Relations between Abstract Datatypes modeled as Abstract Datatypes

Hubert Baumeister

Dissertation zur Erlangung des Grades

Doktor der Ingenieurwissenschaften (Dr.-Ing.)

der Technischen Fakultät der Universität des Saarlandes

Saarbrücken

Dekan:  Prof. Dr. Wolfgang Paul
Gutachter:  Prof. Dr. Harald Ganzinger

Prof. Dr.-Ing. Jacques Loeckx

Termin des Kolloquiums: 21. Mai 1999

Meinen Eltern, für alles

Abstract

In this thesis we define a framework for the specification of dynamic behavior of software systems. This framework is motivated by the state as algebra approach and the modeloriented language Z. From the state as algebra approach we use the idea of modeling the environment and the state components as structures of an institution. However, in contrast to the state as algebra approach, states in our framework are modeled by structures from any suitable institution not only those having algebras as their structures. From Z we use the idea that environment, state spaces, and relations between state spaces are specified using the same logic, and how more complex relations can be constructed from simpler ones by means of the schema calculus. However, we differ from Z in that our framework can be instantiated by different institutions while the approach of Z can only work because of the particular logical system used by Z.

Zusammenfassung

In dieser Arbeit schlagen wir einen Ansatz zur Spezifikation des Verhaltens von Softwaresystemen vor. Dieser Ansatz ist motiviert durch Spezifikationssprachen, die den Zustand von Softwaresystemen als Algebren modellieren, und durch die modellorientierte Spezifikationssprache Z. Von der ersten Gruppe von Spezifikationssprachen übernehmen wird das Konzept den Zustand als Struktur einer Logik zu modellieren; allerdings ist unser Ansatz nicht auf Logiken beschränkt, deren Strukturen Algebren sind. Von Z übernehmen wir die Idee Zustandsräume und Zustandsübergänge mit derselben Logik zu spezifizieren, und die Art und Weise wie aus einfachen Zustandsräumen und Zustandsübergängen komplexere Zustandsräume und Zustandsübergänge konstruiert werden können. Im Gegensatz zu Z können wir eine beliebige Logik verwenden, während der Ansatz von Z nur funktioniert weil eine ganz spezielle Logik verwendet wird.

Extended Abstract

In this thesis we study relations between abstract datatypes. Relations between abstract datatypes can be used to specify the dynamic behavior of software systems. An abstract datatype, a pair consisting of a signature and a class of structures over that signature, defines the state-space of a software system, and relations between abstract datatypes define how the state of a software system changes.

Our approach is connected to the state as algebra approach, where the state of a software system is modeled by an algebra, for example, [33, 4, 22, 29, 59, 20, 16, 23]. However, in a similar way as Goguen and Burstall [13] used the notion of institution to define the semantics of the specification language Clear independent from a particular logical system, we use institutions to study relations between abstract datatypes from an arbitrary institution, not only those consisting of a many-sorted signature Σ and a class of Σ-algebras as in the stateas-algebra approach. For example, we define the institution SET that models the logical system of the model-oriented specification language Z [56], which is based on set-theory. But not only institutions for existing logical systems may be used, one is free to define ones own institution whose structures model in a more appropriate way the states of the class of software systems one is dealing with.

Our approach is also similar to the way the dynamic behavior of software systems is specified in Z. However, Z’s method depends on the particular logical systems used by Z. In this thesis we show a way to uncouple Z’s method from the underlying logical system. This yields a specification method which is in many aspects similar to Z’s method, but can be used with any suitable logical system, including the logical systems used for the state as algebra approach, as well as the logical system used by Z.

The method we use in this thesis is to model relations between abstract datatypes again as abstract datatypes. To this end we define the institution R_{I} which is based on a suitable institution I. Then relations between abstract datatypes from I are modeled by abstract datatypes from R_{I}. This has the advantage that a lot of results from the institution independent theory of abstract datatypes can be reused for the specification of relations. For example, we use the operations defined by Sannella and Tarlecki [50] as the basis for the specification language RSL_{I} used to specify relations. We show also how to reuse the proof calculus for proving properties of abstract datatypes and entailment of abstract datatypes, for example, from Wirising [61], to prove properties of relations and entailment of relations.

The results of this thesis can be used in two ways to specify the dynamic behavior of software systems. First, RSL_{I} can be used as the basis for a more practical specification language. However, new tools have to be designed and implemented for that language. Another way is to use the translation G^{A} of abstract datatypes in R_{I}, that is relations, to abstract datatypes \underline{viii}

in I, which has the property that it preserves entailment. Then one can reuse any specification language having as semantics abstract datatypes in I together with its tools to specify relations. This yields a specification style similar to that used by Z.

Ausführliche Zusammenfassung

Das Ziel dieser Arbeit ist das Studium von Relationen zwischen abstrakten Datentypen. Relationen zwischen abstrakten Datentypen werden verwendet um das dynamische Verhalten von Softwaresystemen zu spezifizieren. Dabei definieren abstrakte Datentypen, die aus einer Signatur und einer Klassen von Strukturen über diese Signatur bestehen, Zustandsräume von Softwaresystemen und Relationen zwischen abstrakten Datentypen deren Zustandsübergänge.

Unser Ansatz ist vergleichbar mit den Spezifikationssprachen, die den Zustand eines Softwaresystems als Algebra modellieren, zum Beispiel [33, 4, 22, 29, 59, 20, 16, 23]. Wir verallgemeinern den Ansatz dieser Spezifikationssprachen und erlauben es den Zustand eines Softwaresystems als eine Struktur bzgl. einer beliebigen Institution I zu modellieren. Zum Beispiel kann man die, in dieser Arbeit definierte, Institution SET verwenden, die die Logik der modellorientierten Spezifikationssprache Z [56] repräsentiert und auf Mengentheorie basiert. Es ist aber auch möglich eigene Institutionen zu definieren, deren Strukturen die Zustände von Klassen von Softwaresystemen besser modellieren als die Strukturen von Institutionen, die eine existierende Logik repräsentieren.

Aus einer ähnlichen Motivation heraus haben Goguen und Burstall [13] den Begriff der Institution entwickelt um die Semantik der Spezifikationssprache Clear unabhängig von einer speziellen Logik zu formulieren.

Unser Ansatz ist ähnlich der Methode, die in Z verwendet wird um das Verhalten dynamischer Systeme zu spezifizieren. Allerdings hängt die Methode von Z von der speziellen Logik ab die Z verwendet. Ein Resultat dieser Arbeit ist die Trennung dieser Methode von der Logik, die Z verwendet. Das Ergebnis ist eine Spezifikationsmethode, die in vielen Aspekten der von Z entspricht, aber nicht von der Logik von Z abhängt. So ist es zum Beispiel möglich Varianten von Gleichungslogik zu verwenden, aber auch wieder die Logik von Z.

