TAPSOFT'87: Proceedings of the International Joint Conference on Theory and Practice of Software Development

Lecture Notes in Computer Science Edited by G. Goos and J. Hartmanis

249 TAPSOFT '87 Proceedings of the International 'Joint Conference on Theory and Practice of Software Development Pisa, Italy, March 23-27, 1987 Volume 1: Advanced Seminar on Foundations of Innovative Software Development I and Colloquium on Trees in Algebra and Programming (CAAP '87) Edited by Hartmut Ehrig, Robert Kowalski, Giorgio Levi and Ugo Montanari

Springer-Verlag Berlin Heidelberg NewYork London Paris Tokyo

Editorial Board D. Barstow W. Brauer R Brinch Hansen D. Gries D. Luckham C. Moler A. Pnueli G. Seegmeller J. Stoer N. Wirth Editors Hartmut Ehrig Technische Universit&t Berlin Fachbereich 20, Informatik, SWT FR5-6 Franktinstr. 28/29, D-1000 Berlin 10 Robert Kowalski Imperial College of Science and Technology 180 Queen's Gate, London SW7 2BZ, England Giorgio Levi Ugo Montanari Dipartimento di Informatica, Universit& di Pisa Corso Italia 40, 1-56100 Pisa

CR Subject Classification (1987): F.0-4 ISBN 3-540-17660-8 Springer-Verlag Berlin Heidelberg New York ISBN 0-387-17660-8 Springer-Verlag New York Berlin Heidelberg

This work is subject to copyright.All rights are reserved, whetherthe whole or part of the material is concerned, specificallythe rights of translation,reprinting,re-useof illustrations,recitation, broadcasting, reproductionon microfilms or in other ways, and storage in data banks. Duplication of this publicationor parts thereof is only permitted underthe provisionsof the German Copyright Law of September 9, 1965, in its versionof .June24, 1985, and a copyrightfee must always be paid. Violationsfall underthe prosecutionact of the German Copyright Law. © Sp~i'nger-VerlagBerlin Heidelberg 1987 Printed in Germany Printing and binding: DruckhausBeltz, Hemsbach/Bergstr. 2145/3140-543210

PREFACE

TAPSOFT '87 is the Second International Joint Conference on Theory and Practice of Software Development. TAPSOFT '87 is being held from March 23 to March 27, 1987 in Pisa. TAPSOFT '87 has been organized by Dipartimento di informatica (Universit& di Pisa), I.E.l. - C.N.R. and CNUCE - C.N.R., and has been supported by AICA and EATCS. TAPSOFT '87 consists of three parts: Advanced Seminar on Foundations of Innovative Software Development

New directions in software development have been proposed, on the basis of recent technological and theoretical advances. Following these trends, the software production process should be made more rigorous, and its result should be expressed in a more abstract and understandable form. The aim of the Advanced Seminar is to bring together leading experts in the various fields which form the foundations of this renovation still in progress and to provide a forum to discuss the possible integration of available theories and methods in view of their applications. The Advanced Seminar will consist of a number of invited talks, two panel discussions and several working groups. The invited talks will be either long, i.e. comprehensive and general, or short, i.e. dedicated to hot topics. Invited Speakers E. Astesiano (Univ. Genova) K. Clark (Imp. C., London) K. Furukawa (ICOT, Tokyo) J. Goguen (SRI, Menlo Park) G. Huet (INRIA, Paris)

R. Milner (Univ.Edinburgh) M. Nivat (LITP, Pads) J. Thatcher (IBM, Yorktown Heights) D. Warren (Univ. Manchester)

Panels • On Industrial Activity and Trends. Chairman: J. Goguen (SRI, Menlo Park) - The Future of Software Engineering. Chairman: D. Bj~rner (Lyngby)

The seminar organizers are H. Ehrig (Tech. Univ. Berlin) G. Levi (Univ. Pisa) R. Kowalski (Imperial College, London) U. Montanari (Univ. Pisa)

iv

Colloquium on Trees in Algebra and Programming Traditionally, the topics of the Colloquium cover a wider area of theoretical Computer Science than that indicated by the title. Actually, topics include the formal aspects and properties of trees and, more generally, of combinatorial and algebraic structures in all fields of Computer Science. Besides the customary topics, in keeping with the overall theme of TAPSOFT, the program will include contributions related to specifications, communicating systems and type theory. The preceding eleven colloquia were held in France and Italy as autonomous conferences, except in Berlin 1985, when for the first time CAAP was integrated into the TAPSOFT Conference. In keeping with the tradition of CAAP as well as with the overall theme of the TAPSOFT conference, the selected papers are presented in the sections listed below. • Algorithms • Proving techniques • Algebraic specifications • Concurrency • Foundations The program committee for CAAP '87 is the following: A. Arnold, Bordeaux J. de Bakker, Amsterdam B. Buchberger, Linz J. Diaz, Barcelona Ph. Flajolet, Paris H. Ganzinger, Dortmund P. Mosses, Aarhus J. Thatcher, Yorktown Heights M. Wirsing, Passau

G. Ausiello, Roma A. Bertoni, Milano M. Dauchet, Lille H. Ehrig, Berlin N. Francez, Haifa U. Montanari, Pisa (Chairman) M. Nivat, Paris G. Winskel, Cambridge

Colloquium on Functional and Logic Programming and Specifications In keeping with the overall theme of the TAPSOFT conferences, CFPL focuses on those aspects of Functional and Logic Programming which are most important in innovative software development. The integration of formal methods and practical aspects of software production is also stressed.

CONTENTS OF VOLUME 1 Session CAAP 1 Chairman: J. Diaz (Barcelona)

Algorithms I. Wegener (J.W. Goethe Univ., Frankfurt a. M.) On the Complexity of Branching Programs and Decision Trees for Clique Functions W. Szpankowski (Purdue Univ.)

Average Complexity of Additive Properties for Multiway Tries: A UnifiedApproach

13

M. Crochemore (LITP, Rouen & Univ. Paris-Nord) Longest Common Factor of Two Words

26

Session CAAP 2 Chairman: B. Buchberger (Linz)

Proving Techniques S. Ronchi della Rocca (Univ. Torino) A Unification Semi~A/gorithm for Intersection Type Schemes

37

B. Steffen (Univ. Kiel) Optima/Run Time Optimization Proved by a New Look at Abstract interpretations

52

F. Bellegarde & P. Lescanne (CRIN, Nancy) Transformation Ordering

69

Session CAAP 3 Chairman: M, Wirsing (Passau)

Algebraic Specifications ! M. Gogolla (Tech. Univ. Braunschweig)

On Parametric Algebraic Specifications with Clean Error Handling

8t

D. Sannella (Univ. Edinburgh) & A. Tartecki (PKiN, Warsaw) Toward Formal Development of Programs From Algebraic Specifications: Implementations Revisited

96

G. Marongiu (Univ. Bologna) & S. Tulipani (Univ. Camerino) Finite Algebraic Specifications of Semicomputable Data Types

111

The selected papers are presented in six sessions covering the following topics. ° Theory and Semantics of Functional Languages • Types, Polymorphism and Abstract Data Type Specifications • Unification of Functional and Logic Programming Languages • Program Proving and Transformation • Language Features and Compilation in Logic Programming • Implementation Techniques The Programme Committee for CFLP is the following C. BShm, Roma K. Furukawa, Tokyo C. Ghezzi, Milano G. Huet, Paris R. Kowalski, London B. Mahr, Berlin R. Milner, Edinburgh E. Sandewall, LinkSping D. Warren, Manchester

K. Clark, London H. Gatlaire, M~3nchen J. Goguen, Menlo Park G. Kahn, Sophia Antipolis G. Levi, Pisa (Chairman) A. Martelli, Torino L. Moniz Pereira, Lisboa E. Shapiro, Rehovot

The TAPSOFT '87 Conference proceedings are published in advance of the conference in two volumes. The first volume includes the final versions of 17 papers from CAAP '87, selected from a total of 51 submitted papers. The second volume includes the final versions of 17 papers from CFLP, selected from a total of 80 submitted papers. Invited papers from the Advanced Seminar are divided between the two volumes. We would like to extend our sincere thanks to all the Program Committee members as well as to the referees listed below for their care in reviewing and selecting the submitted papers: J. Alegria, A. Alfons, S. Anderson, J.L. BalcAzar, F. Barbic, R. Barbuti, M. Bellia, R. Bird, E. BSrger, P.G. Bosco, A. Bossi, G. Boudol, K. Broda, D. Brough, D. Chan, L. Carlucci Aiello, G. Castelli, T. Chikayama, T. Chusho, E. Ciapessoni, N. Cocco, L. Colussi, M. Coppo, T. Coquand, B. Courcelle, G. Cousineau, W. Coy, P.L Curien, A. Davison, P. Degano, R. De Nicola, M. Dezani, M. Dincbas, M Ducass6, P. Dufresne, J. Ebert, B. Eggers, P. van Erode Boas, R. Enders, G. Engels, K. Estenfeld, E. Fachini, A. Fantechi, I. Foster, D. Frutos, J. Gabarro, D. Gabbay, F. Galdbay, G. Gambosi, G. Ghelli, P. Giannini, M. Goldwurm, A. Goto, S. Goto, G. Guida, C. Gunter, T. lato, H. Habel, M. Hagiya, N. Halbwacks, H. Hansen, S. Haqqlund, J. Heering, P. Henderson, R. Hennincker, D. Henry de Villeneuve, C. Hogger, F. Honsell, M. Huntbaok, H. Hussmann, P. Inverardi, R.C.L. Koymans, L Kott, H.J. Kreowski, F. Kriwaczek, S. Kunifuji, Y. Lafont, B. Lang, R. Lasas, A.

VI Lavitte, P. Le Cheradec, K. Leeb, B. Lennartsson, J.J. Levy, M. Undqvist, A. L{amosi, G. Lolli, (3. Longo, J.A. Makowski, V. Manca, P. Mancarella, D. Mandrioli, M. Manny, A. Marchetti Spaccamela, I. Margaria, M. Martelli, L. Mascoet, Y. Matsumoto, G. Mauri, B.H. Mayoh, F. McCabe, J. Meseguer, J.J.Ch. Meyer, C. Moiso, B. MSIler, C. Montangero, K. Moody, A. Mycroft, F. Nickl, M. Nielsen, F. Nielson, F. N0rnberg, M.E. Occhiuto, F.J. Oles, F. Orejas, M. Ornaghi, R. Orsini, P. Padawitz, C. Palamidessi, D. Pedreschi, P. Pepper, A. Pettorossi, A. Poign~, A. Porto, M. Protasi, G. Ringwood, J. Roman, S. Ronchi Della Rocca, G. Rossi, I. Kott, T. Sakurai,D. Sannella, D. Sartini, T. Sato, R. Schuster, M. Sergot, D. Siefkes, M. Smyth, T. Streicher, A. Suarez, Y. Takayama, J. Tanaka, A. Tarlecki, W. Thomas, M. Tofte, S. Tomura, J. Toran, M. Torelli, J.V. Tucker, F. Turini, T. Yuasa, F.W. Vaandrager, B. Vauquelin, B. Venneri, M. Venturini Zilli, H. Wagener, E.G. Wagner, M. Wallace, P. Weis, M. Zacchi, B. Zimmermann

We gratefully acknowledge the financial support provided by the following institutions and Companies: • Comune di Pisa • C.N.R. • Presidenza • Comitato Nazionale per l'lngegneda • Comitato Nazionale per le Scienze Matematiche • CNUCE • I.E.I. ° Dipartimento di Informatica, Universit& di Pisa • Elsag, Genova • Enidata, Milano ° IBM Italia, Roma • List, Pisa • Olivetti, lvrea ° Selenia, Roma • Sipe, Roma o Systems & Management, Torino • Tecsiel, Roma • Universit& di Pisa

vii We wish to express our gratitude to the members of the Local Arrangement Committee: P. Asirelli, R. Barbuti, P. Degano (Chairman), A. Fantechi, P. Mancarella, M. Martelli, F. Tarini and F. Turini. Without their help, the Conference would not have been possible. Pisa, March 1987 Hartmut Ehrig Institut for Software und Theoretische Informatik Technische Universit&t Berlin

Robert A. Kowalski Dept of Computing and Control Imperial College London

Giorgio Levi Dipartimento di Informatica Universit& di Pisa

Ugo Montanari Dipartimento di Informatica Universit& di Pisa

Session CAAP 4 Chairman: G. Winskel (Cambridge)

Concurrency G. Boudol & I. Castellani (INRIA, Sophia Antipolis) On the Semantics of Concurrency: Partial Orders and Transition Systems

123

R. De Nicola (I.E.I., Pisa) & M. Hennessy (Univ. Sussex) CCS without ~'s

138

Ph. Darondeau & B. Gamatie (IRISA, Rennes) A Fully Observational Mode/ for Infinite Behaviours of Communicating Systems

153

Session AS4 Chairman: R. Milner (Edinburgh) E. Astesiano & G. Reggio (Univ. Genova) SMoLCS-Driven Concurrent Ca/curl

169

Session CAAP 5 Chairman: H. Ganzinger (Dortmund) Algebraic Specifications II

M. Navarro (Euskal-Herriko Univ., San Sebastian) & F. Orejas (Univ. Pol. de Catalunya, Barcelona) Parameterized Horn Clause Specifications: Proof Theory and Correctness

202

F. Parisi-Presicce (USC, Los Angeles) Partial Composition and Recu'rsion of Module Specifications

217

Session CAAP 6 Chairman: A. Arnold (Bordeaux)

Foundations (3. (3ambosi, M. Talamo (IASI-CNR, Roma) & J. Nesetril (Charles Univ. Prague) Efficient Representation of Taxonomies

232

J.-J. Ch. Meyer & E. P. de Vink (Free Univ. Amsterdam) Applications of Compactness in the Smyth Powerdomain of Streams

241

M. C. Browne, E, M. Clarke & O. GrQmberg (CMU, Pittsburgh) Characterizing Kfipke Structures in Temporal Logic

256

xt Session AS5 Chairman: G. Levi (Pisa) R. Milner (Univ. Edinburgh) Dialogue with a Proof System

271

G. Huet (INRIA, Paris) Induction Principles Formalized in the Calculus of Constructions

276

Session AS2 Chairman: U. Montanari (Pisa) J. Thatcher (IBM, Yorktown Heights) Algebraic Semantics (Abstract)

287

M. Nivat (LITP, Pads) Tree Codes (Paper not received in time) Author Index

288

CONTENTS OF VOLUME 2 Session AS1 Chairman: H. Ehrig (Berlin) J. A. Goguen & J. Meseguer (SRI, Menlo Park) Models and Equality for Logical Programming

K. Furukawa (ICOT, Tokio) Fifth Generation Computer Project: Current Research Activity and Future Plans

23

Session CFLP 1 Chairman: C, BShm (Roma) Theory and Semantics of Functional Languages A. Piperno (Univ. La Sapienza, Roma) A Compositive Abstraction Algorithm for Combinatory Logic

39

J. Y. Girard (CNRS & Univ. Paris VII) & Y. Lafont (INRIA, Rocquencourt) Linear Logic and Lazy Computation

52

D. CI6ment (SEMA METRA & INRIA, Sophia Antipolis) The Natural Dynamic Semantics of Mini-Standard ML

67

Session CFLP 2 Chairman: K. Clark (London) Language Features and Compilation in Logic Programming Z. Farkas (SZKI, Budapest) Listlog - a Prolog Extension for List Processing

82

R. Barbuti, P. Mancarella, D. Pedreschi & F. Turini (Univ. of Pisa) Intensional Negation of Logic Programs: Examples and Implementation Techniques

96

P. Van Roy (Univ. Leuven, Heverlee), B. Demoen (BIM, Everberg) & Y.D. Willems (Univ. Leuven, Heverlee) Improving the Execution Speed of Compiled Prolog with Modes, Clause Selection, and Determinism

111

Xlll Session CFLP 3 Chairman: D.Warren (Manchester)

Implementation Techniques C. Percebois, I. Fut6, I. Durand, C. Simon & B. Bonhoure (Univ. Toulouse) Simulation Results of a Multiprocessor Prolog Architecture Based on a Distributed AND/OR Graph

126

G. Lindstrom, L. George & D. Yeh (Univ. Utah) Generating Efficient Code from Strictness Annotations

140

S. Finn (Univ. Stirling) Hoisting: Lazy Evaluation in a Cold Climate

155

Session CFLP 4 Chairman: G. Kahn (Sophia Antipolis)

Program Proving and Transformation W. Drabent & J. Maluszynski (Univ. LinkSping) Inductive Assertion Method for Logic Programs

167

A. Pettorossi (IASI-CNR, Roma) & A. Skowron (PKiN, Warsaw) Higher Order Generalization in Program Derivation

182

M. Thomas (Univ. Stirling) Implementing Algebraically Specified Abstract Data Types in an Imperative Programming Language

197

Session AS3 Chairman: R. Kowalski (London) K. L. Clark & I.T. Foster (Imperial College, London) A Declarative Environment for Concurrent Logic Programming

212

D. H. D. Warren (Univ. Manchester) Or-Parallel Execution Models of Prolog

243

Session CFLP 5 Chairman: J. Goguen (Menlo Park)

Unification of Functional and Logic Programming Languages M. Bellia (Univ. of Pisa) Retractions: a Functional Paradigm for Logic Programming

260

P. G. Bosco, E. Giovannetti & C. Moiso (CSELT, Torino) Refined Strategies for Semantic Unification

276

XtV Session CFLP 6 Chairman: B. Mahr (Berlin) Types, Polymorphism

and Abstract Data Type Specifications V. Breazu-Tannen (MIT, Cambridge) & T. Coquand (INRIA, Rocquencourt) Extensional Models for Polymorphism

291

R. Harper, R. Milner & M, Tofte (Univ. Edinburgh) A Type Discipline for Program Modules

308

C. Beierle & A. Voss (Univ. Kaiserslautern) Theory and Practice of Canonical Term Functors in Abstract Data Type Specifications

320

Author Index

335

ON THE C O M P L E X I T Y AND D E C I S I O N

OF B R A N C H I N G

TREES

FOR C L I Q U E

PROGRAMS FUNCTIONS

Ingo W e g e n e r * FB 20-Informatik, Johann W o l f g a n g G o e t h e - U n i v e r s i t i t , 6000 F r a n k f u r t a.M., Fed. Rep. of Germany Abstract Because

of the slow p r o g r e s s

complexity

of B o o l e a n

of B o o l e a n

circuits

branching ching

width-k

of clique

we p r o v e

nally we i n t r o d u c e ces of B o o l e a n progr a m s

functions.

lower

decision

and

branching

large p o l y n o m i a l

BPk(P)

if

w i t h n. Fi-

of all

sequen-

by k - t i m e s - o n l y

We show c o n s t r u c t i v e l y

pro-

lower bounds

for k i n c r e a s i n g

of the classes

bran-

on the d e c i s i o n

For o n e - t i m e - o n l y

bounds

models

trees,

k-times-only

bounds

which may be c o m p u t e d

size.

on the circuit

in r e s t r i c t e d

circuits,

programs

functions

the h i e r a r c h y

functions

of p o l y n o m i a l

subset

is i n t e r e s t e d

restricted

branching

for k - c l i q u e

k is fixed and e x p o n e n t i a l

proper

one

lower bounds

We prove here e x p o n e n t i a l l o w e r

tree c o m p l e x i t y grams

functions

like depth

programs,

programs.

in p r o v i n g

branching

that B P I ( P ) is a

of BP2(P).

I. I N T R O D U C T I O N Until

now one knows

only

bounds

on the c i r c u i t

tions.

Therefore

dels mes

like

(Nechiporuk

monotone

[9])

restricted

and Yao

[15])

(Ajtai et al. Z[k

[11]

fami l i a r

and

Dunne

and W e g e n e r with Boolean

rected,

labelled

Boolean

variables

models

[13],

k-times-only

[14]).

tree where

in part by D F G - g r a n t s

node one tests 1066/I-2

[4],

Pudl~k

[10]

programs

[8], Pudl[k/

tree

One

is

is a di-

are l a b e l l e d

constants.

sche-

programs

that the reader

A decision

the inner nodes

No. We

mo-

[I], B a r r i n g t o n

branching

[7], M a s e k

We assume

by B o o l e a n

an inner

func-

contact

of b r a n c h i n g

(Ajtai et al.

and formulae.

and the leaves reaching

programs,

[3], C h a n d r a / F u r s t / L i p t o n

circuits

of lower

Boolean

a long time r e s t r i c t e d

[5], K r i e g e l / W a a c k

[12],

binary

the root and after * Supported

programs

(depth restricted)

[I],

defined

branching

restricted

branching

[2], B o r o d i n / D o l e v / F i c h / P a u l

since

circuits,

and also

for the proof

of e x p l i c i t l y

one has c o n s i d e r e d

formulae,

like w i d t h

a few poor methods

complexity

by

starts

that v a r i a b l e

and Me 872/I-I

at which

is the label of the node.

If its value

(or right)

label

successor.

the function complexity

program

the c o m p u t a t i o n

outdegree

0. The

that of d e c i s i o n k branching level.

programs

On the other

depth restriction. of c o m p u t a t i o n viously needs

are l e v e l l e d

One

only

ciently

programs

decision

large

[2]).

programs

be c o m p u t e d

grams.

size of BPs called

and A j t a i

(BPkS)

eraser

The p u r p o s e bounds

[11]

boun d

by

iff they can depth.

pro-

[12]. M a s e k

tight r e l a t i o n s

[8],

between

the

(so-

tree

and BP I c o m p l e x i t y

is d e f i n e d

functions.

on N =

of an n - v e r t e x

of B o o l e a n

The c l i q u e

of lower

functions. n fk

function

(~) v a r i a b l e s c o r r e s p o n d i n g to the n fk c o m p u t e s I iff the graph spe-

graph,

contains

2 we consider

for the proof

a k-clique.

decision

trees

and present

some general

lower

techniques.

In C h a p t e r

3 we p r e s e n t

We show w h i c h node

solution

of T u r i n g m a c h i n e s

is to p r e s e n t m e t h o d s

to clique

c i f i e d by the v a r i a b l e s

In C h a p t e r

For w i d t h

branching

to W e g e n e r

effi-

functions

can be c o m p u t e d

for depth r e s t r i c t e d

[I] p r o v e d

of the

Turing machines).

these methods

edges

models.

size and l o g a r i t h m i c

of BPkS we refer

of this paper

3 ~k DT0(f ) + DTI (f) .

DT I (f) > M(f) .

iii)

DT0(f)

Proof:

> M(~).

i) is obvious.

ii)

Consider

Any

1-1eaf L c o r r e s p o n d s

be the m o n o m must be

a decision

consisting

I if we f o l l o w

tree

to a unique

this path.

a disjunctive

iii)

in a similar

The reader

is a s k e d

the minimal

path

of all v a r i a b l e s

and we o b t a i n follows

for f w i t h

Then

number

l-leaves.

from the root to L. Let m(L) and n e g a t e d

variables

f is the d i s j u n c t i o n

form for f with

which

of all m(L)

DTI (f) monoms.

way.

to c o n v i n c e

of

Q.E.D.

himself

that

the number

of

]-leaves

of

a decision tree for f may be smaller than the number of prime implicants of f. But the following result, whose e a s y proof is left to the reader,

shows that this cannot happen for m o n o t o n e functions.

Proposition

I__.'_ If f is monotone,

implicants of f and M(~)

M(f)

is equal to the number of prime

is equal to the number of prime clauses of f.

In [13] the number of prime clauses of the clique function is estimated. The number of prime implicants o b v i o u s l y equals c o m b i n e d with T h e o r e m I and P r o p o s i t i o n

Theorem 2:

DT(fk) ~

(k) + (k-l) n-k+1

;

(n k ) . These e s t i m a t i o n s

I lead to the following theorem.

DT(f3) ~ 5 n-5

•

In order to obtain larger lower bounds on the d e c i s i o n tree c o m p l e x i t y of clique functions we use another general approach.

We have already

seen that the m o n o m c o r r e s p o n d i n g to a path from the root to a 1-1eaf (0-leaf)

in a decision tree for f is an implicant

(a clause)

label the edges of a decision tree such that edges to left

of f. We

(right)

suc-

cessors get label 0 (I). Then we may identify each node v with the 0-1sequence

(il,...,im)

consisting of the labels of the edges lying on the

path from the root to v. By our c o n s i d e r a t i o n s above we get the following result.

T h e o r e m 3:

Let f be a B o o l e a n f u n c t i o n and let Z I (~0) be the length

of the shortest prime implicant for f contains all nodes

(prime clause)

(il,...,im)

of f. Any d e c i s i o n tree

where the number of ones is less

than ZI and the number of zeros is less than ~0" In p a r t i c u l a r DT(f) >

E 0~m 2 n4/3/2-O(n4/3)

10 as well as 11 are of size

for k(n) :=[n2/3].

In [13] also upper bounds on the d e c i s i o n tree complexity of clique functions are presented.

The e s t i m a t i o n of the size of a d e c i s i o n tree

leads already for very simple algorithms to hard c o m b i n a t o r i a l problems, e.g. one may apply results on the number of c l i q u e - f r e e graphs Kleitman/Rothschild

(Erd~s/

[6]).

3. ON THE B P I - C O M P L E X I T Y OF CLIQUE F U N C T I O N S

As we have seen it is rather easy to prove large lower bounds on the d e c i s i o n tree c o m p l e x i t y of B o o l e a n functions.

D e c i s i o n trees are easy

to describe but they are often puffed up. They may contain the same large subtree at d i f f e r e n t places.

In order to d e c r e a s e the size of the

c o m p u t a t i o n scheme it w o u l d be sufficient to d e s c r i b e the subtree only once and to point from many nodes to the root of the subtree. allowed in b r a n c h i n g programs.

Furthermore

This is

it is obvious that optimal

d e c i s i o n trees have the p r o p e r t y that on each path of c o m p u t a t i o n each variable

is tested only once. This ensures that the depth is bounded by

the number of variables.

In b r a n c h i n g p r o g r a m s a node may have many pre-

d e c e s s o r s and the s u b f u n c t i o n s w h i c h have to be c o m p u t e d if one reaches this node from d i f f e r e n t p r e d e c e s s o r s need not to be equal.

One may se-

parate these situations again by r e p e a t i n g tests one has done before. The a d v a n t a g e of this p r o c e d u r e

is the r e d u c t i o n of the size of the

b r a n c h i n g p r o g r a m at the cost of i n c r e a s i n g the depth. branching programs

(BPlS)

For o n e - t i m e - o n l y

the depth is also b o u n d e d by the number of va-

riables. The size of BPlS for f may be p o l y n o m i a l even if DT(f) nential (see [12]

is expo-

We use the f o l l o w l n g a p p r o a c h for the proof of lower bounds on the BP lc o m p l e x i t y of clique functions.

In the d i s c u s s i o n above we have seen

that in b r a n c h i n g p r o g r a m s it is sometimes n e c e s s a r y to repeat tests in order to separate situations one has merged before.

This is not allowed

in BPIS.

There

we can merge

separate

t h e m by a s k i n g

v a n d w is p o s s i b l e v o_rr w a n d

siderations branching trees.

We prove

again.

of all v a r i a b l e s

show that mergings Therefore

if w e a r e n o t A merging

if t h e k n o w l e d g e

to d e t e r m i n e

program.

only

an o l d q u e s t i o n

if a n d o n l y

the k n o w l e d g e

or w is s u f f i c i e n t

situations

not

the v a l u e

tested

that mergings

near

are p o s s i b l e

near

only

reached

on any path

function.

the

to

of t w o n o d e s

that one has

of the

are not possible

BPIS behave

forced

the

con-

source

source

after

to v

These

like

of t h e

decision

a certain

number

of tests.

Theorem tion

4:

f~.

Let v and w be different

If o n a p a t h

most ki:=(~)-I ables more

variables

negatively

to v o r w.

Proof:

Neither

tested

we h a v e

not tested

length

the

following

each path this

of t h e

fulfil

negatively

fact which

a n d at m o s t

since

k0:=

some

of a p r i m e

, see C h a p t e r

input

funcat

variFurther-

the BP I on

to v or w we h a v e

implicant

for BPIS but not

exists

n-2(~)-k+2

changing

o n some p a t h

clause

tested

of t h e p r o g r a m .

of a p r i m e

all variables

prime

holds

in a B P I t h e r e

of w

a cycle

in t h e

following

the a s s u m p t i o n s

same p a t h

there

gatively)

if w e r e a c h

exists

to all e d g e s ,

Each path existing

(k I
b,

(5)

[ 1 - E P• ]m i=1

and l~ = 0 for n < b. The m -th factorial moment of the depth, d m is

l~/n. []

The average numberof internal nodes and other applications A number of other applications of Lemma 1 is possible. For example, from the storage view point it is

In. Naturally,

important to know the average number of internal nodes, recurrence (1) is satisfied with x0 . . . .

