2 Property (2) For any commands c 1 ;c

2C 0and states

s;t

, 9(

u

:State):I

c

(

c

1 )(

s;u

)^I

c

(

c

2 )(

u;t

) I

c

(

c

1 ;

c

2 )(

s;t

)

Proof. By induction on

c

1followed by induction on

c

2. The cases when either

c

1or

c

2is a conditional

or a labelled command are straightforward from the inductive hypothesis. Assume

c

1 and

c

2 are

assignment commands:

c

1is :=(

al;l

1 )and

c

2 is := (

bl;l

2 ). IfI

c

(

c

1

)(

s;u

)then, by definition ofI

c

u

=update((pc

;l

1

)

al;s

). Similarly, ifI

c

(

c

2

)(

u;t

)then

t

=update((pc

;l

2

)

bl;u

). The correctness

of the assignment list of

c

1 ;

c

2 is straightforward from assumptions I

c

(

c

1 )(

s;u

) and I

c

(

c

2 )(

u;t

), from

u

=update((pc

;l

1

)

al;s

), the definition of correct? and from Theorem (4.1). The definition of I

c

(

c

1 ;

c

2

)(

s;t

)requires that

t

is update((pc

;l

2 )

/

((pc

;l

1

cl

)

;s

)), where

cl

is((pc

;l

1 )

al

)(

bl /

(pc

;l

1

)

al

). Note that from Theorem (3.1), update((pc

;l

2 )

bl;

update((pc

;l

1 )

al;s

))is equivalent to update((pc

;l

1 )

al

((pc

;l

2 )

bl

)

/

(pc

;l

1

)

al;s

). That this is equivalent to

t

is straightforward

by extensionality. 2

For any commands

c

1 2C

0

;c

2

2Cand states

s;t

, if

c

1begins in state

s

and ends in state

t

and

c

2

is not enabled in

t

then

c

1 ;

c

2begins in state

s

and ends in state

t

.

Theorem 6.2 Property (2) For any commands

c

1

;c

2

2C

0, label

l

2Labels and states

s;t

2State, I

c

(

c

1 )(

s;t

) pc6

t

l

I

c

(

c

1 ;(

l

:

c

2 ))(

s;t

)=I

c

(

c

1 )(

s;t

)

Proof. By induction on

c

1, the cases when

c

1 is a labelled or a conditional command are straight-

forward from the inductive hypothesis. Assume

c

1 is the assignment command

:= (

al;l

1 ). By Definition (6.3),

c

1 ;(

l

:

c

2

) is a conditional command with the test equal(

l

1

;l

) and false branch

c

1. From the assumption,

I

c

(

c

1

)(

s;t

), state

t

is update((pc

;l

1

)

al;s

). It follows that pc 6

t

l

is

pc

/

((pc

;l

1

)

al

) 6

s

l /

(pc

;l

1

)

al

. Substituting for pc, and for the constant

l

, this is

l

1

6

s

l

.

It follows that the testI

b

(equal(

l

1

;l

))(

s

) is false and therefore I

c

(

c

1 ;

l

:

c

2 )(

s;t

) is equivalent to I

c

(

c

1 )(

s;t

). 2

Let

c

be the result of the composition of any two commands

c

1

;c

2 2C

0. The interpretation of

c

in states

s

and

t

implies that either there is an intermediate state in which

c

1terminates and

c

2 begins

6.2 Properties of Sequential Composition 31

Theorem 6.3 For commands

c

1

;c

2

2C 0,

l

1

;l

2

2Labels and states

s;t

, I

c

(

l

1 :

c

1 ;

l

2 :

c

2 )(

s;t

) (9(

u

:State):I

c

(

l

1 :

c

1 )(

s;u

)^I

c

(

l

2 :

c

2 )(

u;t

))_(I

c

(

c

1 )(

s;t

)^pc6

t

l

2 )

Proof. By induction on

c

1followed by induction on

c

2. The cases when either is a labelled or a con-

ditional command are straightforward from the induction hypothesis. Let

c

1 be the assignment com-

mand:=(

al;l

3 )and

c

2the command :=(

bl;l

4 ). Assume

l

1

s

l

2and let

u

=update((pc

;l

3 )

al;s

).

