d)
.
Then
since
n
domS_~tgs
Similarly, k ,
m
violates
m
k
n
chain dominates
is not m
dominates
e ~
rand m k
also cycle dominates
n ,
m
k
m
k ~
by Lenmm 4.8.
But Thus
p
n
chain (4) of
Now assume that
is in both
S(e,n)
back dominates
k
n
and
k n
and
and
by L~n~na 4.8. back do~rinates
chain dominates
S(e,n)
m .
p .
cycle dom~_nates
n
is in
still satisfies
k
as in m .
and thus
r
is line-like.
back dominates
(B) of the definition of line-like.
p ,
instead of
Thus n
S(n,m)
back dominates
Thus
S(n~m)
Suppose
d .
p
r
is in
chain dominates
m .
m
S(n,m)
m .
or
dom~'nates
and since
in.
and
p
r - m - p - d
dominates
now using
r
and thus
back dominates
Other~Tise~
part (A) of the definition of line-like,
n ~ m ,
p
n
r
We consider two
cycle dominates
cycle dominates
then by hypothesis,
back dominate
and again we are done.
Hence the shortest path from since
If
which already satisfies
and so the definition of line-like is satisfied ~_n
S(n,m)
s .
such that
S(n,m) = S(n,n)
On the other hand, if
n
in
back dominates
or else
So
By Lemma 4.11~
p
p .
Now both
to
(4) and (5)~ by the duality
There is a node
chain domi~mtes
G .
~mas
(1) 2 (2) or (3) of part (A) of the definition of line-like in
S(n,m)
n = m
S(n,m)
is back domJ_nated by
and single exit
principle we need only consider
oases.
every member of
of the definition of iLne-like if
this arrow satisfies G
~
S(n,m) - {m}
m
F] S(m~d) = ~ .
which m
4-42
Now we are ready for the main le~ma.
LEMHA 4.13
Let
P
be a flow diagram whose graph
single exit graph with entry node
e
labeled with a STOP statement or P
is a well-structured
G
and exit node
d
is a line-like d ,
single entry
such that either
has exactly one are leading out of
d
G .
is Then
graph.
PROOF We proceed by induction on
#G ,
the number of nodes in
G .
If
G
has only
one node, this node carmot be labeled with a test statement or else it would either have too arcs leading out of
G
or else there would be a self-loop which is
forbidden by the definition of llne-like.
Hence, the lem~m is true for
#G = i .
Now suppose we have established the lemma for graphs with fewer than and that
#G -> 2 .
assume that
We consider two main cases,
node.
e = d .
Then
e n
First suppose that
is directly connected to exactly one node and
structured and
G = {e} k) S(n,d)
e
is not in
.
S(n,d)
The
#G
nodes
First let us
the induction hypothesis
S(n,d)
n .
e
is not a branch
Clearly
e
chain
subscheme corresponding to {e} is well-
which is iLne-like by Lemma 4.12.
the block composition of the subschemes correspond~ig
P
and
e ~ d .
There are three subcases to consider.
dominates
e ~ d
corresponds
to {e) and to
to a well-structured
Thus
S(n,d)
.
P
is
By
subgraph, and so
is well-structured. Now assume that
and that
e
suppose
e
is a branch node directly connected to nodes
cycle dominates one of the two nodes.
e
cycle domirmtes
containing
n
m ,
those path must go
such path, a contr~adiotion. chain dominates
n
and
n
F~ S(n,d) : % •
and so either a path from
n = k m
to
or e
S(e,e)
e - m-
chain dominates
n
k ,
dominates
and so is in S(e,e)
and
e - d
Thus every path from
For any node
is a chain connection of h~i~othesis to
If there is any path from
consider the shortest such path{ it must go
back dominates
S(e,e)
m .
and
S(n,d)
k
S(e,e)
d ,
e
e
to
d
m so
not
e - m - d .
d
By L ~ k
and
k
is in
.
Thus .
and
Since
e
and thus there is a shorter to
either
S(n,d)
n
The arguments are symmetric,
contains
n
and
e
4.12,
lies on a path from S(n,d)
or else
G = S(e,e)
<] S(n,d)
n
to
d
k
lies on
and so
G
Thus, applying the induction
~nieh are line-like by Lemea 4.12,
P
is well-
structured. Finally assum~ ~hat cycle dominates neither n
m
is directly connected to nodes nor
m .
By Lesma 4.9,
so suppose
e
does not chain domSmmte
like, there is a node
p
such that
m
and
e n
and hence
n .
chain donJ_nated by
e
and
m
and that
cannot chain dominate both
m .
By the definition of line-
chain dominates
p
Suppose there is more than one such node e
n
e
and p .
p
e
hack dominates The set of nodes
mast be itself a chain by Lemma 4.11(3) and so let
p
be the
4-45
least u p p e r bound o f this set or
p
(i)
chain do ~minates S(n,p)
gh S(m,p)
Suppose dominate
k
k .
p'
k
goes
i.e., if
e
chain dominates
W e establish the following
p'
s~le
then
p' = p
observations.
= {p}
is in
S(n,p)
Either
n
arguments are similar~ to
-
.
~
S(m,p)
dominates
suppose
e - n - m - k .
n
m
and or
k ~ p .
m
Thus
dominates
dominates
m
.
n
m
m
both
by Le~ma 4.9.
T%e
Then the shortest p a t h f o o m
But using the direct connection
can get a shorter such path, a contradiction.
and
Hence
k
from
e
to
m
e we
cannot exist and we have
shown (i). (ii)
S(e,e)
-- {e)
Suppose containing
k k
is in
S(e,e)
and
must go either
are sim±lar so suppose it goes path must go
= {e} .
(iii)
Either
n = p
S(m,p)
N
Suppose
or
S(p,d)
n ~ p
and
p
dominate
p .
By h y p o t h e s i s
and thus also
p
n .
or
e - m - k - d ; Since
e cy n
gh S(p,d)
e
e
to
back dorm~nates
c o n t r a r y to hypothesis.
= {p} ;
either
d
the arguments
m = p
k
this
~us
or
: {p} . k
is in
Now
p
S(n,p) fh S(p,d)
cannot dominate
back dominates
Hence
e
o f nodes chain dominated by (iii) is established
and so
S(n,p)
and
k .
The shortest p a t h f r o m
e - n - k - d .
e - n - k - e - d
S(e,e)
k ~ e .
e - n - k - d
e~in e
e
n ,
k ~ p .
n = p ,
n .
Thus both
so b y Lemma 4.9,
so every p a t h f r o m
dominates
so
for
But
e
p
to
n d
n
dominates contains
p
is the least u p p e r bound
a contradiction.
The other half of
similarly.
By similar r e a s o n i n g to the arguments
for (i) - (iii) w e can show (iv) and (v);
the p r o o f is left to the reader as a n exercise. (iv)
If k
(v)
k
G : {e} Let
for
can be r e a c h e d from both
~d S(n,p)
S' (n,p)
S'(m,p)
.
and
m
,
either
k = p
or
If
n ~ p ~ m
of
{e}
,
Y
,
G
p
p = m
Finally if
.
e = d
n .
Then
so we are done.
T H E O R E M 4.14
S(p,d)
dominates
.
S'(m,p)
to
S(p,d)
connection of
Hence
P
{e}
e ey n
;
for
and
and similarly
S'(n,p)
subschemes,
~nd
G
e
n = p , S'(m,p)
is w e l l - s t ~ u c t u r e d
t h e r e is ~ n arc f r o m
and
as does
G
to
S'(m,p) S(p,d)
P
.
comnection
is the chain S(p,d)
,
and
in this case too.
leading out of
G
is the W H I L E connection of
a n d one f r o m {e}
and
m
A p r o g r a m scheme
graph is line-like.
p
is b y (i) - (v) the chain connection o f the I F - ~ and
connection of the I F - T H ~
to some node
U
and so c o r r e s p o n d to w e l l - s t r u c t u r e d
S'(n,p)
similarly if
S(m,p)
be o b t a i n e d by substituting the N U L L node for
Similar to Lemma 4.12, it can he shown that
are line-like,
S(n,e)
n
.
is a simple W H I L E scheme if and only if its
e
4-44
E.
E~SIONS
OF THE DEF~-ITION OF A %££ILE SCHEME
We now consider some extensions of our definition, which depend on enlarging the definitions of functional terms and predicate terms.
Extended Functional Term
-
defined inductively:
(i)
If
x
is a variable,
x
(2)
If
e
is a constant symbol,
(3)
If
f
is an n-placed function letter and
functional terms, then
is an extended functional term. c
is an extended 9mnctional terms
f(tl,... ,tn)
tl,... ,tn
are extended
is an extended functional term.
Extended Predicate Term: If
Q
terms, then
is an m-placed predicate letter and Q(tl,... ,tn)
and
(NOT
t I ,... ,tn
are extended functional
Q(tl,... ,tn)) are extended predicate terms.
Boolean Expression Any connection of extended predicate t e r ~ using
AXD
and
OR
( A
and
v )
is a Boolean expression.
First let us consider some partial extensions which do not increase the expressive power of b~ILv schenms.
PROPOSITION 4.15 Adding the following constructions to the definition of a wellstructured subscheme does not increase expressive power.
(i)
Extended Assignment Statements : If
t
is an extended functional term and
u
is a variable, the following can
be considered to be a well-structured subsoheme:
(Proof is obvious) (2)
and
Simply Extended If
t!,... ,tm
BI
and
B2
IF-THEN
and
WHILE
Constructions :
are extended functional terms,
Q
is an m-placed test letter
are well-structured subschemes, the following can be considered
to be well-structured:
4-45
IF
Q(tl,...,t m)
~
BI
ELSE
C2:
IF
Q(tl,...,t m)
THEN
BI
~NDIF
C 3:
IF
NOT
WI:
~HILE
W2:
~t)~ILE NOT
Q(tl,...,t m) Q(t l,...,t m)
TPm~g BI DO
BI
Q(tl,...,t m)
B2
E~DIF
EROIF
~ND)~ILE
DO
BI
~NEWeK~ILE
(Proof is obvious)
(3)
Extended If
Q
IF - THEN
Constructions
is any Boolean expression and
BI
and
B2
are well-structured
subschemes the following can be considered well-structured:
IF
Q
THEN
BI
ELSE
IF
Q
THEN
BI
ENDIF
B2
ENDIF
Tb~s can be shown by induction on tlne number of connectives by noting that:
IF
QI
OR
Q2
THEN
BI
ELSE
B2
ENDIF
is strongly equivalent to:
IF
QI
THEN
IF
QI
AND
BI
ELSE
IF
Q2
11~
B1
ELSE
B2
ENDIF
ENDIF
and
Q2
THEN
BI
ELSE
B2
ENDIF
Q2
THEN
BI
ELSE
B2
is strongly equivalent to:
IF
(4)
QI
THEN
IF
Partially Extended If
ENDIF
ELSE
B2
E~DIF
~Pm~LE Construction :
QI '" "" 'Qn a_~e extended predicate terms and
B
is a well-structured
subscheme, the following can be considered a well-structured subscheme:
~ILE
(QI
OR
T~is is easily shown. strongly equivalent to:
Q2
OR
...
OR
Qn ) DO
For example, we note that for
B
E~'D~ILE n : 2 , this statement is
4-46
WHILE
QI
DO
B
ENDWHILE;
WHILE
Q2
DO
B ; WHILE
DO
Q1
B
ENDWHILE
E I ~ H I LE
We should like to allow the use of arbitrary Boolean expressions in constructions. language.
This does represent an extension of the power of our programming
Consider the pmogram scheme
in our language
P
We claim that Suppose
P
whose graph appears in Exmmple IV-5
becomes :
START ; WHILE
scheme.
WHILE
P P
Q(x)
and
T(x)
DO
x ÷ f(x)
ENDWHILE ;
STOP
is not strongly equivalent to any simple WHILE progaam is strongly equivalent to a simple WHILE scheme
assignment statements.
P'
with
N
In a simple WHILE scheme we do not allow extended functional
terms or extended predicate terms.
Any step of a computation under, a free
interpretation in such a scheme can increase tlne length of the value of a variable by at most one letter.
First consider, the free interpretation
l(Q)(x) = l(T)(x) = I(Q)(fn(x)) = I(T)(fn(x)) : TRUE l(Q)(~+2(x))
= I(T)(#N+2(x)) : FALSE .
(P' ,l,x) must halt with output must certainly construct statements.
~+2(x)
#N+2(x)
for
I
such that
i -< n -< N+I
and
Under this interpretation computation .
In order to do so, the computation
but this will take at least
Thus there must be a time, before any value
N+I
~+l(x)
assignment has yet been
constructed, when the computation passes twice ~Jnrough the same assignment statement.
Since
construction.
P'
is a WHILE scheme this ean only occur by means of a WHILE
7~nat is, at sem~e time when all the value of the variables to date
are of the form
val(y) : x
or
val(y) = fn(x)
for
I -< n s N , the computation
enters some WHILE construction, passes the test, goes around the loop, re-enters, passes the test and repeats the loop.
Since
P'
is a simple WHILE scheme, this
construction must he of one of the forms:
(i)
WHILE
Q(u)
DO
B
(2)
WHILE
NOT
Q(u)
(3)
WHILE
T(u)
DO
(4)
WHILE
NOT
T(u)
Since the treatment of first two cases. II(T)(E) : I(T)(E)
Q
ENDWHILE DO
B
B
ENDWHILE
ENDWHILE DO
B
END~]ILE
and
T
in
P
In the first case, let and
II(Q)(E) = TRUE
is syn~netric, we need only look at the II
be the free interpretation defined by
for all memfoers
E
Of the domain.
When
4-47
EXA}JPLE IV-5
A SCHemE NOT STRONGLY EQUIVALENT TO ANY SIMPLE W~HIIZ S C H ~
START )
V F
T
% ( ~o~ )
x
÷
[
START >~LILE Q(x) STOP
AND
T(x)
DO
x + f(x)
ENDWHILE
f(x)
4-48
computation
(P',l,x)
were of the form
entered tb/s 9~ILE construction, all values computed to date
val(y) : x
point computation
(P',ll,x)
or
val(y) = fn(x)
construction with the same value of trapped since computation.
II(Q)(E) = TRUE However,
for
n s N , and so up to this
follows the same path and enters the WHILE u .
But now computation
everywhere; thus
(P,ll,X)
halts ~ t h
(P',ll,X)
(P',ll,X)
is
is a divergent
val(P,ll,X) = val(P,l,x) = ~+2(x)
.
So case one is impossible~ the argument for case three is similar, using free interpretation
12
defined by
E . The second case 0 s n s N
and so
12(Q)(E) = I(Q)(E)
and
is Lmpossible, since at this point
NOT
Q(u)
I2(T)(E) = TRUE for all val(u) = fn(x)
is false and the loop is not entered; similarly for
the fourth case. Hence
P
is not strongly equivalent to any simple ~^~!LE scheme.
Thus allowing
arbitrary Boolean expressions in WHILE constructions does indeed extend the power of our language. We now extend o ~
defLnition of a WH~LE scheme.
convenience in terms of our language.
We phrase the defLnition for
The semantics should be obvious from the
previous graphical defintions.
DEFINITION
Let us consider the following constructions acceptable:
(i)
Any START statement; any STOP statement; any assignment statement
(2)
Any statement
where
u
is a variable and
IF
Q
THEN
BI
IF
Q
%I4EN BI
ELSE
t
B2
u÷t
is an extended functional term.
ENDIF
or
where
Q
ENDIF
is an Boolean expression and
BI
and
B2
are acceptable
constructions. (3)
Any statement
}lilLE Q
where (4)
Q
DO
B
~N~YrZ[LE
is any Boolean expression and
B
is any acceptable construction.
[~uy construction BI ~ where
BI
B2 and
B2
are acceptable consi_~uctions.
4-49
DEFINITION
A finite sequence of acceptable constructions starting with START and
ending with STOP and containing no other START or STOP statements is a WHILE scheme. If
P
is a WHILE scheme and
I
an interpretation of
P , then
(P,I)
is a
~{ILE pro@ram or structured pro@ram or GOTO-Iess\PROGR6/~.
F.
WHILE PROGRAMS, STEP PROGRAMS, AND PRIMITIVE RECURSIVE FUNCTIONS We shall see that there are several senses in which WHILE programs and WHILE
schemes are universal.
We first exmmine the "wemkest" sense
-
the fact that
WHILE programs can do everythin~ that ' ~ i n g machines can do. We can use some elm~antary facts from recursive function theory to show that every partially computable or partial reetmsive ftmetion from nonnegative integers to nonnegative integers can be computed by a WHILE progra~ of a particularly simple form.
This result can be extended to functions computable over other domains by
standard encoding techniques. A particular subset of the total rec~0sive functions, the primAtive recursive functions, can he computed by a special type of WHILE program, a STEP program or LOOP program.
We define a STEP construction:
STEP
u
DO
B
E~STEP
as the particular 9~{ILE constr~action:
v÷u
where
v
~ k~ILE
v ~ 0
DO
B ~ v÷v
- i
ENDWHILE
is a new variable and a loop results if the value of
nonnegative integer.
v
is not a
A STEP program or LOOP progr.am can be defined by restricting
interpretations to the nonnegative integers and replacing the W~ILE construction (3) in the definition of acceptable construction by (3) where
B
STEP
u
DO
B
~TEP
is an acceptable construction.
DEFINITION
The operation of primitive, recursion defffmes from functions
the function
f
by the formula :
f(0,x2,...,xn) f(x+l,x2,...,xn)
:
h(x2,...,xn) =
g(x,f(x,x2,...,xn),x 2,...,xn)
h
and
4~50
Notice that
f
can be defined from
h
and
g
by primitive recursion as the
output of the following program:
U ÷ h(x 2 .... ~xn) v÷0 STEP x DO u ÷ g(v~u,x2,...,xn) v ÷ v+l ~{DSTEP z÷u
DEFINITION ~ctions
The family of primitive recursive functions is the least family of closed under f~nctional composition and primitive recursion and
containing the base functions:
S(x)
=
x+l
Z(x)
:
0
Pi~n(W~,...~Xn)
:
xi
Block composition certainly corresponds to functional composition.
Thus we
have shown:
THEOREM 4.16 where
P
Every primitive reeursive function can be computed by a program
is a STEP scheme not m~loying an}, IF-THEN
eonstruction mnd
I
(P,I)
is an
interpretation over the nonnegative integers assigning to function letters only functions
S , Z , Pi,n
pretation
"Is
and
x ~ 1
and to predicate letters only the inter-
x = 0 ?" .
Meyers and Ritehie have shown that the converse is trme compute precisely the primitive recursive f~nctions.
-
that STEP programs
We get from primitive
reoursive functions to partial recursive functions by the minimization operation.
DEFINITION
The operation of minimization defines from a function
f
the function:
t m
Zy(f(Y,X2,..-,Xn))
!
if
m
=
Hin {y I f(Y~X 2 .... ,xn) : 0}
mndefined if
{Y I f(Y,X2,... ,xn) = 0} =
4-5!
Observe that
~yf
cmu be obtained from
u
÷
f(O,x2~...,xn)
z
÷
0
WHILE
u ~ 0
f
by the following
<~{ILE program:
DO z
÷
z+l
u
÷
f(z,x 2,...,xn)
It can be shown that every partial rem~sive (partially computable) function on the nonnegative integers can be obtained by applying minimization once to a primitive recursive function.
Thus it is a trivial consequence of elementary
recursive function theory that
T ~ O R E M 4.17
Every partially computable function can be computed using the set
of program schemes obtained by applying one WHILE eonstruction to a STEP scheme and using interpretations of function letters limited to Pi,n(Xl,... ,xn) "Is
and
x "- i
S(x) , Z(x) ,
and interpretations of predicate letters limited to
x = 0 ?"
This theorem is not really adequate for our purposes.
It does indeed say ~dnat
any program could be written in a very simplified structured form.
But the program
this theorem gives you may be exceedingly inefficient as regards time or space. may be very difficult to construct or analyze. to the approach you really want to use. form
-
It
It may have no obvious relationship
When you convert an existing progrmn to this
and the theorem is effective~ there is an algorithm for the conversion
the resulting p ~ g r a m will in general have no relationship to the original program except the very input-output relation.
We want to know something more.
We want to know not just t.hat WHILE programs
can compute every partial recursive function somehow or other but that the class of W}~ILE schemes is a canonical form.
Notice that this does not follow from the
previous theorem since we want to know about behavior under all interpretations.
4-59
G.
UNIVERSALITY OF WHILE SC}{~vZS
-
SWITCH VARIABLES
It is not difficult to see that every scheme is strongly equivalent to a WHILE schem~ relative to some fixed subLnterpretation.
Just add switch variables to
indicate which statement is now being executed and let the interpretation to which you are relativized include constants and tests for constants.
This is essentially
the B6hm-Jacoppini result.
THEOREM 4.18 I(0) = 0 ,
Let
I
I(i) = i
I(Z)(1) = FALSE .
be the interpretation with domain and for predicate letter
Given any program scheme
can constpuct a W H I L E
scheme
P'
Z ,
P
D : {0,i}
and
I(Z)(0) = TRUE
and
(not employLng
strongly equivalent to
P
0,I
or
relative to
Z )
we
I .
PROOF There are many alternative lines of proof. linear form. a block and
~
I
For each address
k
in
of program as indicated.
P
Suppose that
P
we add a new variable
We let
USTOP
and construct
be a new variable and let
be constants.
If
k
is the address of a test statement
the transfer on TRUE and
If
÷
IF
T(y I ,.. .~yn )
k
If
s
uk
on F~A/~SE) block
T(Yl,...,y n) ~
k
÷
1 THEN
ur + 0
I ; UsToP
+
ELSE
us ÷ 0
+
i ; A ;
Uk+ I
In each ease the block IF
Z(u k)
THEN
÷
% ~
The desired WHILE scheme
ENDIF Bk
is
0
is an assignment statement uk
r,s
is:
is the address of a STOP statement, then uk
A , then
~
is:
0
is defined from
Bk
by:
ENDIF
P'
is simply:
S%A~T uI ÷ 0 ;
WHI~
u2 + i ;
Nor Z(usT0P
uS ÷ i ~
~
... ~ u m + i
m
{
B1 ~ .... Bm ~,~HILE
STOP where
is expressed in uk
is the number of statements in
P .
m
UsToP ÷ i
(where
r
is
0
4-53
This construction is scarcely optimal. new variables,
log m
It is easy to see that instead of
m+l
will suffice and indeed even fewer switch variables are
usually needed since one needs
uk
only if
k = i
or
k
by a GOT0 (is a tre~nsfer address in a test statement).
is a statement addressed
By taking advantage of
other features of particular schemes, still fewer switch variables may suffice in particular cases. The transformation is global.
The schemes
P
and
computationally equivalent in the restricted sense added computational histories of
(P~I' ,a)
and
-
P'
are strongly
if we omit from the test
(P' ,I' ,a)
all values of the new
variables and all tests involving these variables (i.e. test pretation equal.
I'
extending
I
to all of
P
However the loop structure of
P
and
Z )
for an inte~--
P' , then the resulting lists are
has been drastically changed and there
is no simple relationship between the graphs of
P
and
P' .
This construction cannot be fixed up to admit strong equivalence since the %~HILE scheme
P'
constructed is actually a simple WHILE scheme and we saw that
simple WHILE schemes did not form a canonical class.
We can obtain strong
equivalence by using our new variables not to mark the next statement to be executed but rather to store the values of the registers at certain critical points. Adding new variables is crucial as ~
H.
s~mll mention later.
THE STRONG EQUIVALENCE CONS'IRUCTION We now give a construction for transforming any program scheme
strongly equivalent WHILE scheme. division
B 0 ,... ,Bn
We assume that
P
P
into a
is tree-like and has a
J~to major blocks as described at the end of section B.
We
proceed by blocks from the inside out, starting with innermost blocks without any subblocks
-
i.e. without any nodes labeled with a block name.
To each block
Bi
an exit to a block
B. 3
expression E(Bi,B j)
E(Bi,B j) is true.
with subblocks of If node
c
we shall associate a WHILE subscheme
If
Bi
has
(which might be B, itself) we constmuct a Boolean l such that the computation leaves B i for Bj if and only if
We build Bi
p(B i) .
P(Bi)
from the
E(Bi,B j) , the
and a special tree scheme
in block
Bi
contains a test
eritieal p i n t and associate new variables
p(Bj)
associated
p'(B i) . T(Xl,...,x k) , we call
u(i,c,x I) ,... ,u(i,c,x k)
e
a
indexed by the
block, the critical p i n t , and the variable tested at the critical pint. First form block labeled
Bi .
Let
e
B: frc~rl B, by replacing arrows to the entry node by exits i 3. be the entry node of B i Since B'l is a tree, there is a
unique path from the node N
e
to each node including the exit nodes.
we can define a conditional expression
the shortest path from
e
to
E(Bi,N)
For each node
by induction on the length of
N . Notice that either
N = e
or there is a unique
4-5~
node
m
(i)
For
(2)
If
directly connected to
N . We proceed by cases.
N = e , E(Bi,e) : TRUE E(Bi,m)
has been defined and
and the arrow from
m
m
is labeled with an assignment statement
leads to node
N
(which may be an exit)
E(Bi,N) = E(Bi,m) • (3)
If
E(Bi,m)
has been defined and
leads from
m
lead out of
to exit node Bi
N
m
is labeled by subblock
for block
Bk
Bj
and an arrow
(and any arrow from
m
must
by definition of a division into major blocks), then
E(Bi,N ) = E(Bi,m) A E(Bj,B k) . (4)
If
E(Bi,m)
has been defined and
critical point
an exit node), then E(Bi,m) if
b : TRUE E(Bi,m)
Finally, if
Bj ,
E(Bi,B j)
m
is labeled by test
c , and a branch labeled
A
E(Bi,N)
b
T(Xl,...,x k)
leads to node
N
at
(which may be
is either
T(u(i,c,xl),...,u(i,e,xk))
or else, if ^
NOT
b = FALSE:
T(u(i,e,xl),...,u(i,c,xk))
NI,...,N r
is the set of notes which are labeled as exits to
is defined as:
E(Bi,NI)
v
...
v
E(Bi~N)
EXamPLE Let us give the construction for block
B21
from Example IVy4 which gave a
division of the scheme of Example IV-3 into major block.s. The critical points are and
~
and the new variables are
u(21,~,x I)
and
u(21,~,x 2) . The Boolean
expression which gives the conditions under which a computation goes from the entry node of
B21
to the exit fur block
B2
is:
E(B21,B2) :
NOT
T(u(21,~,Xl))
E(B21,B0) :
T(u(21 ,e ~Xl))
^
NOT
E(B21,B21):
T(u(21,~,×I))
A
T(u(21,B,x2))
Similmoly: T(u(21,B,x2))
and
Notice that no two of the conditions (i.e. no two of and
E(B21,B 0) , E(B21,B2)
E(B21,B21) ) can hold at the same time but, assuming the variables in question
have been properly defined, one of the three conditions must always hold.
4-55
p'(B i) . We assume that either
Next we must construct a subscheme
innermost block or we have already constructed Bi .
For each node
N
in
by distance from exit nodes of (i)
If
N
for any subblocks
p(Bi)
B!l we define a subscheme
is an of
SN
inductively, this time
SN
is:
B! . I
is labeled by assignment statement
(a) and the arrow from
B. i Bj
A :
N
goes to an exit node,
N
goes to a node
A (b) and the arrow from A
(2)
(3)
If
N
SN
is
If
N
;
m
which is not an exit,
SN
is:
S m
is labeled by subblock
B. ]
all arrows must lead to exit nodes and
p(Bj ) . is labeled with test
T(Xl,... ,xk)
(a) and all branches lead out of
B!I '
at critical point
SN
c
is:
u(i,c,x I) + x I ; ... ; u(i,c,x k) + x k (b) and a branch labeled the branch labeled
b! b2
leads to node
m
which is not an exit and
leads to an exit node,
SN
is either
u(i,c,x I) ÷ x I { ... ; u(i,c,x k) + x k IF if
T(Xl,...,x k)
b I = TRUE
THEN
or else, if
Sm
ENDIF
b I : FALSE :
u(i,c,x I) + x I ; ... ; u(i,c,x k) + x k IF
NOT
T(x I .... ,xk)
THEN
Sm
ENDIF
(c) and the branch labeled TRUE leads to node FALSE leads to node SN
m2
and neither
mI
mI nor
and the branch labeled m2
are exit nodes, then
is : u(i,c,x I) ÷ x I ; ... ; u(i,c,x k) + x k IF
Finally,
T(x I ..... ~ )
p'(B i)
is
Se
THEN
where
Sml
e
ELSE
Sm2
ENDIF
is the entry node to
B.. 3_
EXAMPLE We continue the construction of t~<e as
p'(B21)
P(B21)
from Example IV-4.
: u(21,~,x I) IF
T(x I)
÷ THEN
xI E ;
u(21,~,x 2)
÷
x2
ENDIF
Clearly we can
4-56
Finally we can define let
p(B i) . If
p(B i) = p'(B i) . Otherwise
Bi
p(B i)
is itself a tree,
B i = B!l and we
is defined to be:
p'(B i) WHILE Notice that
E(Bi,B i)
E(Bi,B i)
would be atree.
DO
p'(B i)
ENDWHILE
must be defined since if there were no exit to
The expression
E(Bi,B i)
which have already been specified in
contains and tests variables
p'(B i)
have been reached; it also tests variables computation must pass through
p(Bj)
Bi , Bi
or else the exit to u(j,c,x r)
Bi
for subblocks
u(i,c,x r)
would not Bj
and the
and define these variables before reaching an
exit that tests them. critical point
Each variable u(i,c,x r) stores the value of x when r was last encountered and is not affected by any subsequent
c
respeeifications of E(Bi,B i)
xr
Thus if we have taken a path leading to the exit to
Bi ,
will be TRUE for appropriate values of the variables and the computation
will re-enter the loop~ otherwise it will leave the loop. EXAMPLE We conclude the construction of defined expression for u(21,~x I) IF
T(x I)
WHILE
p'(B21)
+ THEN
we have for
E ;
u(21,8,x 2) ^
u(21,~,x I) IF
P(B21) :
xI
T(u(21,~,Xl)) DO
P(B21) . Using our formula and the previously
T(x I)
÷
x2
ENDIF
T(u(21,@,x2))
÷
xI
THEN
E ~
u(21,B,x 2)
÷
x2
ENDIF
ENDWHLLE Finally we can define the WHILE scheme the original tree-like scheme
P
P'
which is strongly equivalent to
by:
START P(S o) STOP Example IV-6 gives the complete construction of a WHILE scheme strongly equivalent to the flowchart in Examples IV-2, IV-3 and IV-4. We have just shown: THEOREM 4.19 WHILE scheme
Given a program scheme P'
using new variables~
in the restricted sense.
P
we can construct a strongly equivalent P
and
P'
are computationally equivalent
4-57
EXAMPLE IV-6
CONSTRUCTION OF A WHILE SCHEME TO THE PROGRA~ SCH]9~
CONSTRUCTION OF
NOT
E(B21,B0) :
T(u(21~,Xl))
^ NOT
T(u(21,~,Xl))
A
u(21,%x I)
xI ;
P(B21)
:
~
P'
STRONGLY EQUIVALENT
EXAMPLE IV-4
P(B21) :
E(B21,B 2 ) :
E(B21,B21)
P
T(u(21,~,Xl)) T(u(21~B,x2))
T(u(21,6~x2))
is :
IF
T(x I)
WHILE
÷
THF~~ E ;
T(u(21,~,Xl)) DO
u(21~,x I) IF
ENDWHILE
T(x I)
u(21,B,x 2) ^ ÷
÷
x2
ENTDIF
T(u(21,6,x2)) xI ;
'I}EN E ;
u(21,6,x 2) ÷
x2
~IF
4-58
EXAMPLE IV-6
BLOCKS
CONT~JED
B 2 , BII and Bi11
BLOCK B 2 E(B2,B2) :
NOT T(u(2,~,x2))
^ E(B21,B2)
E(B2~B 0) :
NOT T(u(2,~,x2))
^ E(B21~B0)
E(B2,STOP) :
T(u(2,~,x2))
p(B 2 ) : B ;
u(2,~,x2) + x 2
IF NOT
((x2) IHEN C ;
WHILE NOT T(u(2,e,x2)) DO B ;
P(B21)
ENDIF
^ E(B21,B2)
u(2,~,x2) + x 2 ;
IF NOT T(x2) THEN C ;
P(B21)
ENDIF
ENDWHILE CLEARLY
Bi11 and B21 are isomorphia except for block n~nes and we can take:
p(Blll) = p(B21) ~
E(Blll~Bll) = ~(B2~,B 2) ~
~(BIII,B 0) = ~(B21,B 0)
~nd E(BIII~BII I) = E(B21,B21) THEN we can also identify P(Bll) = p(B 2) E(BII,BII) = E(B2,B2) ;
E(BII,B 0) = E(B2,B 0) ;
E(BII,STOP) = E(B2,STOP)
4-59
EXAMPLE IV-6
BLOCK
]3121
BLOCK
BI21
CONTINUED
E(Bi21,Bi2i) :
NOT
T(u(121,~x2))
A NOT
T(U(121,8,Xl))
E(BI21~BI2) :
NOT
T(u(121,~,x2))
A T(U(121,6,Xl))
E(Bi2i,STOP) :
T(U(121,~,X2))
P(BI2 I) : B ;
u(121,e,x 2)
IF Nor WHILE
T(x 2) NOT
~ffN
x2 C ;
T(u(121,~,x2)) DO
B ~ IF
ENDWHILE
+
u(121,B,x I) A NOT
u(121,~,x 2) NOT
T(X 2)
÷
x I ENDIF
T(U(121,6,Xl)) ÷
THEN
x2 ; C ; u(121,B~x I) + x I
EK~IF
q-GO
EXAMPLE IV-6
CO~FfI/JlIED
BLOCK BI2
msl2~st2) :
(T(u(!2~%x2))
^ T(u(12~8,Xl)))
v (T(u(12,~x2)) A NOT T(u(12,B,Xl)) E(BI2,B 0) :
NOT T(u(12,%x2))
E(BI2,STOP) :
T(u(12,e,x2))
^ NOT T(u(12,8,Xl))
^ E(BI21,BI2))
A E(BI21,STOP )
P(BI2) : E ;
u(12~,x2)
÷ x2 ~
IF T(x2) A T(Xl) WHILE
^ T(u(12,8~Xl)))
(T(u(12,~,X2)) ^ NOT T(u(12,B,Xl)) ^ E(BI21~BI2))]
DO E ;
u(12,~,x2) ÷ x 2 ;
IF T(x2) ENDb~ILE
÷ x1
THEN P(Bl2 I) ENDIF
[(T(u(12,~x2)) v
u(12,8,Xl)
u(12,B,Xl)
A NOT T(xI) THEN P(Bl21)
÷ xI ; ENDIF
4-61
EXAMPLE IV-6
CONCLUDED
BLOCK B 0 (NOT T(u(0,~,Xl))
E(B0,B 0) :
A E(B2,B0))
v
(T(u(0~,Xl))
^ T(u(0,8~Xl))
v
(T(u(0,~,xl))
^ NOT T(U(0,6,Xl))
The final WHILE scheme
^ E(BII,B0)) ^ E(BI2,B0))
P' "
START A ~
u(0,~,x I) ÷
IF T(xI)
xI
THEN D ; u(0,8,x I) ÷ IF T(x I) ELSE
THEN
Xl ~ P(Bll)
ELSE
P(Bl2)
ENDIF
p(B 2)
ENDIF WHILE
E(B0,B 0) DO A ;
u(0,~,x I) ÷
IF m(xI)
~EN
xI ;
n~
u(0'~'Xl)
IF T(xI) ELSE E~IF ENDWHILE STOP
p(B 2 )
THEN
÷ ~i ; P(Bll)
ELSE
P(Bl2)
ENDIF
4-62
I.
N~
VARIABLES ARE }~EEDED
We now show tgmt adding variables in the previous constructions is essential. We exhibit a program scheme
P
with one variable such that any strongly equivalent
WHILE scheme must have more variables.
Our proof actually shows that there is a
program which is not strongly equivalent to any WHILE program with the same number of variables.
Both the counterex~mple and its justification are due to Ashcroft
and M~nna (1971). Consider the program scheme
P
in Example IV-7; it has one variable
shall demonstrate that for a particular interpretation equivalent to any single variable ~ I L E
scheme.
I ,
(P,I)
x . We
is not strongly
We now allow WHILE schemes in the
extended sense, with arbitrary Boolean expressions. Let the domain u
in
of
{a,b}*
and
D v
of interpretation in
I
be the set of all pairs
{a,b,$} ~'~ such that
v
(u,v) with
contains at most one occurrence
$ . We shall actually only consider input from the subdomain
D' = {(e,ySv)
I y~v ( {a,b} + } •
For the tests, let
I(A)((u,av)) = TRUE
be uniformly FALSE elsewhere. let
I(B)
9 ,
let
l(b)
Let
(u~av) ~ D , and let
I(B)((u~bv)) = TRUE
be uniformly FALSE elsewhere. I(a)((u,ev)) = (ua,v)
for any
and
For any
e
for any
in
(u,bv) c D , and
{a,b,$} , and
I(b)((u~ev)) = (ub,v)
I(A)
and let
(u,cv)
I(a)
in
and
be the identity elsewhere, Prom now on we are only discussing programs under interpretation
we discuss the computation of a scheme (S,I,z) .
For
(u,v)
in domain
with input
D , call
It can be shown by induction on computation Rust b~it ~ t h
S
aut~t
IYl
u
z
the head and
, that for input
(ay,v) .
I
and so if
we mean computation v
the tail.
(e,y$v)
in
D'
IYms during the computation in
the P
or
in tony strongly equivalent single variable scheme the value of the single register x
must at all times be of the form
ay
and
y'
in the computation star,ts with wards must be
a ~
Now suppose that P'
u'
is an initial substring of
If the tail of
val(x)
at some point
a , then the second symbol added to the head afterb , the next s~,~l~l but one
b .
(P,I)
is strongly equivalent to
with a single register,
Boolean expression in
x .
Let
k
k
We shall consider only inputs in
the wrong output for some input from
(P' ,I)
for some WHILE
be the length of the longest
P' . At any given place in
at most the fmost (i.e. leftn~st) x .
where
y$ .
sLmilarly if the tail starts with
added to the head must be
scheme
(u',y'v)
is a terminal substring of
P'
the next step can depend on
sg~nbols in the tail of the value of register D' . D' .
It will suffice to show that
P'
gives
4-63
EZ~gMPLE IV-7
A PROGRAM SCHEME NOT STRONGLY EQUIVALENT TO AK~" ~41LE SCHEME WITHOUT MORE V~2JABLES
fk~ START )
x ÷
, ,l
tx
a(x) > \
f
STOP
T~ :)
F
f
I
x ÷ b(x)
l
(~)
1
x ÷ b(x)
'
4-64
Since the length of the head of the output for an input from
D'
can grow
arbitrarily large (depending on the length of tlne tail of the input), scheme must have loops. constructions.
P'
Since it is a WHILE scheme, there must be nonredundant WHILE Let
W
be the last WHILE construction which is neither nested
within a larger WHILE construction nor followed by any other WHILE construction. For each
n
there must be an input from
to go around the loop from
W
at least
D' , we could replace
leavir~g
W ,
W
n
D'
w~ich causes the computation in
P'
times; otherwise, as far as concerns input
with
n
"IF-THEN-ENDIF" constructions.
After
the rest of the program is in effect a tree and so the length of the
tail cannot be decreased by more than
N
symbols for some constant
N .
We shall e~tablish the following claim:
CLAIM:
For each
for any
w
in
with tail
n , there are
{a,b] + ,
y'z$v
y,z,v
with
Izl = n , yz,v e {a,b} +
the computation with input
for some terminal substring
y'
(e,ywzSv)
of
such that
leaves loop
W
yw .
The CLAIM gives us the desired contradiction at once, if we consider Izl _> N+I ~
the computation with input
y'z$v
ly'zl -> N+I
with
(e,~z$v)
will then leave
W
and there will not be enough time to erase
with tail y'z
from
the tail of the output. The proof proceeds by induction on
n .
First consider
mentioned when considering the nonredunda~ncy of (e,ylY2$V') at least
from
k+l
D'
times.
which enters
W
ly21 >_ k . Take
W
$
y = yly 2
(e,ywSv) = (e,ylY2W$Y2V')
from
D'
,
But if
W
or the output would never be correct. and
(e,ylY2$Y2V')
y'y2 v'
W
the computation would see tail
y'$v
Now consider some
for n -> 0
such that for any W
k+l
with tail
are two cases to consider.
So we must
For any input
y'
until
y2v'
y'z$v
y'
of
Y2W$ .
and behave as it did on tail
W . Thus the computation must leave
a terminal substring of
in
k
is entered with tail
(since all computations for input
such that we have found w
W
for a terminal substring
in particular it would not leave
with some tail
leaves loop
v : y2 v' .
This new computation must leave
y' = e ,
v ~ {a,b} +
W , then the
the computation will always see the same leftmost
halt) with some tail
Y2wSY2 v'
and goes around the loop
and halt as it must; hence each of these
symbols of the tail as under input Y2w$Y2 v' .
Y2$V'
decreases the length of the tail by at least one symhnl and yet
cannot decrease it beyond the have
with tail
If the tail were unchanged by a cycle aro<md
computation could never leave times around
W
n = 0 . As we
W , there must be an input
yw .
y,z,v
with
Izl = n , yz ,
{a,b} + , t~e computation with input
for some terminal substring
y'
of
~m~ .
(e,ywz$v) There
4-65
First, assume that for each y~z$v w'
for
in
y'
w
the computation actually left
a non.empty substrLng of
{a,b} + , the computation ~ t h
hypothesis with tail since
y'
y'z$v
is nonempty~
terminal substring of
for
y'
y' = y"a yw ~
yw . ~bw take our new input
(e,~cz$v)
consider only tail
z$v .
left
c = a .
W
rand so the tail is
y"z'$v
wc , c e {a,b]
with tail
zSv .
az$v
added to the head after leavLng
W
(e,y~z'$v)
y~b .
If
y'
W
leaves
a terminal substring of
the CLAIM.
COROLL~RY 4.20
some
(e~ywz'$v) yw .
left
W
with
must be W
a . Now let
with some tail
z' = bz .
y'z$v
for
is empty, the previous tail started with
with the same tail
Hence the computation on input y"
y"
such that the computation
(e,ywaz$v)
-
W
~ill be
in this case,
wards behave alike since control depends only on the tail.
for
for
so by our remark at the start,
and so the next syng~l added to the head after leaving computations leaving
by yw'a
The cases are sg~metric, so let us
Then the computation on input
The computation on any input a terminal substring of
leaves _7oop W
For any
This settles this case.
The last tail before that was
the next s ~ l
with tail
some nonempty terminal substring of
Otherwise there must be some string on input
(e,yw'z'$v)
W
z' = az .
must leave
W
z$v
b . -
b
But all must after-
This is a contradiction. with some tail
y"z'$v
This settles the other case and establishes
I
There is a flowchart program which is not strongly equivalent to
any WHILE program with the same number of registers.
COROLLARY 4.21
y~
Any canonical transformation mapping program schemes into WHILE
schemes cannot preserve computational equivalence.
5-1
V.
CORRECTNESS AND PROGRAM VERIFICATION In this chapter we discuss techniques for program verification and their
mathematical justification.
~ne basic idea behind these methods was originally
presented by Floyd; mathematical formulations and logical justifications were developed by Cooper and Manna, and others, and continued in King's Ph.D. thesis in which he presented the development of a partial implementation for these techniques. et al.
A scmewhat different axiomatic approach has been pursued by Hoare
The reader who has never made acquaintance with the formalism of the first
order predicate calculus should at this point turn to Appendix A for a brief and unrigorous exposition of the material relevant to this chapter. The procedure we shall develop is part algorithm and part heuristics, and interactive in nature. detail only one. criterion
There are many possible approaches and we shall examine in
The general idea is to devise for an input criterion
B , and program
(P,I)
a w~ll-formed formula
satisfiable in the logical sense if and only if respect to
A
and
(P,I)
W(P,A,B)
A , output
which is
is partially correct with
B . To pursue this subject with full rigor, one must actually
appeal to the second order logic in which one is allowed to quantify over predicates (or sets). W(P,A,B)
Instead of going into this aspect we devise the well-formed formula as a sort of logical scheme which uses as functions and predicates not
only those in
P
but also
A
and
B themselves plus certain special inductive
assertions which we shall examine later. I
interpreting
respect to extending W(P,A,B)
A.
I(A) I
A
and and
B
as well as
I(B)
We shall see that for an interpretation P ,
(P,I)
is partially comrect with
if and only if there is an interpretation
I' ,
by providing interpretations for the inductive assertions, under which
holds over the domain of
I .
PATH VERIFICATION For simplicity we shall assume that in the flowc~rts we consider, the input
variables
X
are totally disjoint from the program variables
variables
~
are a subset of the program variables
~ , and the output
Y .
We assume that we are given a flowchart scheme
P
and a path
path may be from START to STOP or it may be from any statement in statement in predicate
P
P . We ass~ame that we are given an initial predicate
B . We wish to construct mechanically
be implemented on a computer following property. are disjoint.
~
-
-
in
P . This
to any other A
and final
i.e. by an algorithm which can
a VERIFICATION CONDITION
We assume now t1~t input variables
~
V(P,~,A,B)
with the
and program variables
5-2
DEFINITION
A logical formula
in scheme input (i)
P
V(P,o~A,B)
is a verification condition for path
if for every interpretation
I
of
P , A , and
B , and every
a , whenever: Progrmn
(P,I)
path
with
~
starts path Y = b'
~
with
X = a
and
at the end of the path
Y = b
and follows the
~ ,
and l(A)(a,b)
(2)
then
is true,
I(B)(a,b')
holds if and only if
I(V(P,o,A,B))(a,b)
is t~de.
Thus the path verification condition is required to be trae ~,ehenever the initial condition
A
holds and the path is followed and condition
B
holds at
the end of the path~ it is required to be false whenever the initial condition holds and the path is followed but condition
B
is false at the end of the path.
The verification condition we shall construct will be vacuously true if in fact a consistent path or if
A
A
o
is not
does not hold at the start of the path.
There are several ways of constructing path verification conditions.
Our
approach will be to use the algorithm for testing whether a path is consistent which we have already explored at length, but it will be relativized to starting the computation at the start of the end of
o
o
rather than at START and ending the computation at
rather than at STOP (of course, in some cases
o
may begin at START
and end at STOP). Let us assume that executed in step
i
o = (ol,...,ot )
of path
the oonvention that in a statement the next statement if test is false.
0
we set
from I)
i If
T(Vl,... ,vn)
val(y,i)
val(y,@) = y
variable
x , and all to oi
k .
We build up the sets
along with the values
and Q
with
T(Vl,...,v n)
holds, and
val(x~0) = x
sets
t . At step i,
set
°i
oi
, and
Q(o,T,FALSE) i
much as before,
in this path.
At step
y
or input
i
running
k . u + f(vl,... ,Vq) , then set , and Q
k . u + y
val(v,i) = val(v,i-l)
sets unchanged. with
u
and
val(v,i) = val(v,i-l)
y
variables, then
for each variable
sets unchanged.
is assignment statement
val(u,i) : c
and
leave the
sets unchanged.
Q
is the address entered if the and
is executed.
is assignment statement
Q
is the address of
We proceed by steps, for
v ~ u , and leave the
v ~ u , and leave the i") If
r~s , r
P , and
for, each p r o ~ a m variable
are empty.
~i
val(u~i) = val(y,i-l)
s
Q(o,T,TRUE)
val(u,i) = f(val(vl,i-l),...,val(vq,i-l))
i ') If
the address of the statement
of each variable at step
is assignment statement
for each variable
oi
~ . We use the linear representation of
k . u ÷ c
val(v,i) = val(v,i-l)
with
c
a constant, then set
for each variable
v ~ u , and
5-3
2)
If
ai
is a conditional transfer
i ~ t ,
3)
place
and in
Q(a,T,F~LSE)
If
is a forced transfer
ai
transfer but let 4)
If
is
and let
T(Vl,o.. ,Vq)
ai+l = s ~ k .
let
r,s
k .
Y = (YI"'" 'Yr )
we assume that
r ~ s if
r~r
and
ai+l = r everywhere.
or is a conditional Q
sets unchanged and
everywhere.
STOP then of course
Then we define
and
Q(a,T,TRUE)
val(u,i) = val(u,i-l)
T(Vl,...,Vq)
t = i .
val(u,i) = val(u~t) = val(u,i-l)
T I,... ,T s ~
in
i = t , make no ehanges; i.e. leave the
Now suppose
T .l .
if
val(u,i) : val(u,i-l) ai
k .
(val(vl,i-l),... ,val(vq,i-l))
A
Q
B
sets alone
everTwhere.
and the list of all predicates in
and
V(P,a,A,B)
Then leave the
P
is
are predicate symbols distinct from all the
as:
B(X,val (Yl,t) ,... ,val(Yr,t))
Observe that if V(P,a,A,B)
a
is not a consistent path, then the hypothesis in formula
is always false, i.e., inconsistent, and so
Hence in this case,
V(P,a,A,B)
V(P,a~A,B)
is always ~ e .
trivially satisfies the definition of a verification
condition. For convenience we designate by assigning the co_~reot '~meanLngs" to symbols of
P
I(V(P,a,A,B)) for path I(B)
a
V(P~a,A,B,I) A
and
according to interpretation
B
the formula resulting after
and the function a~nd predicate
I
-
that is,
V(P,o,A,B,I)
=
which can be regarded as the corresponding verification condition in program
(P~I)
with initial condition
I(A)
and terminal condition
.
Suppose program Y = b ,
(P,I)
is started at the start of path
and then follows path
end of the path.
a
with
Moreover, suppose that
X = a
and
g
with
X : a
[ = [~ : (b l',...,brT)
l(A)(~b--)
is true.
of a computation in a scheme under an interpretation,
and at the
By the very definition
b i' = I(val(Yi,t))(a,b)
for
i -< i -< r .
Notice that if
a
is indeed the path followed in these circumstances.
then for
in
,
I(T(~-))(~,~)
~
l(T(t))(a,b) and
a
= FALSE
and so
= TRUE
I(NOT T(t))(a,b)
and for
= TRUE .
t- in
Hence if
Q(a,T,FALSE) l(A)(a,b)
,
holds
is the appropriate path, then the hypothesis in the implication in
V(P,~,A,B,I)
must be true when evaluated at
V(P,a,A,B,I)(a,b)
~[{
Q(a,T,TRUE)
5.1
X = a
holds if and only if
l(B)(a,b')
~The quantifier-free for~ula
V(P~o~A~B)
definition of a verification condition for path
a
and
Y = b .
Thus
holds.
as defined above satisfies the i~l program
P .
5-4
We might define correctness for a subpath by:
DEFINITION
Progr&m
if whenever
A
follows
~ ~
(P~I)
and path
~
are co_~ect with respect to
holds at the start of subpath then
B
~
holds at the end of path
in program
(P,I)
A
and
B
and the progrmn
o .
Then we cam. rephrase the previous lemma by:
LEMMA 5.2
Program
(P,I)
and path
if and only if
V ~
if and only if
V X V ~V(P~a~A~B)
a
[ V(P,o,A,B~I)
are correct with respect to
holds over the domaffm of has model
I
A
and
B
(equiva!ently~
I ).
EXAMPLE Example V-!
gives a simple W~{iLE scheme
particular interpretation indeed compute
~nd the progrmm
(P,I)
~o~der a
Ultimately we shall verify that program
(P,I)
does
(P,I)
as
z = x! .
