Formal Methods Unifying Computing Science and Systems Theory
Raymond BOUTE INTEC, Universiteit Gent B-9000 Gent, Belgium
ABSTRACT The typical formal rules used are those for arithmetic (asso- ciativity, distributivity etc.) plus those from calculus. Computing Science and Systems Theory can gain much from uni- Exploiting formality and the calculational style are taken for fied mathematical models and methodology, in particular formal granted throughout most of applied mathematics based on alge- reasoning (“letting the symbols do the work”). This is achieved bra and calculus (although, as shown later, common conventions by a wide-spectrum formalism. still exhibit some serious defects). The language uses just four constructs, yet suffices to synthe- By contrast, logical reasoning in everyday practice by math- size familiar notations (minus the defects) as well as new ones. It ematicians and engineers is highly informal, and often involves supports formal calculation rules convenient for hand calculation what Taylor [20] calls syncopation, namely using symbols as and amenable to automation. mere abbreviations of natural language, for instance the quanti- The basic framework has two main elements. First, a func- fier symbols ∀ and ∃ just standing for “for all” and “there exists”, tional predicate calculus makes formal logic practical for engi- without calculation rules. neers, allowing them to calculate with predicates and quanti- The result is a severe style breach between “regular calcu- fiers as easily as with derivatives and integrals. Second, concrete lus”, usually done in an essentially formal way, and the logical generic functionals support smooth transition between pointwise justification of its rules, which even in the best analysis texts is and point-free formulations, facilitating calculation with func- done in words, with syncopation instead of calculation. As Taylor tionals and exploiting formal commonalities between CS and observes, the logical structure of the arguments is thereby often Systems Theory. seriously obscured. Elaborating a few small but representative examples shows how formal calculational reasoning about diverse topics such as This style breach pervades applied mathematics, and is re- mathematical analysis, program semantics, transform methods, flected in the methodological gap between classical Systems The- systems properties (causality, LTI), data types and automata pro- ory, based on calculus, and Computer Science, based on logic. As vides a unified methodology. explained by Gries [13], although formal logic exists as a sepa- rate discipline, its traditional form is drowned in technicalities Keywords Calculation, Computing Science, Concrete Generic that make it too cumbersome for practical use, but now calcula- Functionals, Formal Methods, Functional Predicate Calculus, tional variants exist [12]. Quantifiers, Systems Theory, Unification The rewards of bridging the gap are huge, namely making the symbols do the work, as nicely captured by the maxim “Ut 1. INTRODUCTION faciant opus signa” of the conference series on Mathematics of Program Construction [2]. Here we do not mean only (nor even Motivation: ut faciant opus signa primarily) using software tools, but also the guidance provided by Computing Science and Systems Theory are fundamental to en- the shape of the expressions in mathematical reasoning, and the gineering in general [17] and ICT in particular. Complex systems development of a “parallel intuition” to that effect. This comple- heavily rely on both. Yet, the conceptual frameworks and mod- ments the usual “semantic” intuition, especially when exploring elling techniques are (still) very divergent. The crucial loss is areas where the latter is clueless or still in development. that the benefits of formal reasoning are much underexploited. We briefly elaborate. Approach: Functional Mathematics (Funmath) Whoever enjoyed physics will recall the excitement when ju- A unifying formalism is presented that spans a wide application dicious manipulation of formulas yielded results not obtainable spectrum. A formalism is a language (or notation) together with by mere intuition. Such manipulation, from polynomial factor- formal rules for symbolic manipulation. ization in high school to calculation with derivatives and integrals The language [5] is functional in the sense that functions in calculus, is essentially formal, i.e., guided by the shape of the are first-class objects and also form the basis for unification. It expressions. The usual style is calculational, namely, chaining supports declarative (abstract) as well as operational (implemen- expressions by relational operators such as equality (“=”). An tation) aspects throughout all mathematics relevant to computer example is and systems engineering, and is free of all defects of common R conventions, including those outlined by Lee and Varaiya [18] as +∞ F (s) = e−|x|e−i2πxsdx discussed later. −∞R = 2 +∞ e−x cos 2πxs dx The formal rules are calculational, supporting the same style 0 R from predicate logic through calculus. Thereby the conceptual +∞ −x i2πxs = 2 Re 0 e e dx and notational unification provided by the language is comple- −1 = 2 Re i2πs−1 mented by unified methodology. 2 In particular, this enables engineers to formally calculate with = 2 2 , (1) 4π s +1 predicates and quantifiers with the same ease and algebraic flavor taken from a classic engineering text by Bracewell [10]. as with derivatives and integrals.