I, is an additive property, hence the

xb =0, and an = 1. Applying Corollary 1 we obtain immediately b

~=2

1-

2p~ i=l

In some other applications we might be interested in the average number of intemal nodes with all sons extemat nodes ( see [12], [6] ). Assume for simplicity that b = l and V=2. Let En denote the average number of such nodes. Then E 0 = E I = 0 , E z = I and for n > 2 the average

En satisfies

the recurrence (1) with an =0. Note that

[3o= 1~1= 0 and ~ = 1 - p 12- p 22. Hence by Lemma 1 and straightforward computations we find

En =

]~(-1)k

2

1--p~--pk

k=2

The generalization for V >2 is simple but need some additional computations. For other applications of (t) see [31 - [81, [131, [141.

19

Asymptotic approximation From the practical view point it is important to know asymptotic approximation of d ~ , I , , E n , etc. However, instead o f computing the approximation for each of the above quantifies we may equivalently determine the asymptotic approximation o f the following:

S ( n , r c n ) = ]~(-1)* k~

k

r

'

(1

- E

(6a)

p~)'~

i=1

where r : 1,2 . . . . .

B and o~ is a parameter. ( Note that S ( n ,r Ca ) is the sum in (2) if a, :

[n]~.).

The

application o f (6a) to the evaluation of l~, I. and E~ is straightforward. For example, the m-th factorial moment,

12. is expressed in terms o f S ( n ,r,m) as follows b l~-I

=

V

where ~ = l'IPJs'. S=l

To evaluate (6a) we may use either Rice's method [6], [7] or Mellin transform technique [6], [7], [9], [13], [16]. We apply here the latter method. We proved in [14] that S ( n + r . r . m ) = T ( n + r , r a n ) + O ( 1 ) ,

n+r T(n+r),r) = (-1) r ~ ~[l+O(n-1)]

S

F(z)(n ct) r-l-'

,,

where

az,

(6b)

('~ - tz-,~+) (1 - ] ~ p : - ' ) " i=1

c+i~

and F(z) is the gamma function [16], a + = min{0,a} and the integral notation 5 f ( ' ) stands for

1

The line of integration is either ( - 3 / 2 - i,~,-3~2 + ioo) for r=0, or ( - 1 / 2 - i ~ , - 1 / 2 + ioo) for r = l or (1/2 - io*, 1/2 + ioo) for r > l . The evaluation o f the counter integral in (6b) is routine: one goes from (c, - iN1) to (c, iN 1) to (N2,/N1) to (N2, - iN1) to (c, - i N 1 ) in a negative sense, where c = ½ - [2-r] +. F o r N t ---) ~ the horizontal parts o f t~he integral vanish since F(t + iN1) = O (1 + / N I I~-"~e-t - ~,/2) [I6]. while the vertical component over (1¥2, - iN1) decays due to the factor n r-i-z [12], [16]. Hence the required integral is minus the sum of residuals of the function under the integral to the right of the vertical line fixed at point c = ½ - [2-r]] +. The details may be found in [14]. For m = 1 a closed form expression for S (n ,r, 1) as n tends to infinity is available. Let us define Y

hn = ( - 1 y

]~Pi fn" pi, i=t

and h o = 0. Then PROPOSITION 2. For any n and r the following holds

n >0.

20 S(n,0,1)) = n c¢{ ln(na) + y--1 h2 hi + 2h 2 + f ( n a ) } + O ( 1 ) S(n ,1,1) = ha{ ln(n-1)a+T h2 hi + 2h21 - f ( ( n - 1 ) a ) } + o ( 1 ) n a { (r-Z)!

S(n,r,1) = (-1) r 7 .

~

+f((n-r)cO} + O(I)

r >2

where -/=0.573 is the Euler constant, and f (n) is a fluctuating function with a very small amplitude [ 12], [8], [6]. ( In practise, the function f (n) may be savely ignored ). Proof: The proof may be found in [13]. [] In particular, using the above we immediately obtain an asymptotic approximation for the average number of internal nodes, In. We find that

I~ =h-~{[ 1 -b ] ~1 r=2

] + f (n)}+O(l)

x

On the other hand, the average number of nodes with beth sons external nodes is given by

~-p?-p~ E n =n

2h~

(l+f(n))+O(1)

To evaluate d~ for large n we need the asymptotic approximation of S ( n,r,m ) for m > 1. This is more difficult, however, we can prove that PROPOSITION 3. For any m, and n large enough

I inrnn + ~hin inrn_ln[7 + Tm ~-1 h2 - (rn-t)hl - H b - I - h ] n F(n)] dnm-= h'-'~

+O(llzrn-2n)

where Hb-1 is the (b-1)-st harmonic number [t2], and F(n) is a fluctuating function with a very small amplitude. Proof: We use extensively (6b). Algebra may be found in [14]. [] Two moments play usually an important role in tries analysis, namely: the average and the variance, c~2, of the depth of insertion. Using the above approach we obtain immediately PROPOSITION 4. (i) The average depth of a leaf is given by

21 1

h2 [~'+ 2 - ' ~ ' t - H b - i ] - F ( n ) + O ( n - l )

d, =-~1 In n +

(7)

(ii) The variance, c 2, of the depth is

h2-h 2

In n +C +F(n)+O(n-1),

h~

(8)

where

_~

2"I

hz

2Hb-1

C -ZCC-~-l-~-~-12"~'--~l (1

-~1 (

112

Hb-t

4 2h12

hi )(1

h2

"[

h~

hi )+ h ~ - +

2eb-1

T

h2

hi

2h? t - ~ )

Hb-1 .

and 1

rcz

?a

~= ~-~? I ~ + T

b nr_l

3h22

~th2

h3

+ -4hl : ~ - + hi - 3hi

n

and eb is defined as eb = ~ - - 7 - ( o=0. and eo=O ). F(n) is a fluctuating function with a small arnplimde. Ln r=l

particular, for V-ary symmetric tries h. =In" V hence (8) implies

x2 c"z=~

1 + 12

(iii) The variance of the extemal path length ~

H~-I + ~ + F ( n ) + O ( n In2V

-1)

(9)

In V

is equal to

oL =n c~ so it is O (n In n ) for asymmetric tries, and O (n) for symmetric tries. B

Proof: Equation (7) follows immediately from l~-= ~ (-1) T M r $(n ,r,1), and Proposition 2. To compute c~ note r=l b

that c~=12 + lnL-[lnl-]2/n, and 12= ]~ (-1) r+l r S (n ,r,2), r=l

[] The table below shows the variance of the depth, c~, for symmetric V-ary b -tries. ( see (9)). Note that by (7) the influence orb on the average depth is of order O(1), and for small values ofb it may be safely ignored in practise. However, the variance critically depends on b, and for larger b we obtain more balanced tries. For example, for V=2 the variance c ,z decreases from 3.507 for b=l to 0.6741 for b=4. But there is a trade-off between b and the average searching time. Note that bigger b implies larger searching time in the sequential file of the external node. The total average searching time is dn+ (b-1)/2, where d, is given by (7). Hence, the searching time is minimized for b optimal equal to boe~= 1/(2h 1)+ 1.

22 Table. Variance of the depth for symmetric b-tries

I V

b=l

2

3.5070

3

I b=2

b=3

b=4

1.4256

0.9053

0.6741

1 A462

0.6177

0.4105

0.3184

4

0.9393

0.4189

0.2888

0.2310

5

0.7183

0.3323

0.2358

0.1929

6

0.5957

0.2842

0.2063

0.1717

3. A P P L I C A T I O N S AND DISCUSSION In this section we show some of the possible applications of the above results. In particular, we offer the average complexity of the improved texicographical sorting algorithm proposed recently by Paige and tarjan [17]. Optimization problems.

Let us consider d 2 as a function of p = (Pl, P2 . . . . . Pv). Then a question arises what is an optimal choice of p? It is intuitively clear that the average depth of insertion is minimized for the symmetric case. However, using Proposition 1 it is easy to notice that t ~ and d 2 are minimized for all n and m if the trie is a symmetrical one, that is, p ~ = P2 = . . . .

Pv = t/V. Naturally, the bigger the V is, the smaller the average depth of

insertion is, however, the data structure becomes more complicated. Moreover, formula (7) shows that the bigger the b is, the smaller the average depth of insertion is, however, the impact of b is of the secondary importance since the leading factor in (7) does not depend on b. A measure of balance for a tree.

The variance of the depth of insertion might be considered as a measure of how welt a tree is balanced. In the height-balanced trees the depth of a leaf is the same ( or almost the same ) for all leaves. Then, the variance of the depth is equal to zero. For other trees the depth is a random variable, however, the smaller the variance is, the more balanced the tree is. Indeed, by Tchebyshev inequality, we know that Pr{[Dn - d~ [ > 5} < o~/82. For example, let 8 = 3~, then P r { I D . - d. I > 3 o . } < 1/9, and it says that with probability 0.11 the depth lies in the interval (tin - 3o~, d n + 3on), hence the smaller ~ is, the smaller the interval is. This also means that for small c the average of the depth of insertion is a good measure of the actual depth, while for larger 6, it is very poor performance issue. Let us apply this to tries. By (8) we see that for symmetric tries h 2 - hx2 = 0, hence ~ = O (1) and does not depend on n. We may claim that symmetric tries are of an order of magnitude better balanced than asymmetric tries. Let V = 2, then f o r p = 0 . 5 (symmetric trie) o~ -- 3.507, while f o r p = 0.1 6~ = t2.64 ha n + O(1) and f o r p = 0.3 o .2 = 0.66 In n + O(1). The Tchebyshev inequality implies that with probability 0A1 the depth of insertion for a symmetric trie with V = 2 lies in (am - 5.5, d. + 5.5), while with the same probability the depth is in the interval ( d ~ - 10 ~',t~n, d. + t0 ~q-~-~-n) for p = 0.I and in

23 ( d n - 2.4 ~ q - ~ , dn + 2.4 ~4-M---n) for p = 0.3 and large n. Note also that bigger the b is, more balanced the trie is. Improved lexicographical sorting

Paige and Tarjan proposed an improved iexicographical sorting algorithm [17]. It works in two steps. The first determines so called significant prefix by building a trie over an alphabet, assuming that the total length of all strings is equal to L. The proposed algorithm runs in O ( L ' ) time where L ' is the total length of all significant prefixes. Aho, Hopcroft and Ullman [1] gave a solution with O ( L ) worst case asymptotic time. Hence, the ration LIL" indicates the improvements over the Aho et al algorithm. To compute the average complexity of the improved lexicographical sorting, and compare it with the Aho's lexicographical sorting, we first introduce some notations. Let S = {x l, x2 . . . . .

x~} be set o f the finite length

strings built randomly over an V-ary alphabet U subject to the total length of all strings L (L is fixed). Let also L" denote the total length of all significant prefixes. Note that L ' is a random variable, and it is equivalent to the external path length in the appropriate tile. Assuming symmetric alphabet by Proposition 4 we find that the average value of the external path length is n lgv n + 0 (1). Note, however, that this does not follow directly from our previous results, since in our model we have assumed unlimited strings. Nevertheless, it is easy to show that for large n, and distinct keys (strings), the above holds. Hence EL" = n lgv n + O(1), and the improved ratio IMP = L/EL" = Ll[n lgv n + O(1)]. Such a formula is not very informative, since there is a relationship

between L and n. Indeed, subject to L the number of strings, n, might be equal to one, or two or ... or nmax, where nmax is the maximum number of finite strings whose total length is L. NaturaLly, n 2

then

Ixl+l ~ [Qxl ~ 21xl-l.

Furthermore,

in the second case : IQxI=21xl-i iff x6ab*

The

set

Qx

of

states

of the minimal suffix automaton ~(x)

where a and h are two distinct letters of A.

PROPOSITION 2, The set F x of transitions of the minimal suffix automaton ~(x) satisfies : if Ixt ~< 3 then Ixl ~ IFxl ~ 21xl-l, if Ixl > 3

then

Ixl ~< IFxI ~ IFxl ~ 31xi -4-

Furthermore,

in the second case :

IFx I=3 Ix I-4 iff xqab* c where a,b and c are three distinct letters of A.

29

Automata ~(x) can be transformed in transducers which output positions of the input factor of x. First~ let p be a function defined on F(x) by : p(u) = rain {lyl/3z6A* x = yz et u6F(y) l. The function p is compatible with the right syntactic congruence associated with S(x), which means that, If u and v are factors of x, i.u=i.v implies p(u)=p(v). The function p can thus be defined on states of ~(x) and we get a first transducer where the output associated with a word u is linked to the state i.u. Another more interesting way to get a transducer is to consider the function pos on F(x) : pos(u) = p(u) - !ul. This function is still a sequential function [Be 79]. As p(u) only depends on i.u, with each transition (q,a,q')£F x is associated the output Reading

a word

u =

a a I

2

q*a = p(q') - p(q) - i. ~o. a in ~(x) from its initial state i produces the j

total output : i*a1+(i'al)*a2+'''+(i'ala2"''aj-1 )*aj. When u is a suffix of x its position is Ixu-1 I which is also pos (u) + Ix I-P (u). ~(X) becomes a subsequential transducer [Be 79] if, in addition to outputs on transitions, is defined on terminal states q of ~(x) : out (q) -- Ixl- p(q).

1"7 0

a/O

a/O ~

1

~, 2

b/O ~

3

blO ~

4

a/O ~

5

a/1 b/2

T4 6

a/O b/0 b/1

8

b/0 ,

i0

$3

Figure I.

Minimal suffix transducer for aabbabb (terminal states are 0,6,9 and i0).

b/O --~

7

b/O ----,

~'0 9

30

CONSTRUCTION The second important point concerning minimal suffix automata ~(x) is that their construction can be achieved in time linear in the length of word x. Figure 2 contains an algorithm that builds ~(x). The first 'while' loop is an on-line construction of ~(x) except for the terminal states which are marked with the function 'out' during the last 'while' loop. Note that one or two states are created during each pass through instructions of the first 'while' loop. The main point in the algorithm is the use of a function s defined on states of ~(x) and which is called suffix link. Its role is analogue to the 'failure' function of the Knuth, Morris and Pratt's string-matching algorithm [KMP 77]. Function s is first defined on non empty factors u of x by : s(u)=iongest suffix w of u such that i.u/i.w. This means that s(u) is the longest suffix of u which appears in a different right context inside x.

PROPOSITION

3. Function s is compatible with the right syntactic congruence associated with S(x), i.e. : b~/,vqF(x)-{l} i.u=i.v ~ s(u)=s{v).

the

Proposition initial state

3 shows i. From

that s can be defined on states of ~(x) except on that point of view, s behaves like a default state

function for ~(x). During execution of the algorithm in figure 2, each time a new state q is created (except at initialization) the value of s(q) is computed with the help of function 'suffix'. Its writing has been made simpler by introducing an artificial state on which are defined transitions to the initial state i by all the letters occurring in x. The function 'suffix', called with parameters r and a, climbs up the suffix links starting from r until is encountered a state on which a transition by a is defined. Using side effect, function 'suffix' creates or updates transitions. Tests in the algorithm and function 'suffix' are done by looking at the value of the function 1 defined on states q of ~(x) :

l(q)=max{lwl/w6A* and i.w=q}. One of the properties that brings all its simplicity to the algorithm is the fact that suffix links on words are of maximal length inside their right syntactic congruence class. This partly explains why function 'suffix' does not have to create states.

PROPOSITION

~. Let

y6F(x)-{l} and

q be that state $(x) such that i.y=q-

u=s(y). Then ~v6F(x) i.v=i.u ~ Ivl ~ lul, which may be translated as lul : l ( s ( q ) ) .

Let

31 On a given finite alphabet, all instructions of the algorithm in figure 2 take a constant time, except calls to 'suffix'. To conclude on the 0(Ixl) global time complexity, observe that that each recursive call to suffix strictly decreases l(s(last)) which is increased by at most 1 unit for each new letter.

Theorem 5. The construction of the minimal suffix transducer ~(x) by the algorithm in figure 2 is achieved in time O(Ixl). Almost the same results as those related in this section and the preceeding one remain true when one deals with factor automata instead of suffix automata. But minimal factor automata are of no use to compute LCF because they do not satisfy proposition 5.

32

begin create state 'art'; l(art)~p(art)e-i ; creat state i ; l(i)~p(i)~-O ; s(i)~art ; last e i ; while not end of input do read next letter a ; art.a~i ; create state q ; l(q)el(last)+l; p(q)ep(last)+l ; last.aeq ; last*ae 0 ; resuffix (last,a) ; if l(r.a) > l(r)+l then create state r ; with same transitions

as r.a ;

l(r) e l(r)+l

;

; p(r)~p(r.a)

r.a e r ; r*a e p s(r)esuffix end if ;

(r,a).a

; s(r.a)er

-p(r)-i

;

;

s(q)er.a ; last ~q ; end while ; qelast ; out (q)eO ; while q#i do qes(q) ; out (q)ep(last)-p(q) end while ;

;

end.

function suffix (r,a) ; if s(r).a not defined o_rr l(s(r).a)~l(r.a) s(r).aer.a return

; s(r)*a~p(s(r).a)-p(s(r))-i

(suffix

else return end if ; end function.

(s(r))

(s(r),a))

then ;

;

;

Figure 2 - Construction of minimal suffix tranducers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

33

F - D I S T A N C E A N D LCF.

This section deals with string-matching questions of the kind : search a text t for an occurrence of a word x. The suffix transducer of text t brings an interesting solution to this problem since any further search for a word x takes a time 0(Ixl). We concentrate on another solution which is more convenient when text t often changes as it is the case under a text editor. This time the suffix transducer ~(x) is used in a particular way by means of its suffix link s and the function 1 which gives, for a state q in ~(x), the length of a longest word that reaches q from i. Given x,tEA*, we introduce the function LCF(x,t)=max{lwl/w6F(x) and w6F(t)}. From LCF is defined a distance d between words of A*, called the f-distance [Oh 83] : d(x, t)= Ix I+ it I-2LCF (x, t). Searching t for an occurrence of x translates to searching for a factor u of t such that lul=Itl and LCF(x,u)=Ix I or d(x,u)=0. The algorithm in figure 3 is the basic algorithm to compute LCF(x,t) or d(x,t). It may readily be adapted to do string-matching or even approximative string-matching. The algorithm uses the suffix automaton ~(x) already built. So, ~(x) can be considered as one of the inputs of the algorithm. The other input is the text t. If t=t t 2 . . . t , where the ti's belongs to A, the output of algorithm in figure 3 is the sequence i0,I i ..... i, defined by Ik=max{lwl/w~F(x) and w~S(t ...tk)}. With this notation we get LCF(x,t)=max{Ik/k=0 ..... n}. The proof that the algorithm works well lies on proposition 5 which contains a property of function I on states that are images by the suffix link s. To see why the time complexity of the algorithm is globally 0(Itl), it is enough to note that the instruction 'qes(q)' of the internal 'while' loop strictly decreases l(q) from its value i k, and besides, this latter quantity increases by at most 1 for each letter of t.

Theorem 6. Algorithm in figure 3 compute the lengthes of the common factors of x and t in time 0(itl) (when ~(x) is already built).

COROLLARY 7. Given two words x and t on a finite alphabet A, LCF(x,t) can be computed in time and space complexities 0(Ixtl).

The use of suffix transducers instead of suffix automata allows to memorize an occurrence of a longest common factor, the first for instance.

34

begin {states (q and i) and transitions are those of ~(x). On states are defined functions s a n s i} keO ; loeO ; qei ; while not end of input t d__oo read next letter a ; k~k+l ; if q.a defined then ikelk_z+l ; q~-q.a ; else while qwi and q.a not defined d__oo qes(q) ; end while ; i_ff q.a not defined then ik@O ; else 1 el(q)+l ; qeq.a ; end if ; end if ; end while ; end.

FIGURE 3. Computing l e n g t h e s of f a c t o r s .

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

common to x and t . .

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

REAL-TIME STRING-MATCHING~

The algorithm of the preceeding section has a linear time complexity but the delay between the reading of two consecutive letters of the input text t depends on the word x and is even 0(Ix I) in the worst case. By considering a new suffix link, the delay can be bounded to 0(IAI). First define the immediate right context of a factor u of word x to be the set of letters that follow u : C(u)={a6A/ 3y,zqA* x=yuaz}. When v is a suffix of u we get C(u) ~ C(v) and in particular C(u) ~ C(s(u)) when u~l. When C(u)=C(s(u)) and if ub is encountered in the text t which is searched for x, then it is useless to come down to s(u)b. This gives the idea of a new suffix link noted sa and defined on non empty factors u of x : !

sa(u) = Isk (u) if k is the smallest integer > 0

[

1

such that C(s k (q))JC(u) otherwise

Since C(w)~C(s(w)), the test C(sk(u))wC(u) can be done on the cardinalities of the two sets. The condition on immediate right context easily translates on automaton ~(x) in term of output degree de of its states. If q is a state of ~(w), let de(q)=i{a6A/q.a defined} I. Then the new suffix link sa on states of ~(w) (different from initial state i) is

sa(q)=

{ik

(q) if k is the smallest integer > 0 such that de(s k (q))Ide(q), otherwise.

PROPOSITION 8. Replacing instruction 'q,s(q)' by 'qesa(q)' in the algorithm of figure 3 leads to a real-time algorithm on any finite alphabet.

To compute the suffix link sa~ states of ~ ( x ) are visited in a breadth-first-search order and the following formula is applied which yields an 0(Ix I) time complexity algorithm. I sa(q)=

i if s (q)=i, s(q) if de (s (q))/de (q), ~sa(s (q)) otherwise.

Another way to get a real-time string-matching is to complete the transducer ~(x). In fact the aim of the internal 'while' loop of algorithm in figure 3 and the test hereafter is to compute missing transitions. With complete transducers the space complexity becomes 0({Ai.lxl) while it is 0(ix I) in the previous algorithm°

36 MAIN REFERENCES

:

[Be 79] J. BERSTEL,Transductions

and context-free languages, Teubner, 1979.

[BBEHCS 85] A. BLUMER, J. EHRENFEUCHT, D. HAUSSLER, M.T. CHEN & J. SEIFEIRAS, The smallest automaton recognizing the subwords of a text, Theor. Comput. Sci. 40, 1 (1985) 31-56. [Ch 83] C. CHOFFRUT, On some combinatorial properties of metrics over the free monoid, in : [Combinatorics on words, Cumming ed., Academic Press, 1983]. [Cr 86] M. CROCHEMORE, Transducers and repetitions, Theor. Comput. Sci. (1986) to appear. [KMP 77] D.E. KNUTH, J.H. MORRIS & V.R. PRATT, Fast pattern-matching in strings, SIAM J. Compt. 6, 2 (1977) 323-350. [Sl 83] A.O. SLISENKO, Detection of periodicities and string-matching in real time, J. of Soviet Mathematics 22, 3 (1983) 1316-1387.

An unification semi-algorithm for intersection type schemes Simona Ronchi Della Rocca Dipartimento di Informatica - Universita' di Torino corse Svizzera 185 - 10149 Torino

I. Introduction. The intersection type discipline for ~,-calculus (ITD), defined in [Coppo et ai.,1980 b], is an extension of the classical functionality theory of Curry [Curry et 81.,1958] .In Curry type discipline type schemes are built from type variables using the constructor -~ (arrow). In the ITD, type schemes are built from type variables and the type constant (the universal type) using, as constructors, beside the arrow, the intersection (^). The semantics of a type scheme of the shape ~ - ~ is the classical one, the semantics of a type scheme of the shape ~^B is the intersection of the sets representing the meanings of c~ and ~, the semantics of ~ is the whole semantic domain. In the ITD every term has at least one type scheme, and type assignment preserves B-convertibility. In the Curry type discipline, every term X which can be typed has a principal type scheme (pts), from which all and only the type schemes deducible for X can be derived, by means of substitutions. The problem of computing the pts, if it exists, of a term in the Curry type discipline is decidable, and algorithms to solve it have been proposed by Hindley [Hindley,1969] (for terms of Combinatory Logic), and by Milner [Milner, 1978] [Milner et 81.,1982] (for terms of },-calculus). Milner uses this algorithm in the design of the ML type checker. Both these algorithms are based on the classical unification algorithm of Robinson [Robinson,1965]. In the ITD each term X, which has a finite set of 8pproximants, has a pts in an extended meaning. More precisely, every type scheme deducible for X is derived from its pts by means of a sequence of suitable operations, namely the substitution, the expansion and the rise [Ronchi et ai.,1984]. In this paper the unification problem for intersection type scheme is studied. This problem is semi-decidable. The semi-algorithm UNIFY solving it is presented, and it is proved that ,in the case 8 solution exists, it finds the more general one. While UNIFY uses also operations different from substitution, it is conservative with respect to Robinson's unification algorithm. Moreover a semi-algorithm PP is presented, using UNIFY as essential tool, which, given 8 term X, if X is strongly normalizing computes its pts .Since there is a one-one correspondence between a term and its pts (if it exists), PP can be viewed 81so as a reduction machine,using an innermost reduction strategy. The use of unification between type schemes instead of p-reduction in computing the normal form of a term avoids the necessity of ~-conversions.

