Docsity
Docsity

Prepare for your exams
Prepare for your exams

Study with the several resources on Docsity


Earn points to download
Earn points to download

Earn points by helping other students or get them with a premium plan


Guidelines and tips
Guidelines and tips

Algebraic Description of Programs with Assertions: Verification and Simulation, Study notes of Calculus

An algebraic description of programs with assertions using category theory. The author, Rod M. Burstall, from the University of Edinburgh, explains how to attach assertions to a program as a natural transformation and simulate one program by another with the same shape of flow diagram. The notions are used to prove Floyd's method of proving correctness by verification and Milner's method of proving simulation for programs of similar form.

Typology: Study notes

2021/2022

Uploaded on 09/27/2022

albertein
albertein 🇺🇸

4.8

(4)

240 documents

1 / 8

Toggle sidebar

This page cannot be seen from the preview

Don't miss anything!

bg1
AN ALGEBRAIC DESCRIPTION OF PROGRAMS WITH ASSERTIONS, VERIFICATION AkD SIMULATION
Rod M. Burstall
Dept. of Machine Intelligence and Perception
University of Edinburgh
Hope Park Square
Meadow Lane
Edinburgh EH8 9NW
Scotland
Abstract
A program in flow diagram form is described by a functor frcm a free category to the category of sets
and relations. Attaching assertions to it is described as a natural transformation and so is sim~lation
one program by another with the same shape of flow diagram. These notions are used to prove the
theorems justifying Floyd's method of proving correctness by verification and Milner's method of proving
simulatio~ restricted to programs of similar form. The treatment is novel but the results are not new,
except that non-deterministic programs are dealt with throughout.
Introduction
In this psper we show how a program in flow diagram form can conveniently be described in category
theoretic terms. We leave aside consideration of the syntactic form of the programming language and just
deal with the graph structure of the flow diagram and the functions associated with the arcs of the flow
diagram (for non-deterministic programs we have relations rather than functions). We treat programs with
assertions (Ployd 1967) by associating a set of states with each node of the flow diagram, namely the
states satisfying the assertion. We prove a simple proposition about free categories which when applied
to programs with assertions justifies the inductive procedure used by Floyd to prove the correctness of
programs by verification. We then use the same proposition to justify a method of proving that one
program simulates another, essentially the technique of Milner (1971) but each node simulated by a unique
node. Thus we can prove that a program simulates another program which has a]ready been proved correct.
As Milner points out this can be advantageous if the first program is a more efficient but less
perspicuous version of the second, or it is obtained from it by compilation. We note the need for less
restrictive notions of simulation, particularly one where ~ command is simulated by a whole subprogram.
We deal with non-deterministic programs throughout instead of restricting the discussion to deter-
ministic ones (Cooper 1971 touches on this in respect of verification as does Manna 1970, but Milner's
simulation work is restricted to deterministic programs).
I believe that the elementary notions of category theory used make the definitions and proofs pithy
and natural. The definitions of the terms category, functor and natural transformation are given in the
Appendix, of. Cohn (1965), MacLane and Birkhoff (1967).
Before plunging into formal definitions and theorems the reader might appreciate an informal outline.
We consider programs written in the usual Ylow diagram form, that is, using tests and assignment commands
~r indeed any kind of co~and whose effect on the state can be defined), but omitting any subroutine
structure or Algol-like block structure. Following Karp (1959) and Landin (1969) we simplify the flow
diagrams by replacing two-exit tests by pairs of one-exit tests. Thus
o is replaced by [no
&
A program can then be viewed abstractly as a binary graph with a relation associated with each arc.
If the states of the program are n-tuples of integers, the values of n integer variables, then for an
assignment co~and the relation is a total function from n-tuples to n-tuples changing one component, and
for a test the relation is a partial identity function, undefined for n-tuples which fail the test (cf.
Manna 1970@. If assertions are attached to the nodes in the flow diagram we associate with each node the
set of all states satisfying the assertion; in the absence of a specific assertion we simply take the set
of all possible states. This graph (without the associated sets and relations) now generates a free
categor~ whose objects are the nodes and whose morphisms are the arcs of the graphs and their free
compositions compatible with the starting and finishing nodes of the arcs. We see that the morphisms from
one node (object) to another represent all the possible execution paths between these n6des, including
paths round loops of course.
The function which associates a set with each node and a relation with each arc generates a functor
from the free category to the category of sets and relations. In a sense this functor, including its
domain and co-domain, i__~s the program. The functor carries a composition of arcs (an execution path) into
the composition of the relations associated with the arcs, that is the relation computed along that
execution path. Taking the union of the relations computed along all paths from one node to another we
get the relation computed by the program from one node to another, for example from an entry node to an
exit node.
Now
consider
two programs which differ in the assertions, or even in the commands associated with the
graph. A difference in assertions arises if we add assertions to a program in order to prove its correct-
ness by verification; a difference Jn commands arises if we have one program simulating another. For
pf3
pf4
pf5
pf8

