Algebra unifies calculi of programming

1. Algebra unifies calculi of programming Tony Hoare Feb 2012

2. With Ideas from • Ian Wehrman • John Wickerson • Stephan van Staden • Peter O’Hearn • Bernhard Moeller • Georg Struth • Rasmus Petersen • …and others

3. and Calculi from • Robin Milner • EdsgerDijkstra • Ralph Back • Carroll Morgan • Gilles Kahn, • Gordon Plotkin • Cliff Jones • Tony Hoare

4. but in this talk, only four • Robin Milner x • EdsgerDijkstrax • Ralph Back • Carroll Morgan x • Gilles Kahn, • Gordon Plotkin • Cliff Jones • Tony Hoare x

5. Subject matter: specs • variables (p, q, r) stand for computer programs, designs, contracts, specifications,… • they all describe what happens inside/around a computer that executes a given program. • The program itself is the most precise description • giving all the excruciating detail. • The user specification is the most abstract • describing only interactions with environment. • Designs come in between.

6. Example specs • Postcondition: • execution ends with array A sorted • Conditional correctness: • if execution ends, it ends with A sorted • Precondition: • execution starts with x even • Program: x := x+1 • the final value of x is one greater than the initial

7. More examples of specs • Safety: • There are no buffer overflows • Termination: • execution is finite (ie., always ends) • Liveness: • no infinite internal activity (livelock) • Fairness: • no infinite waiting • Probability: • the ration of a’s to b’s tends to 1 with time

8. Also • Security • low programs do not access high variables • Separation • threads do not assign to shared variables • Communication • outputs on channel c are in alphabetical order • Predictability • there are no race conditions • timing • interval between request and response is short

9. Advantages of unification • Same laws for programs, designs, specs • Same laws for many forms of correctness • Tools based on the laws serve many purposes • and communicate by sound interfaces • Scientific controversy is resolved • and engineers confidently apply the science

10. Operators on specs • or \/ disjunction • and /\ conjunction • then ; sequential composition • while * concurrent composition Constants • skip I terminates immediately • true ⊤ does anything • false ⊥ never starts

11. The language model • a language is a set of strings of characters • /\ is set intersection • \/ is set union • ; is pointwise concatenation of strings • * is pointwise interleaving of strings • I is the language with only the empty string • ⊤ is set of all strings • ⊥ is the empty set.

12. Laws \/ /\ ; * assoc yes yes yes yes comm yes yes no yes  yes yes no no unit T zero T

13. Distribution axioms • ; distributes through \/ • (p*q) ; (p’ * q’) => (p;p’)*(q;q’) • where p => q =def q = p \/ q (refinement) • in the language model • there are less interleavings on the left of => • remember the exchange law in categories?

14. Theorems • => is a partial order • All the operators are monotonic • (p*q);q’ => p*(q;q’) • Proof: substitute  for p’ in exchange • (p/\q);(p’/\q’) => (p;p’)/\(q;q’) • Proof: lhs => p;p’ by monotonicity of ; lhs => q;q’ similarly. The result follows from Boolean algebra.

15. Hoare triple: {p} q {r} • defined as p;q=> r • starting in the final state of any execution of p, q ends in the final state of some execution of r • (p and r may be arbitrary specs). • example: {..x+1 ≤ n} x:= x + 1 {..x ≤ n} • where ..b (finally b) describes all executions that end in a state satisfying a single-state predicate b .

16. Milner triple: r - p -> q • defined as p;q=> r (same as Hoare!) • r may be executed by first executing p and then executing q . • p is usually restricted to atomic actions. • example: (<a>;q) – <a> -> q where <a> is an atomic action • r -> p = def. p => r • an execution step may reduce non-determinism

17. Theorems • Using these definitions, the rules of the Hoare calculus and of the Milner calculus are derivable by simple algebraic proofs from the laws of the algebra.

18. Rule of consequence • p => p’ {p’} q {r’} r’ => r {p} q {r} • r -> r’ r’ –q-> p’ p’ -> p r –q-> p • Proof: ; is monotonic, => is transitive. • These two rules are not only similar, they are the same!

19. Sequential composition {p} q {s} {s} q’ {r} {p} q;q’ {r} r –q-> s s –q’-> p r –q;q’-> p • Proof: associativity of ;

20. Small-step rule p –<a>-> r (r;q’) –<a>->(q;q’) {p} q {r} . {p} q;q’ {r;q’} Proof: monotonicity of ;

21. Choice • {p} q {r} {p} q’ {r} {p} (q \/ q’) {r} • both choices must be correct • r –q-> p (r \/ r’) –q-> p • so the execution may make either choice

22. Frame Law • {p} q {r} {p*f} q {r*f} • adapts a rule to a wider environment f • r –q-> p (r*f) –q-> (p*f) • a step that is possible for a single thread is still possible in a wider environment f

23. Concurrency (and Conjunction) • {p} q {r} {p’} q’ {r’} {p*p’} (q * q’) {r*r’} • permits modular proof of concurrent programs. • {p} q {r} {p’} q’ {r’} {p/\p’} (q /\ q’) {r/\r’} • in Floyd’s rule of conjunction, q = q’.

24. Concurrency r –p-> q r’ -p’-> q’ (r*r) -(p*p’)-> (q*q’) • provided p*p’ = τ • where τ is the unobserved transition, (which occurs (in CCS) when p and p’ are an input and an output on the same channel).

25. Dijkstra triple: p => q\r • usually written: p => wlp(q,r) ‘defined’ by: p;q => r (again) wp(q,r) =wlp(q, r/\ terminates) q\r specifies the weakest program which can be executed before q to achieve the overall effect of r .

26. Morgan triple: q => r/p • ‘defined’ by: p;q => r (again) • r/p is the weakest program which can be executed after p to achieve r.

27. Theorems • q\(r /\ r’) = (q\r) /\ (q\r’) • (r /\ r’)/p = (r/p) /\ (r’/p) • (q \/ q’)\r = (q\r) /\ (q’\r) • r/(p \/ p’) = (r/p) /\ (r/p’)

28. Theorems • (q;q’)\r = q\(q’\r) • r/(p;p’) = (r/p)/p’ • (q\r)*(q’\r’) => (q*q’)\(r*r’) exchange law

29. Unification is the goal of every branch of pure science, because it increases conviction in theory Specialisation is needed for each application, e.g., Hoare logic: proofs of correctness, Milner: implementation, Dijkstra: program analysis, Morgan: programs from specifications …

30. Algebra • is modular, incremental, comprehensible, abstract and beautiful. • An algebraic law can say as little as you like • using any other concepts that you need. • new properties can be added by new laws. • The definition of a concept is allowed only once • so it must describe all the needed properties, • using only previously defined concepts. • Inductive clauses restrict incrementality • Algebra is good for unification

31. Summary: p;q=> r is written by Hoare (triple) Wirth (triple) Milner (transition) Dijkstra (weakest precondition) Morgan (specification statement) p {q} r {p} q {r} r –p-> q p => wlp(q,r) q => [p, r] Milner restricts p to atomic actions (small-step version). The others restrict p and r to descriptions of single states.

32. Conclusions • All the calculi are derived from the same algebra of programming. • The algebra is simpler than each of the calculi, • and stronger than all of them combined.

33. Isaac Newton Communication with Richard Gregory (1694) “Our specious algebra [of fluxions] is fit enough to find out, but entirely unfit to consign to writing and commit to posterity.”