4.4 Stateless Refinement
4.4.2 Laws for Strong Stateless Refinement
The precongruence of strong stateless refinement entails that the (in)equations it induces may be used in any context, hence can be considered as refinement laws. In this section we present a number of the basic refinement laws. These laws give insight into the algebraic properties of refinement. Furthermore, the laws give rise to an algebraic style of reasoning about schedules.
First, we prove Lemma 4.4.9 which is used in the proofs of the subsequent lemmas. It states that if two terms are related by structural congruence, then their behaviour is strong stateless equivalent.
Lemma 4.4.9 Let s, t∈S. If s≡t then s≃t. Proof By definition s≃t iff s6t and t6s.
• s≡t ⇒ s6t:
transition Ifhs, Mi λ
−→ hs′, M′ithen, by (N8) and s ≡t followsht, Mi λ
−→ hs′, M′i.
By reflexivity of 6 holds s′ 6s′.
termination
Ifs ≡skip , then by transitivity of≡ follows t≡skip .
• s≡t ⇒ t6s: The proof is analogous to the previous case.
Next, we present the laws grouped per operator. The schedules in these laws range over S.
Laws for Rule Conditional Composition
The first law can be used to move a single rule-conditional out of a parallel composition such that it is scheduled for execution first. The second law is a special case of the first. The fact that sequential composition enforces a more determined ordering on the execution of schedules than parallel composition, has as a consequence that the law for “;” is a congruence, while the case for “k” is a refinement.
Lemma 4.4.10
1. r → (s1kt)[s2kt]6(r → s1[s2])kt
2. r → (s1;t)[s2;t]≃(r → s1[s2]);t
Proof
1. transition: There are two possible transitions:
• Ifhr → (s1kt)[s2kt], Mi σ −→ hs1kt, M′i then, by (N1),h(r → s1[s2])kt, Mi σ −→ hs1kt, M′i. By reflexivity,s1kt6s1kt. • Ifhr → (s1kt)[s2kt], Mi ε −→ hs2kt, Mi then, by (N0),h(r → s1[s2])kt, Mi ε −→ hs2kt, Mi. By reflexivity,s2kt6s2kt.
termination: There are no s1, s2, t1 and t2 such that r → (s1kt)[s2kt]≡skip ,
hence this case holds vacuously. 2. We prove the following cases.
• (r →s1[s2]);t6r → (s1;t)[s2;t]:
transition: There are two possible transitions: – h(r → s1[s2]);t, Mi
ε
−→ hs2;t, Mi, which is derived by (N0) from
hr →s1[s2], Mi ε −→ hs2, Mi. Then by (N0) we derive hr →(s1;t)[s2;t], Mi ε −→ hs2;t, Mi. By reflexivity,s2;t6s2;t. – h(r → s1[s2]);t, Mi σ
−→ hs1;t, M′i, which is derived by (N1) from
hr →s1[s2], Mi σ −→ hs1, M′i. Then by (N1) we derive hr →(s1;t)[s2;t], Mi σ −→ hs1;t, M′i. By reflexivity, s1;t6s1;t.
termination: There are no s1, s2 and t such that r → s1[s2];t≡skip , hence
• r → (s1;t)[s2;t]6(r → s1[s2]);t: The proof is analogous to the previous case.
Laws for Sequential Composition
The laws from Lemma 4.4.11 show that “;” is a monoid with unit skip. Lemma 4.4.11
1. skip;s≃s
2. s;skip≃s
3. s1; (s2;s3)≃(s1;s2);s3
Proof
Cases 1 and 3 follow from structural congruence and Lemma 4.4.9. We consider case 2. We have to prove s;skip6sand s6s;skip. We give the details for the former; the proof of the latter is analogous.
Let R={(s;skip, s)|s∈S}. We show thatR is a strong stateless simulation. transition
If s6≡skip, then a transition for s;skip can be derived by (N5) from hs, Mi λ
−→ hs′, M′i. By definition of R: (s′;skip, s′)∈ R.
termination
s;skip≡skip only ifs≡skip .
Laws for Parallel Composition
The laws for parallel composition follow from structural congruence and Lemma 4.4.9. They show that “k” is a commutative monoid with unit skip.
Lemma 4.4.12 1. skipks≃s
2. s1ks2 ≃s2ks1
Proof By structural congruence and Lemma 4.4.9.
Distributivity Laws for Parallel and Sequential Composition
The next Lemma yields a general law for the distribution of sequential and parallel composition.