In unserem Ansatz modellieren wir Relation zwischen abstrakten Datentypen wieder als abstrakte Datentypen. Zu diesem Zweck definieren wir eine Institution R_{I} basierend auf einer geeigneten Institution I, deren abstrakte Datentypen Relationen zwischen abstrakten Datentypen von I repräsentieren. Dieses Vorgehen hat den Vorteil, daß die Theorie der abstrakten Datentypen, die unabhängig von einer speziellen Institution ist, auf Relationen zwischen abstrakten Datentypen angewandt werden kann. Zum Beispiel liefern die Operation auf abstrakten Datentypen, wie sie bei Sannella und Tarlecki [50] definiert sind, die Basis für eine rudimentäre Spezifikationssprache RSL_{I} zur Spezifikation von Relationen und wir zeigen wie man Inferenzsysteme, die es erlauben Eigenschaften von abstrakten Datentypen abzuleiten (zum Beispiel Wirsing [61]), anwenden kann um Eigenschaften von Relationen abzuleiten.

\underline{x}

Die Resultate dieser Arbeit lassen sich in zweifacher Hinsicht zur Spezifikation des dynamischen Verhaltens von Softwaresystemen verwenden. Erstens kann man RSL_{I} als Basis einer praktischeren Spezifikationssprache verwenden. Der Nachteil dieser Methode ist, daß neue Werkzeuge für diese Spezifikationssprache entwickelt und implementiert werden müssen. Einen zweiten Weg liefert die Übersetzung G^{A}, die abstrakte Datentypen in R_{I} — also Relationen — in abstrakte Datentypen der Institution I übersetzt. Damit kann man jede Spezifikationssprache mit ihren Werkzeugen wiederverwenden, deren Semantik abstrakte Datentypen in I sind. Als Ergebnis erhält man einen Stil zur Spezifikation von dynamischen Verhalten, der dem von Z entspricht.

Acknowledgments

I am indebted to my supervisor Harald Ganzinger for his support, his patients, and for providing the pressure that I needed to finish the thesis. I also thank Jacques Loeckx for agreeing to referee this thesis.

I wish to thank Viorica Sofronie for careful reading several drafts of this thesis and suggesting improvements. Without her comments the thesis would be very much different.

I also like to thank Andrzej Tarlecki for clarifying some subtle points with indexed categories.

Finally, I would like to thank my colleagues at the Max-Planck-Institut für Informatik for fruitful discussions and a lot of fun, especially, Jürgen Stuber, Uwe Waldmann, Andreas Tönne, Ullrich Hustadt, Renate Schmidt, Uwe Brahm, Margus Veanes, and Giorgio Delzanno.

Contents

1 Introduction 1 1.1 Relations between Abstract Datatypes . . . . . . . . . . . . . . . . . . . . . . 3 1.2 Structure of the Thesis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.3 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2 Some Category Theory 15 2.1 Categories, Functors and Natural Transformations . . . . . . . . . . . . . . . . 15 2.2 Colimits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 2.3 Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.4 Adjoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.5 Indexed Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

3 Institutions 37 3.1 Equational Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.2 Amalgamation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.3 Constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 3.4 The Institution LSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

4 Specifications of Abstract Datatypes 65 4.1 Abstract Datatypes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 4.2 The Specification Language SL_{I} . . . . . . . . . . . . . . . . . . . . . . . . . . 68 4.3 Proving Specification Entailment in SL_{I} . . . . . . . . . . . . . . . . . . . . . . 75 4.4 Problems with Derive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 4.5 Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

5 Relations as Abstract Datatypes 81 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 5.2 The Category Rel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 5.3 The Institution R_{I} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 5.4 Colimits in Sign_{R_{I}} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 5.5 Preservation of Colimits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 5.6 Relation between Adt_{R_{I}} and Adt_{I} . . . . . . . . . . . . . . . . . . . . . . . . 103 5.7 Operations on relations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 5.8 Finite Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 5.9 The Language RSL_{I} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

6 Abstract Machines 113 6.1 State as Algebra Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 6.2 Models of the State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 6.3 Extensions to RSL_{I} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

7 Proving Entailment of Relations 129 7.1 Translation of RSL_{I}-Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . 130 7.2 Refinement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 7.3 Data-Refinement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 7.4 An Example of Data-Refinement . . . . . . . . . . . . . . . . . . . . . . . . . 140 7.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

8 Disjunction 157 8.1 Adding Disjunction to SL_{I} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 8.2 Proving Properties with Disjunction . . . . . . . . . . . . . . . . . . . . . . . . 159 8.3 Adding Disjunction to RSL_{I} . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

9 Z Specifications 165 9.1 The Institution SET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 9.2 Abstract Machines in Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 9.3 Z-style specifications using LSL . . . . . . . . . . . . . . . . . . . . . . . . . . 179

10 Conclusion 183 10.1 Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

A Larch Traits 187 A.1 FiniteMap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 A.2 Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 A.3 SetBasics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 A.4 DerivedOrder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

1 Introduction

It is well recognized that at least some, if not all, aspects of a software system should be formally specified. Among these aspects are the functional requirements and the dynamic behavior of a software system. A specification of the functional requirements is concerned with the data of a software system and how this data is transformed by functions. Usually property-oriented, also known as axiomatic or algebraic, specification languages are used for functional requirement specifications. When writing property-oriented specifications, one first defines the sorts and functions involved; then, their properties are defined by using equations or, more generally, first-order formulas. Examples of property-oriented specification languages are Clear [13], the Larch Shared Language [34], ASL [3], OBJ [28], Obscure [41], ACT [15], and CASL [45].

A specification of the dynamic behavior of a software system is concerned with the changes of the behavior of that system after performing some operations. This means that the system may react differently on the same operation depending on the operations that have been performed in the meantime. An example is the top operation of stacks which returns the top-most element of a stack. The result of two successive top operations yields different elements if a pop operation which removes the top-most element of a stack is performed in between the top operations. This leads to the notion of state of a software system which is an abstraction of the history of a software system. Model-oriented specification languages are often used for dynamic behavior specifications. When writing model-oriented specifications one first constructs an abstract model of the state of the software system and then defines for each operation the effect of this operation on the state. Examples of model-oriented specification languages are Z [56], VDM [40], and B [1].

In general, functional requirement specifications precede dynamic behavior specifications in the software engineering process, in particular, if the target programming language is imperative or object-oriented. The dynamic behavior specification can be seen as a refinement of the functional requirement specifications. Take for example a functional requirement specification of the union operation of sets. Given two sets, the result of the union operation is a set that contains as its only elements all the elements of the argument sets. A dynamic behavior specification specifies in addition whether a new set is created for the result while the arguments remain unchanged, or if the elements of the second set are added to the elements of the first set and thus change the first set.

