NATO ASI Series Advanced Science Institutes Series A series presenting the results of activities sponsored by the NATO Science Committee, which aims at the dissemination of advanced scientific and technological knowledge, with a view to strengthening links between scientific communities. The Series is published by an international board of publishers in conjunction with the NATO Scientific Affairs Division. A Life Sciences Plenum Publishing Corporation B Physics London and New York C Mathematical and Physical Sciences Kluwer Academic Publishers D Behavioural and Social Sciences Dordrecht, Boston and London E Applied Sciences F Computer and Systems Sciences Springer-Verlag G Ecological Sciences Berlin Heidelberg New York Barcelona H Cell Biology Budapest Hong Kong London Milan I Global Environmental Change Paris Santa Clara Singapore Tokyo Partnership Sub-Series 1. Disarmament Technologies Kluwer Academic Publishers 2. Environment Springer-Verlag / Kluwer Academic Publishers 3. High Technology Kluwer Academic Publishers 4. Science and Technology Policy Kluwer Academic Publishers 5. Computer Networking Kluwer Academic Publishers The Partnership Sub-Series incorporates activities undertaken in collaboration with NATO's Cooperation Partners, the countries of the CIS and Central and Eastern Europe, in Priority Areas of concern to those countries. NATO-PCO Database The electronic index to the NATO ASI Series provides full bibliographical references (with keywords and/or abstracts) to about 50 000 contributions from international scientists published in all sections of the NATO ASI Series. Access to the NATO-PCO Database compiled by the NATO Publication Coordination Office is possible in two ways: - via online FILE 128 (NATO-PCO DATABASE) hosted by ESRIN, Via Galileo Galilei, 1-00044 Frascati, Italy. - via CD-ROM "NATO Science & Technology Disk" with user-friendly retrieval software in English, French and German (© WTV GmbH and DATA WARE Technologies Inc. 1992). The CD-ROM can be ordered through any member of the Board of Publishers or through NATO-PCO, B-3090 Overijse, Belgium. Series F: Computer and Systems Sciences, Vol. 158 Springer Berlin Heidelberg New York Barcelona Budapest Hong Kong London Milan Paris Santa Clara Singapore Tokyo Mathematical Methods in Program Development Edited by Manfred Broy Birgit Schieder Institut fur Informatik Technische Universitat Munchen D-80290 Munchen, Germany Springer Published in cooperation with NATO Scientific Affairs Division Proceedings of the NATO Advanced Study Institute on Mathematical Methods in Program Development, held in Marktoberdorf, Germany, July 30 - August 11, 1996 Library of Congress Cataloging-In-Publication Data Mathematical methods in program development/ edited by Manfred Broy. Birgit Schieder. p. cm. -- (NATO ASI series. Series F. Computer and systems sciences; vol. 158) "Proceedings of the NATO Advances Study Institute on MathelUtical Methods in Program Development. held in Marktoberdorf. Germany. July 3D-August 11. 1996"--T.p. verso. Includes bibliographical references. ISBN-13: 978-3-642-645884 e-ISBN-13: 978-3-642-60858-2 D01:1 0.1 007/978-3-642-60858-2 1. Electronic digital computers--Programming. 2. Computer software--Development--Mathematical methods. I. Broy. M. • 1949- II. Schieder. Birgit. III. NATO Advances Study Institute on Mathematical Methods in Program Development (1996 : Marktoberdorf. Germany) IV. Series. OA76.6.M3648 1997 005.1'01'51--dc21 97-22450 CIP CR Subject Classification (1991): D.2.1, D.2.2, D.2.4, F.3.1,F.4.1, 1.2.2 ISBN-13: 978-3-642-64588-4 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. © Springer-Verlag Berlin Heidelberg 1997 Softcover reprint of the hardcover 1st edition 1997 Typesetting: Camera-ready by editor Printed on acid-free paper SPIN: 10552724 45/3142 - 5 43210 Preface Program development is one of the most fascinating challenges of modern technology. Still, the field is in an immature state. Only step by step is the scientific foundation being discovered and understood in more detail. The Summer School on Mathematical Methods in Program Development was held in Marktoberdorf from July 30 to August 11, 1996. More than 100 people, counting participants, lecturers, and staff, attended. The Summer School centred around the techniques of the mathemat ics of program development, including programming paradigms treated by Kathleen Fisher, John C. Mitchell, and Gert Smolka, with their contri butions on new programming paradigms, such as object-oriented program ming and higher-order concurrent constraint programming. An excellent sur vey over the history of programming languages, including many interesting side-remarks explaining why the history went the way it did, is found in F.L. Bauer's contribution on the genesis of algorithmic languages. Trying to abstract away all the superficial differences in programming style are the contributions by C.A.R. Hoare on unified theories of programming and by Manfred Broy with respect to mathematical models used in early phases of program development. The contributions by J .