ISSN: 1690-4524 SYSTEMICS, CYBERNETICS AND INFORMATICS VOLUME 3 - NUMBER 4 31 Overview optional are the usual ones. If f is a function-valued function, The formalism is presented in section 2, which introduces the lan- f x y stands for (f x) y. guage, its rationale and its four basic constructs, and in section 3, Let ? be infix. Partial application is of the form a? or ?b, which gives the general-purpose formal rules, namely those for defined by (a?) b = a ? b = (?b) a. Variadic application is of the concrete generic functionals and for functional predicate calcu- form a ∗ b ∗ c etc., and is always defined to equal F (a, b, c) for lus (quantifiers). Application examples are given in section 4 for a suitably defined elastic extension F of ?. Systems Theory, section 5 for Computing Science, and section Abstraction: the form is b . e, where b is a binding and e an 6 for common aspects. Some concluding remarks are given in expression (extending after “ . ” as far as compatible with paren- section 7. theses present). Intuitively, v : X ∧. p . e denotes a function whose domain is the set of v in X satisfying p, and mapping v to e (for- 2. THE FORMALISM, PART A: LANGUAGE malized in section 3). Syntactic sugar: e | b for b . e and v : X | p for v : X ∧. p . v. Rationale: the need for defect-free notation A trivial example: if v does not occur (free) in e, we de- Notation is unimportant if and only if it is well-designed, but be- fine • by X • e = v : X . e to denote constant functions. Special comes a crucial stumbling block if it is deficient. The criterion is cases: the empty function ε := ∅ • e (any e) and defining 7→ by supporting formal calculation: if during expression manipulation e0 7→ e = ι e0 • e for one-point functions. one has to be on guard for the defects, one cannot let the symbols We shall see howP abstractions help synthesizing familiar ex- i do the work. pressions such as i : 0 .. n . q and {m : Z | m < n}. In long-standing areas of mathematics such as algebra and Tupling: the 1-dimensional form is e, e0, e00 (any length), analysis, conventions are largely problem-free, but not entirely. denoting a function with domain axiom D (e, e0, e00) = {0, 1, 2} Most important are violations of Leibniz’s principle, i.e., that and mapping axiom (e, e0, e00) 0 = e and (e, e0, e00) 1 = e0 and equals may always be substituted for equals. An example is ellip- (e, e0, e00) 2 = e00. The empty tuple is ε and for singleton tuples sis: writing dots as in a0 + a1 + ... + an. By Leibniz’s principle, we define τ with τ e = 0 7→ e. 2 if ai = i and n = 7, this should equal 0 + 1 + ... + 49, Parentheses are not part of tupling, and are as optional in which most likely is not intended. Other defects, also pointed (m, n) as in (m + n). Matrices are 2-dimensional tuples. out in [18], are related to writing function application when the function is intended, as in y(t) = x(t) ∗ h(t) where ∗ is convo- 3. THE FORMALISM, PART B: RULES lution. This causes instantiation to be incorrect, e.g., y(t − τ) = x(t − τ) ∗ h(t − τ). The formal calculation rules and gaining fluency with them is the topic of a full course [7], so here we must be terse. InP discrete mathematics the situation is worse, e.g., for the sum- many conventions are mutually inconsistent and calcula- Rules for equational and calculational reasoning tion rules are rarely given. Poorest are the conventions in logic The equational style of Eq. (1) is generalized to the format and set theory used in daily practice. A typical defect is abusing 0 0 0 the set membership relation ∈ for binding