Lemma 4.4.13 (s1ks3); (s2ks4)6(s1;s2)k(s3;s4)
Proof
Let R = {((s1ks3); (s2ks4),(s1;s2)k(s3;s4)) | s1, s2, s3, s4 ∈ S} ∪IdS. We show that
R is a strong stateless simulation. By Proposition 4.4.2(1) follows that IdS is a strong stateless simulation. We consider the remaining case.
transition
We consider the possible transitions.
• By rule (N5) a transition can be derived from hs1ks3, Mi
λ
−→ hs′
1ks′3, M′i.
This may in turn be derived in one of the following ways. 1. By (N2) from hs1, Mi λ −→ hs′1, M′i, hence s′3 ≡s3. By (N5) we get hs1;s2, Mi λ −→ hs′1;s2, M′i. By (N2) we infer h(s1;s2)k(s3;s4), Mi λ −→ h(s′ 1;s2)k(s3;s4), M′i. And ((s′ 1ks3); (s2ks4),(s1′;s2)k(s3;s4))∈ R. 2. By (N2) from hs3, Mi λ −→ hs′ 3, M′i, hence s′1 ≡s1.
The proof is analogous to the previous case. 3. By (N3) from hs1, Mi λ −→ hs′ 1, M′i and hs3, Mi ε −→ hs′ 3, Mi.
By (N5) we get for the former hs1;s2, Mi
λ
−→ hs′
1;s2, M′i,
and for the latter hs3;s4, Mi
ε −→ hs′ 3;s4, Mi. Then by (N3) we obtain h(s1;s2)k(s3;s4), Mi λ −→ h(s′ 1;s2)k(s3′;s4), M′i. Clearly ((s′1ks′3); (s2ks4),(s′1;s2)k(s′3;s4))∈ R. 4. By (N3) from hs1, Mi ε −→ hs′ 1, Mi and hs3, Mi λ −→ hs′ 3, M′i.
The proof is analogous to the previous case. 5. By (N4) from hs1, Mi
σ1
−→ hs′1, M1i and hs3, Mi
σ2
−→ hs′3, M2i such that M |=
σ1⋊⋉σ2. The proof is analogous to the previous case where use of (N3) should
• By (N8) and (E1) from (s1ks3)≡skip (hence s1 ≡ skip and s3 ≡ skip), and
hs2ks4, Mi
λ
−→ hs′, M′i. From (skip;s
2)k(skip;s4) ≡ s2ks4 we get by (N8) and
(E1) that h(skip;s2)k(skip;s4), Mi
λ
−→ hs′, M′i. Clearly (s′, s′)∈Id
S ⊆ R.
termination
If (s1ks3); (s2ks4)≡skip then si≡skip for all i: 1≤i≤4.
Then also (s1;s2)k(s3;s4)≡skip .
The refinement of Lemma 4.4.13 is represented graphically in Figure 4.4 in confor- mance with the conventions of Figure 4.1 with the exception that here an arrow may denote a sequence of transitions.
refines
Figure 4.4: Refinement of Lemma 4.4.13
The schedule on the right hand side of Lemma 4.4.13 consists of two “threads” s1;s2
and s3;s4 that can proceed independently of each other. For example, the thread s1;s2
may terminate while the other thread is still executing s3. In the schedule on the left
hand side, the semi-colon forces the two threads to synchronize after termination of s1
and s3; i.e. before starting execution of eithers2 or s4.
Corollary 4.4.14 shows some special cases of Lemma 4.4.13. Especially the first of these will turn out to be very useful.
Corollary 4.4.14 1. s1;s26s1ks2
3. (s1ks3);s26(s1;s2)ks3
Proof Take one or two terms of Lemma 4.4.13 equal to skip. Eliminate skip-terms
using Lemma 4.4.11.
Laws for Conditional Composition
In Lemma 4.4.15 we present some basic and distributive laws for the conditional combi- nators. Lemma 4.4.15 1. false ⊲ s[t]≃t 2. true ⊲ s[t]≃s 3. c ⊲ skip≃skip 4. c ⊲ (s1ks2)[t1kt2]≃(c ⊲ s1[t1])k(c ⊲ s2[t2]) 5. c ⊲ (s1;s2)[t1;t2]≃(c ⊲ s1[t1]); (c ⊲ s2[t2]) 6. !(c ⊲ s[t])≃c ⊲(!s)[!t]
Proof By propositional calculus and structural congruence.
