




Study with the several resources on Docsity
Earn points by helping other students or get them with a premium plan
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Community
Ask the community for help and clear up your study doubts
Discover the best universities in your country according to Docsity users
Free resources
Download our free guides on studying techniques, anxiety management strategies, and thesis advice from Docsity tutors
An algebraic description of programs with assertions using category theory. The author, Rod M. Burstall, from the University of Edinburgh, explains how to attach assertions to a program as a natural transformation and simulate one program by another with the same shape of flow diagram. The notions are used to prove Floyd's method of proving correctness by verification and Milner's method of proving simulation for programs of similar form.
Typology: Study notes
1 / 8
This page cannot be seen from the preview
Don't miss anything!
AN ALGEBRAIC DESCRIPTION OF PROGRAMS WITH ASSERTIONS, VERIFICATION AkD SIMULATION
Rod M. Burstall Dept. of Machine Intelligence and Perception University of Edinburgh Hope Park Square Meadow Lane Edinburgh EH8 9NW Scotland
Abstract A program in flow diagram form is described by a functor frcm a free category to the category of sets and relations. Attaching assertions to it is described as a natural transformation and so is sim~lation one program by another with the same shape of flow diagram. These notions are used to prove the theorems justifying Floyd's method of proving correctness by verification and Milner's method of proving simulatio~ restricted to programs of similar form. The treatment is novel but the results are not new, except that non-deterministic programs are dealt with throughout. Introduction In this psper we show how a program in flow diagram form can conveniently be described in category theoretic terms. We leave aside consideration of the syntactic form of the programming language and just deal with the graph structure of the flow diagram and the functions associated with the arcs of the flow diagram (for non-deterministic programs we have relations rather than functions). We treat programs with assertions (Ployd 1967) by associating a set of states with each node of the flow diagram, namely the states satisfying the assertion. We prove a simple proposition about free categories which when applied to programs with assertions justifies the inductive procedure used by Floyd to prove the correctness of programs by verification. We then use the same proposition to justify a method of proving that one program simulates another, essentially the technique of Milner (1971) but each node simulated by a unique node. Thus we can prove that a program simulates another program which has a]ready been proved correct. As Milner points out this can be advantageous if the first program is a more efficient but less perspicuous version of the second, or it is obtained from it by compilation. We note the need for less restrictive notions of simulation, particularly one where ~ command is simulated by a whole subprogram. We deal with non-deterministic programs throughout instead of restricting the discussion to deter- ministic ones (Cooper 1971 touches on this in respect of verification as does Manna 1970, but Milner's simulation work is restricted to deterministic programs). I believe that the elementary notions of category theory used make the definitions and proofs pithy and natural. The definitions of the terms category, functor and natural transformation are given in the Appendix, of. Cohn (1965), MacLane and Birkhoff (1967). Before plunging into formal definitions and theorems the reader might appreciate an informal outline. We consider programs written in the usual Ylow diagram form, that is, using tests and assignment commands ~r indeed any kind of c o ~ a n d whose effect on the state can be defined), but omitting any subroutine structure or Algol-like block structure. Following Karp (1959) and Landin (1969) we simplify the flow diagrams by replacing two-exit tests by pairs of one-exit tests. Thus
& A program can then be viewed abstractly as a binary graph with a relation associated with each arc. If the states of the program are n-tuples of integers, the values of n integer variables, then for an assignment c o ~ a n d the relation is a total function from n-tuples to n-tuples changing one component, and for a test the relation is a partial identity function, undefined for n-tuples which fail the test (cf. Manna 1970@. If assertions are attached to the nodes in the flow diagram we associate with each node the set of all states satisfying the assertion; in the absence of a specific assertion we simply take the set of all possible states. This graph (without the associated sets and relations) now generates a free categor~ whose objects are the nodes and whose morphisms are the arcs of the graphs and their free compositions compatible with the starting and finishing nodes of the arcs. We see that the morphisms from one node (object) to another represent all the possible execution paths between these n6des, including paths round loops of course.
