The Schema Calculus

1. The Schema Calculus

2. Schemas • A notation specifying both system states and operations • One way: S = [ declarations | predicate ] • Means: The state components in the declaration satisfy the predicate • Another way to write a schema: S declarations predicate

3. Combining schemas • Inclusion (like Library inside Borrow): merge the declarations, conjunction of the predicates • S  T : symmetric version of inclusion • S  T : merge declarations,  between predicates •  S : like S, but negating the predicate • S[ new/old] substitution; S with new in place of old

4. Hiding • S \ { v1, …, vn} : hiding variables; remove v1, …,vn from S’s declaration, and instead add  v1, …, vn before S’s predicate • Now just says “there are values” that satisfy the predicate ┌─── Sample ─────────────── x, y, z :  ├─────────────────────────── x < y  y < z └─────────────────────────── ┌─── Sample \ {y} ─────────────── x, z :  ├───────────────────────────  y: . x < y  y < z └───────────────────────────

5. pre S—a derived schema • pre S is the precondition for applying S • Defined as S \ {all variables with ! or  } • Hide everything from the result or output • for Borrow? ┌─── Borrow ─────────────── Library Library’ c?: Copy r?: Reader ├─────────────────────────── c?  shelved r?  readers #(issued  { r? }) < limit issued’ = issued  { c?  r? } readers’ = readers └───────────────────────────

6. A (standard) trick • Can get rid of the  by substituting an expression equal to the hidden variable: x:S  ((x = T)  P)  ( T  S )  P[T/x] Doing this for the example, and simplifying, gives: ┌───pre Borrow ─────────────── Library c?: Copy r?: Reader ├─────────────────────────── c?  shelved r?  readers #(issued  { r? }) < limit └───────────────────────────

7. Schema Composition AB • Idea: connect the result of A with the initial state of B, and hide them both • AB is (A[new/x]  B[new/x]) \ {new} if they each declare x and x • Then F  T is ┌─── T─────────────── s, s , o! :  ├──────────────────── s = 2 s  o! = s └─────────────────── ┌─── F ─────────────── s, s , i? :  ├─────────────────── s = i? + s └─────────────────── ┌────────────────── s, s , i?, o! :  ├───────────────────  new:  . new = i? + s  s = 2 new  o! = s └───────────────────

8. Modularity: an example • A symbol table; ST : STR  VAL Init = [st: ST | st  = {} ] ┌─── Enter ─────────────── st, st  : ST s? : STR ; v? : VAL ├─────────────────── st = st  { (s?, v?) } └─────────────────── ┌─── Lookup ─────────────── st, st  : ST s? : STR ; v! : VAL ├─────────────────── s?  dom st v! = st s? st = st └───────────────────

9. What if s? is “illegal”? ┌─── BadLookup ─────────────── st : ST s? : STR ; rep! : STR  STR ├─────────────────── s?  dom st rep! = (“string not in table: ”, s?) └─────────────────── A more robust Lookup operation is then: Rlookup = Lookup  BadLookup Then could also have: ┌─── Log ─────────────── s? : STR ; rep! : STR  STR ├─────────────────── rep! = (“a successful lookup: ”, s?) └─────────────────── And define: AugLookup = (Lookup  Log)  BadLookup