a dummy. Frequent e R hJustificationi e , (2) patterns are {x ∈ X | p}, as in {m ∈ | m < n}, and Z where the R0 in successive lines are mutually transitive, for in- {e | x ∈ X}, as in {n · m | m ∈ }, where in the patterns Z stance =, ≤, etc. in arithmetic, ≡, ⇒ etc. in logic. p is boolean and e any expression. The ambiguity is shown by In general, for any theorem p we have the rule taking y ∈ Y for p and e. Defects like these prohibit formal rules and explain why, for such expressions, syncopation prevails in v INSTANTIATION: from p, infer p[e . (3) the literature. v Funmath language design We write [e to express substitution of e for v, for instance, x,y We do not patch defects ad hoc, but generate correct forms by (x + y = y + x)[3,z+1= 3 + (z + 1) = (z + 1) + 3. orthogonal combination of just 4 constructs, gaining new useful For equational reasoning (i.e., using = or ≡ only), the basic forms of expression for free. The basis is functional.A func- rules [12] are reflexivity, symmetry, transitivity and tion f is fully defined by its domain D f and its mapping (image 0 v v LEIBNIZ’SPRINCIPLE: from e = e , infer d[ = d[ 0 . (4) definition). Here are the constructs. e e Identifier: any symbol or string except colon, filter mark, For instance, x + 3 · y = hx = z2i z2 + 3 · y. Eq. (4) is used abstraction dot, parentheses, and a few keywords. by taking d := v + 3 · y and e := x and e0 := z2. Identifiers are introduced by bindings i : X ∧. p, read “i in X satisfying p”, where i is the (tuple of) identifier(s), X a set and Rules for calculating with propositions and sets Assume the usual propositional operators ¬, ≡, ⇒, ∧, ∨. For a p a proposition. The filter ∧. p (or with p) is optional, e.g., n : N practical calculus, a much more extensive set of rules is needed and n : Z ∧. n ≥ 0 are interchangeable. Identifiers from i should not appear in expression X. than given in classical texts on logic, so we refer to Gries [12]. Shorthand: i := e stands for i : ι e. We write ι e, not {e}, for Note that ≡ is associative, but ⇒ is not. We make parentheses in singleton sets, using ι defined by e0 ∈ ι e ≡ e0 = e. p ⇒ (q ⇒ r) optional, hence required in (p ⇒ q) ⇒ r. Embed- Identifiers can be variables (in an abstraction) or constants ding binary algebra in arithmetic [3, 4], logic constants are 0 and 1, not FALSE and TRUE. (declared by def binding). Well-established symbols, such as B, 0 v v Leibniz’s principle can be rewritten e = e ⇒ d[ = d[ 0 . ⇒, R, +, serve as predefined constants. e e Application: for function f and argument e, the default is For sets, the basic operator is ∈. The rules are derived ones, f e; other conventions are specified by dashes in the operator’s e.g., defining ∩ by x ∈ X ∩ Y ≡ x ∈ X ∧ x ∈ Y and × by (x, y) ∈ X × Y ≡ x ∈ X ∧ y ∈ Y . After defining {—}, we binding, e.g., — ? — for infix. For clarity, parentheses are never x used as operators, but only for parsing. Rules for making them shall be able to prove y ∈ {x : X | p} ≡ y ∈ X ∧ p[y .
32 SYSTEMICS, CYBERNETICS AND INFORMATICS VOLUME 3 - NUMBER 4 ISSN: 1690-4524 Set equality is defined via Leibniz’s principle, written as an Let p and q be propositions, then p, q is a predicate and implication: X = Y ⇒ (x ∈ X ≡ x ∈ Y ) and the con- ∀ (p, q) ≡ p ∧ q. So ∀ is an elastic extension of ∧ and we verse, extensionality, written here as an inference rule: from define variadic application by p ∧ q ∧ r ≡ ∀ (p, q, r) etc. x ∈ X ≡ x ∈ Y , infer X = Y , with x a new variable. This Letting P be an abstraction v : X . p yields the familiar form 2 rule is strict, i.e., the premiss