-R. Abrial and L. Mussat and by B. von K;yger concentrated on case studies, demonstrating the development of protocols by applying well-founded mathematical techniques in the development process. The rest of the contributions are devoted to the aspect of proving programs correct. This includes questions of proof and program design and calcula tionallogic, as in the contributions by Edsger W. Dijkstra, by W.H.J. Feijen and A.J .M. van Gasteren, and by David Gries. Finally the use of machine based verification assistance is explained by Larry Paulson with the system Isabelle and by N. Shankar introducing PVS. The Summer School treated the topics in a very comprehensive, but nevertheless harmonious way. It turned out to be quite a surprise how closely all the aspects that were treated are related and how well the lectures fitted together. With people from more than 20 countries all over the world together discussing, learning, and further developing this exciting topic of the math ematics of program development, the Summer School was a unique event both from a professional and from a social point of view. It is my privi lege to thank all those people who helped to make the Summer School a big success. These are the participants, the lecturers, our hosts in Marktober dorf, the people helping in the staff, and especially Dr. Ralf Steinbriiggen VI and Frau Ingrid Luhn, who took care perfectly of all the many questions of organization. Finally, I thank Dr. Hans W6ssner from Springer-Verlag, who again was a very pleasant partner to work with when preparing these lecture notes. Munich, April 1997 Manfred Broy Table of Contents D. Gries Eliminating the Chaff-Again: Banquet Speech at Marktoberdorf 1996 1 C.A.R. Hoare Envoi at Marktoberdorf 1996 9 o. Part Designing Proofs and Programs 11 E. W. Dijkstm Heuristics for a Very Simple Euclidean Proof (EWD1180) 13 Complete DAGs (EWD1204) ......................................... 17 A Result of Rabbit Removal (EWD1208) ............................. 19 For the Record: Painting the Squared Plane (EWD1212) ........... . 25 The Marriage Agency (EWD1214) .................................. . 27 Courtesy Dr. Birgit Schieder (EWD1215) ............................ 29 WLOG, or the Misery of the Unordered Pair (EWD1223) ............ 33 My Simplest Theorem (EWD1232) ................................... 35 The Transitive Closure of a Wellfounded Relation (EWD1241) ........ 37 The Formula for sin.(a + (3) (EWD1244a) ............................ 41 A Kind of Converse of Leibniz's Principle (EWD1245) 43 The Strengths of the Academic Enterprise (EWD1175) 45 W.H.J. Feijen, A.J.M. van Gaster-en On a Method for the Formal Design of Multiprograms 53 D. Gries Foundations for Calculational Logic 83 \/111 Part 1. Examples of Protocol Design ........................... 127 J.-R. Abrial, L. Mussat Specification and Design of a Transmission Protocol by Successive Refinements Using B ................................... 129 B. von Karger Formal Derivation of a Protocol in CSP 201 Part 2. Languages and Models for Program Design 213 F.L. Bauer Genesis of Algorithmic Languages .................................... 215 M. Bray Mathematical Methods in System and Software Engineering .......... 271 C.A.R. Hoare Unified Theories of Programming 313 Part 3. Programming Paradigms ............................... 369 K. Fisher, J. C. Mitchell On the Relationship Between Classes, Objects and Data Abstraction ................................................ 371 G. Smolka The Oz Programming Model 409 A Foundation for Higher-order Concurrent Constraint Programming ................................. 433 Part 4. Mechanical Proof Assistance 459 L.C. Paulson Tool Support for Logics of Programs ................................. 