The function which associates a set with each node and a relation with each arc generates a functor from the free category to the category of sets and relations. In a sense this functor, including its domain and co-domain, i__~sthe program. The functor carries a composition of arcs (an execution path) into the composition of the relations associated with the arcs, that is the relation computed along that execution path. Taking the union of the relations computed along all paths from one node to another we get the relation computed by the program from one node to another, for example from an entry node to an exit node. Now consider two programs which differ in the assertions, or even in the commands associated with the graph. A difference in assertions arises if we add assertions to a program in order to prove its correct- ness by verification; a difference Jn commands arises if we have one program simulating another. For
each node of the graph we define a relation between states of one program and those of the other (if the programs differ only in assertions this relation can be an identity function). By insisting that this relation be a natural transformation between the functors for the two programs we capture the notion of verifiable assertions on the one hand and of simulation on the other. If we check commutativity of the appropriate diagrams for the generating m~rphisms of the free category, that is for the individual arcs of the flow diagram, this is clearly sufficient ho ensure that the diagrams commute for all morphisms and we have a natural transformation. A simple theorem to this effect immediately justifies the techniques for proving correctness and simulation. We note that the verification method for correctness can be regarded as a special case of the one for simulation. Alternative approaches to the description of flow diagram programs are given by Landin (1969) and Scott (1970). Free Categories Definition D is said to be a basis for a category if D is a triple (A,F,H) where A and F are any sets and H: A x A - ~ (F) is a function such that for each f • F there is a unique pair (a,b), with a, b ~ A and f ~ H(a,b). (Although D is not a category we will call A the objects of D, call F the morphisms of D, write 'f: a -~ b in D' if f ~--S(a,b) and write HornD for H.) Definition If D is a basis for a category then ~ D , the free category generated by D, is a category such that (i) the objects of ~ D are the objects of D (ii) if f: a -~ b in D then f: a -~ b in ~ D (iii) if f: a -J b in ~ D is a morphism other than an identity morphism then there are morphisms fl'''''fk of D, k_~l, such that f=fl"''"fk (iv) if f'fo = g'go where f and g are morphisms of ~ D and fo and go are morphisms of D then f=g and fo=go.
Remark It is clear that each morphism of ~ D other than an identity decomposes into the composition of a unique sequence of morphisms of D, also that ~ D is unique to within an isomorphism functor. In a free semigroup all sequences are allowed, in the free category only those compatible with D. Definition If D is a basis for a category and ~ is some category then P is said to be a basis for a functor from D to ~ , written P: D ~ , if P is the union of functions PA' PF with PA: Objects of D
Objects of ~ and PF: Morphisms of D-~ Merphisms of ~ , such that if f: a - @ b then P(f): P(a)-@ P(b). Definition If P: D - ~ is a basis for a functor then ~ P , the functor generated by P, is the unique functor ~ P : ~ D @ @ such that (i) ~ P ( a ) = P(a) for each object a of D (ii) ~ P(f) = P(f) for each morphism f of D. ~ P is easily seen to be unique since each non-identity morphism f of ~ D equals fl" " ' " f k for some
unique morphisms fl,...,fk of D and so ~ P ( f ) = P(fl)'...'P(fk).
Theorem 1 If ~ P : ~ O - @ ~ and ~ P ' : ~ D - ~ are funotors and T is a function from objects of O to morphisms of ~ such that for each pair, a,b of objects of D and for each morphism f: a -@ b of D the following diagram commutes;
diagram commutes. If f is an identity it commutes trivially, if f is a morphism of D it commutes by the condition on T. Otherwise f = fl'...'fk where fl,...,fk are morphisms of D3and we prove by induction
on k. For the following diagram commutes
P(a) "~^ P(fl"^ "f^ _ _ -~'P(°)^ ~^ )P(fk) "5" k-l)
,~P' (a)-- ~P' (fl" >... ' f k _ l ) ~,~P' (c) ,~ P' ( f k ) I"~ P(a)
since the left hand square commutes by the induction hypothesis and the right hand one by the condition on
Re or a b a s i s for a functor and a functor then ( (x) means Jb (~(x))).
!
). 2
| y : = ~
T - - - - - -....
x~-n
P'(1) = {(x,y)Ix=n} P'(2) ~(x,y)lyx2x:2n and xZ0}
P(al) ~ Compp(~l,a2) P(a 2 )
P'(a I) Compp,(al,a 2) (a 2)
P(ai)., Compp(~l,a2) P(a 2)
"12'(al)f t r
P'(a 1) Compp~al,a 2) P'(a 2)
I <
:= i+l I
(D,P)
Tl
2---
It := t+x] Ix,X is x I
'Z'(2) = "12(1).
(f-g): ~(f). ~(g).
£(a). @(f); @(b)
r(aI t'(b)
~ ( f ). ~: (b) = r(c) • ~(f).