must be a theorem. ∀ v : X . p, as in ∀ x : R . x ≥ 0. For every algebraic law, Rules for functions and generic functionals most elegantly stated in point-free form, a matching pointwise We omit the design decisions, to be found in [5] and [8]. In what (familiar-looking) form is obtained in this way. Derived rules All laws follow from Eq. (10) and function follows, f and g are any functions, P any predicate (B-valued equality. A collection sufficient for practice is derived in [7]. function, B := {0, 1}), X any set, e arbitrary. Function equality and abstraction Equality is defined via Here we only give some examples, starting with a characteriza- Leibniz’s principle (taking domains into account) f = g ⇒ tion of f = g without inference rules: D f = D g ∧ (x ∈ D f ∩ D g ⇒ f x = g x), and extension- f = g ≡ D f = D g ∧ ∀ x : D f ∩ D g . f x = g x . (11) ality as a strict inference rule: with new x, from p ⇒ D f = D g ∧ (x ∈ D f ∩ D g ⇒ f x = g x), infer p ⇒ f = g. Another example is duality (generalizing De Morgan law) Abstraction encapsulates substitution. Formal axiom: for the ¬ ∀ P = ∃ (¬ P ) ¬ (∀ v : X . p) ≡ ∃ v : X. ¬ p . (12) v domain d ∈ D (v : X ∧. p . e) ≡ d ∈ X ∧ p[d, and for the map- v Here are the main distributivity laws. All have duals. ping: d ∈ D (v : X ∧. p . e) ⇒ (v : X ∧. p . e) d = e[d. Equality is characterized via function equality (exercise). Name of the rule Point-free form Generic functionals Our goal is (a) removing restrictions in Distributivity ∨/∀ q ∨ ∀ P ≡ ∀ (q *∨ P ) common functionals from mathematics, (b) making often-used L(eft)-distrib. ⇒/∀ q ⇒ ∀ P ≡ ∀ (q ⇒* P ) implicit functionals from systems theory explicit. The idea is R(ight)-distr. ⇒/∃ ∃ P ⇒ q ≡ ∀ (P ⇒( q) defining the result domain to avoid out-of-domain applications * P(seudo)-dist. ∧/∀ D P = ∅ ∨ (p ∧ ∀ P ) ≡ ∀ (p ∧ P ) in the image definition. Case (a) is illustrated by composition f ◦ g, whose common Pointwise: ∃ (v : X . p) ⇒ q ≡ ∀ (v : X . p ⇒ q) (new v). definition requires R g ⊆ D f; then D (f ◦ g) = D g. Removing Here are a few additional illustrative laws. the restriction, we define f ◦ g for any functions: Name of the rule Point-free form b f ◦ g = x : D g ∧. g x ∈ D f . f (g x) . (5) Distribut. ∀/∧ ∀ (P ∧ Q) ≡ ∀ P ∧ ∀ Q One-point rule ∀ P=e ≡ e ∈ D P ⇒ P e Observation: x ∈ D (f ◦ g) ≡ x ∈ D g ∧ g x ∈ D f by the Trading ∀ PQ ≡ ∀ (Q ⇒c P ) abstraction axiom, hence D (f ◦ g) = {x : D g | g x ∈ D f}. Transposition ∀ (∀ ◦ R) ≡ ∀ (∀ ◦ RT) Case (b) is illustrated by the usual implicit generalization of 0 Distributivity ∀/∧ assumes D P = D Q, otherwise only ∀ P ∧ arithmetic functions to signals, traditionally written (s+s )(t) = b 0 b ∀ Q ⇒ ∀ (P ∧ Q). The one-point rule written pointwise is s(t) + s (t). We generalize this by (duplex) direct extension ( ): v ∀ (v : X . v = e ⇒ p) ≡ e ∈ X ⇒ p[e . For the last line, for any functions ? (infix), f, g, T R : S → T → B and (v : X . w : Y . e) = w : Y . v : X . e, hence f b? g = x : D f ∩ D g ∧. (f x, g x) ∈ D (?) . f x ? g x . (6) ∀ (v : X. ∀ w : Y . p) ≡ ∀ (w : Y. ∀ v : X . p) (∀-swap). Duals and other pointwise forms are left as an exercise. f e Often we need half direct extension: for function , any , Sometimes the following rules are useful: f (? e = f b? (D f • e) and e *? f = (D f • e) b? f . (7) Instantiation: ∀ P ⇒ e ∈ D P ⇒ P e and, with new x: Gener- alization: from p ⇒ x ∈ D P ⇒ P x, infer ∀ P . Simplex direct extension ( ) is defined by f g = f ◦ g. Wrapping up the rule package for function(al)s Function merge (∪· ) is defined in 2 parts to fit the line: Function range