38 2.Tile interse~ti~, type ~Iis~ipli,e. The reader is supposed to have some acquaintance with k-calculus; in any case he c~n refer to [Barendregt,1984], whose notations we will use. D~filIitiml I. i) The set T of intersection type schemesis inductively defined by: ~i,?i,...~T (i~O) (type variables) s~T

(type constant)

6,-~T ~ (~-~'~)~T,(6h~)eT. ii) A statementis of the form 6x with 6aT and x is a variable, x is the subjectand 6 the predicateof 6M. A basis scheme is a (possibly infinite) set of ststements. The notion of subtype of a given type scheme is obtained in 8 straightforward way from Definition I.i). 6 i-~62-~...-~6n -~I; is an abbreviation for 6 i-~(62-~(63-t..(6n-.~d)...)) and

6 i^62h...^6 n

is

on

abbreviation

for

(6 ih(62h_.(6n_lh6n)...)). The simple semantics(for the definition of simple semantics see [Hindley, 1983]) for T can be given in the following way: I)etinitian 2. Let/~ be 8 k-model. i) Let N6A; if l~ is a valuation of variables in D, then ~ N ~ D is the interpretation of N in Mvia ~. ii)Let PD={XIXcD} and V:{~I~ is a type variable}-+PD. Then the interpretation of 6aT in M via V, notation [6~v~PD, is defined as follows: Io~=D

~v=V(~)

•~' J6 II6-~'~'~={deDjYee~6 ~v.d.eelh;~V }

This semantics induces naturally 8 pre-order relation ~ on T, whose intended meaning

is: 6 YMV. ~6~vC_K BV. Definition 3. The relation < (and ~) on T is inductively defined by: i) ~>~if ~" occurs in 6 then replece ~ in 6 by s1(~')^s2(¥) end

iv)e(B)--{e(~)xI6x~B}-

v)e()--<e(B),e('c)>. An expansion e will be called totalwith respect to e type scheme 6 iff e(6)=e'(6), where e'--. Let D:BI-~;X.Then, if e is 8n expansion, there exists 8 deduction D':e(B)I-e(~;)X,and D' is obtmned from D by dupliceting some subdeductions of D end by odjoining some applications of the rule (^I), as can be seen in the following: Exomple I. Let B--{(~-,~)-~y}.Then is 8 suitable pair for the term y(~,x.x). In fact we can show the deduction D: (-~I) BU{~x}I-~x (-~E) BI-(~-~)-~ocy

BI-~-~x.x

BI-~y(~,x.x). Let e--, e()= is o suitable pair for y(~x.x). In fact there exists e deduction D':

41

(-~I) e(B)U!~IX}I-~1 x (-~I)e(B)U{~2x}I-~2x (^I) e(B)I-~1-*~1 ~'x'x (-,E) e(B)I-((~1-*~ I)^(~°2-~Z ))-*c~y e(B)I-~ y(>,x.x).

e(B)I-~2-*~2 ~x-x

e(B)I-(~ I-~ I)^(~2-%°2 )~xx

The notion of instance can be naturally extended to substitutions and expansions; we will say that e substitution s={} is an instance of s'={} iff 6 i is an instance of 6'i, and an expansion e= is an instance of e'--%I'>iff ~ is an instance of Definition 8.i) A chain c is e finite sequence of operations of substitutions and expansions. ii) Two chains c I and c 2 are equivalent(notation cl==c 2) iff: -

1~

~

-

- if Sl,...,s n and S'l,..,s' m ere all end only the substitutions occurring respectively in c I and c 2, Uti. OPl..Opj(6i)~OPl...opj(%i)~(~. Roughtly speaking, a proper chain unifying two given type schemes is a chain in which a substitution of a type variable with the constant ~ is used only in order to unify two subtypes one of which is ~. Then we are able to prove: Theorem 3.i) (Correctness) If UNIFY(6,'(;)=c,then c(6)~c(I;). ii) (Completeness) Let 6,%ET be such that there exists a proper chain c unifying 6 and I;.Then UNIFY(6,%)~c', where c' is a proper chain unifying 6 and 1;, and cs~c'.c" for some c"(i.e.,c' is the minimalchain unifying 6 and %,in the sense that every other

44 some c"(i.e.,c' is the minimalchain unifying 6 and ~;,in the sense that every other proper chain unifuing 6 and i; must contain (an instance of) every operation occurring inc'). Proof. i) Easy, by induction on the lenght of c. ii) By induction on the pair (we assume the lexicographical order between pairs), where: l(c) is the lenght of c, i.e.,the sum of the number of expansions occurring in c and the cardinality of the union of all the substitutions occurring in c. - n(6,~;) is the total number of symbols occurring in 6 and "C. The case l(c)=o and I(c)=I are obvious. Let l(c)>1.1n the case 6 is a type variable, we must distinguish two cases, according to ~: contains or not occurrences of 6. In the first case obviously there is no a proper chain unifying 6 and ~;. Otherwise, UNIFY makes the substitution s={}.Obviously this is the minimal between all the proper unifying chains composed only of substitutions ( see [Robinson, 1965]). It easy to see that every proper chain unifying 6 and "d in which some operations of expansion occur is at least of length 2 (it must contain at least one substitution, since the expansion generates new type variables) and it is always equivalent to a chain composed by a single substitution. In the case 6 ~ , UNIFY(d,~;)=s, where s={I~ occurs in "c}. Obviously s is the minimal chain, since every chain unifying 6 and I: is such that c(6)=c(~)~. In the case 6=61^6 2 and ~;=s;i^I;2, the proof follows directly from the induction -

hypothesis. In the case 6=61-~6 2 and ~=~:1-~:2,if c is such

that c(6)=c(61)-~c(62) and

c(I;)=c(%1)-~c(I;2), the proof follows directly from the induction hypothesis. In the case c(6)=c(~;)=B^~, by Theorem 2.ii),there exists Cl--e.c2,where e=, such that ci(6)=ci(I;) and c==c I. So c 2 is e proper unifying chain for e(6) and e('~), and, by induction (since I(c2) ~hen if UNIFY(If16f2-+~)--c (~ is a fresh variable) then --

47 Remember that e term X is called s~'~ronglynormalizingiffX, and every its subterm, possess a normal form. T h e o r e m 6.PP(X)= ~ X is strongly normalizing and pp(X)~i then c--U(~,6',~,~;')el.se I.if either ~ or I; 8re either a type variable or ~ then c--U(6,6',~,'I;') 2.if 6--6i-+62 then 2.1.if "C--I;i-+"c2 then let Cl--Ui_1(~1,6",~i,1;',j+I)and c2--Ui_1(c1(62),c1(6'),c1(~;2),c1(~;'),j+1)then C=Cl.C2 2.2. ifs;--~;1^~;2 then let e= then let Cl--Ui~ (6),e(6 ),e(~;),e(~;),0) then c=e.c I 3. if 6--EII^62 then 3.1. if "d=~;1-~;2 then let e--,then let Cl--Ui(e(6"),e(6"),e(1;'),e('C'),O) then c=e.c I 3.2. if'c='c;1^~;2 then let ci=Ui_i(61,6",~:I,'C',j+I)and c2=Ui_1(c1(62),c1(6'),c1(1;2).c1(~'),j+1) then c--cl.c2. Let PPi be the 81gorithm obtained from PP by replacing UNIFY with UNIFY i (i>O). The following theorem holds:

48 Theorem 7.i) PPi(X)=~ ~II(X).

ii) ~ll(X) ~ ~i.PPi(X)=8nd _~. Proof_ Immediste from Theorem 5 8nd from the definition of the 8pproximsnts of term. []

4.Proof of Theorem 6.

(~)By induction on the structure of ×. For X vsriable, obvious. For X=;~.x.X'or X=YZ, where Y does not reduce to ~x.Y',forsome Y',the proof follows directly from the induction hypothesis. For X=(~x.Y)Z, PP(X) =~PP(;k×.Y)= end PP(Z)= and --,where c=UNIFY(6-~6f2~p). It essy too see , by exsmining the

semi-algorithm

PP,

that, if ~~~-,~

and

~If2-,~P

and

UNIFY(~,~)=c',

~P(B,I;,M). Proof_ i) Let xi~=xM1...Mm.

P(B',o~,N)~PP(N)= 8rid 3c.,where is fresh. The proof that pp'(X) is really the principal pair of X, in the sense that ell and only the type scheme deducible for X are obtained from pp'(X) by means of chains of substitutions, expansions and rise, is 8 particular case of the proof that, for A~N, pp(A) is the prlnclpal pelr of A, given in [Ronchl et ai.,1984]. Moreover an algorithm PP" can be define, which differs from PP only in the point 2), which must be replaced by: 2) if X=~,x.X'then if PP'(X')=then if B' contains a premise on x, let ~x, then PP'(X)- else PP'(X)=,where ~ is e fresh type variable. Then we obtain, as corollary of Theorem 6, the following: Theorem 8.1n the intersection type discipline without the constant ~), there exists e polr suitable for X iff X is strongly normalizing. [] This result is stated, but not proved, in [Coppo et el., 1980 o]. Aknoledgments.The author is very grateful to Paolo Busse and Mauro Berta, who gave an essential contribution in designing end implementing the semi-algorithms UNIFY end PP.

51 References.

[Borendregt,1984]

Berendregt H., The Lambdo Calculus: its syntax and semantics, North Holland, (Amsterdam). [Barendregt et ai.,1981]Borendregt H, Coppo M,,Dezeni M., A filter ~,-model and the completeness of type assignment,Journal of Symbolic Logic,84,4. [Coppo et ai.,1980 a] Coppo M., Dezanl M., An extension of the b6sic FL!nctionalityTheory for the L-calculus, Notre Dame Journal of Formal Logic, 21,4. [Coppo et ai.,1980 b] Coppo M., Dszani M.,Vonnori B., Principal type scheme and ~,-celculussemantics,in: J.P.Seldin,J.R.Hindleyads, To N.B.Curry.Essays on Combinatory Logic, ~-celculus end Formalism, Academic Press,London,1980,pp 535-560. [Curry et ai.,1958] Curry H.D., Feys R., Combinetory Logic, vol.1, Nort Holland (Amsterdam). [Hindley,1969] HIndley R.,The principal type scheme as an object in combinatory logic.Trans. Amer. Math. Soc,,146. INindley,1983] Hindle 9 R.~ The completeness theorem for typing A-terms, Theoretical Computer Science, 22. [Milner,1978] Milner R., A theory of type polimorphism in programming, J. Comput. System Sci.,17. [Milner et ai.,1982] Milner R., Domes L,Principal type schemes for functlonal programs, 9-th Syrup. on Prlnciple of programming languages. [Robinson,1965] Robinson J.A., A machine oriented logic based on the resolution principle,Journal of ACM, 12. [Ronchi et 81.,1984] Ronchi Dell8 Rocce S., Venneri B., Principal type scheme for en extended type theory, Theoretical Computer Science, 28.

O P T I M A L

RUN

TIME

O P T I M I Z A T I O N

P R O V E D BY A N E W L O O K A T A B S T R A C T I N T E R P R E T A T I O N S

B e r n h a r d Steffen Institut f~r Informatik U n i v e r s i t ~ t Kiel, D-2300 Kiel

Abstract

A two stage run time optimization algorithm is p r e s e n t e d that combines two w e l l - k n o w n techniques in a Herbrand optimal manner: - Kildall's iterative m e t h o d for data flow analysis and - M o r e l / R e n v o i s e ' s partial redundancy elimination algorithm. To combine these techniques in such an optimal way, we firstly have to elaborate Kildall's approach. This is done by means of a new classification method for abstract interpretations which has to be i n t r o d u c e d before S e c o n d l y we have to extend M o r e l / R e n v o i s e ' s technique, which is only conceived to treat the o c c u r r e n c e s of a single term, to work on the value equivalence classes d e l i v e r e d by the K i l d a l l - l i k e data flow analysis a l g o r i t h m m e n t i o n e d above. Our algorithm being optimal with respect to the Herbrand interpretation, it is a w e l l - f o u n d e d basis for the c o n s t r u c t i o n of further algorithms using special p r o p e r t i e s of a given interpretation. These can be o b t a i n e d by t r a n s f o r m i n g the K i l d a l l - l i k e analysis stage only.

I. P r e f a c e

High-level languages support a convenient and reliable programming, but the r e q u i r e d c o m p i l e r s often produce i n e f f i c i e n t codes. For example the p r o c e d u r e m e c h a n i s m and the macro expansion m e c h a n i s m lead to run time c o m p u t a t i o n s being too c o m p l i c a t e d or even redundant. To avoid this, modern compilers are c o n s t r u c t e d using optimizing techniques. Here the f o l l o w i n g m e t h o d s are very important: - loop invariant - common

code motion

subexpression

and

elimination.

Usually optimizers operate on nondeterministic flow graphs d e l i v e r e d by the compiler front ends. Based on this r e p r e s e n t a t i o n it is p o s s i b l e to combine and to improve the optimization techniques mentioned above in a systematic manner, to receive an algorithm which transforms prog r a m s into a m i n i m a l form w.r.t, the Herbrand interpretation [Gr]. This algorithm mainly consists of a two-stage iterative analysis process:

53 Firstly, we have a data flow analysis algorithm w h i c h is b a s e d on Kildall's iterative analysis technique [Kil and Ki2]. It partitions the o c c u r r e n c e s of the p r o g r a m terms in a Herbrand optimal manner. This optimality is p r o v e d by a new classification approach for abs tra c t in terpre tations. Secondly, we use an algorithm which determines the optimal locations for the c o m p u t a t i o n s of the source program w.r.t, the equivalence relation d e l i v e r e d by the first analysis stage. This algorithm is a g e n e r a l i z a t i o n of the partial redundancy elimination process stated by M o r e l / R e n v o i s e in 1979 [MR]. Our a l g o r i t h m being optimal w.r.t, the Herbrand interpretation, it is a well-founded basis for the c o n s t r u c t i o n of further algorithms using special p r o p e r t i e s of a given interpretation. These can be o b t a i n e d by t r a n s f o r m i n g the first analysis stage only. We now v i s u a l i z e

Here:

basis

and goal

of our algorithm:

(----]

- The arrows denote the n o n d e t e r m i n i s t i c this p r o g r a m part. -

The nodes

characterize

parallel

branching

structure

of

assignments.

This non reducible p r o g r a m part (it is a minimal the g e n e r a l i t y of our concept) has the following

example to d e m o n s t r a t e specific property:

while staying w i t h i n this general loop ( w i t h o u t leaving in the meantime ) the c o m p u t a t i o n s of "a+b" and "x+y" d e l i v e r the same values. This

motivates

the following

optimization:

I h:x+y I

i

i I

i

abc):-<xy h,

1

][ I Xy z :=

I

h )] D i a g r a m

This -

optimization

is r e a l i z e d

R e c o g n i z i n g the "equality" the first analysis stage.

in three of "a+b"

1.2

steps: and

"x+y".

This

is

done

within

- D e t e r m i n i n g the computation points ( see the i n s e r t e d nodes for the i n i t i a l i z a t i o n of h ) and the computation forms ( here "x+y" and "a+b" ). This is realized by solving a Boolean equation system i n i t i a l i z e d by means of the first analysis stage. -

T r a n s f o r m i n g the p r o g r a m on basis of the a n a l y s i s results, i.e. moving the c o m p u t a t i o n s (here "a+b" and "x+y") to the c o m p u t a t i o n points.

54

Previous optimization t e c h n i q u e s fail in t r e a t i n g the s i t u a t i o n m e n tioned above. I n d e e d m e t h o d s e x i s t w h i c h are a b l e to determine the r e d u n d a n c y if the v a r i a b l e h is a l r e a d y i n i t i a l i z e d [Kil, Ki2, KU, F K U and RL], b u t t h e s e m e t h o d s are e i t h e r too w e a k to m o v e any c o m p u t a t i o n at all [Kil, Ki2 a n d KU], or t h e y are r e s t r i c t e d to s p e c i a l l o o p s [FKU and RL]. On the o t h e r given fails

hand,

a technique

exists

which

is c o n c e i v e d

to m o v e

a

term w i t h i n an a r b i t r a r y f l o w g r a p h [MR], but this technique to r e c o g n i z e the " e q u a l i t y " of "a+b" a n d "x+y". Our approach combines and generalizes Kildall's t e c h n i q u e for the

r e d u n d a n c y e l i m i n a t i o n [Kil and Ki2] a n d the m e t h o d to l o c a t e computat i o n s w i t h i n a f l o w g r a p h s t a t e d by M o r e l / R e n v o i s e [MR]. T h e r e s u l t is a u n i f o r m a l g o r i t h m w h i c h d e l i v e r s the o p t i m a l computation points and

computation

forms

the Herbrand

w~r.t,

interpretation.

After presenting the b a s i c c o n c e p t s of this p a p e r in s e c t i o n II, we a n a l y z e the r e l a t i o n s b e t w e e n d i f f e r e n t abstract interpretations [CCI] s e c t i o n Ill. T h e s t u d y of t h e s e r e l a t i o n s d e l i v e r s classification criteria for abstract interpretations w.r.t, a given observational level. T h e s e c r i t e r i a c a n be u s e d to p r o v e the Herbrand optimality of the first analysis stage of o u r o p t i m i z a t i o n a l g o r i t h m as s k e t c h e d in section IV. A f t e r w a r d s , w e s h o r t l y d e s c r i b e the second analysis stage in s e c t i o n V a n d the r e s u l t i n g optimization in s e c t i o n VI.

in

If. Preliminary Definitions We d i r e c t l y introduce graph structure over occurrences G = -

of e l e m e n t a r y

(N, E, s,

(N,E) edge

- s

e )

E ~ N

resp.

LFG =

! G

This

composed

and

structure

allows

flow graphs

as f o l l o w s :

directed

graph

with

node

set

N ~ N

and

× N.

no predecessor write P(G) flow graph

for

of our p r o g r a m m i n g l a n g u a g e as a f l o w w h i c h r e p r e s e n t s the entire set of

statements. are

( start resp.

e

Further, we e of a g i v e n

5F~

which

is a c o n n e c t e d set

possessing

and

the s y n t a x a set N,

end n o d e resp.

I

denotes

a special

element

of

N

nodes.

for the set of all f i n i t e p a t h s f r o m s to G, F G for the s e t of all f l o w g r a p h s o v e r N

linear

the set of all

~ F~

)

successor

IP(G) l =

I

flow graphs

o v e r N,

i.e.

}

Remark II.1 P(G)

characterizes

identify

P(G)

with

a special this

subset

of LFG.

In the

following,

we

subset.

T h e semantics for flow graphs G over N, w i l l n o w be i n t r o d u c e d the MOP-solution in the s e n s e of Kam/Ullman [KU]. For t h a t p u r p o s e n e e d a complete semi-lattice (C, n, ~, ±, T) with bottom element

as we ±

55

and

top

element

T.

The

elements

of

representation of the situations a r b i t r a r y p r o g r a m p o i n t of G. Definition II.l a) Let ~ ~i : N node n c N a V T s C: (~ ~l , C) b)

, (C ~ C~ distributive

~ FG, G

possibly

be a function, function ~n~l

c

I ~nk~i ..... ~n1~l (c),

(~ ~, C) is (~ ~i , C)). delivers semantics

~P~1 (C)

- an i n t e r p r e t a t i o n - a set of s t a t e s the p o w e r s e t (boole,

called

( global )

a

a uniform of state

In

this

~

~

is

the

I =

(D,

~D w i t h

io)

data

lattice

d

(nl .... nk)

c LFG

abstract

semantics

frame, which is appropriate transformations belonging to

the

abstract

complete

to an

semantics

semantics

of a

and ~ D

POT([D)

for C a n d n o d e s

n of

the

form:

instruction)

- V [ ~ [~: ~n~([) =d~ {~ I B o c Zbool, Xbo~le

an

otherwise,

For example, we are a b l e to s i m u l a t e programming language w.r.t.:

- n =dr

and

if G =

imperative programming language as w e l l as the w h i c h is i n d u c e d b y a d a t a f l o w a n a l y s i s a l g o r i t h m .

using

as

at

c C:

] (c) =dr

This approach describe the

goto

serve

occur

w h i c h r e l a t e s to e v e r y from C to C ( i.e.:

local abstract semantics ~ ~l to the d o m a i n FG:

{ PEP(G) then (w.r.t.

semi-lattice

will

~n~! ([~ T) = ~ { ~n~l (c) Ic E T } ). In this case, w e c a l l an abstract interpretation or a local abstract semantics.

When (~ ~l , C) is a f o l l o w i n g e x t e n s i o n of V G

this

which

is the s u b s e t situation,

of we

n [:

~instruction~(m)=sl,

XD l e a v i n g

the

Boolean e x p r e s s i o n

are

to

translate

able

s t a t e m e n t of ~oto programs "if boole s u b f l o w g r a p h of the f o l l o w i n g form:

boole;

then goto

] goto skip [

L1

the

where

boole T R U E .

characteristic

else goto

L2"

in a

L1

predecessor

I goto L2 nboole; T h i s c o n c e p t p r o d u c e s the [Nil, w h i c h is e q u i v a l e n t

skip

~

Diagram

II.l

.

collecting semantics in the s e n s e of Nielson s e m a n t i c s for flow charts.

to t h e u s u a l

It is a l s o p o s s i b l e to s i m u l a t e a v e r y g e n e r a l with formal procedure parameters (see sec. IV). The treatment of semantics induced r i t h m s f o l l o w s i n the n e x t s e c t i o n .

by

procedure concept, e v e n data

flow

analysis

algo-

56

Finally,

we

present

semantics,

which

Definition Let G =

II.2 (N, E,

semantics a)

A

and

s,

Cs

=

V i

c IN

hl :

every

(hl)

induces

b)

Two cs

c)

A

(~

(K

3 nl

if

exists, -

(~i)

is

- a node occurs d)

We

The

~®

=dr

of

node

whereas

fulfils

the

following

sequences

two

(hl)

in

designate

of

=

G

(~i)

of

G

w.r.t. (~i)

Cs

of

is

G

exists,

states

the be

that

every

node

belonging G

~

to ( c~

(~i).

wise)

the

well-known found

in

abstract

(~ ~l , C), G c FG, of G w.r.t, cs Then

we

=

S®

( e

Especially: the end semantics

~®

is

computation

)

(global)

sequence.

n

~ N

end semantics

of

the

(hl).

frameworks

may

so

coincidence ( here [CCI,

the

CC2,

of

MOP- a n d

the

terminology Kil

or

Ki2]

semantics cs c C, and ~®

w.r.t,

results

the

(~,) a f a i r the end

fol). respon-

the

abstract semantics computation sequence

cs

properties:

(component

distributive

Coincidence Theorem L e t (~ ~, C) be the

called

w.r.t,

coincidence

for

w.r.t.

[~0 , fix .... } .

of t h e s e t w o globalization concepts is practical a p p l i c a b i l i t y of t h e theoretical global abstract semantics proved in section III.

The

the

(nl).

sequence

proofs

and

sequence

c NS(SI)

often hl

We

(hl).

(nl)

~

(Si)

{h0 , ~1 .... }

sequence

to

(nl).

sequences.

sequences if

following

theorem for

(~i)

:

(hl)-node

~l , C ) - c o m p u t a t i o n

[KU],

about

NS(~,)

infinitely

following

sible

=

sequence

MFP-solution lows

the

([ ~l , C ) - c o m p u t a t i o n

called

[( [ ] End, ((gi-1 (n))) n ~I-i (n), | n predecessor ~ of n if n = ni | [ ~i - i (n) otherwise.

equivalent

call

(K

is if

(~ ~l , C ) - c o m p u t a t i o n

with

abstract

n = s

equivalent,

a

a local

c N:

~l , C ) - c o m p u t a t i o n

fair,

¢ N

C)-computation

called

(6 ~i , C)

otherwise,

N S ( h i ) as

~L ,

are

graph,

C cs ,

, if

a set

of

flow

N ~ n

T

Sl (n)

elements

the

a

w.r.t,

I Cs

[ ii)

be

G

for

g0 (n)

)

to

(h~) , of

properties

e

globalization of a l o c a l a b s t r a c t MFP-solution of K a m / U l l m a n [KU].

alternative

¢ C.

sequence

sequence

i)

an

corresponds

local

(K ~, ,C)semantics

have: ).

independent

of

the

underlying

(~

El , C ) -

57

III

Levels of Abstract

During

the

- are

two

Interpretations

construction given

terms

of

optimization

representing

the

- is a p r o g r a m p o i n t r e a c h a b l e ? - d o e s a p r o g r a m p a r t c h a n g e the are

of m a i n

able

to

that ~z

interest.

treat

(~ ~z,

C~)

characterize

AI

: CI

and

: C2

describe

ally and

a complete

with

abstract

run

questions

time

some of

special

levels

~i

C3.

abstraction,

variables?

semantics,

of

semantics

are

we

are

abstraction.

For

=

and

(~ ~I , CI)

These

which

like

values?

abstract

semi-lattice

of

three

objects

connected

by

two

abstraction functions:

surjective V n

c N,

c

c CI

: ~n~2 oA~ (c)

~ AI 0~n~1 (c)

.......~ C3.

the

mutual

introduce

the

A2 a d e f i n e d

V c

two

levels

of

concept

on various

take

~ C2,

A2

questions

and

and

values

the

we three

distributive

To

such

purpose,

=

Using

algorithms same

relationship

between

adjoint

two

these

levels

we

addition-

concretization ) functions

or

A~ a

by:

c C,+l : Aia (c)

=dr

I

{ C

I Ai (C)=C

}-

Remark I I I . 1 This

specifies

semantics

~I

the

and

we

following are

semantics

(formalized

determine

automatically.

(iteratively) enough

( typical questions This w.r.t.

completely examples mentioned

section

semantics ~I

and

fixes

- ~2 - C3

this C3

of

abstract

the

inspected the

illustrate

this

properties

of

Cs),

semantics

~z

properties are

to d e c i d e ( i.e.

following

of

are

whether

is

this

want

to

for

an

to s e a r c h

suggested

~2

abstract

we

which we

whether

III.l.(c))

given

which

we h a v e

properties

criteria

the

a

special

purpose

the

property

detailied

interested by

the

a given

in three

abstract

is g l o b a l l y

optimal

) or not°

notations:

treatment.

programming

It

stands

language

for

(compare

the

complete

seo.

iI).

computation level.

question

- A~ and Az characterize l e v e l s of a b s t r a c t i o n . To

that

b a s i c level of o u r the

characterizes identifies

For

(Definition

motivates

the

semantics

elements

for such above ) ~

We h a v e

in s o m e

the

determine

delivers

~2 h a s

Remark I I I . l - ~i

as

computable

to

situation.

interested

situation,

(or

observation)

the

degree

we

~i :

Ci

~ C~

~2 :

C2

~ C2

Cs

C3

use

the

of

level.

abstraction

diagram

below:

Diagram III.1

between

these

58

Furthermore, w e d e n o t e t h e r e l a t i o n b e t w e e n :9~ a n d as :9, )~2 o~ Cs resp. :9~ -----~2 C~ and the and ~z as :gz s , r if there exists u' such t h a t u --+r u' and v ' such t h a t v --+T v ' which are related by any sequence of --*s and --*T containing at least one --*s-

Definition 2 a:7"s,r is the relation

~---~o---~so(--*sU--~T)*.

As we have seen the confluence of " ~ r is the property ~---~,o--*T C_.--~T0~--T, We now define the

cooperation

of " ~ s with "-+T which is a kind of confluence.

Definition 3 "-+s c o o p e r a t e s w i t h -'~T if and only if ~ s , r

F i g u r e 1:--~ S c o o p e r a t e s w i t h --~T

C

=>s,r

(Fig. I).

72

Basically --*r is noetherian and confluent and -'*s cooperates with T then two terms u and v are related by = > s , r

if their transformations by T, namely U i r and vJ. r are related by

any sequence of -'~s and --~r containing at least one --*s-

Definition 4 >S,T is the relation = > s , r tO --~7~.

Lemma 1 If - * s O - - ~ r is noetherian, "-*r is confluent and "-*s cooperates with --*T then > s , r is a partial ordering on terms. Proof: •

- * s and "-*T are noetherian, thus they are irreflexive. Then --*~ is irreflexive and =>S,T

is irreflexive. Thus >S,T is irrefiexive.

• >S,T is transitive. Recall t h a t a relation --~ is transitive if and only if ~ o - + C_ ---~. We get the result by the confluence of " * r , by the hypothesis of cooperation and by definition of

>S,T" Lemma 2 If -~.gU-"~T is noetherian, --+r is confluent and " * s cooperates with " * T , then >S,T is a w e l l - f o u n d e d partial ordering. Proof: --*~ is noetherian since "-*sU--'*r is noetherian.

Therefore, if an infinite sequence t l > s , r

t2 >S,T ... exists, then an infinite sequence =~>s, T O = ~ s , T O = ~ s , T 0 .,, which is, by definition, an infinite sequence "'+TO"'*sO("'*S[.J""~T) O+'-TO ... exists. Thus we use the confluence of - ' * r and the cooperation of ---~s' with --~T and show (Fig. 3) t h a t an infinite sequence of rewriting with

--*To---*sO('-*sU"+T) 0---~r exists which is a contradiction with the well-foundedness of ---~ s U---~ T .

73

.Figure 3. --'~T 0 -"~S 0 -"~SUT 0 ~-'T 0 "'~T 0 "'+S 0 -"~SUT 0 + ' T 0 "--~T 0 -'+S 0 -'~SuT""

UT

UT"

Lemma 3 If --~r and -'*s are F-compatible and stable by substitutions then >S,T is F-compatible and stable by substitutions. Theorem I If "-'*s cooperates with -'*T, "~SU--*T is noetherian and --*r is confluent then > s , r is a well-founded ordering and moreover when -'~s and " ~ r are F-compatible and stable by substitution, > s , r is F-compatible and stable by substitution. Since rewriting relations on T(F,V) are F-compatible and stable by substitutions, we may state the following result: Corollary 1 Let S and T be two rewriting systems. Suppose S cooperates with T~ SUT is noetherian and T is confluent then >S.T is a reduction ordering stable by substitution. F a c t : With the condition of Theorem 1, a rewriting system that satisfies l>s, T r for all rules 1--~r is noetherian. Example 1 The following example comes from [4,5]. a: (x*y)*z --* x*(y*z)

b: f(~)*f(y)-~ f(~*y) c: f(x)*(f(y)*z) --+ f(x*y)*z. a, b and c are the rules of a rewriting system R. Proving that R is noetherian is not easy since the classical methods namely simplification orderings [7] such as recursive path ordering (RPO) or recursive decomposition ordering (RDO) methods fails. We choose T to be

74 rl: f(x)*y --* f(x*y) r2: x*f(y) --+ f(x*y) a: (x*y)*z --* x*(y*z) in order to push up f and put down *. We choose S to be f(f(x))--~ f(x). T U S is noetherian. S and T satisfy the condition of the forthcoming Theorem 3, we will see that this implies S and T cooperate. Thus we m a y use

>S,T

to prove the termination of R.

