An example is presented of the constructive specification of a queue which is done in the style of (Jones 80) using the Vienna Development Method. The basic approach is that of data type refinement. The techniques used are not restricted to those used by Jones, particularly with respect to the method for proving properties of the retrieve function for linked lists, however the notation is consistent with his

Benzinger, Leonora

English

NASA Technical Reports Server

lI
I
I
I
I
I
I
I
I
I
I
I
I
l
I
I
I
I
N87-28302
SAGA Project 1985 Mid-Year Report
An Example of a Constructive Specification of a
Queue: Preliminary Report
Leonora Benzinger
Department of Computer Science
University of Illinois at Urbana-Champaign
Urbana, Illinois
June, 1985
Appendix B
https://ntrs.nasa.gov/search.jsp?R=19870018869 2020-03-20T10:22:53+00:00Z
II
II
II
II
II
II
i
II
II
I
II
II
II
I
II
I
ii
i
An Example of a Constructive Specification of a Queue : Preliminary Report
Leonora Benzinger
Computer Science Dept., University of Illinois, Urbana, Illinois 61801
1. Introductlon
The following is an example of the constructive specification of a queue which is done in the style of
[Jones 80] using the Vienna Development Method. The basic approach is that of data type refinement.
While the techniques we used are not restricted to those used by Jones, particularly with respect to the
method for proving properties of the retrieve function for linked lists, the notation is consistent with his.
2. The specification of a Queue
2.1. States and types for the Queue operatlons
Queue _ Element-list
INIT
states : Queue
ENQUEUE
states : Queue
type : Element -->
DEQUEUE
states : Queue
type :--> Element
EMPTY
states : Queue
type : --> Boolean
2.2. Pre- and post-eondltlons for the Queue operatlons
post-INIT(q,q') --- q' ---- < >.
post-ENQVEUE(q,e,q') --- q' -_ q ',', <e>.
pre-DEQUEUE(q) - q _ < >.
post-DEQUEUE(q,e,q') --- q' = tl(q) and e = hd(q).
post-EMPTY(q,q',b) -----q = q' and (b <:> q _--- <_ >).
g ~.
8. A Data Refinement of a Queue in Terms of Linked Lists
8.1. A queue as a linked llst
Queuel = [node];
node _ record
E : Element;
PTR : Queuel
end;
8.2. The retrleve function
The retrieve function is a function which maps the linked list representation of a queue into a list
representation.
retr : Queuel --> Queue
retr(ql) -------if ql = NIL then < >
else (< ql.E > _1retr(ql.PTR)).
The data type invariant for Queue and Queuel is TRUE.
8.8. Queuel models Queue
In order to show that Queuel models Queue the retrieve function must map all of Queuel into
Queue and every member of Queue must be the value of some member of Queuel under the retrieve map-
ping. These two conditions are stated more precisely as rules aa and ab in [Jones 80, p.187]. In addition
to rules aa and ab, the pre- and post-conditions for the operations for Queuel must imply the pre- and
post-conditions for the corresponding operations for Queue for members of Queuel mapped back to Queue
by the retrieve function. These conditions are precisely stated as rules da and ra [Jones 80_ p.187].
8.8.1. Rules aa and ab are satisfied by the retrieve function
an. (V ql E Queue1)(3 q E Queue such that q _-_ retr(ql)).
Proof. We use structural induction on Queue1. Suppose ql _ NIL. Then retr(ql) _ < > and < > E