We define the range operator R by D (f ∪· g) = {x : D f ∪ D g | x ∈ D f ∩ D g ⇒ f x = g x} and x ∈ D (f ∪· g) ⇒ (f ∪· g) x = (x ∈ D f) ? f x g x. (8) e ∈ R f ≡ ∃ x : D f . f x = e . (13) Filtering (↓) introduces/eliminates arguments: A consequence is the composition rule ∀ P ⇒ ∀ (P ◦ f) and f ↓ P = x : D f ∩ D P ∧. P x . f x . (9) D P ⊆ R f ⇒ (∀ (P ◦ f) ≡ ∀ P ), whose pointwise form yields ∀ (y : R f . p) ≡ ∀ (x : D f . p[y ) (“dummy change”). e f e X = f ↓ (X • 1) f x A particularization is restriction ( ): . We Set comprehension We define {—} as fully interchange- ↓ x ∈ (X ↓ P ) ≡ x ∈ X ∩ D P ∧ P x extend to sets: . able with R. This yields defect-free set notation: expressions Writing a for a ↓ b and using partial application, this yields b like {2, 3, 5} and Even = {2 · m | m : Z} have familiar f formal rules for useful shorthands like
ISSN: 1690-4524 SYSTEMICS, CYBERNETICS AND INFORMATICS VOLUME 3 - NUMBER 4 33 4. EXAMPLES I: SYSTEMS THEORY A system is a function s : SA → SB . The response of s to input signal x : SA at time t : T is s x t, read (s x) t. Analysis: calculation replacing syncopation Characteristics Let s : SA → SB . Then s is memoryless iff We show how traditional proofs rendered tediuos by syncopation ∃ f— : T → A → B. ∀ x : SA . ∀ t : T . s x t = ft (x t). [20] are done calculationally. The example is adjacency [15]. Let T be additive, and the shift function σ— be defined by Since predicates (of type → ) yield more elegant formula- R B στ x t = x (t + τ) for any t and τ in T and any signal x. Then tions than sets (of type P ), we define the predicate transformer R system s is time-invariant iff ∀ τ : T . s ◦ στ = στ ◦ s. ad : (R → B) → (R → B) and the predicates open and closed s S → S (x, y) S2 A system : R R is linear iff for all : R and both of type ( → ) → , by 2 * b * * b * R B B (a, b) : R we have s (a · x + b · y) = a · s x + b · s y. Equivalently, extending s to SC → SC in the evident way, the sys- ad P v ≡ ∀ : R>0 . ∃ x : RP . |x − v| < * * tem s is linear iff ∀ z : S . ∀ c : . s (c · z) = c · s z.A open P ≡ ∀ v : RP . ∃ : R>0 . ∀ x : R . |x − v| < ⇒ P x C C closed P ≡ open (¬ P ) system is LTI iff it is both linear and time-invariant. Response of LTI systems Define the parametrized exponen- c·t We prove the closure property closed P ≡ ad P = P . The tial E— : C → T → C by Ec t = e . Then we have: * calculation, assuming the (easy) lemma P v ⇒ ad P v, is THEOREM: if s is LTI then s Ec = s Ec 0 · Ec. Proof: we calculate s E (t + τ) to exploit all properties. closed P c
≡hclosedi open (¬ P ) s Ec (t + τ) = hDefinition σi στ (s Ec) t ≡hopeni ∀ v : R¬ P . ∃ : R>0 . ∀ x : R . |x − v| < ⇒ ¬ P x = hTime inv. si s (στ Ec) t * ≡hTrading ∀i = hProperty Eci s (Ec τ · Ec) t * ∀ v : R . ¬ P v ⇒ ∃ : R>0 . ∀ x : R . |x − v| < ⇒ ¬ P x = hLinearity si (Ec τ · s Ec) t ≡hContrapositive, i.e., ¬ p ⇒ q ≡ ¬ q ⇒ pi * = hDefintion i Ec τ · s Ec t ∀ v : R . ¬ ∃ ( : R>0 . ∀ x : R . P x ⇒ ¬ (|x − v| < )) ⇒ P v * ≡hDuality and ¬ (p ⇒ ¬ q) ≡ p ∧ qi Substituting t := 0 yields s Ec τ = s Ec 0 · Ec τ or, using , * * ∀ v : R . ∀ ( : R>0 . ∃ x : R . P x ∧ |x − v| < ) ⇒ P v s Ec τ = (s Ec 0 · Ec) τ, so s Ec = s Ec 0 · Ec by func- * ≡hDef. adi ∀ v : R . ad P v ⇒ P v tion equality. The hProperty Eci is στ Ec = Ec τ · Ec (easy). ≡hLemmai ∀ v : R . ad P v ≡ P v . Note that this proof uses only the essential hypotheses. An example about transform methods Tolerances on specifications We show how formally correct use of functionals, in particular Our first motivation for designing × was formalizing the con- avoiding common defective