We consider illustrated.
I .
P
~ ~
8 , and
Instead of
For our program
A
y
and
(P,I)
as names of locations in B
P
arLd in
we shall use as predicate letter, s
A
~ AB ,
we shall assign to these extra predicate letters the
following meanings.
A(X,Yl,Y2,Z)
under
I :
(x ~ O)
AB(X,Yl,Y2,Z)
under
I :
(x ~ 0) ^ (Y2 >_ 0) ^ (z : yl:) A (x : Yl + Y2 )
A(X,Yl,Y2,Z)
under
I :
(z : x!)
We consider three paths.
Path
oI
is the path from
6 only at the end and otherwise does not pass through from
~ Path
condition
back to oI
B
once while
~3
A(X,Yl,Y2,Z)
Under interpretation
(x z 0)
~
Path
B
which reaches
d2
is the path
Q
8
As(x,c,x~f(c))
this becomes
to
y .
sets are m~pty and the verification
is eonstructed as:
~
I
to
is the direct one step path from
encounters no tests so the
V ( P , o I ~ A ~ A B)
6 •
a
V(P,aI,A,A~,I)
:
E(x ~ 0) ^ (x ~ 0) ^ ((0 + i) : 0~) ^ (x : (0 + x))]
5-5
EXAMPLE V-I
A
SCHEME
P
START
....... ,;
'~
I [
/Y2 ÷
Y
( ~To~ )
/ ~ ~'z~l I
5-6
EXAMPLE V-i
(Continued)
PROGR~
(P~I)
( ?
~Yl ++ ~i +I
yliiii ~z 1 Y2 ~I
]
1
Interpretat ion l(f)(n) = n+l , I(T)(n) = TRUE
I
-
domain is nonmegative integers,
l(h)(n) = n -" I ~ if and only if
l(g)(n,m) = n.m ,
n = 0
I(c) : 0 ,
5-7
This formula is "clearly" true for any integer
x . Notice that the truth of the
statement is "obvious" because we consider "obvious" the fact that identity for addition so is defined to be i.
0 + i = I
and
0 + x = x
for any
x
0
is an
and because
"0!"
These "obvious" facts must be built into any procedure for
mechanically verifying such a for~oala. Path
~2
enoounters test
test is FALSE, so V(P,o2,~, ~ )
Y2
is in
for path
~2
T(y 2)
and is followed only when the outcome of the
Q(~2,T,FALSE) . Thus the verification condition is:
[AB(X,Yl,Y2,Z) A NOT T(Y2)] Under interpretation
I
n
AB(x,f(yl),h(Y2,g(f(yi),z))]
this becomes:
[(X -> 0) A (Y2 >- 0) A (Z = yl !) A (X : yl÷ y2) ~ Cy 2 ~ 0)J
=
[(X ~ 0) A ((Y2 ± i) ~ 0) A ((yl + i) " Z : (yl + i)!)
A
(X : yl + i) + (Y2 ~ I))]
To see that this formula is true for all nonnegative integers
x , Yl ' Y2
and
z
one must know various "obvious" facts about addition, monus and minus, and manipulation of identities (the m~am.ing of example, that if
Y2 ~ 0
and
Y2
" : "
in such a forn~la)
is a nonnegative integer, then
-
for
(Yl +I) + (Y2 ± I)
= (Yl +I) + (Y2- i) : Yl + (i +(Y2 +(-i))) = Yl + ((Y2 +(-i)) +i) = Yl + (Y2 +~i+i)) = Yl + (Y2 + 0) = Yl + Y2 - for another example, somewhat more subtle, that the formula
z = yl !
substituted for
in the hypothesis means that in the conclusion, z
a~.ywhmre.
It is fairly c l ~
yl ! can be
that such abilities must be built
into any useful mechanical theorem prover and indeed that sort of thing has been successfully implemented several times. requi~es "knowing" that
However, verification of this formula also
(n+l)! : (n+l)-n!
Building this into the verification
procedure is, intuitively, tantamount to knowing already that with respect to For
A
and
I
that it does compute
is correct
z = x!
~3 ' the final verification condition is:
[AB(X,Yl,Y2,Z) Under
Ay
(P,I)
A
T(Y2)]
=
Ay(X,Yl,Y2,Z)
this is interpreted:
[(x -> @) A (Y2 = 0) A (Z : yl !) A (X : yl ÷ y2) A (Y2 = 0)] n (Z : X!) which we can verify using simple facts about addition,
0 , and identity.
5-8
If the flowchart construction of
P
has a loop-free graph
-
if
is now quite simple.
If
P
W(P,A,B)
a finite nmmber of paths
oi,.o.,~n
hence execution sequences.
P
is a tree
-
then the
is loop-free there are only
from START to STOP which are consistent and
The input condition
inputs, of course, while the output condition
A(~)
is a function only of the
B(X,Y)
can be regarded as a function
of the input and of the final values of all the program variables (some of these values, of course, may play no role in the statement of the condition). under_, these conditions, when
oi
is a complete execution sequence from START to
STOP, the path verification condition a function of the input
DEFINITION
If
P
W(P,A,B)
where
V(P,oI,A,B)
^
First suppose that
V(P,oi,A,B,I)(a)
the vector each true. for
Y
Zi
and
oi
If
A([)
W(P,A,B,I)(~)
is of the form
A(a)
'ITlusif
A
true, while and
Zi
B , B(a,b)
So ~n this case,
is totally correct with respect to
B .
Zi n B([,b-)
A([)
b
A
(P,l,a) .
is the value of
is false under
I ,
W(P,A,B,I)(~)
~i ' then
is true.
Zj
Since
is
is false
(P,I)
is
must also hold and
W(P,A,B,I)(a) and
l(i.e.,
B , I
is true.
Hence if
is a model under which
is satisfied.
On the other band, suppose -
and
is the path actually followed by computation
V(P,oj,A,B,I)(a)
be true.
A
holds under interpretation
is true and the computation followed path
and so
V X W(P,A,B)
that is,
I . Consider any input
Thus
V(P,oi,A,B,I)([)
Zi
!
is a model under which
W(P,A,B,I)(a) a
~i
A(a)
the vector of values of
~
is Irue.
Now
which computation
is t~ue here, and for
must hold and thus
V ~ W(P,A,B)
holds for every input
for which
always halting~ there is a path to STOP.
I(W(P,A,B)) ; notice
is totally correct with respect to
at the end of the computation.
V(P,~i~A,B~I)(a)
satisfied
stand for
P .
is the correct path of the computation, then
totally correct with respect to
(P,I)
V(P,On,A,B)
is false and so the conditional is vacuously t ~ e and
j ~ i
is
a . Notice that by our previous results each conjunct
is true if and only if
is trae) oi
a
W(P,A,B,I)
in the formula
Zi
I
X .
(P,I)
Consider any input vector
l(A)(a)
...
is the list of all execution sequences of
For convenience we shall let
Further, if
for any interpretation
alone.
that it, too, is a function of
where formula
V(P,~i,A,B,I)
has a loop-free graph, let
=
~i"'" '~n
X
Notice that
P
is loop-free and so follows from START
to hold~ Ln particular
must be true under
at the emd of the eomputation.
is
in the domain of
(P,I,~)
W(P,A,B,I)(a)
B(a,b)
a
I , where
b
is
5-9
We have shown that:
THEOREM 5.3
Let
P
he a program scheme with a loop-free graph, and let
any interpretation of and
B
P .
if and only if
V X W(P,A,B)
Program
(P,I)
V X W(P,A,B,I)
is satisfied by model
I
be
is totally correct with respect to
A
is valid (equivalently, if and only if
I ).
Thus verification of programs ~£.th loop-free flowcharts is sLmple (in theory) -
try verifying all possible paths.
Of course, this exhaustive search procedure
is seldom practicable. We cam restate Theorem 5.3 for the special case of always halting schemes. Suppose a program scheme
P
with a loop-free graph has input variables
are not program variables and output variable set
Z = (Zl,... ,zr)
[
which
disjoint from
. Assume that at the end of every completed path (whenever STOP is reached) each
zi
is specified.
value of variable following path
u
o .
For amy execution sequence
after the computation of Let
B(X,Z)
p(P,o) = V(P,o,TRUE,B o) . sequences in
P ,
o(P)
=
P
~ ,
let
val(u,o)
denote the
on a free interpretation
I
o
= (zI = val(Zl,O)) ^ ... ^ (zr = val(Zr,q))
Finally, if
l""'°n
and
is a list of all the execution
let
p(P,o I)
^
...
A
O(~
~) .
Now the arguments for Theorem 5.3 can be used to show correct with respect to TRLFE and
~t
(P,I)
is totally
I(p(P)) . Thus we can show ,cf Theomem A.I in the
append ix ).
COROLLARY 5.4
If
P
is an always halting program scheme we can construct a
quantifier-free well-formed formula respect to ~ J E
B.
mnd
p(P)
such that
P
is totally correct with
p(P) .
PROGPJ~'IVERIFICATION Now we are ready to tackle the more general case in which the flowchart does
have loops.
We first examine the ~mthematical justification for the verification
procedure and then outline the procedure and discuss various problems eomnected with it. We are going to introduce new predicates and new predicate letters to fill certain special roles. some coro,zentions.
To avoid too much notational eomp]ication, let us introduce
The formula we shall develop for
dummy symbols we shall call
P
W(P) • When the predicates
containing A
-
A
and
B
as
the input condition
5-i0
-
and
B
-
W(P,A,B) for
A
the output condition
-
have been specified we use the notation
to indicate that the actual interpreted predicates have been substituted and
B .
Finally when the function and predicate letters of
replaced by their "meanings" £n an interpretation W(P,A,B,I)
. We may regard
W(P~A,B,I)
P
have been
I , we denote this by
as a partial interpretation of
W(P) .
We shall soon see why it is in general only a "partial" interpretation of It is
W(P,A,B,I)
W(P) .
with which we shall be ~mst concerned, for this will express
set of verification conditions for the whole program
(P,I) .
The new predicates we add are called inductive assertions and are assigned to certain preselected points Ln the program.
These points can be selected quite
freely, subject to certain conditions, so this set not be unique; this will mean that "subscripted" by
S .
W(P)
The choice of
S
S
of induction points will
is not itself unique but is really is not significant as to the theory but
may be very important as to the applications.
DEFINITION
For a flowchart scheme
P , a set
S
of addresses in
P
is a set
of induction points if: (i)
S
contains the address of the initial s
of all STOP statements, and (2)
S
cuts all loops in
If
S
P .
is a set of induction points, there is a finite set
se~nents which start with a member of do not pass through any point of into path se~nents from
P
end with a member of
S
of all path and otherwise
S . Every path from START to STOP can be divided
H(S) .
the set of all addresses in
S ,
H(S)
Sets with these properties do exist; for example, is certainly a candidate for
scheme, it suffices to include in
S
S .
For a WHILE
the initial statement ~ all STOP statements,
and the start of each WHILE statement. To each point
t
in
S
corresponds to a predicate A(~)
we assign an arbitrary predicate letter
At(X,Y)
,
At
which
except that the input condition predicate
is always assigned to the initial point in the scheme and the ouput condition
predicate
B(X,~)
or address in
S
is always assigned to all STOPs in the scheme.
Thus every node
is tagged with a ~edicate which we call an inductive assertion.
From the paths in
H(S)
we can select the set
{gl""'gm }
containing all
and only consistent paths w~hich start at a tagged point, end at a tagged point and otherwise do not pass through any tagged point. and ends at
ri
(in some cases we have
Suppose each
ti = r i ) .
~ll-formed formula:
V(P,Ol,Atl,%l)
^
...
V(P,%
At m
) m
~i
starts at
Then we define
W(P)
ti as the
5-11
Now suppose that assigned to
A
and
I
is an interpretation of
B ; we shall use
A
P
and meanings have been
instead of
I(A)
I(B) . Further assume that we have somehow extended which assigns Lnductive assertions to the letters t . We shall likewise use circumstances
I'
At
for
I
B
instead of
to an interpretation
I'
mud so to the tagged points
I'(At) . Finally, suppose that under these
is now a n~del for
holds over the domain of
I
At
and
V X V Y W(P,A,B) , i.e.
V X V Y W(P,A,B,I)
under these inductive assertions.
Let us see what
this implies. Let
~
be an input vector such that
halts with output into segments
Tl,...,T q
ends with tagged point
such that each
ti+ I
other~ise, and furthermore STOP statement. Ti
A(a)
holds and computation
[ . This computation follows some path
Let
bi
in tI
S
~i
(P,!,~)
which can be divided in
S
and does not pass through any member of
starts at tagged point
S
ti
is the START or initial statement and
be the vector of values of
of this computation.
0
We can set
b0
tq+ I
is a
at the end of path segment
arbitrarily just for convenience in the
inductive argument, since the registers in be assi~ned during the computation.
~
and
are initially unspecified and must
Y
[q=
Note that
[
the vector of values at
the end of the computation. We now establish by induction on
i
At (~,[i_ I)
that
holds for
i s i s q+l .
i
Clearly
Atl(a,[ 0) : A(a)
by definition and
have established the desired result for all I'
is a model for
and T = b--k_2 . Tk_ l
V X V Y W(P,A,B)
In particular,
A(a)
holds by hypothesis.
Suppose we
i < k
and let us consider
Ark . SLnce
each of the conjuncts must be true for
V(P,Tk_I,Atk 1,Atk,I')(K,~k_2)
is one of the consistent path segments
hypothesis,
Atk l(~,~k_2)
segment in this situation ending with verification condition
oi
in
must hold; by assumption
X = a
must hold, since
K(S) . By the induction ~k-i
is the legitimate path
Y = bk_ I . Thus the hypotheses in the path
V(P,Tk_I,Atk_I,Atk,I')
must hold by the same arguments we
saw before and thus the conclusion must also be true; that is,
Atk(a,bk_ I)
must
Atq+l(a,b q) = B(a,b)
also
hold. If we consider the special case holds.
So we have shown that for any input for which condition
and for which program words,
k = q+l , then
(P~I)
(P,I)
halts, condition
B
A
is satisfied,
holds for the output.
is partially correct with respect to
A
and
In other
B .
We we have established first: LEM
5.5
Let
B . Suppose that
(P,I) A(a)
be a program with input criterion holds~
(P,l,a)
is satisfiable.
Then
and output criterion
converges with output
assignment of inductive assertions under which V ~ W(P,A,B,I)(a)
A
B(a,b)
V ~ W(P,A,B,I)(a) is true.
~
and we have an holds, i.e.
5-12
More generally, we have:
THEOREM._ 5.6 condition I'
For a flowchart scheme A
and output condition
P
and interpretation
B ,
if
I
I
of
by assigning meanings to the inductive assertions such that
V X V Y W(P,A~B)
, then
(P,I)
enough to find inductive assertions -
and
B .
I'
is a model for
-
I , then in fact
A
and
B .
We have shown that if one is clever
Boolean functions to assign to the various
such that the compound verification condition
in the domain of
with input
is partially correct with respect to
We can also establish a converse of sorts.
At
P
can be extended to ~n interpretation
(P,I)
W(P,A,B)
holds everywhere
is partially correct with respect to
A
If one guessed wrong and the verification condition does not hold, however,
this says nothing as to the correctness of partially correct with respect to
A
(P,I) .
and
B
It may be that
assertions is "wrong" and will not give us the desired answer. not be partially correct with respect to
A
(P,I)
is
and one or more of the inductive
and
B .
Or
(P,I)
may indeed
We will never find out which~
in. this fashion, although the way in. wP~ch the particular inductive assertions fail us and the verification conditions are violated may give us clues as to the location and nature of the possible bugs in our program. However, what we can say is that if to
A
and
(P,I)
is partially correct with respect
B , then some choice of inductive assertions will work
-
there are
inductive assertions (but we may of course not be able to find them) which assigned to the
At
make
V X ~ Y W(P,A,B,I)
true.
The assertions which will always work are the obvious ones and of no use in any practical situation. the eomputation
Namely, let
(P,l~a)
At(a,b)
be true if and only if
at some point enters tagged point
(Under this definition,
At
is partial computable, if
A
t
A([)
with
holds and
Y = b .
is, but not necessarily
computable and of course if we had a handy way of expressing and computing this sort of
At
we could easily verify our program ad Inoc.)
partially correct with respect to
A
and
B
We wish to see that for any choice of condition in where
d
W(P,A,B,I)
holds.
V(P,d,At,A,I)(a,F)
condition is vacuously true. of t
A t , A(a) with
with
Y = b' .
Further
Ar
Y = b
each path verification
t
t to
V(P,d,At,Ar,l)(a,b-)
to tagged point r .
r
not passing
If the hypothesis of the
(P,l,a)
At(a,b)
is true and by definition
at some point enters tagged point
is the continuation of this computation and reaches
So there is certainly a time when computation
~nlth this specification of assertion
d
is
is false, then the verification
If it is true, then
is true and computation
Y = b .
and
That is, we must examine each
through any other tagged point en route from
(P~I)
and see what this means. X = a
is a consistent path from tagged point
conditional expression
So let us assume that
[ .
Now if
r
(P~I,~)
reaches
r r
is not a STOP statement, Lnduetive
was assigned by our definition and thus
A(a,b')
holds by definition.
5-13
But this is the conclusion in conditional expression
V(P,a,At,A,I)(~,[)
the whole expression is true.
r
On the other hand, if
can now conclude that computation Since
(P,I)
(P,I,F)
is partially correct for
conclusion of
V(P,a,At,B,l)(a,b)
also true for
X = a
conclude that
W(P,A,B,I)(a,b)
so we see that
and
,
Y = b .
A
B ~
r
with output
B([~[')
holds.
the verification condition
F' .
As this is the
V(P,o,At,B,I)
is
Since this holds for all conjuncts, we can
is true.
~ X ~ Y W(P,A,B,I)
is the STOP statement, we
halts at point and
~nd so
This applies to any choice of
[
and
~ ,
is satisfiable.
Thus we have
LEMMA 5.7 B .
If
Let A(a)
(P,I) and
be a program with input predicate
B([,[)
are true and
(P,I,[)
A
and output predicate
halts with output
[ , then
there is a choice of inductive assertions under which
V 7 W(P,A,B,I)([)
holds.
Putting everything together:
THEOREM 5.8 predicate if
I
For any program (P,I) B ,
(P,I)
is partially correct with respect to
can be extended to a model for
A
and any input predicate
Z X V Y W(P,A,B,I)
A
and output and
B
if and only
.
EXAMPLE Let us return briefly to Example V-I. and
y
was not accidental, nor was our selection of
the input condition be Thus
Our choice of tagged points
A = A
and
(x ~ 0 )
A(x)
B = ~
.
A (Y2 ~ 0 )
:
(x ~ 0)
condition
are the W(P,A,B,I)
, As ,
We can regard our selection of
and
A
B(x,z)
A~ ,
~ , Let
:
(z = x!)
namely:
^ (Z = yl !) ^ (X = yl + y2 )
as the inductive assertion for point S = {~,6,Y]
A
and the output condition
~ ,
6 •
Then the three paths in
paths we have previously called
oI ,
a2
and
[(S) a3
for and the
is
V(P,oI,A,As,I)
A
V(P,o2,A6,AB,I)
A
V(P,o3,A,B,I)
We have already seen that each of these path verification conditions holds for all choices of
x,Yl,y 2
and
z .
Since
~ x(U ^ V)
(¥ x U) ^ (V x V) , we have shown that
is always logically equivalent to
W(P,A,B,I)
holds for all
x,Yl,y 2
and
z
5-14
in the domain of assignment of
I . Thus
A@
V x V Yl V Y2 V z W(P,A,B,I)
and hence
(P,I)
is tmde for %his
is partially correct fop
A
and
B ,
as
claimed.
Of course we are usually interested in verifying not just partial correctness but also total correctness. using now a formula
We can do so using a variant of the previous methods,
3 X V Y [A(X) A W(P,A,NOT B,I)] .
First suppose that we are dealing with input criterion If
t
is not a STOP statement, let inductive assertion
A(K)
holds a~id computation
The previous a r ~ t s must hold for any t
to tagged p i n t
and r
which is a STOP?
V(PP,At,B,l)(a,b) follows (P,l,a) and
b
~
to
r
b
At(a,b)
5.7) show that
with
Y = b .
V(P,~,At ,Ar,I)(~,~) @
fromltagged point
not passing through any other tagged point for which What about
Suppose
V(P,~,At,B,I)(a,~)
A(K)
holds.
holds, computation and halts, so
V(P,~,At,B,I)(a~b)
if
@
r
is
ends in taggedpoint
1~en if the hypothesis of
(P,l:a)
(P,l,a)
(P,I) .
hold if and only t
and any consistent path segment
diverges, the hypothesis of and so
and program
ever enters tagged po~it
(in the proof of L e ~ a
not the STOP statement. r
(P,I,~}
A
enters
converges.
t
with
Thus if
V(P,~,At,B,I)(K,~)
Y = b
A(a~
and then
holds but
must be false for all
must be vacuously true.
B
Putting this together
we see that:
LEMHA 5.9
If program
(P,I)
fails to halt for any input
holds, then for any output criterion satisfiable.
Alternatively, if for any input criterion
3 X V Y [k(~) ^ W(P,A,B,I)] satisfying input criterion
is not satisfiable, then
Now consider output criterion
choice of inductive assertions In particular,
By Lenma 5.5,
A(a)
for which
A
A(~) is
and output criterion halts for any input
B : FALSE
-
is satisfiable.
B
never, holds and suppose
At
such that
holds.
Suppose
i.e.
Thus we have input
X = a
and a
V ~ [A(a) ^ W(P,A,FALSE,I)(K)] (P,l,a)
B(a,[) = TRUE , which is nonsense.
converges with output
Hence
b .
(P,l,a-) does not
halt. Thus:
L E } ~ 5.10 3 ~V which
Let
(P,I)
be a program ~ith input criterion
Y [A(X) ^ W(P,A,FALSE,I)] (P,I,K)
B
(P,I)
A .
3 X V Y [A(X) a W(P,A,FALSE,I)]
holds.
K
B , 3 X V Y [A(X) ^ W(P,A,B,I)]
fails to halt but
A . If
is satisfiable, then there is some input A(a)
is true.
for
,
5-15
FLnaliy:
T H E O R ~ 5.11
Program
condition ~ A
(P,I)
fails to halt for some input satisfying input
if and only if 3 X V Y [A(X) a W(P,A,FALSE,I)]
Alternatively, program if and only if
(P,I)
is satisfiable.
?~its for all input satisfying in.put oondition
3 X V Y [A(X) A W(P,A,FALSE,I)]
We can now give the corresponding result for total correctness. mappose
(P,I)
(i) for some
is not totally correct for
A
A
is not satisfiable.
mnd
First,
B . Either
[ , A([)
holds but
(P,I,~)
diverges
~ , A(a)
holds and
(P,l,a)
converges with output
or (2) for some B(~,F)
b
but
is false.
In case (i), L~Tma 5.9 tells us that
3 X V [ [A(X) A W(P,A,B,NOT B,I)]
is
satisfiable (since it is satisfiable for any choice of output criterion). (2),
NOT B(a,~)
is true so by Lemma 5.7 (taking
3 X V Y [A(X) A W(P,A,NOT B,I)] Y W(P,A,NOT B,l)(a)
particular, suppose we have input
[
(P,I)
cannot be totally c o c c i
holds.
If
(P,I)
is satisfiable.
In
(P,l,a-) fails to converge,
for input criterion
converges with output
is false and so
is true and
and a choice of inductive assertions for
V Y [A(a--) A W(P,A,NOT B,I)(~)]
B(a,[)
A(a)
3 X V Y [A(X) A W(P,A,NOT B,I)]
which
(P,l,a)
X = a )
is satisfiable (because
is satisfiable).
Now conversely suppose
If
Incase
[ , by LeJmm 5.5,
A
and ~ny output criterion. NOT B(a,b--) is true and
is not totally correct for
A
and
B .
Concluding: THEOREM 5.12 if and only if (P,I)
Program
(P,I)
is not totally correct with respect to
3 X V Y [A(X) A W(P,A,NOT B,I)]
is totally correct with respect to
3 X ~ Y [A(X) ^ W(P,A,NOT B,I)]
A
is satisfiable.
and
B
A
and
B
Alternatively
if and only if
is not satisfiable.
EYAMPI£ Returning to Example V-I we see that the "falsification" condition, 3 x V Yl V Y2 V z [A(x) A W(P,A,F#JbSE,I)]
3xVY
becomes:
I V Y2 V z [(x ~ 0) A [((X ~ 0) ~ As(X,0,x,I)) ^
((AB(X,Yl,Y2,Z) A (y2 ~ 0)) n A$(x,Yl+l,Y2~ l~(Yl+l)'z))
A
((A$(X,Yl,Y2,Z) A (y2 = 0)) n FALSE)]]
5-16
One can show that this formula is inconsister~t over the domain of would run roughly like this: Yl ' Y2 tb~t
and
z
and
A6(n,i,m,j)
m .
x = n ;
m ~
if
n -~ 0
let
holds for some
so there is some such m ~- i , then
le~
m i
be the smallest non~egative integer such and
m = 0 ,
AB(n,i+l~m-l,(i+l)" j)
Hence there is no such integer
I . The argtmlent
be such that the formnla holds for all
j .
Since
n ~- 0 , A6(n,0,n,l)
"FALSE" holds, a contradiction.
holds
But if
also holds, contradicting the minimality of n
and the condition is ~nsatisfiabie.
However, it is obviously simpler to observe that over the given domain the WHLLE construction is in fact a STEP after
x
x
construction and hence the program loop ends
steps.
Examining what we have done so far, we see that consists of a conjunction of formulae
V(P,~,At,A)
W(P)
and so
W(P,A,B,I)
for all paths
a
starting at
a tagged position and ending at a tagged position but not passing t ~ o u g h any tagged position otherwise.
Thus to verify partial correctness it suffices to find
inductive assertions under wffmich the verification conditions will hold for these individual paths. So the verification procedure can be d ~ i d e d into steps: i)
Input the program
(P,I) .
2)
Input a choice of tagged points
3)
Input a choice of inductive assertions
S .
4)
Mechanically generate all verification conditions formal specification of program~ set
At
S
for each tagged point V(P,a,At,Ar,I)
t
in
S .
from the
of tagged points, and inductive
assertions assigned to the tagged points. 5)
Send verification conditions into a THEOREM PROVER.
If all conditions are
proven correct, print "PARTIALLY CORRECT WITH RESPECT TO
A
AND
B "
If
any verification condition is either proven ~ncorrect by the I~OP~E~ P R O \ ~ or else is rejected or not handled by the THEOREM PROVER, return to either 2 ) or 3), calling for new input. There are pitfalls at all steps in the procedure.
Fffrst the format for
representing the program ~ust be carefully thought out.
The generation of
verification conditions in 4) certainly can be done auton~tically, but again their format and presentation is of some importance.
All this can affect the
performance of the THEOREM PROVER. l~ue most obvious difficulty lies in the choice of inductive assertions. wrong choice says nothing about the correctness of the program. the programmer should be able to provide inductive assertions idea w ~ t
is going on at a particular point in the program.
often wishful thin2~ng for various reasons. may help but is not a complete cure.
A
One might say that -
should have some
This is urSortunately
Using structured progranming methods
This emphasizes the generally accepted need
for better doeumentation methods, but is not the whole answer.
The programmer may
know what. is supposed to occur at a given tagged point and may document this well
5-17
enough to satisfy a human user, but may nevertheless not specify the inductive assertion in enough detail to satisfy the T~JEOREM PROVER.
This is a very serious
problem since the conditions left out may seem so .obvious or irrelevant to the programmer as not to be worth specifying or so subtle that only ayl attempt to verify incomplete conditions will bring it out, and the final inductive assertions may prove very unwieldy.
There are different heuristics to apply, of varying degrees
of obviousness, and we shall point out a few in our examples. What about mechanical generation of inductive assertions? in toto.
There is no procedure which by exhaustive search
exhaustive search
-
This cannot be done even unlimited
will eventually come up with "good" inductive assertions and
establish partial correctness whenever partial correctness holds (or even when total co~rectness holds) even for very simple interpretations. shall examine the reasons behind this phenomenon.
In the next~ chapter we
The best one can hope for is some
sort of interactive heuristic procedure in which the machine and progranmer produce the assertions, the machine possibly providing some of the little details the programmer might forget or be u~awere of; even ~n this more modest goal one must realize that success is not certain and somet£mes programmer mud machine together will not be able to verify partial correctness. Even if the "right" inductive assertions are fed into the machine (and there is of eourse no unique right set of tagged points or inductive assertions), neither the practical no-o the theoretical problems end there. mechanical THEOREM PROVER.
There are still problems with the
It is verifying conditions and checking expressions for
tautologies in a fairly rich theory including identity~ constants~ arithmetic of the nat
B
The predicates
A
have to be described properly for the THEOR~JM PROVER to deal with them.
the little example we saw
-
how do you describe
" n! " ?
primitive together with a series of axioms to go with it? recursively from more basic operations?
In
Do you feed it in as a
Or do you define it
In the latter case you might realize in our
example that you have really fed into THEOREM PROVER the fact that our program for n!
is correct
-
in short you have built in what the machine is supposed to prove!
This is a si~91istio example of course, but the basic problem is real
-
getting
the THEOREM PROVTR to deal with some of the rather sophisticated primitives available in many programming languages and getting the programmer to describe the possibly yet more sophisticated notions behind the definition of "correct behavior" for a particular progra~n. The reader should NOT be deluded Lnto thLnJ
5-18
We shall conclude this chapter with further examples and a slightly different approach to verification.
At the end of Chapter VII (on recursion augmented
schemes) we discuss one method of extending verification to programs with procedures and calls.
C.
FURTHER EXAMPLES We shall illustrate and extend the ideas in the last section by looking at
some further examples, one in our invented ~ L E
progra~g
language, and others
in "real" programming languages.
Example V-2 gives a program to compute a binomial coefficient, subject to
xI
and
x2
being intege~,s and
the START and STOP points and loops in the program. in terms of
~
and
Y5
and
B
which are the start of the two WHILE
The second page of the example gives the verification terms
A , B , A
, and
liberties with our procedure Y4
z = ~Xl~ \ x 2I 0 -< x 2 -< x I . The tagged points are
A~
-
Notice that we have already taken tacit
for example we have observed that at point
e ,
are "dummy" variables whose values are of no importance and hence
is not a 9anction of
Y4
and
~
Y5 "
What shall our inductive assertions be?
For simplicity we shall assume that we
are only dealing with the domain of nonnegative integers and thus statements such as "Xl 'x2 'YI'Y2 'Y3 'Y4
and
Y5
are non,negative integers"
s ~ ! l be om~_tted from the
inductive assertions; strictly speaking, they should be included. node
e
dominates node
6
and there is no way of entering the second WHILE state-
ment except through having the test with nonnegative numbers, point for
B
AB
Yl
"Yl ~ 0"
be positive; since we are dealing
is always greater than or equal to
Thus it is certainly safe to place
'Yl ' -> i"
Likewise we notice that in passing from
respecified and
z
is multiplied by
thus it is safe to add
We notice that
Y3
we can add the input condition
xI
and
A(Xl,X 2)
to
when we reach
B , Y4
and
Y5
are
but the other variables are unc_hmnged~
A (Xl,X2,Yl,Y2,Y3,z/y3)
Similarly, since input variables
a
I
in the inductive assertion
x2
to the conditions for
A8
are never changed during the program,
to both
A
and
AB
These are
heuristics which one can readily understand and implement without undue difficulty. The general idea is to search for "fail-safe conditions" which must by the flow of control be true whenever a tagged point is reached and routinely add these conditions to the inductive assertions for that point. useful but they cannot "hurt".
These extra conditions may or may not be
A scan of the verification conditions with abstract
assertions (dummy symbols for the induetive assertions) is often useful in this respect.
5-19
EY~%MPLE V-2
VERIFICATION OF A WHILE PROGRAM TO COMPUTE A BINOMIAL COEFFICIENT
START Yi
+
Xl -" x2
Y2
÷
i
z
÷
i
IF
Yl -" x2 = 0
THEN
Y3
÷
x2 + i
ELSE
Y3
+
Yl + i
Yl
+
x2
ENDIF WHILE
v~ ~ 0
2
DO z
÷
z "Y3
Y4
÷
i
Y5
+
Y2
WHILE
z -" Y5 ~ 0
ENDWHILE
~©WHILE STOP
z
~
Y4
Yl
÷
Yl "- i
Y2
÷
Y2 + i
Y3
÷
Y3 + i
DO Y4
+
Y4 + i
Y5
÷
Y5 + Y2
5-20
EXAMPLE V-2 (Continued)
VERIFICATION CONDITIONS WITH ABSTRACT ASSERTIONS
(i)
[A(Xl,X 2) ^ ((Xl=X2)lx2 = 0)]
Ae(Xl,X2,Xl~X2,l,x2+l,l)
(2)
[A(Xl,X 2) A ((XI~X2)±X 2 ~ 0)]
A~(Xl~X2,X2,1,(Xl±X2)+l,l)
(3)
[A~(xI'x2'YI'Y2'Y3'Z) ^ (Yl ~ 0)]
As(Xl,X2,Yl,Y2,Y3,l,Y2,z'y3 )~
(4)
[A~(xI'x2'YI'Y2'Y3'Z) ^ (Yl : 0)]
B(Xl,X2,Z)
(5)
[AB(Xl,X2,Yl,Y2,Y3,Y4,Y5,Z) ^ (z ~ Y5 ~ 0)]
As(Xl,X2,Yl~Y2,Y3,Y4+l,Y5+Y2,Z)
(6)
[A6(Xl,X2,Yl,Y2,Y3,Y4,Ys,Z) ^ (z ~ Y5 = 0)]
A~(Xl,X2,Yl~l,Y2+l,Y3+l,Y4 )
INDUCTIVE ASSERTIONS Input Assertion Output Assertion
A(x l,x 2):
x 2 _< x I
(x0
B(x1,x 2,z)"
A~(xI'x2'YI'Y2'Y3'Z):
z = x2
(x2 -< Xl) ^ (Yl + Y2 : i + Min(x2,xl-x2)) A (yl+Y3 = x I + i)
^ (i -< Y2 -< Y3 ) ^ (Yl < Y3 ) ^(z
:
( y3-1 Y3
A@(Xl,X2,Yl,Y2,Y3,Y4,Y5,Z):
)
)
Y2
A~(Xl,X2,Yl,Y2,Y3,z/Y 3 ) ^ (i -< Y5 : Y4"Y2 -< z) A (Yl -> i)
5-21
A slightly more subtle heuristic lies behind the conditions "Yl + Y2 = i + Min(x2,xl-x2)" and "Yl + Y3 = Xl + i" in A e A quick scan of verification conditions (5) and (6) shows that within the main loop whenever Yl is decreased by
i
y -" i = y - i) and
Y3
(and we have already agreed that at
then
Y2
and
Y3
are increased by
i
6 ' Yl >- i and otherwise
are ~nchan4~ed. Thus the strategy is to describe
constants (with respect to
xI
and
x2
and so
yl+Y2
which do not change).
Yl ' Y2
and
yl+y3
as
Examining
verification conditions (i) and (2) indicates that the first test really decides Which is the mi_nimL~m of Min(x2,xl-x 2)
and
Xl-'X2
Y3
as
and
x2
and that
~ax(x2,xl-x 2) + I
Yl
and
Y2
is them specified as as
I
~m all cases, so
yl+Y3 = (Xl-'X2) + x 2 + i : Xl+l , whence the desired relations. considerations tell us we must have that condition obtains when
Y2
"i < Y2 <- Y3"
and
Y3
91cremented together; the reason for
at
~
The same
and hence at
are first specified and
"Yl < Y3"
Y2
6 and
"I s Y5 = Y4"Y2 s z"
used to divide
z
computing
used
(k)
by
-
and then dividing by since
n!
Y2
k[
in
are
The
A 8 reflects the fact that the inner loop is
and the condition on
z
in
namely, instead of computing and
Y2
is similar.
The other conditions depend on knowledge of the algorithm involved. condition
since
(n-k)!
A
reflects the method for
(~)
by first computing
n!
(a method which is undesirable for large
n
will cause overflow long before (~) itself gets out of hand) one ~k~ (k+l~ (k+2 ~ ~ . ~k" ' " k " ' ~ k " ' "" using the recurrence relation
computes suooessively ~)
=
n
(nkl)
.
The interested reader can construct the complete verification eonditions and notice what "obvicusfaots" are needed to cheek them. one must know that verify (5) that
(nn) : 1 ~ to verify (4)that
k _< n
implies
For example, to verify (I)
k-< n
n(nn-l) is divisible by
implies
( ~ ) : (nn_k) , to
k , and to verify (6)
the recurrence relation above. Example V-3 is taken from "The Elements of Programming Style" by Kernighar~ and Plauger.
It is a Fortran subroutine for sorting an array of
increasing order.
N
n~mbers into
As it is, it does not appear amenable to our methods.
we can translate it into the WHILE program shown, with ~nput variables and output and program variable
However, Xo
and
n
X . This is an "array augmented" flowchart,
because we have allowed as variables not only "simple" variables (e.g. SAVE), but variables containing arrays (e.g. X(1)
or
array of
X
and
X ° ) and subscripted variables such as
X(I) . These are to be interpreted in the obvious fashion N
variables,
in this example
I
instructions such as
and
-
X
is an
X(1),X(2) ~... ,X(N) . We have special subscript registers, J , which contain integers for subscripts and to which
I + i
or
I ÷ I + I
refers to the value of that variable The special predicate DIMENSION
U(V)
X(i)
can be applied. such that
i
An expression
is the contents of
is true if and only if
V
X(1) I .
contains an integer
5-22
EXAMPLE V-3
VERIFICATION OF A FOR'I~AN SUBROLTI%~ FOR AN INTERCHANGE SO~T
SUBROUTINE SORT DIMENSION C
(X,N)
X(N) SORT INCREASING~ BY INTERCHANGE
IF
(N.LT.2)
~TL~N
DO
20
I = 2,N
DO
I0
J = I,I
IF
(X(1) . GE. X(J)) SAVE = X(1) X(I)
: X(J)
X(J) = SAVE i0 20
CO~fINUE COk~INUE REIIJRN END
GOTO
10
5-23
EXAMPLE V-3
(Continued)
AN ARRAY A U C 4 ~ E D
FLOWCHART VERSION OF THE PREVIOUS SUBROL~I~E
START X
÷
X
N
÷
n
O
IF NOT DIMENSION IF NOT ~
(N < 2)
X(N) THEN
LOOP ~ I F I + 2 ; ~ILE
I -< N
DO J
+
~vvvzeaaaa~ WHILE
i J-
DO IF NOT
(X(1) ~ X(J))
THBI SAVE + X(I); X(I) ÷ X(J) X(J) + SAVE;
~FDIF J ENDWHILE I EATDWHI LE ENDIF STOP
+
I+i
÷
J+l
5-24
m
and
U
is an. array of dimension
m . Any incorrect usage of these variables
causes the whole instruction to be ignored ignored if
L
-
e.g. an instruction
does not contain a proper subscript, or if
variable or if
L
contains
undefined so far.
i ,
and
V
V
u ÷ V(L)
is
is not an art~ay
is an array vmoiable but
V(i)
is
This augmentation of flowcharts does not precisely correspond to
the definition which we discuss in Chapter VII, but is close enough for our present purposes. The translation of the original Fortran subroutine to this augmented WHILE program can be dane mechanically. the semantics involved. A(X~n):
X°
Then input condition
is an array of
and output condition B(X,n,X):
(Xo ^
Now we can apply our techniques~ keeping in mind
B
n
A
is:
n~ers
can be described as"
is an array of (the numbers of X(1) -< X(2) -<
n
numbers)
X
...
^
(X
is a permutation of
are sorted in increasing order~ -<
X(n))
We select the start of the two WHILE statements as tagged points. "fail-safe" strategy mentioned before, we can place "2 -< I -< N"
and
"i -< J -< I+i"
X)
into
AB
,
"2 -< I s N+I"
Using the into
A
as well as the input condition
and A ,
Finishing the definition of inductive assertions depends on observing how the subroutine behaves. So we can have as inductive assertions : A(Xo,X,N,I):
(Xo
is an array of
A (X
N
numbers)
is a permutation of
X)
^ (2 _< I _< N+I) ^ (For A@(X,X,N~I,J):
i -< i s I-2 ,
(X ^ (X
numbers)
X ) o (1 S J <- l+l)
A
^ (For
1 _< i _< J-2 ,
X(i) s X(i+l))
^ (For
J s i <- I-2 ,
X(i) <_ X(i+l))
^ (If
J ~ 1 , then
There are 7 paths to verify: one from START to ~
N
is a permutation of
A (2 -< I _< N)
back to
X(i) -< X(i+l) )
is an array of
~ ,
one from
and one from
for which D ~I~_NSION
X(N)
~
X(J-I) _< X(I) )
one from START to STOP not passing through ~
up to
to
6 ,
~ .
is false?)
one from
e
~ ,
to STOP and two from
(Why is there no need to verify the path
We leave it to the reader to check out
these path ve_~ification conditions. Perhaps the most important thing to notice is that there is really no need to convert to flowchart form as we did~ once one gets the "hang" of it, the verificatior can be done directly for the Fortran subroutine.
5-25
Exmmple V-4 is also from "The Elements of Programming Style".
It is a piece
of PL/I code which runs through a list of numbers determining whether or not they are prime~ it tacitly assumes that the input is integer (which might have been checked elsewhere). We could have transferred this program into flowchart format fairly simply. Instead we havemarked it up for our purposes.
The first thing we did in editing
is to omit the eomments~ whieh are~ however, useful in composing inductive assertions.
Since we are only interested in checking that one sweep through the
program correctly determines whether INPUT is prime, we have treated every return to the initial statement, labelled by 3 stops in the program.
STI , as a STOP statement.
Thus there are
We have tagged the initial line by START and the input
predicate A(X):
X
is an integer
and each of the stops by
STOPi
and the output condition
If
X
is a positive prime integer,
If
X
is an integer greater than or equal to 4 which is not prime,
Otherwise,
Z = "X
candidate for
~
IS A PRIME NUMBER"
IS NOT A PRIME NUMBER"
Z = "ILLEGAL I~PDT
We also tag the DO loop with
Z = "X
B(X,Z):
Tagl
N = X"
and the inductive assertion
~(X,N,R)
.
One
in which the first 5 eonjuncts come from our "fail-safe"
heuristic and the last two from examination of the code is:
(N > 3)
A
(N = X)
A
(X
is an Lnteger)
A
(R
^
(if
R = 3 ,
2 does not divide
A
(if
R > 3 ,
i
A
(2 _~ R -~ SQRT(N) + 2)
is an integer)
does not divide
N) R
for
2 ~ i -~ R - 2)
Since we are only checking correctness of algorithm, we ignore the format of the output (PUT EDIT) statement and translate it into a straight output specification. In some cases one m~ght want to use Lnductive assertions to check output presentation, once correctness has otherwise been verified (subject only to these output instructions being themselves correct).
5-26
EkAMPLE V-4
STI:
VERIFICATION
GET LIST IF
OF A PIECE OF
PL/I
CODE FOR DECIDING IF
(N) ;
N < = i
THEN
DO; PUT EDIT ('ILLZGAL INPUT (SKIP , GOT0
X(10)
,
A ,
N='
,
F(5)
N , ,
A)
' < = i' ) ;
STI ;
END; IF
N>
3
DO
R = 2,3 IF
THEN TO
MOD(N,R)
SQRT(N) = 0
BY
2 ;
/* R = 2,3,5,7,...*/
THEN
DO; PUT EDIT (N ,
(SKIP, GOT0
'IS NOT A PRIME NUMBER' )
F(15)
,
A)
;
STI
END; END;
/* GET HERE FOR PUT EDIT (N , GOT0
STI ;
N : 2
OR
3
OR IF FALL OUT OF LOOP*/
'IS A PRIME NUMBER')(SKIP,
F(15), A);
N
IS PRIME
5-27
EYJ~IZ V-4
(Continued)
START ~
THE CODE E D I T E D FOR V E R I F I C A T I O N
N ÷ X
i(x) IF
THEN
N<=I
UJFPUT ÷ " 'ILLEC=AL IN~2L~ N : ' N " < = STOPI ~ m v w ~ v ~ m
B(X) END; IF
N>
Tagl ~ v ¢ ~ m a ~ AI(X,N,R)
3
THEN DO
R = 2,3 IF
STOP2 ~
TO
HOD(N,R)
SQRT(N) = 0
2 ;
THEN
Z ÷ " N 'IS NOT A PRIME NUMBER'
B(X,Z) END; BD; Z+"N STOP3 B(X~Z)
BY
T IS A P P ~ ' ~ ~ E R '
"
"
5-28
To illustrate what is bmpper~ing, we write out the paths and verification conditions in terms of
A ,
B
and
the actual conditions.
The set of tagged points is
S = {START~ STOPI, STOP2, S ~ P 3 , (i)
Tagl} .
"ILLEGAL INPt~
N = X
: l)) ^ (x
<
>
3)] ~ AI(X,X,2)
START to STOP3 [A(X) A (NOT (X < = I)) i (Ngr (X > 3))] n B(X ,
(4)
< = I" )
START to Tagl
[A(X) ^ (NOT (X
(3)
it is left to the reader to check out
START to STOP1 : [A(X) ^ (X < = i)] ~ B(X ,
(2)
AI {
Tagl to Tagl
-
there ere really two paths for
"X
IS A PRIME NUMBER")
R = 2
and
R ~ 2
and two
conditions • [AI(X,N,2) ^ (2 -< SQRT(N)) i (MOD(N,R) ~ 0)] ~ AI(X,N,3) and [AI(X,N,R ) A (R >- 3) ^ (R <- SQRT(N)) ^ (MOD(N,R) ~ 0)] n AI(X,N,R+2 )
(5)
Tagl
to
STOP2
-
there are really two paths as in (4), but one
condition will do: [AI(X,NR) ^ (R -< SQRT(N)) ^ (MOD(N,R) : 0)] o BOX, ~X
(6)
Tagl
to
STOP3
[AI(X,N,R) ^ (R : SQRT(N) + 2)] n B(X ,
D.
IS HOT A PR~ffE NU]~BER")
"X
IS A PRE~Z NU~BER")
AXIOMATIC APPROACH A var,iant of the method discussed in this chapter has been proposed by
C. A. R. Hoare using a set of axioms and rules of inference to establish partial correctness of programs. The method of Hoare appears more flexible in that axioms and rules can be introduced to cover various constructs of particular programming languages and their implementations ~ but also appears, at least to this author~ even more cumbersome and unwieldy than the Floyd-Manna-King approach when applied to simple flowchart-like programs. approaches is the same.
The formal mathematical justification for both
Basically~ the approach used to date employs "forward
substitution" from hypothesis asset
5-29
method uses "backwards substitution".
Which method is preferable depends partly on
one's taste and partly on the individual program under discussion.
At times a
combination or alternation of forward and backward substitutions might be more efficient. We need to introduee more notation.
I
First, the u~Jal logical notation
W
implies that
W
is a theorem in our system
of inference we have shown that
W
-
based on our set of axioms and rules
holds for all values of its variables over the
domain of interest.
The special notation introduced by Hoare is
A {P} B .
DEFINITION
Let
be a program or piece of program and let
and
assertions.
If whenever
then
B
P
A
is true before the execution of
is true of the values after the termination of
x
SE
when
S
and
a variable to stand for the result of substituting sLmilarly,
Sx'y'z
or
S~
E E
P
and
B P
P , we write
If this can be formally proven in the axiom system, write
Hoare also uses the notation
A
be terminates
A {P} B .
~---A {P} B .
are expressions and for
x
x
everywhere in
~4olmld be the result of substituting
a
for
is S
x , b
for
, ,
y
and
c
If
for
z ,
x + E
variable and
~ : (x,y,z)
and ~ = (a,b,e) , ete.
is an assignment statement, E
x
is an identifier for a simple
is an expression of a programming language without side effects but
possibly containing
DO
if
I
x , then the Axiom of Assignment is:
{x +
A
Notice that this reverses the way we have been treating assignment statements in path verification conditions. B
Essentially we have been saying that to prove that
holds of the values after assignment
establish
1
x ÷ E
if
A
holds previously, one must
A ~ B~ . Actually that is merely a difference in viewpoint, not in
methodology~ and the mathematical justification is the statue. One can provide rules for the three methods of composing WHILE programs, for ex&%Dle.
If
PI
and
P2
are pieees of a program, we can state the Rule of
Composition:
D1
If
~ - - A {P1} A1 and
Informally it ean be phrased: afterwards and whenever holds and
{PI;P2}
A1
follows,
~---A 1 {P2 } B , then
suppose whenever holds before B
A
P2 ' B
holds afterwards.
~---A {P1;P2} B
holds before
PI ' AI
holds
holds afterwards; then if
A
5-30
For a conditional IF-THEN or IF-THEN-ELSE construction we can state the Rules of Conditional Statements:
D2
If
1
(A ^ Q) {PI } B ~ then
IF
I
(A ^ Q) {PI } B
I
A {IF
Q
THEN
PI
In a W H I L E construction, WHILE assumed true when ever is). then
A
PI
I--
and
I
ELSE
P2
A {IF
Q
(A ^ NOT
THEN
PI
ENDIF}
B
Q) {P2 } B , then
ENDIF} B
Q DO PI
ENDWHILE , notice that
Q
can be
is initiated and false when the WHILE loop is ended (if it
Thus if it is true that whenever holds at the end of
A
and
Q
hold at the start of
PI ~ then it is also true that whenever
the start of the WHILE loop, then at the end
A
holds and NOT
Q
A
PI '
holds at
is true.
Formally we can state the Rule of Iteration
D3
If
~- (A A Q) {PI} A , then
~-A
{WHILE Q DO P1 ENDWHILE} (A ^ NOT Q)
We need some rules of inference, to allow us to deduce new "theorems" from the theorems and axioms already established.