Queue.
Suppose ql E Queuel and ql _ NIL. Then retr(ql) _- <ql.E> I', retr(ql.PTR). By the induction
hypothesis there exists q' E Queue such that q' -_ retr(ql.PTR). Let q _ <ql.E> '_, q'. Clearly, q E
Queue and q -_ retr(ql).
ab. (V q E Queue)(3 ql C Queue1 such that q = retr(ql)).
Proof. We use structural induction on Queue. Suppose that q _- < >. If ql _ NIL then by the definition
of the retrieve function retr(ql) _ q.
Let q E Queue and suppose that q _ NIL. It follows that q = hd(q)',', tl(q) where tl(q) E Queue. By
the induction hypothesis, there exists ql' E Queue1 such that retr(ql') _ tl(q). Define ql E Queue1 as fob
lOWS-"
I
i
I
l
I
I
I
I
I
I
I
l
I
I
l
I
l
l
I
g!
I
!
i
B
g
!
i
I
D
I
g
I
g
I
!
I
ql.E _ hd(q) and ql.PTR : ql'.
Then retr(ql): q.
8.3.2. Specificatlon of the operatlons on Queue1
To specify the operations on Queue1 in terms of pre- and post- conditions we need an extension of
some of the notions introduced by Jones [Jones 80, chapter 9] for lists to linked lists. The queue opera-
tions of initialization, enqueue, and empty are straightforward to implement in terms of linked lists. A
difficulty occurs in the post-condltion for the enqueue operation for a queue implemented on linked lists.
If we choose to introduce a new argument, say, tail to describe the element appended at the end of a
queue, then tail must be expressed in terms of the new queue. This is because of the form of the post-
condition for the enqueue operation at the previous level of abstraction (in terms of lists) is in terms of the
new queue which is obtained from the old one by concatenation of a list of a single element to the end of
the old queue.
This can be done by the following:
tall: <hd(rev(ql))> for ql E Queue1
and properly extended notions of hd, rev (the reverse order on lists), and _ _ to linked lists. If the post-
condition for the enqueue operation is stated in terms of tail, it is very awkward to verify rule ra for this
operation because the post-condition for the enqueue operation on lists is stated in terms of queues of lists,
not "tail ends" of queues. This approach then seems to require a backtracking in the post-condltion for
the enqueue operation in terms of lists using the notion of tail.
We use another approach, which is to extend the notions used for lists in the post-condition for the
enqueue operation of a queue implemented in terms of lists to corresponding notions for linked lists. This
has the advantage of making the post-condltion for the enqueue operation in terms of linked lists very
similar in form to the post-condition for enqueue for queues of lists. This also makes makes rule ra rea-
sonably straightforward to check.
8.3.3. Extenslon of the theory of llststo llnked llsts
We definethe notions of head, tail,and concatenation for linkedlists.By an abuse of notation, we
use the same names for thesenotionswhich aredefinedfor lists[Jones80, chapter 9].
Let llist,llistl,llist2be linkedlists.Denote by hd the head of a linkedlist.Itisdefinedas follows:
hd(llist)- llist.E.
The tail of a linked list is denoted by tl. The definition is:
tl(llist) ----llist.PTR.
The length of a linked list is denoted by len. The definition is:
len(llist) ----if llist ---- NIL then 0