It follows, from the assumption, that(pc

;l

3

)

al

is correct in

s

, since it is contained in the assign-

ment list of

c

1 ;

c

2. That I

c

(

c

1

)(

s;u

)is true follows from the definition of I

c

. Since the assignment

list of

c

1 ;

c

2 also contains (pc

;l

4 )

bl /

(pc

;l

3

)

al

and is correct in

s

, the list (pc

;l

4

)

bl

must be

also correct in update((pc

;l

3

)

al;s

)(Theorem 4.1). From Theorem (3.1), state

t

is update((pc

;l

3 )

al

)((pc

;l

4 )

bl/

(pc

;l

3

)

al

)

;s

)which is equivalent to update((pc

;l

4

)

bl;

update((pc

;l

3

)

al

)

;s

))

(Theorem 3.1 and Lemma lem:3.4). The interpretationI(

l

2

:

c

2

)(

u;t

)is therefore true, completing

the proof for this case. Assume that

l

1 6

s

l

2. By definition,

l

1 :

c

1 ;

l

2 :

c

2is a conditional command

with test equal(

l

3

;l

2

)and false branch

c

1. As in Theorem (6.2), it follows that I

c

(

c

1

)(

s;t

)must be

true, completing the proof. 2

Theorems (6.1) to (6.3) describe the behaviour of composition when both commands are executed and terminate. Composition also preserves the failures of the commands: if the composition of com- mands

c

1and

c

2 halts then so does either

c

1 or

c

2. Conversely, if either command

c

1 or

c

2halts then

so does

c

1 ;

c

2.

Theorem 6.4 For command

c

1

;c

2

2Cand states

s;t;u

2State,

1. If

c

1 ;

c

2halts in a state

s

then

c

1 either halts in

s

or produces a state

u

in which

c

2halts.

halt?(

c

1 ;

c

2 )(

s

) halt?(

c

1 )(

s

)_(9

u

:I

c

(

c

1 )(

s;u

)^halt?(

c

2 )(

u

))

2. If

c

1halts in

s

then so does

c

1 ;

c

2 halt?(

c

1 )(

s

) halt?(

c

1 ;

c

2 )(

s

)

3. If

c

1beginning in state

s

ends in a state

u

and

c

2 halts in

u

then

c

1 ;

c

2halts in

s

. I

c

(

c

1 )(

s;u

) halt?(

c

2 )(

u

) halt?(

c

1 ;

c

2 )(

s

) Proof.

1. Assume there is a state

u

such I

c

(

c

1

)(

s;u

) and a state

t

such that I

c

(

c

2

)(

u;t

). From Theo-

rem (6.1), it follows thatI

c

(

c

1

;

c

2

)(

s;t

)contradicting the assumption, halt?(

c

1

;

c

2

)that there is

no state such thatI

c

(

c

1

;

c

2

)(

s;t

).

2. Assume there is a state

t

such thatI(

c

1

;

c

2

)(

s;t

)(and therefore:halt?(

c

1

;

c

2

)(

s

)). From Theo-

rem (6.3), there is a state

u

such thatI

c

(

c

1

)(

s;u

). This is a contradiction since the assumption,

halt?(

c

1

6.3 Applying Sequential Composition 32

3. From the assumption, halt?(

c

2

)(

u

), command

c

2is enabled in

u

and therefore pc

u

label(

c

2

).

Assume that there is a state

t

such that I(

c

1

;

c

2

)(

s;t

). From Theorem (6.3), and from pc

u

label(

c

2

), there is a state

u

0

2State such thatI

c

(

c

1 )(

s;u

0 )andI

c

(

c

2 )(

u

0

;t

). The commands are

deterministic (Lemma 4.1) therefore

u

0

=

u

andI

c

(

c

2

)(

u;t

). This contradicts the assumption

halt?(

c

2

)(

u

).

2

Theorems (6.4) and (6.4), together with the earlier theorems, show that if the composition

c

1 ;

c

2

establishes a property then so will the commands

c

1and

c

2, executed in sequence. If the composition

c

1

;

c

2cannot be executed or cannot establish the property, neither can the two commands considered

individually. The advantage of sequential composition is that it is simpler to show that

c

1 ;

c

2 estab-

lishes a property than to verify

c

1 and

c

2 individually. Any property of the two commands, executed

in sequence, can be established directly from the command

c

1 ;

c

2.