notations like F{f(t)} and writing cept of tolerance for functions, based on a common convention F f ω instead, enables formal calculation. In for specifying frequency/gain characteristics: R +∞ −j·ω·t F f ω = −∞ e · f t · d t 6Gain R T x F 0g t = 1 · +∞ ej·ω·t · g ω · d ω 2·π −∞ ¤ 6A ¤ A f x ¤ ¤¤ A bindings are clear and unambiguous. The example formalizes Aq? A Laplace transforms via Fourier transforms. We assume some fa- ¤ ¤ A ¤ ¤ A miliarity with the usual informal treatments. A A −σ·t ¤ A A¤ - Frequency Given `— : R → R → R with `σ t = (t < 0) ? 0 e , we x define the Laplace-transform L f of a function f by: Clearly, with T x specifying the desired interval for every x, the L f (σ + j · ω) = F (`σ b· f) ω (15) functions f satisfying f ∈ ×T are precisely the desired ones. Next we show other uses of the same operator. b for real σ and ω, with σ such that `σ · fRhas a Fourier transform. With s := σ + j · ω we obtain L f s = +∞ f t · e−s·t · d t. 0 5. EXAMPLES II: COMPUTING SCIENCE The converse L0 is specified by L0 (L f) t = f t for all t ≥ 0 (weakened where `σ b· f is discontinous). For such t, From data structures to query languages Records as in PASCAL [14] are expressed by × as func- L0 (L f) t tions whose domain is a set of field labels (an enumeration type). = hSpecific.i f t Example: with field names name and age, σ·t = ha = 1 · ai e · ` t · f t ∗ σ Person := × (name 7→ ∪· age 7→ ) σ·t A N = hDefin. bi e · (`σ b· f) t σ·t 0 defines a function type such that person : Person satisfies = hWeaken.i e ·F (F (`σ b· f)) t ∗ R person name ∈ A andS personS age ∈ N. Obviously, by defin- = h F 0i eσ·t · 1 · +∞ F (` b· f) ω · ej·ω·t · d ω Defin. 2·π −∞ σ ing record F = × ( · F ) ( · : elastic extension of ∪· ), one can R ∗ = hDefin. Li eσ·t · 1 · +∞ L f (σ + j · ω) · ej·ω·t · d ω also write Person := record (name 7→ A , age 7→ N). R2·π −∞ Trees are functions whose domains are branching structures, 1 +∞ (σ+j·ω)·t = hFactori · L f (σ + j · ω) · e · d ω i.e., sets of sequences describing the path from the root to a leaf 2·π −∞R 1 σ+j·∞ s·t in the obvious way (for any branch labeling). Other structures are = hs := σ+j·ωi · L f s · e · d s 2·π·j σ−j·∞ covered similarly Characterization and properties of systems Relational databases The following record type ∗ ∗ General Signals over a value space A are functions of type record (code 7→ Code, name 7→ A , inst 7→ Staff , prrq 7→ Code ) SA with SA = T → A for some time domain T. specifies the type of tables of the form
34 SYSTEMICS, CYBERNETICS AND INFORMATICS VOLUME 3 - NUMBER 4 ISSN: 1690-4524 Code Name Instructor Prerequisites Substituting the program equations for the various constructs, cal- CS100 Elements of logic R. Barns none culation in our predicate calculus yields [9] MA115 Basic Probability K. Jason MA100 v CS300 Formal Methods R. Barns CS100, EE150 wa [[v := e]] p ≡ p[e wa [[c0 ; c00]] p ≡ wa c0 (wa c00 p) ··· ··· ··· 0 0 wa [[if i : I . bi -> ci fi]] p ≡ ∃ b ∧ ∀ i : I . bi ⇒ wa ci p 0 n Generic functionals subsume all usual query-operators: wa [[do b -> c od]] p ≡ ∃ n : N . w (¬ b ∧ p) 0 For the selection-operator (σ): σ (S, P ) = S ↓ P . defining w by w q ≡ (¬ b ∧ p) ∨ (b ∧ wa c q) . For projection (π): π (S, F ) = {r e F | r : S}. For the join-operator (./): S ./ T = S ⊗ T . 