Adding considerations about reachability to the Logics of Specification Languages [1] chapter [2]

Reeves, Steve

English

Research Commons@Waikato

  Working Paper Series ISSN 1177-777X            CONSIDERING REACHABILITY WHEN COMPARING DATA REFINEMENTS      Steve Reeves             Working Paper:  12/2008 November 2008         © 2008 Steve Reeves Department of Computer Science The University of Waikato Private Bag 3105 Hamilton, New Zealand Considering reachability when comparing datarefinementsSteve ReevesDepartment of Computer Science, University of Waikato, Hamilton, New ZealandNovember 3, 2008 10:44Abstract. Adding considerations about reachability to the Logics of Specifica-tion Languages [1] chapter [2].1 Reachability concernsWe need to think about reachability. It seems to me that the counterexample given inthe chapter [2] relies exactly on having a simulation that is not well-defined, in the sensethat it does not “deal” with all reachable states (made clearer soon!).An ADT may never be able to reach some of its states because there is no sequenceof operations, starting with the initialisation, which allows us to pass to those states.This also means we have to think of all the operations in an ADT, including the initial-isation and finalisation operations, since reachability is a property of the whole ADT,not of single operations within an ADT. So, we’ll assume that an ADT A is given by< SA, {OAi}i , IA,FA > where SA are the states that the ADT may be in, the OAi arethe operations of the ADT, and IA and FA are its initialisation and finalisation opera-tions respectively. (And note that, as is usual in these sorts of presentation, we use ⋆ toname the state from the global state space SG which the ADT is called from and returnscontrol to after it has done its work.)Now consider the three “shapes” of diagrams which have to semi-commute, i.e. theinitialisation and finalisation ones, and the operation ones. These give rise to the usualconditions, for conformal ADTs A and C and simulation S ,IC ⊆ IA o9 SS o9 OCi⊆ OAio9 SS o9 FC ⊆ FAFor these to hold there are certain readings to do with reachability.From the third case, if (tC , ⋆) ∈ FC then there must be a tA such that (tA, ⋆) ∈ FAand (tA, tC ) ∈ S . So, if tC is reachable then ∃ t ∈ SA • (t , tC ) ∈ S .Other conditions on simulations can be read off these conditions, but we need justone rule (below) for our purposes in the current enterprise, and the reading here isenough to give us that. The conditions when read together mean that a simulation mustbe defined everywhere on reach(A) and onto reach(C ), i.e. reach(A) ⊆ domS andreach(C ) ⊆ ran S .Definition 1. For ADT A (taken from [3], p. 80—and see the surrounding discussionthere for consideration of reachability))reach(A) =def⋂{S ⊆ SA | IA(SG ) ⊆ S ∧ ∀OAi • OAi (S ) ⊆ S }where OA(X ) are the states reachable from a state in X ⊆ SA by (one) use of operationOA, i.e.OA(X ) =def {s ∈ X | ∃ t • (t , s) ∈ OA}We then need to add conditions to what counts as a simulation in order to enforcethe property that simulations are well-defined in terms of reachability.So, we have:Definition 2. A simulation S ⊆ T1 × T0 is acceptable with respect to ADT C if∀ t0 ∈ T0⊥ • t0 ∈ reach(C ) ⇒ ∃ t1 ∈ T1⊥ • t1 ⋆ t ′0 ∈ÞSThis definition gives us a new rule that we use in the proof of equivalence (denotedby ♠ there) later:Lemma 1. With the usual conditions on y we have:t0 ∈ reach(C ) y ⋆ t ′0 ∈ÞS ⊢PP2 Strict liftingDefinition 3 (Strictly Lifted Forward Simulation).