Partial preview of the text

Download Algebraic Description of Programs with Assertions: Verification and Simulation and more Study notes Calculus in PDF only on Docsity!

AN ALGEBRAIC DESCRIPTION OF PROGRAMS WITH ASSERTIONS, VERIFICATION AkD SIMULATION

Rod M. Burstall Dept. of Machine Intelligence and Perception University of Edinburgh Hope Park Square Meadow Lane Edinburgh EH8 9NW Scotland

Abstract A program in flow diagram form is described by a functor frcm a free category to the category of sets and relations. Attaching assertions to it is described as a natural transformation and so is sim~lation one program by another with the same shape of flow diagram. These notions are used to prove the theorems justifying Floyd's method of proving correctness by verification and Milner's method of proving simulatio~ restricted to programs of similar form. The treatment is novel but the results are not new, except that non-deterministic programs are dealt with throughout. Introduction In this psper we show how a program in flow diagram form can conveniently be described in category theoretic terms. We leave aside consideration of the syntactic form of the programming language and just deal with the graph structure of the flow diagram and the functions associated with the arcs of the flow diagram (for non-deterministic programs we have relations rather than functions). We treat programs with assertions (Ployd 1967) by associating a set of states with each node of the flow diagram, namely the states satisfying the assertion. We prove a simple proposition about free categories which when applied to programs with assertions justifies the inductive procedure used by Floyd to prove the correctness of programs by verification. We then use the same proposition to justify a method of proving that one program simulates another, essentially the technique of Milner (1971) but each node simulated by a unique node. Thus we can prove that a program simulates another program which has a]ready been proved correct. As Milner points out this can be advantageous if the first program is a more efficient but less perspicuous version of the second, or it is obtained from it by compilation. We note the need for less restrictive notions of simulation, particularly one where ~ command is simulated by a whole subprogram. We deal with non-deterministic programs throughout instead of restricting the discussion to deter- ministic ones (Cooper 1971 touches on this in respect of verification as does Manna 1970, but Milner's simulation work is restricted to deterministic programs). I believe that the elementary notions of category theory used make the definitions and proofs pithy and natural. The definitions of the terms category, functor and natural transformation are given in the Appendix, of. Cohn (1965), MacLane and Birkhoff (1967). Before plunging into formal definitions and theorems the reader might appreciate an informal outline. We consider programs written in the usual Ylow diagram form, that is, using tests and assignment commands ~r indeed any kind of c o ~ a n d whose effect on the state can be defined), but omitting any subroutine structure or Algol-like block structure. Following Karp (1959) and Landin (1969) we simplify the flow diagrams by replacing two-exit tests by pairs of one-exit tests. Thus

o is replaced by [no

& A program can then be viewed abstractly as a binary graph with a relation associated with each arc. If the states of the program are n-tuples of integers, the values of n integer variables, then for an assignment c o ~ a n d the relation is a total function from n-tuples to n-tuples changing one component, and for a test the relation is a partial identity function, undefined for n-tuples which fail the test (cf. Manna 1970@. If assertions are attached to the nodes in the flow diagram we associate with each node the set of all states satisfying the assertion; in the absence of a specific assertion we simply take the set of all possible states. This graph (without the associated sets and relations) now generates a free categor~ whose objects are the nodes and whose morphisms are the arcs of the graphs and their free compositions compatible with the starting and finishing nodes of the arcs. We see that the morphisms from one node (object) to another represent all the possible execution paths between these n6des, including paths round loops of course.