The simplest choice of inference rules for
our system is perhaps the Rules of Consequence:
D4
Using
If
I
A {P} B
If
l
~{P}B
DO
and
D4
and
A n BE
~--- B n B1 ~--
A~A 1
then
1 ~ A {P} B1
then
l
The Nanna approach essentially has one verify
in order to assert what is in Hoare's notation ~- ~
~--A {x ÷ E} B
A{P}B
we can show that our treatment of assignments and Hoare's
are basically the same.
gives us
and
{x ÷ E} B as claimed.
and so if we also have
I
~A
{x + E} B . But
A n B~ , then
D4
Thus one is only discussing whether the selection of
assertions is done "bottom-up" from desired conclusion (B) to sufficient (but perhaps not necessary) hypothesis (A) or "top-down" from
A
to
B . In actual
practice, inductive assertions may be assigned by both strategies,
DO
gives us
5-31
For an example of this approach, we return to the simple program Ln Example V-I~ this is already complicated enough to prevent a completely detailed and rigorous proof.
i
Yl
÷
0
2
z
÷
Yl
3
Y2
+
x
4
WHILE
Y2
We can write this program as:
+i
0
DO
41
Yl
÷
Yl + I
42
z
÷
Yl " z
43
Y2
÷
Y2 -" 1
ENDW~HILE STOP
We shall refer to statements by the labels to their left, for convenience. Recall that the inductive assertion
AB(X,Yl,Y2,Z)
was:
(x ~ 0) ^ (Y2 ~ 0) A (Z = yl !) A (X = yl+Y2 )
Instead of verifying the path from
} Applying rule
I
i
to
4 ,
we now want to prove
A {l,2,3} i~ DO
t]~ee times from
3
back to
1
we g e t :
(X --> 0) ^ (X >- 0) ^ (Z : yl !) ^ (X = Yl + X) {3} (X -> 0) ^ (Y2 -> 0) ^ (Z = yl [) ^ (X = Yl + Y2 )
I
(X --> 0) A (X -> 0) ^ (Yl + I : yl !) ^ (X : Yl + X) {2} (X >-- 0) A (X --> O) ^ (Z = yl .~) ^ (X = Yl + X) (x -> 0) A (X -> 0) ^ (0 + I = 0!) ^ (X : 0 + X) {i} (X -> 0) ^ (x >- 0) A (Yl + 1 = yl !) A (X = Yl + X)
Putting these together by two uses of the Rule of Composition
( x -> 0) A (X -> 0) A (0 + 1 = 0 ! )
^ (X = 0 + X) { 1 , 2 , 3 }
DI
we get:
(X -> 0) A (Y2 -> 0)
^ (Z = y l ! ) ^ (X = Y l + Y2 )
5-32
In order to deduce
AI
~--
we need to apply an axiom of arithmetic
A {1,2~3} A B
x + O = 0 + x
an axiom concerning the factorial:
FI
I
!=8!
a rule of inference regarding identity:
Ii
If
I
u = v
then
~--
A n Avu
and
and tPree other rules of inference:
R1
If
I
A
then
~---B ~ (A A B)
R2
If
I
A
and
I
R3
~-- (A A B)
From
AI
]
0+l:l
Applying
]
and
Ii
n
FI
A ~ B
then
(A A A A B)
we have
and
I..... 2 :
0~
we have
(o + i : 2)
~
(o + i :
o!)
and fl~om R2
[
O+l:0!
~
applications of
1
[(x >- 0) A (x >- 0)] ~ [(x -> 8) A (X >- 0) A (0 + i : 0!) A (X : 0 + X)]
whence by
R3
and
R2
will give
R2
]-- (x_> 0) ~ E(x -> 0) A (x-> 0) A (0 + I : 0!) ^ (X : 0 + x)1 and finally the Rule of Consequence 1
(x >- 0) {1,2,3}
D4
yields
(x >- 0) A (Y2 ~ 0) A (Z : yl !) A (X = Yl + Y2 )
5-33
The proof that
F - - A B A (Y2 ~ 0) {41,42,43} A8
is even longem so we shall
skip several formal steps which are purely applications of mules of inference of the propositional calculus with identity.
I
We start working hackby:
(x m 0) A ((Y2 = i) ~ 0) A (Z : yl !) A (X = Yl + (Y2 ~ I)) {437 (X ~ 8) ^ (Y2 ~ 0) A (Z = yl !) A (X = Yl + Y2 )
I
(X ~ 0) ^ ((Y2 ~ i) ~ 0) A (Yl " Z = yl !) ^ (X = Yl + (Y2 = i)) {42} (X ~ 0) ^ ((Y2 ± I) ~ 0) A (Z = yl !) A (X = Yl + (Y2 ± i))
~-- (X ~ 0) ^ ((Y2 ~ i) ~ 0) ^ ((Yl + i) • Z : (Yl + i)!) ^ (X = (Yl + i) + (Y2 : I)) {41} (X ~ 0) ^ ((Y2 ~ I) ~ 0) ^ (Yl " Z : yl !) ^ (X = Yl + (Y2 ~ I)) and fLnally from
DI
(x ~ 0) A ((Y2
i) ~ 0) a ((Yl + I) • z = (Yl + i)!) ^ (x = (Yl + i) + (Y2
i))
{41,42,43} (x a 0) ^ (Y2 ~ 0) A (Z = yl !) ^ (X = Yl + Y2 ) Now we must add another factorial axiom
F2
~--
(y + i) • y! : (y + !)!
and various arithmetic axioms regamding
+
and
in order to be able to deduce
using the usual rules of inference:
~--
[AB(X,Yl,Y2,Z) A (Y2 ~ 0)] ~ [(X ~ 0) A ((Y2 ± i) ~ 0) A ((Yl + I) " Z = (Yl + i)!) ^ (X = (Yl + i) + Y2 -" i))]
This will finally by
1
AB
A
D4
produce
(Y2 # 0) {41,42,43} A B
Now the Rule of Iteration yields:
~-
A B {4}
A~
^
(Y2 = 0)
5-34
More formal manipulation will show
iI
A8
whence by
I
^
(Y2 = 0)
~
B
D4
A8 {4} B
and finally by
DI
A {1,2,3,4,5} B
which verifies the program. Observe that we have in this procedure worked out some of the steps previously left to the THEOREM PROVER.
The previous procedure involves having the progpammer
select a set of inductive assertions and critical p i n t s , and then. feed this into the computer parts:
a VERIFICATION CON~DITION GENERATOR and a THEOREM PROVER.
In
this alternative construction we still need inductive assertions as the nature of the Rule of Iteration for WHILE statements shows.
Now the inductive assertions are
fed directly into the THEOREM PROV:~R which has been augmented by the special axioms and mules
D0,DI ,D2 ,D3
and
D4
in addition to all of the usual arithmetic axioms,
rules of inference, rules for handling identities and special axioms for the primitives in question (such as the factorial axioms in our example).
In effect the
THEOREM PROVER works backwards from the output condition and the various inductive assertions using implications
[
DO - D3 R ~ S
to find what amounts to path verification conditions it must establish.
-
It turns its heavy machinery to work
on these implications and if it succeeds ever}inhere will eventually use
DI - D4
and these implications to finally prove the verification theorem. It does not seem clear which procedure is easier to Lmplement or more efficient (if and when it works! ).
Both can be augmented to handle other constructions in any
particular programming language.
The first procedure is augmented by changing the
PATH VERIFICATION CONDITION GENERATOR and the second by adding additional axioms or rules to the THEOREM PROVER.
6-1
VI.
DECISION PROBLEMS In this chapter we shall be coneermed with some of the more formal aspects of
the subject, primarily with establishing the decidability or undecidability of some of the properties we have been discussing such as equivalence and partial correctness.
We shall assume that the reader is familiar with the basic concepts
and results regarding computability and Turing machines although no knowledge of proofs or precise formalisms is needed.
We shall give our proofs in more detail
and somewhat more formally than in most of the previous sections.
The reader
uninterested in the mathematical properties of schemes can skip most of this chapter, but should at least peek at the theorems which state that almost everyt~ng interesting about schemes or programs is undecidable.
This is not meant as a
discouraging word, but rather to establish t/~e limits of the theory and how far we can go with ad hoc methods, special cases and interactive procedures before running aground. Let us review s~me definitions and facts. set
B
is total if it is defined on all of
some subset of empty set). the range of
A
(which might be
The domain of f
is
f
{f(a) I f
A
is defined on
L
A
from a set
on which
f
to a
A , or even the is defined while f .
is the function which has value i
and which is undefined outside of
L
A
a e A) , the set of values of L
characteristic or total characteristic function of is i (or YES or TRUE) for members of
f
it is partial if it is defined on
itself, a proper subset of
is that subset of
The partial characteristic function of a set (or YES or TRUE) for members of
A function
A ;
L
L ~ the
is the function whose value
and is 0 (or NO or FALSE) outside of
L .
There are several equivalent ways of defining a recursively enumerable set or predicate.
DEFINITION
A set is recursively enumerable (r.e.) if and only if there is a Turing
machine which when given as input a member of the set will eventually halt and give a YES answer but when given an input not in the set will either give a NO answer or fail to halt. A set is r.e. if and only if it is the range of a total reeursive (total computable) function. A set is r.e. if and only if it is the domain of a partial recursive (partial computable) ~mne~ion. A set is r.e. if and only if its partial characteristic function is partial recursive (partial computable).
There are various ways of defining a recursive set.
6-2
DEFINITION
A set is recursive if and only if there is a Turing machine which
always halts and tells whether or not the input belongs to the set (answer YES if it does and NO if it does not). A set is recursive if and only if its total characteristic function is total reoursive (total computable). A set is recursive if and only if both it and its compl~ment are recursively enumerable.
The fact that a set is recursive if (and only if) both it and its complement are reeursively enumerable is very important.
If we have two procedures, one which
always halts and gives a YES when the input is in set
R ,
set but otherwise may
not halt and one which always halts and gives a NO answer when the input is not in R
hut otherwise may not halt, we can put them together and get an algorithm which
does one step of the first procedure and then one step of the second procedure in alternation and halts and gives the answer provided by whichever procedure halts first. Suppose we have a class be true and recursive set me~r
of
C
infinitely many names.
C
A
of objects for which a proper~y
of n a ~ s of
C
such that
may or may not
C = {ca I a e A} . Each
However, each nam~ in P
is decidable for
A
C
refers to exactly one member of -
really for the set of names
A
if the set
{a
e
is recursive.
A
I
P
holds for
In other words,
P
c a}
is decidable for
C
only if there is a Turing machine which on input
a
if
ca
P
P
has at least one nm~e{ some members may have several or even
C . Then we say that for
C
holds for
A property
ca P
and gives the answer NO if
is partially decidable if the set
is recursively enumerable.
That is,
P
as described by
if and
does not have property {a e A I
P
P .
holds for
ca }
is partially decidable if there is a %%ring
machine which halts and gives answer YES on input
a
if
ca
]has property
which will either halt and give answer NO or else loop forever if property
A
halts and gives the answer YES
ca
P
and
does not have
P .
We shall use without proof the following basic fact of computability theory.
THEOREM 6. i
It is not partially decidable whether a Turing machine diverges on the
blank initial tape.
6-3
A.
!%40 TAPE FINITE STATE ACCEPTORS We shall find it more convenient to use a result on two-tape finite state
machines rather than directly employ the result for Turing machines.
We shall
consider a finite state machine with two tapes, each with its own read-only head moving from left to right, and observe its behavior when each tape has the same input.
A two-tape one-way deterministic finite state acceptor_
DEFINITION
M : (Ki,K2,Z,~,qo,qa~%) (i)
qo
in
~
K1 U K 2 ~ an accepting state
neither (2)
consists of:
Two finite disjoint sets of states,
qa
nor
A finite set
E
qr
in
~
U
and qa
K 2 , a designated initial state and a rejecting state
qr
with
K2 ,
of input symbols,
and (3)
A transition function (K1 u
K2 u
{%,%})
6
from
- {%}
( ~ U K 2) x Z
.
An instantaneous description of
M
M , the input
is a triple
current state
q
the input
on Tape 2 which remains to be scanned.
w2
of
wI
for
a
in
~ , we write
(q,awl,w 2)
for
a
in
Z , we write
(q,wl,aw 2)
reflexive transitive closure of AI*
B
and
B I*
C
imply
~-
W'l.~of
wI
and
~
If
q e KI
and
p : ~(q,a)
q e K2
and
p = ~(q,a)
~- (p,wl,w 2) . Then
(qo,Wl,W2) I
w 2' of
H
and
w~
(Wl,W 2) . Let
infinite tapes on which
M
M
diverges.
M
If
HI
is equivalent to
An infinite tape tapes
u,v
string
w
u
(wl,w 2)
is a fLnite
w2 , then
and
Ld(H)
if
M
M
neither
nitial substring diverges on H , ~(H)
the
set of all the pairs of MI
and
H2
are equivalent if
.
The sets H2
~(M)
w
and
we necessarily have
is ulti~mtely periodic if
~,~th v ~ e ~ i.e. if
initial string
for any terminal
accepts or rejects a tape if and only if it accepts or rejects
some pair of finite initial subtapes. disjoint.
w~
Two machines
La(M~) : La(M2) and %(M l) : ~(M 2)
A , and
accepts a pair of tapes
be the set of all pairs of tapes accepted by
set of all pairs of tapes rejected by
Observe that
M
rejects
is a finite initial substring of La(H)
is defined as the
is a pair of infinite tapes and
accepts nor rejects any pair~ (w~ ~w~) such that wI
I "~
That is A I *
(qa,Wl,W½)
w 2 , while (Wl,W 2)
containing the
(P,Wl,W 2) ~ if
A i ~:- C . We say that
(qo,Wl,W2) I ~" (qr,wl,w~) . If of
(q,wl,w 2)
on Tape i which remains to be scanned and
in the usual way.
(Wl,W 2) , finite or infinite, if subtapes
into
Lr(H)
are always
Ld(~) = Ld(M 2) .
w = uvvv ...
for finite
can be ~ritten as a finite (possibly empty)
followed by arbitrarily many repetitions of a nonempty finite
v . We need the next result which relates Turing machines and two-tape
acceptors with special attention to behavior on ultimately periodic input tapes.
6-4
THEOREM 6.2
For each Turingmachine
deterministic finite state acceptor
T , one can construct a t~m-tape one-way ~
such that if
D = {(w,w) l w
input tape,
finite or infinite} : (i)
MT
(2)
never diverges on
La(~)
f] D = ¢
(w,w)
if
if and only if
w
is ultimately periodic, and
Ld(~)
~
D ¢ }
if and only if
T
diverges when its initial input is the completely blank Tape.
PROOF We only sketch the construction, since this is not a treatise on computability theory. state set
K ,
Suppose
K (~ V = ~
T
instantaneous descPiption (ID) of nonempty, and and
T
q
in
K
has vocabulary
and initial state T
T
C ;
¢
can he written as
q
always sees a new blank symbol
its right or left edge. described as
with blank symbol Let
The computation of
qo B ~ w
I ~w
T
2 ~-- ...
B
for
xy , T
and
x,y • V
An
, y
is in state
q
The rightmost symbol of
y .
when it is about to fall off
on an initially blank tape can he
and can be encoded as
E(C) = ¢qoB¢¢Wl¢¢Cw2¢¢¢¢w 3 .... , assuming that new blanks instantaneous description only as needed
B e V
be a new symbol.
xqy
if the current tape contents is
is scanning the symbol to the right of
We assume that
V
qo "
-
i.e. when
T
B
are added to the
goes left or right of
its current tape. Now
~
searches for input pair
(E(C),E(C))
.
It acts as follows on input
(w,w) : (i)
First
(2)
If
MT
goes to ~
checks on Tape 2 that qr
and if it does, .n+l ~ wn
has just scanned
start of this substr£ng
w
starts with
¢qoB .
moves just right of
If it does not B .
on Tape 2 and is positioned on
(¢n+lwn) , then
P~
si~altaneously scans
Tape i and scans to see whether the next substring on Tape 2 is Notice that
ID Wn+ I
Tape i at the cn+lwn
on
¢n+2wn+ I .
can differ in at most three positions from
ID w n
(i.e.,
state, symbol scanned and symbol left of scanned symbol if the move is left). So this check requires
MT
to remember at most the last 3 symbols at one time,
which a finite state device can do. on Tape 2 it goes to
qr
If
~
does not find this s~bstrJ~g next
and halts; otherwise it ~ms just s c ~ n e d
¢n+2wn+ I
on Tape 2 and is positioned to scan this same substring on Tape i.
(3)
If
~
where
duping its scan of Tape 2 recognizes that it has just seen wn
is a terminating or halting ID, then
Since this condition of
wn
~
halts in state
¢n+lw
n qa "
depends solely on the state and current symbol
scanned, a finite state m~cDfme can easily recognize it.
6-5
Observe that this procedure stops only if either it is not scanning a pair starting in (3) recognizes that and so
~
goes to
blocks of
¢'s
cannot be
E(C)
qa
C
and accepts.
C
in (2) recognizes that qr
and rejects or if
is finite and that the input starts with
(E(C),E(C))
Notice that since we have forced successive
~to become larger and larger~ if for
~
(E(C),E(C)) and goes to
infinite, and so
Mr
w
is ultimately periodic it
will never diverge on
(w,w)
if
w
is an initial substring of
w
is ultimately periodic. Thus and
C
~
accepts
is finite.
initial blan~ tape. and
C
(w,w)
Thus
if and only if
La(Y~) N
Similarly,
is infinite.
Hence
D = ~
~
E(C)
if and only if
diverges on
Ld(}~) n
D ~ ~
(w,w)
T
diverges on the
if and only if
if and only if
T
w = E(C)
diverges on the
I
initial blank tape.
Suppose it were partially decidable for two-tape one-way deterministic finite state aeceptors
M
whether
La(M) @ D = ~ . Then we would have a partially
computable decision procedure
~
(implementable by a Turing machine) which given
the name of a t~o-tape one-way deterministic finite state acceptor give answer YES if never halts if
La(H) @
La(M) n
D = ~
H
will halt and
while it either halts and answers NO or else
D ~ % . Now we can take the algorithm ~
of the previous
theorem (total recursive function, implementable by an always halting Turing machine) which transforms the name of a Turing machine way deterministic finite state aceeptor if
T
~
T
such that
diverges on the initially blank tape.
>
--
~
into the name of a two-tape oneLa(MT) @
We hook ~
to
D = ~
~
if and only
to form
.~' :
>NO
>
LOOP
Clearly If
~'
the name of that
is itself a partially computable decision procedure.
Turing machine T
La(Mr) N
T
as input, D : ~
and, since
~'
will transform
La(}~) N
decidable whether machines to halt on
M .
~'
receives the name of
La(H) gh D = ~
for
decision procedure ultimately periodic.
~
~'
T
) whether
But this is krowm to be false.
is given
and discover via If
T
halts on the
as input it changes
T
to
w
T
diverges on. the
Hence it is not par~ia!ly
for two-tape one-way determ/nistic finite state
Since the algorithm ~
(w,w)
~
~'
D ~ ~ , either halts with mnswer NO or else loops forever.
Thus it would be par~ially decidable (by initially blank tape.
T into
and then halt with the answer K S .
initially blank tape, when Mr
diverges on the initially blank tape, and
produced a machine
MT
which was ~aaranteed
ultimately periodic, there cannot be such a partial
even for machines guaranteed to hale on The same argument applies to the problem
(w,w) Ld(M) @
for
w
D ~ % .
6-6
Hence we have shown that:
I ~ O R E H 6.3
The follow£ng p r o b i ~
way d e t e ~ m i s t i o diverge on
are not partially decidable for t~m-tape one-
finite state acceptors
(w,w)
for
w
M
even if
M
is guaranteed not to
ultimately periodic:
La(M) (~ D :
hd(H) n
n ~
We could use standard coding tricks to show that two symbol input alphabet.
COROLLARY 6.4
ZT
could be taken to have a
Hence:
The following problems are not partially decidable for two-tape one-
way deterministic finite state aeceptors guaranteed to halt for
(w,w)
whenever
M
with input alphabet
w
{0,i}
which are
is ult£mately periodic:
L a (H) F] D = Ld(M) 6~ D
*
This corollary is the starting point for most of our proofs of un.decidability. The general strategy will be to show that a property
P
of schemes is not partially
decidable by finding an algorithm to transform each scheme way deterministic finite state acceptor only if
S
possesses property
H(S)
such that
La(M) F] D = %
into a two-tape one-
L(M(S))
(~ D = ~
if and
P . Then the previous reasoning will show that the
existence of a partial decision procedure for property of one for
S
P
would imply the existence
which we know tQ be impossible.
So we can conclude that
it is not even partially decidable whether a scheme possesses property
P . The
technical term for such a strategy is "many-one reducibility" (actually, one-one reducibility in our examples). P "
B.
We brave shown that the problem of whether
is at least as bard as an "impossible" problem
-
" L a (M) ~
" S
has
D = ~ "
UNDECIDABLE PROPERTIES OF SCHEMES We shall show our undecidability results for monadic schemes with one function
letter, one predicate letter and two program variables. all schemes with: i)
n
2)
one monadic function letter
program variables
Yl ..... Yn
3)
one monadie predicate letter
4)
one input variable
x
f T
Let
Sn
be the fanily of
6-7
The general approach will be to set up a i-i correspondence between free interpretations of schemes in
S2
and infinite binary tapes.
interpretation of such a scheme (notice that the values of
T
on
fm(x)
Sn
does not allow constants) only
could affect the flow of computation and the ultimate
odtput and so we can consider everything else to be fixed. of the form
fro(x) and a free interpretation
tl(E) where
=
Given an expression
E
I , let
a0ala 2 ... a i ...
a 0 : I(T)(E)
and
a i : l(T)(fi(E))
for
i >- i .
Now it is clear that given an infinite binary tape interpretation on
Obviously in a free
Sn
for which
t
there is a free
t = tl(x) . The schemes in
Sn
that we shall
use to establish our undecidability results will actually test only expressions of the form
fro(x) for
m -> 2
and so for all purposes a tape
t
can be considered
to correspond to a "unique" (unique as far as concerns operation of the schemes in question) free interpretation
t
:
I
such that
ti(f2(x))
Consider the five schemes
Pi(M)
diagrammed /~i Examples IV-i through VI-5.
In each case the idea is to establish a correspondence between a binary tape the input
(t,t)
to two-tape one-way deterministic finite state machine
a free interpretation schemes
ZI
and
I
Z2
on
Pi(H)
for which
in Example VI-6;
ZI
t ,
M ~ and
t : ti(f2(x)) . We also use special
never halts and
Z2
always halts.
We can show by careful examination of the schemes in Examples VI-I to VI-5 that the following statement holds in each case.
LE~94A 6.5 (i)
The computation of
Enters address
q
(2)
Enters address
a qr
(3)
Never enters Ld(M)
n
n .
qa
Pi(M)
under free interpretation
if and only if if and only if or
qr
(t (f2(x)),t (f2(x))) I _ I 2 (tl(fZ(x))~ti(f (x)))
if and only if
I
on input
is in is in
(ti(f2(x)),tl(f2(x)))
La(M) N
x : D .
Lr(M) ~ D . is in
6-8
EXAMPLES VI-I - 5.
CONSTRUCTION OF SCHEMES
Pi(M)
in
S2
~m
a two-tape one-way deterministic finite state aeceptor VI-I
Construction of
Pl(H)
M = (~,K2,{0,1},6,qo,qa,q r) which always diverges if and only if For each
q
I Y2 ÷ f(x) _] !
%
For
qa
and
qr
~
, subseheme :
V
i
Yl ÷ f(x)
in
subscher~s:
For each
q
in
K 2 , subschem~:
V r
,,,,,,,y2÷ f(y2 ) I
o
is the address of a subscheme
6-9
EXAMPLE VI-2
Construction of P2(M) which is NOT always halting (diverges under some interpretation) if and only if Ld(H) ~ D ~
Initial subscheme
Yl ÷ f(x) Y2 ÷ f(x)
Subschemes associated with states: For q in
I
I
Yl ÷ f(Yl) I
V Terminal subseheme
~(,. .o~,
V For q in K 2
V
Y2 ÷ f(Y2 )
6-10
EXAMPLE Vl-3
Construction of w
P3(M) . If M
is ultimately periodic, then
halts on P3(M)
(w,w) whenever
halts for all
finite interpretations if and only if La(M) ~ Initial subscheme:
D =
Subschemes associated with states: For
q
in
C SIY~RT)
1
Y
Yl + f(x) 1 Y2 ÷ f(x)
I
0
Subschemes for
7
qa
and
qr
For
7 STOP
)
I
q
in
K2
6-11
EXAMPLE VI-4
Construction of equivalent to
P4(M)
such that
P4(M) is NOT strongly
Z 2 if and only if Ld(M) gh D ~
Subschemes associated with states : Initial subscheme For
q
in
KI
START " ~
l
Yl ÷ f(Yl )
+ Y2 ÷ f ( x )
Subscheme for
qa ' qr
0
For
i
q
in K 2
V Y2 ÷
0
i
6-12
EX~PLE VI- 5
Construction of if and only if for
w
P5(M)
which is weakly equJ~jalent to
La(M) ~ D = ¢ . If M
ultimately periodic, then
equivalent to
Z2
Ps(M)
converges on is finitely
if and only if La(M) £] D = ~ .
For
q
in K I
)
V
Y2 ÷ f(x) Y2 ÷ f(x)
t
I 0
Subschemes for
(
(w,w)
Subsehemes associated with states:
Initial subscheme START
Z2
%,
%
Y
Yl ÷ f(x) Y2 ÷ f(x)
STOP )
(
STOP , )
t
For
q
in K 2
Y2 ÷ f(Y2)~ i
I
6-13
EXAMPLE VI-6
Special Schemes
ZI
and
Z2
Scheme ZI always diverges.
Scheme Z2 always halts
START
START
>
,L I Yl + f(x) ] [ Y2 ÷ f(x)
1
6-14
PROOF of Lemlm 6.5 The lemma follows directly from the definitions of Ld(M)
and the following claim which can be proven by induction on
CLAIM q
The computation
with
and
La(H) ~ Lr(M)
val(y I) = E 1
val(Y2) = fS(E 2)
from
q
to
p
reading
second tape.
(Pi(M) ,l~x) for fgee interpretation and
val(y 2) = E 2
if and only if r
to address
M
on input
p
~ith
I
and
r+s :
goes from address
val(y I) : ~ ( E I)
(tl(f(El)),tl(f(E2)))
symbols on its first tape and
s
goes
symbols on its
•
THEOREM 6.6
P
The following properties of a scheme
for schemes in
S 2 , and special schemes
ZI
and
(i)
P
diverges under all interpretations
(2)
P
diverges "dmder all fLnite interpretations
(3)
P
is strongly equivalent to
ZI
(4)
P
is finitely equivalent to
ZI
(5)
P
diverges under some interpretation
(6)
P
halts under all finite interpretations
(7)
P
is not strongly equivalent to
(8)
P
is not totally equivalent to
(9)
P
is weakly equivalent to
(1O)
P
is finitely equivalent to
are not partially decidable
Z2 :
Z2 Z2
Z2 Z2
PROOF (i)
It is not partially decidable for two-tape one-way deterministic finite state
machines
H
whether or not
construct
PI(H) . Examining
pretation
I
La(H ) r% D = ¢ . Given such a machine PI(H)
(PI(M) ,l,x)
(tl(f2(x)),tl(f2(x)))
is not in
we can
we see that it diverges for a free inter-
if and only if it never reaches address
le~ma we see that
H
fails to reach
qa
qa ; from the previous
if end only if
La(M) ~ D . On the other hand, if
La(M) r% D , there is a free interpretation
I
hence in this case
and halts.
(PI(H) ,l,x) reaches
qa
for which
(t,t)
t = ti(f2(x))
and
Since a scheme always
diverges if and only if it diverges for all free interpretations, we see that always d i v e r g e s i f rand o n l y i f
La(H) ~
D = ¢ .
Thus i f we had a p a r t i a l
p r o c e d u r e which b a i t s and g i v e s t h e answer YES f o p e v e r y we c o u l d have a p r o c e d u r e *to p a r t i a l l y not p a r t i a l l y
decidable whether
P
decide whether
always d i v e r g e s .
is in
P
PI(M)
decision
which n e v e r c o n v e r g e s
La(H) (% D : @ .
Hence i t
is
6-15
(2)
Notice that if a scheme
pretation then
I , that is, if
(P,I' ,a)+
P
does not diverge everywhere for some inter-
(P,l,a)+
for some f ~ t e
for some input
sub£nterpretation
a
I'
in the domain of of
computation is by definition finite and so the range of values of every variable
u
and point
i
in the computation is finite.
this finite subset of the domain of
for each function letter
f
let
val(u,i)
If we let
for D'
be
I , let the interpretation of each predicate
letter be the restriction of its interpretation under
and elsewhere
I ,
I . For a halting
l'(f)(~) = l(f)(~)
I
to subdomain
whenever
l'(f)(~) = ~ , it is evident that computation
indistinguishable from computation
(P,I,a)
D' , and
l(f)(b-) is in (P,I' ,a)
and in particular halts.
D'
is
Hence
P
diverges everywhere if and only if it diverges everywhere on all finite interpretations.
(3)
Thus property (2) is equivalent to property (I) restated.
Since
ZI
and only if
diverges everywhere, evidently
P
is strongly equivalent to
ZI
if
P
diverges everywhere.
Hence property (3) is also a restatement of
P
diverges everywhere under all finite inte pretations Jf and only if
(i). (4) P
Again,
is finitely equivalent to
($)
Now examine
pretation
I
ZI
so we again have a restatement of (I).
P2(M) . A computation
if and only if it never reaches
computation diverges if and only if (t,t) I
(P2(M),I,x)
is in
Ld(M) , then
such that
qa
or
diverges ~nder free interqr ; thus by the len~na, the
(tl(f2(x)),tl(f2(x)))
(P2(M),I,x)
is in
Ld(M) ~
D . If
will diverge for any free interpretation
t = tl(f2(x)) • A scheme is not always halting if and only J~ it
diverges for some free interpretation.
Hence
P2(M)
(diverges for some interpretation) if and only if
is not always halting
Ld(M) N D ~ $ , which is not
partially decidable. (6)
First recall that we actually showed that
La(M) ~
D ~ $ ?
is not partially
decidable even for two-tape one-way deterministic finite state machines with a two sym~l alphabet which always Palt on
(t,t) whenever
This was because in our construction of to halt on
(t,t)
unless
t
(t,t)
t
¢'s
t
ultimately periodic.
T , we forced T
on the blank
in the eneodement we made sure that such a
could never be ultimately periodic. for
is ult£mately periodic.
encoded an infinite computation of
initial tape and by placing extra tape
t
Y~f from Turing machine
Hence we can assume that
M
halts on
6-16
Suppose
(P3(M),I,a)
in the domain of
I . Since
we see that there are ~l(a) = ~i +mk
diverges for some finite interpretation, I
n
for all
I
and
has a finite domain, letting
k
such that
m ~ 0 . Letting
fl
and input
stand for
a
l(f) ,
~l(a) = _~l+k(a) ~nd hence
TI
stand for interpreted predicate
I(T)
we see that in particular,, the tape
t
2 3 Tl(fl(a))Tl(fl(a))
:
is ultimately periodic. t = ti,(f2(x))
If we let
we see that
and thus reaches
qa
or
execution sequence as
M
I*
qr ; as
address
qa " This means that Ps(M)
H
(P3(M),I*,x)
accepts
La(M) N D = ¢ , then
free interpretation
I
with
is ultimately periodic
follows the same infinite
(t,t)
P3(M) (t,t)
and so
La(H) q D ~ ~ .
La(H) N
D ~ %
and
halts for all finite interpretations. is in
t : ti(f2(x)) qa
t
La(H) F] D . Then there is a
for which computation
(P3(M) ,l,x)
in some finite number of steps, say
n . After
qa ' the computation loops forever without computing any new values of
any of its variables. on
since
diverges for any finite interpretation
will eventually enter address
T
(t,t)
and in particular diverges, it must enter
On the other hand, suppose that
entering
be the free interpretation with
_halts on
(P3 (M), I ,a)
Thus if
conversely, if
. . Tl(f~(a) . . . . ).
Thus this computation depends solely on the specification of
A = {fJ(x) I 0 -< j -< n} . Let
l'(f)(fJ(x)) : fJ+l(x) = l(f)(fJ(x)) I'(T)(E) = I(T)(E)
for all
execution sequence of
E
in
I'
be the interpretation with domain
for
A . Thus
(P3(M),I',x)
(P3(M) ,l,x) until entering
Hence
P3(M)
P3(H)
diverges for some finite interpretation.
diverges for finite interpretation
La(M) ~
qa
and
clearly follows the
and then is trapped forever.
I' . Thus if
Putting our conclusions together, we see that interpretations if and only if
A ,
0 <- j -< n-i , l'(f)(fn(x)) = fn(x)
P3 (M)
La(M) N
D ~ ~ ,
halts for all finite
D : ~ . Hence there is no partial decision
procedure to determine whether a scheme halts for all finite interpretations.
(7) qa
Examining or
qr
P4(M)
we see tlnat this scP~me halts if and only if it ever enters
and when it halts the output is always
a program variable, and this is the output of (t,t) with
is in
Ld(M) £] D
t = tl(f2(x))
and so
always halting scheme equivalent to
Z2
then
P4(M)
t
Z2
only if it ever
is chosen with
, since
under all circumstances.
P4(M)
Z2
If I
can fail to be strongly
diverges, that is only if
(P4(M),I,x)
I . Such a computation never reaches
is not strongly equivalent to
is not
certainly cannot be strongly equivalent to the
t = ti(f2(x)) , M
partially decidable property.
x
diverges for free interpretation
Z 2 . On the other hand,
for some free interpretation if tape
(P4(M),I,x)
(f(x),f(x))
diverges on
if and only if
Ld(M) ~
qa
or
(t,t) . Hence
diverges qr
so
P4(M)
D ~ ¢ , which is not a
6-17
(8)
Since
if
P
(9)
Z2
is always halting,
is totally equivalent to
Examining
qr
P5(M)
it gives output
enters address some
r,s ~ 2
equivalent to
qa
is strongly equivalent to
(f(a),f(a))
,
= (f(a),f(a))
H
is weakly equivalent to
L(M)
M
Again we examine
halts on
P5(M)
enters
(t,t) qa
if and only if
qr
Z2
.
Ps(M)
If it ever for
is weakly
ever enters
ever enters state
qa "
qa "
So
Ps(M)
Fh D = ~ .
t
is ultimately periodic and this implies that
Z2 .
So
if and only if no computation ever reaches
L a (M) C~ D = ~ .
Hence
for all finite interpretations.
under all finite interpretations as does to
.
enters address
Ps(M) . As we did in (6) we notice that we cmn assume that
whenever or
if and only
= (fr(a),fS(a))
(Ps(M),I,a)
Tb~s inolds if and only if no computation of
(i0)
(Z2,l,a)
val(Ps(M),l,a)
if and only if no computation
Z2
(P5(M),I,a)
the same output as
it halts with an output val(Z2,l,a)
Z2
Hence (8) is a restatement of (7).
we see that if any computation
whereas Z2
P
Z2 .
Ps(H) qa
Hence
Ps(H)
halts
is finitely equivalent
if and only if.
m
Now let us see some of the implications of these undecidability results. Per~mps the most important is that neither " P
is not strongly equivalent to
Q "
" P
strongly equivalent to
is partially decidable.
Q "
nor
This is why we
could claim as we did that there is no point in giving a large list of elementary equivalence preserving transfor~mtions
-
either global or local
-
since no such
list could be complete and result in ultimately establishing all possible equivalences. Somewhat
more formally, we claim that there can be no list of transformations
on schemes :
tl,t2,...,ti,... such that :
(i)
The function
(2)
F(i,P) : ti(P)
(3)
If
P
F(i,P) = ti(P)
is total recursive.
is stm~ngly equivalent to
is strongly equivalent to
iI ..... i
such that
Q
Q = til(ti2(
P
for each
i .
there is a finite set ... (tir(P))...
)) .
The existence of such a sequence would imply the existence of a partial decision procedure for
" P
with a n ~ r
N
a scheme
P'
is strongly equivalent to and a pseudostack with up to
Q " N
as follows.
We keep a counter
entries of the form
(P'~i)
for
(or, more accurately, the description or name of a scheme) and a number
6-18
i
less than
N . Let the function
POP(X) , remove the top of stack
TOP(X)
give the top of pseudostack
X , and
PUSH(X,Y) , add
give the n~mmbeP of entries in stack
X
Y
and let
X ,
to the top of
X
let
Height(X)
m~d
R( (P' ,i)) = i . Then we can express the procedure using the WHILE program 5m
L((P ~ ,i)) = P'
Example VI-7.
The procedure exemplifies an idea called "dovetail£ng" exhaustively searching an infinite tree.
-
a way of
In this case the choice tree ~s infinite
branching (corresponding to a possibly infinite set of transfor~nations) as well as having potentially infinitely ~im~y levels, corresponding to the fact that any finite number of transformations might be applied to take transformation
til(ti2(...(tir(P) ... ))
P
and then searches the set of all such vectors with For each value of
tree is employed. on
P
N
Q . A compomnd
is regarded as a vector
and the procedure first tries the null vector (i.e. is
N = 1,2,...
Lnto
P
r s H+l
(il,i2,... ~ir)
already equal to
Q )
and each
i. <_ N for 3 a standard backtrack procedure over a finite
The stack keeps track of the effect of successive transformations
and the transformations performed at each step.
everything is reinitialized.
of the ir~fLnite tree are constantly rescann.ed. avoid this problem.
Whenever
N
is updated~
This is inefficient since the finite initial portions By using another stack we could
Each possible vector is tried in turn and the procedure halts
if and only if one of the eomresponding compound transformations takes
P
into
Q .
If such a complete list of transformations exists, then the procedure will halt and give the answer YES if and only if partially decide
" P
P
is strongly equivalent to
strongly equivalent to
Q "
Q . Thus it would
Since we know this is
impossible we must conclude that no such list of transformations exists.
THEOREM 6.7 that
If
tl~t2,... ~ti~
F(i,P) = ti(P)
. . . . . .
is a list of transfo_~mations on schemes such
is total recursive, then either there is at least one
which is not equivalence preserving (i.e. ti(P) for some scheme
P ) or there are schemes
P
and
ti
is not strongly equivalent to Q
such that
P
strongly equivalent and no application of the transformations takes (i.e. the list is not complete with respect to strong equivalence).
and P
Q
are
Lnto
Q
P
6-19
E X A M P L E Vl-7
N
÷
1
S
+
¢
V
÷
P
n
÷
1
WHILE
A SPECL~L W H I L E P R O G F A H
V ~ Q
DO IF
(0 -< HEIGHT(S)
< N)
AND
(n -< N)
THEN
S
+
PUSH(S,(V,n+I))
V
+
tn(V)
n
÷
i
ENDIF IF
(0 < HEIGHT(S)
_< N)
AND
(n = N+I)
THEN
U
÷
TOP(S)
V
÷
L(U)
n
+
R(U)
POP(S) ENDIF IF
(HEIGHT(S)
: 0)
AND
(n : N+I)
THEN V
+
P
n
÷
i
N
÷
N+I
V
÷
t (V)
n
+
n+l
F~I)IF IF
(HEIG}£f(S) = N)
~
(n -< N)
THEW
n
END!F ENDWHILE ~NSWER STOP
+
YES
6-20
An exhaustive simplification procedure with respect to strong equivalence would he an infinite set of transformations totally recursive in whenever
P
jl,...,j s
i
~nd
P , ti(P)
is strongly equival~nt to such that
til
such that
F(i.P) = ti(P)
is
is always strongly equivalent to Q
.tir(P) = tjl
ti
then there are .t.gs(Q)
iI ,... ,ir
P
and
and
The same sort of dovetailing
argument used above shows that the existence of such a procedure would imply the partial decidability of strong equivalence.
THEOREM 6.8
Hence:
There is no exhaustive simplification method for strong equivalence.
Similarly, there can be no min~nal canonical forms for schemes in the following sense:
THEOREM 6.9
There is no subclass
C
of schemes such that there is a total
recursive function mapping all schemes into
C
with strongly equivalent schemes
mapped into the same scheme.
These results hold not only for' strong equivalence but also for weak equivalence and for any "reasonable equivalence".
DEFINITION whenever
A relation
~
among schemes is called a "reasonable equivalence" if
P ~ Q , then
P
is weakly equivalent to
Q
equivalent to
Q , then
THEOREM 6.10
For any reasonable equivalence relation
in
S2 , " P ~ Q "
and whenever
P
is strongly
P ~ Q .
is not ~ t i a l l y
~
and schemes
P
and
Q
decidable.
PROOF We examine the schemes f(x),f3(x),f5(x)~.., pretation
I , let
Tl(f2n+l(a)) = 0
P6(M)
and
for the first TI
stand for
for some input
Z3
f2n+l(x) I(T)
and
a ~ then
in Example VI-8.
fl
P6(M)
for
computation
Otherwise, if N = Min{n I TI (f2n+l(a)) = i} tf2N+3,a~ f2N+8..~. val(Z3'l'a) = ~ I ~ j' I ta)) . Now
Scheme
Z3
which is tested to be i.
searches For inter-
l(f) . If for all (Z3,l,a)
computation
n -> i ,
diverges.
(Z3,l,a)
halts and
is constructed from two-tape one-way deterministic finite state
automaton H = (~,K2,{0,1},@,~,qa,q~) as in Examples VI-I - 5 except that it tests f2n+l(x) for i and uses f2n(x) as the previous schemes used fn(x) . If computation (PI(M),I,a) at step i ]ms val(yj,i) = £2n+I -I ta) and tests T!(val(y j,i)) = i , it goes to either subseheme
I
for
j = i
or
II
for
j = 2
and these are halting s~schemes which stop with val(P6(M),I,a) = (~2n+3, , _2n+3, ,, rI
6-21
EXAMPLE VI-8
CONSTRUCTION of
P6(M)
from deterministic two-tape
one-way finite state acceptor M = (~,K2~{0,1),6,qo~qa,q r
Initial subscheme:
Special Subscheme I
START
Y2 + f ( x )
Y2 ÷ f(Yl ) I Yl ÷ f(Yl ) ]
0
1
Yl ÷ f(Yl )
I
+ Y2 ÷
Subscheme for
Special Subscheme II
qa :
~ sToP )
6-22
EXAMPLE VI-8
CONTINUED
For
q
in
-
KI
Subsehemes for states in, K I t) K 2
For
q
in
I Yl÷ f(Yl)J f
0
Y2 ÷ f(Y2 )
f
%)
K2
6-23
EXAMPLE Vl-8
CONCLUDED
-
Subscheme for
Subseheme for
qr
and Scheme
Z3
Z3 :
qr :
START
y~ ~-x
I
Yl ÷ f(Yl ) I
Yl + f(Yl )
h
÷ f(Yl )
I Yl + f(Yl ) I Yl ÷ f(Yl ) ]
I yl
I J
.I l Y2 ÷ f(Yl )
If
La(M) (% D = %
then
P6(M)
is strongly equivalent to
If
La(M) (% D ~ %
then
P6(M)
is not weakly equivalent to
DEFINITION:
A relation
~
is strongly equivalent to weakly equivalent to
Z3 Z3
on schemes is a "reasonable equivalence" if whenever Q , then
P ~ Q
and whenever
P ~ Q , then
~ , P6(M) ~ Z 3
if and only if
La (M) F] D = ¢ . Hence, for any reasonable equivalence relation S2 ,
" P ~ Q "
is
Q .
For any reasonable equivalence relation
in
P
is not partially decidable.
~
and schemes
P
6-24
Similarly, if the computation reaches Tl(f2n-J(a)) = 0 scheme
Z3
and if
(Z3,l,a)
~
with
val(y I) : f2n(a) , we must have
for
i -< 2n-j _< 2n-i
and since subsoheme
Z3
is initialized,
(P6(M),I,a)
after
halts then
(P6(M) ,l,a) diverges, it must eventually compute
and so
(Zs,l,a)
have different outcomes
-
La(M) lh D = %
is if
On the other hand, suppose
accepts
t
Z3 (t,t)
NI
for
for
and so
halts with output
computation
never compute
with fn(x)
n >-N+2 . Hence
M
(Z3,l,a)
can
n > 2N+4
qa " As we
La(M) N
La(M) ~ accepts
D . Let (t,t)
D = ~
t' . There is some N2
t = a0ala 2 ...... ;
for N
t
finite, it
such that
M
on Tape 2 with Tl(fn(x)) = 0 C -< n -< N+I
2N+5 : Min{n I T~(fn(x)) = i
and
n
and
is odd}
(f2]'[+7(x),f2N+7(x~) . On the other hand
will be able to complete the simulation of
P6(M)
cannot hold.
and
val(y 2) = f2N2+4(x)
and hence never apply
is not weakly equivalent to So if
Having established that
P6(M) ~ Z 3 , then
T
P6(M) ~ Z 3
decidable for schemes in
S2 •
Z3
La(M) N
if and only if
not partially decidable, T~ can conclude as usual tgat
COROLLARY 6.11
Hence if
n -> 0 , Tl(f2n+l(x)) : 0 ,
val(y I) = f2N!+4(x) for
and
to
M
on
(t,t)
since it will f2n+l(x)
with
val(P6(M),I,x) = (f2Nl+4(x),f2N2+4(x)) ~ (f2N+7(x),f2N+7(x)) =
val(Z3,I,x) . Thus P6(M) ~ Z 3
n -> N . Thus
(P6(M),I,x) qa
for all
P6(M) ~ Z 3 .
symbols on Tape i and
Tl(f2n+5(x)) = I
and reach
and since it
reaches state
be the free interpretation with
0 < n -< 3 , TI(f2n+4(x)) = a n
(Z3,I,x)
(P6 (M),l,a)
is in
(tt' ,tt') for any infinite tape
halts after reading exactly I
(P6(M),I,a)
and afortiori
to be infinite since if
N = Max(NI, N 2) . Let
n
Tl(f2n+l(a)) : 0
this can never happen.
is strongly equivalent to
we can assume
for all
odd,
diverges
i.e. have one converge and the other diverge or both
converge with different outputs saw before, if
fl(a) n
(Z3,l,a)
If computation
also diverges.
Thus we see that the only way computations
P6(M)
is identical to
diverges if
val(P6(M),l,a) : val(Z3,l,a) .
will halt if any of these values tests to I for n >- i
qr
which means that D : ~ .
L(M)
~
" P ~ Q "
D = ~
which is
is not partially
I
There is no exhaustive simplification procedure for any reasonable
equivalence relation.
We can contrast these negative results with the following "partially negative" or partially decidable results.
6-25
THEOREM 6.12
Let
Q
be any scheme which halts under all interpretations.
following properties of schemes
P
and
R
The
are partially decidable although not
decidable: (I)
P
baits under some interpretation for some input
(2)
P
halts under some finite interpretation for some input
(3)
P
is not strongly equivalent to
ZI
(4)
P
is not finitely equivalent to
ZI
(5)
P
diverges somewhere under some finite interpretation
(6)
P
diverges everywhere under, some finite interpretation
(7)
P
always halts
(8)
P
is strongly equivalent to
(9)
P
is totally equivalent to
Q
Q
R
(i0)
P
is totally equivalent to
(ii)
P
is not finitely equivalent Co
(12)
P
is not weakly equivalent to
R R
PROOF Theorem 6.6 tells us that the negative of each of these statements is not partially decidable and so none of them are decidable. Statements (1)-(4) are equivalent since we saw before t~mt if a scheme halts for any interpretation~ it Halts for some finite interpretation. halts for any input under any interpretation, interpretation
I
(P,l,x)
Further, if
P
converges for some free
and we can discover this by building the (possibly infinite)
execution sequence tree and seeing whether STOP ever appears.
Hence (1)-(4) are
partially decidable. Any finite interpretation is necessarily reeursive. number of function letters and predicate letters in domain D
or
D
P
There are only a finite and so for each finite
only a finite number of possible assignments of functions from
IJm
to
Dm
to
{0~I} . We csan recursively en~mmera/re all finite interpretations.
A
program must loop if it ever enters the same statement twice with all values specified alike. has I
n
If finite domain
statements and
with more than
ndm
m
D
of interpretation
I
has
d
objects
within
ndm
steps.
a
P
steps must twice enter the same statement with the same
specification of all variables and hence must represent an infinite loop. each input vector
and
variables of any kind, then any execution sequence under
computation
(P,l,a)
Hence for
diverges if and only if it fails to halt
So for each finite interpretation we can decide whether
halts for some inputs or all inputs.
P
Thus (8) and (8) are partially decidable.
We have already seen (in section B of Chapter III) that (7) is partially decidable and that whenever (7) holds f~r
P
we can convert
P
into an always
halting tree scheme and decide strong equivalence and total equivalence (Theorems 3.6 and 3.8 and Corollaries 3.7 and 3.9).
Hence (7) - (ii) are partially decidable.
6-26
As we saw, we can e~lumerate all finite interpretations, pretation
I
and each input vector
a
For each such inter-
we can determine whether
(P,I,$)
and if so what is the outFat and thus decide strong equivalence for (R,I) .
If
P
and
R
P
I
and input
give different answers. which
and
This covers (ii).
is not weakly equivalent to a scheme
an interpretation
(P,I)
ar 9 not finitely equivalent, we will eventually discover
this by trying all finite interpretations. A scheme
halts
a
for. which
R
(P,I~a)
if and only if there is
and
(R,l,a)
both halt but
In this case there is a finite 9~terpretation
val(P~I,a) = val(P,l' ,a)
val(R,l' ,a) : val(R~I,~)
I'
for
. Thus it suffices to
test over all finite interpretations and so we get partial decidability for (12) as for (Ii).
C.
UNDECIDABLE PROPERTIES OF PROGRAMS We have already seen that e v ~ y partial recursive function can be defined by a
program
(P,I)
fu~ictions
where the interpretation
x + i
and
I
is restricted to include only the
x "- i , the predicate
x = 0
(where we take functions over the natural numbers). can assume that the flowelmrt
P
and the constant function 0 It can also be shown that we
contains only three program variables and one
input variable (this is a consequence of Minsky's theorem that every partial reeursive function can be computed using three registers or counters which one can only increase by i~ decrease by i or test for 0; if the Lnput is coded as output as
2z
then two registers suffice).
2x
and
So we can obtain the corresponding
undecidability results for programs over even a very limited interpretation using the well-kno~ results for partial recursive functions.
THEOREM 6.13
The following problems are undecidable for programs
is a monadic flowchart with three program variables and over the r~tural n~.m~ers allowing
I
x + i , x - i ~ x = 0
(i)
(P,I)
diverges for all inputs.
(2)
(P,I)
is strongly equivalent to
(3)
(P,I)
is partially correct for FALSE.
(4)
(P,I)
diverges for some inputs.
(5)
(P,I)
halts for all inputs.
(6)
(P,I)
is totally correct for ~I~UE.
(ZI,I) .
(7)
(P,!)
is not strongly equivalent to
(8)
(P,I)
is weakly equivalent to
(9)
(P,I)
is not totally equivalent to
(Z4,1) .
(Z4,1) . (Z4,1) .
(P,I)
where
is any interpretation and the constant 0.
6-27
(i0)
(P,I)
is totally correct for
z = x
(even if
(P,I)
converges everywhere).
(ii)
(P,I)
is totally correct for
z = x
(even if
(P,I)
is partially correct
for
z : x ).
< sT T
i I I
Z ~- X
< sToP TRIVIAL SCHEME
Z4
is totally correct for
z = x
PROOF Statements
(i), (2) and (3) declare that partial recursive function
val(P,l,n)
is nowhere defined; it is known that it is not partially decidable whether a partial recursive function is everywhere undefined. reeursive function
val(P,l,n)
Statement
(4) says that partial
is not total recursive while statements
(5) and (6)
say that it is total recursive; neither property is partially decidable for partial recursive functions as defined by, e.g., Turing machines. Scheme
Z4
always halts and computes
z = x
-
the identity.
ments (7) and (9) say that a partial reeursive function compute
z = x .
STOP statement in
If
x
P
by
val(P,l,n)
is input but not program variable in
strongly equivalent to
z ÷ x (Z4,1)
STOP to get if and only if
P'
we see that val(P,l,n)
hence (7) and (9) are not partially decidable.
Further,
correct for
z = x
z = y
and is totally correct for
P
and we replace the
(P',I)
(P' ,I)
is partially
if and only if
from
P
by replacing STOP by
interpreted by
I
as
different from
(Z4,I) ~
x + 1 .
z ÷ f(x)
Thus whenever
we see that
(P",I)
STOP where
(P",I)
val(P,l,n)
i.e., total correctness
is not decidable even if partial correctness is given by an oracle. P"
is not
is not total recursive;
is total reeursive; hence (ii) is not partially decidable
form
Thus statedoes not
f
We c~n similarly
is a function
halts it gives an ansmJer
is weakly equivalent to
(Z4,I)
if
6-28
and only if
(P,I)
diverges everywhere and hence (8) is not partially decidable.