ÞSP(T1gT′0) =df {z1 ⋆ z ′0 ∈ T1⊥ ⋆ T′0⊥ | (z1 ,⊥⇒ z1 ⋆ z ′0 ∈ S ) ∧ (z1 =⊥⇒ z ′0 =⊥′)}Various introduction and elimination rules follow from this.Lemma 2. The following additional rules are derivable for strictly-lifted simulations:S ⊆ÞS(i)ÞS ⊆ÞS(ii)⊥∈ÞS(iii)t1⋆ ⊥′∈ÞSt1 =⊥(iv)t1 ⋆ t′0 ∈ÞS t ′0 ,⊥′t1 ⋆ t′0 ∈ S(v)@Lemmas 2(iv − v ) embody the strictness captured by definition 3: if the after state is ⊥then the initial state must also be ⊥, and if it is not ⊥ then the initial state was not either.WF-Refinement is a refinement theory, in which both the operations and the simula-tion are strictly lifted. WF-refinement was defined in the chapter [2] as follows:2Definition 4.U0s⊒wf U1 =dfÞS o9U0 ⊆U1 o9ÞSVarious introduction and elimination rules follow from this definition.Lemma 3. Let z0 and z1 be fresh.z1 ⋆ z′0 ∈ÞS o9U0 ⊢ z1 ⋆ z′0 ∈U1 o9ÞSU0s⊒wf U1(⊒+wf) U0s⊒wf U1 t1 ⋆ t′0 ∈ÞS o9U0t1 ⋆ t′0 ∈U1 o9ÞS(⊒−wf)@We also then need to condition the definition of the refinement relation to considerjust those states that are reachable (unreachable ones clearly play no roˆle). The follow-ing definition incorporates reachability into Definition 4 above.Definition 5. For operations U0 and U1 from conformal ADTs C (with states T0) andA (with states T1) respectively, and for acceptable simulation S we have:U0s⊒wf U1 =df ∀ t0 ∈ T0⊥ • t0 ∈ reach(C ) ⇒ ∀ t1 ∈ T1⊥ • (t1⋆t ′0 ∈ÞS o9U0 ⇒ t1⋆t′0 ∈U1 o9ÞS )This definition gives rise to just the original rules in Lemma 3 with the additionthat everything is conditioned on the assumption that we are dealing with reachablestates. In the proofs that follow we will tend not to record this assumption or its usein order to simplify the presentation since it becomes crucial in only one place right atthe end of our final proof. So, until that point (which is clearly flagged) we will use theunconditioned rules for simplicity.We begin by showing that WF⊖-refinement implies SF-refinement by proving thatWF⊖-refinement satisfies both SF-refinement elimination rules. Firstly the rule for pre-conditions.Proposition 1. The following rule is derivable:U0s⊒wf U1 Pre U1 t1 t1 ⋆ t′0 ∈ SPre U0 t0Proof.δ....t1⋆ ⊥′∈U1 o9ÞSt1 ⋆ y′ ∈U1(2) y⋆ ⊥′∈ ÞS(2)y =⊥(L. 2(iv))t1⋆ ⊥′∈U1(=)Pre U1 t1t1⋆ ⊥′∈ U1(−0 )false(L. 4)false(2,U−o9)Pre U0 t0(1,¬ +,¬ −)3where δ is:U0s⊒wf U1t1 ⋆ t′0 ∈ St1 ⋆ t′0 ∈ÞS(L. 2(i))¬Pre U0 t0(1)t1 ⋆ t′0 ∈ St0 ∈ T0t0 ∈ T0⊥t0⋆ ⊥′∈U0(L. 5(iv))t1⋆ ⊥′∈ÞS o9U0(U+o9)t1⋆ ⊥′∈U1 o9ÞS(⊒−wf)@Turning now to the second elimination rule in SF-refinement.Proposition 2. The following rule is derivable:U0s⊒wf U1 Pre U1 t1 t0 ⋆ t′2 ∈ U0 t1 ⋆ t′0 ∈ S t1 ⋆ y′ ∈ U1, y ⋆ t′2 ∈ S ⊢ PPwhere the usual conditions apply to the eigenvariable y .Proof.U0s⊒wf U1t1 ⋆ t′0 ∈ St1 ⋆ t′0 ∈ÞS(L. 2(i))t0 ⋆ t′2 ∈ U0t0 ⋆ t′2 ∈U0(L. 5(i))t1 ⋆ t′2 ∈ÞS o9U0(U+o9)t1 ⋆ t′2 ∈U1 o9ÞS(⊒−wf )δ....PP(1,U−o9)where δ is:t1 ⋆ y′ ∈U1(1)Pre U1 t1t1 ⋆ y′ ∈ U1(−0 )y ⋆ t ′2 ∈ÞS(1)t1 ⋆ y′ ∈U1(1)Pre U1 t1t1 ⋆ y′ ∈ U1(−0 )y ,⊥(L. 4)y ⋆ t ′2 ∈ S(L.2(v))t1 ⋆ y′ ∈ U1 ∧ y ⋆ t′2 ∈ S(∧+)....P@Theorem 1.U0 ⊒wf U1 ⇒ U0 ⊒sf U14Proof. This follows immediately, by (⊒+sf ), from propositions 1 and 2. @We now show that SF-refinement satisfies the WF⊖-elimination rule.Proposition 3. The following rule is derivable:U0 ⊒sf U1 t1 ⋆ t′0 ∈ÞS o9U0t1 ⋆ t′0 ∈U1 o9ÞSProof.t1 ⋆ t′0 ∈ÞS o9U0Pre U1 t1 ∨ ¬ Pre U1 t1(LEM)δ0, δ1....t1 ⋆ t′0 ∈U1 o9ÞSt1 ⋆ t′0 ∈U1 o9ÞS(2,∨−)t1 ⋆ t′0 ∈U1 o9ÞS(1,U−o9)where δ0 is:U0 ⊒sf U1 Pre U1 t1(2)β0....y ⋆ t ′0 ∈ U0t1 ⋆ y′ ∈ÞS(1) Pre U1 t1 (2)t1 ,⊥(L.4)t1 ⋆ y′ ∈ S(L.2(v))β1....t1 ⋆ t′0 ∈U1 o9ÞS(3,⊒−sf1 )where β0 stands for the following branch:y ⋆ t ′0 ∈U0(1) U0 ⊒sf U1 Pre U1 t1(2) t1 ⋆ y′ ∈ÞS(1) Pre U1 t1 (2)t1 ,⊥(L.4)t1 ⋆ y′ ∈ S(L.2(v))Pre U0 y(⊒−sf0 )y ⋆ t ′0 ∈ U0(−0 )and β1 is:t1 ⋆ w′ ∈ U1(3)t1 ⋆ w′ ∈U1(L.5(i)) w ⋆ t′0 ∈ S(3)w ⋆ t ′0 ∈ÞS(L.2(i))t1 ⋆ t′0 ∈U1 o9ÞS(U+o9)δ1 stands for the following branch:t1 ⋆ y′ ∈ÞS(1)t1 ∈ T1⊥t1 =⊥∨ t1 ∈ T1ǫ0, ǫ1....t1 ⋆ t′0 ∈U1 o9ÞSt1 ⋆ t′0 ∈U1 o9ÞS(∗,∨−)5ǫ0 stands for the following branch:t1 =⊥(∗)t1 =⊥(∗)t1 ⋆ y′ ∈ÞS(1)y =⊥ y ⋆ t ′0 ∈U0(1)t0 =⊥ ⊥ ⋆ ⊥′∈U1 o9ÞS⊥ ⋆t ′0 ∈U1 o9ÞS(=)t1 ⋆ t′0 ∈U1 o9ÞS(=)ǫ1 stands for the following branch:t1 ∈ T1(∗)¬ Pre U1 t1(3) x ⋆ t′0 ∈ÞS(4)x ∈ T1⊥t1 ⋆ x′ ∈U1(L.5(v))x ⋆ t ′0 ∈ÞS(4)t1 ⋆ t′0 ∈U1 o9ÞS(U+o9)t1 ⋆ t′0 ∈U1 o9ÞS(♠, 4)@To get the above step at ♠ to work we need the reachability definitons etc.. Note thatthis is where the proof before failed, so considering reachability, which we failed to doin the original paper, has allowed us to show that the two refinements are equivalent.Theorem 2.U0 ⊒sf U1 ⇒ U0s⊒wf U1@Theorems 1 and 2 together establish that the theories of SF-refinement and WF⊖-refinement are equivalent.Theorem 3.U0 ⊒wf U1 ⇐⇒ U0 ⊒sf U1@Comments: I daresay much of this can be used to extend equivalence results for theother cases. I had hoped that we’d be able to ditch the LEM requirement, but it seemsnot!3 Some machineryNatural carriers for each type (sets which exclude⊥) are then easily defined by closing:Υ =df {zΥ | z ,⊥}under the type forming operations. When we are working in this more general frame-work, we sometimes need the following:6Lemma 4.⊥∈ UfalsePre U tt ,⊥Lemma 5.U ⊆U(i)U ⊆•U(ii)⊥∈U(iii)¬ Pre U t t ∈ T in⊥t⋆ ⊥′∈U(iv) ¬Pre U t0 t0 ∈ Tin t ′1 ∈ Tout ′⊥t0 ⋆ t′1 ∈U(v)Notice that in (v) t0 ranges over the natural carrier set, rather than the extended carrier.@Corollary 1.t ′ ∈ T out′⊥⊥ ⋆t ′ ∈•U(i) ¬ Pre U t t ∈ Tin⊥t⋆ ⊥′∈•U(ii)@References1. Bjørner, D., Henson, M., eds.: Logics of Specification Languages. EATCS. Springer (2008)2. Henson, M.C., Deutsch, M., Reeves, S.: Z logic and its applications. In: Logics of Specifica-tion Languages. EATCS. Springer (2008) 489–5963. de Roever, W.P., Engelhardt, K.: Data Refinement: Model oriented proof methods and theircomparison. Number 47 in Cambridge Tracts in Theoretical Computer Science. CambridgeUniversity Press (1998)7

Considering reachability when comparing data refinements

Abstract

Similar works

Full text

Available Versions

Research Commons@Waikato

Name not available