The function which associates a set with each node and a relation with each arc generates a functor from the free category to the category of sets and relations. In a sense this functor, including its domain and co-domain, i__~sthe program. The functor carries a composition of arcs (an execution path) into the composition of the relations associated with the arcs, that is the relation computed along that execution path. Taking the union of the relations computed along all paths from one node to another we get the relation computed by the program from one node to another, for example from an entry node to an exit node. Now consider two programs which differ in the assertions, or even in the commands associated with the graph. A difference in assertions arises if we add assertions to a program in order to prove its correct- ness by verification; a difference Jn commands arises if we have one program simulating another. For

each node of the graph we define a relation between states of one program and those of the other (if the programs differ only in assertions this relation can be an identity function). By insisting that this relation be a natural transformation between the functors for the two programs we capture the notion of verifiable assertions on the one hand and of simulation on the other. If we check commutativity of the appropriate diagrams for the generating m~rphisms of the free category, that is for the individual arcs of the flow diagram, this is clearly sufficient ho ensure that the diagrams commute for all morphisms and we have a natural transformation. A simple theorem to this effect immediately justifies the techniques for proving correctness and simulation. We note that the verification method for correctness can be regarded as a special case of the one for simulation. Alternative approaches to the description of flow diagram programs are given by Landin (1969) and Scott (1970). Free Categories Definition D is said to be a basis for a category if D is a triple (A,F,H) where A and F are any sets and H: A x A - ~ (F) is a function such that for each f • F there is a unique pair (a,b), with a, b ~ A and f ~ H(a,b). (Although D is not a category we will call A the objects of D, call F the morphisms of D, write 'f: a -~ b in D' if f ~--S(a,b) and write HornD for H.) Definition If D is a basis for a category then ~ D , the free category generated by D, is a category such that (i) the objects of ~ D are the objects of D (ii) if f: a -~ b in D then f: a -~ b in ~ D (iii) if f: a -J b in ~ D is a morphism other than an identity morphism then there are morphisms fl'''''fk of D, k_~l, such that f=fl"''"fk (iv) if f'fo = g'go where f and g are morphisms of ~ D and fo and go are morphisms of D then f=g and fo=go.

Remark It is clear that each morphism of ~ D other than an identity decomposes into the composition of a unique sequence of morphisms of D, also that ~ D is unique to within an isomorphism functor. In a free semigroup all sequences are allowed, in the free category only those compatible with D. Definition If D is a basis for a category and ~ is some category then P is said to be a basis for a functor from D to ~ , written P: D ~ , if P is the union of functions PA' PF with PA: Objects of D

Objects of ~ and PF: Morphisms of D-~ Merphisms of ~ , such that if f: a - @ b then P(f): P(a)-@ P(b). Definition If P: D - ~ is a basis for a functor then ~ P , the functor generated by P, is the unique functor ~ P : ~ D @ @ such that (i) ~ P ( a ) = P(a) for each object a of D (ii) ~ P(f) = P(f) for each morphism f of D. ~ P is easily seen to be unique since each non-identity morphism f of ~ D equals fl" " ' " f k for some

unique morphisms fl,...,fk of D and so ~ P ( f ) = P(fl)'...'P(fk).

Theorem 1 If ~ P : ~ O - @ ~ and ~ P ' : ~ D - ~ are funotors and T is a function from objects of O to morphisms of ~ such that for each pair, a,b of objects of D and for each morphism f: a -@ b of D the following diagram commutes;

P(a). P(~) P(b)

p , ~ f ) " P ' (b)

then 17 i s a n a t u r a l t r a n s f o r m a t i o n "~ : ,.~ P "~ ~ P '.

Proof By d e f i n i t i o n "~ i s a n a t u r a l t r a n s f o r m a t i o n i f f o r each merphism f : a --~ b o f ~ D t h e above

diagram commutes. If f is an identity it commutes trivially, if f is a morphism of D it commutes by the condition on T. Otherwise f = fl'...'fk where fl,...,fk are morphisms of D3and we prove by induction

on k. For the following diagram commutes

P(a) "~^ P(fl"^ "f^ _ _ -~'P(°)^ ~^ )P(fk) "5" k-l)

,~P' (a)-- ~P' (fl" >... ' f k _ l ) ~,~P' (c) ,~ P' ( f k ) I"~ P(a)

since the left hand square commutes by the induction hypothesis and the right hand one by the condition on

T.