However, a functional requirement specification need not be followed by a dynamic behavior specification if, for example, the target programming language is a functional language. Similarly, one may omit the functional requirement specification and directly start with a dynamic behavior specification if its style is more appropriate to the software system that is to be specified, for example a database system.

In the two-tiered approach of Larch [34] functional requirement specifications and dynamic behavior specifications are combined. The datatypes which are used to model the states are given as functional requirement specifications. For this the Larch Shared Language is used which is a specification language based on many-sorted total algebras and equational logic with constraints. For each target programming language there exist different Larch Interface Languages for the specifications of the dynamic behavior of the functions, procedures, or methods of that programming language.

A problem with the two-tiered approach of Larch is that for each programming language the state is modeled in a different way. This is in contrast to the state as algebra approaches where not only the used datatypes are defined by algebras, but also the states. This has the advantage that the datatypes used by the components of the state as well as the set of admissible states of a software system can be specified by the same specification language.

There are quite a few specification languages and methods using the state as algebra approach, for example, Gurevich’s Abstract State Machines [33], also known as evolving algebras, d-oids by Astesiano and Zucca [4], COLD-K by Feijs and Jonkers [22], transition categories by Große-Rhode [29], equational dynamic logic by Wieringa [59], an informal proposal to dynamic algebras by Ehrig and Orjeas [20], the implicit state approach by Dauchy and Gaudel [16], and the proposal by Ganzinger to model the semantics of programs by transformation of algebraic theories [23].

In this thesis we abstract away from the use of algebras to model states; instead, we use structures from any suitable institution. Goguen and Burstall [13] introduced the notion of institution to define the semantics of the specification language Clear independent from a logical system. In a similar way we use institutions to define a framework for dynamic behavior specifications which can be instantiated, for example, with states modeled as manysorted total algebras, many-sorted partial algebras, order-sorted algebras, and first-order structures. In addition, we define two new institutions which can be used to model states. The institution LSL models the logical system of the Larch Shared Language, and the institution SET models the logical system of the model-oriented specification language Z.

Given a specification language whose semantics are abstract datatypes, that is pairs consisting of a signature and a class of algebras over that signature, then a specification in that specification language defines the state space of a software system. Operations that modify the state of a software system are relations between abstract datatypes or, more precisely, relations between the classes of algebras given by abstract datatypes.

In this thesis we concentrate on the specification of state transformations, that is we study relations between abstract datatypes. We provide a set of basic operations to construct complex relations from simpler ones. These operations are parallel composition, extending the domain of a relation by adding new state components, and restricting a relation by hiding state components. Other operations, like sequential composition, can be defined in terms of these basic operations.

Another way to define state transitions relates the state components before and after a state transformation using formulas. Our approach is based on the observation that we can use the same kind of formulas that were used to define the components of the environment and the set of admissible states to relate the state components before and after a state transformation. These formulas depend on the logical system we use for the states; however, they do not depend on a particular logical system, like equational logic or first-order logic.

We also provide an inference system for proving properties from relations. This inference system is based on an inference system for the institution used to model the states. This allows us to reuse theorem provers for the base institution, if existent, to prove properties of relations.

This work is strongly influenced by the model-oriented specification language Z [56, 57]. In Z states are modeled as elements of schema-type, state spaces as schemata which are sets of elements of schema-type, and operations (relations between state-spaces) again as schemata. The schema-calculus allows to construct complex state spaces and operations from simpler state spaces and operations. Since state spaces and operations are schemata, and schemata are objects in the logical system underlying Z, proving properties of states and proving operations are done using the same inference system.

However, the fact that schemata are objects of the logical-system of Z implies that the method used by Z for the specification of state-based software systems depends on the particular logical system of Z and thus cannot be applied directly to the state as algebra approach.

In this thesis we present a way to uncouple Z’s method for the specification of state based systems from the logical system used by Z. This is based on the close relationship between schemata and abstract datatypes already observed by Spivey [56]. This yields a specification method which is in many aspects similar to Z’s method, but can be used with any suitable logical system, including the logical systems used for the state as algebra approach.

1.1 Relations between Abstract Datatypes

As an example of a relation between abstract datatypes consider a simple counter with an increment operation. The state space of the counter is modeled as a class of Σ_{C}-algebras M_{C} where Σ_{C} is a many-sorted signature with one sort Nat, an operation succ from Nat to Nat, and constants zero and c of sort Nat; and M_{C} has the following properties: For each algebra A in M_{C} A(Nat) is the set of natural numbers ℕ, A(c) is an arbitrary natural number, A(zero) = 0,and A(succ)(n) = n + 1 for each natural number n.

The relation Inc ⊆ M_{C} × M_{C} is defined as all pairs (A, B) such that B(c) = A(c) + 1. Note that, because of the way M_{C} is defined, A(Nat) is the same as B(Nat), A(succ) the same as B(succ), and B(zero) is the same as A(zero). Thus Inc defines an operation incrementing the constant c while leaving the interpretation of Nat, succ, and zero unchanged.

The advantage of viewing a class of Σ-algebras M as an abstract datatype (Σ, M) is the possibility to use a specification language that has abstract datatypes as the semantics of their specifications to define the domain of relations. For example, the abstract datatype (Σ_{C}, M_{C}) is given by the following specification using a syntax adopted from the Larch Shared Language:^{1}

Counter : trait
introduces
   succ: Nat
   zero: Nat
   c: Nat
asserts
   Nat generated freely by succ, zero

Now consider the following pascal program:^{2}

program example;
   var c: natural;
   procedure increment;
   begin
      c := c + 1;
   end;
begin
   c := 10;
   increment;
end.

Its state can be viewed as a Σ_{C}-algebra where Σ_{C} contains as sorts the pascal types — in this case natural — and for each variable x of type T a constant x of sort T, which in this example is c. Then we can view the semantics of a pascal procedure as a relation between abstract datatypes. This makes it possible, for example, to check whether the pascal procedure increment implements the relation Inc defined above.

However, for specification purposes we do not want to limit ourselves to those algebras that model states of pascal programs. Instead, we want to use more problem oriented descriptions of the state space, and only after a process of data-refinement reach algebras that model states of pascal programs to show that a certain pascal program implements its specification.

Thus, we are not limited to the use of constants as state components in the state as algebra approach. For example, we can define the state of a dictionary by an algebra over a signature that has sorts bool, E for the elements of the dictionary, K for the keys of the dictionary, and functions map from K to E and dom from K to bool. The intention is that the function map records the associations between keys and values, but since map is a total function, we need the function dom which tells us for each key if the key/value pair is valid. Now an operation Update(k, e), adding an association (k, e) to the dictionary, changes the value of map such that map(k′) is e if k′ = k and is the old value of map(k′) if k ≠ k′. Similarly, dom is changed such that dom(k′) yields true if k′ = k and returns the old value of dom(k′) otherwise.