For every 9sting machine that
g(n) = n
steps and steps.
if
T
g(n) = n + i
T
one can construct a total r~cursive function
such
started on the initially balnk tape does not stop within if
T
n
started on the initially blank tape stops within
This function is the identity if and only if
blank tape.
g
T
n
diverges on the initially
Hence it is not partially decidable whether a total reeursive function
computes the identity~ this settles (i0).
1
In particular, we see that partial correctness is not decidable even for very trivial output conditions and for programs whose flowchart structure is very simple. This means that the program verification procedure must remain a procedure and not an algorithm
-
success is NOT guaranteed.
No algorith~ can decide whether or not
a program is partially correct with respect to given Lnput and output conditions. Further the verification procedure cannot be completely mechanized.
There is no
procedure implementable on a computer which given a program and an input condition A
and an output condition
B
will always halt and say YES whenever the program is
partially correct with respect to
A
and
B
but when the program is not partially
correct may say NO or may just give up or may even grind on forever.
That is simply
another way of saying t]qat partial correctness is not partially decidable.
If we
could mechanize the production of inductive assertions in such a way that when partial correctness held the assertion generator would finally find the "right" assertions and the THEOREM PROVER finally establish the corresponding path verification conditions, then we would in effect have a partial decision procedure. ~nat does all this mean in a practical way?
Certainly we brave no intention of
writing programs for all partially computable functions; indeed time and space considerations do not allow execution of all partially computable functions.
The
functions actually computed form a very small subset of the prgmitive reeursive functions.
We do not know, however, whether they fall into a class for which
partial correctness is partially decidable; one suspects not.
In any case, since we
obtain our undecidabili~y results for programs with very simple structure, there can be nothing in the structure of "real" programs which will allow us by and of itself to conclude that the properties of interest are at least partially decidable. The undecidability results do not say that a task is always impossible that no program can be written to perform the task properly in all cases. programs could be written to handle speeial cases.
-
just
But
Thus we cannot completely
meehar~ize the verification prooedure so it will succeed eventually whenever it should succeed.
We can of course verify particular programs and we can improve the
verification procedure and increase the set of cases where it will ~¢ork. As a practical matter, complexity questions will probably swamp one first
-
programs for which verification is possible but it simply takes too long.
classes of
6-29
D.
A
DECIDABLE
SUBCLASSES
-
IANOV SCHEMES
A lanov scheme is essentially a one variable scheme.
In the original model as
interpreted by Rutledge such a scheme basically contained: -
a finite state control (finite set
K
of states)
-
a finite set of monadic operators or function letters, a finite set of Boolean predicates or test letters,
fl "'" 'fn
Tl,... ,Tm
a single register for input, computations, and output a designated output function 0 The program started with input
x
in the register.
off, at first all possible tests are applied to an m-tuple of O's and l's.
To start the computation
x , resulting in
Depending on the outcome of these tests, control is
passed to a state
q
register contents
y , tl~a program first calls in a function
state
q
and replaces
which is now the first state.
y
by
fq(y)
-
tests are applied to this new value of (Tl(Y),...,Tm(Y))
(Tl(X) ,... ,Tm(X))
While in a state
i.e., executes y
fq
associated with
y ÷ fq(y) . Then all the
and depending on
q
control is passed either to the next state
function resulting in a halt with output
q , with
and the vector q'
or to the output
0(y) •
Thus we can see that a lanov scheme is essentially a special form of one variable scheme.
On the other hand, a one variable scheme is obviously liberal if
we do not allow constants or reinitializing the register, and so applying the transformation
t
used to "free" a liberal scheme results in a free one variable
scheme in the Rutledge format. So we feel free to use the following definition for lanov schemes.
DEFINITION variable,
A lanov scheme is a scheme with one input variable, y , and one output variable
following kinds of subschemes for monadic function letters letters
x , one program
z , which is composed entirely of the f
and monadie predicate
T :
START
)
\/
z
~
y
( sT0 )
6-30
By courtesy we also allow the following subscheme since there are lanov schemes with the unbreakable loop property:
The following results are immediate from the definition and previous constructions.
THEOREM 6.14
Given a Ianov scheme one can effectively construct a strongly
equivalent free lanov scheme.
% ~ O R E M 8.15
It is decidable whether a lanov scheme is free.
It is decidable whether a Ianov scheme is always halting.
~ e r e are sever~ ways to demmnstrate the decidability of strong equivalence (and of almost ever~hing else) for lanov schemes.
One method is to use a variant
of the Moore minimization algorithm for deterministic finite state machines to show that there is a minimal canonical fozm~ for lanov schemes
-
every lanov scheme can
be converted into a minimal standard form scheme which ~is unique up to a graph isomorphism such that two sehe~nes are strongly equivalent if and only if the corresponding canonical forms are graph isomorphic. Another proof is based on the idea that in a free interpretation lanov schemes sequence for
P P
and and
P' , P' ,
I
of two
if we write down in succession the values of
y
in
then:
(i)
if
val(P,l,x) = val(P' ,l,x)
and both are defined we must have the two
(2)
if at any point the two sequences of y-assignments differ
sequences of y-assignments identical,
y + f(y)
and
P'
has
y ÷ g(y)
then either
P
and
P'
e.g.
P
has
are not strongly
equivalent or else both computations must diverge; further, if we assume as we may that both
P
and
P'
are free schemes then at this point to be strongly
equivalent they must both be in a "dead end" with no path completion to STOP. Call a node in a free scheme "live" if there is a path from it to a STOP statement; since the scheme is free th~s path is an execution sequence. "dead" if it is not live
-
if there is no path from it to STOP.
Call a node We have mentioned
previously that it is decidable whether there is a path between two nodes in a finite state ~ a p h
(although it is not decidable whether there is an execution
sequence between two nodes in a scheme that is not free).
Hence it is decidable
6-31
whether a node in a free scheme is live or dead.
As a first step in provLng the
decidability of strong equivalence, we establish the decidability of weak equivalence.
L~A
6.16
Let
P
and
P'
be t~s free la_uov schemes such that
distinct assignment statements and Schemes in
P
P
and
and
P'
o'
P'
contains
m
in
P~
n
distinct assignment statements.
beginning at START such that
the pair
(b)
both
o
and
~'
contain exactly
(c)
both
o
and
~'
terminate at live nodes, and
(d)
the last node in
(e)
contains
are not weakly equivalent if and only if there are paths
(a)
a'
P
{a,~'}
is consistent
~
k
assignment statements for some
contains an assignment
contains an assignment
y ÷ g(y)
y ÷ f(y)
such that
k ,
and the last node in
f ~ g , and
i -< k -< nm + I .
PROOF First suppose that there are paths
~
in
START and satisfying (a) - (d)~ in p=~rticular, the end of
o ,
~' ,
P'
in
P
o'
a'
{~,~}
in
P'
o'
starting at
is a consistent pair.
for some strings
w
At
val(y) = fw(x)
and
w'
of function
(we are again omitting parentheses in composing
Both paths end at live nodes and so can be extended to a path
containing
containing
and
val(y) = gw'(x)
lwl -- lw'l = k-i
monadic fmnctions). T
and
in any free interpretation following this path,
and at the end of symbols, with
P
~
as initial subpa%h and continuing on to STOP and
as initial subpath and continuing on to STOP.
the values of
y
in
P
and
P'
T'
in
At the end of
o
are different under any free inter-
pretation and cannot become the smme in any path contLnuation under a free interpretation and so afterwards versa.
Hence
pretation T' .
I
{T,T'}
T
cannot test the same expressions as
T'
and vice
is also a consistent pair and so there is a free inter-
under which computation
(P,l,x)
follows
T
and
Both computations halt but must give different outputs.
(P' ,l,x) Hence
P
follows and
P'
are not weakly equivalent. On the other hand, suppose free interpretation different outputs.
I
y ÷ f(y)
~' and
live nodes, and (a) - (d).
P'
are not weakly equivalent.
(P,l,x)
and
(P' ,l,x)
There is a
both halt but give
of the execution sequence followed by (P' ,l,x)
ends in an assignment
such point; at the end of val(y) = ~ ( x )
o
of that followed by ~'
and
There is a first point at which they make diffement assignments.
That is, there is a subpath a subpath
P
under which
{a,~'}
y ÷ g(y) ,
~ ~ val(y) = fw(x)
for some string
w
such that
~
Hence
Thus we know that we can find subpaths
~ ~
and
f ~ g , and this is the first
and at the end of
of function symbols.
is consistent pair.
(P,l,x)
ends in an assignment
o'
Clearly both paths end at and
and
~' o'
satisfy all of satisfying all of
6-32
(a) - (d) and furthermore they wJ_il satisfy: (f)
At the end of
o
in a free interpretation,
at the end of o'
val(y) = gw(x)
So now let
o'
We c l a ~
o
and
val(y) = fw(x)
and
be the smallest paths satsifying (a) - (d) plus (f).
that (e), the length condition, must also he satisfied: so
lwl = k-i -< nm . into segments
Suppose it is not, so
oi,... ,ok
lwl = k-i >- nm + I .
and similarly
o'
into
We can divide
o I' ,... ,ok '
o
such that each
segment contains exactly one assignment statement which occurs at the end of the segment.
There are only
there are
r
and
s ,
and
@ ' r os
and
node
p
~r+l
through
n
assignment statements in
I -< r ~ s -< k-i
such that
~r
P
and and
m os
in
pT
and so
end Ln the same
o ' end in the same node q . If we "pinch out" segments s from path o and segments o' through ~ ' from o' the r+l s resulting paths are T = Ol,... ,ar~s+l,... ,Ok_l,O k and T ' = °I' ,... ,or ' 'o s'+ l " " ' ~' o' Since Or and °s ended at the same node k-i ~ k " p and ~r' and o s' ended at the same node q , T and T' are indeed legitimate paths.
Through
{r '
path
o
has computed
computed the same value for some val(y) = W2Wl(X)
for
val(y) = w3w2wl(x)
where
val(y) = fw3wl(x) TT
w = w3w2w I .
meet the same conditions as
o
and
If nm + I
P
o'
and
of length
Thus
P'
o
r ;
and at the end of
and at the end of
(lW3Wl] + l ~ lw3w2wll ,+ i) of
wI
Iw2I : s-r
val(y) = Wl(X)
o
we have
and
o'
at the end of Ok_ I
and
Hence at the end of
T'
o'
os
Ok_ I'
T
o'
has
and
o s' ,
we have
we have
val(y) : gw3wl(x) .
So
T
This contradicts the minimality
meet all of (a) - (e) and we are done.
are free and eontaLn at most
r
r(nm + 2)
I
tests, a path with at most
assignment statements is altogether of length at most
need only test paths of length up to
and
but contain fewer
assignment statements. and
and path
r(~m + 2) .
Thus we
and they are finite in number.
Hence:
THEOREM 6.17
Weak equivalence is decidable for lanov schemes.
So we can decide weak equivalence for lanov schemes; we can decide whether they ever halt with different answers.
If they are weakly equivalent, the only way they
ean fail to be strongly equivalent is for one to halt and the other loop for the same interpretation and input.
We now show t~mt this situation is detectable.
use a somewhat mmre complex version of the previous argument. "loop-alive" if there is any path from node.
n
Call a node
We
n
to STOP passing twice through the same
6-33
LE~{~A 6.18
Let
P
and
P'
assignment statements and interpretation
I
{a,a'}
(b)
a
contains
such that
there are finite paths (a)
be free Ianov schemes such that
P'
g
(P,I,x)
in
P
m
halts but
and
a'
P
contains
assignment statements.
in
(P' ,I,x)
P'
n
There is a free
diverges if and only if
starting from START such that:
is a consistent pair,
ends in STOP and
a'
ends at an assignment statement labeling a node that
is either dead or else loop-alive~ (c)
o
contains exactly
k + 1 (d)
k
assignment statements and
o'
contains exactly
assignment statements~ and
0 s k s 2ran + i
PROOF First suppose we have paths
o
and
o'
satisfying (a) - (c).
at a node tlnat is either dead or loop-alive, path
T
(with
because of
y
P'
o'
is free.
Now
o'
is a consistent pair.
computation
ends
can be extended to an infinite
contained one more assignment than
under a free interpretation at the end of
{o~}
o'
as finite initial subpath) which is an execution sequence
as the schemes are lanov, any extension of
T
o'
Since
(P,I~x)
o'
o
and of
o'
o
must be consistent with
llnus there is a free interpretation
follows
o
so the values
must differ.
and so halts and computation
I
Thus,
o .
So
under which
(P',I,x)
follows
and so diverges. On the other hand, suppose there is a free interpretation
(P,I,x) of
halts but
(P,I,x) ,
have at most or
P'
(P' ,I,x)
containing r
k + 1
{a,a'}
a'
r
test statements in a row.
of the execution sequence of
assignments;
k -< 2ran + 1 a'
I
such that
be the complete execution sequence k .
If
P
and
{%0'}
J~to
{a,o'}
we are done.
containing
is obviously a consistent pair.
Clearly the
be that pair satisfying (a) - (c) with
Suppose
o I' , ...,ok ' ,Ok+ I '
This time, since
0 -< r } s > t -< k-i a s'
and
P
Hence we can find a
(P' ,I,x)
k >- 2ran + 2 .
We divide
o
k
into
at'
and
such that each path segment contains exactly one
k -> 2ran + 2 , we can find Or,as
and
end in the same node
be "pinched out".
minimal. Ol,...,a k
assignment statement and all em.d in this assignment statement except that at STOP.
P'
satisfies all of (a) - (c).
So we can again let
and
0
assignn~nt statements for some
can contain more t ~
exactly
If
k
Let
predicate letters, then since they are free no path in either.
finite initial segment
pair
diverges.
at
r ,
s
end in the same node
and p
ok
ends
t
such that
while
or ' ,
q . We now have Two middle segments that could
lP£s is necessary to ensure that the shortened paths will still
form a consistent pair. Let w3w2wl(x)
w l(x) after
be the value of at ;
There are two cases.
let
zI ,
y
after z2 ,
First suppose that
ar , w2w l(x)
and
z3
after
gs '
and
be similar values for path
w2w I : z2z I ;
since
o' .
lWll = IZll = r ,
6-34
Wl:~l path
and
w 2:z
2.
Let
~
bemth
are the same in corresponding parts of o and
oI ..... %~,%+1,...,ot ..... ok
~I' "" " '~r' ~Os+l' "" " 'Or ~ ~'° ~ 'Ok' '°k+l'
and P'
{T,T'}
~'
T
mud
T'
y
still at tlne ~
T'
be y
they must have been the same in
because tlne excised pieces started with the same value of
and ended with
and
Notice that when the values of
value in
P
as in
y
in
P
P' . Hence
must still be a consistent pair which clea~ly satisfies (a) - (c), and this
contradicts the minimality of Now we let
T
be
k .
The other case to consider is that
al,... ,dr,... ,Os,Ot+l,...,o k
and let
T'
w2w I ~ z2z I .
be path
,. .. ~ ' ~ ' Now we can argue that the truncated paths ~i' " ' ' d r ' " " ' a s " O t + l " "' k ~ k+l z and T' are still consistent because they were consistent through s assignment statements and afterwards
y
contained different values in the two schemes so there
is no way for inconsistency to arise.
Thus
{T,T')
is again a consistent pair
satsifying (a) - (c) and violating the minimality of (d) is also true for
COROLLARY 6.19
{~,~'}
k .
So we can conclude that
m
It is decidable for lanov schemes
any interpretation and input for which
P
~alts but
P
and P'
P'
whether there is
diverges.
Putting these things together we see that:
THEOREM 6.20
It is decidable whether two lanov schemes are strongly equivalent.
All the properties of schemes shown to be undecidable in general in section B of this chapter can be s ~ w n by similar arguments to be decidable in the special case of lanov schemes.
Yt~s does not apply to the properties of programs discussed
in section C if the ~owchart is lanov (single register, no resets or constam.ts). Every partially computable function can be implemented by a single register machine, even under relatively simple interpretations.
The result of Minsky on two counter
machines also shows that:
THEOREM 6.21
Every partial recursive function from non-negative integers to non-
negative integers earl be expressed as ~nd
I
an interpretation p e ~ t t L n g
" p
divides
x "
and output function
for every prime
f(n) : val(P,l,n) only functions
p ~ constant i~
px
for and
P
a fancy scheme
x/p
and predicate
and special input function
log2x .
Using similar but much longer arguments, it can be shown that:
THEOREM 6.22
Strong equivalence is decidable for lanov schemes with constants
and resets (instructions
y + x
in the body of the scheme).
2x
7-1
VII.
RECURSION SCHEMES In this chapter we start the discussion of an alternative model for programs,
designed to reflect recursive properties of p r o g r a ~ n g
languages.
We shall see
that this model does indeed represent an augmentation of the flowchart model we b~ve been studying up to now.
One topic of concern will be v~hen recursion
equations can be translated into flowchart form
-
when recursion schemes are
flowclnartable. We example these models not only as mathematical entities but also as a means of determining what the mathematical properties of schemes tell us regarding programming problems and languages.
In studying alternative models an important
point to consider is their relative power. While we have an intuitive notion of what we mean by saying that one programming language or class of programming languages has more power than another, serious difficulties arise when we try to formalize this notion.
Even quite rudimentary
languages are nevertheless universal in the sense that we can write programs in them for any partial recursive function using very simple base functions and predicates indeed.
Let us illustrate this point by reviewing a few facts we have encountered
regarding computation of partial reaarsive functions by programs with flowchart seh~=q~es.
FACT I
Under a recursive JJnterpretation, a program scheme computes a partial
recursive function(or functions if there is more than one output variable).
FACT II
Any partial recursive function
f(n)
nonnegative integers can be expressed as
from nonnegative integers into
val(P,l,n)
independent variable (all assignments of the form
where
P
is a three variable
y ÷ f(y) ) program scheme and
is an interpretation on the nonnegative integers allowing only functions x - i , predicate
FACT III
"x = 0"
and constant
x + i
I and
0 .
If lanov schemes are restricted to the interpretation
I
above, only a
small subclass of the reoursive functions are computed in the sense that g(n) = i + val(P,l~n)
for
(P,l,n)
convergent and
g(n) = 0
for
(P,l~n)
divergent is a total recu~sive function and "most" total reeursive functions cannot be so expressed. with functions and constant
However, if one selects as interpretation px
I
and
x/p
and predicates
"p
divides
as well as special input function
then every partial recursive function lanov (single register) scheme
P
f(n)
2x
x"
I
the i~nterpretation for every prime
and output function
can be expressed as
val(P,l,n)
and this particular interpretation
I .
p
log2x for a
7-2
T~nese last two facts can be obtained from Minsky's result that two counter machines are universal and FACT III justifies the original definitions of lanov and Rutledge.
Of course, the pro~oams involved are in general complex, urm~tural and
highly inefficient. The implication of these results and similar ones that could be cited is that we cannot study the relative expressive power of progranm/ng languages by merely studying the class of functions defined under s ~ p l e J~nterpretations.
These
considerations suggest studying abstract uninterpreted programs or schemes of one sort or another and examining when members of one class can be transformed into members of another class preserving equivalence under all interpretations.
We make
the following definitions, formalized later. Two schemes
P
and
Q
are tran~!ati~s of each other if they compute the same
partial function under all interpretations, that is, if they are strongly equivalent. A class in
CI
CI
of schemes is translatable into a class
there is a
Q
in
C2
such that
In this approach, if a class vice versa, then we consider more expressive power than be translated into
C2
C2 CI .
and
C2
~
P
and
Q
C2
of schemes if for each
P
are strongly equivalent.
is translatable into a class
C2
but not
to be more powerful and possess in some manner If
CI
and
C2
are incomparable
cannot be translated into
CI
-
-
CI
c~nnot
then each has
advantages and special conveniences not available in the other and we wish to determine which properties lead to this incomparability. We really need more than a mere existence theorem that a class is translatable into
C2
so that all features of
computing power.
CI
can be modeled in
C2
without loss of
At the very least the construction involved should be effective
there should be a total recursive function carrying any member of strongly equivalent member of
C2 .
CI
-
into a
Further we should like the translation to
preserve some of the properties mentioned in Chapter IV, possibly computational equivalence, and to carry subschemes into subschemes, blocks into blocks and perhaps statements into groups of instructions so that one can build an efficient and flexible translation system. Our general results on the comparison of flowchart schemes and recursion schemes will be: All flc~4cPmrt schemes can be translated into rec~o_~sion schemes. There are recursion schemes not translatable into flowchart schemes. It is ~ndecidable whether a recursion scheme
is translatable into a
flowchart scheme. Linear recursion schemes are always translatable into flowchart schemes. Evemy recursion scheme can be translated into a flowchart scheme augmented by one pushdown store. Recursion schemes are equivalent to procedure augmented flowchart schemes.
7-3
In the special case of monadic recursion schemes, we shall see in Chapter VIII that: The classes of monadic rect~sion schemes and monadio flowchart schemes are incomparable. Every monadic ree~0rsion scheme can be translated into a flowchai~t scheme augmented by a simple pushdown store.
A.
DEFINITIONS •N]D EXA~@LES Now we are ready for some definitions.
As before, one must define the base
objects of the metalanguage, then the schemes written in the metalanguage, and finally the semantics, how a scheme computes a function under a given interpretation. The basic objects are: Variables
x I ,x2 ,...
as before
Constants
c l,e 2 ,...
as before
Basis function letters
f,g,h,..,
as before
Predicate letters
P,Q ,T,...
as before
Defined function letters
F 0 ,FI ,F2 ,...
new
"terminals"
-
basis function letters, variables, constants
"nonterminals"
-
defined function letters
To the objects needed to describe program or flowchart schemes we have added defined function letters, whose role will become clearer later. these objects into extended terms as we did before.
We can compose
We shall take the liberty of
using "term" for "extended term" and denote what was called terms in Chapter II by "simple terms".
DEFINITION
We define terms inductively:
i)
A variable or, a constant is a term.
2)
If
f
is an n-placed basis function letter and
f(tl,...,t n) 3)
If
F
tl,... ,tn
is a term.
is an n-placed defined function letter and
F(t l,...,t n)
are terms, then
t I .... ~tn
are terms, then
is a term.
A term is terminal if it contains no defined function letters ; otherwise it is nonterm/nal.
DEFINITION if
A term
t
t : G(Ul,...,u n)
is very simple if or
t = f(ul,...,u n)
a basis function letter and t
is very simple or
function letter or that
tk
u I .... ,un
t = G(t I .... ,tn) f
t
is either a variable or a constant or for
G
variables. or
a defined function letter or A term
t
t : f(tl,...,t n)
for
a basis function letter and there is a
is a very simple term and
ti
is a variable for
f
is sLmple if either G
k ,
i ~ k .
a defined I -< k -< n
such
7-4
DEFINITION
A r e c i s i o n equation is a statement of the form:
Fk(Yl,... ,ym ) : IF
T(u I .... ,un)
~EN
t
ELSE
t'
where (i)
Fk
(2)
T
is an n-placed predicate letter
is an m-placed defined function letter
(3)
t
and
(4)
yl,...,ym
t'
are terms and each variable in are
m
distinct variables and
and this equation is said to define
DEFINITION
t
or
t'
appears in
{Ul:...,Un} C
{Yl .... 'Ym}
{Yl .... 'Ym}
Fk .
A recursion scheme is a finite set of recursion equations and a
designated initial defined function letter
F0
such that:
(i)
Each defined function letter is defined at most once.
(2)
Every defined function letter appearing on the right hand side of any equation is defined exactly once.
(3)
One equation defines
F0 .
We say that the scheme defines the function defined by
F0 .
An interpretation of a recursion scheme is defined similarly to an interpretation of a flowchart scheme.
Tne interpretation assigns meanings to constants,
predicate letters and basis f~nction letters found in the scheme but does not, of course, assign meanings to defined function letters.
A free ~terpretation is
likewise defined as usual, to have as domain the set of all terminal terms over the set of variables, constants and basis function letters found in the scheme. For any interpretation
I
we can extend the interpretation of functions and
predicates to any terminal term terms
T(tl,... ,tn) ,
function.
If
f
in the usual way.
For a variable
l(t l),...,l(t n) , then
l(f)(l(t I),... ,l(tn)) ~
l(T(tl,... ,tn))
and any composition of predicates, and terminal
is an n-plaoed basis function letter,
terms interpreted as functions function
t
if
T
is the Boolean function
x , l(x) t I,... ,tn
is the identity are ter~dmal
l(f(tl,... ,tn))
is the
is an n-placed predicate letter, l(T)(l(tl),... ,l(tn)) . It is sometimes
convenient to extend this concept to nontermN_nal terms by the formula l(F(tl,...,tn)) = F(l(tl),... ,l(tn)) if
f
for a defined function letter
is a basis function letter but at least one of
we can let arguments of
l(f(tl,...,tn)) = l(f(l(tl),...,l(tn))) f
t 12"..,tn
F . Further,
is nonter~nal,
and re-evaluate when all of the
become terminal.
The definition of computation in a recursion scheme is a little more complicated than for a flowchart scheme.
Computations are defined from the inside out when the
equation has nested defined function letters.
It has been sho~m by B. Rosen that
evaluating recursion equations from, the inside out produees a system with the
7-5
Church-Rosser property. expression
E
That is, if
E 2 ).
and
E2
are expressions derived from an
by alternative expansion methods, then there is an expression
which can be derived from both or
E1
E1
and
E2
(of course,
E3
E3
might be either
E1
In particular, as long as the inside-out restriction is maintained the
order of expansion of functional terms carm.ot affect the answer.
So we shall
arbitrarily select Whatever expansion method seems most convenient at the moment~ usually we shall expand from left to right, always expanding the leftmost defined function letter ~hose inner terms are all terminal. We can represent an expanded term as a tree in the obvious fashion.
A
variable or, constant is represented by a single node labelled by itself:
.x
If
or
tl~...,t n
.c
are terms represented by trees
represented by a tree with root labelled
f
~...
,An , then
f(tl,...,tn)
and with the roots of
AI,...,I ~
is as
SONS:
.f
n
and similarly for
F(tl,... ,tn) .
Computation in a recursion scheme can be represented by derivation in a type of grammar. I
Suppose we are computing in a recorsion scheme
&nd 9rove so far derived a term
E = ~G(tl,... ~tn)E 2
where
tl,...,tn
I
terr~inal terms), and
is either a basis or a defined function letter.
is a basis function letter,
(i) (2) If
E G
-->
I
under an interpretation
values in the domain of G
(if
S
is a free interpretation,
G = f , let
tl,... ,tn
are will be (i) If
G
G = F , let the defining equation for
F
E 3 = l(f(tl,...,tn))
and write
EIE3E 2
is a defined function letter,
be F(Ul,...,un) : IF
T(Uil, . ° . ,u~)
and suppose first that
l(T)(til
appear in
so we can write
Ul,... ,un
Ul,... ,un
,tim)
T/{EN t
ELSE
9ms the value [~b~. t
as
t' All variables in
t(ul,... ,un) , a function of
(the dependence on some or all of these variables might be vacuous).
E 4 : t(tl,...,tn) , the result of substituting
t
ti
for
ui
everywhere in
t
Let and
7-6
then write
(2)
E
~>
EIE4E 2
On the other hand, if
l(T)(til,.~.,tim)
t'(ul,...,un) , and let
(2)'
E
We let
~>
>
is FALSE we can write
E 5 = t~(t!,...,t n)
as
and then write
EIE5E2
be the transitive reflexive closure of
always and if
t'
E
> E'
and
E'
> E" , then
~>
E
-
that is,
E ---> E
> E" .
As we have just discussed, the order in which these computations are made is i~material.
Thus we can assume, for example, that we always perform type (I)
derivations before type (2) when possible, and within a type expand the leftmost expression possible.
DEFINITION Let
I
Let
S
he a recursion scheme with initial equation
be an interpretation and
there is a terminal term F0(al, ....an ) _i'<_> w (S,l,a~+
or
w
then
a = (al,...~an)
(a member of the domain of (S,I,~)
converges and
val(S,l,a)+ . Otherwise
F0(Xl,...,Xn) .
a selection of input values. 1 )
If
such that
val(S,I,a) = w , written
(S,l,a-) diverges , written
(S,l,a)+
or
val(S,l,a)+
We can prove the same relationship between computations under arbitrary interpretations and computations mnder free interpretations that we did for flowchart schemes, defining program scheme.
THEOREM 7.1 Let
I*
letter
Let
U(S)
for a reeursion scheme
S
in the same way as for a
We state it without prmof.
S
be a recumsion scheme and
I
be the free interpretation obtained from
an interpretation with input I
[ .
by setting for each predicate
T
l*(T)(tl,...,t) : l(T(t I .....tm))(~)
for all term/mal terms if
(S,I*,X)
tl,...,tm
in
converges and Whenever
val(S,l,a)
=
U(S) . Then (S,I,a)
(S,l,~)
converges if and only
converges,
val(S,l*,X)(a)
We next illustrate these rather complicated definitions with some examples.
7-7
EXAMPLE We first illustrate our definitions with a computation under a free interpretation.
Consider the reeursion scheme with one equation:
F(x)
=
IF
P(x)
THEN
x
ELSE
h(F(f(x)),F(g(x)))
which we could represent in tree form:
=
IF
x
THEN
Consider the free interpretation and
l(P)(t) = TRUE
F(x)
>
m>
elsewhere.
h(F(f(x)),F(g(x)))
I
ELSE
with
,F///~,F
l(P)(x) = l(P)(f(x)) = l(P)(g(x)) = FALSE
This gives us the computation
>
h(h(F(f(f(x))),F(g(f(x)))),F(g(x)))
h(h(f(f(x)),F(g(f(x)))),F(g(x)))
~
h(h(f(f(x)),g(f(x))),F(g(x)))
h(h(f(f(x)),g(f(x))),h(F(f(g(x))),F(g(g(x)))))
~>
h(h(f(f(x)),g(f(x))),h(f(g(x)),F(g(g(x)))))
-->
h(h(f(f(x)),g(f(x))),h(f(g(x)),g(g(x)))) = val(S,l,x)
\
\.
J\
D
X ~
1
1
!
I
0
7-9
/\
/\
f
g
f
g
the last tree in the series being of course the tree representation
of
val(S,l,x)
.
As a second example, consider the recursion scheme
F(x) = IF
T(x)
under the interpretatJ~on "x = 0" ,
I(f)(x)
interpretation,
F(4)
I
f(x)
ELSE
h(x,F(g(x)))
with domain the nonnegative
= x + i ,
l(G)(x)
= x ± I ~
and
Jmtegers,
I(h)(x,y)
I(T)(x)
is
Under this
= x-y
the scheme becomes:
F(x) = IF
T~e comFatation
THEN
x : 0
for input
TH~
4
x + I
ELSE
is then:
........ > h(4,F(g(4)))
-->
h(4,F(3))
>
h(4,h(3,F(2)))
--->
h(4,h(3,h(2,F(1))))
....>
h(4,h(3,h(2,h(l,F(0)))))
~>
Not surprisingly,
h(4,h(3,h(2,h(l,l))))
h(4~6)
F
~>
~>
h(4,h(3,F(g(3))))
h(4,h(3,h(2,F(g(2)))))
....... >
>
x-F(x " i)
>
h(4~h(3~h(2,h(l,F(g(1))))))
-->
-->
h(4,h(3,h(2,h(l,f(0)))))
h(4,h(3~h(2,1)))
-->
h(4,h(3,2))
24
defines the faotorial under this ~terpretation.
section we shall see how to verify programs with recursion.
Later in this
This full expansion is
somewhat clumsy, and we w~uld probably take the liberty of expressing the computation
in this abbreviated
F(4) ~ >
form:
4.F(3) ~=> 12.F(2) --> 24.F(I) --> 24.F(0) ~ >
24.1
=
24
7-i0
We can define strong equivalence between recursion or p_~oKram schemes as before.
DEFINITION and
I~
written and S
For schemes
(S,I) - (S',I')
(S' ,I' ,a) and
S
and
S~
(with a common domain),
S'
pretation
,
(reeursion or program) and interpretations
(S~I)
is strongly equivalent to
if and only if for all inputs
diverge or both converge and
are strongly equivalent, I ,
(S,I)
val(S~l,a)
S - S' ,
a ,
(S'~I')
either both
= val(s' ,I' ,a) .
I
, (S,l,a) Schemes
if and only if for every inter-
is strongly equivalent to
(S' ,I) .
As we did for program schemes, one ean establish the following result for recursion schemes :
THEOREM 7.2 (S~I)
Recursion schemes
is strongly equivalent
S
and
(S' ,I)
ST
are strongly equivalent if and only if
for every free (Herbrand) interpretation
I .
If we try to define a "free" recursion scheme in the same way we defined a free program scheme
every path is an execution sequence
-
we find that although the
intuitive meaning is clear, it is very hard to formalize this concept. should one define a "path" in a recursion scheme?
Exactly how
Or an "execution sequence"?
is possible to do so by a moderately complex tree recursion argument.
It
Instead we
will give a "syntactic" definition akin to the one we established as a theorem for program schemes.
DEFINITION
A recursion scheme
and every m-place test (tl,... ,tm)
We
give a f o r ~
now
CI ÷ C 2 , in
A class or
C2 .
to
P
for every
DEFINITION
CI
cI
recursive function
T
is never applied twice to the same m-tuple
during the computation
(S,I*,X)
of schemes is tr,amslatable into a class if for every
P
in
CI
from in
CI
into
C2
such that
C2
f(P)
C2
written
if there is a total is strongly equivalent
CI .
Classes
CI
and
C2
are intertranslatable,
is translatable into
C2
and
C2
is translatable into
intertranslatable
CI
is effectively translatable into
if
.
there is a strongly equivalent
is effectivel_~y translatable into
f P
U(S)
I*
definition of translatability.
CI < C 2 , Class
is free if for every free interpretation
:in S ,
of members of
DEF]]IITION
Q
T
S
effectively translatable into
CI .
written CI . C2
C 1 --- C 2 ,
if
CI
They are effectively and
C2
7 -ii
DEFINITION
If
CI , write
CI < C2 .
DEFINITION
Classes
into
C2
and
CI
C2
is translatable into
CI
and
C2
C2
but
C2
are incomparable if
is not translatable into
is not translatable into
CI
is not translatable
CI .
There are various ways we can extend or restrict the definition of recursion scheme without affecting computing power.
Some of these ar,e very useful.
We shall
give two such results, leaving the proof to the reader. First let us extend the definition of recursion equation as we did the defLnition of WHILE scheme. predicate terms
Let a Boolemn expression be &ny expression involving
P(tl~...,tm)
where each
a variable), and the connectives
A~
ti
is a terminal term (not necessarily
, OR , and
NOT . We define a reeursion
expression ~ductively, by saying that first any term is a recursion expression, and then that any statement of the form expression if
Q
IF
Q
is a Boolean predicate and
THEN E1
E1
and
ELSE
E2
E2
is a recursion
are recursion
expressions.
L~I'~A 7.3
Let
R
be the family of recursion schemes.
schemes obta£ned by extending
R
to allow equations
F(Ul,...,un)
Q
7H~N
where
Q
=
IF
is a Boolean expression and
involving only
Ul,...,u n
E1
El
as variables.
ELSE
and Then
Let
R'
be the family of
E2
E2 R
are recursion expressions and
R'
are effectively
intertranslatable.
Now the alert reade~ will object that this is circular. semantics of such extended equations.
easiest to do by saying that, for example, an equation IF
Q
THEN
E1
ELSE
E2
where
E1
For we ~ust def£ne the
This can be done directly but it is probably
and
E2
F(Ul,...,un) =
are not terms, is an abbreviation
for three equations:
r(u I ..... u n) = ir
Q
THEN
Fl(Ul,...,un)
ELSE
F2(Ul~...,un)
FI(Ul,...,un) = E 1 F2(UI~...,uh) = E 2 for new defined function letters F I and F 2 . Thus it rm~mins only to redefine computations by substituting I(Q) for I(T) where T is a predicate letter.
7 -12
We now turn to a restriction, rather than an extension, of recursion equations. First, let us permit an equation:
F([)
: t
to abbreviate any equation
F(U)
=
for any term
IF
t
T(U)
and
%~q
predicate
t
LT~SE t
T .
That is , we permit equations without any
conditional expression; the indicated action takes place in all cases.
Now we
define simple recursion equations and schemes.
DEFINITION i)
F0 2)
A recuPsion scheme
For sc[le integer
n ~ 1 ,
S
with initial function
is simple if
which may~be m-placed for
m ~ n
The initial equation is of the form
F0(Xl,...,Xm) : F1(Ul,.o.,u)
where &rid
3)
F0
all defined funetions are n-placed except perhaps
u.l = x.l u- = x_± i
for for
i <: i <:
m
m+l <: i <:
~
n
All other equations are of the for~s: a)
F(Ul,...,u n) : IF
b)
F(u I .... ,un) = G(tl,...,t n)
c)
F(u I .... ,un) = f(sl,...,s r)
where
F ~
is a for
k ,
G ~
and
T(u . . . . ml~
H
i ~ k <= n ,
i ~ k ,
,u. ) ik
THEN
ELSE
H(Ul,...,u n)
are defined function letters not equal to such that
and there is a
j ,
tk
is very simple and
i < = j <= r ,
simple nonterminal term or a variable, and f
G(u I,...~u n)
si
such that
F 0 , there
ti
is a variable
sj
is either a very
is a variable for
i ~ j ,
is a basis function.
DEFIJqlTION
A term
DEFINITION
A recursion equation of the form
F(U)
or of the form
=
t
IF
is linear if it contains at ~ s t
T(~)
THEN
t
ELSE
t'
one n o n t e r m ~ a l .
and
7-13
F(U)
is linear if
:
t
t
and
t'
are both linear.
DEFINITION
A reeursion scheme is linear if all its equations are linear.
DEFINITION
A r~cursion scheme is monadie if all its functions, basis, predicate
and defined, are monadic.
L~{'Z 7.4
The classes of recursion schemes and of simple rec~Jrsion schemes are
effectively intertrmnslatable.
Furthermore, every recursion scheme
effectively tr~qslated into a simple recursion scheme linear, monadic or linear monadic, then
The proof is left to the reader.
S'
S'
S
such that if
c~n be S
is
is linear, monadic or linear monadic.
The general idea is to convert IF-THE2{
expressions to type 3a) (of the definition of simple schemes) by adding new defined function letters and conditionless equations
F(U-] = t ; then the conditionless
equations are converted to forms 3b) and 3e) by adding extra argument places to build up complicated terms from very simple terms. functions have at most than
k
n
If the original defined
argument places and the original terms contain no more
symbols each (excluding parentheses and comas) then the new defined
functions need no more than
2n+l
argument places.
Special care is needed in the
linear case not to violate the definition of linearity.
The monadic case needs a
separate approach, similar to the conversion of context-free grammars into Chomsky normal form.
B.
COMPARISON OF FLOWCHART AND RECURSION S C ~ S In this section we show that recursion schemes are more powerful than flowchart
or program schemes.
Our first result is the effective translatability of program
schemes into recursion schemes.
In section D we shall see a stronger form of this
result~ when we augment our flowchart schemes with procedures.
THEOR_~ 7.5
The class of program schemes with one output variable is effectively
translatable into the class of recursion schemes.
7 -14
PROOF
We assume that our program scheme the first instruction in line i.
P
is written in linear sequential form with
We use the convention that in a test statement
the first transfer address is the transfer for positive (TRUE) outcome of the test. We can assume that variables
P
has input variables
yl,...,ym
Xl,...,x n
and an output variable
z
disjoint from program
which is neither an input for a
program variable arJ only appears in a bmlt£ng sequence We shall~ in addition to the start function
z + u
F 0 , have one defined function
for each address in tlne flowc.hart and all the functions except functions of P
n+m
variables.
X
and the program variables as
final value of
z
values of the
xi
F0
shall be
The values of the various variables or locations in
shall be carried along in each equation.
as
STOP.
~ .
Let us abbreviate the input variables
Function
}q(X,~)
will compute what the
~ u l d be if the computation started at inst~action and
yj
specified by the arguments of
The initial equation for
F0(X)
input starting at instruction i.
q
with the
Fq
will represent output given for the actual
Each programvariable is by definition assumed
to be specified before it is computed on; thus any initial value assigned to it is irrelevant.
So the initial equation is:
Fo(X) where
m
If
=
Fl(X,Xl,...,xI)
copies of q
xI
are added as dummy argmi~ents, later replaced by
is the address of an assignment statement
q"
Yr
÷
f(ul""'Uk)
where by hypothesis each
Fq(X,Y)
where
tj : yj
If
q
for
is in
X
or
Fq+l(X,t I .....tm)
j ~ r
and
tr : f(uI .... ,uk) .
mr
+
u
3~ ~ z , we lnave
rq(Z,Y) : ~+l(Z,tl,.°.,tm) where
tj
Y ~ then we have
is the address of a store statement
q"
with
:
u. ]
=
yj
for
j ~ r
and
tr
=
U
•
Yi'S o
7-15
If
q
is the address of an assignment
q"
where
YI~
c
4-
Q
is a constant, we have
:
where
tj = yj
If
q
for
I
j ~ r
....
and
tr : c .
is the address of a test statement
q.
T(Ul,...~u k)
r,s
where by the hypothesis each
%(X,Y) Since
z
IF
:
is in
u. J
T(u I . . . . ,uk)
~
THEN
or
Y , then we have
Fm(X,Y)
ELSE
Fs(X,[)
is not a program variable the only statements involving
, z
must be
of the form:
q.
Z
~-
q+l.
STOP
U
and so we have
Fq(X,Y)
:
u
[]
This result should be compared with the next one which exhibits a recursion scheme which cannot be converted to flowchart form.
THEOREM 7.6
There is a recursion scheme which is not strongly equivalent to any
pro~oamseheme.
PROOF We give an Lnformal argument that the particular scheme be translated into any program scheme.
S0:
F(x) = IF
P(x)
THEN
x
ELSE
h(F(f(x)),F(g(x)))
SO
given below cannot
7-16
Let us consider the behavior, of IN(W(X)) = FALSE g .
Thus for
if and only if
N = 3 ,
N = i ,
the output of
example we already computed g(g(x))))
.
under a free ~ t e r p r e t a t i o n
contains fewer than
N
IN
such that
occurrences of
f
and
13(f(g(x))) = 13(g(f(x))) = 13(f(f(x))) = I3(g(g(x)')) =
13(g(x)) = 13(f(x)) = l(x) = FALSE For
SO
w
but
13(f(f(f(x)))) = TRUE .
(S@,ll,X)
is
h(f(x),g(x))
.
In a previous
va!(S0,12,x)
as
h(h(f(f(x)),g(f(x))),h(f(g(x))~
In general, the output under
IN
can be represented as a tree:
°h
/< Wl(X)
/< w2(x)
where each
wi(x)
w3(x)
w4(x)
bip~ry tree of depth IN
tI
w
2N_3
w2N_ 2
w
2NI
N
N
occurrences of
with distinct leaves.
f
and
g .
W2N
2N
strings
~nis is a full
We claim that no program scheme
ean compute this output.
Any term and
...
/\
is a properly parenthesized az~d distinct one of the
eontaLning parentheses and exactly
under
/\
and
stored before
h(tl,t 2 ) t2
appearing on the tree is distinct from any other subterm
are also distinct; thus
h(tl,t 2)
tI
and
t2
must be computed and
can be computed.
One way of thinking of this situation is to visualize a game, with a binary tree of depth
N
as a "board" and
in a program scheme). leaf or has t~n "sons".
k
markers or "pieces" (representing locations
Any marker can be placed on a leaf.
Each node is either a
If both sons of a node are covered with markers, then one
marker can be moved up to that node and markers removed from the two sons.
The
object is to eventually place a marker on the root, using as few markers as possible.
How many markers are needed in the ~nrst ease?
The answer is that if the tree is a full binary tree of depth markers are necessary and sufficient. N = i
is obvious,
N ~ then
The proof is by induction on
N .
N+I
The case
for then there are just two leaves and both must be covered
before the root can be covered.
Suppose this is true for depth
N-I .
The root
has two sons each of which can be regarded as the root of a full binary subtree of depth
N-I ;
call these nodes
nI
and
n2 .
The root can be covered when and only
7-17
when both
nI
it requires
mud N
N+I .
are covered.
markers to do this.
must remaLn on of
n2
nI .
Suppose Then
N-I
By induction it t-~es
Then the root can be covered.
required and that
N+I
nI
is covered first.
By induction~
of these markers are free, but one
N
markers to cover
n 2 , for a total
The argument shows both that
N+I
are
suffice.
We have really proven~ using our analogy:
SUBLEMMA (P,I) P
Let
P
be any program scheme m~d
must have at least Thus if
N+I
SO
N+I
program scheme,
DEFINITION
If
with distinct leaves, then
val(S0,1N,X) Hence
P , P
would need
and hence need infinitely many SO
is not strongly equivalent to any
m
A recursion scheme
strongly equivalent to
If
free interpretation
S In
S
is flowchartable if there is a program scheme
S .
~nat we 9rove really s h o ~
PROPOSITION 7.7
N
storage locations (variables).
locations to compute each
but will not prove formally is:
is a recursion scheme such that for each for which the computation of
constructing a f~ll binary tree of depth S
any free interpretation.
were strongly equivalent to a program scheme
storage locations, a contradiction.
P
I
ever constmmcts a full binary tree of depth
n
val(S,In,X)
n
there is a requires
or greater with distinct leaves, then
is not flowc~mrtable.
We can show for always halting recursion schemes as we showed for always halting program schemes that there is a uniform bound on the length of any computation and hence on the length of the output under ~ny free interpretation.
PROPOSITION 7.8
Any always halting recursion scheme is flowchartable.
These facts and the standard constructions we saw before allow us to show that it is not partially decidable whether a recursion scheme is flowchartable
-
and
it also is not partially decidable whether a recursion scheme is NOT f]owehartable.
THEOREM 7.9 " R
For recursion schemes
R ~ neither
is not fl<~ehartable '~ is partially decidable.
" R
is flowchartable"
nor
7-18
PROOF The proof uses the schemes in Example VII-I. deterministic finite state acceptor program scheme (i)
If
P(M)
and two r~cuu~sion schemes
La(M) F~ D = %
then
La(M) F~ D ~ ¢ , then (2)
For a two-tape one-way
M = (~,K2,{0,1},6,qo,qa,q r)
RI(M) RI(M)
RI(M)
and
R2(M)
is strongly equivalent to
such that
P(M)
and if
is not flowchartable.
If
Ld(M) Fh D = ~
then
R2(M)
is always halting and hence flowchartable and
if
Ld(M) (% D ~ ¢
then
R2(M)
is not flowcbartable.
If we have proven (i) and (2) we can conclude that if and only if if
we constmuct a
La(M) F~ D = %
told that
R2(M)
RI(M)
is flowchartable
is not flowchartable if and only
Ld(M) F~ D ~ ~ . Since these are not partially decidable problems for two-tape
one-way deterministic finite state acceptors, we have the desired results by the standard arguments. It remains to establish (I) and (2). machine M
M
never reaches state
qa
(t~t)
then
in the same way our previous flowchart schemes did.
that
RI(N)
scheme
P(M)
explicitly.
If
M
reaches
subscheme with defining letter G
RI(N)
If
simply imitates
Thus we know in this case
is flowchartable and can write out the strongly equivalent program
corresponding free interpretatirm
by
We give informal justifications.
on input
It
F
qa
qa
with
on input pair
which we know is not flo~hartable.
interpretation
In, t
takes
RI(M) n
reaches the
which in turn leads it into a subsch~me defined The functions and tests in
arranged that there is no interference from previous tests.
a full binary tree of depth
(t~t) , then for' the
tlt(h(x)) : t , RI(M)
to
G
For each
G n
are so some free
and then leads it to construct as output
with distinct leaves; so
RI(M)
is not flowchartable
in this case. We now examine or
q~
R2(M) . If
M
never diverges on
and so every occurrence of nonterminal
occ~mr~ence of
Fqr
or
Fqa
Fq
(t,t)
But if
M
diverges on
(t,t)
more and mnre of a computation that is really equivalent to is not flowchar.table. imitates
M
on
For each
(t,t)
n
qa
ultimately is replaced by an
rand hence by a temminal string.
halts and so is flowcbartable.
it always reaches
Thus then SO
Fq'S
R2(N)
always executes
which we have seen
there is a free interpretation
as far. as concerns expansion of the
R2(M)
It ,n which but on the
Gq 's
imitates
(S0,I n ) as previously defined and gives as output the full binary tree of
depth
with distinct leaves.
n
Ld(M) f'] n ;~ ¢
•
Hence
R2(M)
cannot be flowchamtable m±'=
7-19
EXAMPLE Vll-i
CONSTRUCTIONS TO PROVE THAT FLOWCHA-RTABILITY IS NOT DECIDABLE
Start from a deterministic two-tape one-way finite state acceptor H : (K1,K2,{0,1},~,%~qa,%) A.
PROOF THAT " R Recursion scheme
La(H)
IS FLOWCHARTABLE" RI(M)
IS NOT PARTIALLY DECIDABLE
described below is flowchartable if and only if
n :
n
The initial equation is:
F0(x)
=
Fqo(h(x),h(x),x)
For each
q
Fq(Ul~U2,X) : IF For each
q
Fq(Ul,U2,X) = IF For
qr
and
in
T(u !) in
f(x)
Fqa(Ul,U2,X)
=
G(x)
@(x)
=
IF
F6(q,l)(h(Ul),U2,X)
ELSE
F6(q,0)(h(Ul),U2,X)
ELSE
F6(q,0)(Ul,h(u2)~x)
K 2 there is an equation:
qa
=
there is an equation:
~{EN
T(u 2)
F%r(Ul,U2,X)
And finally
KI
G(x)
Q(x) THEN
THEN
F6(q,1)(ut,h(u2),x)
we have:
is defined by an equation we know is not flowchartable: x
ELSE
h(G(f(x)),G(g(x)))
7-20
EXAMPLEVll-i B.
CONTINU~£D
CONS~UCKON OF PROG-iKA~MS C I ~ Program scheme
P(H)
finite state acceptor
P(H)
is constructed from t~en-tape one-way deterministic
M : (Ki,K2,{0,1}~6,qo,qa,q r)
Initial Subscheme
Subscheme for, q
in
KI
\/
START ....).....
l
f
u I + h(x) 1 u 2 ÷ h(x)j
Ul ÷ h(Ul)
i ÷ h(Ul)
% Subsehemes for
(
qa
told qr
Subsch~me ~br
q
in K 2
z LOOP
) FALSE
RUE
( ~o~ ) U2 + h(u2) ,,I
u 2 + h(u 2)
+
7-21
EXAMPLE VII-I C.
CONCLUDED
PROOF I~_~T ~' R
IS NOT BOWC?bIRTABLE" IS NOT PARTI~LY DECIDABLE
Recursion scheme finite state aeceptor and only if
R 2 (H)
is constructed from two.tape one-way deter~/nistie
M = (Ki,K2,{0,1},@,~,qa,q r)
and is not flowebmrtable if
Ld(H ) (h D ~ ~ .
The initial equation is
Fo(x) = Fqo(h(x),h(x),x) For each
%(Ul~U2,V)
=
IF
For each
Fq(Ul,U2,V)
=
:
:
KI THEN
q
K 2 there is &n equation
in
%~
THEN
q
in Q(v)
G6(%l)(h(Ul),U2~V)
G6(q,l)(Ul,h(u2),v)
ELSE
G6(q,@)(h(Ul),U2,V)
ELSE
G6(q,O)(Ul,h(u2),v )
we have:
Fqr(Ul,U2,V)
IF
there is an equation
T(u I)
and
For all Gq(Ul,U2~V)
in
IF T(u 2)
For qa Fqa(Ul,U2,V)
q
: v
K I k) K 2 there is an equation TP~5~
ELSE
h(Fq(Ul ,u2 ,f(v)) ,Fq(Ul,U2 ,g(v) ) )
7-22
C.
