Maude: Rewriting Logic for Intensive Care Specialists

1. Maude:Rewriting Logic for Intensive Care Specialists Chris Wright Nov 2000

2. Liz Sonenberg David Kinny maude.csl.sri.com

3. Fmod A-GRAPH is sorts Edge Node . ops n1 n2 n3 n4 n5: -> Node . ops a b c d e f : -> Edge . ops source target : Edge -> Node . eq source(a) = n1 . eq target(a) = n2 . eq source(b) = n1 . eq target(b) = n3 . eq source(c) = n3 . eq target(c) = n4 . eq source(d) = n4 . eq target(d) = n2 . eq source(e) = n2 . eq target(e) = n5 . eq source(f) = n2 . eq target(f) = n1 . endfm c n3 n4 d b a e n1 n2 n5 f

4. Fmod PATH is protecting NAT . protecting A-GRAPH . sorts Path Path? . subsorts Edge < Path < Path? . op _;_ : Path? Path? -> Path? [assoc] . ops source target : Path -> Node . op length : Path -> Nat . var E : Edge . var P : Path . cmb (E ; P) : Path is target(E) == source(P). eq source(E ; P) = source(E) . eq target(P : E) = target(E) . eq length(E) = s(0) . eq length(E ; P) = s(0) + length(P) . endfm Maude> red length(b ; c ; d) . result NzNat s(s(s(0))) Maude> red length(a ; b ; c) . result Error(Nat): length(a ; b ; c)

5. Fmod PATH is endfm • introduces a functional module, which is required to be confluent (CR) and terminating; therefore a normal form exists protecting NAT . protecting A-GRAPH . protecting and importing provide modularization differing semantics (vi) sorts Path Path? . subsorts Edge < Path < Path? . • many sorted specification op _;_ : Path? Path? -> Path? [assoc] . ops source target : Path -> Node . op length : Path -> Nat . mixfix syntax operator declarations, with equational attributes

6. var E : Edge . var P : Path . variable declarations cmb (E ; P) : Path is target(E) == source(P). eq source(E ; P) = source(E) . eq target(P : E) = target(E) . eq length(E) = s(0) . eq length(E ; P) = s(0) + length(P) . equational specification note conditional membership axiom Maude functions as a read-eval-print interpreter, with no I/O facilities beyond this. C++ Compiled versions for most *nix Version 2 to have socket I/O

7. Maude supports equational and rewriting logic computations • Many sorted equational specification • many sorted signature (S, ) of sorts and operators • a set E of (conditional)  expressions • loose semantics of a many sorted specification (S, , E) is the set of algebras (S, ) that satisfy the (conditional) equations in E • often interested in the initial semantics given by a particular algebra

8. Two terms are identified iff they have meaning in all algebras in the loose semantics • Can also define this congruence proof theoretically by means of a deduction system for equational logic • Hierarchy of equational logics supported by Maude • many sorted equational logic • order sorted equational logic • membership equational logic

9. Modularization • a <protecting> importation does not change the initial algebra of the imported module (no junk, no confusion) • an <including> importation imposes no semantic restrictions Fmod BASIC-NAT is sort NAT . op 0 : -> Nat . op s : Nat -> Nat . op _+_ : Nat Nat -> Nat . vars N M : Nat . eq 0 + N = N . eq s(M) + N = s(M + N) endfm

10. fmod NAT+OPS is protecting BOOLEAN . protecting BASIC-NAT . op _*_ : Nat Nat -> Nat . op _-_ : Nat Nat -> Nat . op _<=_ : Nat Nat -> Bool . op _>_ : Nat Nat -> Bool. vars N M : Nat eq 0 * N = 0. eq s(M) * N = (M * N) + N . eq 0 – N = 0 . eq s(M) – 0 = s(M) . eq s(M) – s(N) = M – N . eq 0 <= N = true . eq s(M) <= 0 = false . eq s(M) <= s(N) = M < N . eq M > N = not (M <= N) . endfm fmod NAT3 is including BASIC-NAT . var N : Nat . eq s(s(s(N))) = N . endfm

11. Overloading • sub-sort and ad-hoc overloading • require that the co-arities are pairwise if the arities are (so no overloading of constants) • but allow qualification of operators to relax this restriction: • allow 0 to be ad-hoc overloaded and disambiguate • 0 + 0 • with • 0 + (0).Nat or 0 + (0).Nat3 or • (0 + 0).Nat

12. fmod NUMBERS is • sorts Nat NzNat Nat3 . • subsort NzNat < Nat . • op zero : -> Nat . • op s_ : Nat -> NzNat . • op p_ : NzNat -> Nat . • op _+_ : Nat Nat -> Nat . • op _+_ : NzNat NzNat -> NzNat . • ops 0 1 2 : -> Nat3 . • op _+_ : Nat3 Nat3 -> Nat3 [comm] . • vars N M : Nat . • var N3 : Nat3 . • eq p s N = N . • eq N + zero = N . • eq N + s M = s (N + M) . • eq (N3 + 0) = N3 . • eq 1 + 1 = 2 . • eq 1 + 2 = 0 . • eq 2 + 2 = 1 . • endfm