W e have l >S,T r for all rules of R: proof

• (x*y)*z ---~fix*(y*z) (by a E T) (x*y)*z >s,~" x*(y*z) (by definition) • f(x)*f(y)JcT=f(f(x*y)) and f(f(x*y))-*s f(x*y). Thus f(x)*f(y) =>S,T f(x*y) (by definition) and f(x)*f(y) >s,r f(x*y) (by definition) • f(x)*(f(y)*z)J.T=f(f(x*(y*z))), f(x*y)*z.[ T=f(x*(y*z)) and f(f(x*(y*z))) -'~s f(x*(y*z)). Thus f(x)*(f(y)*z) =>s,T f(x*y)*z (by definition) and f(x)*(f(y)*z) >S,T f(x*y)*z (by definition) 2. L O C A L I Z A T I O N OF T H E C O O P E R A T I O N Thus if we have two rewriting systems S and T such that S cooperates with T, T is confluent and SDT is noetherian and 1 >s,T r for all rules 1 -+ r of R, then R is noetherian. The confluence of T may be tested using the Knuth-Bendix procedure. The termination of S U T may be tested using other well-founded orderings [7]. Only the cooperation of S with T has to be checked with appropriate methods, for instance using the solution proposed in this section.

75

Like confluence, cooperation may be localized, and we are going to prove a Newman-like theorem for cooperation.

Definitioon 5 " * s l o c a l l y c o o p e r a t e s w i t h -'+T if and only if +-To---~s C =>s,T (Fig. 4). F i g u r e 4: S l o c a l l y c o o p e r a t e s w i t h T

,~

Theorem 2

~

L ~

"~

..........

~ kS"~ ¢~

If "-*sU"~T is noetherian and --*T is confluent then the local cooperation implies the cooperation of -'*s with --*TProof: We use a noetherian induction on "-*SU'*T. Let us have y ~:Ts,T z thus y ~ - ~ x -'*s s (--~sU--~T)* z, we have to show t h a t y =>S,T z* If in = 0, we have y = x --*s s (--+sU'-*T)" z thins y ---->S,T z. o If m > 0 , we have y l such t h a t y +_~-1 y l +-T x. F r o m the local cooperation, we get y l

=>S,T s. Thus we have x l and sl such t h a t y l --*T x l , s --+~ sl and xt --*sO(-.+sU--*T) sl. a

F r o m the confluence of -'+T, there is an y2 such t h a t y "--~T y2 and x l "-+T y2. We notice t h a t (-~5U-~T)" = -~;U-~;O-~sO(-~sU-~)',

and thus we find two subcases. a

(1)

Suppose s (-+sU--*r)* z means s--+Tz. With the confluence of --*T, there is a zl such t h a t sl--+TZl

and

Z--+TZl.

Thus

we

xl--*so(--*sU--+T) O--+TZl

get

X1--+so(--+sU-+T) z l (by "-*T -- (-'~sU-'*T)

and

thus

and transitivity of (--+sU--+T))- Now we

have y2mrs, TZl. So by noetherian induction y 2 = > s , TZl and therefore, by transitivity of --*T, we conclude t h a t y = > s , Tz (Fig. 5). (2)

If

("-+sU--*T)*

= "-*ro-'*sO("*sU-'*T)*,

t

thus

s--+ T z0 --*sO(-+sU-*T)'z

and

the

confluence of --*T provides a zi such t h a t st - * r zl and z0 - * r zl. Now by noetherian

76 induction, we get zl =>S,T z. Moreover by noetherian induction, we get y2 - - > s , r zl. i

Therefore by transitivity of -+s,r, we get y2 =:>S,T z and by transitivity of "*r, we conclude that y =>s,r z (Fig. 5). .Figure 5.

%z

. . . . .

:::-

:~,

b4.

If S and T are rewriting systems, by looking at critical pairs between S and T it is possible to decide that S locally cooperates with T.

Definition 6 A critical pair p4--ro--* s q between a rule of S and a rule of T is cooperative if and only if p = > s , r q.

Definition 7 A rewriting system is variable preserving if and only if all rules are variable preserving i.e., variables that occur on the lef~hand side 1 do not disappear on the right-hand side r and thus V(1)=V(r).

Definition 8 A rewriting system is left-linear if and only if all rules are left-linear i.e. , variables occur only once on the left-hand side.

Theorem 3 Suppose T is a left-linear rewriting system and a variable preserving rewiting system. A rewriting system S cooperates locally with T if and only if all the critical pairs between S and T

77

are cooperative. The proof looks like the proof of the similar theorem on confluent critical pairs.

3. E X T E N D E D

TRANSFORMATION

ORDERING

Results of Section 1 are useful in many cases like Example 1 and relations T and S can be easily found. In this section we w a n t to go again further and to show t h a t T can be extended by using any ordering t h a t contains S and T. This way, we expect to prove termination of more rewriting systems The problem with T usually arises when both sides of a rewrite rule are transformed by T into the same term. We now use a well-founded ordering > > such t h a t - * s -----> > and - ' * r _C > > to define a relation between terms, written >>

-'+Err(T)" This relation extends -"*r in the sense t h a t - * E r r ( r ) C

and -'*EXr(T} C =T, The last condition is necessary to ensure the confluence of

- ' * r is confluent and the cooperation of

-'~EXT(T) if

"~EXT(T) with -"~s if -"~r cooperates with " * s . There-

fore, we define "*ZXT{r) as = T N >:>.

Definition 9 Let "~T be a confluent and noetherian and let >:> be. a well-founded ordering on terms t h a t contains ---*sU---~r. S--*EXT(T)t if and only if s~ r = t~T and s > > t .

Proposition 1 Suppose -'~s cooperates with a confluent and noetherian relation " * r , > > founded ordering on terms t h a t contains --~sU--~r then

is a well-

-"~EXT(T) i8 confluent, ---~sU---~xr(r) is

noetherian, -'*z cooperates with --*Exr(r). Fact-. Therefore

~S,EXT(T) c a n be used to prove termination.

L~mma ~: Suppose t h a t

-"t'TI~--'~T2 and --',sIC_---+s2 then = > s , r l ----- = > s , r2 and > s , r l C >s, r2,

=>SI,T C -- = > s 2 , r and >Sl,T C -- >S2,T, =>sl,rlC_=>s2,r~ and >S1,TIC_ >S2,TS.

78

Lemma 5: --*r -- --*ZXr(T) F a c t : >S,T C_ >S,EXT(T) (direct consequence of Lemma 4 and 5). Proof of Proposition 1: • --+SU--~E)CT(T) is noetherian: obvious since "-~s _C :>> (by hypothesis) and -'~EXT(T) C_ > > by definition.

• -+EX:P(T)is confluent: If t--+EXT(T)tl and t --+EXT(T)t2, by definition, we have t l S r = t$:r = t2,tT = t'. Since "*T a

"+EXT(~) by Lemma 5, we get t l "*EXT(T) t' and t2 --+EXT(T) t' thus --*EXT(T) is locally confluent. Since --*EXT(T) C ~

by definition, --+EXT(T)is noetherian. Now -'*EX~'(T) is locally

confluent and noetherian. Therefore it is confluent. • "-'~s cooperates with --+EXT(T)" Since "-*E):T(:") is confluent and "~SU--+EXT(r) is noetherian, "*s cooperates with -'*/~XT(I") if it locally cooperates with --+EXT(T) (by Theorem 2). Suppose t h a t tl+--EXT(T)t--+St2. Since tl,[T=tJ, r (by definition of --~EXT(T)) and t~T-----~s, Tt2 (by cooperation of --~s with "+w), we get

tl--*To=)s, Tt2. Then t l = ~ s , Tt2 (by definition) and tl=:>s,ExT(~)t2 (by Lemma 4 and 5).

Example 2 [10] The termination of the rewriting system R rl: f(s(x)) --+ f(p(s(x))) ~2: p(s(o)) ~

o

r3: p(s(s(x))) --~ s(p(s(x))) is not provable by simplification orderings since f(s(x)) is embedded in f(s(p(x))). But with the transformation rule T': p(8(x)) - * x

79

we get a rule S': f(s(x)) --* f(x) T' is confluent, regular and left-linear. S~UT' is noetherian. S' cooperates with T' (there is no critical pair). For the rules r2 and r3, we get l ~

-- rSz~. So let us take a recursive path ord-

ering based on the precedence p > s to extend T'. Then p(s(0) >S.EXT(r') 0 and R terminates.

4. C o n c l u s i o n The transformation orderings allow us to prove termination of rewrite systems where methods based on simplification orderings fail. We are currently looking way to implement it in REVE and to a d a p t it to the proofs of other systems. Reference8 i. L. Bachmair and N. Dershowitz, "Commutation, Transformation, and Termination," in Proc. 8th Conf. on Automated Deduction , Lecture Notes in Computer Science, vol. 230, Springer Verlag, Oxford (England), 1986. 2. L. Bachmair and D. Plaisted, "Associative P a t h Orderings," in Proc. i8t Conference on .Rewriting Techniques and Applications, Lecture Notes in Computer Science, vol. 202, pp. 241254, Springer Verlag, Dijon (France), 1985.

3. J. Backus, "Can Programming Be Liberated From the Von Neumann Style? A Functional Style And Its Algebra of Programs," Comm. o f A C M , vol. 21, no. 8~ pp. 613-641, 1978. 4. F. Bellegarde, "Utilisation des Syst~mes de R~gcriture d'Expressions Fonctionnelles comme outils de Transformation de Programmes Itgratifs," Th~se de doctorat d ~ t a t , Universit~ de Nancy I, Dept. Math~matiques Appliqu~es, 1985. 5. F. Bellegarde, "Rewriting Systems on FP Expressions to reduce the number of Sequences Yielded." Science of Computer Programming, vol. 6. pp. 11-34, North-Holland, 1986.

8O 6. F. Bellegarde and P. Lescanne, "Termination Proofs Based On Transformation Techniques," Submitted To Information and Control, 1986. 7. N. Dershowitz, "Termination," in Proc. lrst Conf. Rewriting Techniques and Applications , Lecture Notes in Computer Science, Vol. 202, pp. 180-224, Springer Verlag, Dijon (France), May 1985. 7. I. Gnaedig and P. Leseanne, "Proving Termination of Associative Commutative Rewriting Systems by Rewriting,"

Proceeding8 8th International Conference on Automated Deduction ,

Oxford (England), 27-31 July 1986. 9. G. Huet and D. Oppen, "Equations and Rewrite Rules: A Survey," in Formal Languages: Perspectives And Open Problems, ed. Book R., Academic Press, 1980.

10. S. Kamin and J.J. Levy, "Attempts for Generalizing the Recursive Path Ordering," Inria, Rocquencourt, 1982, University of Illinois Report.

ON PARAMETRIC ALGEBRAIC SPECIFICATIONS WITH CLEAN ERROR HANDLING

martin gogolla I n f o r m a t i k B, TU Braunschweig P o s t f a c h 3329,

D-3300 Braunschweig

ABSTRACT Usual a l g e b r a i c s p e c i f i c a t i o n partially

ordered s o r t s .

s u p e r s o r t s as w e l l tures

(e.g.

t e c h n i q u e s can be e x t e n d e d t o t r e a t

This a l l o w s t h e i n t r o d u c t i o n of

as o v e r l o a d e d o p e r a t o r s ,

existence

of

initial

a l g e b r a s and

a l g e b r a i c and o p e r a t i o n a l s e m a n t i c s ) o f tion

method

handling is

are preserved. studied.

On t h i s

proach tric

1.

equivalence

of

the equational specifica-

basis error

and

exception

a l g e b r a s which a r e o k / e r r o r -

and o k / e r r o r - c o m p l e t e ) a r e

considered.

a l l o w s t o p r o v e an e x t e n s i o n lemma f o r

specifications

fea-

For each s o r t an ok and an e r r o r s u b s o r t i s

i n t r o d u c e d and c l e a n a l g e b r a s ( i . e . consistent

sub- and

while pleasant

T h i s new

ap-

p e r s i s t e n t parame-

which p e r m i t e r r o r h a n d l i n g .

INTRODUCTION

During

the

promising

last

method f o r

programming approaches

tics

and p h i l o s o p h i e s f o r

final

[ 8 8 M 76,

opment

of

[EFH 8 3 ] ,

Partially treated etc.].

the specification

Among them a r e i n i t i a l [Wa 79, WPPDB 83, Ga 83] ST 8 5 ] .

specification

proved t o

be

There a r e

many such

[ADJ 76, ADJ 81, EKMP 82, and o b s e r v a t i o n a l seman-

Research i n t h e f i e l d languages l i k e

a

a b s t r a c t data types in

the a l g e b r a i c semantics of

led to the

OBJ [FGJM 8 5 ] ,

develACT

ONE

ASL [SW 83] and many o t h e r s .

ordered

sorts first

introduced in

i n a s e r i e s o f p a p e r s EGo 83, They a r e t h e b a s i s f o r

handling,

of

languages and s o f t w a r e e n g i n e e r i n g .

specifications. K1 84]~

years a l g e b r a i c s p e c i f i c a t i o n s

a t o p i c which i s

Po 84,

[Go 78] 8M

84,

have G~M

been 85,

our approach t o e r r o r and e x c e p t i o n

studied extensively in the literature

82 [ADJ 76, etc.].

Go 77, The

clean

Go 78,

BGP 82,

GDLE 82, Bi 84~ Po 84, BBC 8b,

fundamental new n o t i o n s i n t r o d u c e d h e r e a r e t h a t

a l g e b r a s and c l e a n s p e c i f i c a t i o n s ,

ok/error-consistency allows

and

where c l e a n r e f e r s

ok/error-completeness.

t h e use o f pure e r r o r v a r i a b l e s ,

before.

In

the

specifications

literature

o n l y [Po

This

approach possible

84]

considers

i m p o r t a n t because s p e c i a l problems a r i s e h e r e .

to

the

exception

extension

lemma

By t h i s

[Eh 81] and use i t

approach, guaranteeing the w e l l

parametric

which i s q u i t e

[Po 84] works w i t h

whereas we c a r r y o v e r p e r s i s t e n c y

h a n d l i n g case.

of

to

which was n o t

in connection with e r r o r handling,

non p e r s i s t e n t s p e c i f i c a t i o n s ,

of

we can a p p l y

for

definedness of

our

the

clean

R-

algebra

the a p p l i c a t i o n of

parametric specifications.

The paper i s o r g a n i z e d as f o l l o w s . i d e a s by means o f tal

definitions

fications.

some examples.

Chapter 2 i n t r o d u c e s t h e b a s i c Chapter 3 r e v i e w s t h e fundamen-

and f a c t s c o n c e r n i n g s u b s o r t s i n a l g e b r a i c s p e c i -

Chapter

4 t r e a t s c l e a n a l g e b r a s and c l e a n s p e c i f i c a -

tions.

Chapter

5

d i s c u s s e s p a r a m e t r i z a t i o n and

lemma.

Chapter

6

g i v e s some s h o r t c o n c l u d i n g remarks.

space l i m i t a t i o n s

2.

all

our

extension Due

to

p r o o f s are omitted.

THE BASIC IDEA

Our

main new c o n c e p t f o r

a clean algebra. for

the

ok

e r r o r and e x c e p t i o n h a n d l i n g i s

T h i s means t h a t our a l g e b r a s have two

and e r r o r p a r t o f each s o r t and

ok/error-consistent

(there

the

error).

The approach i s e x p l a i n e d b e s t by an example. Here i s our of

t h e n a t u r a l numbers.

s o r t s Nat opns

0 : - > Nat-Ok Succ: Error

Nat-Ok - > Nat-Ok : ->

Nat-Error

ok

and

and

spe~ N a t u r a l N u m b e r s W i t h E r r o r H a n d l i n g =

either

ok

are

error)

specification

( e v e r y element i s

subsorts

carriers

i s no element which i s b o t h

ok/error-complete

t h a t of

or

83

Succ,

Pred

:

Nat - > Nat

Plus,

Times :

Nat N a t - > Nat

vats

n : N a t n+,m+:Nat-Ok n - : N a t - E r r o r

e~

Succ ( n - ) Pred(O)

= n= Error

Pred (Succ ( n + ) ) Pred Entry-Error

Tree :

has

(2)

function

The

The f i r s t

occurrence such

one.

Entry-Ok ->

Tree-Ok

to the

corresponding to

(4)

important to

It

is

= O, o t h e r w i s e t h i s

(6)

and

axiom

for

derived

variable

the function

essential

use

can be c l a s s i -

The e r r o r

propagation for

Entry

Leaf

the

variables

as t h e n e x t e x a m p l e shows.

NoEntry :

in Nat

the opns-part)

~e~ec P a r a m e t r i c B i n a r y T r e e s = parm s o r t s

dis-

The s o r t

The f u n c t i o n s

t h e o~pD_s-part).

pure error

specifications,

one

Succ may a l s o be a p p l i e d

t h e axiom Times(O,n+)

constructors

n-

that

and s u b s o r t s a r e u s e d .

c a u s e an e r r o r

use

(I)

car-

makes no s t a t e m e n t a b o u t t h e n a t u r e o f

Three d i f f e r e n t

an ok v a r i a b l e

fied

Nat-Error

an ok v a l u e when a p p l i e d t o

The

would

an a l g e b r a h a v i n g as

T h e r e a r e some p e c u l i a r i t i e s

above w o r t h t o

that

result.

is

t h e s u b s o r t s N a t - O k and N a t - E r r o r .

is

assures

the specification

in

Suet.

parametric

84 Node :

Tree-Ok Tree-Ok - > Tree-Ok

NoTree : - > T r e e - E r r o r Leaf : E n t r y -> Tree Node : T r e e T r e e - > T r e e GetEntry :

Tree -> Entry

GetRight, GetLeft :

Tree -> Tree

vare

e+:Entry-Ok e-:Entry-Error

e_~ns

Leaf(e-)

t:Tree

tl+,t2+:Tree-Ok

= NoTree

N o d e ( N o T r e e , t > = N o d e ( t , N o T r e e ) = NoTree G e t E n t r y ( L e a f ( e + ) ) = e+ G e t E n t r y ( N o d e ( t l + , t 2 + > ) = NoEntry G e t E n t r y ( N o T r e e ) = NoEntry GetRight(Leaf(e+)) = GetLeft(Leaf(e+)) GetRight(Node(tl+,t2+))

= NoTree

= GetLeft(Node(t2+,tl+))

= t2+

G e t R i g h t ( N o T r e e ) = G e t L e f t ( N o T r e e ) = NoTree end spec The

specification

leaves sists

when it in

function t h e use o f If

is

builds

binary trees with given entries

applied.

the resulting GetEntry is the error

The g i v e n p a r a m e t e r s o r t

specification,

well

defined.

variable

e-

struction

the

T h i s can o n l y be a c h i e v e d by

in

would n o t be p e r s i s t e n t

per-

because

t h e axiom L e a f ( e - )

one would s p e c i f y o n l y L e a f ( N o E n t r y ) = N o T r e e ,

more e x c e p t i o n s t h a n t h e s i n g l e of

especially

the

at

Entry

for

error

=

NoTree.

then the con-

parameter algebras NoEntry.

Again,

having

lines

i-3

t h e 9 ~ D ~ - p a r t can be c o n s i d e r e d as t h e s i g n a t u r e s p e c i f i c a t i o n

for

t h e c o n s t r u c t o r s and l i n e s

ideas

4-7 f o r

the derived functions.

s k e t c h e d above a r e now made p r e c i s e i n

the (ollowing

The

chap-

ters.

3.

REVIEW OF ALGEBRAIC SPECIFICATIONS WITH SUBSORTS

The facts

following

remarks

r e v i e w the fundamental

and o u r n o t a t i o n c o n c e r n i n g a l g e b r a i c

subsorts.

Readers

etc.]

find

will

~amilar with

[Go 78,

many common d e t a i l s .

definitions

and

speci÷ications

Go 83,

Po 84,

and

SM 84,

85 3.1De÷inition A

signature

partial

(S,~,E)

c o n s i s t s of

(1) a s e t S of

sorts,

(2)

a

o r d e r ~ on S and (3) a f a m i l y Z=w~S* ssS of Bets of

function ~:v->r.

(Signature~ Algebra~ Morphism)

symbols Name(E)

such

that

(4) ~:w->s,

v~w

and

r~s

implies

= {~w'sl~eEw~s} denotes t h e f u n c t i o n names and

Symb(Z) = {~Id~Zw, s} the f u n c t i o n symbols of Z. A E - a l g e b r a (A,F) c o n s i s t s of that

(1) a f a m i l y A=s~S of s e t s such

(2) s~r i m p l i e s Asia r and (3) a f a m i l y F-< _ ~A w , s>~W'SsName(Z)

of f u n c t i o n s w i t h ~ ' S : A w - > As such that~

(4) i f

~:w->s,

~:v->r

and a~AwnAv, then ~ ' s ( a ) --~A v'r(a) A

Z-morphism

s~S

of

f:A->B

mappings such t h a t

a~Aw and (2) a~AsnAt

3.2 D e f i n i t i o n The

E-term

seS

of

s1...sn->s

between

E - a l g e b r a s A and B (i)

algebra

and

(I)

least

family

the for

d

:

functions ~:->s

and

f o r ~ : s l . . . s n - > s and t i E T s i .

of the term a l g e b r a )

E-term a l g e b r a TZ i s i n i t i a l

i n t h e c a t e g o r y ALGZ of a l l

E-

Z-morphisms between them.

(Congruence, Q u o t i e n t ) s on a E - a l g e b r a A i s a f a m i l y seS of

t i o n s ~s on As such t h a t implies

for

d : - > s i m p l i e s ~ T s and (2)

are determined by (3) ~ , s : = ~

(Initiality

Z-congruence

the

t i ~ T s i i m p l i e s d ( t l . . . t n ) ~ T s and

algebras with a l l

A

fs(~'S(a))=~'S(fw(a))

(Tz,F Z) has as c a r r i e r s

sets s a t i s f y i n g

3.4 D e f i n i t i o n

family

implies fs(a)=ft(a).

(4) ~ ? 1 " ' ' s n ' s ( t l . . . t n ) : = ~ ( t l . o . t n )

The

a

(Term a l g e b r a )

K~'S>dw,SEName(Z)

3.3 Fact

is

rela-

(1) ~s = [~EQ n AsXAs ] and (2) ai ~EQ bi

~ l"''sn's(al"''an)

~EQ ~ i ' ' ' u n ' r ( b l " ' ' b n )

for alibi

E

AsinAui ,

d : s l . . . s n - > s and d : u 1 . . . u n - > r , where ~EQ i s the e q u i v a u lence on sasAs generated by ~.

The q u o t i e nt A/~ of a E - a l g e b r a A by a E-congruence ~ has (1) the c a r r i e r s A/E s = { [ a ] l a e A s } ~ the

where [ a ] = { b ~ U-A la~-~b}

f u n c t i o n s ~w,S~Name(Z)

[~l'''sn's(bl...bn)],

and

(2)

sl"''sn,s([al]...Zan]):= w i t h ~A/~

where [ a i ] ~ A / ~ s i ~ [ a i ] = [ b i ]

and b i ~ A s i .

86 3.5 D e f i n i t i o n

(Equation~ S a t i s f a c t i o n ,

A

L=R i s a p a i r o f

~zeguation

signature Z Z-algebra cide.

Z(V)-terms,

having a d d i t i o n a l l y

A satisfies

A specification

L=R~ (Z,E)

Specification)

if

where

Z(V)

is

the

t h e v a r i a b l e s V as c o n s t a n t s . all

e v a l u a t i o n s o f L and R

A

coin-

c o n s i s t s o f a s i g n a t u r e Z and a s e t E

of E - e q u a t i o n s .

3 . 6 Fact A

(Induced Congruence)

s e t of E - e q u a t i o n s E i n d u c e s u n i q u e l y a s e t o f c o n s t a n t

tions

E(Tz) ,

which

a g a i n i n d u c e s a l e a s t congruence ~E

equaon

TZ

c o n t a i n i n g E(Tz)°

3 . 7 Fact

(Initiality

of

t h e q u o t i e n t term a l g e b r a )

The q u o t i e n t term a l g e b r a TZ/E E i s of a l l

(Z,E)-algebras satisfying

3 . 8 Example ( B i t s t r i n g s The

h a v i n g as s u b s o r t s

and s i n g l e b i t s

i n t h e c a t e g o r y ALGz, E

t h e e q u a t i o n s E.

handling)

error

following lines define bitstrings

String*)

~

avoiding

initial

of

arbitrary

non empty b i t s t r i n g s

length

(sort

( s o r t S t r i n g +)

(sort Bit).

B i t S t r i n g s A v o i d i n g E r r o r H a n d l i n g= sorts Bit

< String+ < String*

opns

: -> B i t

0,1

: -> S t r i n g

.

.l.

: S t r i n g * S t r i n g * -> S t r i n g *

.I.

: Bit

.l.

: String* Bit

First,

S t r i n g * -> S t r i n g + -> S t r i n g +

L a s t : S t r i n g + -> B i t

vats

b:Bit

e~ns

s l l ( s 2 1 s 3 ) = ( s l l s 2 ) Is3

e,sl~s2,s3:String*

sl~ = his = s First(bls)

= Last(slb)

= b

end spec Please

note

t h a t the s p e c i f i c a t i o n

s o r t s and v a t s has n o t r e a l l y determines

p a r t between t h e

t o be a s i g n a t u r e ,

but i t

a s i g n a t u r e i n t h e sense o f our d e f i n i t i o n .

more t h e f u n c t i o n s F i r s t

key

and L a s t r e t u r n i n g t h e f i r s t

words

uniquely Further-

respective-

87 ly

last

cally

bit

are well

defined,

because a l l

a l l o w e d by t h e s i g n a t u r e e i t h e r

applications syntacti-

yield

0 or

1.

3 . 9 Remark ( D e c l a r a t i o n s ) One can a l s o use so c a l l e d d e c l a r a t i o n s i n s p e c i f i c a t i o n s Go

83].

A d e c l a r a t i o n c o n s i s t s of

that

the

term w i l l

sort

(e.g.

a term and a

sort,

a l w a y s e v a l u a t e t o an element o f

i * i : N o n N e g a t i v e ~ where i

is

a v a r i a b l e of

[Go 787 assuring

the sort

given int).

4. CLEAN SPECIFICATIONS

4.1 D e f i n i t i o n A

signature

(Clean, o k / e r r o r - c o n s i s t e n t , (S,~,Z)

S-OKuS-ERROR,

is called

ok/error-complete)

(ok/error-)clean,

S-OK={s-OklsES-MAIN},

if

S=S-MAINu

S-ERROR={s-Error~sES-MAIN}

and ~ = { s ~ s l s s S } u { s - O k ~ s , s - E r r o r ~ s l s s S - M A I N } . A Z - a l g e b r a A w i t h Z a

clean s i g n a t u r e i s c a l l e d

As_Error and (3) A

= 0,

A is

specification is

ok~error-consistent,

(2~ o k / e r r o r - c o m p l e t e ,

clean, if

algebra

(I)

A

eeE(T~) i m p l i e s e i t h e r s u i t a b l e s o r t s.

As_Ok n

As_ok u As_Error

=

As,

o k / e r r o r - c o n s i s t e n t and o k / e r r o r - c o m p l e t e .

(Z,E)

clean.

if

if

is

called clean,

if

the

s e t E of e q u a t i o n s i s

initial

called

(E,E)-

clean,

eeTs_okXTs_Ok o r eeTs_ErrorXTs_Error

ALGz,E,CLEA N d e n o t e s t h e c a t e g o r y o f

(Z,E)-algebras with all

all

if

for

a

clean

morphisms between them.

4 . 2 C h a r a c t e r i s a t i o n ( S p e c i f i c a t i o n s w i t h c l e a n term a l g e b r a s ) Given the

a specification specification

(Z,E)

(~,E)

is

w i t h a c l e a n term a l g e b r a clean,

if

and o n l y i f

TE,

then

the set E

of

equations is clean.

4 . 3 C h a r a c t e r i s a t i o n (Clean s p e c i f i c a t i o n s ) A specification (I)

T~, E i s

(2)

there is

(E,E)

is clean, if

and o n l y i f

o k / e r r o r - c o n s i s t e n t and a subspecification

(a) ZG c o n t a i n i n g a l l ok o r e r r o r

result

(b) EG c o n t a i n i n g a l l

(ZG,EG)~(Z~E)

s o r t s and s u b s o r t s and s o r t s and c l e a n e q u a t i o n s o f E and

with all

operations with

88 (c)

there is

a unique s u r j e c t i v e

morphism f:~G,EG->U~_>EG(T%,E ) .