1Note that it is not completely true that (Σ_{C}, M_{C}) is the semantics of the given specification since for an algebra A in M_{C}, A(Nat) is the same as ℕ while for an algebra B satisfying the LSL-specification we can only ensure that B(Nat) is isomorphic to ℕ. However, as we will see in later chapters, this poses no problems.

2For the purpose of this introduction we assume that pascal has a datatype natural for the natural numbers.

The theory presented in this thesis is largely independent from the underlying logical systems used to model the states. To make this precise, we use the notion of an institution. The idea of an institution I is to abstract away from the notion of many-sorted signatures, algebras, equations, and satisfaction to an arbitrary class of signatures such that each signature Σ has associated a class of Σ-structures, a set of Σ-formulas, and a satisfaction relation ⊧^{I} which relates Σ-structures to Σ-formulas valid in these structures. The definition of abstract datatypes extends naturally to arbitrary institutions. An abstract datatype with respect to I is a pair (Σ, M) where Σ is a signature from I and M a class of Σ-structures.

A variety of well-known logical systems have been shown to be institutions, and a lot of these can be used in the framework of this thesis; for example, the original paper by Goguen and Burstall [25] showed that equational logic, that is many-sorted signatures together with algebras as Σ-structures and (conditional) equations as Σ-formulas, forms an institution. Also first-order logic is an institution. As part of this thesis we show that the logical systems underlying the specification languages LSL, which is a variant of equational logic with constraints, and Z, which is based on set-theory, are institutions. It is also possible to define a new institution appropriate to model the states of a particular class of software systems. For example, one could define an institution which naturally allows to talk about states containing arrays and pointers.

The instantiation of our framework by different institutions results in different specifications for the same problem. For example, if in the dictionary example the states were modeled by partial algebras, the state would probably consist only of a partial function map from K to E. For any key not in the range of the dictionary map would be undefined. The operation Update(k, e) would change map(k) to yield e if map is defined for k and would extend the domain of map to include k if map is not defined for k. If the institution SET were used, then map most likely would be a subset of K × E such that if (k, e) and (k, e′) are in map, then e = e′. The operation Update(k, e) would add the pair (k, e) to map and remove any pair (k, e′) with e ≠ e′ from map.

In this thesis we construct a new institution R_{I} based on a suitable institution I used to describe the states. The signatures of R_{I} are, roughly, tuples Θ = ((Σ_{1}, M_{1}), …, (Σ_{n}, M_{n})) of abstract datatypes from I, and Θ-structures are tuples (A_{1}, …, A_{n}) where A_{i} is in M_{i} for 1 ≤ i ≤ n. Now we can view a relation R ⊆ M_{1} × … × M_{n} as an abstract datatype (Θ, R) with respect to the institution R_{I}.

The advantage of this approach is that we can reuse the institution independent theory of abstract datatypes found, for example, in the paper of Sannella and Tarlecki [50] for the definition of relations. The operations on abstract datatypes can be interpreted in R_{I} as operations on relations. For example, we show how the relation Inc can be defined as the class of all pairs (A, B) ∈ M_{C} × M_{C} such that (A, B) satisfies the equation c′ = succ(c) where c′ refers to the value of B(c) and c to the value of A(c). Note that, by the choice of M_{C}, A(succ) and B(succ) are the same. Other operations to construct relations are union, extension, and restriction. More complex operations on relations, like sequential composition, instantiation etc. can be defined in terms of these primitive operations.

Another consequence of the construction of R_{I} is that we can reuse the institution independent proof calculus for proving properties of abstract datatypes and refinement of abstract datatypes studied, for example, by Sannella and Tarlecki [50], Wirsing [61], and Hennicker, Wirsing and Bidoit [38] to prove properties of relations and entailment of relations.

1.2 Structure of the Thesis

The rest of this chapter gives a brief overview of specification languages based on the state as algebra approach.

The notion of institutions is based on category theory; thus Chapter 2 introduces the terminology from category theory needed for the main construction of this thesis in Chapter 5. The reader familiar with (co)limits, adjunctions, and indexed categories may want to skip this chapter.

Chapter 3 introduces institutions and gives three examples: the institution EQ of equational logic, EQC of equational logic with constraints, and the institution LSL, which formalizes the logical system underlying the Larch Shared Language [34].

Chapter 4 summarizes the institution independent theory of abstract datatypes. It introduces the specification language SL_{I} for writing specifications of abstract datatypes in an institution I, and we present an inference system for proving specification entailment.

Chapter 5 contains the main construction of this thesis — the institution R_{I} parameterized by a suitable institution I — and proves properties of this institution, like that the category of signatures of R_{I} is (finitely) cocomplete and that the structure functor preserves colimits. Another important property is the relationship between abstract datatypes in R_{I} and abstract datatypes in I. The chapter ends with the introduction of the language RSL_{I} for the definition of relations.

Chapter 6 applies the theoretical results of the previous chapter to the specification of abstract datatypes with states, also called abstract machines. Several styles for the specification of abstract machines are discussed.

Chapter 7 extends the methods for proving specification entailment introduced in Chapter 4 to prove entailment of relations. The main technique is the translation of RSL_{I}-expressions to SL_{I}-expressions, which preserves entailment of relations. As an example we apply these results to the refinement of abstract machines and prove the correctness of the implementation of a stack by using a pointer in an array. This stack implementation is also an example of the construction of more complex relations from simpler ones.

In Chapter 8 we add disjunction to our set of operations on specifications and thus to RSL_{I}. This allows us to define relations on parts of the input domain first and then combine these relations into one relation, which is defined on the whole input domain. Disjunction was not studied before as a specification building operation mainly because, in contrast to the union of specifications, the disjunction of specifications is not in all institutions expressible on the presentation level; for this a sufficently expressive institution is needed. We shall show that LSL is such an institution.

Chapter 9 compares the approach of this thesis with the approach taken by Z for the specification of sequential systems. To this end we first define the institution SET of the logical system underlying Z, which is a variant of set theory, and then investigate the relationship between elements of schema-types and abstract datatypes over SET . The outcome is a specification style similar to that used by Z for the specification of sequential systems, but using an algebraic specification language — LSL — instead of Z.

1.3 Related Work

There are mainly two approaches to the specification of state based software systems using algebras. In the first approach, also known as the explicit state approach (cf. [16]), a state is modeled as an element of the carrier set of a special state sort. Operations changing the state of a software system are functions having the state sort in its domain and co-domain. To enforce data abstraction, one usually hides the state sort which means that one cannot directly compare two elements of the state sort. This leads to the hidden sorted approach (cf. Goguen et al [24, 26]).