13. Equational attributes • a binary operator can be made to satisfy equational attributes: • f(x, f(y, z)) = f(f(x, y), z) • f(x, y) = f(y, x) • f(e, x) = x • f(x, e) = x • f(e, x) = x, f(x, e) = x • [assoc] • [comm] • [left id] • [right id] • [id]] • Divide the equational theory of a functional module into a disjoint union (E U A) • And form the quotient with A then E.

14. Asso ciativity • Consider a fragment from a list module: • op nil : -> List . • op _ _ : List List -> List [assoc] . • op _ _ : NeList NeList -> NeList [assoc] . • var N : Nat . • var L : List . • var L' : NeList . • eq reverse(nil) = nil . • eq reverse(N) = N . • eq reverse(N L') = reverse(L') N . • The associative attribute allows • 1 2 3 4 • to be unambiguous.

15. Asso ciativity + Identity • Consider a fragment from another list module: • op nil : -> List . • op _ _ : List List -> List [assoc id: nil] . • op _ _ : NeList NeList -> NeList [assoc id: nil] . • var N : Nat . • var L : List . • var L' : NeList . • eq reverse(nil) = nil . • eq reverse(N L') = reverse(L') N . • Note the identity attribute; the singleton case • reverse(N) • is a particular case of (N L) by instantiating L with the constant nil and apply the identity equation

16. Similarly, associativity, commutativity and identity provide multiset rewriting • And the addition of an idempotence equation provides a framework for rewriting of sets.

17. Parameterization: • Allows arbitary elements satisfying some requirements to acts a parameters for functional modules • The requirements are expressed by theories and then views are used to instantiate parameterized modules. • Parameterized modules, theories and views belong to an extension of Maude called Full Maude. • Full Maude defns must be surrounded by parentheses (which requirement will be dropped)

18. (fth TRIV is • sort Elt . • endfth) A functional theory is a MEL specification with loose semantics. The equations are not used for rewriting or simplification, so do not need to be CR, terminating or satisfy requirements about new variables on the RHS • (fth TOSET is • protecting BOOL . • sort Elt . • op _<_ : Elt Elt : Elt . • vars E1 E2 E3 : Elt . • eq E1 < E1 = false . • ceq E1 < E3 = true if E1 < E2 and E2 < E3 . • ceq E1 < E2 or E2 < E1 = true if E1 =/= E2 . • endfth)

19. (fmod LIST[X :: TRIV] is • ... • ... • endfm) Denotes that X is the formal parameter and must be instantiated with modules that satisfy the requirements of theory TRIV. This instantiation is done with views • (view NAT from TRIV to NAT is • sort Elt to Nat . • endv) Then LIST[Nat] denotes the instantiation of the parameterized modules LIST[X :: TRIV] by Nat

20. Rewriting logic: • view the specification as a rewriting logic specification • and allow the rewriting to over congruence classes modulo some structural axioms. • rewriting logic is intrinsically reflective • Allow reasoning about concurrent change in system states • Remove the equational interpretation and replace it with a rewriting (ie directional) interpretation

21. Rewriting logic • System modules in Maude are rewrite theories • Require of system modules that: • The equations are divided into structural axioms A and a set of equations E that are CR and terminating modulo A (ie a functional module) • The rules in R must be coherent with the equations E modulo A.

22. mod A-TRANSITION-SYSTEM is sort State . ops n1 n2 n3 n4 n5 : -> State rl [a] : n1 => n2 . rl [b] : n1 => n3 . rl [c] : n3 => n4 . rl [d] : n4 => n2 . rl [e] : n2 => n5 . rl [f] : n2 => n1 . endm Maude> rew [10] n3 . result State: n5 Note that the specification is not confluent and not terminating. Due to non-termination, the interpreter admits an upper bound on rewrites.

23. (omod ACCOUNT is protecting MACHINE-INT . protecting QID . subsort Qid < Oid . class Account | bal : MachineInt . msgs credit debit : Oid MachineInt -> Msg . vars A B : Oid . vars M N N' : MachineInt . rl [credit] : credit(A, M) <A : Account | bal : N> => <A : Account | bal : N + M > . crl [debit] : debit(A, M) <A : Account | bal : N> => <A : Account | bal : N – M > if N >= M . endom)

24. And the rest • Reflection and metaprogramming • Maude in Maude • Maude and • lambda calculus • constraint programming • "Real time" extensions providing LTL formulae and model checking in Maude