4 . 4 Remark ( S u r j e c t i v e morphiem i n If

t h e morphism f

of

(~B,EG)

then t h e r e a r e terms t l

that

TZG,EG ~ [ t l ] ~ [ t 2 ]

maximal s e t o f additional ok

is also injective,

above) then

(Z,E)

i s an e n r i c h m e n t

: T~G,ES and U~_>EB(T~, E) a r e i s o m o r p h i c . I f

injective, such

(c)

:

identification

and TZ, E ~ [ t l ] = [ t 2 ] .

in

t3eTs-(Ts_okUTs_Error), can

also

tl=t3

be done c h o o s i n g

involving

o n l y ok o r e r r o r t e r m s . this

establish

not

error

But EG i s

T~, E i s done v i a a term t 3

rule

out

is

a

e q u a t i o n s a p p l i c a b l e t o ok and e r r o r t e r m s , so t h e

identification

nor e r r o r

it

and t 2 b o t h ok o r b o t h

It

is

and

t3=t2.

different

a l s o much

neither

equations

smoother

case from a m e t h o d o l o g i c a l p o i n t o f view

a clear distinction

between ok and e r r o r

This

and

to to

constructors

and d e r i v e d f u n c t i o n s .

4 . 5 Concept ( P r a g m a t i c s f o r A

clean

specification

clean s p e c i f i c a t i o n s )

(Z,E)

should

(ZG,EG) w i t h T~B and EG c l e a n such t h a t

have

a

subspecification

(Z,E)

is

an e n r i c h m e n t o f

(ZG,EG).

4 . 6 Example ( B i t s t r i n g s This

with error handling)

clean s p e c i f i c a t i o n

defines bitstrings

of

arbitrary

E r r o r s a r e i n t r o d u c e d by t h e f u n c t i o n s Head and T a i l t o t h e empty s t r i n g . BitStrings = sorts Bit, cons

0,1

String : -> B i t - O k

NoHead : -> B i t - E r r o r : -> S t r i n g - O k • t.

: S t r i n g - O k B i t - O k -> S t r i n g - O k

NoTail : -> S t r i n g - E r r o r runes . I .

: String Bit

-> S t r i n g

Head : S t r i n g - > B i t Tail

: S t r i n g -> S t r i n g

vats

s:String s+:String-Ok b:Bit

eqns

N o T a i l l b = sINoHead = N o T a i l

length.

when a p p l i e d

b+,b1+,b2+:Bit-Ok

89 H e a d ( s + I b l + I b 2 + ) = He~d(s+Ib1+) Head(~ib+) = b+ Head(~) = Head(NoTail) = NoHead Tail(s+Ibl+lb2+) = Tail(s+Ibl+)ib2+ Tail(~Ib+) = T a i l ( ~ ) = T a i l ( N o T a i l ) = NoTail end spec The

p a r t s f o r t h e ok and e r r o r = o n s t r u c t o r s and f o r t h e

functions general

are

indicated

there will

by t h e keywords cons

be an e q u a t i o n p a r t f o r t h e

and

derived

funcs.

In

constructors

as

w e l l . For t h e s u b s o r t s t h e f o l l o w i n g e q u a t i o n s h o l d : T~,E,Bit_Ok ~{0,1},

T E , E , B i t _ E r r o r ~ { N o H e a d } v TE,E,String_Ok ~ ( { 0 ~ i } ) *

and

T E , E , S t r i n g _ E r r o r ~ { N o T a i l } . On t h i s b a s i s t h e f u n c t i o n s Head and T a i l a r e d e f i n e d such t h a t t h e s u b s o r t s a r e r e s p e c t e d .

5. CLEAN PARAMETRIC SPECIFICATIONS

5.1 D e f i n i t i o n A

( S i g n a t u r e morphism, s p e c i f i c a t i o n morphism)

s i g n a t u r e morphism f : Z 1 - > Z 2 between s i g n a t u r e s ( S I , ~ $ I , [ 1 ) and

($2,~$2,E2) Symb(E2)

consists

implies

forgetful

mappings

f:SI->S2

such t h a t s ~ S l r i m p l i e s f ( s ) ~ s 2 f ( r )

f ( ~ ) e £ 2 f ( w ) , f ( s ). s<Slr

of

A

s i g n a t u r e morphism f

f(s)<s2f(r).

functor

A

Uf:ALG~2->ALGEI.

and d~Elw~s i m p l i e s

is called

strict,

if

induces

A s i g n a t u r e morphi~m

e q u a t i o n o f E l , when t r a n s l a t e d by f , morphism

f:Symb(~l)->

s i g n a t u r e morphism f

c a l l e d s p e c i f i c a t i o n morphism from (Z1,EI) t o

specification

and

(E2,E2),

if

f

a is

every

b e l o n g s t o E2 : f ( E I ) ~ E 2 . A

i s c a l l e d simple,

if

$1~$2,

Symb(El)~

Symb(E2) and f : S I - > S 2 and f:Symb(El)->Symb(E2) a r e i n c l u s i o n s .

5.2 D e f i n i t i o n A

(Parametric s p e c i f i c a t i o n ~ p e r s i s t e n t )

p a r a m e t r i c s p e c i f i c a t i o n c o n e i s t s of a p a r a m e t e r s p e c i f i c a t i o n

{ZP,EP) EP~EB.

and The

a body s p e c i f i c a t i o n

(ZB~EB) such

c o n s t r u c t i o n F:ALGzp,Ep->ALGEB~EB [ADJ 78, specification rally"

that

EP~ZB and

semantics of a p a r a m e t r i c s p e c i f i c a t i o n i s t h e

is called persistent~

[WE 85] i s o m o r p h i c f o r

all

if

Po 8 4 ] .

free

A parametric

A and U(F(A)) a r e " n a t u -

(ZP~EP)-algebras A,

where U i s

90 the f o r g e t f u l

f u n c t o r U:ALGEB->ALGzp induced by t h e s i g n a t u r e s EP

and EB.

5.3 D e f i n i t i o n The

( A p p l i c a t i o n of a p a r a m e t r i c s p e c i f i c a t i o n )

r e s u l t of a p p l y i n g a p a r a m e t r i c s p e c i f i c a t i o n w i t h parameter

(ZP,EP) means

and body (~B,EB) of

a

t o an a c t u a l s p e c i f i c a t i o n

s p e c i f i c a t i o n morphism

specification

(~R,ER),

IF ssSP THEN h(s)

(ZA,EA)

h:(~P,EP)->(~A~EA)

is

by the

where ER=EA+hR(EB), ER=EA+hR(EB), hR(s) =

ELSE s FI

and hR(d) = IF ~sSymb(EP) THEN h(~)

ELSE d F I . (ZP~EP) . . . . ~ - - - >

(EB~EB)

I I h

I I

I

I hR

I

I

(ZA,EA) The

sR

> (ER~ER)

r e s u l t s p e c i f i c a t i o n i s t h e pushout of t h e a c t u a l s p e c i f i c a -

tion the

(ZA~EA) and t h e body s p e c i f i c a t i o n

(ZB~EB) w i t h r e s p e c t

parameter (EP,EP) and t h e s p e c i f i c a t i o n morphisms h

where

s

is

t h e s i m p l e s p e c i f i c a t i o n morphiem

induced

and by

to s, the

i n c l u s i o n of t h e parameter i n t h e body.

5.4 D e f i n i t i o n

(Clean p a r a m e t r i c s p e c i f i c a t i o n )

A

specification

parametric

(ZB,EB) the free

is called clean,

if

with

parameter

(EP~EP) and

f r e e c o n s t r u c t i o n F i s p e r s i s t e n t on ALBEp~EP~CLEAN and construction

i m p l i e s F(A)

body

t h e s i g n a t u r e s ZP and ZB a r e c l e a n ,

F p r e s e r v e s cleanness :

A

~

the

ALSEp,EP,CLEAN

E ALGEB,EB,CLEAN.

5 . 5 E x t e n s i o n Lemma ( f o r c l e a n p a r a m e t r i c s p e c i f i c a t i o n s ) Let

t h e r e be g i v e n a c l e a n p a r a m e t r i c s p e c i f i c a t i o n w i t h parame-

ter

(EP~EP) and body (~B,EB)~

(EA,EA)~

a

strict

actual

clean

specification

s p e c i f i c a t i o n morphism h: (EP~EP)->(EA~EA) and

the r e s u l t s p e c i f i c a t i o n (I)

an

(ER,ER) as d e f i n e d above.

The r e s u l t i n g p a r a m e t r i c s p e c i f i c a t i o n w i t h p a r a m e t e r (EA,EA) and body (ZR,ER) i s c l e a n : FR i s p e r s i s t e n t on ALGEA,EA~CLEAN and i t

preserves cleanness.

91 (2) F o Uh = UhR o FR. . . . . E___> ALG~p,EP,CLEAN ALGZB,EB,CLEAN

t

I

l

Uh ;

i UhR

l i

i I

ALGEA,EA,CLEAN . . . . ~ - - >

ALG~R,ER,CLEAN

5 . 6 Remark ( c o n c e r n i n g t h e e x t e n s i o n lemma) The p r o o f o f [Eh

81].

our e x t e n s i o n lemma a p p l i e s t h e R - e x t e n s i o n lemma o f

The

restriction

of ALBzp,EP t o c l e a n a l g e b r a s can

e x p r e s s e d as p r e d i c a t e f o r m u l a r e q u i r e m e n t s . clean

algebras

method,

because

neither

ok

morphism

the

underlying

The s t r i c t n e s s

o f t h e parameter

i m p l i e s t h a t ok o r e r r o r o p e r a t i o n s will

also

be ok o r e r r o r o p e r a t i o n s

to

specification

one does n o t want t o c a r e a b o u t e l e m e n t s

nor e r r o r .

h

parameter

is essential for

This r e s t r i c t i o n

be

being

passing

of

the

formal

in

the

actual

parameter.

5 . 7 Concept

(Pragmatics f o r

Analogously

to

clean parametric s p e c i f i c a t i o n s )

t h e case w i t h o u t p a r a m e t e r s a c l e a r

distinction

between ok and e r r o r c o n s t r u c t o r s and d e r i v e d f u n c t i o n s s h o u l d be established.

Therefore

parameter (ZP,EP) (ZP,EP)

a

clean parametric

~ (ZB,EG) ~ (ZB,EB)

all

w i t h T~G(A) and EG c l e a n such t h a t G

A~ALGEp,EP,CLEAN,

where G i s

duced by t h e p a r a m e t r i c s p e c i f i c a t i o n body

is

an e n r i c h m e n t o f B(A)

the f r e e c o n s t r u c t i o n w i t h p a r a m e t e r (EP,EP)

inand

(ZG,EG).

5 . 8 Example ( P a r a m e t r i c s t r i n g s

with error handling)

This clean parametric s p e c i f i c a t i o n trary

with

and body (ZB~EB) s h o u l d have a s u b s p e c i f i c a t i o n

i s p e r s i s t e n t on ALGzp,EP,CLEAN and F(A) for

specification

parameter

s o r t Char.

f u n c t i o n s Head and T a i l

o v e r an a r b i -

Again e r r o r s a r e i n t r o d u c e d by

when a p p l i e d t o t h e empty s t r i n g .

s pec P a r a m e t r i c S t r i n g s = parm s o r t s Char o~ons

defines strings

NoHead : -> C h a r - E r r o r

the

92 bod~ s o r t s S t r i n g cons

A : -> S t r i n g - O k .I.

: S t r i n g - O k Char-Ok -> S t r i n g - O k

NoTail : -> S t r i n g - E r r o r funcs

.I.

: S t r i n g Char - > S t r i n g

Head : S t r i n g -> Char Tail vats

: S t r i n g -> S t r i n g

s:String

s+:String-Ok

c:Char c + ~ c l + , c 2 + : C h a r - O k t - : C h a r - E r r o r eqns

NoTaillc = slc-

= NoTail

Head(s+Icl+Ic2+) = Head(s+Icl+) Head(Ale+) = c+ Head(A) = H e a d ( N o T a i l ) = NoHead Tail(s+Icl+Ic2+)

= Tail(s+Icl+)Ic2+

Tail(AIc+) = A Tail(A)

= T a i l ( N o T a i l ) = NoTail

e n d sp,ec The

parts

keywords for

the

it

is

for

the

parameter

p a r m and b o d ~ , parameter

and t h e

essential for

Char-Error algebra

In

and t h e

general

body are

there

constructors

will

indicated

be an e q u a t i o n

as w e l l .

= NoTail.

algebra

F(A)Char_Ok

F(A)

will

have

the

the part that sort

parameter

given~

following

note

c - of

I÷ a c l e a n

A w i t h s e t s AChar_Ok and AChar_Error i s

resulting

Please

p e r s i s t e n c y t o use t h e v a r i a b l e

in the equation s l c -

by

then t h e

carriers

:

~

AChar_Ok, F(A)Char-Error ~ AChar_Error , )* F ( A ) s t r i n g _ Ok ~ (AChar_Ok and F ( A ) s t r i n g _ E r r o r ~ { N o T a i l } . F u r t h e r m o r e t h e c o r r e s p o n d i n g f r e e c o n s t r u c t i o n i s n o t p e r s i s t e n t on ALG~p,Ep,

if

no r e s t r i c t i o n

t o c l e a n a l g e b r a s i s made.

5 . 9 Remark ( P o i n t e d a l g e b r a s and s p e c i f i c a t i o n s ) All

c o n s i d e r a t i o n s p r e s e n t e d here can be s p e c i a l i z e d t o

a l g e b r a s [Go 8 6 ] , sort.

In t h i s

pointed

where t h e r e i s o n l y one e r r o r element f o r

case e r r o r r e c o v e r y i s n o t s u p p o r t e d t o o w e l l ,

e s p e c i a l l y e r r o r p r o p a g a t i o n can be done a u t o m a t i c a l l y .

each but

93 6.

CONCLUSION

The

notion

algebra

of

a

clean algebra i s

satisfying

certain

a special

case

of

s o r t e q u a t i o n s which e s p e c i a l l y

sense i n t h e c o n t e x t o f p a r t i a l l y considered

just

an make

o r d e r e d s o r t s and which can

as a n o t h e r c o n s t r u c t f o r

algebraic specification

guages. For example i n c l e a n a l g e b r a s t h e s o r t

be lan-

equations

s-Ok n ~ - E r r o r = ~ and s-Ok u s - E r r o r = s are v a l i d f o r sort like

all

s o r t s s.

terms b u i l t union,

over the g i v e n s e t of

intersection,

An a l g e b r a s a t i s f i e s u a t i o n s of

A s o r t equation c o n s i s t s of a p a i r of s o r t s and s e t

operations

d i f f e r e n c e ~ complement and empty s e t .

a sort equation,

if

the set theoretic eval-

t h e two e x p r e s s i o n s w i t h r e s p e c t t o t h e g i v e n

coincide. This t o p i c

is

algebra

subject to f u t u r e research.

7. REFERENCES

ADJ 76

J.A.Goguen/3.W.Thatcher/E.S.Wagner : approach t o t h e s p e c i f i c a t i o n , tation

of a b s t r a c t data types.

gramming Hall, ADJ 78

methodology,

Englewood C l i f f s

H. E h r i g

/

R.T.yeh (ed),

tion

:

lOth STOC~ 1978,

/

1982,

C.Choppy :

tions. BGP 82

Proc.

F.Boisson / L.R.I.

/

pp.322-369.

Abstract

r e c o v e r y by means o f llth

ICALP 1984,

types

of

To a p p e a r .

exception handling

e q u a t i o n s and

declara-

LNCS 172, p p . 9 5 - 1 0 9 .

G. Guiho / D.Pavot :

R e p o r t , Orsay 1982.

data

approach based on a

between e x c e p t i o n s and e r r o r s .

M.Bidoit : Algebraic specification error

E.G. Wagner

Parameter p a s s i n g i n a l g e b r a i c s p e c i f i c a -

B . B e r n o t / M. B i d o i t

and

specification

San Diego.

w i t h e x c e p t i o n h a n d l i n g : An i n i t i a l

Bi 84

Prentice

Data t y p e s p e c i f i -

3~W.T h a t c h e r /

languages. LNCS 134, B e r l i n

distinction

pro-

i978~ p p . 8 0 - 1 4 9 .

H.-J.Kreowski /

J.B.Wright

BBC 8b

V o l . IV~

P a r a m e t r i z a t i o n and t h e power o f

t e c h n i q u e s . Proc.

algebra

Current trends in

J.W.Thatcher/E.S.Wagner/~.B.Wright : cation :

ADJ 81

An i n i t i a l

c o r r e c t n e s s and implemen-

Multioperator algebras.

94 Eh 81

H.Ehrig

:

A l g e b r a i c t h e o r y of parametrized

specifica-

t i o n s w i t h r e q u i r e m e n t s . Proc. b t h CAAP 1981, 8enova. EFH 83

H. Ehrig/W.Fey/H.Hansen : ACT ONE : An a l g e b r a i c s p e c i f i cation

language w i t h two l e v e l s

Report No. 8 3 - 0 3 , TU B e r l i n , EKMP 82

of

semantics.

Techn.

1983.

H. E h r i g / H . - J . K r e o w e k i / B . M a h r / PPadawitz . :

A l g e b r a i c im-

p l e m e n t a t i o n o f a b s t r a c t d a t a t y p e s . TCS, V o l . 2 0 1982. FGJM 85

K°Futasugi / J.A.Goguen /

J . - P . Jo u a n n a u d / J.Meseguer :

P r i n c i p l e s o f OBJ2. Proc. POPL 1985, p p . 5 2 - 6 6 . Ga 83

H.Ganzinger

:

Parametrized s p e c i f i c a t i o n

:

Parameter

passing and i m p l e m e n t a t i o n . ACM TOPLAS, V o l . 5 1983. GSM 76

V . G i a r r a t a n a / F . O i m o n a / U . M o n t a n a r i: cepts

in a b s t r a c t data type

Observability

specification.

Proc.

con5th

MFCS 1976, Gdansk, LNCS 45. SDLE 82

M . G o g o l l a / K . D r o s t e n / U . L i p e c k / H . - D . E h r i c h : A l g e b r a i c and operational

semantics o f s p e c i f i c a t i o n s a l l o w i n g e x c e p -

t i o n s and e r r o r s . TCS, V o i . 3 4 1984, pp.289-313. Go 83

M. G o g o l l a

:

specifications. cells Go 86

Partially

ordered

sorts

in

algebraic

Proc. 9 t h CAAP 1984, Bordeaux, B. Cour-

( e d ) , Cambridge U n i v e r s i t y Press, pp.139-153.

M.Gogolla : Ober p a r t i e l l

g e o r d n e t e Sortenmengen und d e -

t e n Anwendung z u r F e h l e r b e h a n d l u n g i n A b s t r a k t e n

Daten-

t y p e n . D i s s e r t a t i o n , TU Braunschweig, 1986. 8o 77

J.A.Goguen Proc.

:

Abstract e r r o r s f o r a b s t r a c t data

Conference

on Formal D e s c r i p t i o n o~

types.

Programming

Concepts 1978, E . J . N e u h o l d ( e d ) , North H o l l a n d . 8o 78

J.A.Goguen : Order s o r t e d a l g e b r a s : E~ception and e r r o r s o r t s , c o e r c i o n s and o v e r l o a d e d o p e r a t o r s . Semantics and Theory of Computation Report No.14, UCLA, 1978.

SM 84

J.A.Goguen/J.Meseguer : Order-sorted a l g e b r a I : P a r t i a l and o v e r l o a d e d o p e r a t o r s ,

e r r o r s and i n h e r i t a n c e . Tech-

n i c a l R e p o r t , SRI I n t e r n a t i o n a l , GJM 85

K1 84

1984.

J.A. Goguen/J.-P.Jouannaud/J.Meseguer :

Operational

m a n t i c s f o r o r d e r - s o r t e d a l g e b r a . Proc.

12th ICALP 1985.

se-

H . K l a e r e n : A c o n s t r u c t i v e method f o r a b s t r a c t a l g e b r a i c software specification.

TCS, V o l . 3 0 , No.2 1984.

95 Po 84

A.Poigne

:

Modularization

specifications ST 85

with subsorts.

D.Sannella/M.Wirsing : specification

Wa 79

M.Wand : sions.

WE 85

for

algebraic

I m p e r i a l C o l l e g e , London.

D . S a n n e l l a / A ~ T a r l e c k i : On o b s e r v a t i o n a l e q u i v a l e n c e and algebraic specification.

SW 83

techniques

l O t h CAAP 1985, B e r l i n .

kernel language f o r

Final

a l g e b r a s e m a n t i c s and d a t a t y p e

~CSS, V o l ~ l g ,

data types.

exten-

No. 1 1979, p p . 2 7 - 4 4 . Canonical constraints

for

parame-

Research R e p o r t RC 11248, IBM, 1985.

WPPDB 83 M . W i r s i n g / P . P e p p e r / H . Partsch/W. Dosch/M.Broy : a r c h i e s of

algebraic

and i m p l e m e n t a t i o n . P r o c . FCT 1983.

E.G.Wagner/H.Ehrig : trized

Proc. A

abstract data types.

On

hier-

A c t a I n f o r m a t i c a 1983~

Toward formal development of programs from algebraic specifications: implementations revisited (Extended abstract) Donald Sannella 1 and Andrzej TarIecki2 Abstract The program development process is viewed as a sequence of implementation steps leading from a specification to a program. Based on an elementary notion of refinement, two notions of implementation are studied: constructor implementations which involve a construction "on top of" the implementing specification, and abstractor implementations which additionally provide for abstraction from some details of the implemented specification. These subsume most formal notions of implementation in the literature. Both kinds of implementations satisfy a vertical composition and a (modified) horizontal composition property. All the definitions and results generalise to the framework of an arbitrary institution.

1

Introduction

There has been a lot of interesting work done on notions of refinement (see e.g. [GTW 78], [GB 80], [Ehr 81,82], [EKMP 82], [SW 82], [GM 82], [Gan 83], [Lip 83]). In [SW 83] and then in [ST 85b,86b] we used a very simple notion of specification refinement which seems appropriate for loose specifications: a specification SP refines to a specification SP', if every model of SP' is a model of SP; this extends to a notion of refinement of parameterised specifications. This looks suspiciously oversimplified, especially in comparison with most previous work in this area. In this paper we elaborate on how this simple notion can provide a basis for realistic and non-trNial program development. Roughly speaking, first we allow an implementation of a specification SP by another specification SP t to consist of a "program" or construction written in terms of SP t to compute the functions specified in SP. This subsumes most previous notions of implementation in the literature, e.g. [GTW 78], [Ehr 82], [EKMP 82] and [SW 82]. Then we incorporate ideas concerning behavioural equivalence of algebras as discussed in [GGM 76], [Rei 81], [GM 82], [ST 86b] (and elsewhere), by allowing the construction to deliver a result which realises SP not "exactly" but only up to an equivalence on algebras. This subsumes the notions of implementation in [Ehr 81], [GM 82], [Sch 82] and [BMPW 86]. These notions extend to parameterised specifications as before. In order to be useful for stepwise and modular program development, implementations should compose vertically and horizontally [GB 80]. The simple notion of refinement enjoys both of these properties. The first extended notion composes vertically and satisfies a (modified) horizontal composition property; similar results for the second notion hold only under certain additional conditions. We present these ideas in the framework of partial algebras [BrW 82]. This is mainly to take advantage of the reader's intuition, since all of the main definitions and results as well as method* ological remarks may be directly restated in the framework of an arbitrary institution [GB 84]. This means that they can be used to develop programs from specifications in a wide variety of logical systems. Thus, a user of the presented program development methodology may choose the logical system which is most suited to his particular task. Moreover, different logical systems may be most suitable at different stages of the development of even a single program, for example when developing an efficient imperative program from a high-level algebraic specification. We enable this by allowing specifications to be implemented by specifications in a different institution using what we call a semi-institution morphism [Tar 86]. 1Department of Artificial Intelligence, Universityof Edinburgh and Laboratory for Foundationsof Computer Science, Department of Computer Seience~ University of Edinburgh 2Institute of Computer Science, Polish Academyof Sciences, Warsaw

97 Unfortunately, for lack of space we are not able to cover this topic here; the interested reader should consult [ST 87] for a detailed treatment of this subject as well as for all the proofs, examples and full discussion which we are forced to omit here.

2

Algebraic preliminaries

Due to lack of space we omit the definitions of the following standard algebraic notions: signature (E), signature morphism (a), the category S i g n of signatures with initial (empty) signature ~.¢; partial E-algebra A, (closed) E-subalgebra, (weak) E-homomorphism, the category P A l g ( E ) of partial E-algebras; the a-reduct functor _[~: P A l g ( E ' ) --* P A l g ( E ) for any signature morphism a: E ~ E; terms t, equations VX.t = t', definedness formulae D(t), partial (first-order) sentences ~, and their translations (a(t), etc.) under signature morphisms. All these definitions may be found in [ST 87] and elsewhere. We write A ,~ ~ to denote that the algebra A satisfies ~, defined in the usual way (generalised to classes of algebras and sets of sentences as usual). For any signature ~ and S C_sorts(E), we say that a E-algebra A is reachable on S if it contains no proper E-subalgebra with carriers of sorts not in S the same as in A. In other words, every element of A is the value of a E-term with variables of sorts not in S (for some valuation). Notice that any E-algebra A contains exactly one ~-subalgebra which is reachable on S and has carriers of sorts not in S the same as in A, denoted ]~s(A). We omit qualification by S in these definitions if S =

sorts(E).

Let A e P A l g ( E ) . A congruence on A is an equivalence relation =- C tA[ × ]A[ such that for any f : s l , . . . , s n --~ s in Z and al,bl E )A)s,,...,a,,,b,, e ]A[,., if al =-s, bl . . . . ,an -=,. b. and fit(a1 . . . . . an) and fA(bl . . . . . bn) are defined, then fA(al . . . . . an) =, fA(bl . . . . . b,,). The quotient of an algebra by a congruence is defined as usual.

3

Specifications and r e f i n e m e n t

We are not going to formally define precisely what specifications are; they are just finite syntactic objects of some kind. Every specification describes a certain signature and a class of algebras over this signature. This semantics is made explicit using two mappings which assign to each specification SP a signature Sig[SP] E [Sign[ and a class Mod[SP] C [PAlg(Sig[SP])] of Sig[SP]-algebras. Algebras in MocI[SP] are called models of SP. We call a specification consistent if it has at least one model. This rather general description covers high-level user-oriented loose specifications admitting nonisomorphic models as well as low-level detailed specifications or even programs which for us are just very tight specifications. We adopt a purely model-theoretic view here and stop the analysis of the notion of a program at this level. Any application of the methodology we outline would require some further syntactic constraints on the notion of a program. D e f i n i t i o n 1 For any signature ~, S p e c ( ~ ) denotes the collection of all E-specifications, i.e. specifications SP such that Sig[SP] = ~,, preordered by the inclusion of model classes. For any two specifications SP1 and SP2, a specification morphism a: SP1 --* SP2 is a signature morphism a: Sig[SP1] --~ Sig[SP2] such that for any model A2 C Mod[SP2], A2I~ e Mod[SPl]. We assume that S p e c ( E ) contains at least basic specifications. That is, given a signature E and a (finite, recursive, r.e.) set ¢ of E-sentences, (E, ¢) is a specification with:

Sig[(E, ~)] = Z Mod[(Z, ~)] = {A e P A l g ( E ) ] A ~ ¢} If the sentences are all (universally quantified) equations or definedness formulae we call (E, ¢) an equational specification.

