Equations -- specifying constraints

Instructor's Guide


intro, types, algebra, modules, classes, summary, Q/A, literature
The specification of the signature of a type (which lists the syntactic constraints to which a specification must comply) is in general not sufficient to characterize the properties of the values of the type. In addition, we need to impose semantic constraints (in the form of equations) to define the meaning of the observer functions and (very importantly) to identify the elements of the type domain that are considered equivalent (based on the intuitions one has of that particular type).
  
  
slide: Equivalence

Mathematically, the equality predicate may be characterized by the properties listed above, including reflexivity (stating that an element is equal to itself), symmetry (stating that the orientation of the formula is not important) and transitivity (stating that if one element is equal to another and that element is equal to yet another, then the first element is also equal to the latter). In addition, we have the property that, given that two elements are equal, the results of the function applied to them (separately) are also equal. (Technically, the latter property makes a congruence of the equality relation, lifting equality between elements to the function level.) See slide 8-equivalence. Given a suitable set of equations, in addition to a signature, we may identify the elements that can be proved identical by applying the equality relation. In other words, given an equational theory (of which the properties stated above must be a part), we can divide the generator universe of a type T into one or more subsets, each consisting of elements that are equal according to our theory. The subsets of   
   , that is GU factored with respect to equivalence, may be regarded as the abstract elements constituting the type T, and from each subset we may choose a concrete element acting as a representative for the subset which is the equivalence class of the element. Operationally, equations may be regarded as rewrite rules (oriented from left to right), that allow us to transform a term in which a term   
   occurs as a subterm into a term in which   
   is replaced by t2 if t2. For this procedure to be terminating, some technical restrictions must be met, amounting (intuitively) to the requirement that the right-hand side must in some sense be simpler than the left-hand side. Also, when defining an observer function, we must specify for each possible generator case an appropriate rewriting rule. That is, each observer must be able to give a result for each generator. The example of the natural numbers, given below, will make this clear. Identifying spurious elements by rewriting a term into a canonical form is somewhat more complex, as we will see for the example of sets.

Equational theories

To illustrate the notions introduced above, we will look at specifications of some familiar types, namely the natural numbers and sets. In slide 8-Nat, an algebraic specification is given of the natural numbers (as first axiomatized by Peano).

Natural numbers

Nat


  functions
  0 : Nat
  S : Nat -> Nat
  mul : Nat * Nat -> Nat
  plus : Nat * Nat -> Nat
  axioms
  [1] plus(x,0) = x
  [2] plus(x,Sy) = S(plus(x,y))
  [3] mul(x,0) = 0
  [4] mul(x,Sy) = plus(mul(x,y),x)
  end
  

slide: The ADT Nat

In addition to the constant 0 and successor function S we also introduce a function mul for multiplication and a function plus for addition. (The notation Sy stands for application by juxtaposition; its meaning is simply S(y).) The reader who does not immediately accept the specification in slide 8-Nat as an adequate axiomatization of the natural numbers must try to unravel the computation depicted in slide 8-symbolic.
  mul(plus(S 0,S 0),S 0) -[2]-> 
  mul(S(plus(S 0,0)), S 0) -[1]-> 
  mul(SS 0,S 0) -[4]->
  plus(mul(SS0,0),SS0) -[3]->
  plus(0,SS0) -[2*]-> SS0
  

slide: Symbolic evaluation

Admittedly, not an easy way to compute with natural numbers, but fortunately term rewriting may, to a large extent, be automated (and actual calculations may be mimicked by semantics preserving primitives). Using the equational theory expressing the properties of natural numbers, we may eliminate the occurrences of the functions mul and plus to arrive (through symbolic evaluation) at something of the form Sn 0 (where n corresponds to the magnitude of the natural number denoted by the term). The opportunity of symbolic evaluation by term rewriting is exactly what has made the algebraic approach so popular for the specification of software, since it allows (under some restrictions) for executable specifications. Since they do not reappear in what may be considered the normal forms of terms denoting the naturals (that are obtained by applying the evaluations induced by the equality theory), the functions plus and mul may be regarded as secondary producers. They are not part of the generator basis of the type Nat. Since we may consider mul and plus as secondary producers at best, we can easily see that when we define mul and plus for the case 0 and Sx for arbitrary x, that we have covered all possible (generator) cases. Technically, this allows us to prove properties of these functions by using structural induction on the possible generator cases. The proof obligation (in the case of the naturals) then is to prove that the property holds for the function applied to 0 and assuming that the property holds for applying the function to x, it also holds for Sx. As our next example, consider the algebraic specification of the type Sn 0 in slide 8-Set.

Sets

Set


  • GSetA = {∅, add}

  • GUSetA = {0, add(0,a), …, add(add(0,a),a), …}

Axioms

  • GSetA = {∅, add}

  • GUSetA = {0, add(0,a), …, add(add(0,a),a), …}


slide: The ADT Set

In the case of sets we have the problem that we do not start with a one-to-one generator base as we had with the natural numbers. Instead, we have a many-to-one generator base, so we need equality axioms to eliminate spurious elements from the (generator) universe of sets.
  
  • {∅}

  • {add(0,a), add(add(0,a),a), …}

  • {add(add(0,a),b), add(add(0,b),a), \ifsli..…}


slide: Equivalence classes for Set

The equivalence classes of GUSet A / ∼  (which is GUSet A / ∼  factored by the equivalence relation), each have multiple elements (except the class representing the empty set). To select an appropriate representative from each of these classes (representing the abstract elements of the type SetA) we need an ordering on terms, so that we can take the smaller term as its canonical representation. See slide 8-set-equi.