else 1 + len(tl(llist)).
The index operator extended to linked lists is given by:
llist(i) --- if i -_ 1 then hd(llist)
!
else tl(llist)(i- 1).
The concatenation operator extended to linked lists is given by:
llistl '**,llist2 - the unique linked list such that:
(V i E {1,...,len(llistl)} (llist(i) = llistl(i))) and
(V i E {1,...,len(llist2)} (llist(i + len(llistl)) = llist2(i)).
We observe that llist ','tNIL = NIL *,*,llist = llist.
8.3.4. The retrieve function has an inverse
To define _hd(llist)_ where llist is a linked list, we need the inverse of the retrieve function. We
observe that the retrieve function, retr, has a natural extension from Queue1 to List1, the collection of all
linked lists, by defining retrieve as follows :
retr : Listl --_ List
retr(ll) _- if 11 _ NIL then < >
i_ retr(ll.PTR).else (<I1.E> II
The next lemma proves that retr is 1 to 1 and therefore, the inverse exists.
Lemma. Let 11, 12 in Listl and assume that retr(ll) _- retr(12). Then 11 _ 12.
Proof. The proof is by structural induction. Suppose ll _ NIL and 12 _ NIL. Then retr(ll) -_- < > but
retr(12) : <12.E> Illt retr(12.PWR). This contradicts the assumption that retr(ll) ---_ retr(12).
Next, let ll _ NIL and retr(ll) _-_ retr(12) for some 12 in Listl. Furthermore, suppose that for each
linked sublist 11' of ll, if retr(ll') _ retr(12'), where 12' is a linked sublist of 12, then 11' _ 12'. We note
that 12 _ NIL since 12 _ NIL implies that retr(12) _ < >, in which case retr(12) _ retr(ll). Therefore
retr(12) = <12.E> I1_D retr(12.PTR). We also have retr(ll) = <ll.E> Iii retr(ll.PWR). Since ret(ll) =
ret(12), <ll.E> = <12.E> and retr(ll.PTR) : retr(12.PTR). By the induction hypothesis, I1.PTR -_
12.PTR. We conclude that ll _-_ 12.
We observe that the rules aa and ab hold when applied to linked lists. The proofs carry over by
replacing queues implemented in terms of lists and linked lists by arbitrary lists and linked lists. Thus,
the function retr is a 1 to 1 mapping onto the set of lists, List.
Let 1 in List. There exists a unique 11 in Listl, by rule ab, such that retr(ll) _ 1. Define invretr as:
invretr(1) _ 11.
This definition can be restricted in a natural way to hold only for queues implemented in terms of lists and
linked lists.
We are now in a position to extend the list notation to linked lists. Let ll in Listl. Then there exists
(a unique) 1 in List such that retr(ll) _ 1. Assume furthermore that ll _ NIL and that ll.E _ e. We
define the linked list formed from the element ll.E as follows:
< ll.E > = invretr(< hd(1) > ).
In particular, <hd(ll)_> _ invretr(<hd(l)_>). Notice that the list in the term on the left is a linked list,
while the list in the term on the right hand side of the equivalence is not a linked list.
!
!
!
!
!
!
II
II
II
II
II
II
II
II
II
II
II
!
I
I
I
l
I
l
I
I
I
i
l
I
I
I
I
I
I
I
8.8.5. States and types for the Queuel operations
queuel ---_ [node];
node ---- record
E : Element;
PTR : Queue1
end;
INITI
states:Queue1
ENQUEUEI
states:Queue1
type :Element -->
DEQUEUE1
states • Queuel
type "--> Element
EMPTY1
states : Queuel
type : --> Boolean
8.3.6. Pre- and post-condltlons for the Queuel operations
post-INITl(ql,ql') - ql' _- NIL.
post-ENQUEUEl{ql,ql',e) ------ql' ---- ql I_ de>.