The next laws may be used to eliminate or combine conditionals. Lemma 4.4.16
1. c ⊲ s[t]≃c ⊲ s[¬c ⊲ t] 2. c ⊲ s[t]≃(c ⊲ s)k(¬c ⊲ t)
3. c ⊲ (r → s[t])≃c ⊲ (r → c ⊲ s[t]) 4. (c1∧c2) ⊲ s[t]≃c1 ⊲ (c2 ⊲ s[t])[t]
Proof By propositional calculus and structural congruence.
Next, we investigate how the conditional c ⊲ ..[..] can be combined with the rule conditional r →..[..]. Lemma 4.4.17 describes a refinement which is based on the idea
that the conditionc can be used to test whether or not a rewrite rule rcan be executed successfully We use fail to denote a rewrite rule that never succeeds (can only make
ε-transitions). We can think of it as being defined as fail=b x → m ⇐ false. For any rule
r holds fail∢r, hence fail is a lower bound for the set of multiset rewrite rules ordered by the strengthening relation ∢.
In the following laws, we use c⇒ ¬b to mean: for all valuations v, c[x :=
v] ⇒ ¬b[x:=v].
Lemma 4.4.17 Letr =x7→m ⇐ b. Ifc ⇒ ¬b, thenc ⊲ (fail;s2)[t]≃c ⊲ (r → s1[s2])[t].
Proof Consider the following cases
• c= false: then by structural congruence and Lemma 4.4.9 c ⊲ (fail;s2)[t]≃t and
c ⊲ (r → s1[s2])[t]≃t. By reflexivity t≃t.
• c=true: then by structural congruence and Lemma 4.4.9 c ⊲ (fail;s2)[t]≃fail;s2
and c ⊲ (r → s1[s2])[t]≃r →s1[s2].
Forfail;s2, we infer by (N0) and (N5),hfail;s2, Mi
ε −→ hs2, Mi. From c⇒ ¬b follows by (N0), hr → s1[s2], Mi ε −→ hs2, Mi. By reflexivity s2≃s2.
Corollary 4.4.18 fail;t≃fail → s[t]
Proof Follows as a special case from Lemma 4.4.17 by taking c=true. Execution of fail never changes the input-output behaviour of a schedule (or pro- gram). Hence it can always be omitted. This could be formally justified if skip6fail would be a strong stateless refinement. However, this is not the case because the left hand side and the right hand side make a different number of transitions. Weak statebased refinement does not distinguish between differing numbers of ε-transition. In Section 4.4.3 we will develop the weak variant of stateless refinement and present the laws that it induces (which resolve the above issue).
Laws for Replication
In this section we will uncover the algebraic properties that characterize replication. The first two laws follow straightforwardly from the operational semantics.
Lemma 4.4.19 s6!s. Proof transition: Supposehs, Mi λ −→ hs′, M′i. Then by (N6) we infer h!s, Mi λ −→ hs′, M′i. By reflexivity of 6 follows s′6s′.
termination: By (E8), s≡skip implies !s≡skip .
Lemma 4.4.20 sk!s6!s Proof transition: Supposehsk!s, Mi λ −→ hs′, M′i. Then by (N7) we inferh!s, Mi λ −→ hs′, M′i. By reflexivity of 6 follows s′6s′.
termination: sk!s≡skip only if s≡skip , then by (E8) !s≡skip . Recall that sk stands for k ≥ 0 copies of schedule s composed in parallel. Using
the above we formally justify, by Corollary 4.4.21, the intuition that “!s” stands for an arbitrary number of copies of “s” composed in parallel.
Corollary 4.4.21 For all k ≥1 :sk6!s
Proof By induction on k. • k = 1: By Lemma 4.4.19 followss6!s. • k >1: sk ≃ definition sk sksk−1 6 induction hypothesis sk!s 6 Lemma 4.4.20 !s An important property of replication is its idempotence. As a stepping stone to the general result, we first prove the following simpler case.
Proof
Let R = {(tk(!sk!s), tk!s) | s, t ∈ S} ∪IdS. We prove that R is a strong stateless simulation by induction on the depth of the inference. We will use the following property of R
If (s1, s2)∈ R and t∈S, then (tks1, tks2)∈ R (∗)
From Proposition 4.4.2.1 follows that IdS is a strong stateless simulation. We consider the remaining case.
transition A transition for tk(!sk!s) can be derived in the following ways 1. From (N2) by ht, Mi λ
−→ ht′, M′i. Then by (N2) also htk!s, Mi λ
−→ ht′k!s, M′i. Clearly (t′k(!sk!s), t′k!s)∈ R.
