Kleene Algebra with Tests DEXTER KOZEN Cornell University Weintro duce Kleene algebra with tests an equational system for manipulating programs We give a purely equational pro of using Kleene algebra with tests and commutativity conditions of the following classical result every while program can b e simulated byawhile program with at most one while lo op The pro of illustrates the use of Kleene algebra with tests and commutativity conditions in program equivalence pro ofs Categories and Sub ject Descriptors D Software Engineering To ols and Techniques structuredprogramming D Software Engineering Program Vericationcorrectness proofs D Software Engineering Language Constructs and Featurescontrol structures F Logics and Meanings of Programs Sp ecifying and Verifying and Reasoning ab out Pro gramsassertions invariants logics of programs mechanical verication pre and postconditions specication techniques F Logics and Meanings of Programs Semantics of Program ming Languagesalgebraic approaches to semantics F Logics and Meanings of Pro grams Studies of Program Constructscontrol primitives I Algebraic Manipulation Expressions and Their Representationssimplication of expressions I Algebraic Manip ulation Languages and Systemsspecialpurpose algebraic systems I Algebraic Manip ulation Automatic Programmingprogram modication program synthesis program transfor mation program verication General Terms Design Languages TheoryVerication Additional Key Words and Phrases Dynamic logic Kleene algebra sp ecication INTRODUCTION Kleene algebras are algebraic structures with op erators and satisfying certain axioms They arise in various guises in manycontexts relational algebra Ng Tarski semantics and logics of programs Kozen Pratt automata and formal language theory Kuich Kuich and Salomaa and the design and analysis of algorithms Aho et al Iwano and Steiglitz Kozen Many authors havecontributed to the development of Kleene algebra Anderaa Archangelsky Backhouse Blo om and Esik Boa Cohen a Conway Gorshkov Kleene Kozen Authors address Computer Science Department Cornell University Ithaca NY email kozencscornelledu The supp ort of the National Science Foundation under grant CCR is gratefully acknowl edged Permission to make digitalhard copy of all or part of this material without fee is granted provided that the copies are not made or distributed for prot or commercial advantage the ACM copyrightserver notice the title of the publication and its date app ear and notice is given that copying is by p ermission of the Asso ciation for Computing MachineryIncACM Tocopy otherwise to republish to p ost on servers or to redistribute to lists requires prior sp ecic p ermission andor a fee c ACM Dexter Kozen Krob Kuich and Salomaa Pratt Redko Sakarovitch Salomaa In semantics and logics of programs Kleene algebra forms an essential comp onent of Prop ositional Dynamic Logic PDL Fischer and Ladner in whichitis mixed with Bo olean algebra and mo dal logic to give a theoretically app ealing and practical system for reasoning ab out computation at the prop ositional level Syntactically PDL is a twosorted logic consisting of programs and propositions dened bymutual induction A test can b e formed from any prop osition intuitively acts as a guard that succeeds with no side eects in states satisfying and fails or ab orts in states not satisfying Semantically programs are mo deled as binary relations on a set of states and isinterpreted as the subset of the identity relation consisting of all pairs s ssuchthat is true in state s From a practical p oint of view many simple program manipulations suchas lo op unwinding and basic safety analysis do not require the full p ower of PDL but can b e carried out in a purely equational subsystem using the axioms of Kleene algebra However tests are an essential ingredient since they are needed to mo del conventional programming constructs such as conditionals and while lo ops We dene in Section a variant of Kleene algebra called Kleene algebr a with testsfor reasoning equationally with these constructs Cohen has studied Kleene algebra in the presence of extra Bo olean and commu tativity conditions He has given several practical examples of the use of Kleene algebra in program verication such as lazy caching Cohen b and concur rency control Cohen c He has also shown that Kleene algebra with extra conditions of the form p remains decidable Cohen a It can b e shown us ing a result of Berstel see also Gibb ons and Rytter and Kozen that continuous Kleene algebra in the presence of extra commutativity conditions of the form pq qpeven for atomic p and q is undecidable In