LINF~RRECURSION SCH~vESARE FLOWCH~RTABLE ~y
of the methods advanced for code optL~zation depend on presenting the
program in flowchart form without any use of recursive features such as proceduu~es. In the light of the results in the previous section it is an open a~id £nterestLng problem to characterize at least some subcases of flowchartable recursion schemes and determine special cases in wb_ich it is decidable whether schemes are flowchartable. We now ex&mLne one special case in which we !~now that schemes are always flowcbartable
-
the case of linem0 recursion schemes.
A term was defined to be
linear if it contained at mmst one nontemninal; a recursion scheme is linear if all terms appearing in all of its equations are linear. We mentioned that recursion schemes could always be translated into simple recursion schemes in such a way as to preserve linearity.
For our purposes, this
m e ~ s t ~ t in discussing linear rec+~sion schemes we can assume that all equations are in one of the following four formats: (i)
F(~)
=
G(t I,... ,tn)
(2)
F(Y)
=
f(tl,...,tk_l,G(Y),tk+I .... ,ts)
each
t. terminal and f a basis function i = IF T(Yil,...,Yik) THE%{ G(Y) ELSE
(3)
F(~)
(4)
F(Y)
G
a defined function, and each G
ti
term£nal
a defined function and
H(Y)
G , H
defined
function letters =
t
t
terminal
Before giving a formal proof that Itneer recursion schemes are flowcha~table we shall illustrate the concepts involved by an example which is small and yet complex enough to illustrate the general case.
EXamPLE F0(x)
=
Fl(g(x),h(x))
Fl(Yl,y 2)
=
IF
T(Yl,y 2)
Consider the free interpretation I(T)(g(h(x))~g(x)) elsewhepe.
=
I~N I
f(yl,Y2 ) ELSE with
l(T)(g(g(x)),g(h(x)))
TP~ computation
(S~!~x)
f(Fl(g(y2),Yl)+f(yl,Y2))
l(T)(g(x),h(x)) =
FALSE
and
= l(T)(tl,t 2)
proceeds as follows.
-->
.f
=
TRUE
7-23
- - >
f~
°f
.~J\.f
~f
.f"
g
°f
g
,g
g
,h
~x
x
,X
__
->
=
val(S,l,x)
.f
.fJ\.f
/\ ,g
/\
g
fg
,X
~e
output is
f(f(f(f(g(g(h(x)))~g(g(x))),f(g(g(x)),g(h(x)))),f(g(h(x))~g(x)))~ f(g(x),h(x)))
Notice tb~t two types of action occur. simple pattern
g
The arguments of
is applied to the second argument
becomes the first argument while the first argument
Yl
Y2
FI
are built up in a
and then
g(y2 )
is switched into second
7-24
place uno?mnged.
Clearly a flowchart scheme can £mitate this action by alternating
the FALSE branch of test instructions
T(Yl~y 2)
(yl,Y2) ÷ (g(y2)~yl)
can lead to the output statement At each step
Fl(Yl~y 2)
with the s£mult~neous compute and store .
Similarly the TRUE branch of test
z ÷ f(y!,y2 ) .
is replaced by
f
applied to the new
f(yl,Y2 ) . The computation piles on as many To m=~ee it worse, each step also installs new occurrence of
f's
f(yl,Y2 )
n
z
steps after forming
are the values after step
as indicated above, we must also, if the F I ~ build up
n-i
, then
n-2
Thus if
z(n)
and
n
and
Yi(n)
z(n) = f(Yl(n),Y2(n))
steps of the computation yield
and
z(n+l) =
z(n+2) =
, and so forth.
How can this be done without using a counter?
Yl(n)
and recreate inter-
steps of the computation starting at the top to get
f(z(n+l),f(Yl(n-2),Y2(n-2)))
implicit clock since
fn
n , we ~dst first construct
f(z(n) ,f(Yl(n-l),Y2(n-l)))
values of
and to
as the second argument of the
mediate values of the arguments, proceeding backwards.
then recalculate
FI
as there are execution steps.
f .
Thus, in addition to building up computation took
T(Yl,y 2)
But this is not the full output.
7%e answer is that we have an
was exactly the number of steps required to obtain the Y2(n)
that first set
T(Yl,y 2)
to TRUE.
Thus we ~dst store
the initial values of the inputs and then using new variables run a separate recomputation, not to get output but just to count to be repeated up to variables
ui
n-I
and
n .
This type of action must
times and so we really need two counters.
vi
to serve as counters.
We add new
In the first restart we give the
variables the values after two eom@utation steps and the
y
after doing one, and store this starting value of the
variables in the
variables.
Now when the
u
variables are back at step (i.e. v
z(n+l) ).
y
n-i , and so we can construct that part of the tree
1~nen we update the
v
values by one step and store this in y
u
and
variaNes at their step i
This time the y-computation will lag two steps behind the u-computation and
end with the values for k
v
variables reach the required shut-off values the
and now restart the whole computation with the
values.
u
u
variables the values
n-2 . At the
k-th
restart cycle, we have the y-computation
steps behind the u-computation and end with the
y
values and make the corresponding construction (i.e. initial (time
k )
values of the
available for the next cycle. stored in the
v
u
variables in the
We recognize
k = n
variables at their time z(n+k) ). v
n-k
We always store
variables and have them
because at this po£nt the values
variables are already at the shut-off point and so we stop.
These ideas are embodied in the flowchart in Example VII-2 which is strongly equivalent to our, scheme
S . 1~e construction carries over to the general ease.
We allow our flowchart to use multiple assignment statements tI
and
t2
(Ul,U 2) ÷ (t!,t 2)
for
arbitrary (terminal) terms which are executed by sLmultaneously storing
the curment value of
tI
in
uI
and the current value of
t2
in
u 2 . As we have
discussed before, these assignment statements can be simulated by standard assignment
7-25
EXAg~LE VII-2
FLOWCHART SCHEME STRONGLY EQUIVALENT TO LINEAR RECU[RSION SCHEME
F0(x) = Fl(g(x),h(x)) FI(Yl,Y2 ) : IF T(Yl,y2)
IIU]~N
<
f(yl,Y2 ) ELSE f(FI(g(Y2),Yl),f(Yl,Y2))
'.....
START
F
T
(Yl,Y2)
'
t, (ut'u2) ~-,,(yz'y2)
T
(Ul'U2) + (g(u2)'Ul)
(Vl,V2) ÷ (Ul,U2)
STOP
Iz
(Yl,Y2) ÷
f(g(x)z f,h(x))j yl yS
I F
T
I (Yl,Y2) + (g(Y2),Yl)
I
(Vl,V ) + (g(v2) Vl) I ..!U ...l,u2) ÷ (Vl,v21
i
7-26
statements using new d ~ y
variables.
We have not done so because it would obscure
the lines of the construction.
THEOREM 7.10
Every linear recursion scheme is flowchartable.
PROOF We adapt the ideas of the previous construction (Example VII-2). ~have more than one equation.
We use the fact that these equations can be assumed
to be in one of four formats which we shall call A
Now we may
for building up arguments and
0
Q
for query,
T
for terminal,
for building up fumctions on the outside.
We
must not only keep track of the number of steps and store the values for the next cycle in the acting on
v
variables but must also keep track of which equation is currently
u , which equation is acting on
w h e n w e restart.
(R,k)
and
means equation
(i,j,k) Fk
and which equation will act on
v
We keep track of this information mnemonically in the addresses.
Thus address
equation
y
will mean restart with equation
will act on
v
F.m is acting on when we restart.
k
(the equation for
y , equation
F.]
on
u
Fk ) and
For convenience in juggling notation we assume that the recursion equations Lu our linear reeursion scheme some in
F~ ; the equation
X:
(Xl,...,xn)
equation defines
S
define in order defined functions
defining
and
~:
F0(X)
Fi
is called equation
(yl,...,ym)
while equation
F0,FI,...
i . We let the variables
be all distinct and assume that the start i
for
i ~ 0
defines
us to store automatically the Luput in separate locations.
Fi(Y-] ; t?~s allows
We emn without loss of
generality assume that all defined functions are m-placed except perhaps for Let
~ : (Ul,...,um)
and
is a term using the
V : (Vl~... ~vm)
Yi
obtained by substituting
for
Yi
F@ .
contain new and distinct variables.
as variables, we use the notation
ui
to
u(t)
If
for the term
everywhere (so for exmmple if
t = F3(Yl,f(y2),Fs(Yl,Y3,Yl)) ~ then u(t) = F3(Ul,f(u2),Fs(Ul~U3,Ul)) ) A g a ~ , we allow our flowcharts to use multiple assignments such as (Ul,U 2) + (tl,t 2)
for arbitrary (terminal) terms
To an equation s(i) the
using the u
tI
q(i)
d(i)
and
we may associate various objects
t2 . -
an assignment statement
variables, a corresponding assignment statement
variables, an assignment statement involving
statements GOT0s
y
i
on the
y
variables or
or conditional GOTOs
dT(i)
qu(i) and
Su(i)
z , z(i) , and/or query
on the
u
variables, as well as
dF(i) . 'lhe nature and type of these
objects depend on the type of equation. We can assume that the start equation is
FO(~) where the
tj
:
F I ( t 1 . . . . . t m)
are terminal terms.
We let
using
s(0)
and
Su(0)
be defined by"
7-27
s(0):
(Yl .... '~m ) ÷
(tl ..... tm)
Su(O):
(Ul~-..,um)
(t I ..... t m)
and of course
d(O) = 1
We can a s s ~
+
since we transfer to equation I.
tbmt the other equations are Ln one of four forms and assign
these objects as indicated below. (1)
Type i
- ri(Z) = rr(t~,...,t m)
We say that
i
d(i)
(2)
=
a terminal term.
(tl""~t~)
Su(i):
(Ul .... 'Um) ÷
(u(tl)'""U(tm))
-
Fi(Y) = f(tl,...,tk_l,Fr([),tk+l,...,ts) i
is in
d(i)
=
r
s(i)
=
su (i)
Type
Q
-
:
i
is in
=
r
dF(i)
=
s
q(i)
-
We say t~mt
T(Yil,...,Yik ) Q
ELSE
Fs (~)
s) THEN
Fr (~)
and let
Uik)
z + t
We construct a proKram scheme
P
strongly equivalent to
S
as follows ~ by
As subscheme labels we use:
and
k
are equation numbers and
The scheme appears in Example VII-3. properties.
terminal
F.(~) = t t a term/hal term l i is in T and let
z(i) :
i,j
tj
: T(Yil,...,Yik)
qu(i) : T(u11,
subschemes.
each
and let
the null statemm~t
F.(Y)m = IF
dT(i)
T
0
z ÷ f(tt,...,tk_l,Z,tk+l,...~t
We say that
where
tj
(Y! .....Ym ) ÷
Type 0
Ty~
each
and let
s(i):
z(i):
(4)
A
r
We say that
(3)
is in
•
R
is a special symbol meanLng restarl
We leave it to the reader to check out its
7-28
CONSTRUCS'ZON OF FLOWCPI~RT P RECI~SION SCHEME S .
EXAWP LE VII-3
I.
EQUIVAL~N~ TO A LINTY3.
Straight simulation mode Initial subscheme :
'}
START
$
s(0) 1
< Sim~mlation of
i
y
in
A
or O
Simulation of
i
in
Q
\/
,
s(i)
+ Simulation of If
i : I
or
0 : ~
V z(i)
i
in
T If
i~l
~ 0~%
V < s(i)
I
s
(v I .... , v )
U
(0)
+ (u I .... , u )
7-29
EXAjWPLE VII-3 (Continued) If. Restart subschemes For k
in A
Su(k)
or 0
(v I ..... v m) ÷ (u I .... , u )
I
s(0)
for k' : d(k)
For k
in Q
V
for k ' = d T
For k
in T
V for k" = dF(k)
7-30
EXAMPLE Vll-3 III.
(Continued)
Clock simulation mode i carries the y-computation, u-computation and k is the next restart position.
Subschemes for
i
or
j
in
A
or
j
the
0
s(i)
Su(j)
+ Subscheme for
j
in Q , i in
A
or
0
for
Subscheme for
i' : d(i)
i
in Q ,
,
j
j' : d(j)
in
A
or
0
) I
s(i)
Su(J
T
2
F
V for
i' = d(i)
,
j' = dT(j)
,
j" = dF(J) for
i' : dT(i)
,
i" : dF(i)
,
j' : d(j)
7-31
EXAMPLE VII-3
llI.
(Continued)
Clock s£mulation mode continued
Subschemes for
T /
for
i' = dT(i) ,
\
i
and
j
F
i" = dF(i) ,
in
Q
T/
j' : dT(j) , and
j" : dF(j)
\
F
7-32
EXAMPLE VII-3
IV.
(Concluded)
END OF CYCLE AND RESTART MODE
-
For
i
i
or
in
j
in
T
T
7
This situation cannot occ~<~ since
j
carries the u-computation
which leads the y-computation in and so point
j -
must reach the cutoff an equation in
fiest.
Subsch~me for
j
Ln
T
rand i
in
A
and
in
0
V
+ Subscheme for
j
in
T
N I z(i) 'Vm) ..!.ul .. .....%T~) ÷ (vI ....
%
i
or
i
Q
T
-
7-33
We have just shown that linear recursion schemes are flowchartable.
In the last
section we showed that every program scheme is translatable into a recursion scheme and our construction actually showed that every program scheme can be translated into a particular type of linear recursion scheme.
DEFINITION
A term
t
is right linear if it contains at most one nonterminal and
no terminal appears to the left of any nonterminal.
Thus
t
is right linear if it is either terminal or else of the form
F(tl,... ,tn)
DEFINITION
with each
ti
terminal and
F
a defined function letter.
A recursion schem~ is right linear if all terms appearing ~n all its
equations are right lineaw.
Thus our result (Theorem 7.5) in the previous section could be phrased:
COROLLARY 7.11
The class of program schemes with one output variable is
effectively translatable into the class of right linear recursion schemes.
I~tting our results together yields:
THEOREM 7.12
The classes of program schemes with one output variable, of l~near
recursion schemes and of ri~ut linear recursion schemes are effectively intertranslatable.
This is not true for monadic reeursion schemes.
In the monadic case, right
linear schemes are intertranslatable with l~nov schemes but the class of linear monadic recursion schemes is more powerful. Suppose we have a recursion scheme letter
f
are distinct from all basis or defined function letters of
appear anywhere in
S'
S'
plus
function
defining
(S,11 )
where
I t (f)(a) = val (S T ,l,a) S .
S"
F~
of
S , f S'
S ,
f •
whose defined function letters are those of
1'
all equations of
is the extension of
It should be clear that if
S
and
Scheme
I
I ,
(S",I)
computes the
obtained by setting
i.e. ~ a functional composition of $'
S S ~'
S I , and in addition the equation
Under any interpretaionn
ever~here
does not
is n-placed.
f ~ now regarded as a defir~ed function letter.
contains all equations of f(Y) = F~(~)
such that all defined function letters
and the initi~ defined function
We can define a recursion scheme and those of
S'
containing an n-placed basis function
of
S'
and another recursion scheme
S
are both flowehartable, so is
St
into
S' .
7~34
THEOREM 7.13
The class of flowchartable recursion schemes is closed under func-
tional composition.
Thus not only the linear reeursion schemes but also their closupe under f~mnctional composition is flowchartable
D.
RECURSION A U G H F ~
-
a fairly rich family.
FLOWCHART SCH~IMES
In a previous section~ we have sho~en that recu_~sion schemes are more powerful than flowchsrt schemes.
Now we add to the basic model of flowchart of program
schemes a mechanism resembling recursive procedures and calls as defined in for example.
PL/I ,
We fLnd that such recursion augmented flowchart schemes are in fact
equivalent in expressive power to rectmsion schemes.
Thus we show that reeursion
schemes are indeed one version of the model we seek to study the power of programs when augmented by recursion, in contrast to programs without this extension but perhaps with other additions. It is generally known that recursive procedures can be implemented using stacks. Here we provide a formal expression for this p~ece of "folk-lore" by showing that recursion schemes (or, as we shall actually do it, program schemes augmented by recursion) can be effectively translated into program schemes augmented by" a pushdown store.
We shall note without formal proof that program schemes au~]nented by
arrays are actually more powerful than recursion schemes
-
a rather surprising
and counzerintuitive result. As defined in Chapter Two, program schemes have basis function letters, predicate letters and constants, with "meanings" assigned by interpretations.
These
syTmbols plus the variables or storage locations are combined to form tin-©basic kinds of instructions or statements, assigrments and tests~ two special instructions, STOP and START were also defined. Recursion augmented schemes also have defLned ftmction s}~bols or procedure symbols~ their values are assigned by the computation rather than by the interpretation.
As in the definition of recursion schemes, each defined function letter or
symbol
F
is assumed to be m-placed for some nonzero positive integer
m . A re-
eursion augmented program scheme is allowed a new type of instruction, a call.
DEFINITION
A call is an instruction of the form
CALL
Where
F
F(yI ,... ,yn )
is an n-placed defined function symbol~ and
variables, called the actual pa_~am~ters:of the call.
Yl .... 'Yn
are
n
distinct
7-35
Each defined function symbol appearing in a scheme must of course be defined in the scheme.
This is done by appending to the scheme a special type of subrou-
tine or subscheme called a procedure definition.
DEFINITION
A procedure definition is a set of instructions of the form:
PROCEDL~dE F(xI .... ,xn) DECLARE NEW
(Ul~... ,um)
Q END
F
where i)
is an n-placed defined function symbol, the function defined by the proce-
F
dure
2)
Xl~... ,xn
are
n
distinct variables~ the formal parameters of the procedure;
3)
Ul,... ,um
are
m
distinct variables, all different from the
4)
u. are called the local variables of the procedure~ and m Q ~ the procedure body, is any nonespty list of assignment ir~structions, test
x i , and the
instructions and CALL instructions, involving as variables only the formal parameters and local variables of the procedure, such that START
Q
STOP is a pro-
gram scheme with CALLs.
A recursion augmented scheme is a program scheme with definitions appended for all procedures called.
DEFINITION Q
A recursion augmented program scheme is a list
is a program scheme with CALLs, each Qi
Qi
(Q'QI"'" '~) such that
is a procedure defLnition ~nd
i)
the
define all and only defined function symbols appearing in CALLs in
2)
the variables of
Q , the global variables, do not appear in mny
variables in
are disjoint from those in
Q u Q1 u -.. u ~ Qi
and each defined function symbol is defined only once, and
Now we brave defined the syntax of our model together
-
we must define tile semantics
interpretation. recursion schemes
-
Qj -
for
Qi
and the
i ~ j .
how a scheme is for~,mlly put
how a function is computed under an
Interpretations are defined as for ordinary program schemes or for -
the defii~ed functions are not interpreted.
We made a slight departure from our previous assumptions. cheated a little in the definition of a scheme.
Notice that we have
We have not explained how the divi-
sion Lnto input variables, program variables, and output variables is to be carried out.
In particular, we have not explained what the requirement that on every path
7-36
from START every non-input variable must be assigned to before it is computed on, means in a situation where the path contains CALLs.
Such an explanation eould be
made but it would be complex and in some respects undesirable.
For example, we
wish to allow the actual par~neters of a CALL to be undefined when the call is initially executed because the procedure called may return the desired values.
So we
abandon this requirement and instead adopt a convention that every domain of an interpretation contains a special symbol acting on
A
A
meaning "undefined".
as one of its variables yields the value
tion acting on a value not ~
its domain returns
A
Any function
and likewise any func-
A . This convention has some pit-
falls of its o ~ , but does allow us to sidestep some unpleasant proble¢~.
If
A
is ever the output of a program this is taken to mean that the program is illdefined. Let
P = (Q,QI~... ,~)
pretation of
P , and
K
s£mulating computation pose the computation F
be a recursion augmented program scheme,
an input vector. (Q~l~a)
(Q,l,a)
The computation
Qj
our definition all i < i < s • Let for
ui
be
Yi
Xl~...:xn
and all
t
~ast excecute G %
the END
every~fnere in
F
statement in
are distinct.
Let
u i'
be a new variable, Yi
subprogram
for
x. z
u.' l
F(yI,... ,yn ) by
(Qj ' ,I) . When the computation reaches
Qj, , it wipes out all the local variables (Q,I)
and
u i' and
with the instruction directly following CALL
and continues Ln the same way.
Thus, computation (Q~I)
Qj . Let the forUl,..• ,us . By
Qj . Now the computation replaces CALL
resumes the simulation of F(Yl:...,yn)
xi
Sup-
F(Yl,...,yn) , where
and the local variables
Qj' = Q ~_ X~U , the result of substitutLng Jy,u ~
Qj ' and proceeds to simulate
an inter-
starts by
in the usual way, until a CALL is ~eaehed. at step
is an n-placed defined function letter defined by procedure
real parameters of
I
(P,l,a)
(P:l,a)
or else some subprogram
is at any step either sAmulating the main program (Qj',I) .
It can encounter a call, CALL
either in the main program or in a subprogr&m. this call, it takes the procedure
Qk
G(v) ,
In either case, when it encou~ters
defining
G , replaces the formal para-
meters by the actual] parameters uniformly and changes the local variables into new variables
(this is necessar57 if~ for ez~ple~
proceeds now as if CALL
G(v)
G
is being called by itself) and
_had been replaced by this copy
Qk'
of
Qk "
Roughly speaking, this form of parameter passing can be considered a run-t~me macro-substitution. Finally, computation
(P,I,a)
instruction while in the m a ~
halts if and only if it encounters the STOP
program
(Q:I) .
7-37
EXAMPLE We need an illustration of this somewhat complicated definition. assigned by an interpretation
I
have already been written down in the recursion
au~ented program scheme of Example VII - 4.
~e
resulting program is a moderately
poor program for computing the binomial coefficient tegers
n
and
k
with
i <__k <__n .
(k)
for nonzero positive in-
One reason it is not a good program is that
input is not tested for validity~ a~other is that the algorithm then
k! , then multiply
kZ
by
(n-k)!
and divide
often not a safe one because of overflow. y
by
u!
and works just if
T%e meanings
u
and
y
n!
The procedume
-
compute
by this result FACT(u,y)
We enter instruction
3
with the
a copy of the procedure body for before instruction
4
FACT
is
multiplies
are already nonzero positive integers.
The example also gives selected parts of the computation for input k = 2 .
n! , -
IF
and the
of the main program.
test positive. END
n = 3
and
Then we proceed as if
statement were inserted just
Notice that our definitions require a
procedure definition to be, in effect, a single entry single exit subseheme so there is no ambiguity about where we enter the procedure or where we leave or where we go next, even if the main program were not a
WHILE program (i.e., well-structured).
The procedure definition gives us a local value main program, formal parameter and
TEMP
becomes
T~P I .
u
in
3.4 ,
FACT
When substituting into the
becomes actual paa~&meter
In fact,
the value of the global var~iable
TEMP.
xI
TE~
xI ~ y
becomes
zI
was introduced so that we do not change
while executing the subroutine.
calls itself, this time with actual parameters
TEMP 1
Notice that and
zI ;
as this example shows, a local variable can become an actual parmmeter of another CAIL.
7-38
EXAMPLE VII - 4
Program
A RECURSION AUGMENTED PROGRAM FOR
P : (Q'QI)
input
n
and
k
output
zI
Main Program: i.
Xl ÷ n
;
x2 ÷ k
2.
zI + i ~
z2 + i
3.
IF
xI >
I
~FrEN CALL
FACT(xI~z I)
ENDIF
4.
IF
x2 >
1
THEN CALL
FACT(x2,z 2)
ENDIF
5.
x2 ÷ xI - x2
6.
IF x 2 > 1
7.
z I ÷ Zl/Z 2
8.
STOP
THEN CALL
Procedure
FACT:
PP@CEDURE
FACT(u,y)
DECLP~
NEW
E~DIF
( I ~ :))
i.
TE~
2.
y ÷ TEMP.
3.
TEMP+TEMP
4.
IF
END FACT
FACT(x2,z 2)
+ u y
T~.'P > 1
- 1 I~N
CAIJ~ F A C T ( T ~ [ ~ y )
E~©IF
(k)
AND SOME COMPUTATION S~I~PS
7-39
EXAMPLE VII - 4
Computation
CONTINUED
steps
fop
Enter, instruction Now proceed 3. i.
3
n : 3 ~
with
k = 2
val(x I) = 3 ,
val(x 2) = 2 ,
val(z I) = val(z 2) = i
as if the main program wepe:
TEMP I + x I
2.
z I ÷ TEHP I . z I
3.
I~PI
4.
IF
÷ ~PI
- I
TEIJP I > i
THEN CALL
FACT(TEMP I,z I)
ENDIF
END FACT 4. etc.
~ter
3.4
with
val(x I) = 3 ,
val(x 2) = 2 ,
val(z I) = 3 ,
val(z 2) = ! ,
val (TEMP I) = 2 3. 4. i.
TEMP 2 ÷ 71~vP I
2.
zI ÷ T~
2 . zI
3.
IEMP 2 + 7~MP 2 - i
4.
IF
TEFP 2 > i
THEN CALL
FACT(~2:z
I)
ENDIF
END FACT END FACT 4. etc.
Enter
3.4.4
with
vaI(TEMP I) = 2 3. 4.
~
END FACT 4. etc.
FACT
and
val(x I) = 3 ~
val(x 2) -- 2 ~
v a l ( T ~ P 2) = i .
Now:
val(z I) = 6 ,
val(z 2) = i
and
7-40
EXAKPLE
Enter
VII - 4
4
with
variables
CONCLUDED
val(x I) = 3 ,
~ I
and T ~
2
val(x 2) = 2 ~ val(z I) : 6 ,
val(z 2) = i
a_nd
have been destroyed.
Now proceed as if main progr&m were: 4. i.
TEMPI ÷ x 2
2.
z 2 ÷ TEHP I . z 2
3.
TEMPI ÷ TE~P I - i
4.
IF
TEMP I > i
THEN CALL
FACT(TEMPI,Z 2)
END FACT 5. etc.
Enter
4.4
with
val(x I) = 3 , val(x 2) = 2 ~ val(z I) : 6 ~ val(z 2) : 2 , and
v a l ( T ~ P I) = I .
Now:
4. END FACT 5. e t c .
Enter
6
TEMP I
destroyed.
with
val(x I) = 3 : val(x 2) : i , val(z I) : 6 , va!(z 2) : 2 , and
Enter
8
Since
and halt with
val(x 2) is not greater t~mn
val(z I) : 6/2 : 3 .
i ~
proceed to
This is the output.
7 .
7-41
The next thing to observe is that we enter and must insert ¬her copy of ment of the first copy. and
zI .
3.4
with the test again positive
FACT ~ this time just before the
END FACT
This time the actual parameters are, as mentioned,
The local variable of this
CALL
stateTE~ I
is not supposed to be the same as for
the previous one, so we need a new variable and use
TEMP 2 ~ this illustrates why
we must change the names of the local variables ~ too. When we enter FACT
statement.
3.4.4
the test is now false~ so we go immediately
This causes variable
retu_~n to the calling subroutine. TEMP I
4
2
4.
x2
and
z2 .
~
FACT
Since variable
~MPI
Thus, we are free to reuse
instead use a new variable, say
T~
3 . We enter
TEMP I
and r e ~ n
END FACT , destroy
and this time
FACT
with actual
was destroyed, as far as the pro-
gram is concerned it never existed.
encounter
E~\©
of the main program.
the test is again positive, so we insert a copy of
parameters
to the
to be permanently destroyed, and we
We again encounter
is removed and we return to At
T~
4.4 to
5
~PI
~ we could
with the test negative, of the main program.
There are some comments on this definition we should make.
It by no means
reflects all possible features of procedures and calls in "real" p r o g r a ~ n g languages.
We have deliberately chosen only to reflect features essential to the
notion of recursion and to adopt conventions and restrictions that make other concepts as simple as possible. Some of the restrictions we have placed on our model are: i)
The values of the actual parameters are altered during the course of the procedure in accordance with the instructions of the procedure ;
2)
The actual parameters must be variables, not expressions (such as all parameters are distinct;
CALL
FACT(u,u)
X + Y
), and
is not allowed, nor CALL
FACT(x ! - x2,z 2) 3)
Procedure definitions are all single entry single exit subgraphs;
4)
The only global variables available to a procedure are the actual parameters;
5 ) All local variables and formal parameters are distinct new variables, and all local variables die at the end of the procedure subroutine. None of these restrictions affect computing power. using new temporary variables. computation.
Restriction
3)
This can readily be shown
helped us in the definition
of
All the restrictions will be useful when we adapt the verification
method to handle recursion{ restriction
2)
is vital in this respect as without it
the method in the last section of this chapter is invalid. As we have mentioned, our definitions entail parameter passing by a kind of run-time macro-substitution.
We now define a very useful equivalence preserving
transformation on rec~mosion augmented sehemes, macroexmmnsion, which can be considered a kind of compile-time macro-s~stitution.
DEFINITION
Let
P = (Q,QI,... ,Qm ) be a reeursion augmented program scheme and let
7-42
CALL
F(Yl,... ,yn) be an instruction in
by procedure Sk
END
Qk " Let
F , with
Sk
and l e t
for
everywhere in.
flicts
Q , with
be PROCEDURE
as procedure body.
Sk
with addresses in
i n g CALL F ( Y l , . . . ,yn )
and a l t e r i n g Q .
by
For
I < i < m , let
of substituting
Yi
P' : (Q' ' Q I " ' "
i s a macroexpansion o f
'~)
(Ul,... ,um) ;
u i'
for
be a new
xi
the addresses of instructions
The scheme
Sk'
~F a function symbol defined
F(Xl,... ,xn) ; DECLARE NEW
~ U" ~ t h e r e s u l t Sk' : s xk~,~,
variable
ui
Qk
and
ui'
to avoid con-
o b t a i n e d by r e p l a c -
P .
We note without proof that:
COROLLARY 7.14 lent to
If
P'
is a macroexpansion of
P , then
is strongly equiva-
P' .
If an instruction CALL
F(~)
occurs while procedure
cuted (so this call might, for example~ not appear in procedure called by level.
P
F
F
is being exe-
F
itself but in another
) this call is termed recursive.
0ther~ise it is first
Any call in the main program is obviously first level, but calls inside
a procedure might be first level or recursive depending on the sequence of ins~uctions by which they are reached.
A complete first level macroexpansion of
P
in-
volves macroexTe~iding one by one all calls in the main program, then repeating this process as long as there are calls which are first level with respect to the original program scheme can form
PI
P .
If
P
has
P3
from
P2
with respect to all calls in
defined function letters (procedures) we
by macroexpansion of all calls in
by macroexpansion of all calls of then
n
Pn
P , and then form
by macroexpansion of all calls of
P , and so on.
P2
from
PI which are first level with respect to P2
which are first level
By the time this has been repeated
must be recursive with respect to
P .
PI P ,
n
tJ~es,
In particular, if there
is no interpretation and input under which a recursive call is executed, we can safely remove all calls from
Pn
(if any are there) and still have a strongly
equivalent scheme which is now a program scheme without reeursion.
COROLLARY 7.15
If
P
is a recursion augmented program scheme such that no recur-
sive call is ever executed during any computation of
P , then
P
is strongly
equivalent to some program scheme without recursion.
Suppose in a recursion augmented scheme then, before this call is completed (and
END
P , a procedure F
reached),
F
F
is called and
is called again.
Suppose further that every test encountered during these recursive calls of always yields the same answer (i.e. , each test or else always gives answer ~ALSE).
T
F
either always gives amswer ~:RUE
Then the same path must be followed during the
7-43
second call of
F , yielding ultimately a third call of
second is completed, and so forth. Thus, before the first call of and values
a
and
b
F
before the first or
So the program will be in an unbreakable loop.
F
such that
tion of the original call of
F
is finally completed there must be some test T
is applied to both
and
l(T)(a) = TRUE
apply a complete first level macroexpansion of all calls are recursive with respect to
P
a
but
and
[
T
before comple-
l(T)(b) = FALSE .
If we
P ~ th~n in the resulting scheme
and so this situation must hold for
every call.
COROLLARY 7.16 P .
Let
S
be obtained by a complete first level macroexpansion of
~@henever &ny procedure
F
is called, either it is never completed anl the
computation loops, or there is some test
T
such that
for two different values during the execution of
T
gives different answers
F .
Example VII - 5 gives a complete first level maeroexpansion of the scheme of Example VII - 4.
All calls are row recursive with respect to the original scheme;
the process needed to be carried out only once.
The result~-~ scheme is not
unique because we could have chosen the names of the new variables in different ways.
In particular, since the three calls expanded were independent in the sense
that at most one could be executed at a time, and local variables are destroyed after completion of a call~ we could have used the same variable, say all three replacements of local variable used
7~MP
TD~P
~=~JPI ~
for
(for that matter, we co~m!d have
itself.)
Now we must show that our definition is "reasonable" in that the classes of recursion schemes and of recursion ausnented program schemes are effectively intertr&nslatable.
~ne proof is not hard.
First suppose we have a recursion scheme assume that
S
is simple.
S . We can, as disoussed before,
In particular, we can assume that
S
has an initial
equation of the form
ro(xl~... :xm) : Fl(xF... ~%,x I .....x !) n-m times
and that all other equations are of the forms:
F(u I~... :un) : t F(Ul,...,u n) : IF
t
terminal
T(Uil:...,Uik)
THEN
G(Ul,...,u n)
ELSE
H(Ul, ....u n)
7-44
EXAi~PLE VII - 5
A COHPL~TE FIRST L S V E L M A C R O E X P A N S I O N
OF E X A M P L E VII - 4
Hain Program: I.
xl÷n
;
2.
zI ÷ i ,
3.
IF
x2 + k z2 ÷ i
xI > i
THEN 3.1
TEHP I ÷ x l
3.2
z I ÷ TEMP 1 . z 1
3.3
TEHP 1 + r£iuiP1 - 1
3.4
IF
TEMP 1 > !
'IHEN CALL
FACT(TEMPI,Z I)
ENDIF
FACT(TE}~2,z2)
F~,©IF
FACT(TEMP3,z 2)
ENDIF
ENDIF 4.
IF
x2 > 1
THEN 4.1
TEMP 2 + x 2
4.2
z 2 ÷ 'IT~P 2 . z 2
4.3
TSHP 2 + TEMP 2 - i
4.4
IF
~ 2
> i
1~£~k{ CALL
FA~IF 5.
x2 ÷ xI - x2
6.
IF
x2 > i
ENDIF 7.
z I ÷ Zl/Z 2
8.
STOP
THEN 6. i
TEMP 3 ÷ x 2
6.2
z 2 ÷ TEMP 3 . z 2
6.3
TEHP 3 + TEMP 3 - i
6.4
IF
TEMP 3 > i
TH~
CALL
7-45
F(Ul,...,u n) : G(tl,...,t n) F(Ul,...,u n) : G(tl,...,ti_l,H(Ul,..~,u n),ti+i,...,t n) for
F , G
and
H
n-placed defLned f~±nction le~ers and
t I ~... ~tn
terminal
terms. The main body
Q
of the new scheme is simply:
START CALL
Fl(X I, ....Xm,Xl,...,Xl,Z)
STOP with input variables
Xl,.,. ,xm
and output variable
Each defined function letter
F
(except
function letter def~ed by procedure F(Ul,...,Un,Z)
z .
F 0 ) becomes an n+l-placed defined
QF " For convenience we omit the PROCEDURE
statement and the END
F
statement, and include the DECLARE NEW
statement only when there are in fact local variables.
We use the same formal
pa~meters and local variables tbroughout~ the names can be changed to agree with oIJr definitions. If the equation definir~g F F(Ul~...,u n) : t
for
in t
S
is:
terminal
then the definition of the body of procedure
QF
is:
z÷t If the equation defining
F(Ul,...,u n) = IF
F
in
S
is:
T(Uil,...~Uik)
then the definition of the body of procedure
IF
T(Uil,...~Uik)
ENDIF
THEN
QF
G(Ul,...,u n)
is:
THEN CALL
G(uI~... ~Un~Z)
ELSE CALL
H(Ul,... ,Un,Z)
ELSE
H(Ul,...,u n)
7-46
If the equation definLng
F
is
F(Ul:...,u n) = G(tl~..,,t n) then the definition of the body of procedure
DECLARE NEW
QF
is:
(Vl,...,v n)
Vl ÷ t I ; ... ; v n ÷ t n Ul ÷ v I ; ... ; u n + v n CALL
G(Ul,...~Un~Z)
FLnally, if the equation defining
F
is
F(Ul,...,u n) = G(tl,...,ti_l~H(Ul,...,Un),ti+l,...,tn) then the definition of the body of procedure
DECLARE NEW
QF
each
t. ]
terminal
is:
(Vl,... :Vn,Y)
v I ÷ t I ; ... ; vi_ ! + ti_ I Vi+l + ti+ I ; ..... ; Vn ÷ t n CALL
H(Ul,... ,Un,Y)
u I ÷ v I ; ... ; ui_ 1 ÷ vi_ 1 ui÷Y Ui+l + Vi+l ; "'" ; Un ÷ v n CALL
G(Ul,...,Un~Z)
%~nus we have shown
~3EORE,~ 7.17
The class of recursion schemes is effectively translatable into the
class of recur,sion augmented program schemes.
7-47
EXAMPLE We can re-examine briefly two of the schemes studied in Section chapter.
A
of this
The first scheme was:
F(x) : IF
P(x)
THEN x
This is not in the desired form.
ELSE
h(F(f(x)), F(g(x)))
However, the scheme is so clear that we can apply
the algorithm to it directly, making the necessary adjustments as we go. scheme is simply:
START CALL
F(x,z)
STOP
and the procedure definition
PROCEDURE
P(x)
is just:
F(x,z)
DECLARE NEW IF
QF
(Ul 'u2 'Yl 'Y2 )
THEN
z ÷ x
ELSE u I ÷ f(x) ;
u 2 ÷ g(x)
CALL
F(u I ,yl )
CALL
F(u2 'Y2 )
z ÷ h(Yl,y 2) ENDIF END
F
Our second example was the interpreted scheme
F(x) = IF
x = 0
This becomes again
START CALL STOP
F(x,z)
THEN
x + i
ELSE
x.F(x ± i)
The main
7-48
with procedure def£nition
PROCEDURE
x = 0
;
F(x~z)
DECLARE NEW IF
as
QF
(u) 'I~:N z ÷ X+l ELSE
tl÷X
"_ i
CALL
F(u~z)
z ÷ x.z
ENDIF END
F
The translation of a recursion augmented progrm~ scheme into a recursion scheme is an elaboration of the construction in the proof of Theorem
I~IORF}[ 7.18
7.5.
l~ne class of recursion augmentesJ program schemes with one output vari-
able is effectively translatable into the class of recmrsion schemes.
PROOF Let
P = (Q'QI'""Qp)
variables (locations in in
Q ,
be a recursion augmented program scheme with
Q ) Xl,... ,xn .
For each address
we create a new defined function letter
a defined function letter in
P
r
m
cedure definLng
for each address
F .
In the main scheme
r.
Fm~ i
Q ~
an instruction
X- + t
corresponds to an equation
%(×1 . . . .
'%)
an instruction
r.
T(v)
s,~
--
%+l(xz '''''xj-~_'t'×j+l
.... '~)
If
F
formal parameters and
local variables ~ we create a new m-placed defined function letter s~nd an ~m+k)-placed defLned fur.ction letter
global
of an instT'uction
Y~r which is n-placed.
for a procedure with
n
'
Fi r
for
is k
i < i < m
in the pro-
7-49
corresponds to equation
~(~)
and if
x. 30
= IF
T(E)
THEN
Ms(~)
ELSE
M~(~)
is the output variable, then
r.
STOP
becomes
M
(x)
: x.
r
]0
The new feature is that if with
m
F
is a procedure symbol in
formal parameters, a call instruction in
r.
CALL
P
defined by a procedure
Q
F(v I ..... vm)
now corresponds to an equation
Mr(Xl~...,x n) = Mr+l(tl,...,t n) where for
x i = vj , t i = Fj(v I ..... vm)
Suppose mal parameters For
F
is a procedure symbol in yl,o..,ym
and if P
and local variables
x i { {v I .... ,vm} ,
defined by a procedure Ym+l,...,ym+ k .
i < i < m , there is an equation
Fi(Y I .... ~Ym ) : FI,i(Y I ..... Ym,Yl ..... Yl ) k tLmes
Now an instruction in
r.
QF
yj ÷ t
corresponds to
Fr,i(Y 1 ..... Ym+k ) : Fr+l,i(Yl,...,Yj_l~t,yj+ 1 ..... Ym+k ) and
r.
T(~)
s,~
t. l
QF
:
X. i
with for-
7-50
to
Fr,i(~) : IF
T(q)
'~]{
Fs:i(Y)
ELSE
F~ ~i(y)
while
r.
END
F
becomes
F r , i ( Y l " " ' Y m + k ) : Yi " Finally, a call in
r.
CALL
Qy G(Vl,. • o ~vs)
becomes an equation
Fr,i(Yl,...,Ym+k ) = Fr+l,i(tl,...,tm+k) where tj = ~ ( v I .... ,vs)
if
The new reeursion scheme letter to
P .
~
xj = vk
S
and
t.~ = x.~ if
x.; ~ {vI .....Vs} .
is the set of all the equations above with initial
. It is left to the reader to see that
S
is indeed strongly equivalent
•
In the next section we briefly compare recursion augmented schemes with program schemes augmented by other data manipulation mechanisms
-
pushdown stores, labels
and arrays.
E.
PUSHDOWN STORES, LABELS ~%~© A=
tations of program schemes:
pushdow~ stores and arrays.
The primary results are
that the classes of recursion augmented program schemes and of pushdown store augmented schemes are effectively Lntertranslatable and that the class of array augmented progrmm schemes is more powerful.
7-51
For this section we consider a pushdown store to be a finite but unbounded list whose entries are members of the domain of discussion. and constructions for the case of one p u s h d o ~ to cover many pushdown stores.
We give our definitions
store; they can easily be enlarged
It can be shown, although we shall not do so, that
the class of program schemes augmented with two pushdown stores is effectively intertranslatable with the class of program schemes augmented with any number of pushdown stores (see the reference by Brown, Gries and Szymanski for details).
DEFINITION
A program scheme augmented by one pushdown store has a special variable
which is not an input variable and whose contents is always a list and two additional instruction forms:
PUSH(u)
for a variable list in
~ ,
u ~ ~ , leaving
which makes the contents of
u
and the rest of
~
u
the new top entry in the
unchanged, and
u e POP
which removes the top entry in the list in and leaves the rest of u ÷ POP
~
~
and places it in location
unchanged, but if
is ignored (has no effect).
~
Variable
is empty ~
(A)
u ~
the instruction
is always assumed to be initially
empty (i.e., contain the empty list).
We make the stipulation that the pushdown store variable cannot be an input variable
-
so the input cannot be a list
-
for the same reason we will also
prohibit using an array variable as an input variable (so the input cannot be an array)
-
namely to permit comparison of the power of schemes with these augmenta-
tions without getting anomalous results because one class has apples as input and the other has oranges. An array variable
A
is really an infinite sequence
A(1),A(2) ,... ,A(i),...
of variables which are used as subscripted variables.
We assume that we have a new
"reserved" set
... ) which are not allowed
Z
of subscripts,
Z = (i , 2_ ,
3 ,
to be members of the domain of an interpretation and are reserved for subscripting arrays. of
Z
Integers used as input are assumed to be totally distinct from the members and cannot be compared with them.
A program scheme augmented by an array has two sorts of variables variables able.
u,v,x,y~z,..,
and array variables
A(v)
where
v
T~us any statement may contain as variable an expression
simple variable. refer to variable
If
v
contains a subscript
A(i) .
Otherwise,
A(v)
i_ , then
A(v)
-
simple
is a simple var~A(v)
for
is taken to
is taken to refer to
A(1)
,
v
a
7-52
the default value.
Two new types of instructions
are allowed.
Instruction
u ÷ i I
for
u
a simple variable,
u ÷ v + 1
if
v
places subscript
contains
subscript
i
_
if
2-- is placed in
u
u .
If
v
places subscript
u . i+l
Instruction
in
u ,
Although this form of augmentation
DEFINITION
A ,
undefined,
is used ~mstead.
is called an "array" in the literature~
&nd
A(v)
u÷v
for
v
a simple variable,
and subscript instructions
+ I .
for just one array variable.
It is fairly easy
to see that one array gives as much power as any number of arrays. A
and
B(1)
B
can be co~@Lned Lnto array
and in general
C(2k+l)
is
A(k+l)
C
in which
and
C(2k)
C(1) is
u ÷ 3 ,
A(1)
,
C(2)
.
such as
u ÷ v + 3
which can readily be seen to be imitated by three ordinary instruc-
tions, and also perm£t i+l
For example, is
B(k)
For convenience we shall also allow subscript instructions
script
it
stack or list which can be everywhere accessed.
Again, we gave our definition
or
v
A program scheme augmented by an array a_]lows simple variables and
as,ray variables
is
and
is used as an argument of a basis function or predicate
beb~ves more like ~n addressible
arrays
u
does not contain a subscript the default value
when it contains a subscript the value
i
in variable
I
must be sLmple variaJ~les{
u÷
1
u ÷ v - I
~Inich places
i
£n
and otherwise places the default value
u i
if in
v u .
contains subIt can be shown
that use of " _. " does not affect the power of these schemes. Another useful mechanism is the use of labels. has a special set of addresses called labels,
A scheme augmented by labels
{L I ,... , L }
such that each label
is attached to exactly one statement ~ some statements can have no labels but no statement can have more than one label and no label can refer to more than one statement.
Two new instr.uetions are allowed:
v ÷ L.
for a label
L.
I
v
w_hich places label L. in location v , and a statement GOTO 1 fers control to the statement labeled L i if v contains a label
does not contain a label then
GOTO
next statement in the usual way.
v
and variable
i
is simply ignored
v
which tr&ns-
Li ;
if
v
and control passes to the
We assume that the set of labels is disjo~mt from
the domain of any Lnterpretation.
DEFINITION v ÷ L
A program scheme augmented by labels as values permits £nstructions
and
GOTO
v
for a label
L
and a variable
v .
To simplify the stateme~it of results we use the following definitions:
DEFINITION schemes,
Let PR
R
be the class of recursion schemes,
P
the class of program
the class of pr~o~rsm schemes augmented by recursion:
of program schemes augmented by one pushdown store and
PA
PPDS
the class
the class of program
7-53
schemes augmented by arrays. that, for example,
PAL
If labels are also allowed, add subscript
L ,
so
is the class of program schemes augmented by arrays and
labels.
Recall t h a t if
CI
if classes
CI
is translatable into
and
C2
but
C2
are ~ntertrarLslatable, we ~Pite
C2
is not tra~nslata~le into
C I - C2 ;
C I , we write
CI < C 2 . So far we have seen that:
P
We shall argue (without formal proofs) that
P < R
PR --- PpDs < PA
First we shall give a fairly detailed proof that
PR < PPDSL
and then argue
intuitively that the use of labels wasn't really necessary{ a more complicated construction would yield a scheme in
LDg#@~ 7.19
PPDS "
PR < PPDSL
PROOF Let
P : (q'ql'" "" ~Qp)
be a program scheme augmented by reeursion; assmne all
pieces are written in linear form. The general idea is that when we call any function, we p]ace on the p u s h d o ~ store the current values of all variables which are active but not actual parameters of the call (global values if we are in the main program, formal parameters and local variables if we are in a procedure).
This frees all variable names for
use during the execution of the procedure and so we use for~z~l parameters and local variables as variables.
We also place on the store a label telling us where to
return on completion of the call.
When the call is completed, a POP instruction
takes the top value of the list, which is a label, and then a GOTO statement returns control to the appropriate labeled statement; the labeled statement respecifies the actual parameter variables with the new values computed du~ing the execution of the procedure and restores the vsdues of the old, unchanged variables from the top of the pushdown store to their proper locations a~nd then transfers eontrgl to the next statement to be executed. For convenience we allow the use of a statement TRANSFER TO any address (but not a label).
r
where
This is not to be confused with a GOTO
simply abbreviates any unconditional transfer instruction like
T(x)
v ~
r
is it
r,r . We
7-54
also assume that addresses in the mainprogr&m procedure defining
F
are denoted by
First take the main program
CALL
PUSH(y l )
Q
are denoted by
and in the
.
Q .
Replace any call instruction
F(Vl,..o,v n)
by ~ ...
;
PUSH(y m)
DUMMY ÷ LQ, r PUSH (D U % ~ ) Xl + Vl ; "'" % Xn ÷ v n TRANSFER TO
where
yl,...,y m
Vl,...,v n ,
are all the global values not among the actual parameters
LQ, r
is a new label,
DUMMY
the formal parameters of the procedure
is a new variable, and
QF
defining
Xl,...,x n
are
F . Also append the labeled
statement:
LQ ,r
V l ÷ X l ' "°"
~
Ym + POP ; . . . TRANSFER TO
Observe that the new
Vn ~
Yl ÷ POP
are not actual parameters
n
statement first stores all global values which
(yl~... ,ym )
on the pushdown store~ then puts label
LQ, r
on top of the pushdown store~ and finally lets the values of the actual parameters of the call,
v I ,... ,vn ,
Xl,... ,xn ; the
xi
specify the formal parameters of procedure
will be used as variables in the execution of
trol passes to the start of label
LQ ,r
the procedure body of
F . When
F
F , F . Then con-
is completed,
will be retrieved from the top of the store and a GOT0 will pass con-
trol to the statement labeled by
LQ~ r
Then each actual parameter of the call,
v i , will be respecified by the final value of the corresponding formal parameter, xi ,
of
F , the other global variables will have their proper values restored from
the pushdown store and control will return to following
, the statement originally
eQ ,r> .
This transfo~nPation is applied to every call Ln Now transform any procedure call
QF
defining
F
Q ;
let the result be
by sLmilar methods.
Q' .
Replace any
7-55
CALL G ( U l , . . . , u m)
PUSH(z I) % . . .
by
PUSH(zk)
~
DUMMY ÷ LF, r PUSH (DUHHY )
wl÷u I ~ T~SFER
where
Zl~... ,zk
w÷u
~
...
TO
are those ~%rmal parameters and local variables of
the actual parameters new variable, and
Ul,...~um
Wl,... , w
of the call,
LF, r
QF
is a new label and
not among DUMMY
a
are the formal parmneters of the proeedtA~e defining
G . Also append the labeled statement:
LF, ~
Ul
Wl
÷
~" "'"
~
z k ÷ POP ; . . . TRANSFER TO
Finally,
assume the last
and r e p l a c e
it
END
÷ wn
Un
~
z 1 ÷ POP
statement
is
F
by
DUHHY÷ POP GOTO Db%~Y
f o p a new v a r i a b l e
DL}iKf .
The new scheme i n
Call the result
PPDSL
is simply
Q'F
after all these traI~sformations.