2. From (N2) by h!sk!s, Mi λ
−→ hs′, M′i. This transition can in turn be derived in five ways. Two of these are symmetric, hence we only need to consider three.
(a) By (N2) from h!s, Mi λ
−→ hs′′, M′i. This can be derived in two ways.
i. By (N6) from hs, Mi λ −→ hs′′, M′i, hence s′ = s′′k!s. Then, by (N2), we derive hsk!s, Mi−→ hλ s′′k!s, M′i. By (N7) we infer h!s, Mi−→ hλ s′′k!s, M′i. Hence by (N2) htk!s, Mi λ −→ htks′′k!s, M′i. Clearly (tks′′k!s, tks′′k!s)∈Id S⊆ R. ii. By (N7) from hsk!s, Mi λ −→ hs′′, M′i, hence s′ = s′′k!s. By (N2) we infer hsk!sk!s, Mi λ
−→ hs′′k!s, M′i. The derivation for this transition is
shorter than the derivation of the transition we want to prove the proposi- tion for, hence by the induction hypothesis we gethsk!s, Mi−→ hλ s′′′, M′i
such that (s′′k!s, s′′′) ∈ R. By (N7) also h!s, Mi λ
−→ hs′′′, M′i. By (N2)
htk!s, Mi−→ hλ tks′′′, M′i. From (s′′k!s, s′′′) ∈ R follows by (*) that
(tks′′k!s, tks′′′)∈ R.
(b) By (N3) from h!s, Mi−→ hλ s′′, M′i and h!s, Mi ε
−→ hs′′′, Mi. The proof pro-
ceeds, analogously to the previous case, by induction on the depth of the inference (where (N3) is used in place of (N2)).
(c) By (N4) fromh!s, Mi σ1
−→ hs1, M1i, andh!s, Mi
σ2
−→ hs2, M2iwhereM |=σ1⋊⋉σ2.
3. By (N3) from ht, Mi−→ hλ t′, M′iand h!sk!s, Mi ε
−→ hs′, Mi.
The proof is analogous to the case 2.
4. By (N3) from ht, Mi−→ hε t′, Mi and h!sk!s, Mi λ
−→ hs′, M′i.
The proof is analogous to the case 2. 5. By (N4) from ht, Mi σ1 −→ ht′, M 1i and h!sk!s, Mi σ2 −→ hs′, M 2i
such that M |=σ1⋊⋉σ2. The proof is analogous to the case 2.
termination
tk!sk!s≡skip only ift≡skip and !s≡skip , hencetk!s≡skip .
Corollary 4.4.23 1. ∀k :k ≥1 : (!s)k6!s 2. ∀k :k ≥1 :skk!s6!s Proof 1. By induction on k. • k= 1: By reflexivity of 6 follows !s6!s. • k >1: (!s)k ≃ definition tk !sk(!s)k−1 6 induction hypothesis !sk!s 6 Lemma 4.4.22 !s
2. Assume k ≥1. We calculate as follows.
skk!s 6 Lemma 4.4.19 (!s)kk!s ≃ definition of sk+1 (!s)k+1 6 case 1 !s
Finally we prove that replication is idempotent.
Lemma 4.4.24 !(!s)6!s
Proof
LetR={(tk!(!s), tk!s)|s, t ∈S}∪IdS. We show thatRis a strong stateless simulation up-to 6. We will use the following property ofR:
If (s1, s2)∈ 6R6 and t∈S, then (tks1, tks2)∈ 6R6 (*)
From Proposition 4.4.2.1 follows that IdS is a strong stateless simulation. By reflexiv- ity of 6 follows that IdS is a strong stateless simulation up-to 6. We consider the remaining case.
transition
We proceed by induction on the depth of the derivation of htk!(!s), Mi λ
−→ ht′ks′, M′i. This transition can be derived in the following ways.
1. By (N2) from ht, Mi λ
−→ ht′, M′i. Then by (N2)htk!s, Mi λ
−→ ht′k!s, M′i. Clearly (t′k!(!s), t′k!s)∈ 6R6 .