6. EXAMPLES III: COMMON ASPECTS Here ⊗ is the generic function type merge operator, defined as in [8] by S ⊗ T = {s ∪· t | (s, t): S × T ∧. s c t}. Note that ⊗ is Automata theory is a classical common ground between comput- associative, although ∪· is not (exercise). ing and systems theory. Yet, even here formalization yields uni- fication and new insights. The example is sequentiality (captur- Formal semantics of programming languages ing non-anticipatory behavior) and the derivation of properties by We show how the functional predicate calculus unifies the predicate calculus. methodology for analysis (the ad example) and semantics. Preliminaries For any set A we define An by An = The state s is the tuple made of the program variables, and 0 n → A where n = {m : N | m ci fi ∃ i : I . bi ∧ R ci (s, s ) ≡hDefinit. ≤i∀ (x, y) : (A ) . ∃ (z : A . y = x ++ z) ⇒ ∗ Command c Termination T c s ∃ (u : B . s y = s x ++ u) ∗ 2 ∗ v := e 1 ≡hRdst ⇒/∃i ∀ (x, y) : (A ) . ∀ (z : A . y = x ++ z ⇒ ∗ 0 00 0 0 00 ∃ u B . s y = s x ++ u) c ; c T c s ∧ ∀ t • R c (s, t) ⇒ T c t : ∗ ∗ ∗ 0 0 ≡hNest, swpi ∀ x : A . ∀ z : A . ∀ (y : A . y = x ++ z ⇒ if i : I . bi -> ci fi ∃ b ∧ ∀ i : I . bi ⇒ T ci s ∃ u : B∗ . s y = s x ++ u) ∗ 2 ∗ For skip: R skip (s, s0) ≡ s0 = s and ≡h1-pt, nesti ∀ (x, z) : (A ) . ∃ u : B . s (x ++ z) = s x ++ u T skip s ≡ 1. For abort: R abort (s, s0) ≡ 0 and ≡hCompreh.i ∗ 2 ∗ ∗ 2 T abort s ≡ 0. The loop do b -> c0 od stands for ∃ r : (A ) → B . ∀ (x, z) : (A ) . s (x ++ z) = s x ++ r (x, z) 0 if ¬ b -> skip b -> (c ; c) fi by definition, where c is This completes the proof. Remarkably, the definition of ++ is the command itself. used nowhere, illustrating the power of abstraction. Hoare semantics Let the state before and after executing The last step uses the function comprehension axiom: c satisfy a (antecondition) and p (postcondition) respectively. ∀ (x : X. ∃ y : Y.R (x, y)) ≡ ∃ f : X → Y. ∀ x : X.R (x, f x) 8s s0 a[s R c (8s, s0) Since all that is known about and is 8s and , R X × Y → s for any relation : B. this must imply p[s0 . This is the intuition behind the definitions Derivatives and primitives This framework leads to the of the following correctness criteria: following. An rb function is unique (exercise). We define the 0 s 0 s {a} c {p} ≡ ∀ 8s • ∀ s • a[ ∧ c (8s, s ) ⇒ p[ 0 Partial: 8s R s derivative operator D on sequential systems by s (x −< a) = Termination: Term c a ≡ ∀ s • a ⇒ T c s s x ++ D s (x −< a), so D s (x −< a) = r (x, τ a) where r is the Total: [a] c [p] ≡ {a} c {p} ∧ Term c a rb function of s, and by D s ε = ε. Calculating Dijkstra semantics We define the weakest lib- Primitivation I is defined for any g : A∗ → B∗ by I g ε = ε eral antecondition operator wla and the weakest antecondition and I g (x −< a) = I g x ++ g (x ++ a). Properties are shown operator wa by {a} c {p} ≡ ∀ s • a ⇒ wla c p and [a] c [p] ≡ next, with a striking analogy from analysis. ∀ s • a ⇒ wa c p (evident). To obtain explicit formulas, we cal- culate [a] c [p] into this shape. s (x −< a) = s x ++ D s (x −< a) s x = s ε ++ I (D s) x f (x + h) ≈ f x + D f x · h f x = f 0 + I (D f) x 8 0 s 8 0 s 8 ∀ s • ∀ s • a[8s ⇒ (R c ( s, s ) ⇒ p[s0 ) ∧ T c s Of course, in the second row, D is the derivation operator from s 0 0 s R ≡ h ⇒ ∀i ∀ 8s • a[ ⇒ ∀ s • ( c (8s, s ) ⇒ p[ 0 ) ∧ c 8s x Ldst. / 8s R s T analysis, and I g x = g y · d y for integrable g. Moreover, s 0 0 s 0 ≡ h ∧ ∀i ∀ 8s • a[ ⇒ ∀ (s • c (8s, s ) ⇒ p[ 0 ) ∧ c 8s Pdst. / 8s R s T f x + D f x · h is only approximate. 8 0 0 s ≡ hs for si ∀ s • a ⇒ ∀ (s • R c (s, s ) ⇒ p[s0 ) ∧ T c s This and other differences confirm the observation in [18] that automata are easier than real functions. Note the similarity with the ad -calculations. We proved: ∗ ∗ 0 0 s Finally, {(y : A . r (x, y)) | x : A } is the state space. wla c p ≡ ∀ s • R c (s, s ) ⇒ p[s0 and wa c p ≡ wla c p∧T c s.