98

Specification-building operations are used to put together little specifications in nice ways to make progressively bigger ones [BG 77]. Any specification-building operation, given a list of argument specifications, yields a result specification; semantically, a specification-building operation is a function on classes of algebras. The only assumption we make about these functions is that they are monotonic; intuitively, less restrictive argument specifications yield a less restrictive result. Specification languages like CLEAR [BG 77,80] may be viewed just as sets of such operations plus some syntactic sugar. E x a m p l e 1 ( t r a n s l a t e ) [ST 86a] Given a specification SP and signature morphism a: SigISP ] --+ E', t r a n s l a t e SP b y a is a specification with semantics defined as follows:

Sit[translate SP b y a] = ~' Mod[translate SP b y a] = {A' e P A l g ( E ' ) i A'I~ e Mod[SP]}

[]

T r a n s l a t e is actually a family of specification-building operations, t r a n s l a t e = {translateo: z~r.,: S p e e (E) --+ S p e c (E')}oeStgn For any specification-building operation w we will write w: S p e c ( E ) --+ S p e c ( E ' ) , meaning that w takes Z-specifications to E'-specifications. Note that we have tacitly assumed that ~o is a unary operation; to simplify the presentation we make the same assumption throughout when convenient. A specification language usually provides a way for the user to define his own specificationbuilding operations, i.e. a mechanism for constructing parameterised specifications. There are different approaches to parameterised specifications; in this paper we use the approach of [ST 86a]. Semantically, any parameterised specification can be viewed as a function taking any specification over a given parameter signature ~par to a specification over a result signature Er,s- Syntactically, we write a parameterised specification as a )~-expression, ~X: Zpar.SPr,~[X], where X is an identifier and SPr~[X] is a Zr~s-specification built using specification-building operations which may involve X as a variable denoting a Ep~,-specification. For any Epar-specification SP, (~X: Ep~,.SPr~,[X])(SP) is a specification with semantics defined (essentially as 13-conversion) as follows: 5g[(~,X: r~o,.SP, o,[Xl)(SP)] = E~o, Mod[(~X: Ep~.SP,,,[X])(SP)] = Mod[SF~,,[SP/X]] We sometimes write ()~X: ~p~.SP,~[X]): Spec(Zp~) --* Spec(H~,,) to indicate the paxameter and result signatures explicitly. The programming discipline of stepwise refinement suggests that a program (which is a specification) be evolved from a high-level specification by working gradually via a series of successively more detailed lower-level intermediate specifications. A formalisation of this approach requires a precise definition of the concept of refinement. D e f i n i t i o n 2 Given two specifications SP and SP' such that Sig[SP] = Sig[SP'], we say that SP refines to SP', written SP ,.,.,'> SP', if Mod[SP'] C_ Mod[SP].

Given two parameterised specifications P and P' with the same parameter signature Epic, we say that P refines to P', written P ~ P', if for any Epic-specification SP, P(SP) ~ P'(SP). Intuitively~ SP ~ SP' if SP' incorporates more design decisions than SP. An important issue for any notion of refinement is whether refinements can be composed vertically (SP ~ SP' and SP' ~ SP" implies SP ~ SP") and horizontally (P ~ P' and SP ,..-.> SP' implies P(SP) .....> P'(SP')) [GB 80]. The above notion of refinement has both these properties since specification-building operations are monotonic. These properties allow large structured specifications to be refined in a gradual and modular fashion.

99 The development of a program from a specification consists of a series of refinement steps SP1 ~ ... ~ SP~, where SPo is the original high-level specification and SPn is a program. Vertical eomposability guarantees the correctness of SP, with respect to its specification SPo. This views each of the specifications SPo,..., SP, as a single indivisible entity. If, however, we decompose any of them using a parameterised specification, say SP~ = P(SP), then the further developments of P and of SP may proceed separately. Horizontal composability guarantees that the results of these developments may always be combined to give a refinement of SPk and so of SPo as well. Of course, these (sub)developments may themselves involve further decomposition.

SPo ~

4

Constructors and

implementations

The simple notion of refinement is mathematically elegant but perhaps a bit oversimplified from a practical point of view. In the sequel, we wilt develop notions of implementation built on top of this simple notion of refinement which are more suited to practical use. We start with a notion of implementation which involves a construction from the implementing specification to the implemented specification. What is a construction? Model-theoretically, the characteristic feature of a construction is that it transforms an algebra over one signature to yield another algebra over a (possibly different) signature. Thus, we can identify a construction a with a functions a: PAlg(E) -~ PAlg(E'). This determines a specification-building operation denoted (ambiguously) by the same symbol. We call specification-building operations of this kind constructors. D e f i n i t i o n 3 A constructor determined by a/unction ~: PAId(E) ~ PAlg(E') is a specificationbuilding operation ~¢: Spee(~.) --~ Spec(E'), where for any E-specification SP, Sig[~(SP)] -- E' and

Mod[~(SP)] = {~(A) I A e Mod[SP]}. Fact 1 Constructors are monotonic, preserve consistency of specifications, and are closed under

composition.

[]

E x a m p l e 2 (derive) For any E'-specification SP' and signature morphism ~r: E -~ E', the semantics of the specification derive f r o m SP ~b y a is as follows: Sig[derive f r o m SP ~ b y a] = E Mod[derive f r o m SP' b y a] = (A]~ [ A e Mod[SP']) The derive specification-building operations (one for each a: E - , E') are constructors determined by the corresponding reduct functors --In. Intuitively, derive can be used to hide and/or rename some of the sorts and operations of a specification. [] E x a m p l e 3 ( r e s t r i c t ) For any E-specification SP and set S c_ sorts[Z] of sorts, the semantics of the specification r e s t r i c t SP o n S is as follows:

Sig[restrict SP o n S] = E Mod[restriet SP on S] = {)~s(A) t A e Mod[SP]} The r e s t r i c t specification-building opera, ions (one for each E and S C sorts[E]) are constructors determined by the corresponding restrict functors ~s. :Restrict is used to remove "junk", i.e. to restrict to the reachable part of Mgebras. [] aFrom the category-theoretic point of view, it is natural to assume that this is a functor (all our examples are) but since we do not use the morphismpart in this paper we take this simplifiedview here.

100

E x a m p l e 4 ( q u o t i e n t ) For any T-specification S P and congruence ~ on ground ~-terms, the semantics of the specification q u o t i e n t S P w r t ~ is as follows: Sig[quotient S P w r t ~1 = ~ Mod[quotient S P w r t ~] = { A / ~ f A e Mod[SP]} The q u o t i e n t specification-building operations (one for each Z and ~ on Z-terms) are constructors determined by the corresponding quotient functors _ / ~ . Intuitively, q u o t i e n t is used to identify the values of certain terms; usually the congruence ~ is presented via a set of equations. [] E x a m p l e 5 ( e x t e n d ) If we have a signature morphism a: Z --* ~' then constructors from Spec (~) to $ p e c ( ~ ' ) will be called synthesizing constructors along a. The intuition is that they just build new stuff on top of the existing algebras without forgetting anything. One standard way to define such a synthesizing constructor is using the free extension. Namely, for any signature morphism a: Z --+ ~f and equational Et-specification S P ~, there is a free functor F~: P A l g ( ~ ) ~ Mod[SP'] (the left adjoint to the reduct funcLor _In: Mod[SP'] --. PAlg(~,)). That this functor always exists is a well-known fact. For any E-specification SP, e x t e n d SP t o S P ~ v i a a is a specification defined as follows: Sig[extend SP t o SP ° v i a a] = ~' Mod[extend SP t o SP' v i a a] = {Fo(A) ] A e Mod[SP]} Note that S P may be an arbitrary specification here, not necessarily equational. In general F~ does not have to preserve all the properties required by S P (so a was not required to be a specification morphism a: S P --* S P ~) although it does preserve ground equations deducible from SP. [] Non-example ( t r a n s l a t e ) The t r a n s l a t e specification-building operation defined in the last section is not a constructor. Consider for example any a: ~¢ --* ~, where ~ is non-empty or any a': ~ --* ~' which is non-injective on sorts. [] D e f i n i t i o n 4 A synthesizing constructor ~: S p e c ( E ) --* S p e c ( ~ ' ) is persistent along a signature rnorphism a: ~ -+ E', written ~: Spec(r,) -~+ S p e c ( ~ ' ) , if ~: P A l g ( Z ) -+ P A l g ( E ' ) is (strongly) persistent with respect to o, i.e. for any ~.algebra A, to(A)[~ = A. E x a m p l e 6 ( a m a l g a m a t e d u n i o n ) Given two persistent constructors *;1: S p e c ( E ) - - ~ Spec(E1) and ~2: S p e c ( ~ ) - ~ Spec(E2), let ol "El

ty2t be a pushout in Sign. For any E-algebra A, define ~(A) to be the unique E*-algebra such that n(A) J~l, = ~I(A) and n(A)In2, = ~2(A). ~(A) is well-defined since nl(A)In1 = A = n2(A)la~. Thus, we have defined a function ~: P A l g ( E ) --* P A l g ( E ' ) . We denote this function and the corresponding synthesizing constructor (along a l ; a l t = a2;a2 t) by ~;1 + ~2; if any doubts may arise, we add a l , a2 as subscripts to +. Intuitively, ~1+f¢2 "puts together" the constructions n l and ~2. The assumption of persistency guarantees that this is possible. (See the notion of amalgamated sum in [PB 85] and [EM 85].) [] F a c t 2 If a l : S p e c ( Z ) - - ~ S p e e ( ~ l ) and a2: S p e c ( E ) - ~ S p e c ( ~ 2 ) are persistent constructors then ~1 + ~2: S p e c ( E ) - - ~ S p e c ( ~ ' ) is a persistent constructor along a =~el a l ; a l ' = a2;a2'. []

t01

E x a m p l e 7 ( t r a n s l a t i o n o f a c o n s t r u c t o r ) There is another operator on constructors connected with the pushout in Sign. Namely, reconsider the pushout diagram of example 6 and suppose ~;1: S p e c ( E ) - ~ - + S p e c ( ~ l ) is a persistent constructor. Then for any A2 e P A l g ( ~ 2 ) , define ¢2(~1)(A2) to be the unique ~'-algebra such that o2(~1)(A2)In1, = ~l(A2]a2) and a2(~l)(A2)In2, = A2. Thus we have defined a function a2(~:1): P A I g ( ~ 2 ) --+ PAlg(G') which we call the translation of ~1 along a2. We use the same notation and terminology to refer to the corresponding synthesizing constructor (along a2'). Notice that a2(¢~1) is persistent. Intuitively, cr2(~1) performs ~1 on the up. part" of ~2-algebras and leaves the other components unchanged. Notice that the translation of a constructor is a more elementary operation than the amalgamated union. Namely, using the notation of example 6, ~1 + ~2 = t~2;a2(~l) = ¢:1;a1(~2). [] D e f i n i t i o n 5 ( c o n s t r u c t o r i m p l e m e n t a t i o n ) A specification SP is implemented by a specification SP' via a constructor x~: Spec(Sig[SP']) --* Spec(Sfg[SP]), written SP ~ SP', ff SP .....> ~(SP'). Intuitively speaking, if we want to evaluate a function in SP, we are able to do this provided we can evaluate any function in SP' since the constructor ~ puts together functions in SP' to obtain all functions in SP. In this sense, ~ may be viewed as a program parameterised by the (possibly not yet executable) specification SPq Notice that, using the constructors introduced in examples 2-5 above, we can reduce many of the notions of implementation in the literature (e.g. [GTW 78], [Ehr 82], [EKMP 82], [SW 82]) to the one above. For example, the implementation notion of [EKMP 82] assumes that ~: is the composition of e x t e n d , d e r i v e , r e s t r i c t and q u o t i e n t constructors (in that order). Our definition of constructor implementation resembles the notion of implementation given in [Ehr 81] for single algebras. In [Ehr 81], A is implemented by B via a construction F if A is (isomorphic to) a quotient of a subalgebra of F(B). When generalising to loose specifications, the requirement that some quotient of some subalgebra of F(B) be isomorphic to A may be regarded as a construction only if the subalgebra and quotient are taken uniformly on all models B of the implementing specification. If we do not require uniformity then this amounts to a non-constructive step which will be fully subsumed by the notion of abstractor implementation defined in section 5. There are even closer similarities with the notion of implementation of (parameterised) specifications in [Lip 83]; see section 6.1 for details. T h e o r e m 1 ( v e r t i c a l c o m p o s i t i o n ) /f SP ~

SP' and SP' ~

SP" then SP ~

SP".

~ []

Notice that since ~';~: is an acceptable constructor, there is no reason to require that it has (or may be transformed to) the same form as either ~ or ~:'. In general this will not be the case. However, in some special cases it turns out that such normal form theorems may be obtained, often under some additional assumptions about the specifications involved (see e.g. [Ehr 81], [EKMP 82], [8W 82], [EWT 83], [Ore 83]). It seems to us that the requirement that the composition of constructors must be forced into some given normal form corresponds to requiring programs to be written in a rather restrictive programming language which does not provide sufficiently powerful modularisation facilities for the job. In some situations, putting a constructor into a normal form can be viewed as an optimization process. The following simple fact allows us to mechanically strip off outermost constructors if the specification we want to implement happens to be built in this way. F a c t 3 For any constructor ~: S p e c ( ~ ) -+ S p e c ( ~ ' ) and ~-specifieatfon SP, ~(SP) ~., vided that SP ~, SP'. An interesting special case of this is the amalgamated union of specifications.

SP' pro[]

102

D e f i n i t i o n 6 For any two specification morphisms a l : SP ~ SP1 and er2: SP --~ SP2, the amalgamated union of SP1 and SP2, written SP1 + SP2 (decorated with subscripts SP, trl,a2 on + if necessary}, is a specification with semantics defined as follows:

sig[sP1 + sP2] = ~; Mod[SP1 + SP2] = Mad[translate SP1 by al'] U Mad[translate SP2 by aT] where the following diagram is a pushout in S i g n : ol

Sig[SP]

Sig[SP2]

= Sig[SP1]

a2'

" ~'

T h e o r e m 2 If SP1 ~ SP and SP2 ~ SP where both ~1: Spec(Sig[SP]) - ~ Spec(Sig[SP1]) and ~;2: Spec(Sig[SP]) -el+ Spec(Sig[SP2]) are persistent constructors, then SP1 + SP2 ~ SP. D This theorem allows us to implement the independent components of a specification separately and then combine their implementat;.ons provided that they do not affect the common part. In the above theorem we required ~1 and t¢2 to be persistent on all Sig[SP]-algebras as in the definition of the amalgamated union of constructors. However, in this context (as well as in similar situations in the sequel) it is sufficient to require that ~;1 and ~;2 are persistent only on models of SP (which may be easier to achieve in practice). Of course formally, ~I + ~;2 is then only a constructor on Mad[SP] rather than on PAlg(Sig[SP]) since it may be undefined on some Sig[SPl-algebras. T h e o r e m 3 Let E

E2

al

.

a2'

E1

" El

be a pushout in S i g n , tel: S p e c ( E ) -el+ Spec(E1) be a persistent constructor, and SP1,SP2 be E1and E2-speeifications respectively. [f SP1 ~ d e r i v e f r o m SP2 b y a2 then S P I + S P 2 ~ SP2. [] This gives another way of decomposing a specification and implementing the components separately. Namely, we implement one component using (a part of) the other and then we can proceed with the implementation of the other component. Summing up, the development process using this notion of implementation would consist of a sequence of steps SPo ~ SP1 ~ "" ~ SP,. Intuitively, SPo, SP, etc. do not "grow" as happens when we use the simple refinement notion, where this development would look like: SPo ~-~

~l (sP,)

---~

. . . ~.~> ~

(. . .

~.CSP.)...)

Using constructor implementations, we gradually reduce the specification by implementing its parts. Our goal is to end up with an empty specification over the empty signature, i.e. SPn = (T,¢, 0). Then, the composition of constructors to,;-.. ;~I forms a program which implements SPo.

103

5

A b s t r a c t o r s and i m p l e m e n t a t i o n s

It is often possible to abstract away from some of the details of the user's original specification without violating the real intention behind it. This is the idea behind the specification technique known in software engineering as abstract model specification [LB 77], in which the user defines in a more or less concrete fashion a model which gives the desired results with the intention that any program giving the same answers is acceptable. This theme has been discussed in [GGM 76], [Rei 81], [GM 82], [Kam 83], [ST 85a] and elsewhere; the idea goes back (at least) to work on automata theory in the 1950's [Moo 56]. To formalize these ideas we will consider another class of specification-building operations called abstractors. Intuitively, any equivalence relation on Z-algebras determines a specification-building operation which relaxes interpretation of any E-specification SP by admitting as a model any Zalgebra which is equivalent to a model of SP. Definition 7 An abstractor determined by an equivalence relation =_-C PAlg(E) × PAlg(~) is a specification-building operation a~: Spec(~) --* Spec(E) where for any Z-specification SP, S i g [ a ~ ( S p ) ] = r.

Mad[a~(SP)l

=

{A e

PAlg(E) I 3A' e

Mod[SP].A =__A'}

In the sequel we will omit the subscript =- when there is no danger of confusion. Also, if a is known we denote the abstraction equivalence which determines it by =_-~. F a c t 4 Abstractors are monotonic, idempotent, and preserve and reflect consistency of specifications. [] In general, abstractors are not closed under composition. This fact is neither surprising nor disturbing; we will not in fact have occasion to compose abstractors. E x a m p l e 8 ( o b s e r v a t i o n a l a b s t r a c t i o n ) For any E-specification SP and set W of ground Zterms, the semantics of the specification a b s t r a c t SP w r t W is as follows [SW 83]: Sig[abstract SP w r t W] = Z Mad[abstract SP w r t W] = {A E PAlg(Z) I 3A' E Mad[SP].A =w X ) where for any two algebras A , A ' E PAlg(Z), A --=-wA' iff: • for all t e W , A p D(t) iff A' p D(t), and • for all s E 8orts(E) and all t,t' E W,, A ~ t = t' iff A' ~ t = t'. Intuitively, W is the set of G-terms which represent computations the user is allowed to perform. We do not want to distinguish between algebras in which all these computations give the same results. A similar idea in the context of concurrent processes appears in [deNH 84]. [] E x a m p l e 9 ( b e h a v i o u r a l a b s t r a c t i o n ) An important special case of observational abstraction is behavioural abstraction. For any E-specification SP and set OBS C sorts(E) of sorts, the semantics of the specification b e h a v i o u r SP w r t OBS is as follows [SW 83], [ST 86a], [ST 86b]: Sig[behaviour SP w r t OBS] = Z Mad[behaviour SP w r t OBS] = {A E PAlg(Z) I 3A' e Mad[SP].A =OBS A'} where the equivalence =-OBS is just ~-w for W the set of all ground E-terms of sorts in OBS. Intuitively, OBS is the set of external sorts, visible to the user. []

104

D e f i n i t i o n 8 ( a b s t r a c t o r i m p l e m e n t a t i o n ) A E-specification SR is implemented by a E'-spceification SP' wrt an abstraetor a: Spec(E) --* Spec(Z) via a constructor ~: Spec(E') -~ Spec(E),

written SP ~

sP', if ~( sP) ~

~( sP').

If in the above definition, a is behavioural abstraction, then intuitively speaking we are implementing the behaviour of SP rather than SP itself. This subsumes the notions of implementation in [GM 82], [Sch 82] and [BMPW 86]. Notice that the abstractor a cannot be chosen arbitrarily; the choice depends on the specification SP and the context in which it is to be used. If a abstracts too much then the implementation will be useless - - for example if -= is the total equivalence on P A l g ( E ) then SP 2~> SP' for any SP' and constructor ~: Spec(Sig[SP']) ~ Spec(Sig[SP]). Suppose SP ~ SP' and SP r ~ SP". We would like to be able to conclude that SP ~ SP". According to the above argument we assume that a was chosen appropriately for the context in which SP is to be used and so we do not want to change it even when composing implementations. In general, there is no hope for such a result. If a I is too "liberal", there is no reason to expect that transforms any a'(SP')-model to a model of a(SP). However, the following theorem does hold: T h e o r e m 4 ( v e r t i c a l c o m p o s i t i o n ) I] SP ~ SP s and SP' ~ , SP then SP ~ SP" provided preserves the abstraction equivalences, i.e. for any two algebras A1, A2 E P A l g ( Sig[SP']) if A1 =--~, A2 then a(A1) ---~ a(A2). [] A methodological conclusion from this theorem is that the development process should proceed as follows: starting from a specification SP considered in a context for which an abstractor a is appropriate, we (abstractor) implement SP, say ST' ~ SP'. The next step should be to establish the appropriate abstractor up to which SP' may be considered by "pushing ~ through a". Namely, this should be the abstractor determined by the equivalence a - ~ ( - , ) where for A, A' E PAlg(SIg[SP']), A a - l ( ~ a ) A t iff a(A) ----~~(A'). Then, we can proceed with the development of SP' in the context of the abstractor determined by ~-~(-~). (Actually, any equivalence finer than a - ~ ( = , ) will do.) Similar ideas in the context of concurrent processes appear in [Lar 86]. C o r o l l a r y 1 If SPo ~ SPo ~ SP,.

"" ~

SP, and -a2 C _

Ell(-----ai)

and ... and - ~ . C _ a ,-i_ l ( =_a . _ , ) then []

Note that in practice, it is often convenient to sharpen the above results. They hold if the constructors preserve the equivalences between models of the appropriate specifications (e.g. in the vertical composition theorem it is sufficient that ~(A1) ~ ~(A2) for any A1 e PAlg(Sig[SP']) and A2 E Mod[SP'] such that A1 =-~, A2). In the rest of this section, we show that vertical composition and the above methodological remarks may work in practice. On one hand, the constructors we have introduced do preserve appropriate (observational) equivalences; and on the other hand, we show how to push standard observational equivalences in a satisfactory way through the constructors we have defined. L e m m a I ( d e r i v e ) For any signature morphism a: E1 --+ E2 and set W of ground E2-terms, P j l ( - w ) : ---aCW), where P~: Spec(E2) --+ Spec(E1) : d 4 ~X: E2. d e r i v e f r o m X b y a. [] L e m m a 2 ( r e s t r i c t ) For any signature E, S C sorts(E) and set W of ground E-terms, A - w ]~s(A) for all E-algebras A, where Rs: S p e c ( E ) -* Spec(E) =~el AX: E. r e s t r i c t X on S. [] The above lemma gives directly a characterisation of the result of pushing observational equivalence through r e s t r i c t constructors. Moreover, it directly implies that r e s t r i c t steps may be skipped if we use abstractor implementations. C o r o l l a r y 2 Under the assumptions of lemma P, ]~l(=-w) = - w .

[]

105

C o r o l l a r y 3 Under the assumptions of lemma 2, if a is the abstractor determined by n-w, then for any E-specifications SP and SP', SP ~~s SP' implies SP ~t a SP'. [] It is worth pointing out that the above corollary also allows us to throw out r e s t r i c t steps "in the middle" of the development process (provided that the intermediate equivalence used in this step satisfies the assumptions of lemma 2). This means that corollary 2 becomes superfluous since instead of using it to push equivalences through r e s t r i c t steps we can just skip these steps entirely. The situation with q u o t i e n t steps is similar although we need slightly more restrictive assumptions (see [ST 87] for details). Definition 9 For any signature morphism a: Z ---* Z', constructor ~: Spec(~) --~ Spec(Z') and sets W and W' of ground Z- and ground ~'-terms respectively, ~ is observably sufficiently complete (wrt W , W ' ) if for any term t' E W', either for any A E PAlg(Z), ~(A) ~ D(t') or there exists a term t e W such that for any A e PAlg(Z), ~¢(A) ~ t' = or(t). Typically, we will consider sets W and W' such that observable sufficient completeness is a weaker condition than sufficient completeness, which corresponds to the case where W' is the set of all ground }]'-terms of the sorts a(S) for S =a,f sorts(P.) and W is the set of all ground E-terms. Definition 10 For any signature morphism a: ~ --* ~', constructor ~: Spec(Z) --~ Spec(I]') and set W of ground E-terms, ~c is observably persistent {wrt W ) if for all terms tl,t2 E W of the same sort and anu A E PAIg(Z), ~(A) ~ a(tl) = a(t2) iff A ~ tl = t2 and ~(A) ~ D(a(tl)) iff A ~ D(tl). Notice that observable persistency is a weaker condition than the standard persistency. L e m m a 3 (synthesize) For any signature morphism a: Z --* Z' which is injective on sorts, structor t~: Spec(Z) --, Spec(~') and sets W and W' of ground Z- and Zt-terms respectively, is observably sufficiently complete wrt W, W ~ and observably persistent wrt W then ~¢-i(-~w,) 3 Moreover, if in addition W is a minimal set such that observable sufficient completeness holds '~- ~ ( - w , ) = - w .

conif =w. then []

As remarked already, constructor implementation using the derive, restrict, quotient and e x t e n d constructors subsumes many of the notions of implementation in the literature. The above lemmas imply that the extension of any of these notions to a corresponding notion of abstractor implementation goes through smoothly. L e m m a 4 ( a m a l g a m a t e d union) Let ~1: S p e c ( Z ) - - ~ Spee(Z1) ands:2: S p e e ( B ) - ~ Spec(E2) be persistent constructors, W, W 1 , W 2 be sets of ground Z-, ~1- and ~.2-terms respectively such that ~1 is observably sufficiently complete wrt W, W1 and ~2 is observably sufficiently complete wrt W, W 2. Recall that ~ =def ~;1 + ~2: Spee(P,) ~ Spee(Z'), where al Z • ZI

Z2

' P,,'

is a pushout in Sign, is a persistent synthesizing constructor (along a l ; a l ' = a2;a2'} such that for A e PAlg(Z), ~(A) is the unique E'-algebra such that ~;(A)1ol, = ~I(A) and to(A) o~, = ~;2(A). Under these assumptions, ~ is observably sufficiently complete wrt W , W ' where W I =def e l (W1) U ~2' ( w 2 ) .

[]

C o r o l l a r y 4 Under the assumptions of lemma 4, ~c-l(-w ') 2 - w .

[]

106

L e m m a 5 ( t r a n s l a t i o n of a c o n s t r u c t o r ) Consider again the pushout diagram from lamina 4. Let W, W1, W2 be sets of ground E-, E l - and E2-terms respectively, and let s l : Spec(E) _z2+Spec(E1) be a persistent constructor. If ~1 is observably su~ciently complete wrt W, W1 and cr2(W) C_ W2 then o2(~1): Spec(E2) --* Spec(E') is observably sui)~eiently complete wrt W 2 , W ~ where W' =

o1'(w1) u ~2'(w 2).

[]

C o r o l l a r y 5 Under the assumptions of lemma 5, o2(~1)-1(~w ,) ~ ~w2.

[]

6

Parameterisation

and

implementations

In the same way as the simple notion of refinement on specifications gave rise to a notion of refinement for parameterised specifications, the definitions of constructor and abstractor implementation extend to notions of constructor and abstractor implementation for parameterised specifications.