The other approach is the state as algebra approach where the state of a software system is modeled as an algebra and a state transformation as a relation or function between classes of algebras. This approach goes back to at least Ganzinger [23], who used this approach to define an algebraic semantics of imperative programming languages.

Semantic of While-Programs Ganzinger defines the semantics of while-programs to be the composition of a free functor and a forgetful functor on algebras representing the state of the program. In principle there are three specifications: Spec_{base}, Spec_{X}, and Spec_{X∪X′}^{p}. Spec_{base} is the specification of some base types defining the domain over which the variables range. Spec_{X} is a conservative extension of Spec_{base} containing constants of the form x : s denoting the variables of the program. Each program p determines a specification Spec_{X∪X′}^{p} which is an enrichment of Spec_{X} that contains for each x : s in Spec_{X} a constant x′ : s. Further, it contains equations defining the semantics of the program p. For example in the case where p is the assignment statement x := t, Spec_{X∪X′}^{p} contains the formula x′ = t. The semantics of a program p is given by T_{p}; U_{σ} where T_{p} : Alg(Spec_{X}) → Alg(Spec_{X∪X′}^{p}) is the left adjoint to the forgetful functor U with respect to the inclusion of Spec_{X} in Spec_{X∪X′}^{p}, and U_{σ} : Alg(Spec_{X∪X′}^{p}) → Alg(Spec_{X}) is the forgetful functor for the signature morphism σ that takes each x : s in Spec_{X} to x′ : s in Spec_{X∪X′}^{p}. In general T_{p} will be a persistent functor; however, if p does not terminate then (T_{p}; U)(A) ≠ A.

Abstract State Machines (a.k.a. Evolving Algebras) Abstract State Machines, formerly known as evolving algebras, are intended to provide a computing device for formalizing the notion of algorithm similar to the Turing machine model, which formalizes the notion of computable function. The Abstract State Machine Thesis claims that for any algorithm there always exists an appropriate abstract state machine that simulates that algorithm in lock-step on the same abstraction level of that algorithm. Thus, Abstract State Machines are able to directly execute algorithms without translating them to a lower abstraction level.

Computation models and specification methods seem to be worlds apart. The Abstract State Machine (ASM) project started as an attempt to bridge the gap by improving on Turing’s thesis. We sought more versatile machines which would be able to simulate arbitrary algorithms in a direct and essentially coding-free way. Here the term algorithm is taken in a broad sense including programming languages, architectures, distributed and real-time protocols, etc.. The simulator is not supposed to implement the algorithm on a lower abstraction level; the simulation should be performed on the natural abstraction level of the algorithm.

The ASM thesis asserts that ASM’s are such versatile machines.

This quote from Gurevich can be found on the web-site on Abstract State Machines^{3} and is adapted from Gurevich [33].

The state of an abstract state machine is a one-sorted algebra. Relations and subsorts are modeled using characteristic functions.

A signature Σ is a finite collection of function names, each of a fixed arity and possibly marked as relation name or static name, or both. The set of function names includes the null-ary static function names true, false, and undef; the equal sign as a binary static relation name; and the usual Boolean operations.

A Σ-algebra A (or a state) is a non-empty set X, called super-universe, together with a set of functions for each function name f in the signature. If the arity of f is n, then the algebra contains a function f^{A} : X^{n} → X if it is not marked as a relation name and a function f^{A} : X^{n} → {true, false} if it is marked as a relation name. The null-ary function names true, false, and undef are required to be interpreted as different elements from the super-universe.

Unary relations U determine subsets of the super-universe and are called universes. Universes do not include undef.

All functions and relations are total. Partiality is modeled by returning undef. However, note that the characteristic function of a relation can not yield undef. Further, the boolean operations ∨, ∧, ¬ etc. are not relations and therefore may have undef as a result. The boolean operations are strict while, in general, functions need not be strict.

The equality sign is interpreted as the characteristic function of the identity on the superuniverse. Note that this implies undef = undef.

3http://www.eecs.umich.edu/gasm/

Transformations are build from sets of guarded multi-update instructions of the form

if g then R.

A multi-update instruction R is a set of update instructions f(t⃗) := t_{0} where f is a function name not marked as static, t⃗ a vector of ground terms matching the arity of f, and t_{0} a ground term. Let t⃗ evaluate to a⃗ and t_{0} to a_{0} in A. If the guard g evaluates to true in A, then the update f(t⃗) := t_{0} changes the interpretation of f at location a⃗ in A to a_{0}. All update instructions are performed simultaneously. The result of function applications to values not mentioned in an update instruction remain unchanged. In case of conflicting updates, i.e. where there are update instructions for updating f^{A}(a⃗) to a_{0} and to b_{0} (a_{0} ≠ b_{0}), A is not changed.

A program is a set of guarded multi-updates, and a run of a program is a possible infinite sequence of algebras starting from some initial state such that the next algebra in the sequence is obtained by firing the guarded multi-updates in the previous algebra.

The interpretation of function names marked static cannot change. The set of static names determines a sub-signature Σ_{Env} of Σ.

The execution of a program for an evolving algebra is deterministic. If two conflicting update instructions are to be executed, none of them is executed. This is in contrast to the Evolving Algebra Tutorial [32] where one update was chosen non-deterministically. In the current setting non-determinism is achieved by introducing a new transformation rule

choose v in U
   R
endchoose

This rule randomly picks an element a of the universe U and executes R in an algebra where v is bound to a. If the universe U is empty, the execution of the evolving algebra halts.

Parallelism is modeled by rules containing variables which are declared with

                             Var v ranges over U

where U is preferably finite. The semantics is that for each instantiation of v with a value from U the updates are performed in parallel.

D-oids D-oids are a model theoretic approach by Astesiano and Zucca [4] to define dynamic datatypes. D-oids consist of a set of algebras over a many-sorted signature together with a set of dynamic operations. A dynamic operation associates to an algebra A and a set of values from A an algebra B a return value from B and a family of functions f_{s} : A(s) → B(s) for each sort s called the tracking map.

In the D-oids approach not only the interpretation of the operation symbols may change, but also the interpretation of sorts. The tracking map f_{s} is used to relate the elements in the interpretation of the sort s before and after an application of a dynamic operation. For example, if a dynamic operation adds a new element of sort s, that is B(s) = A(s) ∪ {e}, then f_{s} is the injection of A(s) into B(s).

Proposal for Dynamic Abstract Datatypes An approach similar to d-oids is the informal proposal for dynamic abstract datatypes by Ehrig and Orejas [20]. The instant structure specification, a conservative extension of some value type specification, is intended to model class sorts and attribute functions of objects. A dynamic operation denotes a function mapping a model A of the instant structure specification and a set of values from A to some instant algebra B.