ISSN: 1690-4524 SYSTEMICS, CYBERNETICS AND INFORMATICS VOLUME 3 - NUMBER 4 35 7. CONCLUSION Johan Jeuring, eds., Generic Programming, pp. 89–119, Kluwer (2003) We have shown how a formalism, consisting of a very simple lan- [9] Raymond T. Boute, “Calculational semantics: deriving pro- guage of only 4 constructs, together with a powerful set of formal gramming theories from equations by functional predicate calculation rules, not only yields a notational and methodological calculus”, Technical note B2004/02, INTEC, Universiteit unification of computing science and systems theory, but also of Gent (2004) (submitted for publication to ACM TOPLAS) a large part of mathematics. Apart from the obvious scientific ramifications, the formal- [10] Ronald N. Bracewell, The Fourier Transform and Its Ap- ism provides a unified basis for education in ECE (Electrical and plications, 2nd ed, McGraw-Hill (1978) Computer Engineering), as advocated in [17]. [11] Edsger W. Dijkstra and Carel S. Scholten, Predicate Cal- The difficulties should be recognized as well. First, although culus and Program Semantics. Springer-Verlag, Berlin calculational logic is easier than classical formal logic, the de- (1990) emphasis on proofs in education has caused students to find logic [12] David Gries and Fred B. Schneider, A Logical Approach increasingly difficult [1, 19]. Second, conservatism of colleagues to Discrete Math, Springer-Verlag, Berlin (1993) may even be a larger problem [1, 18, 19, 21], and there are known cases of censorship. [13] David Gries, “The need for education in useful formal Yet, the wide scope of the formalism demonstrated in these logic”, IEEE Computer 29, 4, pp. 29–30 (April 1996) few pages, with only minor gaps left for the reader to fill, provides [14] Kathleen Jensen and Niklaus Wirth, PASCAL User Man- ample evidence for the long-term advantages. ual and Report. Springer-Verlag, Berlin (1978) [15] Serge Lang, Undergraduate Analysis. Springer-Verlag, 8. REFERENCES Berlin (1983)
[1] Vicki L. Almstrum, ”Investigating Student Difficulties With [16] Leslie Lamport, Specifying Systems: The TLA+ Lan- Mathematical Logic”, in: C. Neville Dean and Michael G. guage and Tools for Hardware and Software Engineers. Hinchey, eds, Teaching and Learning Formal Methods, Pearson Education Inc. (2002) pp. 131–160. Academic Press (1996) [17] Edward A. Lee and David G. Messerschmitt, “Engineering [2] Eerke Boiten and Bernhard Moller,¨ Sixth International — an Education for the Future”, IEEE Computer, Vol. 31, Conference on Mathematics of Program Construction No. 1, pp. 77–85 (Jan. 1998), via (Conference announcement), Dagstuhl (2002). ptolemy.eecs.berkeley.edu/publications www.cs.kent.ac.uk/events/conf/2002/mpc2002 /papers/98/ [3] Raymond T. Boute, “A heretical view on type embedding”, [18] Edward A. Lee and Pravin Varaiya, “Introducing Signals ACM Sigplan Notices 25, pp. 22–28 (Jan. 1990) and Systems — The Berkeley Approach”, First Signal [4] Raymond T. Boute, Funmath illustrated: A Declarative Processing Education Workshop, Hunt, Texas (Oct. 2000) Formalism and Application Examples. Declarative Sys- ptolemy.eecs.berkeley.edu/publications/ tems Series No. 1, Computing Science Institute, University papers/00/ of Nijmegen (July 1993) [19] Rex Page, BESEME: Better Software Engineering [5] Raymond T. Boute, “Fundamentals of hardware description through Mathematics Education, project presentation languages and declarative languages”, in: Jean P. Mermet, http://www.cs.ou.edu/˜beseme/besemePres.pdf ed., Fundamentals and Standards in Hardware Descrip- [20] Paul Taylor, Practical Foundations of Mathematics (sec- tion Languages, pp. 3–38, Kluwer Academic Publishers ond printing), No. 59 in Cambridge Studies in Advanced (1993) Mathematics, Cambridge University Press (2000); quoted [6] Raymond T. Boute, “Supertotal Function Definition in from the introduction to Chapter 1 in Mathematics and Software Engineering”, IEEE Transac- http://www.cs.man.ac.uk/˜pt tions on Software Engineering, Vol. 26, No. 7, pp. 662– /Practical Foundations/html/s10.html 672 (July 2000) [21] Jeannette M. Wing, “Weaving Formal Methods into the [7] Raymond Boute, Functional Mathematics: a Unifying Undergraduate Curriculum”, Proceedings of the 8th In- Declarative and Calculational Approach to Systems, Cir- ternational Conference on Algebraic Methodology and cuits and Programs — Part I: Basic Mathematics. Course Software Technology (AMAST) pp. 2–7 (May 2000); file text, Ghent University (2002) amast00.html in [8] Raymond T. Boute, “Concrete Generic Functionals: Prin- www-2.cs.cmu.edu/afs/cs.cmu.edu ciples, Design and Applications”, in: Jeremy Gibbons and /project/calder/www/
36 SYSTEMICS, CYBERNETICS AND INFORMATICS VOLUME 3 - NUMBER 4 ISSN: 1690-4524