Section wegive a complete equational pro of of a classical folk theorem Harel Mirkowska which states that every while program can b e simulated by another while program with at most one while lo op The approachwetake is that of Mirkowska who gives a set of lo cal transformations that allowevery while program to b e transformed systematically to one with at most one while lo op For eachsuch transformation wegive a purely equational pro of of correctness This result illustrates the use of Kleene algebra with tests and commutativity conditions in program equivalence pro ofs In Section we observe that the universal Horn theory of the continuous Kleene algebras is not recursively enumerable therefore not nitely axiomatizable This follows from a construction of Berstel see also Gibb ons and Rytter and Lemma of Kozen This resolves an op en question of Kozen KLEENE ALGEBRA is an algebraic structure As dened in Kozen a Kleene algebra K satisfying b elow As usual we omit the op erator from expressions writing pq for p q The order of precedence of the op erators is thus p qr Kleene Algebra with Tests should b e parsed as p q r The unary op erator is dened by q qq p q r p q r p q q p p p p p p pqr pq r p p p p pq r pq pr p q r pr qr p p pp p p p p q pr r p q r q rp r qp r where refers to the natural partial order on K p q p q q Instead of and we might take the equivalent axioms pr r p r r rp r rp r Axioms say that the structure is an idemp otent semiring under and and the remaining axioms sayessentially that behaves like the Kleene star op erator of formal language theory or the reexive transitive closure op erator of relational algebra See Kozen for an intro duction A Kleene algebra is said to b e continuous if it satises the innitary condition n pq r suppq r n where q n n q qq and where the supremum is with resp ect to the natural order We can think of n as a conjunction of the innitely many axioms pq r pq r n and the innitary Horn formula n pq r s pq r s n Dexter Kozen In the presence of the other axioms the continuity condition implies and is strictly stronger in the sense that there exist Kleene algebras that are not continuous Kozen All true identities b etween regular expressions interpreted as regular sets of strings are derivable from the axioms of Kleene algebra Kozen In the au thors exp erience two of the most useful suchidentities for simplifying expressions are pqp pq p p qp p q whichwecallthesliding and the denesting rules resp ectively For example to derive the identityp q p q q wemight reason equationally as follows q p q p q by p p qp q by p q q by Kleene Algebra with Tests To accommo date tests weintro duce the following variant of Kleene algebra A Kleene algebra with tests is a twosorted algebra K B is a unary op erator dened only on B such that where B K and K is a Kleene algebra and B is a Bo olean algebra The elements of B are called tests We reserve the letters p q rstuv for arbitrary elements of K and a b c d e for tests In PDL a test would b e written b but since we are using dierent symb ols for tests we can omit the The sequential comp osition op erator acts as conjunction when applied to tests and the choice op erator acts as disjunction Intuitively a test bc succeeds i both b and c succeed and b c succeeds i either b or c succeeds It follows immediately from the denition that b for all b B It is tempting to dene tests in an arbitrary Kleene algebra to b e the set fp K j p g This is the approach taken by Cohen a This approach is more restrictive than ours and we feel that it is less desirable for two imp ortant reasons Although it makes sense in algebras of binary relations Ng Tarski it do es not work in all Kleene algebras For example consider the min Kleene algebra of the theory of algorithms see Kozen consisting of the set fx R j x g fg with op erations minx and for the Kleene algebra op erations and resp ectively In this algebra p for all p but the idemp otence law pp p fails so the set fp K j p g do es not form a Bo olean algebra In our approach every Kleene algebra extends Kleene Algebra with Tests trivially to a Kleene algebra with tests by taking the twoelementBoolean algebra f g Of course there are more interesting mo dels as well Even in algebras of binary relations it forces us to consider all elements p as tests including conditions that in practice would not normally b e considered testable For example there may b e programs p whose inputoutput relations have no side eects ie p but the asso ciated test succeeds i p halts which in general is undecidable Weintend tests to b e viewed as simple predicates that are easily recognizable as such