Q' ~ QI' ~ "'' ~ Qp
T
m
Notice that the labels were used solely to tell us ~!here to go next. there was a k-placed predicate r~ent interpretation ables
T
and values
T(}-) is TRUE and
TRUEI~... ,TRUNk
and
q
in
T(~)
~
and
q
is false, and
FALSEI,... ,FALSEk
Suppose
such that u~nder the eur%- is stored in vari-
(i.e. ~ = (TI,... ~Tk)
and
7-56
vaI(TRUEi)
: mi
for
i < i < k
~nd similarly for
assign each label to a sequence a label
L
s I .... ,sn
sequence of
n
TRUEs, we would execute n
copies of
T
on top.
top of the store, one executes this
n
and
times; a sequence of
L
2
TRUEs ~nd
times and then
iterations of
k
Instead of placing
were assigned to, say, the
PUSH(TRUE I) ~ ... ~
PUSH(T[{L[Ak) L. 1
POPs into new variables~ tests by
n
n-2
L
n , we could
When the time came to f£nd
n
times,
from the T
and does
TRUEs will then be followed by TRANSFER TO
is now just an ordinary address.
sequence of n-2
k
For some
of TRUEs and FALSEs.
on top of the pushdown store: if
thus putting
q ).
SJatilarly, if
Ls
FALSEs we execute PUSH(FALSEI)
PUSH(TRUE I) ; ... ;
POPs and tests by
T
PUSH(TRUE k)
twice,
L
T were assigned to the { ... ;
PUSH(FfiLSEk)
in this case,
yields the sequence of values
T(~)
n ,
T(}-) ,
T(%-), ... ,
T(q) , which is now translated to TRANSFER TO L s Thus if we had such a test and values, we could simulate the recursion aug-
mented scheme by a one pushdown store scheme without labels. such a test and values.
The tY~ick is to locate
This is done using a concept introduced by Constable and
Gries, the looator scheme.
DEFINITION
Let
P
be a program scheme possibly augmented by extra mechanisms.
Let the predicates of A scheme and
P'
P
be
TI~°.°,T n ,
is a locator for
FALSEi, j
for
P
i < i < n ,
each
Ti
a ki-placed predicate letter.
if it has special reserved variables i < j <_k i
and special addresses
TRUEi, j
~l''"'~n
which are addresses of NULL statements with no next statement, such that for any interpretation (i) (2)
I
and input
a ~
either
both
(P' ,l,a)
and
(P~I,a)
diverge~ or
both
(P' ~I~a)
and
(P,I,a) enter STOP statements with the same values of the
output variables, or (3)
for some
i ,
Tj ~ and
vaI(FALSEi, j) : vj ,
and
I < i < n ,
(P',I,a)
enters address
i <_ j <_k i , and
~. with vaI(TRL~..) l l~] I(Ti)(T I .... ,Sk.) = TRUE A
=
I(Ti)(Vl,...,Vk. ) = FALSE . l
Our previous argument essentially says that if a reeursion augmented scheme S
has a locator
S'
in the class of pT,ogram schemes (or. indeed in
we eam~ simulate it by a pushdown store without labels. locator
S' .
If
S'
PPDS ) then
For we start out in the
either loops or halts, we are in good shape since
S
is
guaranteed to do the same tlnLng. of
S
If S t enters ~. , then we restart a simulation m now using a pushdown store without labels and encoding the labels by sequences
of TRUEs and FALSEs; we use T.(F) i
and
T.(~) i
~ = (T l,...,Tk.)
as discussed before,
i
and
5- = ( V l " " ' V k . ) l
and tests
7-57
LEMYA 7.20
If a recursion augmented scheme has a locator in
then it is strongly equivalent to a member of
P
(or
PPDS )'
PPDS "
We claim that a recursion augmented scheme does indeed have a locator in
P .
Recall that we observed that when a scheme executes a reoursive call, then it must use some test statement twice with opposite results before completing that call or. else it is in a loop (cf Corollary 7.16).
If every call is recursive, we need not
wnrry about saving variable values because the call will never be completed before locatLng the required test and values.
~is
is the basis for the const~_etion in
the next lemma.
LEMMA 7.21
Every recursion augmented scheme has a looator in
P .
PROOF Let the reeursion augmented scheme be
S = (Q,QI,...,Q p) . Assume as before
that each piece is in linear form, with addresses in and addresses in the procedure defining
F
by
Q
represented by
.
Without loss of generality we can assume that all predicates are monadic~ the consCruction in the general case is similar but is burdened by more subscripts. For each test
T
let
TRUE(T)
address for the locator
S' .
and
FALSE(T)
Let
E ~
be new variables and
sT
a new
be a new va_~iable whose value is always
A , undefined. First assume that we have already applied a complete f~rst level macroexpansion to
Q
and all the calls are now recursive.
before we go to some Now put together
~T Q
(Corollary 7.16). and the bodies of all the procedures and apply the follow-
ing transformation to everything.
(where
N
can be
T(v)
Q
T(v)
This means that no call can be completed
or any
Replace every test
,
F
and
v
is some variable) by
,
T(TRb~(T))
:
F~J~SE(T) ÷ TRUE(T) TRUE(T) + v TRANSFER TO
sT
7~58
T(FALSE(T))
,
TRUE(T) ÷ F~LSE(T)
F~LSE(T) + v TRAlqSFER TO
where
,
ses.
and
A
are all assumed to be new addresT(v)
with either
T(TRUE(T))
or
and continues the simulation if they are the same but transfers to
if they are different.
tain has
,
This piece of code compares the value of
T(FALSE(T) ) ~T
,
~T
(undefined).
Notice that initially
Suppose
I(T)(val(v)) = TRUE
I(T)(A) = TRUE .
and we do not exit at has
and FALSE(T)
s T , then we know that
TRUE
and if a later execution of
have
I(T)(val(FALSE(T))) : I(T)(val(TRUE(T))) : I(T)(A) = TRUE
our opposite values.
TRUE(T)
both con-
If the first execution of
I(T)(A) =
I(T)(val(v)) : FALSE , we shall and so have located
If one objects to this use of the tricky convention on
a more complicated construction will work~ in which tlne first execution of puts the value of
v
in both
TRUE(T)
and
F~/2E(T)
regardless of outcome of
the test, while the second and all subsequent executions of any test the outcome if positive with
A , T(v)
T(TRUE(T) ), and if negative with
T(u)
T(FALSE(T))
compares .
Any call
CALL
F(Ul,...,u n)
is replaced by
DU}{~Y: ÷ u n n
Dt~#f I + u I ; ... x I + D~i~% I ; °.° Yl ÷ EM2TY ; ... ; TR~{SFER TO
Ym + EMPTf
where the formal parameters of the procedure defining local variables are
YI'" " " 'Ym '
and
DUMMYI,.. • ,DU]KMYn
we know that the call can never be completed we will loop forever
-
F
-
are
Xl,... ,xn , the
are new variables
either we will reach some
.
Since
sT
there is no need to save the values of any of the currently
active variables. When this transformation is complete, the result is the desired loeator for S.
m
or
7-59
So putting these lemmas together we have our first result, a formal way of saying that recursion can be implemented using just one stack.
THEOREM 7.22
The class of recursion augmented program schemes is effectively
translatable into the class of program schemes augmented by one pushdown store.
The tra_nslation of pushdown store schemes to recursion augmented schemes proceeds along sg~ilar iLnes.
First we translate into a scheme with rec~orsiona:nd
labels and then we argue that locators exist and so t?~ labels are not really needed.
LEF~A 7.23
PPDS ± PRL
PROOF Let
S
be a program scheme augmented by one pushdown store, and let the simple
variables of
S
be
Xl~...,x n .
Create new vaz~,iables LABEL for each address
r
in
S
and plus
Let
F
TOP
and labels (which are also addresses)
be an n+2-placed defined function letter.
and
<END> .
The main scheme is s£mply:
I.
IABEL +
2.
CALff~ F(x I .....Xn,L~BEL,TOP)
3.
STOP
There is only one procedure, which has formal parameters and
TOP .
Xl,...,x n ,
LABEL
The first statement in the procedure body is:
.
GOT0
LABEL
while the last statement is of course:
<E~©>
If statement T(v)
s,k
r
then
END
F
is an assignment, then
is
T(v)
,
is the same as
r ;
if
r
is
.
The basic idea of the construction is that the stacking of entries in the list is simulated by s taekJslg of calls, and unstacking (popping) of entries by unstacking (completing)
the ealls.
7-60
So an instruction
r.
PUSH(u)
becomes
LABEL ÷
CALL
F(Xl,...,Xn~L%BEL,u)
while
r.
u÷
POP
becomes
u+TOP
LABEL + TRANSFER TO
<END>
Finally the instruction
r.
STOP
becomes
LABEL ÷ <E}©> IRANSFER TO
The labels stored in
<El©>
LABEL
are used simply to p i n t to the next statement
to be executed while calls are stacked or unstacked.
Since
LABEL
is always used
as an actual parameter, fts value is carried along when a new call is instituted or an old call is completed. parameter.
When
PUSH(u)
On the other b~nd~
TOP
is never used as ~n actual
is simulated, a new call is begun with
u
as the new
value of the formal parameter and the old value is "left behind" in the previous procedure but is not destroyed. value of
TOP
goes into
with the previous value of label becomes is reentered at
<END> 3.
TOP
per~ently STOP
%~en
v + POP
is fLnmlly si~Jlated~ this new
v ~ the call is ended arid the old procedure is reentered still there.
In
simulating
STOP , the value of
and the calls are unpeeled until the main s c h ~ e
a~nd everything halts.
•
7-61
To complete the translation of pushdown store schemes into recursion schemes we must show how to construct a locator. down store augmented scheme pretation
I
S
with
for which each test
or always negative
n
The key observation is that if a pushinstructions is computing under an inter-
I(T)
is a constant
-
either always positive
then at any point at most the top
n
entries on the push-
down store are avaiable~ the computation will never see any entries further down in the store.
Hence the locator need know only the top
n
entries and can forget
the others. So a locator in
P
for
S
will have
whether the pushdown store is empty.
n+l
Execution of a
causes transfer from copy
i
copy (of
S ) for copy
while simulation of a
i-i
I < i < n
for
starts in copy variables PUSH(u)
to copy
i+l ,
for
PUSH
@ .
Since only the top
n
S , to keep track of instruction simulation
0 < i < n-i POP
but no change in
causes transfer from
but no such simulation occurs in copy
Wl,...,~n
0 .
entries need be recorded,
can replace pushdown store variable
i
to
The computation n
new
w . An instruction
can be simulated by:
~i ÷ u ~ and
n
copies of
u ÷ POP
~2 + ~i ~
"'" ;
~n + ~n-i
by
u + ~i ;
Wl + ~2 ~ "'" ;
Wn-i + Zn
A test instruction is handled as before.
LEMMA 7.24
For each scheme in
THEOREM 7.25
PPDS
Thus we can show:
a locator can be found in
P .
The class of program schemes augmented by one pushdowm store is
effectively translatable into the class of reeursion augmented program schemes.
THEOREM 7.26
R - PR =- PPDS
It should be fairly clear that a pushdown store cam be regarded as a particular kind of array.
Basically we only need keep track of the location of the top of the
pushdown store. priate subscript.
This is done by using a new variable, say An instruction
A(TOP) ÷ u ~
while an instruction
PUSH(u)
TOP ÷ TOP + i
u ÷ POP
TOP, to store the appro-
is simulated by two instructions:
is simulated by:
7-62
u ÷A(TOP)
;
TOP ÷ TOP ~ i
(we have already mentioned that the operation "~" is permissible and can be eliminated by a more complicated construction in which the subscript
in a new array as
LEMMA 7.27
B(TOP) .)
PPDS ~ P A
;
Initially
TOP
is set at
i .
TOP ± i
is stored
Thus:
in fact the class of program schemes augmented by any
number of pushdown stores is effectively translatable into
PA "
Now we can show that arrays are more powerful than recursion, or indeed than any number of pushdown stores.
We do so by considering a functional very popular
in "schematology" called leaftest.
DEFINITION
Let
X
and
dic predicate letter. I
p
be monadic basis function letters and let
The functional
leaftest(X~p,T)(x)
T
be a mona-
under any interpretation
is defined by
leaftest(l,p,T)
x
if
I(T)(A) = TRUE
x
if there are
n !l
or ,
l(T)(x) = TRUE fl,...,fn
~
{X,O}
such
= that
l(T(fn...fl(x))) = TRUE
undefined otherwise
LEMMA 7.28
Leaftest can be implemented by an array augmented program scheme.
PROOF Leaftest is strongly equivalent to the following scheme, with array variable A
and subscript variables
J
and
K .
The idea is to test
of the array and then, if the result is negative, put
A(A(J))
A(J)
, the "bottom"
and
o(A(J))
on
the "top". i.
IF
NOT
T(u)
IHEN
2.
J+l
~
3.
WHILE NOT
K+I T(u)
; A(J) + x ; u + A(J) DO
K + K + 1 ; A(K) ÷ l(u) ;
K ÷ K + 1 ;
A(K) ÷ p(u) ; J + J + 1 ; u + A(J) ~ I ~ ENDIF 4.
z÷x
;
STOP
•
7-63
Intuitively, the functional
leaftest(Ap,T)
tree for some node (including the root finds one it halts with answer, x
searches the following infinite
x ) which t:ests under
T
to be TRUE; if it
and otherwise searches forever.
X
~ ~ ~ 0 ( x )
~.,A~
pAA(x)
~pA(x) ppA(x)
AAp(x)
This is an infinite full binary tree.
pXp(x) App(x) ppp(x)
Roughly speakLng~ a single pushdown store
cannot search such a potentially infinite tree.
}~aen we did so in Chapter VI, we
added a counter whose length could be compared with the length of the store.
In
fact we cannot search such a tree with any number of pushdown stores unless they can find their "bottoms"
-
unless one can find out if the store is empty.
pushdown stores in this chapter do not have this ability. be done with any number of pushdown stores. if a special test "Is pushdown store
i
The
Hence leaftest cannot
However~ two pushdown stores suffice
empty?" is allowed, since in that case we
can use two stores to simulate the action of the array in the array augmented scheme for leaftest. We now provide a little more detail for the claim that leaftest cannot be implemented by a program scheme with any number of pushdown stores.
LEHHA 7.29
Leaftest cannot be implemented by a program scheme augmented by any
number of pushdown stores.
PROOF The proof consists in showing that if
leaftest(k,0,T)
could be done by just
adding pusb~do}~, stores of the type described in this section, then it could be done by an ordinary program scheme without augmentations, but that is impossible. We have argued tlnat locators exist for sohe~.~es with one pushdo~,~ store. same discussion applies to schem~s with ~ny n ~ e r scheme
S
pretation
has I
n
pushdown stores and
m
for which each predicate
of p u s h d o ~ stores.
£ns~uctions and operates under an inter-
I(T)
is single valued, then the scheme
either halts before completing more than
m
stores cannot have more than
apiece~ or else after
a loop of length
m
entries
m 2 : m I + m 2 <_m .
The
If such a
instructions, and so the pushdov~ mI
steps it enters
Fbr eaoh store this loop either does not
7-64
change in size or grows by at most the top
m2/2
entries are read.
m2
new entries and in either case no more than
Thus the same result holds
tion the scheme need remember at most the top
m
~il:... ,~iLm ;
the locator needs
in such a situa-
entries on the store.
locator can be built which substitutes for each p u s h d o ~ varie}sles
-
(re+l)n
store
Hence a
"~i ~ m
copies of
S
ordinary
to keep track of
when the stores are empty. So if leaftest is implemented by a scheme is a locator
S'
for
interpretation
I ,
has no answer.
If
S if
S'
If
found values
b
and
S
with
n
pushdo~
loops forever, so does
(S,l,x)
(S' ,I,x)
enters the special address
for which
by placing into address
strongly equivalent to
S
Under any and leaftest
halts, it halts with the "right '~ answer for
l(T)(a) = TRUE
and
~
e
the instruction
and
S"
(S:l,x)
then it has
l(T)(b) = FALSE .
it ever finds a '~'I~RUE",then it has found a solution for leaftest! S"
stores, there
is an unaugmented program schmne.
(S',l,x)
(S' ,l,x)
and so for leaftest. a
and
z ÷ x ~
STOP
But if
So if we form
we have a scheme
is an unaugmented program scheme.
Thus if we can implement !eaftest by a pushdown store augmented scheme, we can Lmplement leaftest with a program scheme
S"
other augmentations.
uses only basis functions
0
and predicate
STOP ,
T(u) ,
T
We cam_ assume tlnat
S"
and that each statement of
u ÷ x ,
without pushdow~ stores or any
S"
is of the forms:
u ÷ ~(v) ~ u ÷ p(v) , and
u ÷ v
~ere
input variable and is not a program or output variable, ~id
u
variables (we may have either
have
ables and
m
u = v
or
u ~ v ).
We consider two types of free interpretations.
TRUE elsewhere~ for y ~ w
and
t
and
for
0 < lwl <_ t
w(x)
i
It
w
the test
certainly cannot ~ ! t (S",It)
n
are p r o ~ a m program vari-
lwl = t ,
let
For any
and let
t
let
It(T)
It(T)(A) =
be uniformly
It,w(T)(A) = It,w(T)(y(x)) = FALSE
S"
during
It .
By our hypothesis on
S '~
steps of computation ever9~ variable must take on values of the form
with length
under
is the only v
It,w(T)(w(x)) = TRUE .
First consider the behavior of during
S"
and
statements.
It(T)(x) = l(T)(w(x)) = FALSE
for
Let
x
~nd
1
STA~RT ,
bounded by It(T)
will beb~ve as if
enters a cycle after at most
i .
Thus during the first
will always return the answer
computation steps and, since
S"
_TRUE ar~swer has been returned, the program
It(T) m
t
FALSE
were single-valued.
For
t > m+l ~ the program
steps and the cycle length is
of values can be assumed by a variable during such a cycle?
r <_m .
~t
Suppose variable
sort u
has value
u 0 on entering address q and on returnir~g to q after r steps i i has value u Either u = y(x) because u has been reset d~r~ng the cycle or i y(u 0) i y(v 0) u = or u -for 0 <_ IYl <-r and a variable v ~ u . In the first ~ase, as long as the cycle lasts stant,
y(x) ,
u
takes values from some f~nite set and is a con-
at the end of the cycle.
cycle with a value ~n
y*(u 0) .
In the second case,
u
In the third case, the values of
keeps ending the u
depend on the
7-6,5
behavior of
v
during the cycle; for
times and since there are
n
out and we have cyclic behavior. A
of values and a fixed set
some t
k
such that program
t > nm+l
the cycle will repeat at least
Thus for
B
t > nm+l
of the form
(S",I t)
there are a fixed finite set
B = Yl Zl(X)
U
... U Yk Zk(X)
Yi"yiSzi (x) ' Yi = Yi'Yi '' with
strings of members of
B
for
enters and remains in a cycle for its first
steps during which the variables take values which are either in
the form
n
variables fluctuations due to this tb/rd case smooth
lyi"yiSzi I <_t ,
bounded in length by
A
or are of
i.e. terminal sub-
t .
We can conclude thus that during the first
t
steps of
(S",I t )
the number
of possible values taken on by the various variables grows at most as some polynomial in
t .
But the number of possible values of
must be tested grows exponentially in w
in
{l,p}
with
takes on value behavior of
lwl = t
w(x)
S"
It,w
w(x)
lwl = t
t . Hence for some imoge
for this
never gets a chance to test ing
for
t
which
there is a
such that during this fixed cycle no variable ever
under any interpretation
under
w(x)
w(x)
It,
Finally, if we consider the
w , we see that the resulting program
and since it can leave the cycle only by test-
it is stuck in this cycle and so diverges, although leaftest is defined
for this interpretation
It, w
and input
x . Hence no program scheme and thus no
pushdown store scheme can implement leaftest.
THEOREM 7.30
[]
R - PR - PPDS < PA ~ the class of program schemes augmented by
arrays is not translatable into the class of program schemes augmented by any number of pushdown stores.
There are a few other things one can mention.
First, our argument applies only
to pushdown stores defined so as not to know their "bottoms".
We leave it as an
exercise to the reader to construct a program scheme for leaftest using two pushdown stores plus instructions "IF be shown that
n
construct a locator for the down stores.
EMPTY(~ i)
THEN ... ELSE ...". Next, it can
pushdown stores can be simulated by two. n
The general idea is to
pushdown store machine; the locator uses no push-
Then the TRUE and FALSE values can be used to mark the bottom of a
store, and separate the
n
pushdown stores all stacked up on one store (alternating
the "real" entries with the marked TRUE and FALSE values with, say, TRUE marking the bottom of a store and FALSE for intermediate entries).
Each store is then
accessed by transferring all the entries above it to the second store, suitably interleaved with the marked values, and then transferring back. down store does not suffice; two are more powerful than one. to show this is a variant of leaftest.
However, one push-
The functional used
7-66
DEFINITION
The functional
Eleaftest(X,p,T)
is defined by:
leaftest(X,p,T)(x)
if
l(T)(y) : TRUE
and
Eleaftest(X,0,T)(x,y,z) = x
l(T)(z) = FALSE
otherwise
We leave it to the reader as an exercise to implement Eleaftest using two pushdown stores (with no test for emptiness this time). y
and
z
The p i n t is that now
can be used to mark the bottom of the %~o p u s h d o ~ stores ~nd the
"real" entries corresponding to interleaved with the "markers"
A(J) y
or
and
A(K)
in the proof of Lemma 7.28 are
z .
It can be s h o ~ that if Eleaftest were implementable in leaftest be also.
COROLLAiRY 7.31
Hence Eleaftest is not implementable in
PPDS ~ then so would PPDS "
The class of program schemes augmented by t ~
pushdo~m stores is
not translatable into the class of program schemes augmented by one pushdown store.
Using simple simulation techniques it can be shown that the class of program schemes augmented by pushdown stores and labels is effectively intertranslatable with the class true that PA
PA
PAL and
of program, schemes augmented by arrays and labels. PAL
are intertrans!atable, but the translation from
It is also PAL
to
is not effective! Consider schemes without any tests.
A scheme in
PA
without any tests is
either always halting or never halting and a simple examination of the graph will show which one.
However, it is undecidable whether a scheme in
tests is always halting!
PAL
without any
The proof consists in simulating with such a scheme the
behavior of a Turing machine on an initial tape consisting of all there were an effective t~anslation from
PAL
be decidable.
to
The translation from
PAL
to PA
0 's . So if
PA ' then t9£s question would is nonconstructive and depends
on Imving an oracle tell you about the behavior, of certain test-free schemes. Details can be found in the reference by Constable and ©ties.
F.
VERIFICATION OF PROGRAMS WITH RECURSION We conclude this chapter, by discussing briefly the verification of programs
with procedures and calls.
We use the model of a recursion augmented program
schemle in order to do so conveniently. At first glance it might seem as if our verification conditions would have to keep track of the contents of a pushdown store implementation of recursion.
For
7-67
the final output will depend of course not just on the final output of the call being executed, bat where it creme from and what is the stack of calls and "saved" variables waiting to be completed.
However, this is not really necessary.
First we discuss a version of the verification procedure which provides a sufficient condition for partial correctness
-
if the procedure gives a positive
answer, then the program is indeed partially correct for the given input and output criteria.
However, the condition is not necessary
-
the program can be partially
correct yet no choice of inductive assertions will make the procedure "work".
This
leads us to the complete proced~moe, which is rather more complex and lengthy. Suppose our program
(P,I)
comes from an underlying scheme
P
with procedures
and calls as defined in Section
A
be
B . We first define critieal points and inductive
A
and the output criterion
assertions as before.
of this chapter, and let the input criterion
~ e n we add to the list of critical points every point
directly before and directly after a call.
Some care needs to be exercised in
assigning inductive assertions to these calling points. To each procedure
F
we assign two inductive assertions
FA
are ~ritten solely in terms of the formal par&meters of procedure the only free variables in Now consider, a call in
k.
CALL
~
and
FB
and
FB
which
F ~ that is,
are the formal parameters of
F .
(P,I):
F(ul,...,un)
We have carefully required that symbols
Ul,... ,un
be variables and that they be
all distLnct and f~orther be all distinct from the formal parameters of procedure F , say Xl,...,x n . At this point, these requirements become crucial. critical points of interest can be called and just after the call of
kA
and
F . To critical point
The two
k B , the points just before kA
assign the inductive asser-
tion
FAx which is the result of substituting u i for x i everywhere in FA and to u critical point k B assign F Bx , the result of substituting u i for x i in F B . u We must consider the procedures to be subroutines or subprograms in the program. So we take each procedure body QF
QF
we attach inductive assertion
assertion
and play the same game. ~
To the entry point of
and to the exit point we attach inductive
F B . We choose the other critical points to cut all cycles and to include
all points directly befo-~e or directly after calls.
We assign inductive assertions
to critical points freely, except that for a call
k.
CALL
@(v)
if the formal parameters of
G
are
j , we assign to
kA , the point just before
7-68
this call of
C~ ~J
G , the Lnductive assertion
and to
k B ~ the point just after
V
this call has been completed, the assertion
G By V
After all this has been done~ we apply the usual verification procedure to the main program and to each procedure body
-
constructing verification conditions
and sending them to a TP•OREM PROVER just as before.
We claLm that if all the veri-
fication conditions hold for the main progrmn and all procedures, then the whole progrmm is partially correct for
A
Why can we make this claim?
and
B .
The idea is simple but subtle.
does not terminate for a particular iaput, say outcome.
If it does terminate for input
more than make
k
k
a , there must be some
calls are executed during the entire computation
complete first level macro expansions of
(P' ,I) .
Each time a call of
F
If the program
a , we are uninterested in the
(P~I)
k
such that no
(P,l,a) . Now
and call the result
is ~mcroexpanded, put into the diagram all the
critical points ~nd inductive assertions with the appropriate substitutions of actual parameters for formal parameters.
Because of the way in which we have cho-
sen inductive assertions before and after calls~ the points before and after' the macroexpansion of
F
will have attached the same inductive assertions as before.
Finally, when we are all done~ replace any remaining calls by a LOOP instruction. As far as input (P' ,I)
difference between ments.
a
are identical
is concerned~ the old program -
(P~I)
and the new program
they must both converge with the same answer.
(P,I)
and
(P' ,I)
The only
in execution is the inserted LOOP state-
If they are never reached, the programs are strongly equivalent.
that for input
a
We know
they can never be reached because for this input, the program does
not nest calls more than
k
deep.
All the verification conditions of
among the verification conditions of
(P,I) ,
(P' ,I)
appear
since all the paths appeared either,
in the main program or the procedure bodies~ and we do not construct verification conditions over a LOOP statement (or if we do, we construct the condition that is uniformly TRUE). certaLnly hold for
Hence, since the verification conditions hold for (P' ~I) .
But
(P' ,I)
has no procedures or, calls and hence by
our previous arguments, we can conclude that respect to B
A
and
B .
2~nus (P~I)
for the particular input
a[ .
(P,I) ~ they
(P' ,I)
is partially correct with
is partially correct with respect to
But this holds for all inputs.
So
A
(P,I)
and is
partially correct for the given criteria as claimed. Unfortunately this procedure will not work even in some very simple cases where partial correctness is transparent.
Consider the very trivial program:
7-89
IF
THEN CALL
xI = x 2
ELSE
IF
F(x2,z) xI > x 2
'FH~
u ÷ x2+l CALL
ELSE
F(u:z)
u ÷ xI CALL
F(u,z)
~©IF ENDIF STOP PROCEDDIKE
F(u~v)
2
v ÷u END
F
This program is obviously partially correct with respect to
xI
and
and
x2
A(Xl,X2):
are integers
B(Xl,X2~Z):
If
x I = x 2 ~ then
2 z = x2
if
x I < x 2 ~ then
2 z = xI
if
x I > x 2 , then
z = (x2+i)2
It should be clear that the procedure as just described cannot handle this program.
For the inductive assertion
each CALL u ,
F(x2,z)
or
F(u,z)
FB
attached to tlne critical poJ~at after
will have as free variables only
the actual parsmeters, but the output criterion
its value depe.nds on the relationship of between
z
and
x2 .
xI
and
B
x2
involves
z
and
xI
x2
and
or
x2
and
as well as the relationship
We have so far provided no way to carry over a CALL assertions
regarding variables not involved in the CALL. An obvious first stab at a solution p~es~nts itself.
Let the critical points
around CALLS have extra assertions for the variables not involved in the CALL. the CALL at address the point where
~'
kA
k
in the main program is a call of procedure
F , attach to
just before the CALL any indurative assertion of the form
is the appropriate version of
~
and
C
If
C ^ ~'
is any assertion involving
as free variables only the global variables which do not appear in the actual parameters of the CALL. where
F B'
Then attach to
kB
directly following the CALL,
is the corresponding version of
FB .
C ^ F B'
Similarly, if the CALL of
F
at
7-70
address C
cedure F
k
occurs within the procedure body of procedure
G , the extra assertion
will have as free variables those formal parameters and local variables of proG
which are not involved in the call of
remains just
F . However, the input assertion
F & , while the output assertion is
FB .
Since variables that
are not act@al parameters do not change during the execution of the C ~ L , there is no problem ~n attaching tion at
C
C
to
in verifying procedure
kB .
kA F ;
and if
kB C
and no need to use inductive asser-
is t~ue at
kA
it most also be true
So we can confidently state that if this amended procedure comes up with
a positive result, this program is partially correct for the given input and output criteria. Even this patcln is not qu~te enough. C
on
xI
or on
xI
and
x2
Our simple example shows t]nat a condition
but not on
u ,
is not enough.
All the active
variables must be tied together for the verification procedure to return a positive answer.
But the actual parameters may change in value during a CALL, so we would
have to put the added assertions into the verification process for the proeedu_re called.
~nis can multiply itself Lndefinitely and so is obviously unsatisfactory.
There are several ways of cleaning this up.
We now present just one.
We
notice that part of the problem is that procedures are really kinds of programs which we verify separately.
In our main verification procedure, we demanded that
the input variables be unchanged during the whole program, in order to be able to mare clean statements about the re!ationsbip between the fir.al values of o~f%nput variables with the initial values of input variables. that we have not done this for procedures. Let variable QF
u
Let us see how we can do it!
appearing in the body
Q
of the main program or in the body
of a procedure be deemed to be "changed" during
in the left ~ n d
"unchanged".
Q
or
QF
if it appears either
side of ~n assignment statement or in a CALL of
corresponding formal parameter
"unchanged"
One of our difficulties is
v
of
G
is cI~%nged during
G
QG "
such that the Otherwise it is
It should be evident that it is decidable whether or not
u
is
flag all variables appearing on the left hand side of an assignment
statement~ if a formal parameter
v
is flagged in
in the corresponding place of any call of
QF ' flag any variable appearing
F ; continue ~ntil all variables are
flagged or no new ones can be flagged; the flagged ores are "changed".
The point
of this definition is that a changed variable may or may not be changed during a particular execution sequence~ but an unchanged variable cannot possibly be changed in any computation. We give a technical m e a n S ~ to the formal term " d ' ~ " . appearing ir~ a call
k.
CALL F ( . . . , u , . . , )
If
u
is a variable
7-71
in the ma~Ln program, then
u
is a du~.~my at
variable and the only statements involving the main program and are of the form
k
if
u
v + u
u
is not an Lnput or
other than for
k
v ~ u ~
output
an.
appear after
in particular,
k u
in cannot
appear on the left hand side of an assignment statement, in a test, or in any other call.
If
u
is a variable appearing in a call
Gk.
in the body u
QG
u
F(...,u~...)
of a procedure
is a dummy at
involving for
CALL
Gk
if
u
other than
v ~ u ~
Gk
in particular,
G
(which may or may not be equal to
is a local variable in appear after u
Gk
in
G
F ), then
and the only statements
QG
and are of the form
v ÷ u
cannot appear on the left hand side of an assign-
ment statement, in a test, or in any other call. Now we place on our programs two additional restrictions on the use of variables in CALLs.
They are:
i)
No Luput variable is cP~uged.
2)
The formal parameters of any procedure where the
x. l
are unchanged in
F
F
can be described as
and any call of
F
where the
vj
are dummies at
i)
can easily be met by tPansferring
t~le contents of any input variable Lnto a copy vaYdable. with formal parameters
k.
CALL
Ul',... ,un'
k.
CALL
k1"
Yi
If we have a proced~mre
Xl,...,x n , we add new formal parameters
with the assignments
the procedure have
we let
can be described as
k .
We have already observed that condition
QF
'Ym
Hul,...~Un,Vl,...,' %)
k.
start
Xl""'Xn~Yl~""
Yl + xi ; "'" ~
substituted for
xi
Yn + Xn
every~here.
yl,...,y n
F
and
and then let the rest of For a call of
F
F(u I .... ,un)
be
n
new variables not appearing anywhere else and substitute:
F(u l,...:u n,u l',...,u n')
Ul ÷ Ult ~ . "'" ~ Un ÷ U 11T
This is all right since the
xi
ape now unchanged in
F
and the
u.l' are all new
and are never again used. Once we ape assured tl~t the CAALs obey cedure
F
parameters
with unchanged formal parameters ~ = ( Y I ' " " 'Ym )
2)
we are in bus~ness.
x = (xI ~... ,xn)
we let input criterion
~
Now for pro-
and other fo~r~l
involve all the unchanged
7-72
formal parameters, meters of
F , x
criterion
~
x , but output criterion and
y .
and output criterion
FB .
with the
may involve all the formal paraF
we use input
Suppose we have a call of
in the main program, in the procedure body of any other call of
FB
To verify the procedure body for
QF
of
F
F
(whether
or in the procedure body
QG
F) , say
k.
CALL
F(Ul,...Un,Vl~...,Vm)
ui
corresponding
to the uneheanged formal parameters
mies v i corresponding to the
Yi'S .
(xi) and the dum-
We attach to critical point
kA
an induc-
tive assertion of the form
ck^ u
and to
kB
the corresponding assertion
C k ^ F Bx'y u~v where
Ck
may involve as free variables the
variables which are not d u ~ e s
ui
as well as asly other active
(any global variables if this is the main program
or formal parameters and local variables if this is a procedure body). additional assertions
Ck
Since the
involve only variables unchanged in the procedure, we
are free to carry such assertions over a procedure without further checking. Now we have a method that is both necessary and sufficient to demonstrate partial correctness.
We have already seen that if these verification conditions
all hold, then the program is indeed partially correct for the given criteria. arguments used in Chapter
V
The
can be adapted to show that if partial correctness
holds, then some choice of inductive assertions will make the verification conditions true.
LX~LE First examine
Exas~le VII - 6.
This is one possible version of Example Vll - 4
altered to meet the conditions of our verification procedure.
Of course, one need
not in. general in_-.mnsform the program itself; one can in practice apply the verification, tee]~nique "as if" the tra~usformation had already been made, provided e ~ e ~ care is taken with the identity of the various ~ariables and parameters. The critical points in Example VII - 6 are the initial and final points, 8 ~
in the main program and the initial and f i n ~ points
FI
and
F4
FACT , as well as the points just before CALLS in the main program, and
6.1- ,
F3.1-
in the procedure, and the points after calls,
i
and
in procedure 3.1- ~
5.1+ ,
4.1-,
4.1+ ,
7-73
6.1+
and
F3.1+ .
The example shows the input and output criteria for the main
vrogr_am and for the procedure.
Additional inductive assertions are attached to
each of the calling points, as indicated by assertions
C3 ,
C4 ,
C6
and
CF .
There are i0 paths to cheek in the main program (2 are inconsistent and so cause no problems) and 3 in the procedure.
7-74
EXAMPLE
VII - 6
EXAMPLE VII - 4 EDITED FOR VERIFICATION
Main Program
indicates
Input variables t i.
Xl ÷ n
~
2.
zI ÷ i ;
3.
IF
n,k
x2 + k z2 + i
xI > i
THEN
3.1
CALL
3.2
zI ÷ wI
FACT(Xl~Zl,Vl~Wl)
ENDIF 4.
IF
x2 > i
THI~$
4.1
CALL
4.2
z2 ÷ w 2
FACT(x2,z2,v2,w2)
L~XrDIF 5.
NEW ÷ x I - x 2
6.
IF
NEW > i
THEN
6.1
CALL
6.2
z2 ÷ w 3 I~NDIF
7. % 8.
z I + Zl/Z 2 STOP
PROCEDURE
FACT(NEW,z2,v3,w 3 )
critical
po~ts
7-75
EXAMPLE VII - 6 -- CONTINUED
Procedure Program
FACT(u~y'uI'Yl )
PROCEDURE
DECL&RE I'~'W (TEHP I ~T~'IP2) t
FI.
yl + u . y
F2.
uI ÷ u - i
F3.
IF
uI > i
F3.1
CALL
F3.2
Yl ÷ TEHP2 ENDIF
t
THEN
F4.
END FACT
FACT(u I 'YI"FEMPI ~TEMP2 )
7-7G
EXAMPLE
VII - 6
CONTINUED
Input criterion
A(n,k)
Output criterion
Extra
VERIFICATION
:
n,k
B ( n , k , z I)
inductive
:
integers, A(n~k)
,
OF EZAMPLE
VII - 4
i ~ k ~ n z I : (<)
assertions
For 3.1
C 3 ( n , k , X l , X 2 , Z l , Z 2)
:
A(n,k)
,
xI = n
,
x2 : k
,
zI = z2 : i
For 4 . 1
C4(n,k,Xl,X2,Zl,Z2)
:
A(n~k)
,
xI = n
~
x2 : k
,
z I = n!
F o r 6.1
C6(n,k,Xl,X2,Zl,Z2,NEW) z I = n[
For p r o c e d u r e
,
i)
2)
3)
x2 = k
,
N]£~ : n - k
,
u,y integers,
FB(U,y,ul,Yl ) :
:
y A I
~(u,y)
~(u,y)
~
:
,
u > i
uI : u - i
uI : u - i
,
Yl
-
,
Yl=U!
. y
u.y
,
2 ,
3 ,
3.1-
(n > i) n ~ ( n , l ) i ,
2 ,
3 ,
A 4 ,
(n = n) A
(k = k) A
(i = I = i)
4.1-
s L u c e t h i s p a t h is i m p o s s i b l e i ~
2 ,
3 ,
4 ~
5 ~
6 :
6.1-
6 ,
7
s i n c e t h i s p a t h is i m p s s i b l e
For p a t h A(n~k) A
5)
i
For path TRUE
4)
A
,
conditions :
For path TRD~
:
C F ( U , y , u l , Y I)
For path A(n,k)
x I -- n
z 2 = k!
~(u,y)
Output criterion
Verification
~
z2 = i
FACT:
Input criterion
For F3.1
A(n,k)
:
~
i ,
2 ,
(n <_ i) A
For path
3.1+
[ ~ ( X l , Z I) ^
~
3 ,
4
(k < I) A 3.2
~
4 ~
(v I = X l - l ) A
(Z 1 : Z 2 = i) A
~
5 ,
,
8
(n-k <_ i) ~ [A(n~k) A
[i : (k)]]
4.1-
(W 1 = XI!
. Zl) A A ( n ~ k ) A
(X 2 > i)] ~ [ ~ ( X 2 , Z 2) A A ( n , k ) A
(X 1 : n) A
(X I = n) A
(X 2 : k) A
(X 2 : k) A
(Z 1
=
n!)
A (Z 2 = I)] 6)
FOP path
3.1+
[FA(Xl,Zl) A
3.2
,
4
(V I = X I - I ) A
(z I : z 2 : I) A (X 2 = k) A
,
(X 2 <_ i) A
(XI-X 2 = n-k) A
~
5 ,
6 ~
(W I = Xl! (X ! -
6.1-
. Z I) A A ( n , k ) A
X 2 > i)] n
(W I = n!) A
(x I = n) A
[~(Xl--X2,Z2)
(Z 2 = k I ) ]
(X 2 = k) A
A A(n,k) A
(x I = n) A
7-77
EXAMPLE
7)
VII - 6
For p a t h
3.1+
[FA(Xl~Zl)
8)
C0~I~rCED
,
3.2
,
4 ,
^ (v I = Xl-l)
5 ~
G ,
7 ,
A (W I = XI!
8
Zl) A A(n,k)
(z I = z 2 = i) ^ (x 2 <_I)
A (X I - X 2 <_ i)] n [A(n~k)
For p a t h
5 ,
4.1+
[l~A(x2,z2)
,
4.2
,
^ (v 2 = v2-1)
6 ,
^ (X I = n) ^ (x 2 = k) A ^ [Wl/Z 2 : (k)]]
6.1-
A (W 2 = X2!
. Z2) A A(n,k)
A (X 1 = n) A (X 2 = k) A
(Z 1 = n!) A (Z 2 = i) ^ (Xl--X 2 > i)] n [ F A ( X l - X 2 , W 2) A A(n,k)
9)
(x 2 = k) A (Xl-X2
= n-k) A (Z I = n!) A (W 2 = k!)
For p a t h
4.2
4.1+
[k_A(x2,z2) (z I = n!) A 10)
For p a t h
,
,
5 ~
A (V 2 = X2-1)
6 ,
7 ,
A (W 2 = X2!
(Z 2 = I) A (Xl-X 2 <__i)]~ 6.1+
,
6.2
~
7 ,
[FA(NEW,z2 ) ^ (v 8 = NEW-I) (NEW = n-k) ^ (z I = n!) ^
A (X 1 = n) ^
8
. Z2) ^ A(n,k) [A(n,k)
A (X I = n) ^ (x 2 = k) ^
^ [Zl/W 2 = (k)]]
8
A (W 3 = NEW!.z 2) A A(n,k) (z 2 = k!)] n [A(n,k)
A
(X I = n) A (X 2 = k) A
A [Zl/W 3 : (~)]]
7-78
EXamPLE
VII - 6
Verification
I)
2)
conditions
For path
FI ,
[~(u,y)
a (u-1
}br path
FI ,
[~(u,y) 3)
CONCLO~ED
for the Procedure
F2 ,
F3
~
F3.!-
> i)] ~ [ ~ ( u , y ) F2 ,
F3 ,
[FA(ul~Yl)
F3.1+
,
F3.2
,
A (u-i : U-l) A (u.y = u.y)
^ (u-i : u-i) ^ (u.y : u!
. y)]
F4
^ ( T ~ P 1 : Ul-l) A ( T E ~ 2 : Ul!
(Yl : u.y)] ~ [ ~ ( u , y )
A ~(U-I,u.y)]
F4
^ (u-l <_i)] = [ ~ ( u , y )
For path
FACT.
. yl ) a ~_(u,y)
A (u I : u-l) ^ (TEMP2 : u!.y)]
^ (u I - u-l) ^
8-1
VIII.
MONADIC RECURSION SCH~!~]S We now focus attention on the special case of monadic recurs£on schemes.
DEFINITION
A recursion scheme is momadio if all of its defined and basis function
letters and all of its predicate letters are monadic.
Our first result is that the classes of monadic recursion schemes and monadic program schemes are incomparable.
We use a somewhat different argument than before
to establish the existence of a monadic recursion scheme not trsmslatable into any monadic program scheme.
In the case of monadic schemes we save ourselves much
notational complication by omitting parentheses and writing f(g(x))
as
its p s i t i o n
A.
F(x)
as
Fx
fgx ~ we often take the additional liberty of omitting the
and x
since
is obvious.
A MONADIC RECURSION SCHEME WHICH IS NOT FLOWCP~ARTABLE
THEOREH 8 .I
S:
The monadic recursion scheme
Fx : IF
Tx
THEN
x
ELSE
gFFfx
is not translatable into any strongly equivalent monadic program scheme.
PROOF In this example we see that, freely speaking, a simulating program scheme would run out of time rather than space. For each iuteger defined as follows. of occurrences of
For
n >- i ~
consider a "counting" free
For an expression f
in
E
E
if
E = x
or
In(T)(E) -- TRUE
£f
E ~ x
and
we define an expression
r(E) r(E)
h
interpretation let
r(E)
the empl7 tape
,~-I n-l~ hn : n n _ i r g nn_ I
for
g
in
is not divisible by is divisible by
n -> 2
In
be the number E .
Let
n
n
as follows by induction on n
hI = e
{f,g}*x ,
minus the nmmber of occurrences of
In(T)(E) = FALSE
n -> i
in
n :
8-2
We show by induction on evident for
n = i . Assume
for any terminal term
E .
n
tkmt
val(S~In,X)
n -> 2 . Since
= gnhnfnX
Define a function
I (T)(E) = FALSE n
for
Fn
for
n >_ i .
by
It is
Fn(E) = val(S,In~E)
E : x , we see that
h(x) : g(L(L(fx))) Suppose we are computing under an interpretation induction on
r+(n-s)
r(t s) = s , r(t
that for
then there are
) = s-r
i s r -< s -< n ,
ts_ I
and
ts_ r
if
in
In
It can be sh~w.~ by
ts
is in
{f,g}+
{f,g}+
with
with
r(ts_ I) = s-i
and
such that
s-r
() g F r t x
* > (gF)r-lts Ix
S
For
n ~ 2
~ >*
t
-
x s-r
the computation can be divided into phases:
=~>
where each
.
(S,In+l,fx)
>
gFElX
Ei
En_ I : g ~
*
gF2fx
Fx ~->
(gF)n-~]n_iX
> E0x
:
"" (gF)n-2 "" ~ > En_2 x I~_>
val(S,In,X)
is an appropriate word in
{f,g}*
with
Similarly, if we now compute under with input
Ffx ~ >
fx
gF2f2x
where the expressions
val(S,In+l,fx)
x
> Eofx
Ei
,
instead of
In+ I
I
in particular n
,
(gF)n-lgfn+ix
:
= val(S,In+l,X) (S~In,X)
Indeed f o r any
E
!
in
rfhus we have
{f,g}+
with
we can write (recalling t ~ t free interpretation)
F (x) is itself a formal function s~qee n Fn+l(EX) : Fn(X)(Ex) .
Thus if we have shown that Fn+l(X) = gFn+l(Fn+l(fx)) : gFn+l(g~hnfn+ix) = g
Fn(x) : gnh~fnx
for
n -> i
we
r(E) : i is a
have
= gFn+l(Fn(X) (fx)) = gFn+l(gnhnfnx(fx))
= gFn(x)(gnhnfn+ix)
n+l~ ~.n n~ ~n+l n+l~ ~n+l nn~ g nnr x : g nn+ir x .
: g(gnhnfnx(gnhnfn+ix) ) This shows that
F (x) : gn h fn x n
n>_l
and f o l l o w
"~ >
are the same as for
= val(S,In,x)(f×)
m(b i) : i ;
we have:
* > (gF)n-2En_2fx
gFElfx
~>
instead of
* > (gF)n-lgF2fn+Ix ~ >
(gF)n-iEn_ifx
..,
for all
n
. If we set
m
n
mh+ I : 2n + 2m n .
:
weseet
n-I ran+I
t
ml =
0
½:2
and for
n>l
Expanding this recurrence relation, we get the series expression: 2k+l(n-k)
: k:0
8-3
and hence
mn+ 1 : 2n+2 - 2(n+l) - 2 .
So we have
Ival(S,In,X) I = 2n+l - i . We claim that no flowchart scheme can
exhibit this growth pattern under, that
(P,In,X)
converges.
In
Suppose
Suppose P
has
m
variable; program variables, output variables outcome of the only test r(t)
or
In(T)(t)
Whether
t ~ x
n + i
and
(P,I n)
and
k
r(t)
is congruent to k(n+l) m
instruction with the values in the
m
steps.
The~
instructions.
Ival(P,In,X) I _< ck(n+l) m .
For
n
val(P,In,X) ~ val(S,In,X)
Since the
n
divides
j mod n
for
t = x
0 -< j -< n-I .
or
If the
steps, then it mmst twice enter the sane registers in the same equivalence classes as Thus if
is some constant
(P,In,X) c
converges, it does
such that each instruction
can increase the length of the value of a variable under
and so
input
is concerned the values of the
before~ hence it ~s in an unbreakable loop. k(n+l) m
-
equivalence classes, determined by whether
computation contains more than
so within
is any flowchart scheme such
depends solely on whether or not
t = x , as far as progrmn
registers fall in
P
registers of all kinds
In
by at most
large this is strictly less than . Hence
F
c . Hence
Ival(S~In,X) I
cannot he strongly equivalent to S. •
We have shown -that the class of manadie recursion schemes is not translatable into the class of irmnmdic program schemes.
Before showing that the two classes are
in fact incomparable let us consider briefly how we can compute the value of a monadie reeursion scheme using a s~nple pushdown store. We use a pushdown store w/th the top at the right and start with the defined letter of the start equation alone on the top of the store. in an output register. output register. (i)
and erase
f
I(T) by
a
is in the output register replace
(3)
f , apply it to a
by
l(f)(a)
If the top of the pushdo~n store is a defined fur~ction letter, say F
is
to the value of the output register, E
in this
from the top of the pushdown store.
and the recursion expression defining
F
x )
At any step:
If the top of the store is a basis function letter, say
the output register and if
(2)
1]~e output is generated
We start with the in,at (the initial value of
IF
Tx
THEN
a , and if
Ex
ELSE
l(T)(a)
on the top of the pushdown store and otherwise replace
E'x
F
apply
is TRUE replace F
by
E'
If the pushdown store is empty, STOP a~d print zhe value of the output
register. %~ne pushdown stores considered in the previous chapter contain as individual items members of any domain.
In the case of monadic schemes we can get away with a
shnpler and stricter definition of a store. variable
u
fixed v~eabulsmy
F
and to which we c~n apply as 9anctions only
erases the rightmmst symbol, if any, of I~JSH(u,A)
We can regard a store as a special
whose value under, any interpretation must be a member of
(which adds
A
u
F*
POP(u)
for a (which
regarded as the top of the stack) and
to the top (right) of
u
for any
A
in
F ).
The only
8-4
predicates applicable to empty, A
u : e ,
u
are EYIDTY(u)
mnd for each
A
in
is the top (rightmost) symbol of
any computation.
which is TRUE if and only if
F , TOP(u~A)
u
is
which is true if and only if
u . The store is always empty at the start of
Further all assignments and tests involving
u
cannot involve
mny other variable.
'lhus we ~mve really established the followLng result:
THEOREH 8.2
The class of monadic reeursion schemes is translatable into the class
of lanov schemes augmented by a simple pushdown store.
PROOF We extend the definition of a pushdown store variable to allow functions PUSH(u,w)
for any strg~g
that can be simulated bY
w
over the pushdo~m store vocabulary
lwl
instructions of the form
We can assume that our monadic reeursion scheme fl,...,fm function
and defined functions Fi
F0,FI,...,F n
with
S F0
F* ; obviously
PUSH(u,A)
.
has basis functions initial and tlmt each
is defined by an equation
F.x 3-
:
IF
T.x i
THEN
E.x 3_
ELSE
E!x i
The strongly equivalent program scheme with one pushdown store can be described by the WHILE scheme in Example VIII-I.
It is obviously a single register lanov scheme
augmented by one sir~ple pushdow~ store,
m
We have shown that in the ~nnadic case one sgnple pushdown store suffices. Similar to this definition of the augmentation of a flowchart scheme by a simple pushdown store one can define a counter as a reserved variable
u
whose values can
only be non-negative integers and to which can only be applied the functions &nd
u "- i
&nd the predicate
all assignments to or by v ÷ f(u)
u
are forbidden for
u + i
u : 0 . As in the case of an added pushdo~m store, must be independent variable v ~ u
and any
-
that is
u ÷ f(v)
THEN
ELSE
and
f .
The proof of ~7.eorem 8.1 can be modified to show tbmt:
THEOREH 8.1'
The monadic recursion scheme
S:
Fx : IF
Tx
x
gFFfx
is not translatable into tony strongly equivalent monadic program scheme augmented by one
count eP.
8-5
EXAi~LE Vlll-I
bHIL~ SCI~7~ TO D 6 o ~ I ~
A MO!%DIC PZCL[RSION SG-IEHE
START y
÷
x
u
+
PUSH(u,F 0)
WHI~
NOT EMPTY(u)
DO IF
~DP(u,f I)
THEN
y ÷ fl(y) ; u ÷ POP(u)
E~©IF
IF
TOP(u,f 2)
1]~
y ÷ f2(y) ; u ÷ POP(u)
ENDIF
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
IF
TOP(u,f m)
THEN
y ÷ fm(y) ;
IF
TOP(u,F 0)
~{
u + POP(u) IF
T0x
.