Implicit State Approach In the implicit state approach of Dauchy and Gaudel [16] the states are enrichments of an abstract datatype defining the environment by a set of access functions. The set of access functions is divided into elementary access functions and nonelementary access functions. The non-elementary access functions are completely defined in terms of the elementary access functions and the functions in the environment. Modifiers are functors on states built from elementary modifiers by sequential and indifferent composition and using conditionals. Elementary modifiers modify the value of the elementary access functions; however, since the value of the non-elementary access functions depend on the value of the elementary access functions, the non-elementary access functions also change. The signature containing the symbols from the environment together with the elementary and non-elementary access functions is denoted by Σ_{ac}.

The implicit state approach is independent of the specification language used to specify the environment and how the non-elementary access functions relate to the elementary access functions as long as the semantics of a specification in that language is a class of many-sorted algebras.

Given an elementary access function f : s_{1} → s_{2} with sorts s_{1} and s_{2} from the environment. An elementary modifier has the form μ-f (t_{1}, t_{2}) where t_{1} is a term over the signature of the environment and t_{2} is a term over Σ_{ac} such that all variables in t_{2} also occur in t_{1}. Given a Σ_{ac}-algebra A and an elementary modifier μ-f (t_{1}, t_{2}), a new Σ_{ac}-algebra B is constructed by letting B(f)(a) = ρ̃(t_{2}) if there exists a variable assignment ρ from the variables of t_{1} to A such that ρ̃(t_{1}) = a. In case there is no such assignment, B(f)(a) is the same as A(f)(a). All the other elementary access functions do not change; however, the derived non-elementary access functions may change if they depend on f.

Transition Categories In the approach taken by Große-Rhode in his PhD-thesis [29, 30] the states of a software system are partial algebras over a many-sorted signature Σ = (S, Ω). Σ contains the sorts and operations of the data-types needed to describe the state components, and, in addition, some sorts in S are marked as reference sorts for other sorts in S. A reference sort for a sort s is denoted by ref(s). Not every sort in S needs to have a reference sort, and it is possible to have a reference sort for a reference sort, for example, ref(ref(s)). For each reference sort ref(s) there exists an operation !_{s} : ref(s) → s in Ω, called the contents function. A base specification BaseSPEC is a pair (Σ, Φ) where Φ is a set of conditional existential equations defining the data-types and the state invariant.

Given a model A of BaseSPEC, a state A^{[d_{1}:=a_{1},... ,d_{n}:=a_{n}]} is a free extension of A by the set of existential equations !_{s_{i}}(d_{i}) =e= a_{i} where a_{i} is an element of A(s_{i}) and d_{i} is an element of A(ref(s_{i})) for every i = 1, …, n. In the free extension the values a ∈ A(s) are added as constants to the signature. Note that a state A^{[d_{1}:=a_{1},... ,d_{n}:=a_{n}]} need not be a persistent extension of A, that is, the unit morphisms η_{A} : A → A^{[d_{1}:=a_{1},... ,d_{n}:=a_{n}]} of the adjunction may not be a family of isomorphisms. This happens, for example, if a formula φ in Φ requires that !_{s}(d) =e= !_{s}(d′) while we have a state A^{[d:=a,d′:=a′]} where a and a′ are two distinct elements in A(s). In this case the state A^{[d:=a,d′:=a′]} satisfies the equations !_{s}(d) = a and !_{s}(d′) = a′, which implies together with φ that a = a′ and thus η_{A}(a) = η_{A}(a′).

A state A^{[d_{1}:=a_{1},... ,d_{n}:=a_{n}]} is called persistent if the state is a persistent extension of A. The intuition is that a persistent state A^{[d_{1}:=a_{1},... ,d_{n}:=a_{n}]} defines the value of the contents function A(!_{s_{i}}) for d_{i} ∈ A(ref(s_{i})) as a_{i} for every i = 1, …, n while the interpretation of all other symbols, including the interpretation of the sorts, in A^{[d_{1}:=a_{1},... ,d_{n}:=a_{n}]} is, up to isomorphism, the same as in A.

A method is either a create method, a delete method, or a transformation. A create methods increases the domain of the contents functions, a delete method decreases the domain, and a transformation changes the value of the contents functions.

A transformation method m of type w, p ∈ S^{∗} is written as m : ref(w); p where ref(w) is an abbreviation for ref(s_{1}), …, ref(s_{n}) if w = s_{1}, …, s_{n}. A method definition for method m is a set of rules

u =e= v → m(Δ_{1}, …, Δ_{n}, t_{1}, …, t_{m}) := r_{1}, …, r_{n}

where u and v are terms of the same sort, Δ_{i} is either a constant or a variable of sort ref(s_{i}), t_{i} a term of sort p_{j}, and r_{i} a term of sort s_{i} for every i = 1, …, n, j = 1, …, m, and p = p_{1} … p_{m}.

For a given model A of BaseSPEC and values a_{i} of A(p_{i}) for all i = 1, …, m a method expression of the form m(a_{1}, …, a_{m}) determines a relation between states A^{St} and A^{St′} as follows: If A^{St} has the form

A^{[d_{1}:=a_{1},... ,d_{n}:=a_{n},d_{n+1}:=a_{n+1},... ,d_{n+m′}:=a_{n+m′}]}

and there exists a variable assignment ρ such that the evaluation of t_{i} with respect to ρ is the same as a_{i} for i = 1, …, n and the guard u =e= v is true with respect to ρ, then A^{St′} has the form A^{[d_{1}:=b_{1},... ,d_{n}:=b_{n},d_{n+1}:=a_{n+1},... ,d_{n+m′}:=a_{n+m′}]} where b_{i} is the evaluation of r_{i} with respect to ρ for i = 1, …, n.

A create method is defined similar to a transformation method with the restriction that the evaluation of Δ_{i} with respect to ρ for every i = 1, …, n yields a value of reference sort not in the domain of the corresponding contents function !_{s_{i}}.

A delete method is given by the expression del(d_{1}, …, d_{n}) where d_{i} is an element of the set A(ref(s_{i})) for every i = 1, …, n. It transforms a state A^{St} where d_{i} is in the domain of the contents function !_{s_{i}} into a state A^{St′} where d_{i} is not in the domain of the contents function !_{s_{i}} for every i = 1, …, n.

COLD-K In COLD-K [22] the states are many sorted algebras with partial functions and predicates. The state transitions are specified using Harel’s dynamic logic [35] or given directly as an expression involving other state transitions.

A class consists of a the definition of a many sorted signature Σ = (S, Ω) with annotations which sort-, function-, and predicate symbols are variable, together with a set of procedures of the form

                    PROC p : s1,..., sn -> MOD f1,...,fm

where p is the procedure name, s_{i} are sorts from S, and f_{j} are either sort-, function-, or predicate symbols which have been marked variable. The intention is that p describes a state transition with parameters of sort s_{i} which is only allowed to change the state components given after the MOD keyword.