Re or a b a s i s for a functor and a functor then ( (x) means Jb (~(x))).

Example of a program

Consider the following program written in the conventional notation.

value of x is n.)O, an integer) $i

!

). 2

YES

(We assume that the initial

NO

| y : = ~

I

The flow diagram for this is D, a basis for a category. Let the objects of D be 1,2,3,4,5 and the

morphisms of D be f12: i "@ 2, f 2 3 : 2 -@ 3, f 3 4 : 3 "-~ 4, f#2: # -@ 2, f 2 5 : 2 -@ 5.

f122 I f

f

The set of possible states foT-this program is N x N, where N is the set of integers, since a state

is determined by a value for x and one four y. Thu~ in the absenc~ cf ~ c i f i c assertions we associate

N X N with each point. The commands correspond to relations over N ~ N, i.e. subsets of (N ~ N) × (N ~ N).

The abstract program is P: D - ~ , a basis for a functor, thus

P(1) = N ~ N

P(2) = N × N

etc.

P(f~o) = {((x,y),(x',y'))~x'---x and y'=lJ

P(fo~) = { ( ( x , y! , ( x ' , y ' ) ) ~ x ~ O and x'--x and y'--y~

P ( f ~ , ) { ( ( x , y ) , ( x ' , y ' ) ) l x ' = x and y'=2xT~

P(f~2) = { ( ( x , y ) , ( x ' , y ' ) ) i x ' = x - i and y ' - - y }

Consider a s i m i l a r program w i t h some s p e c i f i c a s s e r t i o n s

T - - - - - -....

YES

ly := 2 ~

I -'= 1

I

x~-n

yx2X=x n and x~O

y=2 n

~yx2X=2 n and x~O

.... yy~2x=2~2 n and x)O

The abstract program is P': D - ~ t h u s (assuming P'(a) _~ N X N for each object a)

P'(1) = {(x,y)Ix=n} P'(2) ~(x,y)lyx2x:2n and xZ0}

etc.

and assuming P'(f) .~ (N X N) X (N × N) for each morphism f)

P'(fl2 ) = ~((x,y),(x',y'))Ix'=x and y'=l and x=n, and y'x2x':2 n and x'~O}

etc.

Execution of programs

A flow diagram, D, is a basis for a category and generates a free category ~ D. Each morphism of

~ D is equal to the composition of a unique finite sequence of morphisms of D, i.e. arcs of the flow

diagram. Thus the morphisms of ~ D are the possible execution paths of the computation associated with

the flow diagram and HO~D(a,b), i.e. ~flf: a -~ b in ~ D ~ , is the set of all possible execution paths

starting at a and finishing at b.

An abstract~rogram, P: D - ~ , is a basis for a functor and generates a functor ~ P : ~ D " ~.

If f: a -~ b in ~ D is an execution path then ~ P ( f ) is the relation computed along that path.

We can now define the relation computed by the program from a to b, say Compp(a,b), as

Compp(a,b) = U { P(f)If: a * b in

Here we have considered the relation computed along each computation path from a to b and taken the

union of these. Thus when the program is run if a state s I occurs at the point a, then a state s2 can

occur later at the point b iff (sl,s2) ~ Compp(a,b).

In the above example ~ D has objects {1,2,3,4,5} and morphisms (f11,f22,f33,f44,f55,f12,f23,f34,f42,

f25'f12 ' f23'f23 ' f34 .... 3 where fii,i=1 ..... 5 are the identities. HOm~D(1,5) = ~ f 1 2 " f 2 5 , f $ 2 " f ~ ' f ~ "

f25,f12.f23,f34.f42.f23.f34.f42-f25,... ~, and so on.

Correctness

Floyd (1967) gives a method of proving the correctness of a program by attaching 'assertions' to the

points in the program and 'verifying' that each assertion, except the one on the entry point, follows

from the preceding assertion or assertions. Suppose that this 'verification' has been carried out, then

~loyd shows that if the program is started in a state satisfying the assertion at the entry point and then

reaches a given exit point, it will do so in a state satisfying the assertion at that exit point. Let us

call this the 'Verification Theorem'. Floyd proves it by induction on the length of the execution paths.