.
.
.
.
. . . . . . . .
u + POP(u)
° . .
ENDIF
Z~iEN u ÷ PUSH(u,E 0) ELSE
u ÷ PUSH(u,E 6)
ENDIF ENDIF IF
TOP(u,F I)
THEN
u ÷ POP(u) ; IF
TlX
THEN
u + PUSH(u,E I)
ELSE
u + I~JSH(u,E i)
RINDIF ENDIF
IF
TOP(u,F n)
T~EN
u + POP(u) ; IF
TnX
_THEN u ÷ PUSH(u,E n) ELSE
HNDIF DNDIF ENDWHILE z
÷
STOP
y
u ÷ PUSH(u,E n)
8-6
However, it is known that two counters can imitate a simple pushdown store over a fixed vocabulary (or, for that matter~ any n~mmber of such p u s h d o ~ stores){ the sLmulation does not require additional variables beyond the reserved counter variables.
Hence one can show float:
THEOPd~4 8.2'
The class of monadic recursion schemes is effectively tmanslatable
into the class of lanov program schemes augmented by two counters.
When one turns to general recursion schemes one runs into a problem.
The
pushdown store must record not only the basis and defined function letters but also the actual values of the funetlons.
The proof we used to establish that a particular
recursion scheme was not fl@wc~mrtable also shows that it does not suffice to record the basis function letters and nmnes of registers in which the values of arguments are stored registers.
the actual values cannot then be computed with a finite number of Hence the domain must be encoded into some finite alphabet.
This
either requires placing some restriction on domains or else admitting that the encodLng of the domaLus p.eed not be uniform and tluat the specification of the pushdo~n store(s) can_ vary.
So, in the previous chapter we considered what might
be called a "complex" pushdown store
-
the individual entries were not members
of a fixed vocabulary but rather members of the domain of the interpretation contents of the variables
such a store is really a list of lists.
-
It cannot
necessarily be translated uniformly into counters.
B.
VALUE LA~{GUAGES A very powerful technique for comparing monmdic recursion schemes with monadic
program schemes ~ s
introduced by- Luckh~m and Garland.
language theory in an interestglg way.
It uses results from forma£
~ne basic concepts are those of a value
language and an interpreted value language~ formal languages which describe some of the properties of a given scheme. In describing the output interpretation
DEFINITION
I
val(S,I,X)
of a monadic scheme under a free
we omit parentheses, as discussed before.
For a recursion scheme
S
the value language of
S ,
language :
{ val(S,l~X)
I
I
free interpretation,
val(S,l,~)+ }
L(S) ,
is the
8-7
DEFINITION
For a program scheme
P
the value language of
P ,
L(P)
,
is the
language:
{ val(P,I,X)
I
I
free interpretation,
val(P,I,X)+
}
Our observations on lanov schemes can be expressed as follows.
~EOREM
8.3
The value language of a lanov scheme is a regular set.
For monadic recursion schemes and certain subcases of monadie program schemes such as lanov schemes we can also define the ~terPreted
value language.
To give a mnifo~rm definition, let us represent TRUE by and define the Lnterpreted value language with
r
tests
TI,...,T r
L#(S)
I
and FALSE by
0
of a monadic recursion scheme
S
as the set of all words of the form:
Pnfn ... PlflP0X such that there is a free interpretation (i)
either
n = 0
val(S,l,x)
and
I
val(S~l,x) = x
for which:
or
and
n ~ I
= fnfn_l...fl x ,
(2)
P0 : I(Tr)(X) I(mr-1)(x) "'" I(T1)(x) ' and
(3)
for
i s i s n ,
Pi = bir " " bil ' where
bij = l(Tj)(fifi_l...flx)
.
EXAMPLE Consider the monadic recursion scheme
SI:
FoX = IF
TlX
THEN
Fix
Fix = IF
T2x
THEN
fF0fx
ELSE
~x
F2x = IF
T2x
THEN
gF0gx
ELSE
ghgx
The value language of
L(S I)
(where
wR
is
L#(S I)
=
w
SI
ELSE
F2x
is easily seen to be:
{whwRx I w e (f,g}+)
written backwards).
The interpreted value language of
{Pn+lelPn...~nPlhPo~nOin~n_llin_l...elliox
I n ~ 0 ,
i 0 ..... i n c {O,l},po,Pl ..... Pn+l ~ {OO,Ol,lO,ll} for
0 ~ k <- n ,
ik = i
then
if
~k = f }
ik = O
then
~k : g
,
and if
SI
is :
8-8
Now examine the monadic reoursion scheme: $2:
G0x
:
IF
TlX
~
fGlfX
ELSE
gGlgX
~x
=
IF
T2x
TREW
G0x
ELSE
hx
It is clear that
L(S 2) = L(S I) . However,
SI
For example, consider the free interpretation
l(Tl)(X)
:
l(Tl)(fx)
:
l(Tl)(ffx)
and
I(TI)(E)
FoX But in
S2
l(T2)(x)
l(T2)(fx) =
:
I(T2)(E)
~>
Fix
-->
fGlfx
~>
ffhffx
=
~>
0
fhfx
:
0
i
l(T2)(ffx)
:
0Of00hllf01x
val(S2,11,x)
and
~>
is in
00f00f00h00fllfOlx
with
,
S2 •
defined by
=
0
elsewhere.
:
In
SI
we have:
val(Sl,l,x)
:
GoX
Now
i
is not strongly equivalent to I
=
fGofx
and
~
but not in
val(Sl,l,x) L#(S 2)
while
L#(S2)-L#(S I) . The reader can verify that
ffhffx -- va!(Sl,12,x)
ll(Tl)(X) = i
ffGlffx
val(S2,l,x)
L#(S I)
is in
-->
for free interpretations
ll(T2)(fx) = 0 , and
fhfx =
II
and
12
12(Tl)(X) = 12(T2)(x) =
12(Tl)(fx) = i ~nd 12(T2)(fx) = @ ; II(TI)~II(T2),I2(TI) arbitrary elsewhere.
and
12(T 2)
can be
If two schemes are strongly equivalent they must give the same output under all interpretations arid all inputs and hence under all free interpretations~ thus the value l&%guages must certainly be the sam.s. If is, whenever
(S' ,l,a) converges,
certainly the set of outputs of
(S,l,a) S'
S
is an extension of
converges and
S'
-
that
val(S,l,a) : val(S' ,I,K)
must be a subset of the set of outputs
of
S . So we can establish the following simple facts about value and interpreted value languages. FACTS (i)
For any schemes
L(S) = L(S') ;
if
S S
and
S T , if
S
is an extension of
and S'
S'
are strongly equivalent then
then
L(S') c
L(S)
8-9
(2)
For any two classes
into
CI
and
:
{L(S) I S e
Hence, if there is a scheme
S
not translatable into
and
C2
C l}
in
For monadic reeursion schemes
if and only if (4)
of schemes, if
CI
is translatable
C 2 , then:
~( C I)
(3)
C2
If
C1
~ ~( C 2)
C1 C1 S
such that
{L(S) I S e C 2} .
L(S) ~ o~( C 2)
is not translatable into and
S' , S
then
S
is
_
C2 .
is strongly equivalent to
S'
L#(S) = L#(S') . and
C2
is translatable into
,W#(~)
are two classes of monadic recursion schemes then C2
:
{L#(S) [ S e
Cl} ~
oW#( C 2)
Fact (3) is also true for Iarmv schemes.
S'
even if
S
is Ianov and
:
(L#(S) I S ~
L#(S) = L#(S') S'
with
always halting.
START
)
y + f(x)
Z ~- X i
( sTo )
S
not strongly
For an example
S'
S
C 2) .
For arbitrary monadic one input one
consider the sehemms below:
START
C1
if and only if
output program sehes~es it is possible to have equivalent to
:
)
8-10
We have
L#(S): L#(S'):{~x,p2gplx
are not even weakly equivalent. z ÷ x ) the string tested definition of
L#(S)
S
but
S ~ S' ~ S
and
S'
(z + g(x)
and
(f(x) ) doesn't appear in the output and so the
is in this case artificial and irrelevant.
For monadic recursion schemes even if
I pl,P2 e {0,i}}
The p i n t is that due to resets
S
and
is not strongly equivalent to
S'
it is possible to have
S'
-
L(S) = L(S')
the same output might be given
but for different interpretations~ we saw this in the previous example. First we show that the reversal of the interpretedvalue language of a monadic recursion scheme is a deterministic context-free language. effective.
This construction is
Hence the strong equivalence problem for mopmdic reeursion schemes is
decidable if the equivalence problem for deterministic context-free languages is decidable.
(E. Friedman has recently shown that the converse is also true
-
if
the strong equivalence problem for monadic reeursion schemes were decidable then the equivalence problem for deterministic context-free languages would be decidable. Hence the strong equivalence problem formmnadierecursion schemes is precisely the same as a well-known open problem
-
the equivalence problem for deterministic
context-free languages.)
17~OREM 8.4
The reversal of the interpreted value language of a monadic recursion
scheme is a deterministic context-free language.
PROOF We take the reversal of the interpreted value language simply because the input tape on a pushdo}~ store acceptor is read from left to right while we write the composition of functions from right to left. Let be
S
be a monadic recursion scheme with
r
tests
T I,...~Tr
~
r
-> I
,
and equations :
F.x l for
0 s i s n
:
IF
Tk.X i
TH~
m ~i,l x
mnd initial equation
ELSE
Ei,0x
F0 .
Our deterministic pushdown acceptor will have as states [DEAD]~ and a state
[w]
for each
stand for the empty string, with The transition function
@
w
in
{0,I}
with
[START], [STOP]~
O s lwl ~ r ~ we let
of our pushdown store machine starts off, with the
pushdown store initially empty:
~([Sm;~RT],x,e)
This tramsition causes
x
:
e
lel = 0 .
([e],F0)
to be read on the input tape, places
(right) of the pushdown store and transfers to state
[e] .
F0
on the top
8-ii
For
w
in
{0,i}*
6([w],p,Z)
for mny Z : Fi
p
in
or
:
{0,i}
Z = f
and
0 s lwl s r-i , the transition:
([wp],Z)
~nd any condition
for a basis function
finite state control the outcomes of the
Z
of the pushdown store (i.e.
f ), r
Z = e
causes the machine to collect in its tests under the interpretation
described by the input word. If the machine has collected the required outcomes of the a state
[w]
with
w = bl...b r ,
pushdown store is now
Fi ,
@([w],e,Fi) which replaces Tki
Fi
:
by
in
{0,i} .
If the top symbol of the
([w],Ei,bk.) l
i
or
or
Ei, 0
0
simulates the computation of f
bj
tests, it is in
there is a transition
Ei, I
is supposed to be
each
r
S .
for a basis function letter
depending on whether the outcome of test
as indicated by the input tape; thus the machine If the top s ~ o l
f ,
of the pushdown store is now
the transition is, for
w
in
{0,i} +
with
lwl = r ,
~([w],f,f)
=
([e3,e)
which means the machine must now consult its input tape for the outcome of the tests on the new value. When the pushdown st~re is empty and we have collected the test outcomes, we ~m~accept:
6([w],e,e)
for
w ~ {0,1} +
:
and
([STOP],e)
fwl : r
.
7T~e machine accepts all and only input words which lead it from initial state [START] w£th empty pushdowm store to acceptLng state [STOP] with empty puslndo~m store. Any transition not described above leads into the dead state [DE6D] 6([w],f,g) = ([DEAD],g)
for
f
a~id ~([STOP],a,Z) : ([DEAD],Z)
and
g
basis functions and
for any input
and the dead state can never be left
-
a
(L#(S)) R , •
the reversal of
L#(S)
and hence
or
(e.g. lwl ~ r
and pushdown store condition
6([DEAD],a,Z) : ([DEAD],Z)
Clearly the language accepted by this d e t e ~ n i s t i c
free.
f ~ g
(L#(S)) R
, Z )
everywhere.
pushdown store aceeptor is is deterministic context-
8-12
A term in a monadic recursion scheme is right linear if either it contains no defined function letters or else is of the form letter and
y
Fyx
for
F
a defined function
a (possibly empty) string of basis function letters~ such a term is
left linear if it either contains no defined function letters or else is of the form
yFx
for
F
a defined function letter and
basis function letters.
y
A monodic recursion scheme
a (possibly empty) string of S
is righ t linear if in each
equation
Fx
both
E
and
:
IF
E'
Tx
~I~N
Ex
ELSE
are right linear.
E'x
We define left linear monadic recursion
schemes in similar ways. Our previous construction can be adapted to show:
COROLLA_RY 8.5
~ne reversal of the interpreted value lang0age of a linear monadie
recursion scheme is a deterministic linear context-free language (the language accepted by a deterministic sLngle-turn pda).
COROLLARY 8.6
The reversal of the interpreted value language of a right linear
or left linear monadic recursion scheme is a regular set.
Now Valiant has shown that the equivalence problem for deterministic finiteturn pdas is decidable, hence:
COROLLARY 8.7
The strong equivalence problem is decidable for mor~dic linear
recursion schemes.
To get the value language
L(S)
from
(L#(S))R
one reverses the words and
erases the sequence of 0~s ~id i's indioating the o u t e o ~ of tests for a given interpretation.
The families of context-free, of linear, and of regular l&nguages
are all closed under reversal and erasing so we have at once:
THEOREM 8.8
The value language of a
(i)
monadic recu~sion schemm is context-free,
(2)
linear monadic recursion scheme is linear context-free, and
(3)
right linear monadic rect~sion scheme is regular.
8-13
We note in passing that it is easy to show that a few converses hold (provided of course we remove the end (i)
Every context-free
(2)
Every linear context-free
x ):
language is the value language of some monadic recursion
scheme.
monadic recursion (3)
language is the value language of some linear
scheme.
Every regular set is the value language of some right linear monadie recursion scheme.
However not every deterministic the right format
context-f~ee
language
-
even if it is in
-
monadic recursion
is the reversal of the interpreted value language of some , scheme: the regular set x0(f0) is an obvious example.
We can show:
THEOREM 8.9
Every context-free
language is the value language of some free
monadic recursion scheme.
PROOF If
L
grammar
is a context-free
G = (V,E,P~S)
language, there is a reverse standard form context-free
such tlmt
L = L(G)
and all rules of
P
are
of the forms
S +e Z ÷ya
For
Z
let
r = ~mx {r(X)
each
in
a c E ,
Z
some way:
V - Z ,
in
let
r(Z)
be the number of rules with left hand side
I Z • V - E} .
V - ~
Z
For
I s i s r
let
Ti
Z
and
be a binary test.
For
assume that the rules with left hand side
Z ÷ YzlaZl
,
Z + YZ2aZ2 , --. , Z + yzr(z)azr(Z)
distinct defined function letter in.
y ~ (V - {S} )
FZi
for each
i ,
Z •
are ordered in
Create a new and
I ~ i s r(Z)
.
The terminals
are now considered to he basis function letters. If
S ÷ e
is in
P
and
r(S) = i ,
then the only equation is
FsIx = x
If
If
S ÷ e
S ÷ e
is in
P
and
r(S) ~ 2 ,
FsIx = IF
TlX
THEN
is not in
only equation is
P
and
x
then the start equation is
ELSE
r(S) = i ,
Fs2X
and the only mule is
S ÷ ya
then the
8-14
FSI Otherwise,
=
yax
r(S) -> 2 ,
and if the fimst rule for
S
is
S ÷ ya ,
the start
equation is
FSI
For
=
IF
TlX
(Z,i) ~ (S,I)
FziX
For
:
IF
THEN
and
Tix
= IF
ELSE
Fs2X
i _< i _< r(Z) = _~ ,
T~3~,~ YZiaZi x
(Z~r(Z)) ~ (S~I)
FZr(Z)X
yax
ELSE
there is an equation
F Z i+l x
there is an equation
Tr(z)X
~
yzr(z)azr(z)X
These equations form a monmdic recursion scheme
ELSE S(G)
YZr (z)azr (Z) x and it can be verified
that (i)
S(G)
(2)
L(S(G)) : Lx
the
u
is a free monadie recursion scheme •
We can examine a few schemes. variable as a counter.
out to i, simultaneously
Flowcbart scheme
constructing
v as
the scheme again searches for the first m = n ,
v
is recomputed as
is repeated, with
v
bnanx .
ending as
transferred to output register of
P1
is
val(P I) = {anbnanx
m
anx .
Then
such that
Finally
anbnanx z
u
fmx
in
Example VIII-2 uses
n
such that
u
is reset to
I n >- i}
fnx
tests
fx
and
tests to i; since
is reset to
fx
and then the contents of
and the computation halts.
not strongly equivalent to any ~ n a d i c
II4EOREH 8.10
PI
First it finds the first
and the search v
are
So the value language
which is not context-free.
Hence
P1
is
recursion scheme.
There is a ~onadic program scheme Which is not strongly equivalent
to any monadic r,ec~rsion scheme.
II~OREM 8 .ii
The classes of monadic recursJon schemes and monadic program schemes
are Lncomparable.
8-15
EXAMPLE VIII-2
-
Monadic flowchart scheme
PI
is not translatable into
any strongly equivalent monadic recursion scheme.
START
)
I u ~ f(x) v ÷ a(x) >
uv +÷ a(v) f(u) J
u
+
f(x)
v
÷
b(v)]
I
,>
u
+
f(u)
I u
÷
f(x)
v
÷
b(v)
I......~...... +
a(v)
t
<
1
6
f(u) STOP
The value language of
z
>
n
n
PI ' L(PI) = {anb a x
n >- I}
a(v) I is not Context-Free
8-16
Scheme
P2
in Example VIII-3 shows that a flowchart scheme may not be
translatable into a monadic recursion scheme even if the value language is contextfree.
The reason is that
enters
PI
and if
R
P2
L#(P 2) Fh R = L#(P I) (h R l's,
really combines two schemes.
If
T(x) = i ,
is the regular set of all wnrds ending in and if
h
Ix
P2
then
is the homomorphism which erases the O's and
h(L#(P 2) F~ R) = h(L#(P I) (% R) = L(P I)
which is not context-free; sinee the
family of context-free languages is closed under intersection with regular sets and homomorphism,
L#(P 2 )
is not context-free and so
monadic recursion scheme.
On the other hand, if
P2
cannot be translated into any
T(x) = 0 ,
P2
enters a scheme
which is essentially a lanov scheme and whose value language is the regular set aa*bb*aa*x . and hence
Since
L(P 2 )
L(P I) c aa*bb*aa*x ,
L(P 2) = L(P I) t) aa*bb*aa*x = aa*bb*aa*x
is context-free and even regular.
In Example VIII-4,
P3
is a flowchart scheme the reversal of whose interpreted
value language is deterministic context-free.
(L#(P3))R
{x0(a0)2nalbPl...bPm
:
Indeed,
n ~ 0 , m = 2(2n+i) , Pl .... 'Pm ~ {o,1} }
U {x0(a))2n+lalbPl...bPm
i n ~ 0 , m = 2n+2 , pl,...,pm
~ {o,1] }
u {xl}
which is deterministic context-free and even realtime. depends on whether the number of even or an odd number. sequence of
a's
a's
However, the final outcome
read until the test of
DEFINITION
But the determ/nistic pda for the reversal of an
A deterministic pda
imply
M = (K,Z,~,qo,F)
if and only if for all inputs
(qo,wX,e)
q = q'
}~'~
We call
yields i is an
This requires two states which record whether the whole
is even or odd.
interpreted value language has a property which might be called
k _> 0 ,
anx
(q,e,y)
and
w,w'
and
"r+l-deflnlte" " .
is k-definite for an integer x ,
(qo,W'x~e)
if
I ~'~
L(M) , the language accepted by
Ixl _> k , then
(q',e,y')
M
by final state and
empty pushdown store, a k-definite-deterministie context-free language.
In this definition~ we allow our deterministic pdas to block (rather than enter a DEAD state).
We can adapt our previous construction to show that under these
definitions :
THEOREM 8.4' scheme with
The reversal of the interpreted value language of a monadic recursion r
tests is an (r+l)-definite deterministic context-free language.
8-17
EXA]~LE VIII-3
-
Flowchart scheme
P2
is not translatable into
any monadic recursion scheme
x
>
l
+
a(x) I
l P1 t l
'"x ÷ b(x) I
I x ÷ a(x)
STOP ~)~ The value language of
P2
is
the interpreted value language
L(P 2 ) : aa*bb*aa*x L#(P 2)
z
÷
x
which is regular~ however,
is not context-free, since if
the h o ~ r p h i s m
that erases the test outcomes and
words ending in
ix , h(L#(P2) fh R) = L(P I)
R
h
the re~la_~ set of
which is not context-free.
is
8-18
EXAkIPLE VIII-4
-
Flowchart scheme
P3
is not strongly equivalent
to any monadic recursion scheme even though (L#(P3))R
is deterministic context-free
S~ZRT
y
+
)
x
)
0
y
+
a(y)
u
÷
y
+
S
a(u) z
\
y
+
÷
y
b(y)
t
a(y)
.....STOP 1
U
~"
X
>
u y
+ +
a(u) I b(y)
Y
+
b(y)
z
l
+
y
!
I
(
STOP
)
)
8-19
Now
(L#(P3)) R
is not 2-definite
(or even k-definite for any
k )
and so
P8
cannot be translated into any strongly equivalent monadic recursion scheme.
We can extend these constructions a little further to show that every recursively enumerable set can be obtained as the value language of a monadic program sche~m (subject to addition of the final
THEOEM
8.12
x , of course).
Every recursively enumerable set is the value language of some
monadic program scheme.
PROOF Just as we showed that for every Turing machine deterministic
finite state aceeptor
tape if and only if
L(~)
reeursively e n u m e r ~ ! e
~
such that
(h D = % ,
la~nguage
T T
and a marker
(i)
If
For each
(z,z)
is in w
such that
La(M) ~
in, L
D ,
then
(w$t,w$t)
is a ~ r i n g
(w$t,w$t) of
T
is in
La(M) F] D
where
w
is in
w
as input.
where
%w
:
E
and
M
not in
E , there is a
with input vocabulary
t
for some
t
and
in
L .
containing only
O's
H
w
does not accept
&nd
l's
(w$t,wSt)
on both tapes.
L , machine
H
searches for pairs
is an encoding in binary of a computation
Thus in effect
h(%wCm~¢m2..,¢Inn¢)
~- ID I ~- ID 2 ~ - ... ~
description of
$
machine which accepts
accepting
t
z = w$t
there is a finite tape
until after it has read past the
T
$
such that:
(2)
If
one-way
so it can be shown that for any
L C_ E*
deterministic two-tape one-way finite state acceptor E U {$,0,I}
there is a t ~ - t a p e
halts on the initially blank
T ,
and
instantaneous descriptions
h
ID n ,
ID n
is an accepting instantaneous
is a homomorphism mapping the symbols of the into O's and l's in a one-to-one uniquely decodable
fashion. Let not in and
M = (KI,K2,E E .
t) {$,0,1},6,qo,qa,qr)
For convenience, order
• We assume that
E = {al,...,a m }
and let
$,0 , and i are am+ I = $ ,
am+ 3 = i . In Example VIII-5 we const~aet by subsehemes a program scheme
output variable
L(P(M))
z
P(H)
am+ 2 : 0
with
such that
=
{wRx I 3(wSt,w$t) e La(H) (h D ~ w e Z }
=
LRx .
This suffices, since the family of recursively e_numerable languages is closed umder reversal.
8-20
EXAMPLE Vlll-5 CONSTRUCZ[[ON of flowchart scheme state acceptor I ,
M = (KI,K2,E
(P(M),I,x)+
t I = w$t'
START
and
÷
D
finite
For any free interpretation and in that case
= wRx .
y
,)
Subscheme fop
q
in
KI
x
%
u2
(tl,t I) • La(M) ~
val(P(M),l,x)
t
u1 ÷
from two-tape one-way d e t e ~ i s t i c
t) {$~0~l},6,qo,qa~q r) .
if and only if
, w • L ~
P(M)
x
u I ÷ f(u I)
i
1
0
\ \
y
( T00~)
8-21 EXAMPII~]VI!I-5 (Continued)
~bschemefor
Subschem~for q in K2
f
7
u2
+
f ( u 2)
\< '
f
/ \ \ \ \
V
<
LOOP ....
8-22
EXAMPLE VI!I-5 (Concluded)
Y lul x ,I
I x ÷ al(x) ....
I~(Ul)l
i
i
x + a2(x)
I
t'
X
\
I <
z ÷ x 1 (, LOOP
)
8-23
Our construction deviates slightly from the previous ones of this type in that we have one test
Ta.
in sequence from
al I to
every
j >- i
for each
there is an
other~\ise let
I
ai
am+ 3 . i ,
in
Z <) {$,0,i} . We always apply these tests
Call a free interpretation
I -< i -< m+3
be "useless".
If
I
such that
I
"useful" if for
l(T a . )(fJx) = i
is useful, let
b4 =la k
and
where
J
k = Hin{ill(Ta.)(fJx)
= i} .
Scheme
P(H)
pretation oncelit is known to be useless : 0
for
•nterpretatmons.
l(T.)(fJx)
If
•
l
This time
I -< i s m+3 I
P(M)
-
computation
(P(H),l~x)
t I = w$t'
is in
for some
bj = a k
w
in
by reassigning
val(P(M),l,x)
x ~ wRx , = wRx
is encountered with
t I = b l...bj ....
M
on input qa
P(M)
fJ+ix .
x + akx . to
z
w
in
for
If
L . Thereupon
output on a free interpretation,
C.
fix
and so we need not worry about useless
reaches subscheme
La(M) Fh D .
the values of the tests on the
contents of
i.e. ~
is built so that for a useful free interpretation
(P(M),I,x) " simulates
(tl,t I)
-
is useful, let
computation
i.e.
is set to loop for a useless inter-
P(H)
When
P(H)
so
H
accepts
P(M)
reaches
uI
to
x
and rechecks
records the fact that bj = $
it transfers the
val(P(H) ~I,x) = wRx . 7%us
This is the only way in which L(P(M))
(tl,t I) ,
qa ' then we must have
resets
This time
I ,
In particular,
if and only if reaches
and halts with L .
(tl,t I) .
P(M)
can give
has the desired properties.
FREE MONADIC RECURSION SCHEMES It is undeeidable whether a monadic program scheme is free.
But it is fairly
easy to see that it is decidable whether a ronadic recursion scheme is free. that a monadic recursion scheme of
[]
S
S
under every free interpretation of
the sarape expression
Recall
is free if and only if drafting every computation S
no test
T
of
S
is twice applied to
Ex .
If we construct the pushdown store automaton which accepts the reversal of the interpreted value language of a monadic recursion scheme only two cases in which (i)
S
S
we see that there are
can fail to be free:
If some defined function letter
F
appears on the top of the
pushdo~m store and then without erasing the store or advancing the input, a defined function letter the equations for (2)
F
and
If some defined function
G F
G appears on top, and
have the same test. appears on the top of the pushdown
store, an occurrence of a defined fu~-~ction letter below: and
G
G
appears
is reached without advancing the input tape, and
the equations for
F
and
G
have the same test.
8-24
Case (i) means that in the derivation under some free interpretation we have ,
,
FoX "--> uFtx ---> uvGtx
where
r
is a string of basis functions and the second
derivation takes at least one step, and the same test equations for free.
F
and
G .
Then test
T
If we form a context-free g r m m m r
i.e. an equation and
G ÷ E'
F--k-=> vG
-
Gx : IF
Tx
THEN
Ex
must test from
S
ELSE
E'x
k ~ 0
in the resulting grammar.
does not occur for ~ny free interpretation in FOX--> S
uFtx
but then
cannot be free.
for
is not
F0 -->
uFt
G -~ E
and
If this condition does not occua~, If it does and
S , then
S
Fox
> uPtx
c~nnot be free;
is impossible.
But if both
However, standard methods show that it is decidable u,F,t,v
such that
F0 -->
uFt
and
k ~ 0 .
The other case, (2), is handled similarly, situation
S
becomes t~To productions
Ftx----> vGtx
for context-free grammars whether there are F ~ - - > vG
twice and so
we observe that it suffices to test whether
for
occur, then
tx
is associated with the
in the straightforward way
condition (i) cannot occur in the original scheme.
similarly if
T
FOX-----> uGvFtx
basis functions and context-free g r ~ s
v
and
Ftx ....> tx
This really applies to the
arld v t x - - - > tx
for
t
a string of
a string of defined flmnctions. Again., it is decidable for whether this situation holds; if it does, either
S
is
already not free because the corresponding derivations in the scheme calmot hold for any free interpretation~ or the existence of this situation under any free interpmetation violates the definition of "fr,eeness".
So we have proven the following
result of Ashcroft, Manna and Pneuli:
THEOPdg{ 8.13
It is decidable whether a monadio recursion scheme is free.
If a monadio recursion scheme If
S
has
n
S
is free, then neither (i) nor (2) can hold.
defined functions, then every
n
steps of a comuutation must add at
least one new basis 9anction letter in the argmment of the defined function letter being computed upon. can be "erased".
Sgm[larly, no more than
n
defined function letters in a row
If we pursue these conditions into the formation of the
deterministic pushdo~n store automaton for the reversal of the interpreted value language of such a scheme, one can show that (Ashcroft, Manna, Pneuli):
THEOREM 8.14
The strong equivalence problem far free monadic recursion schemes is
decidable.
By contrast, E. Friedman has shown:
THEOREM 8.15 undecidable.
The weak equivalence problem for free monadic recursion schemes is
8-25
D.
WEAK TRANSLATABILITY We can carry the ideas ir~ the proof that ever0~ recursively en,mmerable set is
the value language of some monadic program scheme one step forward ~nd show that in a certain sense we can translate monadic recursion schemes into monadic program schemes, this notion of translatability being weak translatability.
There are alternative definitions of "weak translatabilitS'. definition is rather "strong".
DEFINITION (i) (2)
A scheme
S
"Weaker" versions omit condition (3).
is weakly translatable into a scheme
S'
if
L(S) : L(S') For any interpretation then computation
(3)
The following
For any interpretation letters of
I
and input
a ,
converges ~nd of
S
if computation val(S~l~)
(S~I)
(S' ,l,a) converges,
: val(S',l,~)
restricted to the function and predicate
S , there is an interpretation
such that
THEOREM 8.16
I
(S~l~a)
I'
is strongly equivalent to
of
S'
compatible with
S
(S' ,I') .
Every monadic recursion scheme is weakly translatable into a monadic
program scheme.
PROOF Let
S
be a monadic recursion scheme.
By methods similar to the proof of
Chomsky normal form for context-free grmmmrs we can convert the equations of
S
to the forms:
for
t
Fx
:
IF
Px
:
Gx
Px
:
GHx
Px
=
tx
Qx
a terminal ter~L and
Assume tPmt F0,FI~... ~Fn
S
with
T
Gx
ELSE
F,G,H
Hx
defined function letters.
is in this form and that F0
The program scheme test
THEN
P(S)
S
@,i~... ~n,$
and which we assume to be an for some new symbol
simulated by binary tests in the standard way. x ~ u , v ,
and
z .
has defir~ed function letters
we shall construct in Example VIII-6 has an extra
which does not appear in
with possible outcomes
S
the initial function letter.
Register
input and zrogram variable.
z
Scheme
$ ; P(S)
n+2-way test
such a test could be has variables
holds the eventual output and register
The registers
u
and
v
S .
is
are special program variables
whic~h simulate the puslndo~ store of a p u s h d o ~ store machine ~ l ~ m e n t i n g computations of
x
the
8-26
EXAMPLE Vlll-6 WEAK TRA~ISLATIONOF A RECURSION S ~ 8 ~TO FLOWCHART SCHI~ Abbreviate subscheme:
Let the subscheme:
r /
~ /
Initial subschema:
l u ÷
gx v ~ gx
u ÷ gu v ÷ 8v
all i ~ r
0P
)
8-27
E X A @ L E VIII-6
(Continued)
Subschemes for updating the Pushdown store Simulation
Y
LU-~
0
$
~x I (sTop) .......
8-28
EXAMPLE VIII-6
(Continued)
Subschemes for updating the Pushdo~ store Simulation
(Continued)
Y
[
l U ÷
V
÷
gv
•
•
•
•
•
•
V
÷
gv
~ F ~ i /
8-29
EY~iPLE VIII-6 III.
IF
(Continued)
Subschemes for Sg~ulating the Recursion Scheme
EQUATION
i
IS:
Y k 'v+~
2/
F.x = F x
IF
EQUATION
i
IS:
F,x : F F x i P S
Y
v ÷ gv "'11 !
v
÷
gv
v
~- gv
8-30
EXAMPE
[iI.
VIII-6
(Concluded)
S u b s c h e m e s for S£mu£atJ~Ig the R e c u r s i o n Scheme
IF
EQUATION
F.x = t x l
t
i
IS:
terminal
Y
-
IF F.x = IF i
(Continued)
EQUATION Qx
THEN
V
|
X
÷
-iX
[
v
÷
gv
I
i F x i~
v
÷
gv
IS: ELSE
F x s
8-31
We relate a free ~nterpretation l(T)(gJx) = i
tl
with
:
0 s i s n
and
:
rand if
-->
(S,l,x)
Pl
if
I(T)(gJx) = $
I
of
S
there is a tape
I
WlX
in
S :
> w2x
converges in
n
---> .....
steps:
PI
is infinite,
l~nus Pl
contains the successive p u s h d o ~ store
contents of the pushdown store machine execut~_ng $$
converges; if
infinite and
(S~I)
separated by
$'s
(S,I,x)
does not eonverge~ the tape
I'
of
tI' = PI
I
or
to PI
P(S)
PI
is called "useful" if either
is finite and
I'
is "useless".
The scheme
P(S)
(S,I~x)
is infinite.
ti, = pi t'
PI
for some tape
is a record of the pushdown store contents of the machine executing
Otherwise
and
to represent the fact that the pushdown store is mnpty when
An extension
tI
if
: ~0$wlSw2$"'$Wn$$
and otherwise
ending in
aj : F i
and defining:
F0$Wl$W2$ .....
where ~nder interpretation
Fox
and a tape t I • by settglg
al...aj .....
Given a free interpretation
Pl
I
aj = $
is t' ;
thus
(S,I) .
is built to loop whenever
I'
is
"useless" so that we need only consider the effect of useful free interpretations of
P(S) . The variables
u
and
v
are used to ensure that an interpretation is "useful"
and to keep track of the proper equation to simmlate. to
gx .
Next the test
t I = F0$ .
Variables
T u
on and
with two heads which reads Initially we enter
-
tI
gx V
and then
and tries to verify that it is useful.
on free interpretation
tI
starts with
F0$
and
$
-
u
heads at
l(T)(gx) = 0 next page.
and
makes sure we start with
behave like the heads of a finite state acceptor
determining that v
ggx
Initially they are both set
that is,
I
-
subscheme
after
and having, figuratively speaking, both and
v
are both specified at
u
g2x
I(T)(g2x) = $ . This is shown at the top of the diagram on the
8-32
Initially, from S~fTkRT to
ro
Fo~ From
:
$
~ix
:
%x
:
. . . $ Y F i $ Y
TT
L1 V
To
:
• • -$
Y
Fi
$
y
~
T To
$
T
v
:
$
Y
Fi
$
Y
Fr
$
y
~T
L1
V
8-33
Now suppose that at some step in the computation of subscheme
where
represents the proper pushdowm store contents through
tI
and have verified that the tape
cup--rent p u s h d o ~ argument of symbol of
y
and "head"
(or on
second p i c t ~ e If
store co.ntents~ variable
Fi ,
then
u
v
tI
sym~l
of
y
and
"$"
and head
v
is the
at the rightmost
This situation is d i a g r ~ e d
gv
v
as
having checked that '~$" and
tI
on page 8-32,
ensures that
starts with
v
on the last
Finally in subscheme
to the last
gv ,
and tests that this yields
F0$Wl$...$Y~rSyFr$Y
u
F0$Wl$...$YFi$Y yF i , yF i
contains the proper value of the
first reassigns
to
is on the next to last
starts with
starts with
There are four possibilities.
third picture on page 8-32. that
x
is sitting on
y = e ) .
P(S)
r , reassigns
it enters subscheme ~nd head
if
from the top.
Fix = F x
tests to
$
u
tI
(P(S) ,l,x) , we are at
P
$
under
gv T .
Thus
F0$Wl$...$YFiSyFr$ "$" . 1 ~ s
is the
the computation verifies
by moving head
v
to the rightmost
'~$" ~ncountered to date.
In the process it
observes that
F is the top of the last complete pushdowm store and so proceeds to r as shown in the last picture on page 8-32. If the simulation was
subscheme
"correct" at
oF,i> ,
it is still correct.
Second, suppose subscheme
F~x = F F x . This case appears on page 8-34. First in l r s we verify that l(T)(gv) = r ~ then l(T)(ggv) = s and fiz~ally
l(T)(gggv) = $ . v
to the last
This checks that
"$"
with
u
tI
starts
F0$Wl$...$YFi$yFFs$
still on the next to last
picture on the next page; this situation holds as we enter subscheme verify that
tI
"$"
to the last
Fs
~nd
v
starts with
F0$...$YFi$YFrFs$YF r
and moves head
'~$" as sh~o~ in the second
as head
u
P .
Then we
moves to the last
"F " and we enter subscheme ~ b~v~ng noticed that r is the top of the last complete pushdown store contents foumd on t I to date.
Again, if the simulation was correct at
eF,i~
it is still correct.
Next, suppose that oF,i>
first tests
F.x = IF Qx THEN F x ELSE F x . In this case subscheme l r s l(Q)(x) and on I ~ behaves as if the equation were Fix = Frx
and on FALSE as if it were
Fix = FsX .
We have already illustrated this form of
behavior. Finally consider the case illustrated on page 8-35. top of the illustration. and
u
In moving from
to
oF,i>
tI
verifying that
the last
"$"
and
v
for
t
a term_4nal st~ring. ~ i s The case
Now we b~ve verified that
F0$Wl$...$y'FjFi$Y'F j
the next symbol on
Fix = tx
T~ere are two cases.
sits on the last
and move tI
tI
"$"
this time we reassign v
to this position.
y = y'Fj
is
appears on the
starts with
azld v
on the last
'Tj"
x + tx ~ veri~- that Then we pass from
"$~' is
starts with
to
F0$Wl$...$y'F.F.$y'F.$y' and moving u to J ~ c to the righ~most symbol of y' . Tb~s is shown in the top
three pictures of the illustration on page 8-35.
Again, everything checks out.
8-34
For
From
Fix
:
FrFsX
:
.
.
.
$
y
Fi$
y
IT
u
To
v
:
. . .
$
y
ri
$
y
rr
rs
T
l
kl
To
S
V
:
...
~
y
ri
~
y
%,
rs
~
y
%
T T
ii
v
8-35
For
Fix = tx
t
terminal
.Ether Prom
:
• . .
$
y'
F.
F.
$
y'
u
To
V
:
. . .
To
F.
$
y'
Fj
Fi
$
y'
Fj
$
$
y'
Fj
F,
$
y'
Fj
$
:
•
•
y'
-i
TT
U
e__ From
To
To
: ...
$
F.
...
$
ri
l
:
<STOP>
$
$
u
v
$
$
:
...
$
ri
v
v
8-36
In the last case, verified that "$"
F.x m : tx ~ t a terminal string and y : e so that we have starts with F0$Wl$...$Fi$ and both u and v sit on the last
tI
This is shown in the last three parts of the illustration on page 8-35.
reassign position. with
x ÷ tx ,
then check that the next symbol of
Now we move
F0$Wl$...$Fi$$
u
right and meet this
and this is
Pl
"$" .
"$" ,
and move
So we know that
We
v
to this
tI
starts
since the pushdown store contents are empty.
The computation ends and we go to the STOP statement placing the current contents of x
in the output register Znus if
I
is a useful free interpretation of
the restriction of (P(S),I,x) pretation
I
converges, I ,
then eventually
z .
S
P(S)
simulates
S
on
then
So for any useful inter-
(P(S)~I)
val(P(S),l,x)
I'
tl, = pl t'
= val(S,l,x)
is strongly equivalent to
(P(S) ,I,x)
free interpretation
,
S ; if computation
.
(S,I) .
encounters a "woong" symbol on
other hand, any free interpretation
divergent and
P(S)
to the functions and predicates of
of
P(S) for
is weakly translatable to
I
S
I
tl' = Pl
convergent and any choice of
as desired,
is useless,
and loops.
On the
alone has an extension to some useful
according to the formula
(S,l,x) P(S)
of
If tI
m
for t'
(S,l,x) Hence
A-I
APPENDIX
A
PROGRAM S C I ~ E S A ~ [ D
-
I~{E FIRST ORDER PREDICATE CALCULUS
We wish to present a few of the basic ideas of the first or~der predicate calculus, using as a starting point the ideas of h~terpretations of schemes which we ~ v e
already encountered.
We are dea_ILng with a particular f o c a l metal~ngdage which extends the metalanguage used to define and describe program schemes.
The alphabet used contains
the symbols used in defining program schemes: variables constant s function letters predicate letters parentheses and commas but adds to them equality symbol:
=
logical symbols:
A ,
quantifiers:
~ ~
V ,
] ,
n ,
V
We extend the definition of terms to give us (extended) functional terms, atomic formulae, and well-formed formulae.
DEFINITION
All these are defined inductively.
The following expressions ~re functional terms.
i)
If
x
is a variable,
x
is a f~nctional term.
2)
If
c
is a constant,
c
is a functional term.
3)
If
f
is an
then
f (t I , .... t n)
DEFINITION I)
If
F
then 2)
If
n-placed function letter and
DEFINITION
are functional terms,
is a functional term.
A~ atomic formula is defined as follows. is an n-placed predicate letter and P(tl,...~t n)
tI
tl~... ,tn
and
t2
tl,...,t n
are functional terms,
is an atomic formula.
are functional terms, then
(t I = t 2)
is an atomic formula.
A well-formed formula (wff) is defined as follows.
!)
Every atomic formula is a ~ f .
2)
If
x
is a variable and
3)
If
~
&rid 8
~
is a wff, then
3xe
and
Vx@
are wffs.
are wffs, then the following are wffs:
A wff formed without any application wff containing no usage of
" - "
of 2) is qua~ntifier-free.
is a ~ o l e a n
expression.
A quantifier-free
A-2
The qumntifier " ~x "
" Ix "
is usually translated "there exists an
is translated as "for all
x "
x "
while
We shall give more precise semantics for
these symbols by extending the concept of an imterpretation to a wff.
First we
must distinguish between those variables appearing "free" in a wff and those which are "bound" by the q~sm~tifiers.
DEFINI'FION
These definitions are also inductive.
Any appearance of a variable in a wff is either free or bound by these rules :
i)
Any appearance of a variable in a quantifier-free wff is free.
2)
A variable appearing free in a ~ff
e
appeams free in
appearance of a variable in
~
is free in
(c~ ~ 6 )
and
and
y
(c~-
~)
~
or
If
are distinct variables and
4)
Any appearance of a variable
is free in,.3y~
or
Vye
~
x
- Q(x)) .
x
is bound in
Variable
x ;
-
and
Vx@
for any wff
(]((x : c) - (y = z)))
is free and variable
it ~s not a function of
more complieated~ e.g. in the wff x
x
3xe
y
e .
or
is bound in ~ f
this wff, as we shall shortly see: can be regarded as a
formula of one variable,
appearances of
e .
that is not free by (i) - (3) is boumd% in
For example: all variables appear free in
(VyP(x,x,y) -: Q(x)) ~
(~ ^ ~)
is a wff, then any appearance of
if it is free in
particular, any occurrence of
(P(x~f(x):g(x,z))
(~ v B) ,
.
3)
x
x
,
(]e) ~ a free
in
second two appearances of
y .
The situation can be
(Vx~yP(x~x,y) D (]VyP(y,x,x)))
P(x,x,y)
-
x
P(y:x,x)
in
, the fiT'st two
are bound by the quantifier are free.
x
but the
When we wish to avoid
this sort of eonfusion~ we can restrict attention to "pretty wffs" in w%ieh either every appearance of a variable
DEFINITION
x
is free or else every appearance of
Every atomic formula is a pretty R~Y.
2)
Let
be a variable.
and all appearances of 3)
Let
~
and
(@ A S) ~ x
6
x
If x
~ in
is a pretty wff such that e
be pretty wffs.
(~ n ~) ,
such that
in
is bound.
The following wffs are preLty %ffs.
i)
x
x
and
are free, then _~nen (]~)
(e e 6)
appears free in
3x@
and
x
appears free in ~x@~ are pretty wffs.
is a pretty wff.
The ~ffs
(~ v 6)
are pretty wffs unless there is a variable e
but bound in
B
or free in
6
but bound
e .
DEFINITION
A sentence is a wff w£th no free variables.
A pretty sentence is a
pretty wff with no free variables.
Now we must define interpretations for functional terms, atom&c formulae, ~.~fs and sentences.
Basically we have as before;
A-3
DEFINITION
~n interpretation
assignment of each constant
c
!
consists of a nonempty domaJ~
to a member
i) for each n-placed function letter
f
2) for each n-placed predicate letter I(P):
l(c)
of domaJ~l D
a total function P
D
and an
and D n + D , and
l(f):
a total Boolean function
n n + {~UE,rALSE}
First we must extend the definition of this purpose we consider any member
a
i
to arbitrary functional terms.
of the domain
D
of
I
For
to be a functional
term.
DEFINITION
We define
l(t)
for a functional term
t
not contaL-~Jmg a variable
by:
i)
For a constant
2)
For a member
3)
If
a
tl,... ,tn
c ,
I(c)
of
D ,
is the member of
D
assigned to
o .
I(a) : a .
are functional terms not containing variables, and
f
is an
n-placed functional letter, then I(f(tl,...,tn)) : I(f)(I(tl),...~I(tn))
DEFINITION variables
If
t
is any functional term containing precisely the
Xl,... ,xn
l(t):
Dn ÷ D
where
t(a l,...,a n )
•
and no others~ then by
defined by
l(t)
l(t)(al,...,a n) = I(t(al,...,a~))
is formed from
t
n
distinct
we mean that function,
by substituting
ai
for all for
xi
al~...,a n ~ D, everywhere.
We can make similar definitions for atomic formulae.
DEFINITION I)
If
P
We define
I(~)
for an atomic fo:cmula
is an n-placed predicate letter and
~
not containing a variable by:
tl,... ,tn
are functional terms not
containing veriables, then l(P(tl~..,,tn)) = I(P)(I(t I) .... ~l(tn)) 2)
If
tI
and
t2
are functional terms not containing variables, then I TRU]~
I((t z : t2))
DEFINITION variables I(~):
~
Xl,... ,xn
in
everywhere.
if
i(t I) = I(t 2)
~ FAi.~E otherwise
is any atomic formula containing precisely the m~d no others, then by
D n ÷ {TRU-E,FALSE} defined by
al,... ,an xi
If
:
D , where
I(~)
n
we mean that Boolean function,
l(~)(al,...,a n) = l(~(al,...,an))
~(al,... ,an)
distinct
is formed from
e
for all
by substituting
ai
for
A-4
Thus be.
So
" - "
is interpreted as equality, relative to
l((f(x) = f(x))(a)
a
of the domain of
I
and
a ~
particular FALSE. and
I ,
but
l((f(a) : g(a)))
for example, if I
l(f)
D
z
denoted by
as we intend it to I
may be TRUE or FALSE, depend~mg on are the same function for a l(f)(a) ~ l(g)(a)
is
" v "
is
f(g(f(x,y)),f(y,z))
"OR"
is that function of variables
" ] "
is
Connective
"NOT"
" n "
is
" ^ "
4)
5)
while
We now give the formal defLnitions of
In this definition~ recall that we allow members of the domain of
Let
e
and
6
TRUE
3)
"AND" ,
"IMPLIES"
be w~ffs which contain no free variables but might
contain free occurrences of members of the domain of interFretation
2)
is
to play the same role as constants or free (but not bound) variable in wffs.
DEFINITION
i)
Informally, they
Occasionally we use the English words rather than the
formal sym~eols as a matter of convenience.
I
if
a = 0 .
((x+y) 2 + (y+z)) .
"IF AND ONLY IF" .
these concepts.
it is
l(g)(a) = a 2
I(P)(g(a)) : TRUE
if and only if
Now we must explain the semantics of the logical connectives.
" z "
~
l(f)(a,b) = a+b ,
l(g(f(b,a))) : (b+a) 2 ;
have meanings you are probably acquainted with. connective
and any member
a = 0 , then we can compute:
l(P)(a) : TPJ~E
For this interpretation, e.g., and
l(g)
is the integers,
l(P)(a) = TRUE if and only if
l(f(a,g(b))) = a+b 2 ;
x,y
and
then it will always be TRD~ while if
As another example, if
and only if
I ~
will be TRUZ for any interpretation
l((]e))
I((~
v 8))
l((e ^ 5))
I((~ ~ 5))
I((~ ~ B))
if
l(a) = FALSE
FALSE
if
I(~) : 17{UE
TRUE
if
efther
FALSE
if
both
TRU~
if
I(~) = I(~) = TRUCE
F~SE
if
either
I .
=
I(~) = TRUE
or
I(6) : TRUE
=
I(~) : FALSE
and
I($) : FALSE
:
I {
TRUE
if
I(~) = FALSE
I(~) = FALSE
FALSE
if
!(~) = TRUE
TRUE
if
I(~) : 1(8)
FALSE
if
I(~) m I(B)
or and
or
1(5) = FALSE
I(5) = TRUE 1(8) = FALSE
Then
A-5
There are one or two points to notice in this las~ definition. significance of the implication symbol " ~
IMPLIES
@" ,
wff
~
8
is IPJ~ or
~
in 4).
is the "hypothesis"
sentence has value TRUE under m~d
" n "
I
if either
is ~ALSE and
@
and
e
8
and
B
is F ~ S E a n d
hypothesis is TRUE but the conclusion FALSE.
One is the
In a sentence
" ~ n B " ,
is the "conclusion". are TRUE r or
~
The
is FALSE
is only FALSE when the
Thus if
" ~ n 8 "
is TRUE and the
hypothesis is TRUE, we car~ conclude that the conclusion is TRUE; but if the hypothesis is FALSE we can make no coKment about the conclusion.. We sometimes say that such an implication is "vacuously TRUE" if the hypothesis is FALSE. We can readily show that the connectives AND and OR are associative in the sense tbmt
I((~ ^(B ~ Y))) : I(((~ ^ ~)^ y))
similarly
I((~ v(@ v y))) = I(((~ v @)v y)) .
to omit parentheses and write
for any interpretation
I
and
For these reasons it is customary
(~i ^ "'" ^ ~n )
or
(el v ... v ~n )
when, hopefully,
no ambiguity can occur~ the first expression is often called a conjunction of the conjmncts
~i,...,en
and the second a disjunction of the disjuncts
~l,...,~n
Now we must define the semantics of our sentences with quantifiers.
Notice
that in our definitions~ logical comnectives have precedence over qua~ntifiers. Thus in evaluating evaluate ~xP(x)
I((](~xP(x) ^ (]~x~yQ(x,y)))))
I((~xP(x) ^ (]~x~yQ(x,y))))~ and
evaluating
(]~x~yQ(x,y)) I(~xP(x))
and for each
a ,
~nd
examine
etc.
, we first peel off the NOT and
to do this, we evaluate the two conjumcts,
Finally we are driven inside and must start by
l(~x~yQ(x,y)) l(~yQ(a,y))
. ,
In the latter case we also go Lnwards,
etc.