The semantics of a class consists of

• a set of states St together with a function assigning to each state σ in St a Σ-algebra A(σ),

• an initial state σ_{0} in St and

• a transition relation T_{p} for each procedure p.

A transition relation T_{p} is a relation consisting of tuples (σ, x_{1}, …, x_{n}, τ); σ and τ are states from St, and each x_{i} is an element of the carrier set for sort s_{i} of algebra A(σ). The interpretation of a symbol from Σ may only differ in A(σ) and A(τ) if it occurs after the MOD keyword in the definition of the procedure.

The possible interpretations of classes are constrained by a set of dynamic logic formulas. In addition to the usual first-order language, dynamic logic formulas contain assertions of the form

INIT, [p]φ, <p>φ and PREV φ

and expression of the form PREV t.

INIT is true only in the initial state σ_{0} with an empty history. INIT can be used to constrain the initial state. For example, the formula INIT ⇒ ∀i : ℕ. f(i) = 0 ensures that in the initial state A(σ_{0}) the interpretation of the operation f is the constant function returning 0.

An assertion [p]φ is true in a state σ with history (σ_{0}, …, σ_{n}) if φ is true in all possible successor states τ of σ given by the transition relation T_{p} with history (σ_{1}, …, σ_{n}, σ). An assertion <p> is true in a state σ with history (σ_{0}, …, σ_{n}) if there exists a successor state τ given by the transition relation T such that φ is true with history (σ_{1}, …, σ_{n}, σ). The assertion PREV φ is true in a state σ with history (σ_{0}, …, σ_{n−1}, σ_{n}) if φ is true in σ_{n} with history (σ_{0}, …, σ_{n−1}). The evaluation of an expression PREV t in a state σ with history (σ_{1}, …, σ_{n}) is the evaluation of t in A(σ_{n}). Any other formulas φ not containing any of the above assertions is true in a state σ with history (σ_{1}, …, σ_{n}) if φ is true in A(σ).

Usually the specification of a procedure follows a certain pattern. First, one defines the conditions pre under which a procedure proc has a successor state. This is done by a formula of the form pre ⇒ <proc>true. Then the effect of proc on the state is given by a formula of the form [proc]post, which states that after any state transition associated with proc is performed the formula post holds. The first formula is a liveness property and the second a safety property.

State components not mentioned in the MOD clause of a procedure do not change by the state transition associated to that procedure. Note that for variable state components that are functions it does not suffice to give the new result value for an argument value as in the ASM approach by Gurevich; instead, one also has to state that the function applied to the other values yield the same results as in the previous state. That is, to specify a procedure proc(p, x) intended to change the function f at value p to yield f(p) = x; but otherwise remaining the same, one has to write [proc(p, x)]f(p) = x ∧ ∀i. (i ≠ p ⇒ f(i) = PREV f(i)).

Equational Dynamic Logic In Wieringa [59, 60] Equational Dynamic Logic is defined as a specification language for dynamic objects in the context of object oriented databases.

The environment of base types and sets for object identifiers is provided by the initial algebra A of a conditional equational specification Sp_{Adt}. To define the set of possible states of an object system, an enrichment Sp_{Stat} of Sp_{Adt} by attribute functions and class invariants is given. No new sorts are allowed. Attribute functions are operations having a sort of object identifiers as their first argument. The set of possible states, or possible worlds, are all extensions of A satisfying Sp_{Stat}.

Transformations are modeled as terms of a special sort Event and are called events. The sort Event together with operations of sort Event are given by a conservative extension Sp_{Event} of Sp_{Adt}. An algebra E satisfying Sp_{Event} and having A as Sp_{Adt}-reduct is chosen as a model for all events. Terms over Sp_{Event} of sort Event denote (non-deterministic) functions on the set of possible worlds defined by Sp_{Stat} and A such that terms evaluating to the same value in E are the same function on the possible worlds.

The interpretation of elements of sort Event as functions on possible worlds is constraint by the use of dynamic equational logic. These are formulas requiring certain properties to hold after performing a certain event. For example, the formula

age(p) = a ⇒ [inc Age(p)]age(p) = a + 1

restricts the interpretation of the event inc Age(p) in such a way that if age(p) = a holds in a state C, then age(p) = a + 1 must hold in any of the possible successor states C given by

inc Age(p).

A problem with these kind of specifications is that the semantics of the event inc Age only ensures that in the successor state age(p) = a + 1 holds, but it does not say anything about age(q) for object identifiers q different from p, and similar it is not ensured that attr(p) = a ⇒ [inc Age(p)]attr(p) = a for an attribute attr different from age.

2 Some Category Theory

The framework of institutions and the main results of this paper are formulated using category theory. In the following chapter we shall summarize the results from category theory needed in the rest of thesis. First we introduce categories, functors, and natural transformations and give some examples. Then limits and colimits are defined and their construction is shown in the categories Set and Cat. After that, adjunctions and indexed categories are presented. For a more thorough treatment of category theory see the books of Mac Lane [43], Barr and Wells [5], or Adamek, Herrlich and Strecker [2]. The material about indexed categories is mainly from Tarlecki, Burstall and Goguen [58].

2.1 Categories, Functors and Natural Transformations

A category C consists of a collection of objects and a collection of arrows also called morphisms. Each arrow f of a category C has associated two objects in C: the domain, dom(f), and the codomain of f, cod(f). The composition g ∘ f of two arrows f and g of C is defined if the codomain of f is the same object as the domain of g and yields again an arrow in C with domain the domain of f and codomain the codomain of g. Composition is associative:

h ∘ (g ∘ f) = (h ∘ g) ∘ f,

and for each object c there exists an arrow id_{c}, the identity on c, with domain and codomain being c such that for all arrows f with domain c, and g with codomain c:

id_{c} ∘ f = f and g ∘ id_{c} = g.

For an arrow f with domain c and codomain d we shall use the function notation and write f : c → d. We shall also use the diagrammatic notation f; g for the composition of two arrows f : c → c′ and g : c′ → c instead of g ∘ f.

An arrow f : c → c′ is an isomorphism if there exists an arrow f^{−1} : c′ → c, the inverse of f, such that f; f^{−1} = id_{c} and f^{−1}; f = id_{c′}.

A discrete category is a category where all arrows are identities. Any set can be regarded as a discrete category; the objects of the category are the elements of the set and the only arrows are the identities id_{e} : e → e for each element e in the set.