pre-DEQUEUEI{ql) - ql _ NIL.
post-DEQUEUEl(ql,ql',res) -- ql' _ ql.PTR and res _--- ql.E.
post-EMPTYl(ql,ql',b) - ql' _ ql and {b <_> ql ---_ NIL).
8.8.7. The retrleve functlon isan isomorphlsm
Lemma. Let de>, ll E List1 and suppose that len(ll) ---- n for some integer n > 0. Then (ll °01
<e>).PTR = 11' _I de> where I1 E Listl and len(ll) = n - 1.
Proof. Suppose n _- 1. Then ll = Gel> for some el E Element. We have {11 _m<e>).PTR ---- (Gel> II
<e>).PTR ---- de> _ NIL _1de>. NIL E Listl and len(NIL) _-_ 0.
Let len{ll) -----n. Then ll -_ Gel, e2, ..., en> where ei E Element for i _ 1, 2, ..., n and the ei's are
not necessarily distinct. We have
_' <e>).PTRH <e>).PTR _- (<el, e2, ..., en> ,i(11
<el, e2, .., en, e>.PTR
---_ (e2, .., en, e>
,0 de>.
_e2, ..., en=> l0
Let 11' ---_ <e2, ..., en>. We observe that ll' E Listl and len(ll') -----n - 1.
I
Lemma. Let <e>, 11 • Listl. Then retr(ll _ <e>} ---- retr(ll)_ <e>.
Proof. We use induction on len(ll). Suppose that len(ll) ---- 0. Then ll ---- NIL. It follows that retr(ll II
<e>} ---- retr( <> 111<e>) : retr(<e>) ---- <> 111<e> = retr(ll)Ill I <e>.
Assume that the lemma holds Vll' • Listl for which len(ll') d n for some integer n > 0. Let 11 •
Listl and suppose that len(ll) -----n and let ll.E ---- e'. We have
We note that ll.E ---_ (11 _t de>).E so that
We can rewrite (11 _ de;>).PWR as 11' _J_de> where len(ll') d n from the previous lemma. By the
induction hypothesis,
retr((ll _a de>).PWn) -----retr(ll' _ de;,} = retr(ll')_ de>.
It follows that
retr(ll f_ de>) = de'> IllI (retr(ll')ll_ _ de>).
But from the definition of the retrieve function
retr(ll) = dhd(ll);-_ retr(ll.PWR).
Therefore, retr(ll _ <e;-) --_ retr(ll)_ de;-.
" retr(12), that is, the retrieve function is an isomor-Theorem. V ll, 12 • Listl, retr(ll ",,12) ---- retr(ll)ii
phism from the set of linked lists to the set of lists.
Proof. We use induction on len(12). When len(12) = 0 we have
retr(ll ,,H12) = retr(ll ,," d >) ---- retr(ll).
In List we have
H < > ---- retr(ll).retr(ll) ",, retr(12) ---- retr(ll),,
" 12') _--- retr(ll)" retr(12') for 12' • List1 for which len(12') d n for some positiveAssume that retr(ll H i_
integer n. Suppose that len(12) -_-- n. Then
" (dhd(12)> H retr(tl(12)))" retr(l:) = retr(ll),, ,,retr(ll) _,
' (hd(12):>)" retr(tl(12)).= (retr(]l),, ,,
By the induction hypothesis and the previous lemma,
" ha(12))" retr(tl(12)).(retr(ll) ,," dhd(12)>)",, retr(tl(12) -=--retr(ll. ,,
Since len(12) ----=n, len(tl(12)) _-- n - 1 so that we can use the induction hypothesis with 12' -_ tl(12). It
l
i
l
!
!
i
!
l
i
I
i
i
I
I
l
I
i
l
lI
I
I
I
l
l
I
I
I
l
l
l
l
l
I
I
I
follows that
" <hd(12)>)." < hd(12)>)" retr(tl(12)) -_ retr((ll ,,retr(ll. ,, " tl(]2))
" (<hd(12)> " tl(12)))-----retr(ll ,, ,,
-- ,I 12).retr(ll .
8.8.8. The operations on Queue1 model the operations on Queue
The next step is to show that each of the new operations on Queue1 : INIT1, ENQUEUE1,
DEQUEUE1, and EMPTY1 correspond to the operations INIT, ENQUEUE, DEQUEUE, and EMPTY on
Queue. For each of the operations on Queue1 we must show that both da and ra [Jones 80] hold, where da
and ra are :
da. (V ql E Queuel)(pre-OP(retr(ql),args) => pre-oPl(ql,args)).
ra. (V ql E Queuel)(pre-OP l(ql,args) and post-OPl(ql,args,ql',res) ----> post-