6.1

Parameterisation and constructor implementations

Definition 11 For any parameterised specification P: Spec(Ep~r) --* Spec(Er,~) and specificationbuilding operation w: Spec(E,~,) --~ Spec(E), w(P) is a parameterised specification defined by w(P) ~-def ~X: Ep~.w(P(X)): Spec(Ep,r) ~ Spec(E). Definition 12 ( c o n s t r u c t o r i m p l e m e n t a t i o n ) For any parametcrised specifications with a com-

mon parameter signature P" Spec(r~po,) -- Spec(~) and P': Spat(r po,) -- Spec(~') and constructor ~: Spec(E t) --~ Spec(E), P is implemented by pw via tc, written P ~ g~, if P .....-> tc(P'). This subsumes the notion of implementation of parameterised specifications in [SW 82]. It resembles the one in [Lip 83], where a parameterised specification is a (strongly) persistent functor. According to [Lip 83], P is implemented by P' via a construction F (another persistent functor, obtained by composing certain specification-building operations) if there is some P" and (persistent) natural transformations i: P" -~ P';F and s: P" -~ P such that i and s are componentwise injective and surjective respectively. In our framework, this corresponds roughly to an implementation via the composition of a persistent constructor, a restrict step and a q u o t i e n t step (in that order). Although there are several other definitions of implementation of parameterised specifications in the literature (see e.g. [EK 82], [GM 82] and [Gan 83]) it is difficult to compare them with ours because our definition extends the definition for the non-parameterised ease in the usual way that a relation is extended from elements to functions (that is, pointwise). In contrast, [EK 82] defines implementation of parameterised specifications by comparing their bodies and then proves that this implies our notion of implementation. This is arguably preferable from the point of view of proving correctness of implementations but we prefer to adopt the natural definition and treat the problem of proving correctness separately. T h e o r e m 5 (vertical c o m p o s i t i o n ) For any parameterised specifications P, P t p , parameter signature Epa~, if P ~ P~ and P~ ~ P" then P ~ P'.

with common []

As in fact 3, we can strip off outermost constructors from parameterised specifications: Fact 5 For any parameterised specifications P and P~ and constructor ~ on the result signature of p, ~(p) ~ P~ provided that P ~ P'. [] Constructor implementations do not compose horizontally. In fact, the standard formulation of the horizontal composition property is not even well-formed in this case. Namely, if P: Spec(Ep,r) --* Spec(Ere,) is a parameterised specification, SP is a Ep,r specification and SPitz"> SP', then in general Sig[SP'] ~ Evar and so P(SP') is not even well-defined. However:

107

T h e o r e m 6 ( h o r i z o n t a l c o m p o s i t i o n ) Given a parameterised specification P with parameter signature Ep~r and a Ep~r-speeifieation SP, if P ~ P' and SP ~ SP' then P ( S P ) ~ P'(tt(SP)). [] Although this is not horizontal composition as formulated in [GB 80], it is perfectly adequate for our purposes. It guarantees that in the case of a specification formed by applying a parameterised specification P to a E-specification SP, the developments of P and SP may proceed independently and the results be successfully combined. If P ~ P1 ~ "'" ~ Pn and SP ~ SPx u ~ ... ~ SPa then P ( S P ) ~ P~((#,~;..-;#,)(SP~)). We aim at reducing the parameter specification to the empty specification and the parameterised specification to the identity. If SP~ = <E$,~) and P , = ).X: E . X then the composition of constructors tt,~;..- ; # 1 ; ~ ; " " ;gl implements P(SP). 6.2

Parameterisation

and

abstractor

implementations

D e f i n i t i o n 13 ( a b s t r a c t o r i m p l e m e n t a t i o n ) For any parameterised specifications with a common parameter signature P: S p e c ( ~ p ~ ) -~ S p e c ( E ) and P': Spec(Ep~r) -+ S p e c ( E ' ) , abstractor a: S p e c ( E ) --* S p e c ( E ) and constructor to: S p e c ( E ' ) -+ S p e c ( E ) , P is implemented by P ' wrt a via ~, written P ~ P', if a(P) ~ ~(P'). T h e o r e m 7 ( v e r t i c a l c o m p o s i t i o n ) For any parameterised specifications P, P~, P" with common parameter signature Ep~,, if P ~ P ' and p, ~~' p , then P ~ P" provided that t; preserves the abstraction equivalences. [] Applicability of this result in program development requires proving that the constructors we use preserve the appropriate abstraction equivalences. For this, lemmas 1-5 of section 5 are applicable just as in the non-parameterised case. Unfortunately, the horizontal composition theorem for abstraetor implementations does not hold, even in the form suggested by the horizontal composition theorem for constructor implementations; parameter specifications cannot in general be abstracted from since parameterised specifications can make essential use of non-observable parts of the parameter. One way to circumvent this is to restrict attention to parameterised specifications which use their arguments in an abstract way, so that if we change the argument to an equivalent one we get a result which is equivalent. D e f i n i t i o n 14 Let a: S p e c ( E ) -~ Spec(E) be an abstraetor. We say that two E-specifications SP1 and SP2 are a-equivalent if Mod[a(SP1)] = Mod[a(SP2)]. T h e o r e m 8 ( h o r i z o n t a l c o m p o s i t i o n ) [[ P ~ P , and SP ~~' SP , then P(SP) ~ p,(,~,(SpO ) provided that P preserves a~-equivalenee, i.e. for any specifieatior~ S P 1 , S P 2 over the (common) parameter signature of P and p,, P(SP1) and P(SP2) are a-equivalent whenever SP1 and SP2 are a'-equivalent. [] The requirement that P preserves aLequivalence in the above theorem is guaranteed in either of the following three cases: 1. P has the form ~X: E.SPI[a'(X)], i.e. P abstracts from its argument before using it. 2. P is built entirely from constructors which preserve the relevant abstraction equivalences. 3. The abstractor a' is trivial, i.e. for any specification SP, Mod[a'(SP)] = Mod[SP]. The last c~se amounts to the following: Corollary 6 I/P

~ P ' and SP ~

SP' then P ( S P ) ~

P'(td(SP')).

[]

108

A constructor implementation SP ~ SP ~ is an abstractor implementation SP ~ SP ~ where the abstractor ~ is trivial. Notice however that when we push the corresponding equivalence through ~ and the constructors used in the further implementation of SP ~, the resulting abstraction equivalences may determine non-trivial abstractors again and so the use of techniques of abstractor implementations may be essential further on.

7

Concluding remarks

A number of important problems connected with the ideas presented here remain to be considered. First, we do not discuss here any methods for proving correctness of refinements; methods for proving theorems in specifications, especially in the context of observational abstraction [ST 86a,86b], are relevant to this problem. This would be especially important in the case of parameterised specifications. There is a large body of technical work in the literature on different specific notions of implementation. Viewed in our approach, each of these notions corresponds to a restriction on the choice of constructors and abstractors which may be used. We have tried to unify and generalise the many different notions of implementation in the literature. This quest for generality yields a uniform framework in which we can compare different approaches. We can investigate which of the problems encountered under different notions of implementation are inherent to the very concept of what an implementation should be and which are just technicalities caused by the imposed restrictions, and conversely, which results and properties are consequences of such restrictions and which are inherent to the nature of implementations. We have not yet tried to pursue this line of investigation in a systematic manner. According to our definition, any inconsistent specification refines any specification over the same signature. But if we succeed in refining a specification to a program then the original specification must have been consistent. This means that checking consistency is not necessary to ensure correctness of the development process. However, an inconsistent specification is a blind alley. On the other hand, even a consistent specification may have no computable model and so we cannot in general avoid blind alleys in program development anyway. In what we have presented here, constructors are just functions rather than actual pieces of programs in ~he usual sense. We did not give any particular syntax for defining constructors. It would be interesting to develop a programming language which would provide facilities for defining and composing constructors (this would probably require restricting the notion of constructor we use, as implied in section 3). A good starting point seems to be Standard ML [Mil 85] with modules [MacQ 85 I, where constructors could be defined as Standard ML functors (i.e. parameterlsed modules}. Acknowledgements Many of the ideas in this paper evolved in close collaboration with Martin Wirsing. Thanks to Oliver Schoett for many relevant discussions, to Hartmut Ehrig for his criticism which stimulated us to write these ideas down, and to an anonymous referee who directed our attention to [Lip 83]. Thanks to Teresa for (gastronomic) care. This work was supported by grants from the Alvey Directorate and the Polish Academy of Sciences.

8

References

[ B M P W 86] Broy, M., MSller, B., Pepper, P. and Wirsing, M. Algebraic implementations preserve program correctness. Science o/Computer Programming 7, pp. 35-53. [ B r W 82] Broy, M. and Wirsing, M. Partial abstract types. Acta In/ormatica 18 pp. 47-64.

109

[BG 77] Burstall, R.M. and Goguen, J.A. Putting together theories to make specifications. Proc. 5th Intl. Joint Conf. on Artificial Intelligence, Cambridge. [BG 80] Burstall, R.M. and Goguen, J.A. The semantics of Clear, a specification language. Proc. of Advanced Course on Abstract Software Specifications, Copenhagen. Springer LNCS 86, pp. 292-332. [deNH 84] de Nlcola, R. and Hennessy~ M.C.B. Testing equivalences for processes. Theoretical Computer Science 34, pp. 83-133. [Ehr 81] Ehrich, H.-D. On realization and implementation. Proe. lOth Intl. Syrup. on Mathematical Foundations of Computer Science, Strbske Pleso, Czechoslovakia. Springer LNCS 118. [Ehr 82] Ehrich, H.-D. On the theory of specification, implementation~ and parametrization of abstract data types. Journal of the Assoc. for Computing Machinery 29 pp. 206-227. [ E K M P 82] Ehrig, H., Kreowski, H.-J., Mahr, B. and Padawitz, P. Algebraic implementation of abstract data types. Theoretical Computer Science 20 pp. 209-263. [EM 85] Ehrig, H. and Mahr, B. Fundamentals of Algebraic Specification I: Equations and Initial Semantics. EATCS Monographs on Theoretical Computer Science, Springer. [EWT 83] Ehrig, H., Wagner, E.G. and Thatcher, J.W. Algebraic specifications with generating constraints. Proc. lOth Intl. Colloq. on Automata, Languages and Programming, Barcelona. Springer LNCS 154, pp. 188-202. [Gan 83] Ganzinger, H. Parameterized specifications: parameter passing and implementation with respect to observability. TOPLAS 5, 3pp: 318~354: [GGM 76] Giarratana, V., Gimona, F. and Montanari, U. Observability concepts in abstract data type specification. Proe. 5th Intl. Syrup. on Mathematical Foundations of Computer Science, Gdansk. Springer LNCS 45. [GB 80] Goguen, J.A. and Burstall, R.M. CAT, a system for the structured elaboration of correct programs from structured specifications. Technical report CSL-118, SRI International. [GB 84] Goguen, J.A. and Burstall, R.M. Introducing institutions. Proe. Logics of Programming Workshop (E. Clarke and D. Kozen, eds.), Carnegie-Mellon University. Springer LNCS 164, pp. 221-256. [GM 82] Goguen, J.A. and Meseguer, J. Universal realization, persistent interconnection and implementation of abstract modules. Proe. 9th Intl. Colloq. on Automata, Languages and Programming, Aarhus. Springer LNCS 140, pp. 265-281. [ G T W 78] Goguen, J.A., Thatcher, J.W. and Wagner, E.G. An initiM algebra approach to the specification, correctness, and implementation of abstract data types. Current Trends in Programming Methodology, Vol. 4: Data Structuring (R.T. Yeh, ed.), Prentice-Hall, pp. 80-149. [Kam 83] Kamin, S. Final data types and their specification. TOPLAS 5, 1 pp. 97-121. [Lar 86] Larsen, K. Context-dependent bisimulation between processes. Ph.D. thesis, Dept. of Computer Science, Univ. of Edinburgh. [Lip 83] Lipeck, U. Ein aIgebraischer Kalkiil ffir einer strukturierten Entwurf yon Datenabstraktionen. Ph.D. thesis, Abteilung Informatik, Universit~t Dortmund. [LB 77] Liskov, B.H. and Berzins, V. An appraisal of program specifications. Computation Structures Group memo 141-1, Laboratory for Computer Science, MIT. [MacQ 85] MacQueen, D.B. Modules for Standard ML. Polymorphism 2~ 2. [Mil 85] Milner, R.G. The Standard ML core language. Polymorphism 2, 2. [Moo 56] Moore, E.F. Gedanken-experiments on sequential machines. In: Automata Studies (C.E. Shannon and J. McCarthy, eds.), Princeton Univ. Press, pp. 129-153.

110

[Ore 83] Orejas~ F. Characterizing composability of abstract implementations. Proe. Intl. Con/. on Foundations o/ Computation Theory, Borgholm, Sweden. Springer LNCS 158, pp. 335-346. [PB 85] Parisi-Presicce, F. and Blum, E.K. The semantics of shared submodules specifications. Proe. 10th Colloq. on Trees in Algebra and Programming, Joint Conf. on Theory and Practice of Software Development (TAPSOFT), Berlin. Springer LNCS 185, pp. 359-373. [Rei 81] Reichel, H. Behavioural equivalence - a unifying concept for initial and final specification methods. Proc. 3rd Hungarian Computer Science Conference, Budapest, pp. 27-39. [ST 85a] Sannella, D.T. and Tarlecki, A. Some thoughts on algebraic specification. Proc. Srd Workshop on Theory and Applications of Abstract Data Types, Bremen. Springer InformatikFachberichte Vol. 116, pp. 31-38. [ST 85b] Sannella, D.T. and Tarlecki, A. Program specification and development in Standard ML. Proe. 12th ACM Syrup. on Principles o/ Programming Languages, New Orleans, pp. 67-77. [ST 86a] Sannella, D.T. and Tarlecki, A. Specifications in an arbitrary institution. Report CSR184-85, Dept. of Computer Science, Univ. of Edinburgh; to appear in In/ormation and Control. [ST 86b] Sannella, D.T. and Tarlecki, A. On observational equivalence and algebraic specification. Report CSR~172-84, Dept. of Computer Science, Univ. of Edinburgh; to appear in Journal of Computer and Systems Sciences. [ST 87] Sannella, D.T. and Tarlecki, A. Toward formal development of programs from algebraic specifications: implementations revisited (full version). Research report, Dept. of Computer Science, Univ. of Edinburgh (to appear). [SW 82] Sannelta, D.T. and Wirsing, M. Implementation of parameterised specifications (extended abstract). Proc. Oth Intl. Colloq. on Automata, Languages and Programming, Aarhus. Springer LNCS 140, pp. 473-488. [SW 83] Sannella, D.T. and Wirsing, M. A kernel language for algebraic specification and implementation (extended abstract). Proe. Intl. Conf. on Foundations of Computation Theory, Borgholm, Sweden. Springer LNCS 158, pp. 413-427. [Sch 82] Schoett, O. A theory of program modules, their specification and implementation (extended abstract). Report CSR-155-83, Dept. of Computer Science, Univ. of Edinburgh. [Tar 86] Tarlecki, A. Software-system development - - an abstract view. Information Processing '86. North-Holland, pp. 685-688.

FINITE ALGEBRAIC SPECIFICATIONS OF SEMICOMPUTAB-LE DATA TYPES(*) G. Marongiu D p t . o f Mathematics, U n i v e r s i t y of Bologna, Italy S. Tulipani D p t . o f Mathematics and Physics, U n i v e r s i t y of Camerino, Italy

0-I n t r o d u c t i o n For many y e a r s computer s c i e n t i s t s have looked at data objects in terms of axioms which g o v e r n the beilaviour of data s t r u c t u r e s .

Data Type S p e c ~ c ~ o , l .

Such an attempt is called

)~bsL'Lac~

A b s t r a c t i o n is i n v o l v e d in the fact that only p r o p e r t i e s

which are i n d e p e n d e n t of data r e p r e s e n t a t i o n are c o n s i d e r e d . In the a l g e b r a i c a p p r o a c h , initiated in the p a p e r of LISKOV-ZiLLES [1974], data s t r u c t u r e s are t h o u g h t of as algebras in the s e n s e of g e n e r a l a l g e b r a (see also [ Zi 79] and specifications are g i v e n in terms of equations or conditional e q u a t i o n s . But, only p a r t i c u l a r models of the s p e c i f y i n g axioms play a special role. Data s t r u c t u r e s are u s u a l l y finite, sometimes potentially infinite. T h e r e f o r e , the significant models of a data t y p e specification E in a s i g n a t u r e Z a r e g i v e n b y the class Algm(Z,E) whose members are the models of E which are finitely g e n e r a t e d b y elements named as const_ ants in Z. The initial a n d final objects in Aigm(Z,E), which a r e g i v e n up to isomorphism, determine the initial and final a l g e b r a semantics, r e s p e c t i v e l y . More p r e c i s e l y , assuming t h a t two closed terms t , s of s i g n a t u r e

Z are g i v e n , t h e n , the equation

t=s is t r u e when the terms t , s are e v a l u a t e d in the initial a l g e b r a if and only if the formal equation t=s can be p r o v e d from E. Moreover, the equation t=s is c o n s i s t e n t with E if and only if it is t r u e in the final a l g e b r a . Both initial and final a l g e b r a semantical a p p r o a c h e s have been widely d i s c u s s e d (see [ADJ 75,78,82], book

~/a 79], the

~-M 85].

BERGSTRA and TUCKER [1983 ] c~scussed the problem of c h a r a c t e r i z i n g semicom~ utable (cosemicomputable, computable) data t y p e s by means of finite conditional s p ecification with h i d d e n f u n c t i o n s and no additional s o r t s plus initial a l g e b r a semantics (*) R e s e a r c h p e r f o r m e d u n d e r the auspices of the Italian CNR and MPI. This is a r e v i s e d v e r s i o n of p r e v i o u s ( u n p u b l i s h e d ) p a p e r which circulated u n d e r the title: Finite Specification of Data T y p e s with e x t r a Operations.

1t2

(plus final a l g e b r a semantics), plus both semantics, r e s p e c t i v e l y .

However, the

problem is solved only for cosemicomputable and computable data t y p e s . We have t r i e d to solve the problem for semicomputable data t y p e s g i v i n g a c h a r acterization which is weaker than that c o n j e c t u r e d in the p a p e r [B-T 83]. More

prec

isely, let us assume A is an infinite semicomputable a l g e b r a of s i g n a t u r e Z and finite l y g e n e r a t e d b y constants named in its s i g n a t u r e . T h e n , we can determine a finite conditional equation s p e c i f i c a t i o n ( ~ E ) where z ' is a finite s i g n a t u r e e x t e n d i n g z with no additional s o r t s so t h a t : g i v e n two closed terms t , s of s i g n a t u r e (1)

t=s

Z, then

is t r u e in A if and only if t=s is provable from E.

Moreover, our method p r o v i d e s an expansion A' to s i g n a t u r e Z' of the s t r u c t u r e h such that A ~ is a model of E. However, A' in ' o u r theorem is not t h e initial a l g e b r a of Alg m ( Z ' , E ) , as BERGSTRA and TUCKER c o n j e c t u r e d in the semicomputable case. In fact we cannot p r o v e for closed terms, t ' , s ~ of s i g n a t u r e z': (2)

t'=s' is t r u e in ~ if and only if t'=s ~ is pro~able from E.

This means that the specification (Z',E) is a c o n s i s t e n t e x t e n s i o n b u t not an enrichm ent of a specification for A extend

(see [E-M 85, Chap. 6 ]). F u r t h e r m o r e our r e s u l t s also

n a t u r a l l y to cosemicomputable and to computable data t y p e s (see Theorems

B and C). The agility of proof via Combinatory Logic does not consent comparison of the complexity of the s e t of conditional equations E to the complexity of the r e c u r s i v e functions which define A. This problem will be e x p l o r e d in f u t u r e work [M-T 86 ] where it has also b e e n p r o v e d that one single equation is s u f f i c i e n t f o r s p e c i f y i n g a computable a l g e b r a as a h i d d e n enrichment u n d e r both initial and final a l g e b r a semantics ( a c c o r d i n g to BERGSTRA and TUCKER Definition, see [B-T 83] and [B-T 8{)]. To simplify notation, we t r e a t the case of s i g n a t u r e

Z in a single s o r t . However,

the r e s u l t s can be easily e x t e n d e d to m a n y - s o r t e d a l g e b r a s . It is assumed that the r e a d e r is familiar with the p a p e r s of B e r g s t r a and T u c k e r [ B - T 83], [ B - T 86] and with the main p a p e r s on specification t h e o r y ; in p a r t i c u l a r

~ - M 85]. Moreover, the

basic notations of u n i v e r s a l a l g e b r a and r e c u r s i o n t h e o r y a r e assumed (see [Gr 78 ], ~ z 79] ). In p a r t i c u l a r , it is assumed an u n d e r s t a n d i n g of the notions of semicomputable, cosemicomputable and computable a l g e b r a which can be found t r e a t e d in full in MAL'CEV [1961] (see also [Ra 60]).

113

1-Preliminaries and Notations. Let Z be a finite algebraic signature having at least one constant symbol. We shal} denote

~ b Y { f l , . . . , fk' c 1 " " '

Cr} where f l , . . . , f k

are function symbols and cl ,

. . . , c constant symbols. If A is an algebra of carrier A and signature ~ we denote r the i n t e r p r e t a t i o n s of the symbols oi' Z in the a l g e b r a A b y # f~k CA A AS pointed out in the introduction, we shall consider only algebras of finite signature and in addition they are infinite and generated by elements named as constants in their signature. Hence, if an algebra is of signature E it is generated by the elA A ements c 1 , . . . , c r . For s u c h a l g e b r a s the definitions of semicomputable, cosemicomputable and computable can be g i v e n more simply than in the g e n e r a l case along the following lines (see [Ma 61] , [ B - T 86]). Definition 1.1

An a l g e b r a N is a r e c u r s i v e number a l g e b r a if and only if the c a r

t i e r of N is the set

N

of n a t u r a l numbers and the operations of N a r e r e c u r s i v e

functions. Definition 1.2

Let

same s i g n a t u r e and

A be an a l g e b r a and N be a r e c u r s i v e number a l g e b r a of the ~: N -~ A be a morphism. T h e n , ~ is

(i)

a r e c u r s i v e l y enumerable ( r . e ) morphism,

(ii)

a c o r e c u r s i v e l y enumerable ( c o - r . e . ) morphism,

(iii)

a r e c u r s i v e morphism,

if and only if k e r

n = p

is

(i)

a r e c u r s i v e l y enumerable relation,

(it)

a relation whose complement in N 2 is r e c u r s i v e l y enumerable,

(iii)

a r e c u r s i v e relation,

respectively. Definition 1.3

Let A be an a l g e b r a . T h e n ,

(i)

semicomputable,

(it)

cosemicomputable,

(iii)

computable,

A is

if and only if t h e r e e x i s t s a r e c u r s i v e number a l g e b r a N (of t~e same s i g n a t u r e ) and a surjective ~ : N -~ A such that ~ is (i)

a r.e epimorphism,

(it)

a co-r.e, epimorphism,

(iii)

a recursive epimorphism, respectively.

114

F o r t h e f o l l o w i n g d i s c u s s i o n we n e e d some f a c t s a b o u t c o m b i n a t o r y a l g e b r a s a n d c o m b i n a t o r y logic t h a t we r e c a l l i n o r d e r to f i x t e r m i n o l o g y a n d n o t a t i o n 0 f o r a c o m p r ehensive treatment see

[Ba 8 1 ] ,

[H-S 80] ) . L e t cl = { , , K , S }

be a signature

such that

- is a s y m b o l of b i n a r y o p e r a t i o n a n d K , S a r e c o n s t a n t s y m b o l s . A c o m b i n a t o r y a l g e b r a is a s t r u c t u r e

M = (M, • , K M , s M) of s i g n a t u r e

El.

Kox-y = x

E2.

S-xoy.z

= x-z,

(y,z)

cl w h i c h s a t i s f i e s t h e a x i o m s :

,

w h e r e t h e a s s o c i a t i o n f o r t h e o p e r a t i o n s y m b o l • is d o n e a s u s u a l f r o m t h e l e f t so t h a t MlOM {

...o

T(cl),

i.e.

Mk

m e a n s ( . . . ( ( M 1 - M 2 )-M 3) . . . .

a t e r m of s i g n a t u r e

cl w i t h

no

),M k

. A c o m b i n a t o r is a t e r m i n

variables.

Some c o m b i n a t o r s a r e c a l l e d

n u m e r a l s . More s p e c i f i c a l l y , if n is a n e t u r a l n u m b e r we d e n o t e b y rn~ a - c o m b i n a t o r w h i c h is c a l l e d t h e n u m e r a l r e p r e s e n t i n g r0~ = K*I

n a n d is d e f i n e d i n d u c t i v e l y a s follows:

r n + l1 = S , B o r n 7

(1.4)

w h e r e as u s u a l I is t h e c o m b i n a t o r S - K ° K a n d B is t h e c o m b i n a t o r S , ( K o S ) . K . denote the equational theory,

We

w h o s e n o n logical axioms a r e E1 a n d E2 a n d w h i c h is

n a m e d C o m b i n a t o r y L o g i c , b y CL. What we n e e d is t h e f o l l o w i n g ( s e e [ B a 81 ]) Faot 1.5.

F o r e v e r y r e c u r s i v e f u n c t i o n f t h e r e e x i s t s a c o m b i n a t o r F f w h i c h repres_

ents f in CL,

viz. for all natural

numbers

nl,...,n m

CL ~-- Ff

nI

...

m

rf(n I ..... nmf.

2-Semic0mloutable D a t a T y p e s . T h e o r e m A. a finite set all

Let

Main r e s u l t .

A b e a s e m i c o m p u t a b l e a l g e b r a of s i g n a t u r e Z . T h e n , t h e r e e x i s t s

E of c o n d i t i o n a l e q u a t i o n s i n a s i g n a t u r e

t l , t 2 e_ T ( ~ ) :

El--- t l = t 2

if a n d o n l y if

A~

X' e x t n e d i n g

~ such that for

tl=t 2 •

I n o r d e r to p r o v e T h e o r e m A we m u s t c a r r y o u t some c o n s t r u c t i o n s

a n d p r o v e two

Lemmas. Let

A b e a s e m i c o m p u t a b l e i n f i n i t e a l g e b r a of s i g n a t u r e

N be a recursive

n u m b e r a l g e b r a of s i g n a t u r e

Let us suppose that ml,...,m ~(m 1) = c A , . . . , a n d m.=m. 1

]

A A i f f c. = c.

Let p be ker ~

1

]

X and

Z = {fl'""

'fk'Cl"'"c~

~ : N -~ A b e a r . e .

,

epimorphism.

r are natural numbers such that A ~(m r ) = c r

for i,j=l, .... r.

and g be a recursive

f u n c t i o n of t h r e e v a r i a b l e s s u c h t h a t f o r

(2.1)

115

m,n ~ N , (m,n)~

p iff t h e r e is a n a t u r a l n u m b e r p s u c h t h a t g ( m , n , p )

= 0. When

f is a f u n c t i o n sz]mbol which is not c o n s t a n t of s i g n a t u r e Z, t h e c o m b i n a t o r which r e p r esents

in

CL

bet algebra

t h e f u n c t i o n fN w h i c h i n t e r p r e t e s

N is d e n o t e d b y Ff. F i n a l l y ,

t h e symbol f in t h e r e c u r s i v e nu_m

the combinator which represents

the rec

u r s i v e f u n c t i o n g w h i c h e n u m e r a t e s k e r ~ is d e n o t e d b y G. Let now ~' be t h e s i g n a t u r e {fl""'fk'cl i.e.,

Z' is

~ u

'''''cr'

° ,K,S,

Nat, Horn}

cl p l u s two u n a r y o p e r a t i o n symbols Nat,Horn.

list of c o n d i t i o n a l e q u a t i o n s in ~', w h e r e x , y , x l , x

2....

C o n s i d e r t h e following

d e n o t e v a r i a b l e s . To simplify

n o t a t i o n we mention o n l y one of t h e f u n c t i o n symbols f l ' " "

' f k ' s a y it f of m a r g u m e n t s

E l - E 2 axioms of CL. E3

is the conjunction for all f in ~ of

(1 ~ m

N a t ( x i ) = K ) ÷ Hom(Ff* x 1- . . . . Xm) = f ( H o m ( x l ) . . . . . Hom(Xm))

E4

l Z

specification with respect to

A if

: T(Z')/-=EI Z

where the isomorphism into A is induced by the natural evaluation of the terms of

85],

T(Z ) in A (see [E-M Our

Theorem

A proves

ding ] is a retraction, this case we could The

term

Chap.

[B-T 86]). that there is such

i.e. there exists a morphism

say that the specification

consistent

extension

is used

6) in quite similar situations

Then,

according

an isomorphism

to Definition

h such

(Z',E)

3.4 of [B-T

that the embed-

that h o j = identity.

is a ao~istemt

in the literature

but involves

and

In

extension ~or A.

(for example

in [E-M 85 ]

two specifications.

86 ]

we

can restate

Theorem

A as

fellows,

Proposition. The specification method (for a b s t r a c t data t y p e s ) b y means of a finite conditional equation c o n s i s t e n t extension with no additional s o r t s , is complete for the class of semicomputable data t y p e s .

References [ADJ 75 ] J.A.

GOGUEN,

J.W.

THATCHER,

E.G.

WAGNER

and

J.B.

WRIGHT,

Abstract data t y p ~ as i n i t i a l (~gebras and correctness of d ~ a representations, i n Proceedings ACM Conference on Computer Graphics, P a t t e r n Recognition a n d Data S t r u c t u r e , NY 1975, 89-93. [A,DJ 78 ] J.A. GOGUEN, J.W. THATCHER a n d E.G. WAGNER,

An inZ~a~ ~gebra approach to the s p e ~ e a t i o n , correctness and implementation of abstract data types, C u r r e n t t r e n d s in Programming Methodology, Vol. 4: Data S t r u c t u r i n g ( R . T . Yeh, e d . ) , Prentice-Hall (1978), 80-149.

[ADJ 82 ] J.W. THATCHER, E.G. WAGNER a n d J . B . WRIGHT, Data type speaL~eation: parametrization and the power of specifAcation technique, TOPLAS 4(4), 1982, 711-732. [Ba 81 ]

H.P. RARENDREGT, The lambda ealcu~as, i$~ s y ~ a x and seman~cs, North-Holland, Amsterdam 1981.