We will now see how the theorem can be expressed in our terms and how a proof analogous to Floyd's can be

obtained rather directly.

The program without assertions will have a set associated with each point in the flow diagram, the

same set for each point, namely the set of all possible states for programs in that language, say using

some given set of variables. Attaching assertions to it will be thought of as specifying another program

with the same flow diagram but possibly more restricted sets of states attached to the points, the set

of all states satisfying the assertion at the point. The relations corresponding to the commands will be

the previous ones restricted to the sets of states attached to their starting and finishing points.

We shall reduce proof of correctness to checking that a certain diagram commutes for each arc in the

flow diagram, which corresponds to Floyd's verification of each assertion.

Definition Suppose r: T "~ U and r': T' -~ U' are relations and T' .~ T &nd U' ~ U.

(i) We say that r' is th~ restriction of r if r' = r ~ (T' ~ U')

(ii) We say that r' is a conservative restriction of r iff r' is a restriction of r and y ~ U'

whenever x ~ T' mud (x,y) @ r, that is r(T') ~_. U'.

We can express these notions diagrammatically.

Definition We define the injection morphism ixy: X "~ Y in ~ as {(x,y)Ix ~ X and y=x}.

We will abbreviate ixy to i when X and Y are clear from the context.

Lemma 1

T r U

T' r' U'

commutes iff r' is the conservative restriction of r.

Proof The definition of conservative restriction may be written:-

(i) t r' u <=7 (t @ T' and u @ U' and t r u)

(ii) (t ~ T' and t r u) => u ~ U'

ll

P(al) ~ Compp(~l,a2) P(a 2 )

"~(al) ~ ,T(a 2)

p,

P'(a I) Compp,(al,a 2) (a 2)

Proof Since (D,P') directly simulates (D,P) with respect to "~ , by Theorem I P : ~ D - ~ d i r e c t l y

simulates ~ P : ~ D - ~ with respect to "~. The theorem follows, using the remark about unions of

relations.

Corollary (Direct Simulation Theorem) Under the conditions of theorem 3 the following diagram commutes,

where r is any relation such that "C (a2),r = ip,(a2), that is r is any right inverse of "~ (a2)

P(ai)., Compp(~l,a2) P(a 2)

"12'(al)f t r

P'(a 1) Compp~al,a 2) P'(a 2)

Proof "~(al),Compp,(al,a2),r = Compp(al,a2)' "~(a2)'r = Compp(al,a2)"

Remarks The corollary means that instead of running the program (D,P) we can encode the input data using

" ~ a l ) , run the program (D,P), then decode the outputs using r. (Note that we are using the notion of

inverse differently from Milner. He writes r -1 for {(y,x)~(x,y) 6 r }, which is sometimes called the

converse of r.)

We notice that conservative restriction is a special case of direct simulation. If (D,P') is a

conservative restriction of (D,P) then (D,P) simulates (D,P').

Example Suppose that the non-deterministic command 'x,X i__~sY' assigns values to x and X such that

{x} U X = Y and x ~ X, then the program (D,P') below simulates (D,P).

Is :: s+A(i)) i :

I <

(D,P')

:= i+l I

(D,P)

Tl

2---

It := t+x] Ix,X is x I

(D,P') has states (i,s,A,n) and (D,P) has states (x,X,t).

Define ~ by

((i,s,A,n), (x,X,t)) E • ( 1 ) iff s=t and X =[A(j) I i~j~n].

'Z'(2) = "12(1).

"C(3 ) is "~(2) adding that x=A(i).

((i,s,A,n), (x,X,t)) 6 "%'(4) iff s=t.

To prove that (D,P') will do the computation of (D,P) we verify that for each of f12' f23' f31 and

f14' "~'(a).f = f, q~(b) where f: a -~ b.

The above definition of simulation is clearly too restrictive since each step of the first program is

simulated by just one step of the second. Milner (private communication) has pointed out that in his work

also corresponding execution paths must be the same length in each program. I have investigated two other

notions of simulation using the category approach and hope to report the details elsewhere. In one of

these each instruction of one program corresponds to a subprogram of another and in the other it correspond~

more generally, to a set of execution paths in the other program.