This is implied by our next
definitions.
DEFINITION
Let
~(x)
other free variables.
i)
2)
where
l(3x~(x))
!(~xc~(x))
@(a)
DEFINITION
be a p r e t t y ~ f
as a free variable ~nd no
I TRUE
if there is an
a
~FALSE
if
l(~(a)) : FALSE
I TRUE
if
I(@(a)) = TRUE
i FALSE
if there is an
in
D
I : with
I(e(a)) = IRU~
= for all for all
a a
in in
D . D
: a
in
is the sentes.ce obtained by substituting
Let
@(Xl,...,x n)
l(~(Xl,...,Xn)):
~i+
D a
such that for
x
FALSE
I(~(a))
evert~There
£n
@ .
be a pretty ~ff eonta~ming as free variables all and
x I .... ,xn .
By
l(9(Xl,...,Xn))
{TR~,FALSE}
l(@(Xl~...,Xn))(al~...,a n) = l(@(al,...,an)) @(al~...~a n)
x
Then we can extend the definition of
only the distinct variables function
eontaining
is the result of substituting
we denote the Boolean
defined by setting for all ai
for
al:...,a n xi
in
everywhere
D , where ~n
@ .
A-6
One consequence of this definition which ~ I ! program verification is that (~x ~i ^ "'" ^ ~x ~n )
Vx(~ I ^ ... ^ ~n )
be important in applications to is logically equivalent to
in the s~nse that for any interpretation
l(~x(e I ^ ... ^ ~n )) = I((~x ~I ^ "'" ^ ~x ~n )) ~ quantification
( ~ )
distributes over conju~etion.
existential quantification disjunction
-
( ~ )
Ix ( S l v
(~x Sl v ... v 3x ~n )
'Ibis is not true of
but existential quantification distributes over
... v Sn )
-
I ,
in other words, universal
is logically equivalent to
while universal qumntification does not distribute over
disjunction.
DEFINITION
A pretty sentence
interpretation for
~ .
If
I
I(@) = FALSE
Pretty sentence I
such that
@
~-- (@ - ~) ~ (~ n ~) ,
is satisfiable If
]9
then
(consistent) if there is an I(~) = T R ~
for every interpretation
is valid (is a theorem) if
or, equjjalently,
If
~
I0~) : 'I~LE .
, we call
I , then
I(~) = TRUE
is inconsistent.
~-- @
in this case.
and
<
are said to be logically equivalent~ if
then we say that
9
logically implies
It is possible to define
I(9)
~ .
for any arbitrarT sentence
~ . We let
@(Xl,... ,xn)
denote a wff such t~mt each
wff, all
are distinct and no other variable appears free although all
xi
occurrences of
xi
may not be free.
for all and only free occurrences of same as for pretty sentences. wff
~(Xl,... ,xn) ~--
xi
a model
for every interpretation
is inconsistent~ we sometimes write }
~
I
is a variable appearing free in that
Then
9(el,... ,an )
x.l
Then the definition of
Note that for any wff
denotes substituting I0~)
@(Xl,...,x n) ,
ai
is the
there is pretty
such that
~x I ... ~x n (~(x I ....
,xn)
~ ~(x I .... ,Xn))
The advantage of using a pretty wff or pretty sentence is that if any occurrence of x
is free, all occurrences are free.
The disadvantage is that many more names of
variables may be needed for the bound variables.
APPLICAtiONS TO PROGRAM S C ~ S Suppose p(X,Z)
P
is a program scheme with
n
input mud
output variables and
is a pretty wff using the same alphabet of function, predicate and variables
symbols (possibly including constan~ symbols) where = (Zl,... ,zm) , free in
m
@ ,
appear free in
each
xi
and
zj
a variable.
X = (Xl,... ,x) That is, the
xi
and and
zj
appear
are all distinct, all occurrences are free and no other va_piables p .
An ~nterpretation
to be an interpretation of (p,I)(a~b)
=
@(X,Z)
I(p(a,b))
I
of
P
with domain
D
and to define a function for
a
in
Dn ,
b
in
Dm
can be considered
A-7
as shown above.
Thus it makes sense to say, e.g., that
with respect to
(p,l) .
(P,I)
is totally correct
m
DEFINITION
Scheme
P
and output criterion
is partially correct with respect to input criterion p(X,[)
correct with respect to
DEFINITION
Scheme
P
and output criterion
if for all interpretations
0~,I)
and
I ,
(P,I)
is partially
(p,l) .
is totally correct with respect to input criterion p(X,~)
correct with respect to
if for all interpretations
(~,I)
_
@(X,Z)
and
I ,
(P,I)
@(X,Z)
is totally
(p,I) .
When we omit the input criterion we assume that it is the "courtesy wff" TRUE, standing for any always true wff (e.g. Such a formula pretation
w~hich
I
p(X,Z)
and every
a
(x = x) ) .
can be considered to be functional if for every interin the domain of
I , there is at most one
~
for
l(p(a,b) ) = TRUE . 7he methods of Chapter III can be used to show that:
THEOREM A-i
Given an always halting program scheme
quantifier-free wff
p
such that
P
P , we can construct a
is totally correct with respect to TRUE and
p •
This is not necessarily true for schemes with loops.
The always halting scheme
in Example A-I is totally correct with respect to TRD~ and:
(((P(f(x)) ^ P(g(x))) n (z : h(x,x))) ^ ((P(f(x)) A(]P(g(x)))) n (Z = h(x,g(x))))A((]P(f(x)))o
(z = h(x,f(x)))))
We take a somewhat different approach in Chapter V in discussing partial correctness for arbitrary programs. quantifier-free wff letters of A program (P,I)
P ,
W(P,A,B)
special predicate letters
(P,I)
but also to
a program scheme
A
and
B
is thought to apply interpretation A
and
I(B) . An interpretation meanings to
From
A I .... ~An
B I'
W(P,A,B)([,Z)
output variables
Z .
one constructs a
extends
I
,
plus others I
to get input criterion
A I,... , A
not just to I(A)
P
.
to get
and output criterion
by using the same domain but attaching
which are tuninterpreted by
considered to be
P
which contains besides the predicate and function
I . The wff
W(P,A,B)
i.e., a function of the input variables
The main point of that chapter is that:
can be [
and
A-8
THEOREM A-2
There is an extension
V X V Y
if and only if
I'
of
I
which is a model for
W(P,A,B)
(P,I)
is partially correct with respect to
I(A)
and
I(B) .
This enables one to detail an interactive verification procedure for flowchart based programs such that if the procedure returns a yes answer, then the program is indeed partially correct with respect to the given input and output criteria. The catch, discussed in Chapter V and justified in Chapter VI, is that it may not be possible to find when
I'
I' .
In fact~ there can be no mec]h~nical procedure which,
exists, will eventually locate it and establish the validity of the
interpreted formula.
A-9
EXAMPLE A-I
TOTAL CORRECTNESS FOR AN ALWAYS HALTING SCHEME
START
y
÷
f(x)
F /
Z
+
\T
h(x,y)
y
+
g(x)
/ ¢" <
STOP
/ ÷
h(x,x)]
I
~his scheme is totally correct with respect to TRUE, and the wff:
(((P(f(x)) ^ P(g(x))) n (z = h(x,x))) A ((P(f(x)) A (]P(g(x))))n (z = h(x,g(x)))) ((]P(f(x)))n (z = h(x,f(x)))))
E-I
EXERCISES
CHAA°TER II
2.1.
~br this problem use only schemes without identity or reset statements (i.e. for (a)
y ÷ x , x
and
y
for
x
and
y
variables) om equality tests (i.e.
Given two schemes
P
and
P' ,
each with
variables, show how to construct a scheme equivalent to
(b)
P'
Given a scheme
if and only if
P
with
construct schemes ables such that lent to
(c)
x = y
variables) or constants.
P' P
n
P"
input and
and
P"
with
n
input and
m
output
P"
such tbmt
P
is totally
always halts.
m
output variables, show ~how to
n+l
input and
always halts if and only if
P'
I
output vari-
is strongly equiva-
P".
Prove that the termination problem (does
P
halt for all interpretations
and all inputs?) is decidable if m~d only if the total equivalence problem (do
P'
and
P"
always halt and give the same answer for all inter-
pretations and all inputs?) is decidable.
(d)
Prove that if the strong equivaleIlce problem (for all interpretations and all inputs do
P
and
P'
either both diverge or both halt with
the same answer) is decidable, then the termination problem is decidable.
2.2
Call
P
the set of program schemes under the linear form definition given
in Section (a)
C .
Consider the class
FI
of program schemes which enlarges
P
to allow
multiple assignment statements:
k.
(x 1 ..... Xn) ÷ (fl(Yll
..... Ylml)~""
'fn(Ynl .... 'Yr~.L )) m
Execution of such an instruction involves simultaneous assignments. For example, if at some stage in a computation under interpretation a
7.
is assigned to
x
and
b
to
y , execution of
(x~y) ÷ (f(x), g(x,y))
places
l(f)(a)
in
8 . Show that given scheme P in P .
x
and PI
in
l(g)(a,b) PI
in
y
and transfers control to
one ca~ construct a strongly equivalent
E-2
(b)
Now enlarge
k.
PI
to allow multiple-valued tests: i.e., instructions:
T(y I ..... yr )
m I ..... m t
which transfer control to i .
m. if the output of the test predicate is i Call this fm~mily of schemes P2 " Give formal definitions of
schemes~ interpretations and computations in
P2 " Devise a decent
(intuitively satisfying and not too long winded) definition lence" under w~hich each m ~ e r
of
P2
of "equiva-
is equivalent to some member of
P.
2.3.
For an interpretation
I
with domain
D
and for integers
(l,n,m)-predicate be any total function from
D n x Dm
(a)
input and
Let
P
and
Prove that
P' P
be two schemes with
n
is strongly equivalent to
P'
only if
(b)
~ :
(P,I)
(P' ,I)
P' ;
.
output variables.
I
and
(l,n,m)-
is partially correct with respect to
~
if and
~ .
(a) ~ devise means of expressing in terms of
correctness the properties:
equivalent to
m
is partially correct with respect to
Following the model of ~ial
let an
{TRUE,FALSE}
if and only if the fol-
lowing condition holds for every interpretation predicate
n,m
£nto
(P,I)
P
always halts~
P
totally
totally correct with respect to
@ .
Hl}rfS: (a)
In proving that the condition cited implies that
P =- P' ,
predicates like
(P,l,a)+ "
that
(P,I)
and
" ~@(a,b) = I~UE (P' ,I)
if and only if
diverge
for the smme inputs.
consider to show
1~nen establish
strong equivalence.
(b)
Consider predicates such as and conditions such as to any
2.4.
'~ ~a(C~b) : FALSE
" (P,I)
if end only if
a : c "
is not partially correct with respect
~ ."
Show informally that the transformations
in Example II - 4 take a scheme into
a strongly equivalent scheme (preserve strong equivalence).
2.5.
For the schemes in Example E - i, all with input variable variable
y ,
aind then
B - C , using a sequence of "easy"
prove that
A -= B - C .
x
and output
It may be easier to show first ~ra~nsform~tions
A E B
(i.e. substi-
tutions of one subprogram for another which clearly preserve strong equivalence)
E-3
to go from steps.
A
to
B
and
C
to
B .
Display and explain carefully all
If your explanations are clear enough and your steps are small and
comprehensible enough, no formal justifications need be given.
CHAFIER III
3.1.
Exa~d~ne Scheme
A
in Example E - 2.
the longest computation.
Prove that it always halts and fLnd
Then construct the simplest strongly equivalent
tree scheme you can find (its computation may or may not be shorter than those in the original scheme~ there is not necessarily a umique answer). There are at least two approaches to proving that the scheme always halts. You may list the addresses of assigrment statements executed, the respecifications of the
Yi
and what must be the value of
T(y i)
if the computa-
tion is to continue, making allowances for choices (compare our treatment of Example II - 3).
Or you may draw a version of the execution sequence
tree (as in Example III - I)~ reca~ding at each node only important information such as the address of the executed statement and the new values of the Yi
for an assignment or the values tested for a test statement; since we
always have ing only 3.2.
val(Yi,j) = fn(x)
for some
n , you ean save space by record-
n .
Repeat #3.1 for Schmne
C
in Example E - 2.
HI]'[~: This problem is very lengthy if done just by trial and error exmnple, the value of
z
on halting can be
fn(x)
for
n > 30 .
help first to notice that it suffices to consider ~ter?retations domain the integers,
l(f)(n) = n+l , and initial input
x = 0
-
for
It may I
with
and then
to prove small lemmas such as: If the cemputation enters point
B
val(y I) = i , val(y 2) = j
val(y 3) : k ~
for
i < ~ < j , either the computation_ halts or it eventually passes
points
6
and
i < k < j , l(T)(i) = I(T)(j) = 0
~ o n c e and enters point
val(y 2) = 2j+l-i , val(y 3) = k+2 , for
3.3.
with
and
8
with
and
I(T)(~) : i
val(y I) = j ,
l(T)(2j+l-i) = 0
and
I(T)(~) : I
j < ~ E 2j-i .
Improve the proof in Section
C
that freeness is undecidable by using the
correspondence problem to show that freeness is undecidable for schemes with one monadic predicate letter and two monadie function letters (i.e. show how to eonst~.~ct for
A
and
B
a scheme
two monadic functions such that
P(A,B)
respondence problem has a solution).
P(A~B)
with one monadic predicate and
is not free if and only if the cor-
E-4
3.4.
(open problem)
Is freermss decidable for schemes with one mmnadic function
letter and any number of monadic predicate letters7
3.5.
3.6.
Prove that it is decidable: (a)
Whether a liberal scheme is already free.
(b)
WYmther a liberal scheme is always halting.
(c)
Whether two liberal schemes are totally equivalent.
A scheme
P
is progressive if in every path through
P : whenever only
test statements intervene between sLn assigrment statement and a subsequent assignment statement of the
Yi
-
u + f(vl,...v r)
v ÷ g(Yl"'" 'Ys ) ' then
u
is one
i.e., the assignment location of each assignment statem~ent
must be one of the retrieval locations of the next assignment statement if any. (a)
Show that every progressive scheme is liberal and hence strongly equivalent to some free scheme.
(b)
Show that it is decidable whether a scheme is progressive.
(c)
Exhibit a liberal scheme which is not strongly equivalent to any progressive scheme.
3.7.
An independent -variable (IV) scheme assignments of the form
y + f(y)
~ o v e that given an IV scheme equivalent free IV scheme
3.8.
P
R where
contains only monadic tests and f
is a monadic function letter.
we can effectively construct a strongly
P' .
Prove that for a program scheme
P , the domain
U(P)
of a free interpreta-
tion is always a context-free language.
C}~PTER IV
4.1.
Examine the lattice of implications among the various types of structural similarity defamed in Section
A .
Justify the absence of other lines in the
upper quadrangle by finding: (a)
two schemes that are strongly structurally similar but neither is a homomorphic image of the other, and
E-5
(b)
two schemes that are _not strongly structurally similar but one is a homomorphic image of the other.
4.2.
Repeat #4.1 for the next quadrangle by finding: (a)
two schemes that are structurally similar but not strongly computationally isomorphic, and
(b)
two schemes that are strongly computationally isomorphic but not structurally similar.
4.3.
Complete #4.1 and #4.2 by finding: (a)
two schemes that are computationally isomorphic but not stm~ongly computationally equivalent,
(b)
two schemes that are strongly computationally equivalent but not compurationally equivalent, and
(c)
two schemms that are strongly equivalent but not computationally equivalent.
4.4.
Prove the Block Replacement Lemma. can be a subblock of
B
-
(Notice that the difficulty is that
i.e. a subgr_aph which is a block
-
Bl
without
having been added as a block. )
4.5.
Examine scheme
A
in Example E - 3.
Find a tree-like scheme division of
4.6.
A'
Prove that if
A'
Show why scheme
strongly equivalent to
into major blocks, as in Example
B
A A
is not tree-like. and then exhibit the
IV - 4.
is a well-sv~_uctured scheme~ then:
DO
B
tSYfiL Q(u)
DO
B
~IL
ENDU~TIL
and
NOT
are well-structured schemes.
@ (u)
BDm~TIL
1~eir semantics appear in Example E - 3,
Diagram 2.
4.7.
Prove that the extended test statements in (2) in Section tured schemes.
E
are well-struc-
E-6
4.8.
Complete #4.5 by finding an extended I,~{ILE scheme strongly equivalent to Scheme
A
of Example E - 3.
CF~-~TER V
5.1.
(a)
For scheme
Pl
and the tagged points indicated on Diagram i of Example
E - 4 write out in terms of
f,g,c,A,B,A , and
tion conditions necessary to prove
(b)
Now let
I
c
at
is TRb~E if and only if
~,~HIIZ ... DO... B~WHILE
Now assign
A
and
B .
n = 0 . Express the program IF ... %~r~N ... ELSE ... ENDIF
A(x)
: x >_ 0
A (x,Yl,Z)
:
B(x,z)
(PI,I)
(PI,I) and
etc.
(0 E Y l
AB(X,Yl,Y2,Z ) :
Show that
partially correct for
0 , I(f)(n) = n + i , l(g)(n) = n - 1 , and
as a stt0uctured program using
(e)
the path verifica-
be the interpretation with domain the natural nmmbePs set-
ting constant l(T)(n)
PI
A8
t-x) ^ (z = 2x-yl)
(0
: z : 2x
is partially correct with respect to
first generating the verification conditions for choice of inductive assertions
A
and
A@
(PI,I)
A
and
B
by
and this
and of input predicate
and then checking the verification conditions.
B ,
You may be reasonably
inform~l Ln establishing that the verification conditions hold for all x,Yl,y 2
5.2.
and
z
in the domain of
Consider structured program
(P2,1)
already interpreted WHILE program. and only if B(x,z)
I .
Ln Diagram 2 of Example E - 4 which is an Let the input predicate
A(x)
be true if
x
is a nonzero positive integer and let the output predicate 2 be true if and only if z : x Show that (P2,1) is partially cor-
rect with respect to A (x:Yl,Y2,Z)
and
A
and
B
by findir~g suitable inductive assertions
As(X,Yl,Y2,Z) for the tagged points, generating the
appropriate verification conditions, and showing that these conditions hold over the domain of the natural nu~ers.
You may be reasonably informal in
establishing that the verification conditions hold.
E-7
5.3.
Construct a structured progr_am (P3,1)
which is totally correct for
B
x
where
A(x)
is true if m~d only if z
is the
and
B(x,z)
is t~ae if ~nd only if
prime.
Start the process of verifying that your program is partially correct
by selecting appropriate tagged points in terms of the symbols to
the
only
At
Your program may use as constants only
n + i , n ± I , and
n = 0?
t ~ generating verification conditions
and then assigning suitable inductive assertions
A t . Then write out the conditions in full and informally cheek
them out.
C } ~
A
is a nonzero positive integer and th x prime; take 2 as the first
n.m
(check for zero) and
0,1,2 , as functions
(multiplication) and as predicates only
n = m?
(check for equality).
VI
6.1.
Complete the proof of Lemma 6.5.
6.2.
A scheme
P
is a 2-variab!e Lndependent variable (IV) scheme if it has
exactly 2 variables
Yl
and
Y2 ~ both of which are input, program, and
output variables, if it has only monadic tests, and if the only assignments are of the forms (a)
Yl ÷ f(Yl ) and
H1
and
H2 ~
show how to construct two 2-variable IV schemes
P2
such
that
M1
is equivalent to
Lr(M 2) ) if and only if
(b)
Y2 ÷ f(Y2 ) "
Given two two-tape one-way deterministic finite state acceptors
P1
M2
(i.e.,
P1
La(M I) : La(M 2)
is strongly equivalent to
Given two 2-variable IV schemes
PI
&nd
such that
MI
(c)
is equivalent to
M2
Lr(M I) :
P2 "
P2 ~ show how to construct
two two-tape one-way deterministic finite state acceptors
equivalent to
and
and
if and only if
PI
HI
and
H2
is strongly
P2 "
Show that the strong equivalent problem for 2-variable IV schemes is decidable if and only if the equivalence problem for two-tape one-way deterministic finite state acceptors is decidable.
(d)
Show tlnat strong equivalence is undeeidable for 2-variable IV schemes with resets (statements
HINTS:
In
VI - 5; in
(a) (a)
and
(d)
Yi + x
or
Yi ÷ Yj
for
i ~ j ).
you want constructions like E!
notice that now you are considering
La(M i)
ever~
E-8
not just on the diagonal and cannot start with but in
(d)
Yl ÷ x
Y2 ÷ x . In
(b) , it is perhaps useful to
t
from Section
D
of Chapter III.
TI~...Tk , a free Lnterpretation
I
will correspond to an input
i
of the form
tli = P01...P0kfl...Pml...Pmkfk+l...
P0j : I(Tj)(Yi) ' Pmj = I(Tj)(fm(Yi))
and
(Pl,l,x)
fk+l...fl(Yl) ~ the behavior of computation with the behavior of
R~
Y2 + f(x) ;
or
first employ transformation
to Tape
and
you want to consider behavior on the diagonal~ since you are
now allowed to use
has tests
Yl ÷ f(x)
HI
on
If
PI
where
computes at some point
(P!~l~x)
is then correlated
(tll,tl2) , etc.
It is knom~ that the strong equivalence problem for 2=variable IV
schemes is decidable (see Bird, M., "The Equivalence Problem for Deterministic T~s-Tape Autemata,"
6.3.
J. Commuter System Sciences, 7 (1973) 218-236.)
Prove that the following are undecidable for 2-variable independent variable schemes (a)
PI
mnd
P2 :
whether there is any free interpretation (P2~l,x)
(b)
whether
HINTS:
In
PI
is weakly equivalent to
(P(A)~I,x)
P(A)
and
and
come of tests on
fm(y 2)
PI
and
HINT:
PI
n
In
members of
is defined.
P2
A
if
respondence problem, for
fm(y I)
to
(or. B ) and the out-
PI
is an extension of (A:B)
(a) .
val(Pl,l~a~ : val(P2,I,~D
is an extension of
Use a construction similar to the one in 8.8. P(A)
for
Prove that for 2-variable IV schemes
it is undecidable whether
output values so
I
(b) , modify the construction of
is an extension of
val(P2~I~a) P2
such that there is an
(A,B)
to write out that member~ combine the ideas of
Examples IIl - 3 and VI - I.
whenever
and
halt if and only if the corres-
Use the outcome of tests on
indicate the n~mJner of one of the
Recall that
(Pl,l~x)
P2"
P(B)
(P(B)~I,x)
pondence problem has a solution.
6.4.
such that
(a) , use the Correspondence Problem; construct for
two 2-variable IV schemes which both
I
both halt.
P(B)
P2 "
This t£me~ set the
if and only if the cor-
has no solution.
6.5.
Prove that the two problems in 6.3a and 6.4 are decidable for lanov schemes.
6.6.
Show that it is partially decidable whet~her a scheme is not free~
E-9
6.7.
A free finite partial interpretation assigns f
I
of a scheme
l(f)(tl~...~t n) = f(tl,...~t n)
and
tl,...,t n
in
has domain
U(P) ,
U(P) , but there is a finite subset
of
U(P)
T , T
interpretation
if it is a complete free interpretation
I
I'(T)
~nerever
(a)
I'
completes
I
is only defined on
D
such that for eaeh n-placed test
(i.e.
is everywhere defined for each predicate I
PI
converges but either
fails to be an extension of
(d)
PI
I
under which
is not an extension of
P2
if and only if
such that
(P2,1,~)
val(Pl,l,X) ~ val(P2,l,X)
PI
diverges.
P2 "
Show that for independent va_~iable schemes it is partially decidable whether
PI
Is
true for arbitrary schmrtes
(b)
whether
HINT: use
and agrees with
Show that for independent variable schemes it is partially decidable whether
(e)
I
(PI,I,~) converges with
or there is a completion of
(b)
T )
D n . A free
is defined.
Show that a scheme
there is a free finite partial Lnterpretation
6.8.
P
for each n-placed function letter
In (b)
PI
is not strongly equivalent to
is it partially decidable
fails to be an extension of
(b) ~ assume
PI
and
P2
P2 "
P2 ?
to be free and use
(a) ~ in
(c) ,
.
Use the definition of progressive in. Exercise 3.6.
M o d i f y the proof that
strong equivalence is decidable for lanov schemes to show that strong equivalence is decidable for progressive schemes.
O~APTER VII
7.1.
Let
R
be the family of recursion schemes.
obtained by ex~ending
R
F(Ul,...,u n) = IF where
Q
(a)
Q
u I ,... ,un
R'
R'
be the family of schemes
E1 E1
ELSE
E2
and
E2
are recursion expressions
as variables.
Complete the definition of in
THEN
is a Boolean expression and
involving only
Let
to allow equations
R'
by providing semantics
computes a function render an Lnterpretation.
-
how a scheme
E-IO
(b) 7.2.
Show that
R
and
R'
are effectively intertranslatable.
Prove that the f~m~lies of rec~0rsion schem~s and of simple reoursion schemes are effectively intertranslatable (Lemma 7.4).
7.3.
Prove that the families of linear recursion schemes and of simple linear recum.sion schemes are effectively intertre~nslatable (Le~ma 7.4).
7.4.
Prove that any always halting reeursion schemes is flowchartable (Proposition 7.8).
7.5.
Let
P
be a recursion augmented flowchart scheme.
macroexpansion of 7.14 ).
7.6.
P , then
P
Show that if
is strongly equivalent to
P'
P'
is a
(Corollary
Give an algorithm for performing a complete first level macroexpan-
sion of
P .
Let
be the class of recursion augmented schemes defined in Section
PR
of Chapter VII.
Constable and Gries define a slightly different class
using an alternative method of parameter passing. a main scheme and procedure definitions. tion
QF
D
A scheme in
P'R
P' R contains
In this case, a procedure defini-
contains at the start, in addition to a statement of formal para-
meters and local variables, a statement
RETOR~(z)
where
z
is a new vari-
able, the output variable~ which can also appear in the instmuetions and calls of
QF ' A call has the form
has formal parameters executes as if call
v ÷ F(Ul,... ,un) • If procedure
Xl,... ,xn , and output variable v ÷ F(Ul,... ,un)
x I' ÷ u I ~ ...
xn
T
÷
QF
z , then the scheme
were replaced by
u
n
Q'F v 4- z ~
where of
QF
x I' ~... ,xn' ,z' with
x i'
are new vm0iables, and
replacing
xi
and
z'
Q'F
importar~t point is that execution of the call of value of
Ul,... ,un
of the call
v
(as it does for schemes in
is respecified.
intertranslatable.
Prove that
is a copy of the body
replacing
PR
F
z
everywhere.
The
does not change the
PR ) but after completion and
P' R
are effeetively
Thus the method of parameter passing selected does not
affect expressive power.
7.7.
Construct a flowchart scheme augmented by one pushdown store strongly equivalent to the recursion scheme:
E-II
F(x) : IF
7.8.
P(x)
~-EN
x
ELSE
h(F(f(x)),F(g(x))).
Show that for any recursion augmented program scheme equivalent recursion augmented program scheme
P'
P
there is a strongly
using only one proced~0re
F . Consider the translations between recursion and pushdown store
HINT:
augmented schemes.
7.9.
Construct an £mplementation of
leaftest(A,p,T)(x)
using only two push-
down stores but allowing instructions of the form:
IF
IS EMPTY~ TRANSFER TO
z.
r , ELSE TRANSFER TO
s
l
where
~i
can be pushdown store
are addresses.
zI
or pushdown store
Then construct an implementation for
~2 ' and
r
m~d
s
Eleaftest(A~p,T)(x~y~z)
using only two pushdown stores and not pemnitting such instructions (cf. Lemmas 7.28 and 7.29 and Corollary 7.31).
7.10.
Construct a recursion augmented scheme and all procedure bodies are trees
-
P
without iteration (the main scheme
no loops) and an interpretation
I
with domain the nonnegative integers and using only dyadic function, e(n,m) : n+m , constant only if
n = m ,
criterion " x
0
and predicate
such that program
(P,I)
E(n,m)
w~hich is true if and
is totally correct for input
is a nonnegative integer" and output criterion " x 2 = z '~
Then prove that your progrmn is partially correct for the given input and output criteria. HINT:
Use the fact that for
n _> I , n 2
is the sum of the first
n
odd
n~ombers.
C~I~OTER VIII
8.1.
Prove that the class of monadic recursion schemes is effeetively intertranslatable with the class of sLmple monadic recursion schemes.
8.2.
Prove that the class of linear monadic recursion schemes is effectively intertranslatable with the class of simple linear monadic recursion schemes.
E-12
8.3.
Prove that for monadic recursion schemes lent to
S'
if and only if
preted value language of
8.4.
S
and
S' ,
L#(S) = L#(S') , where
S
L#(S)
is strongly equivais the inter-
S .
Prove that the reversal of the interpreted value language of a right linear monadic reoursion scheme is a regular set (Corollary 8.6).
Give an example
of a iLnear monadic reeursion scheme wP~dn is not strongly equivalent to amy right linear monadic recursion scheme.
E-13
~I
E-I
-
DIAGRAM
i
START
,,)
't y ÷ f(x)
k
y ÷ f(y)
I z ÷ f(x)
+
Scheme
A
E-14
~ A M P L E E-I
-
DIAGRAM
2
START )
Yl ÷ f(Yl )
Y2 ÷ g(Yl 'Yl )
\
i Yl ÷ f(Y2 )
I y2*f~y2-----~
z ÷ f(x) ~--~
Scheme
B
STOP
,,)
E-15
EXA~[PLE E-I - DIAGRAM 3
START
}
I Yl÷ f(x) t >I Ys ÷ f(Yl)
.l I[ Yl ÷
f(Yl )
IY2+g(Y3'Y3) 1 Y4
÷g(Yl'YI';' I
Yl + f(Y4 )
t !
Y2 ÷ f(Y2 ) 1 t
Y4 + f(Yl )
Y2 + f(Y4) ""'~ !~ ]
Scheme
C
z ÷ f(x)
STOP
}
E-16
EXAMPLE E-2 - DIAGRAM i SCHEME A
START
Input Variable x
)
C~atput Variable z
i
Program Variables Yl 'Y2
YI ÷ f(x)
Y2 ÷ f(Yl )'']
1 0
| Yl ÷ f(Yl) |
t
,
1
E-17
EXAMPLE E-2
DIAGRAM2 SCHK~E B
Input Variable x
START
I Y2 + f(x)
Output Variable z Program Variables Yl ~Y2
1
/
Y2 + f(Yl ) '"'li J
1 0
IY2
2
(Y2)
I
Yl ÷ f(Yl) I !
1
E-18 EXAMPLE E-2 - DL%GR~/"I3 SCH~ C
Input Variable x Output Variable z
Yl + f(x) Y2 ÷ f(Yl) Y3 ÷ f(Y2) "~I ~ I Y2 ÷f(Y2)'.'l
~i ~
0
E-19
EXAMPLE E-3
- DIAGRAM i SC_~i~E A
START
I
)
x I ÷ f(xI)
x I ÷ f(xI)
x I ÷ g(xI)
x 2 ÷ f(x2)
x 2 ÷ g(x2)
x 2 ÷ f(x 2)
i
~
Xl ÷ g(xl) x 2 ÷ g(x2)
I I
0
~I I f
X ÷ h ( X l , X 2 ~ T(~ ) ~ i
I
x I + h(x l,xI
L/
° Iz + h(xl,x2)
Input Variables Xl,X2 Output Variable
z
STOP
i
)
E-20
EXJ~vIPLE E-3
DO
-
DLAC~{
2
UNTIL
Let
B
be a single entry single exit well-structured schemes, which are not
zero entry or zero exit, m
variables, then
BI
Q and
be an m-placed predicate letter, &rid u B2
a vector of
are defined bel@~.
B2
B1
I....
BI:
DO
B
UNI'IL NOT
Q(~)
ENDUh[IIL
B 2:
DO
B
UNTIL
Q(~)
ENDU~]71L
E-21
EXAMPLE E-4
-
DIAGRAM i
SCHEME
PI
S%
)
A(x) Yl ÷ x Z+
z
A~(x'YI'Z)
~
C
÷ f(z)
z
FALSE
TRUE
B(x,z)~ STOP
Y2 ~ z m
A6(x,YI~Y2,Z)
TRL~
1
Y2 + g(Yl ) .....
z ÷ f(z) Y2 ÷ g(Y2 )
E-22
EXAJ2LE E-4
-
DIAGRAH 2
START A(x) yl ~- x y2 ÷ 0 z÷
0
Y2 ÷ Y2 + 1
h
"~ILE
Yl ~ 0
A~ (x,Yl,Y2 ,z)
DO Y3 + Y2
%
........WHILE ....
Y3 ~ 0
DO z+
Z+I
Y3 ÷ Y3 -" ENDWHILE Yl ÷ Yl ± i Y2 + Y2 + i Y2 + Y2 + i ENDWHILE STOP B(x,z)
STRUCZURED PROGRAM
(P2 ,I)
B-I
BIBLIOG~R~f Since this is a set of lecture notes rather than a research monograph ! have provided neither an exhaustive list of papers and books on the subject nor a c~monological account of who-did-what-when.
The bibliography simply contains a
chapter by chapter record of those articles which influenced
selection and
presentation of material ~ the books listed for Chapter VI and Appendix A (on logic and recursive fur~ction theor~y) are mea~nt to supply background material for the interested reader.
My choice of references has no implications whatsoever as to
priority, superiority or significance, but simply reflects my own eclectic approach and personal idiosyncracies.
I apologize in advance to all those whose work would
have appeared in any complete or chronological listing.
CHAPTERS II AND III Garland, S. J. and D. C. Luekham, "Program schemes, recursion schemes, and formal language," J. Computer System Sciences, 7 (1973) 119-160. Luckham, D. C., Park, D. M., and M. S. Paterson, "On Formalized Computer Programs, ~' J. Computer System Sciences, 4 (1970) 220-249. Hanna, Zohar, "The Correctness of Programs," J. Computer System Sciences, 3 (1969) 119-127. Manna, Zohar, "Program Schemas," in Currents in the Thegry of Computing, Alfred V. Aho (editor), Prentice-Hmll (1973) Englewood Cliffs, New Jersey, pp. 90-142. Paterson, M. S., "Equivalence problems in a model of computation," Ph.D. Thesis, University of Cambridge, Cambridge, England, 1967.
CHAPTER IV Ashcroft, E. and Z. ~ n n a , "The translation of 'Go To' Programs to 'WHILE' Programs," Booklet TA-2, Preprints of the IFIP Congress 1971, Ljubljana, Yugoslavia, August, 1971. Dijkstra, E., "GoTo Statement Considered Harmful," Communications Association ComputLng H~e~h~.ery~ ii (1968) 147-148. Dijkstra, E., "Notes on Structured P r o g r a ~ g , "
in Structured Programming,
0. J. Dahl, E. W. Dijkstra, and C. A. R. Hoare (editors), Academic Press (1972) London, pp. 1-82.
B-2
CHAPTER IV (Continued) Manna, Zohar, "Program Schemas," in Currents in the Theorg of Computing_, Alfred V. Aho (editor), Prentice-Hall (1973) Englewood Cliffs, New Jersey, pp. 90-142. Meyer, A. R. and D. M. Ritchie~ "The Complexity of Loop Program~," Proceedings ACM 22nd National Conference, 1967, Psyehonetics, Narbeth, Pennsylvania, pp. 465-469. Mills, H. D., "Mathematical Foundations for Structured Progrmmf~qg," Report FSC 72-6012, Federal Systems Division, IBM, Gaithersburg, Maryland (1972). T#~If, W. A. ~ "progrmmmSmg without the Go To," Booklet T_A-3, Pre~rints of the IFIP Congress 1971, Ljubljana, Yugoslavia, August, 1971.
CHAPI~ZR V Hoare, C. A. R., "An Axiomatic Basis for Commuter Programming, T' C~m~nications Association for Computing i~chinery, 12 (1969) 576-580. Kernighan and Plauger, The Elements of Programming Style, McGraw-Hill, New York, 1974. 7King~ J. C. ~ "A Program Verifier," Ph.D. Thesis~ C~negie-Nellon b~iversity, Fittsburg, Pennsylvania, SeptenJner 1969. Manna, Zohar, "The Correctness of Programs," J. Computer System Sciences, 3 (1969) 119-127. Yeu~na~ Zohem, "~them~tioal ~eors~ of P~rtial Correctness," J. Computer System Sciences, S (1971) 239-253. Manna, Zohar, "Properties of Programs and the First-CkJer Predicate Calculus," J. Association Computing Machinery, 16 (1969) 244-255.
CHAPTER VI Davis, M., Computability and Unsolvability, McGraw-Hill, New York (1958). Garland, S. J. and D. C. Luckham, "Program Schemes, recumsion schemes, and formal l~ns~ages," J. Computer System Sciences, 7 (1973) 119-160. Hermes, H., EnumerabilitK_, Decidability, Computability, Academic Press, Hew York for Springer-Verlag, Berlin (1965).
B-3
CbLA2TER VI (Continued) Luekham, D. C., Park, D. M. and M. S. Paterson, "On Formalized Computer Programs," J. Computer System Sciences, 4 (1970) 220-249. Paterson, M. S., "Equivalence problems in a model of computation," Ph.D. ~l'hesis, University of Cambridge~ Cambridge, England, 1967. P6ter, R., Recursive Functions, Academic Press~ New York, 1967. Rutledge, J. , "On Ianov 's Program Schemata," J. Association Computing Machinery, ii (1964) 1-9. Yasuhara~ A., Recmrsive Function Theory and Logic~ Academic Press, New York, 1971.
CHAPTER VII Brown, S., Gries, D. and T. Szymanski, "Program Schemes with Pushdown Stores," SIAM Journal Computing, 1 (1972) 2%2-268. Constable, R. L. and D. Gries~ "0n Classes of Program Schenmta," SLAM Journal Computing:!
(1972) 66-118.
Hoare, C. A. R., "Procedures rand Parameters:
An Axiomatic Approach:" in
Symposium on Semantics of Algorith~£c Languages, E. Engeler (editor), Springer-Verlag, New York, 1971, 102-116. Paterson, H. S. and C. E. Hewizt, ~'Comparative Schematology," Record Project MAC Conference on Concurrent System 9 and Parallel Computation, Woods Hole P~ssachusetts, J1me 1970, ACH, 119-128. Strong, H. R., "Translating Recursion Equations into Flow Charts," J. Computer System Sciences, 5 (1971) 254-285.
B-4
CHAPTER VIII Asheroft, E., Manna, Z. and A. Pneuli, "Decidable Properties of Monadic Functional Sehemas," in Theory of Maehines-and Computations, Z. Kohavi and A. Paz (editors), Academic Press, 1971, pp. 3-18. Chandra, A., "On the Properties and Applications of Program Schemes," Ph.D. Thesis, Stanford University, Stanford, California, March 1973. Friedman, E. P., "Equivalence Problems in Monadic Rec~msion Schemes," Proceedings 14th Annual Symposium on Switching and Automata Theory, Iowa City, Iowa, !973, 28-33. Garland, S. J. and D. C. Luckham, "Program schemes, recursion schemes, and formal languages," J. Computer System Science_~ss,7 (1973) 119-160. Valiant, L. G., "The Decidability of Equivalence for Deterministic Finite-Turn Pushdown Automata," Proceedings 6t!~ Annual ACM Symposium on Theory of Computing, Seattle, Washington, (1974) 27-32.
APPENDIX A Enderton, H. B., A Mathematical Introduction to Logic, Academic Press, New York, 1972.
I-i
INDICES
In the Index of Notation and the Index of Terms, the page reference is usually to either the location of the appropriate definition or to the place where the notation or term is first introduced.
INDEX OF NOTATION
u ÷ t
assignment statement
2-1
I
interpretation
2-5
l(f) ,
function assigned by
I(T)
I
to
f,T
2-5
(P,I)
program with scheme pretation I
(P,I,7)
computation of
(P,I,~)+
computation
(P,I,[)
halts
2-8
(P,I~)+
computation
(P,l,a)
diverges
2-8
val(P,l,a)
output of
val(P,l,~)+
val(P,I,~)
is defined
2-8
val(P,l,~)+
val(P,I,F)
is undefined
2-8
T(~)
conditional transfer statement
r,s
(P,I) ~ (P',I')
(P,I)
P ~ p,
scheme p,
p _: F p-
p, R (P,I) = (P',I'
, p_-p,
>
(P~I) > (PT,I')
,
p>
<
(P,I) < (P',I') , P <
(P,I)
P
a~id inter-
(P,I)
on input
for input
a
2-8
a
2-8
2-10
strongly equivalent to P
2-G
(P' ,I' ) 2-17
strongly equivalent to
P
finitely equivalent to
P'
P
recursively equivalent to
P'
2-17 2-17
P'
2-17
weak equivalence
2-20
p'
extends
2-20
p'
included in
2-20
U(P)
Herbrand universe for scheme
Q(s,T,0),Q(s,T,I)
Q-sets
IS~SY
free interpretation from
T(P) , T'(P) , T*(P)
execution sequence tree
3-12ff
value language of monadic program
3-21
L(P)
scheme
P
3-1 3-3ff
P
s ~s '
3-9
1-2
computation record for
p(P,I,[)
IF
Q
B1
THEN
WHILE
Q
DO
B
ELSE
B2
~NDIF
]]{]~LE
(P,I ,a)
4-2
test added computation record
4-2
I F - T H ~ construction
4-33
~ILE
4-34
construction
n
dominates
m
n
back dominates
ch
m
n
chain dominates
m
4-36
cy
m
n
cycle dominates
m
4-36
n
d
n
bd
n n
m
m
4-35 m
4-35
V(P,a,A,B)
verification condition for path in scheme P
V(P,a,A,B,I)
verification condition for path a in program (P,I) with criteria A and B
5-3
w(P)
verification formula for scheme
P
5-9ff
W(P~A,B)
verification formula for scln~me and criteria A and B
P
5-10
W(P,A,B,I)
verification formula for program (P,I) and criteria A and B
5-10
I
w
W
5-29, A-6
A
{P}
s
[ - - A {P}
s
A
5-2
is a theorem
whenever A is true before P halts -then B is true
X
a
{P}
B
P
and
5-29
is a theorem
5-29
SE
result
M = (Ki,K2,Z,~,qo,qa,qr)
two-tape one-way determfnistic finite state aeceptor
6-3
set of pairs of tapes accepted by
H
6-3
set of pairs of tapes rejected by
M
6-3
in
%<M) %
set of pairs on which
Ld(M) La(M)
of substituting
~ D,Lr(H)
Q D , Ld(M)
Q D
E
for
x
5-29
s
M
diverges
intersections with diagonal
D
tz(E)
tape for interpretation expression E
P.l (M)
special schemes constructed from machine M
I , and
6-3 6-4 6-7
6-8
--
6-12, 6-21 6-23
1-3
F(y) = IF
T(u)
THEN
recursion equation
7-4
computation in recursion scheme
7-5ff
C I + C 2 ; C I -_< C 2
class class
7-i0
CI e C2
classes latable
CI
class CI translatable into class but not intertranslatable
C 2 7-ii
call of a proced,~e in a recursion augmented program scheme
7-34
parts of procedure declaration in reoursion augmented program scheme
7-35
(Q'QI ..... Qp)
recursion augmented program scheme
7-35
A
undefined
7-36
PUSH(u) ; POP
instructions in pushdom~ store augmented program scheme
7-51
A(v) ; i
notation in array augmented program
7-51
, E' ; E ~ >
E-->
<
ELSE
t'
E'
C2
F(Yl,...,y n)
c~
PROCEDURE
CI C2
translatable into CI
and
C2
intertrans-
7-10
F(Yl, ....yn )
DECLaSE KEW END
t
(Ul,... ,u)
F
S cheTile
+ L ; GOT0
instructions in label augmented program scheme
7-52
special classes of schemes
7-52, 7-53, 7-59
-unconditional transfer
7-53
leaftest (k ,p ,T)
special functional
7-62
Eleaftest (k p ~T)
special functional
7-66
v
P;
R~
PR;
PPDSL ; PA ; TRANSFER TO
PPDS ;
PAL ; PRL
r
induetive assertions associated with procedure POP(u) ; PUSH(u,A) ; TOP (u ,A)
EHFi~Xu)
;
7-67 F
instru~tions for simple pushdown store augmented program scheme
8-4
L(S)
value la~guage of reeursion scheme S
8-6
L#(S)
interpreted value language of recumsion scheme S
8-7
value languages of schemes in class C
8-9
~(C)
1-4
~#(C)
A ,V, I ,n, =- , 3,~
interpreted value languages of schea~es in class C
8-9
logical symbols
Appendix A
1-5
INDEX OF TERMS
acceptable construction
4-48
address
2-10
computation
2-6ff 2-11ff
2-10
complete terminated computation 2-7
ancestor
4-11
computation halts
array
7-51
transfer address
program scheme augmented by arrays assignment statement extended assignment statement
2-8
computationally equivalent
4-3
7-52
strongly computationally equivalent
4-3
2-1 2-i0
computationally isomorphic
4-3
4-44
strongly computationally isomorghic computation record
4-3 4-2
atomic formula
A-!
equivalent computation records
4-3
axiom of assignment
5-29
test added computation record
4-3
back dominate
4-35
computation state
2-6
block
4-14ff
conjunct; conjunction
A-5
block composition
4-14
consistent path
3-7
block iteration
4-15
consistent path set
3-7
block s~cructured program
4-15
constants
block replacement le~na
4-15 4-16
2-i, 2-4
block structure theorem
4-18 4-19
division into major blocks
4-207 4-23, 4-24
equivalence to tree-iJ~e graph
4-16, 4-17
subbloek
4-15
cormectness - see partial correctness ; total correctness oot~ter a u g m e n t a t i o n by one c o u n t e r
augmentation by two counters
8-4 8-6
critical point
4-53 4-54
cycle dominate
4-36ff
arbitrary Boolean expressions 4-46 in ~THILE eonstructions 4-48
decidable
6-2
partially decidable
6-2
in recursion schemes
7-11
disjunct; disjunction
A-5
type of wff
A-I
diverge
2-8
7-34
dominate
4-11, 4-35
Boolean expression
call
4-45
recursive call
7-42
first level call
7-42
entry node
4-6
canonical form
4-1
execution sequence
3-2ff
canonical transformation
4-1
exhaustive simplification procedure
6-2 Off
ey~it node
4-7
finite equivalence
2-17, 6-14ff
chain dominate
4-36ff
closed graph
4-30
I-6
finite state aeeeptor two-tape one-way deterministic 6-3ff finite state acceptor
Konig 's
3-10
label
7-52
program scheme augmented by labels
7-52
flowchartable recursion scheme
7-17ff
flow diagram
2-2
free program scheme
3-18
free tree program scheme
3-20
liberal scheme
3-32ff
free reeursion scheme
7-10
line-l~<e
4-37
locator scheme
7-56, 7-57, 7-61
logically equivalent
A-6
logically implies
A-6
LOOP prod'am
4-49
maeroexpansion
7-42
graph closed graph
4-37
single entry subgraph
4-6
single entry single exit graph
4-30
tree-like graph
4-11
zero entr~y graph
4-30
zero exit graph
4-30
graph homomorphic image
4-5
graph isomorphic
4-5
graph isomorphism
4-6
halt everywnere~ always halting
2-16
Herbrand universe
3-1
homomorphic image
4-4
strong homomorpi~ie image
4-5
lanov scheme
6-29ff
IF-THEW construction
4-33
construction
simply extended IF-THEN construction
complete first level macroexpansion
7-62 7-66
7-42
minimization
4-51
model
A-6
monadic program sc/neme
3-21
monadic reeursion scheme
7-13, 8-1ff
free monadic recursion scheme
8-13ff
parameters actual parmmeters
7-34
formal parameters
7-35
partial correctness
2-26
4-45
of a path
5-4
4-44
and verification formula
5-gff
of a scheme
A-7
incomparable classes of schemes
7-11
inconsistent sentence
A-6
induction points
5-10
inductive assertions
5-10
Infinity Leama
3-10
interpretation
2-5
compatible interpretations
2-22
finite interpretation
2-6
free Lnterpretation
3-1ff
Herbrand interpretation
3-1ff
minimal interpretation
2-22
of a wff
A-3ff
reeursive interpretation
2-6
intertranslatable
Eleaftest
4-30
line-like graph
extended I F - ~
leaftest
7-I0
Post Correspondence Problem
3-24
primitive recursion
4-49
primitive recursive functions
4-50
procedure body
7-35
procedure definition
7-35
program
2-6
program, scheme
2-2ff
always halting program scheme
3-13
free program scheme
3-18
free tree program scheme
3-20
linear form of a program scheme
2-10ff
monadic progrmm scheme
3-21
tree program scheme
3-13
1-7
pushdown store program scheme augmented by one pushdown store simple pushdown store
7-51
SZ~P program
7-51
strong equivalence
2-17
relative to I
4-6
of recursion schemes
7-10
8-4
quantifier
A-!ff
Q-sets
3-3ff, 3-18
reasonable equivalence
2-20, 6-20ff
reeursion augmented program scheme
7-35
recursion equation
7-4
linear recursion equation reeursion scheme
7-13 7-~4ff
computation in a recursion scheme
7-4ff
flowcb~a~table recursion scheme
7-17
linear recursion scheme
7-13, 7-26ff
monadic recursion scheme
structurally similar strongly structurally similar term
4-49
4-4 4-4 2-1 7-3
extended functional term
4-44, 7-3, A-I
extended predicate term
4-44
f~mnctional term
2-1
l~ear term
7-12
nont ermLna i term
7-3
predicate term
2-1
simple term
7-3
terminal term
7-3
very simple term.
7-3
7-13, 8-1ff
termNmate
2-8
linear monadic recursion scheme
8-!2
termination problem
2-16
test statement
right linear monadic recursion scheme
8-12
2-2, 2-10
total comrectness
left linear monadic reeursion scheme
8-12
2-26, 5-Sff, 5-14ff 6-26ff, A-7
total equivalence
2-19
right linear recursion scheme
7-33
simple reeursion scheme
7-!2
recursive
translation of scheme
7-2
translatable
7-2, 7-10
6-2
reeursive equivalence
2-i7
reeursively enumerable
6-1
effectively translatable
7-10
rule of composition
5-29
intertranslatable
7-10
rule of conditional statements
5-30
effectively intertranslatable
7-10
rule of consequence
5-30
weakly translatable
8-25
rule of iteration
5-30
tree-like
4-11
satisfiable
A-6
tree program scheme
3-13
sentence
A-6
tree with reinitializations
4-20
A-2
weak equivalence
2-20
single entry subgraph
4-6
well-formed formula, wff
A-I
single entry single exit subgraph
4-30
pretty sentence
STEP construction
pretty wff
A-2
quantifier-free wff
A-I
4-49 well-structured subseheme
4-31 4-32
1-8
ultimately periodic tape
6-3
valid sentence
A-6
value language of monadic program scheme
3-21, 8-7
of monadic recursion scheme
8-6
interpreted value language of 8-7 monadic recursion scheme variables
2-1
bound variables
A-2
free variables
A-2
global variables
7-35
local variables
7-35
verification condition
5-2
verification formula
5-85-gff
verification procedure
5-16ff
WHILE composition
4-34
~ I L E construction
4-34
partially extended WHILE construction
4-45
simply extended WHILE construct ion
4-44
WHILE program simple WHILE program ~v}{Ii~ scheme simple WHILE scheme
4-49 4-35 4-49 4-35
zero entry
4-30
zero exit
4-30