[B-T 80 ] J.A. BERGSTRA a n d J.V. TUCKER,

~L~e

On bounds for the s p e c i ~ c a ~ o n of data types by means of equations and eondi~onal equations, p r e -

p r i n t IW 131/80 Amsterdam 1980. [B-T

83 ]

I ~ t ~ a ~ and ~ n a l a~gebe~ s e m a ~ c s two characterization theorems", SIAM J. of

J . A . BERGSTRA a n d J.V. TUCKER,

for data type s p e ~ c a t i o ~ : Computing 12 (1983), 366-387.

[B-T 8G ] J . A . BERGSTRA a n d J.V. TUCKER,

Algebraic s p e c i ~ c a ~ o ~ of Computable and Semicomputable Data Types, Department Computer Science Re-

122

search Report CS-R8619, Amsterdam (May 1986).

[E-M 85 ] H. EHRIG and B° MAHR, Fundamentals of Algebraic S p e c ~ c a ~ o n 1, Monograph EATCS, S p r i n g e r - V e r l a g 1985.

~Gr 78 ]

G. GRATZER, U~va~a£ Algebra, 2nd ed. S p r i n g e r - V e r l a g , 1979.

[H-S 80 ]

J.R. HINDLEY and J . P . SELDIN ( E d s . ) , To H.B. Curry: Essays on combinatory logic, lambda-calcal~ and fo~aL~m, Academic Press, NY 1980.

[L-Z 74 ]

B.H. LISKOV and S.M. ZILLES, Programming with Abs~act Data Type, Proc. ACM Symp. on v e r y high level l a n g u a g e s , SIGPLAN Notices 9, (1974), 50-59.

[L-Z 75 ]

B. LISKOV and S. ZILLES, S p e c ~ c a ~ o n teahniques for data abs~acL~o~, IEEE T r a n s a c t i o n s on Software E n g i n e e r i n g 1 (1975), 7-19.

[Ma 71 ]

A . I . MAL'CEV, ConsL~uc~ve algebras I, The Metamathemathics of Algebraic Systems, Collected p a p e r s : 1936-1967, North-Holland.

[M-~ S6 ]

G. MARONGIU and S. TULIPANI, computable types, in p r e p a r a t i o n .

[Mz 79 ]

J. MALITZ, I~L~oducA~on to Math~ma~ca£ Logic, S p r i n g e r - V e r l a g , 1979.

IRa 60 ]

M.O. RABIN, Colpu~able algebra, g e n i a l theory and the theory o~ computable ~eld~, T r a n s . Amer. Math. Soc. 95 (1960), 341-360.

[Wa 79 ]

M. WAND, Final algebra s e m a a ~ and data type extensions, J. Computer a n d Ststems Sciences 19 (1979), 27-44.

[Zi 79]

S. ZILLES, An l~Lzoduc~on to data algebras Lect. Notes 86, (1979), 248-270.

R ~ r k s on complexity ~n speai~y£ng

in Comp. Sci.

O n t h e S e m a n t i c s of C o n c u r r e n c y : Partial Orders and Transition Systems

G. Boudol & L Castellani INRIA

Sophia-Antipolis

06560-VALBONNE FRANCE

Abstract. We introduce an algebra of labelled event structures whose operations are sequential composition, sum, and parallel composition. A transition relation is defined on these objects, where at each step a process performs a labelled poser. It is claimed that the bisimulation relative to such transition systems brings out a clean distinction between concurrency and sequential non-determinism. 1. I n t r o d u c t i o n . This paper may be seen as proposing a tentative synthesis of various approaches to the semantics of concurrency. Milner's work on caIcuii of processes ([17,18,19]) provides our main source of inspiration. Let us recall the main features of such calculi (cf [1]): first there is a syntax which describes abstract programs as terms of an algebra; second there are behavioural rules according to which each term may perform some actions and become another term in doing so. This brings in a notion of tabeIled transitions denoted prog

act

~prof

Finally a semantic equality is defined by means of the well-known notion of bislmulation [21,18,33. This gives the scheme of the following technical material. Plotkin has advocated in [23] that labelled transition systems determined by structural operational rules provide a fairly natural setting to describe the operational semantics of programming languages. This is even more true with regard to parallel programming where one wants to program non-terminating processes, which may communicate during the computations: here functions from input to output can no longer be used as the semantical model. A symptom of this need of a more discriminating model is that a process is sometimes thought of as giving rise to a whole domain of computations rather than interpreted as a point in a domain; this point of view is exemplified by Winskel's work [20,32,34]. We shall entirely adopt Milner's standpoint [18,19] according to which any abstract notion of process must be based firmly upon operational semantics. As a matter of fact, one often uses informal behavioural arguments in order to decide whether some processes should or should not be distinguished. For instance (taken from [5]) one can "prove"

124

(at(b + ~)) + (aib) + ((a + c)ib) = (al(b + 4 ) + ((~ + ~)tb) (we use here a CCS-like notation) by saying that if the left-hand side performs a concurrently to the b of (alb), then the right-hand side is able to do the same thing by choosing a in ((a + e)Ib), and so on, so that no behaviour distinguishes the two terms. We shall give here a precise meaning to such a proof, by means of bisimulations. Bisimulations on transition systems provide a powerful concept (see [1,3] ), but many authors argue ([4,6,28], to mention but a few) that this yields an inadequate description of concurrency; specifically what is questioned is Milner's expansion theorem [17,14], expressing a simulation of concurrency by sequential non-determinism. Roughly speaking (a I b) = ab + ba, thus the parallel composition operator can be eliminated (from finite terms), whence it is not primitive. As a contribution to the theory of "true concurrency", our paper aims at solving

concurrency

#

sequentiality + non-determinism

More precisely our thesis is that this can be solved while still dealing with bisimulatlons on transition systems. Evolving from Petri's ideas [22], there is another way to approach the semantics of concurrency; following this way one thinks of sequentiality as causality, that is as prescribing an ordering on events. Dually, two events are concurrent if they are not causally related. Thus here a computation is a partially ordered set of events rather than a mere sequence. This is by now a widely held point of view; it appears in the early work of Mazurkiewicz on traces [15], which have been related to posets and algebraic structures (monoids) in [16] and [29]. Another generalization of words was proposed by Winkowski [30,31]. Grabowski sets up in [12] a theory of "partial words" that are labelled posets, what Pratt and Gischer call pomsets ([26,10,27], see also [29]). These are also the configurations of Winskel's (Iabelled) event s~ruc~ures, which are posets enriched with a notion of conflict [32,33,34] - a kind of object that Montanari & a/. also deal with [4,7,8]. Fairly close is the notion of process suggested by Petri [22], which is a partial unfolding of a net into an occurrence net (cf [9,11]). Reisig studies in [28] what can or cannot be distinguished according to various notions of computations. By the way, we must point out the fact that almost all the works we have just mentioned model more or less explicitely a process as a "language", that is a set of pomsets; this entails the linearity of sequential and parallel composition, that is their distributivity over the sum interpreted as set theoretic union. Roughly speaking, (a[(b + c)) = (a]b) + (alc) and a ; (b + c) = a ; b + a ; c, a kind of property that does not hold in Milner's calculi of processes. Let us now introduce our contribution: first of all, in order to solve ~ we must start with a formalism in which one can talk about sequentiallty, non-determinlsm and concurrency as distinct notions; this is why we adopt Winskel's (labelled) event structures which are built upon the exclusive relations of causal ordering, conflict and concurrency. Each of these relations gives rise to a way of constructing event structures: one simply juxtaposes two such structures and then sets the relation between their events. These operations are sequential composition, sum, and paralIeI composition; they provide us with a syntax for finite event structures (in this paper we shall treat neither infinite structures nor communication; to get some ideas about these subjects see the full version of the paper [2]). Here comes the main idea. We have already mentioned that an event structure determines a set of computations, what Winskel calls configurations. Then, defining "what remains of the structure" after such a computation we get a notion of labelled transition: here the action (= the computation) is a finite pomset and the reached state (= what remains...) is another event structure. The point is that we generalize what usually is "over the arrow"; a similar idea may be found in [5,8] and it seems that it could be applied to Petri nets where computations are processes (in the technical sense of [9,11]). As a matter of fact, we also extend Milner's idea ([18]) that actions should be elements of a commutative monoid (a similar notion is Winskel's synchronization algebra [33,34]): here we get elements of a "dioid", see below.

125

We also give a structural operational semantics (in Plotkin's style [23,24]) for our "abstract programs", and then show an exact correspondence between the semantical and syntactical notions of transition. Next we define our semantic equality, in the same way as Milner defines his strong congruence, and give an axiomatization for it. We claim that this notion of equality solves ~. Note: almost all the proofs are omitted; more details may be found in [2]. 2. A l g e b r a of L a b e l l e d E v e n t S t r u c t u r e s . As previously announced, our first concern is in labelled event structures. For some technical reasons that will become clear later, our definition is a slight variation of Winskel's one. At some points we shall assume knowledge of the work of Nielsen, Plotkin, and Winskel [20] which shows how to derive (labelled) event structures from some kind of (labelled) Petri nets; thus we shall feel free to use standard concepts of net theory (cf [9]) when dealing with such derived event structures. 2.1 Labelled Event S~ructures and Terms. Let as usual {0,1}* be the set of words over the alphabet {0,1}. The concatenation of two words u and v is denoted uv, whereas the product of two languages L and L' is

LL' = {uv/u e L & v E L'}

DEFINITION. Let A be a non-empty set. An A-labelled event structure (A-LES for short) is a structure (E, ,catled derivation relation, is defined, in the SOS style [Plo8t], with the intuition that agent t 1 may evolve to become agent t2 either by reacting to a X-stimulus from its environment (tl--X--~t2) or by performing an internal action which is independent of the environment (tl--Z--~t2).

Definltion 2.1.1 Milner's derivation relation tl---g---rt2 is defined as the least relation satisfying the following axiom and inference rules. Act)

ktt---~t---~t

Res)

t 1 ---~t--+ t2

implies t t ~ - - I . t ~ t2x,cx, ~t ~ {~,t~-}

Rel)

t 1 ---ix--> t2

implies tl[~] ---~(~t)---~ t2[qb]

Sum) t 1 ---kt--->t2

implies t l + t - - ~ t ~ t 2

and

t+t 1 ---tl--~ t2

Com) t 1 --Ix--> t2

implies tl!t---kt---~ t21t

and

tit1 ----~--* fit2

tl--X-->t 2 Rec)

and t'l--~.---~t'2

tl[rec x. tl/X]--kt--~t2

implies

implies

tllt'l--~--~t21t'2

rec x. Pl --'#"-> P2'

The derivation relation above completely specifies the operational semantics of CCS; a second level of CCS semantics is defined on top of this to obtain more abstract descriptions of system's behaviours. To this purpose, a notion of testing is introduced in [DH84] which is then used to define equivalence relations on CCS terms which allow one to identify agents which are "behaviourally" equivalent. In [DH84], processes which react in the same way to experiments performed by external observers are considered as equivalent. Observers are just terms over Y'CCS w {w}, where w is a distinguished action symbol, not in A, used as a special action which "reports success" of an experiment. This theory leads to three preorders on processes which are based on the possibilities processes have of always (must) or sometimes (may) satisfying observers. We will concentrate on one of the preorders discussed there, namely on the one which considers as satisfactory only those experiments (sets of interactions between a process and an observer) which always report a success. The outcomes of the interaction between processes and observers are obtained by studying the set of computations which take place because of synchrorfizations between processes and observers or because of silent transitions. To this purpose the notion of complete computation, i.e. of a computation which is either infinite or such that the terminal pair, <state of the process, state of the observer>, can not perform a further synchronization or silent move is very important. Also, to be able to describe the outcomes of experiments on partially specified objects and on terms specified via unguarded recursive definitions, [Mit80], a predicate .t, on CCS terms is also required:

144 Definition 2.1.2. Let $ be the least predicate on terms which satisfies i. 1"~L$, 3.p$, ii. p$ and q$ implies (p + q)$, (Plq)$, (P[q~])$ and (pko~)$ iii. (t[rec x. t/x])$ implies (rec x. t)$ The converse of $ is denoted by ]', i.e. p $ (read p diverges) if not p$ (read p converges). Based on the notions above and on CCS operational semantics we have: Definition 2.1.3 Ifo is an observer in RECEccs u (w} then: p must satisfy o if

whenever plo = Po[Oo-~-*PllOl-X-*.... is a maximal computation then there exists n > 0 such that On--W~ and PklOk]" implies Oh-W---~for some h < k.

¢

This predicate is the basis of the preorder on CCS terms reported below. In its definition and in the rest of the section, 0 is used to denote the set of all the observers in RECzccs u {w}" Definition 2.1.4. p _ T2xR ,

TI-~->T 2

implies T I [~1 -~().)~> T2[~1

t I -~> T 2

implies T 1[~] ~ - > T2[~]

T 1 ~X~>T 2

implies TI[] T -)~~> T 2

and

T [] T 1 -~.-> T 2

T 1 ~~> T 2

implies TI[] TN~> T2 [] T

and

T [1 T 1 ~~> T [1 T 2

and

TIT 1 ~ , ~ > TIT2

Rel)

Ext)

Int)

TI@T 2~~> T 1 and

Com) T 1 -1~~> T2 T 1 N~_> T2 T 1 N~> T 2

Ree)

T 1 @ T 2 ~~> T 2

implies TllT ~)~~> T21T and T' 1 ~~,--> T' 2 implies T l t T - ~ > T21T

implies

T lIT' 1 - - > T21T'2

and TIT 1 - - > TIT2

rec x. T ~~> T[rec x, T/x]

Und) ~ ~ > The operational semantics of the two choice operators and the new invisible move, ~-->, which is different from -'~---~deserve some comments. We have that the two rules for ~ simply say that process P ~ Q could exhibit P's or Q's behaviour since it can perform an invisible move to any of them. In the case of [1 we have that process P [] Q can take a final decision as to which behaviour to exhibit only after performing a visible action; invisible moves leave the choice still open. As for the other operators, the above operational semantics is very similar to the one given in Definition 2.1.1 for CCS. Some differences are however worth noting. There is an axiom also for the undefined process fl and we take a different approach for determining the moves of recursive terms; instead of inferring the moves of a recursively defined term from the moves of their unwindings we simply have an axioms which allows unwinding. Note that they are the particular nature of the nondeterministic operator [] and the different kind of invisible moves which allow us to do this; had we done it for the original CCS and used "~to unwind recursive terms, the resulting semantics would have been very different because unwSnding could preempt occurrences of other actions.

146

As with CCS in the previous section, we can define a set of observers and a set of experiments to define a testing preorder on the new language. Observers are just terms over ZTCCS w{w). The set of all such observers will be denoted by 0 T. Now, the machinery outlined above for the original CCS and the operational semantics for TCCS allow us to have:

Definition 2.2.2. Given an observer O e 0 T we have: P M U S T SATISFY O if whenever PIO = PoIOo ~~> PIlO1 ~~>... is a maximal computation then there exists n _>O such that On--W->

*

Again, by using the above predicate a preorder on TCCS terms can be defined. Note that because of the new semantics for £2 and for recursive terms, we do not need to define any divergence predicate to be able to evaluate the effect of experimentations on underspecified processes or on processes specified via unguarded recursive definition. Indeed in these cases, we will always have an infinite computation from PIO which never reports success, and this means that for any observer O, which does not report success before starting experimentations, we have not( P MUST SATISFY O) whenever P is equal to ~2 or unguarded.

Definition 2.2.3. P

or

<W, CO>, where R

(rasp infinite} observational

is a ready

set

sequence of transitions. m e a n i n g s of p r o g r a m s

observations for the order <w, RCYR'> C

<w,R> C

and

w

coincide <w, ~ >

(rasp

~

with

, is

the

visible

trace

of a

the a s s o c i a t e d set of maximal

.

I..~TRODUCTION This paper is concerned with the relation of abstraction between operational and observational models for 'linear' semantics of 'CCS' transition systems [26] [23]. O b s e r v a t i o n a l m o d e l s m e a n here 'fully abstract' m o d e l s for equivalences or preorders induced by (CCS) program defined experiments, such as 'tests' [22] [13,14]. The observational models are naturally homomorphic images of the operational models, but it is not so easy to find out the homomorphism induced by a family of experiments. Indeed, observational models cannot be defined by arbitrary homomorphisms ! A 'concrete' linear model for CCS is the operational model in which programs are rendered by sets of finite and infinite computations. An 'abstract' linear model for CCS is the observational model in which programs are identified if and only if no CCS experiment distinguishes between them. In spite of the effort on models

for testing preorders

[13,20], that very sensitive model has

not yet been worked out, for it has been shown in [10] that some infinite experiments are strictly more sharp than any family of binary tests (finite or infinite). There lays the motivation for the present paper, where we produce the expected model for the full version of pure CCS. Let us proceed to a rapid review of some existing approaches on the side of abstract models, independently of the h o m o m o r p h i s m s which induce them as quotients. First of all, one can distinguish between implicit quotient models and explicit models where explicit representations are dealt with [6] . Further separation may be observed between two classes of explicit models, namely the class of purely order theoretic models and the class of mixed space and order theoretic models. C l a s s i c ~-algebraic domains are most commonly used in models of the first class [7,13,19,20,24]. For the second class of models, the order relation is the reverse inclusion between closed subsets in some metric completion considered

(*)

rR;gA

of languages, trees or tree-languages [11,18,27], and since the spaces have denumerable bases, the resulting complete partial

- Camp,.,s

ae

r~ea.uL~eu

_

F 35o4z

RENNES

CEDEK

154 orders are again ~-algebraic. In the framework of explicit models, it is usually assumed that each element or open set of the denumerable base represents a property that may be tested under finite

finite time

experiments or

fail

[i] , i.e.

under experiments

[13]. Therefore,

identical

which either

meanings

are

succeed

in

necessarily

assigned to CCS programs which differ b y their ~-traces[10]. Notice that this situation is less frequent under the assumption of fairness, since fairness intensifies the separation power of tests, but it arises nevertheless. A possible way out is to work within the bounds of 'uniform' behaviours are then closed sets, and isomorphic semantics infinite streams and from finite observations particular, that property holds for the finite state

concurrency [12] : are obtained from

respectively [ii]. In subset of CCS, obtained

by forbidding the parallel composition and renaming of open terms[8]. There arises from the above review that no well known method is available for associating CCS programs with their compositional meanings under infinite experiments. We think of e x p e r i m e n t i n g on p r o g r a m u as running a maximal computation from the parallel system (t ~C[u]) for some testing program t and program context C. This definition, though a d e q u a t e to de Nicola and Hennessy's notion of testing, departs from it in the definition of the result of experiments. For us, the result of an experiment is the sequence of transitions of the testing program (along that experiment). On that basis, we equip p r o g r a m s with an 'implementation' preorder as follows: u is an implementation of v if and only if no finite or infinite experiment on u tells that it is not v [9,16,21]. The abstract model which we are looking for is the fully abstract model for this implementation preorder. Moreover, we argue that programs identified in that model must be identified in any other observational model, as soon as it relies on the above stated observation principles. Our approach towards the abstract model is progressive and rests entirely on the concrete model which we establish in a preliminary stage. The first stage is to discover the homomorphism which induces the abstract model. The second stage is to construct that model. The first stage amounts essentially to transfer the implementation preorder from programs to sets of computations and then to represent the latters by sets of pairs <w,~> or <w,R> where w is a 'trace' and R is a 'ready set'. On that way, we define an ordered algebra of abstract computations and prove that the abstract meaning of a program is the set of maximal representations of its concrete computations. The second stage amounts to supply a fixpoint characterisation of the abstract meanings of programs in the power algebra of abstract computations. Special difficulties are encountered here, for the 'suitable' fixed points are neither least nor greatest nor optimal fixed points. A plausible explanation for that misfit is the apparent contradiction between two opposite requirements imposed by full abstraction : inobservable actions (e.g.~) must be ignored in the domain of meanings, but they must be accounted for in the fixed point characterization of sets of infinitary traces. To solve the difficulty, we suggest to compute the 'suitable' fixed points as combinations of a least fixed point in the power algebra of abstract computations and of a greatest fixed point in the power algebra of coarse traces (with explicit ~'s). That m e t h o d has the default to split the meanings of open terms in two c o m p l e t e l y disjoint functions, but full abstraction is obtained at the level of closed terms which are given an ordinary compositional m e a n i n g in a single domain. The paper contains nothing about the proof theory for the equivalence in the resulting model. That issue will be considered in forthcoming papers.

155

2...~N OPERATIONALSEMANTICS.~ORPURECCS We p r e s e n t

here

a slightly

augmented

version

of M i l n e r ' s

'pure'

calculus

of

c o m m u n i c a t i n g systems [13,19,23]. The extensions affect u n g u a r d e d recursion and non d e t e r m i n i s t i c choice. As regards syntax, programs are the c l o s e d terms of a r e c u r s i v e t e r m algebra. As regards semantics, the o p e r a t i o n a l m e a n i n g s of p r o g r a m s are sets of t r a n s i t i o n sequences, d e f i n e d by a logical s y s t e m a la Plotkin

[25].

2. I. A syntax of programs We

assume

given

a set

X

(ranged

sets A and ~ of c o m p l e m e n t a r y { ( 1 ) = [ a n d ~ ( ~ ) = ~. A =A

u ~

action partial p(z)=z, The

rasp.

and ~

Throughout

M = Au{z}

(~M)

function

of our

(ranged over by oPi

~0

=

{NIL

Z 1

=

{~ / ~e M}

=

{I,

N

x)

= M~ We

where

call

and

two

almost

is

disjoint

bijections

~ rasp.

~ (~ A )

a renaming

p(9)=D

algebra

) are the following

variables,

we let k rasp.

{~},

such that

term

of

l i n k e d by reciprocal

unless both entities

recursive

Zi

by

names,

the paper,

inaction.

p from N to N

a n d p(~)= ~(p(~))

signature

resp.

is the

over

action

~:

9 range over

the

invisible

function

any

one-one

every-where,

Q(~)=~,

are undefined. is ~ = ~ 0 u

~I ~ ~

sets of i-ary symbols

' where

the

:

},

+,

u {p / p is a renaming

function},

e}.

Binary operators I, +, ~ are the u s u a l a s y n c h r o n o u s composition, choice a n d internal choice. The b i n a r y operators are u s e d in i n f i x e d

external form, the

guarding operators (~) are p r e f i x e d , and the renaming operators (p) are postfixed. O u r set of r e c u r s i v e open terms is the set T E R M with t y p i c a l e l e m e n t s t as follows : t = x In the

I o p i (tl,---t i ) I t wh above

function

D

valuations

line, with

(xl=t I ,...

finite

D(xi)=

ti

domain

(x i = tl,..,

xn

Xn=t n ) stands

= t n ). for

a

'declaration',

dom(D)={Xlt..~x n } ( c X

) and

i.e.for

a

corresponding

(6 TERM).

The o p e r a t i o n (.) wh D, when a p p l i e d to t e r m t, binds the free occurences of the x i to the t i in t and in the tj. R e c u r s i v e open terms are d e f i n e d up to the G - c o n v e r s i o n of t h r o u g h o u t the p a p e r no c o n f l i c t

arises

their bound variables. F o r all terms, that any two d e c l a r a t i o n s have disjoint

between

free v a r i a b l e s

and bound

we shall assume d o m a i n s and that

variables.

Owing

to

that

convention, the set theoretic union (D u D') of two d e c l a r a t i o n s occuring in a given t e r m is always a declaration. Terms without free v a r i a b l e s (i.e. closed terms) are c a l l e d p r o g r a m s . The m e t a v a r i a b l e s s, t, u, v will be u s e d to d e n o t e g e n e r a l terms, i n t e r e s t e d in programs

a n d in p a r t i c u l a r p r o g r a m s and in their computations.

(e

PROG).

We

are

mainly

156

2 . 2 . An operational semantics for programs A computation

is

between

programs.

visible

or

a finite

or

Transitions

invisible

actions

infinite are

sequence

either

(l or ~),

steps

or

of of

transitions

evolution

ti-Vi-gti+l

resulting

self-transformations

of

from

programs

with no a c t i o n involved. In the last case, label ~ appears as a w i t n e s s for the flow of time. According to P l o t k i n ' s method of structural inferential semantics, t r a n s i t i o n s are d e f i n e d b y a finite family of schemes of axioms a n d rules of inference

for relations

u _v_~ v in PROG x N

x PROG.

The set T of transitions

is the least subset of PROG x N x P R O G c l o s e d under f o l l o w i n g system, stated in G e n t z e n like style.

logical

inference

in the

AX I OM$. ~t -~-~ t t @ u -~-9 t ,

t @ u -$-) u

NIL wh D -~-~ N I L x W~ D

_C_+ D (x) w_h D

for D (x) d e f i n e d

(~t) wh D

-(;-+ ~(t wh D)

(tp) wh D

-(;--> (t wh D)

( t o p 2 u) W_h D

-(~-9 (t W_h D) oP2

(u ~th D)

(t w h D) w h D'

-~-~ t W/l (D u D')

RULES ( t+u -~-~ t')

(t -~-+ t')

( tlu

(t -~-~ t') ( (t-~-~

t')

, (u _l_+ u') (tp

(t -~-~ t')

Except

for

) ~

the

u-transitions

axioms are

( tlu -z-+ t'tu')

_p(D)_~ t'p)

( t oP2 u -~-)

(t -~-~ t')

, ( u+t -~-~ t')

-~-+ t'{u ) , ( ult -~-~ ult')

of

meant

i_~ p(~) defined

t'oP2

internal

to

give

u),

choice,

an

all

the

operational

d i v e r g e n c e due to u n g u a r d e d r e c u r s i v i t y are the c h a r a c t e r i s t i c m a r k of u n g u a r d e d

u oP2 t')

( u oP2 t -(~-9

axioms

flavour

to

: infinite sequences divergence.

and

rules

the

notion

for of

of u - t r a n s i t i o n s

2 . 3 . A concrete linear model A denotational c o m p u t a t i o n s can the

full

m o d e l w h e r e p r o g r a m s are i n t e r p r e t e d b y sets of i n f i n i t a r y be d e r i v e d from the above d e f i n i t i o n s (this is a c h i e v e d in

version

of

the

paper) . Such

a

model

is

a

bridge

between

the

o p e r a t i o n a l d e f i n i t i o n a n d the o b s e r v a t i o n a l m o d e l which we are l o o k i n g for, since the latter is n o t h i n g but a morphic image of the former. For the sake of conciseness, necessary

the

p r e s e n t a t i o n of the

description

We d e f i n e

*T

(resp.~)

that y6 .IN (resp. yE ~ u The f i n i t a r y functions,

resp.

operational

of the c o r r e s p o n d i n g as the

{~})

where t -)t means

set of sequences

and V i < y,

infinitary

model

domain

meanings

st or

(ti-Di-~ ti+l) of p r o g r a m s

t = £t or t =

is r e d u c e d

here

to the

of interpretation. (ti-Di-~ti+l)i ~ }.

and we let Q range over P (~°T) .

The set oc~ m a y be o r d e r e d by. the p r e f i x order on sequences ; it may also be c o n s i d e r e d as a c o m p l e t e m e t r i c space, u n d e r the m e t r i c t o p o l o g y i n d u c e d by the u l t r a m e t r i o d i s t a n c e of [5].Limits in the Scott t o p o l o g y i n d u c e d b y the order p r e f i x coincide indeed with limits in that m e t r i c topology. Now, for t in PROG,

[ItN~op is prefix closed and t o p o l o g i c a l l y

closed,

and [Itl]*op is equal

to [Itl]~opc~ *T, whence [Itl]~op is the topological closure of [Itl]*opThe i n t e r p r e t a t i o n s Z-operators

9/~k : P(*T) k-) P(*T)

are the union additive

(*T) k -~ P(*T)

and ~ k

and ~ k

extensions

: (~)k_+p(~)

: p(~)k

of

'elementary*

of

the

convention

o p e r a t o r s are i m p l i c i t l y extended, w h e n e v e r necessary, extensions. However t h e r e is an e x c e p t i o n in the

(u-~-~v)"

:

w.r.t, c_ in the

that

functions

and

along union additive case of the 'funny

d e n o t e d ",", an operation which has a central

model and which is defined as follows

for the

operators D_llk :

(so they are continuous

complete lattices P(*T) and P ( ~ ) ) . In the sequel, we m a k e h e a v y use

concatenation'

_> p ( ~ )

importance

in our

• : T x c~]. __~ p(o~]r) :

~t = {~u' (u-~-+v) }'

(U-D--)V)" (ti-Di--)ti+l)i