The main difference between Milner's approach and ours are that he uses a program model due to Landin

(1969) and includes the current point in the program as part of the state. G. Plotkin (private commun-

ication) has pointed out that ~is treatment is related to ours if we contract D to have just 3 objects

(input, output,computation) and 3 morphisms (input -~ computation, computation--~ computation,

computation-~output). By including points as part of the state he ignores some of the specific flow

diagram structure, but obtains extra generality which might help in treating phenomena like premature jumps

out of subroutines. The fixed point technique which he uses could probably be carried over to the

category description as an alternative to our reliance on Theorem I.

I hope this paper shows some signs of promise for the category approach, but I am well aware that it

will only be justified if it leads to novel results.

A cknowl edgement s

The work was stimulated by the ideas of Landin (1969) and Milner (1970) and I am grateful to them and

to Gordon Plotkin for helpful discussions'in this area. I would like to thank Michael Gordon and Gordon

Plotkin for debugging a draft version, and Eleanor Kerse for typing. The work has been carried out with

the aid of a grant from the Science Research Council.

Appendix Definitions of category,, functor and natural transformation

A category g ~ consists of a class of objects, and a class of morphisms, related as follows. (1) With

each couple of objects, a, b,there is associated a set Hom(a,b) of morphisms, such that each morphism

belongs to just one Hom(a,b). We write f: a --2 b for f ~ Hom(a,b). (2) If f: a -@ b and g: b -9 c

there is a unique h: a -~ c called the composition of f and g, and denoted by f.g. (3) If f: a - 9 b,

g: b -~ c and h: c --) d then (f-g),h = f, (g.h). (~) To each object a there corresponds a morphism

ia: a -9 a, called the identity for a, such that for any f: b -9 a and g: a --) c f,i a = f and ia.g = g.

A functor, ~ , from a category ~ to a category ~ , written ~ : ~ - ~ , is a function which takes

O~objects t o ~ objects and ~ m o r p h i s m s t o ~ morphisms in such a way that (1) ~ ( l a ) = • (2) If

f : a-"~ b in ~ and g: b "-~ c i n ~ t h e n ~ (f): P (a) ~ ( b ) in ~ and ~ ( g ) : ~ (b)--)~(c) in ~.. and

(f-g): ~(f). ~(g).

If (%) : ~ - ~ a n d ~ : ~ - ~ are functors, by a natural transformation, "~ : ~ - ~ ~ w e mean a function

which associates with each object a in ~ a morphism ~ (a): ~ (a)-~ ~ (a) in ~ so that the following

diagram commutes

References

Cohn, P.M. (1965) Universal Algebra.

£(a). @(f); @(b)

r(aI t'(b)

New York and London:

That is,

~ ( f ). ~: (b) = r(c) • ~(f).

Harper Row.

Cooper, D.C. (1971) Programs for mechanical program verification. Machine Intelligence 6 (eds. B. Meltzer

and D. Michie) Edinburgh: Edinburgh UniversityPress, pp. 43-59.

Floyd, R.W. (1967) Assigning meanings to programs. Proceedings of Symposia in Applied Mathematics.

American Mathematical Society, Vol. 19, 19-32.

Karp, R.M. (1959) Some applications of logical syntax to digital computer programming. Harvard Universi~

Thesis.

Landin, P.J. (1969) A program macLine symmetric automata theory. Machine Intelligence 5 (eds. B. Meltzer

and D. Michie) Edinburgh: Edinburgh University Press, pp. 99-120.

Maclane, S. and Birkhoff, O. (1967) Algebra. New York: MacMillan.

Manna, Z. (1970) The correctness of nondeterministic programs. Artificial Intelligence, Vol. i, 1-26.

Manna, Z. (1970~ Termination of programs represented as interpreted graphs. Sprin~ Joint Computer Conf.

pp. 83-89.

Milner, R. (1970) A formal notion of simulation between programs. Memo 14, Computer and Logic Research

Group, University College of Swansea, U.K.

Milner, R. (1971) An algebraic definition of simulation between programs. Stanford Artificial

Intelligence Project Memo AIM-142. Computer Science Department, Stanford University. (Also in Proc.

I.J.C.A.I. Conference, London, September, 197~.)

Scott, D. (1971) The lattice of flow diagrams. Semantics of Algorithmic Languages (ed. E. Engeler)

Springer Lecture Notes in Mathematics, Vol. 188, pp. ~11-~66.