461 N. Shankar Machine-Assisted Verification Using Theorem Proving and Model Checking ................................................. 499 Eliminating the Chaff -Again Banquet Speech at Marktoberdorf 1996 David Gries Computer Science, Cornell University Ithaca, New York, 14853 USA I was asked to speak at this banquet at a rather late date. In order to make preparation easy, I did what any self-respecting software engineer does: reuse an already-produced component -with changes to fit the new context. At Marktoberdorf 1978, the formal development of algorithms was a hot topic, discussed with religious fervor by those for and against. Yesterday, traces of that fervor cropped up in the discussion of operational reasoning versus formal proof development. At Marktoberdorf 1978, I delivered a sermon on the new religion of formal algorithm development, called "Eliminating the Chaff". This sermon is the component that I will reuse. "Chaff", by the way, is what you get when you thresh wheat to get the kernels -the chaff is the garbage that is thrown away. Within this sermon, various authors are appropriated quoted (or misquoted, as the case may be). From time to time, I will give an aside (footnote) to give you historical information that you, at your age, may not know and to let you know when to laugh. The reading for the day The reading for this m3o'r. ning's sermon is taken from Knuth's first epistlel to the Structurians (page 6, pars. 2 and This part of the epistle concerns Knuth's attempt to develop an algorithm discussed in the first book of the old testament2 and the problems he faced: Whenever I'm trying to write a program without goto statements, I waste an inordinate amount of time deciding what type of iterative clause to use (while or repeat, etc.) ... I know in my head what I want to do, but I have to trans'late it painstakingly into a notation that often isn't well-suited to the mental concept [I wrote the program while] ... I was in bed with a pad of paper, ... , at about one AM; I expect I finished 15 or 20 minutes later. About 2 minutes were wasted trying to think of a suitable iteration statement. Here endeth the reading for the day. 'Knuth, D.E. A review of Structured Programming. STAN-CS-73-371, Computer Science Department, Startford University, June 1973. 2Dahl, 0.-1., E.W. Dijkstra, and C.A.R. Hoare. Structu.red Programming. Academic Press, 1972. M. Broy et al. (eds.), Mathematical Methods in Program Development © Springer-Verlag Berlin Heidelberg 1997 2 The technical lesson Keeping in mind the reading for the day, let us develop a divine little binary search algorithm in the calculational way and see what we can learn from it. We ardently seek an algorithm that, given x and an array segment b[O .. n - 1] that satisfies Q, stores in variable i to truthify R: Q: b[O] :::; x < b[n -1] A 2:::; n R: 0 :::; i < n - 1 A b[i]:::; x < b[i + 1] We note with satisfaction that for the segment b shown below, the divine little algorithm will store in i the rightmost position of x -or if x is not in the array segment, the position after which x belongs. o 1 2 3 4 5 6 bl244477 8 1 We reject with horror specifications that call for x to be found or that fail if x is not in the array. Such heathenistic suggestions, usually proposed by operational people who hide their shame in unreadable handwriting, must be suppressed! Nay, eradicated! Even if the ink is not tasteful! We now seek simple ways to truthify R -or parts of it. We note that i:= 0 truthifies all except the conjunct x < b[i + 1]. Hence, using a method passed down to us by one of our leaders, we create a fresh variable j and weaken R to get a possible loop invariant P: P : 0 :::; i < n - 1 A j < n A b[i]:::; x < bfj] which is truthified by .i, j := 0, n - 1. In short order, we: '* (a) Calculate the loop condition B using the fact that it must satisfy P A..,B R. (b) Divine the bound function j - i - 1 , using the fact that i starts out small, j starts out large, and termination occurs when j = i + 1 . (c) Strengthen the loop invariant to include i < j. (d) Develop the loop body -in the calculational way- to decrease the bound function and maintain invariant P, thus giving us the following algorithm: i,j:= O,n -1; {invariant P : 0 :::; i < j :::; n - 1 A b[i]:::; x < bfj]} {bound function: j - i-I} do i + 1 '" j -t var e := (i + j) ..;. 2; {i < e < j} if b[e] :::; x -t i := e o x < b[e] -t j := e fi od

Mathematical Methods in Program Development

Similar Mathematical Methods in Program Development