2. By (N2) from h!(!s), Mi−→ hλ s′, M′i. This transition can be derived in two ways:
(a) By (N6) from h!s, Mi λ
−→ hs′, M′i. Then by (N2) htk!s, Mi λ
−→ htks′, M′i. And (t′ks′, t′ks′)∈IdS⊆ 6R6 .
(b) By (N7) from h!sk!(!s), Mi λ
−→ hs′, M′i. By the induction hypothesis follows
h!sk!s, Mi λ
−→ hs′′, M′i such that (s′, s′′) ∈ 6R6. From Corollary 4.4.22 follows h!s, Mi λ
−→ hs′′′, M′i such that s′′6s′′′. By transitivity of 6 follows
that (s′, s′′′) ∈ 6R6 . By (N2) follows htk!s, Mi λ
−→ htks′′′, M′i. From
(s′, s′′′)∈ 6R6 and (*) follows (tks′, tks′′′)∈ 6R6 .
3. By (N3) from ht, Mi λ
−→ ht′, M′i and h!(!s), Mi ε
−→ hs′, Mi. For the latter tran- sition follows, analogous to case 2, that h!s, Mi ε
−→ hs′′, Mi such that (s′, s′′) ∈
6R6 . From (N3) then follows htk!s, Mi λ
−→ ht′ks′′, M′i and by (*) we con-
clude (t′ks′, t′ks′′)∈ 6R6 .
4. By (N3) from ht, Mi ε
−→ ht′, Mi and h!(!s), Mi λ
−→ hs′, M′i.
5. By (N4) from ht, Mi σ1 −→ ht′, M 1i and h!(!s), Mi σ2 −→ hs′, M 2i where M |= σ1⋊⋉σ2.
The proof is analogous to the case 3. termination
tk!(!s) ≡ skip only if t ≡ skip and !(!s) ≡ skip. From the latter follows by (E8) that
!s≡skip , hence tk!s≡skip.
Lemma 4.4.25 !(!s)≃!s
Proof
• !s6!(!s): follows from Lemma 4.4.19.
• !(!s)6!s: follows from Lemma 4.4.24.
The next lemma proves a refinement concerning distributivity of replication over parallel composition.
Lemma 4.4.26 !(s1ks2)6(!s1)k(!s2)
Proof Let R = {(tk!(s1ks2), tk(!s1)k(!s2)) | t, s1, s2 ∈ S} ∪ IdS. We show that
R is a strong stateless simulation up-to 6. We will use that R satisfies the following property
If (s1, s2)∈ 6R6 and t∈S, then (tks1, tks2)∈ 6R6 (*)
From Proposition 4.4.2.1 follows that IdS is a strong stateless simulation. By reflexiv- ity of 6 follows that IdS is a strong stateless simulation up-to 6. We consider the remaining case.
transition
By induction on the depth of the inference. 1. By (N2) fromht, Mi λ −→ ht′, M′i. Then by (N2)htk!s1k!s2, Mi λ −→ ht′k!s1k!s2, M′i. Clearly (t′k!(s1ks2), t′k(!s1)k(!s2)∈ 6R6 . 2. By (N2) fromh!(s1ks2), Mi λ
−→ hs′, M′i. This transition can be derived in 2 ways. (a) by (N6) from hs1ks2, Mi
λ
−→ hs′, M′i. Transitions for s
1ks2 can be derived
i. By (N2) from hs1, Mi λ −→ hs′ 1, M′i hence h!(s1ks2), Mi λ −→ hs′ 1ks2, M′i.
By (N6) we infer from the former h!s1, Mi
λ −→ hs′ 1, M′i. By (N2) we obtain htk!s1k!s2, Mi λ −→ htks′ 1k!s2, M′i. Because s26!s2 and (tks′ 1ks2, tks′1ks2)∈ R we have (tks1′ ks2, tks′1k!s2)∈ 6R6 .
ii. By (N3) from transitions hs1, Mi
λ −→ hs′ 1, M′i and hs2, Mi ε −→ hs′ 2, Mi, henceh!(s1ks2), Mi λ −→ hs′1ks′2, M′i. By (N6) we inferh!s1, Mi λ −→ hs′1, M′i and h!s2, Mi ε −→ hs′2, Mi. By (N3) we get h!s1k!s2, Mi λ −→ hs′1ks′2, M′i. By (N2) we obtain htk!s1k!s2, Mi λ −→ htks′ 1ks′2, M′i. By reflexivity of 6 and IdS⊆ R follows (tks′