A property of sequential composition in a flow-graph language is that it is not associative. The label of a command determines whether the command is enabled in a state. The composition of command

l

1 :

c

1 with

c

2, (

l

1 :

c

1 );

c

2 has label

l

1. The composition of any command

c

with (

l

1 :

c

1 );

c

2,

c

;((

l

1 :

c

1 );

c

2 ), will select((

l

1 :

c

1 );

c

2 )iff

c

selects

l

1 :

c

1 and will behave as

c

otherwise.

Even if

c

selects

c

2,

c

2 will not be executed since it can only follow

l

1 :

c

1.

Example 6.1 Let

l

1

;l

2

;l

3

;l

4

2 Labels be distinct. The command goto

l

2 ;(

l

1 :goto

l

3 ;

l

2 : goto

l

4 )

is equivalent to goto

l

2. However, the command

(goto

l

2 ;

l

1 : goto

l

3 ;)

l

2 : goto

l

4 is equivalent to goto

l

2 ;

l

2 :goto

l

4. 2

6.3

Applying Sequential Composition

The commands which result from sequential composition can be complex. To ensure that composition has Property (2), an assignment command

c

1 composed with labelled command

l

:

c

2 results in a

conditional command in which both

c

1and

c

1 ;

c

2occur. However, the result of sequential composition

can, in some circumstances, be simplified using the properties of the expressions and commands. To replace a command

c

of a program with a simplified command

c

0

, command

c

must be equiv- alent to

c

0

in all states,I

c

(

c

)(

s;t

)=I

c

(

c

0

)(

s;t

)(Lemma 5.1). This is possible by the replacement of

expressions in the command with strongly equivalent expressions. The conditions for strong equiv- alence of expressions can often be established from the syntax of the commands and, in these cases, the simplification of a command can be carried out mechanically. For example, assume

l

1

=

l

: in the conditional command if(

l

1 =

o

l

)then

c

1 ;

c

2else

c

1, the expression (

l

1

=

o

l

)can be replaced with

true. From the semantics of the conditional command, the result is a command equivalent to(

c

1 ;

c

2 ).

This method is similar to the techniques used for symbolic execution (King, 1971).

Example 6.2 Assume name

x

2Names, values

v

1

;v

2

2Values, labels

l;l

1

2Labels and expressions

e

1

;e

2

2E. Let

a

2Fn be defined such that for all

v

2Values and

s

2State,

a

(

v

)is distinct from

x

in

s

. Also assume for

v

1

;v

2

2Values that

a

(

v

1 )

s

a

(

v

2 )iff

v

1 =

v

2.

The assignment command:=((

x;e

1 )

/

(

a

(

e

2 )

;v

2 )

;l

)is equivalent to:=(

x;e

1

/

(

a

(

e

2 )

;v

2 )

;l

). The assignment command:=((

x;v

1 )

/

(

a

(

e

2 )

;v

2 )

;l

)is equivalent to:=((

x;v

1 )

;l

).

6.4 Abstraction of Programs 33

The expression ref(

a

(

x

))

/

(

a

(

v

2

)

;v

1

)is equivalent to ref(

v

1

)when

x

has the value

v

2. The conditional command: if(

x

=

o

v

2 )then(ref(

a

(

x

))

/

(

a

(

v

2 )

;v

1 ):=

e

1

;l

) else(ref(

a

(

x

))

/

(

a

(

v

2 )

;v

1 ):=

e

2

;l

)

is equivalent to the command: if(

x

=

o

v

2 )then(ref(

v

1 ):=

e

1

;l

) else(ref(

a

(

x

)

/

(

a

(

v

2 )

;v

1 ):=

e

2

;l

) 2

6.4

Abstraction of Programs

The method for abstracting from programs is to choose two commands

c

1

;c

2 of a program

p

and

form the subsetf

c

1

;c

2

gof

p

. Sequential composition is applied to the two commands to obtain the

singleton setf(

c

1

;

c

2

)g. This is combined with the original program

p

, removing command

c

1 from

p

, to obtain the abstraction

p

]f(

c

1 ;

c

2

)gv

p

. This can be repeated any number of times, allowing a

sequence of commands to combined by sequential composition.

This method of abstraction is based on two properties of composition and refinement: the first that the singleton setf(

c

1 ;

c

2

)gis an abstraction of the setf

c

1

;c

2

g.

Theorem 6.5 Composition forms an abstraction

In document Verification and abstraction of flow graph programs with pointers and computed jumps (Page 31-34)