OP(retr(ql),args,retr (ql'),res)).
da. (V ql E Queuel)(pre-INIT(retr(ql),args) => pre-INITl(ql,args)).
Proof. The proof is immediate since pre-INIT and pre-INIT1 are both TRUE.
ra. (V ql E Queuel)(pre-INIT1 (ql,args) and post-INIT1 (ql,args,ql',res) ----> post-
INIT(retr(ql),args,retr(ql'),res)).
Proof. Since ql' _ NIL we know that retr(ql') ---- < >.
da. (V ql E Queuel)(pre-ENQUEUE(retr(ql),args) ----> pre-ENQUEUEl(ql,args)).
Proof. This follows immediately since the pre-conditions for ENQUEUE and ENQUEUE1 are both
TRUE.
ra. (V ql E Queuel)(pre-ENquEUEl(ql,args) and post-ENQUEUEl(ql,args,ql',res) => post-
ENQUEUE(retr(ql),args,retr (ql'),res)).
Proof. We have ql' ---- ql I', <e> and retr(ql') ---- retr(ql I', <e>). By the lemma of 2.3.7, retr(ql') =
retr(ql) i, <e>.
da. (V ql E queuel)(pre-DEqUEUEl(retr(ql),args) => Pre-DEQUEUE(ql,args)).
Proof. Since retr(ql) _ < >, ql _ NIL.
ra. (V ql E Queuel)(pre-DEQUEUEl(ql,args) and post-DEQUEUEl(ql,args,ql',res) => post-
DEQUEUE(retr (ql),args,retr(ql '),res).
Proof. We have ql _ NIL and ql' _ ql.PTR and res ---- ql.E. From the definition of the retrieve func-
tion, retr(ql) ---- <ql.E> I_lretr(ql.PWR). Then retr(ql') ---- retr(ql.PWR)---_ tl(retr(ql)). Finally, res =
ql.E = hd(retr(ql)).
da. (V ql E Queuel)(pre-EMPTY(retr(ql),args) _-> pre-EMPTYl(ql,args)).
I
Proof. This is immediate since the pre-conditions are both TRUE.
ra. (V ql e Queuel)(pre-EMPTYl (ql,args) and post-EMPTY1(ql,args,ql',res) _---:> post-
EMPTY(retr(ql),args,retr (ql '),res)).
Proof. We have ql : ql' and (b <:> ql : NIL). Since ql = ql', retr(ql) _ retr(ql'). But ql = NIL
implies that retr(ql) ---_ _>. Therefore, b _-_:> ql _--- NIL _> retr(ql) _ <>. Next, suppose that
retr(ql) : <>. Since retr is 1 to 1, ql = NIL ---> b. Therefore, b <=:> (retr(ql) ---- <=>).
4. The Realization of the Queue Object in Pascal
To realize the queue object in Pascal we need a refinement which maps the queue-like structure into
a representation of the queue in terms of pointers and variables on the Pascal "heap".
Queuerep :: Heap: Ptr --> Noderep
where Noderep :: ELT : Element
PTER : ^ [Ptr].
A further refinement is necessary to go from the queue representation to an implementation of a
queue in Pascal.
program queue;
type
qptr : ^qrec;
qrec : record
qdata : char;
qnext : qptr
end; (* qrec *)
vat
head : qptr;
tail : qptr;
function empty : boolean;
begin
empty :: (head ---: nil)
end; (* empty *)
procedure init;
begin
head :: nil;
tail :: nil
end; (* init *)
procedure enqueue(arrive : qptr);
begin
if arrive < > nil then
arrive^.qnext := nil;
if empty then
head :_---arrive
else tail^.nextq :: arrive;
tail :: arrive
end; (* enqueue *)
function dequeue(var head, tail : qtr) : char;
begin
if head < > nil then
l
l
l
I
I
I
I
l
I
I
I
I
i
I
l
I
i
I
II
i
II
I
I
II
i
I
I
i
I
II
ii
i
II
I
I
i
i
begin
dequeue :_ head^.data;
head :---- head^.nextq;
if head _-_ nil then
tail :_ nil
end
end; (* dequeue *)
References.
Jones, Cliff B._ Software Development : A Rigorous Approach_ Prentlce-Hall International, Inc, London,
1980.


An example of a constructive specification of a queue, preliminary report, appendix B

Abstract

Similar works

Full text

Available Versions

NASA Technical Reports Server