A subcategory D of C is a category such that the objects and arrows of D are included in the objects and arrows of C. We write D ⊆ C to denote that D is a subcategory of C. A full subcategory D of C is a subcategory of C such that for any two objects c and c′ from D: if f : c → c′ is an arrow in C then f is an arrow in D.

Examples of categories are:

0 the empty category with no objects and arrows,

1 the category with one object and its identity as arrow,

2 the category with two objects 1 and 2 and just one arrow f : 1 → 2 not the identity, ↓↓ the category with two objects 1 and 2 and two arrows f : 1 → 2 and g : 1 → 2 not the

identity, V the category with three objects 0, 1 and 2 and two arrows f : 0 → 1 and g : 0 → 2 not

the identity, K_{n} the discrete category with objects {1, …, n}, Set the category having sets as objects and functions between sets as morphisms, Grp the category having as objects groups and as morphisms group homomorphisms. The opposite category C^{op} of C has as objects the objects of C and as morphisms f^{op} : c′ → c for every morphism f : c → c′ in C. The composition of arrows f^{op}; g^{op} in C^{op} is defined as (g; f)^{op}. Note that (C^{op})^{op} = C. Sometimes it is convenient to depict a category C as a graph with nodes the objects of C and edges the arrows of C. In general, the identity arrows and all arrows composed from other arrows are not shown. For example, the category V is depicted as

\xymatrix{1 &  & 2 \\  & 0 \ar[ul]^{f} \ar[ur]_{g}}

A category C is freely generated by a graph if the objects of C are the nodes of the graph and the arrows are the reflexive and transitive closure of the edges of the graph. A (covariant) functor F : C → D is a pair of functions from the collection of objects of C to the collection of objects of D and from the collection of arrows of C to the collection of arrows of D such that

1. if f : c → d then F (f) : F (c) → F (d),

2. F (f ∘ g) = F (f) ∘ F (g),

3. F (id_{c}) = id_{F (c)}. Functors preserve isomorphisms. Consider a functor F : C → D and an isomorphism f : c → c′ in c′ then F (f) is an isomorphism with inverse F (f)^{−1} = F (f^{−1}) because

F (f); F (f)^{−1} = F (f); F (f^{−1}) = F (f; f^{−1}) = F (id_{c}) = id_{F (c)}

and similar for F (f)^{−1}; F (f) = id_{F (c′)}.

The composition of a functor G : D → D′ with a functor F : C → D is the composition of their functions on objects and their functions on arrows:

(G ∘ F)(c) = G(F (c)) for all c ∈ C and
(G ∘ F)(f) = G(F (f)) for all f : c → c′ ∈ C.

A contravariant functor F from C to D maps objects in C to objects in D and arrows f : c → c′ in C to arrows F (f) : F (c′) → F (c) respecting the identities and the composition of arrows, that is, F (id_{c}) = id_{F (c)} and F (f; g) = F (g); F (f). A contravariant functor F from C to D can be either regarded as a covariant functor from C^{op} to D or as a covariant functor from C to D^{op}, whatever is convenient. The composition of a contravariant functor G from D to D′ with a contravariant functor F from C to D yields a covariant functor F; G from C to D′, and the composition of a contravariant functor G : D → D′ with a covariant functor F : C → D (and vice versa) yields a contravariant functor F; G from C to D′.

The category Cat has as objects categories and as arrows functors. The identity morphisms are functors Id_{C} which are the identity on objects and on arrows from C; the composition of two functors is the composition of the functions on objects and on arrows.

The category FCat is the full subcategory of Cat having as objects only finite categories, that is, categories with a finite set of objects and arrows.

In this thesis we use a naive approach to category theory in that we assume that Cat is large enough to hold all categories of interest, ignoring the foundational problem that the category Cat cannot be an object of itself and thus cannot be the category of all categories. An overview of these problems and their solutions can be found at pages 21ff of Mac Lane’s book [43].

The opposite to a functor F : C → D is the functor F^{op} : C^{op} → D^{op} with F^{op}(c) = F (c) and F^{op}(f^{op} : c′ → c) = F (f : c → c′)^{op}. Note that (F^{op})^{op} = F. Thus ^{op} is a functor from Cat to Cat mapping categories to their opposite categories and functors to their opposite functor.

Given two functors F and G from C to D. A natural transformation μ : F ⇒ G is a family of arrows μ_{c} : F (c) → G(c) in D such that for any arrow f : c → c′ in C the following diagram commutes:

\xymatrix{F (c) \ar[r]^{F (f)} \ar[d]_{μ_{c}} & F (c′) \ar[d]^{μ_{c′}} \\ G(c) \ar[r]_{G(f)} & G(c′)}

Let F be a functor from D to D′ and μ a natural transformation from G to H, where G and H are functors from C to D. The composition of μ with F is the natural transformation from G; F to H; F defined by:

(μ; F)_{c} = F (μ_{c}).

Similarly, let F′ be a functor from C′ to C then the natural transformation F′; μ from F′; G to F′; H is defined by:

(F′; μ)_{c′} = μ_{F′(c′)}

Two functors F and G from C to D are natural isomorphic if there exists a natural transformation μ : F ⇒ G such that μ_{c} : F (c) → G(c) is an isomorphism for each c ∈ C. Note that the family of morphisms (μ_{c})^{−1} for each c ∈ C yields again a natural transformation μ^{−1} : G ⇒ F.

Given two categories C and D, the objects of the functor category D^{C} are functors F : C → D and the morphisms are natural transformations.

The identity in D^{C} for a functor F : C → D is the natural transformation id_{F} : F ⇒ F given by (id_{F})_{c} = id_{F (c)}.

The composition of two natural transformations μ : F ⇒ G and ν : G ⇒ H is defined by (μ; ν)_{c} = μ_{c}; ν_{c}.

2.2 Colimits

An object c of a category C is an initial object of C if there exists for all objects d in C a unique arrow h : c → d in C. A category may have no, one or several initial objects, which, in the latter case, are all isomorphic.

Note that if c is an initial object then the identity is the unique arrow from c to c.

The initial object of Set is the empty set and the initial object of Cat is the category 0 with no objects and no arrows.

For categories C and J the diagonal functor Δ : C → C^{J} maps an object c of C to the constant functor Δc : J → C given by

Δc(i) = c and Δc(f : i → j) = id_{c}

and an arrow g : c → c′ to the constant natural transformation Δg : Δc ⇒ Δc′ given by (Δg)_{i} = g.

Definition 2.1 (Colimit) Given a functor F : J → C. The colimit of F consists of a pair (ι^{F} , ∐_{J} F) where ∐_{J} F is an object of C and ι^{F} is a natural transformation ι^{F} : F ⇒ Δ ∐_{J} F such that the following universal property is satisfied: For any object c and natural transformation μ : F ⇒ Δc from C there exists a unique arrow h_{μ} : ∐_{J} F → c such that the following diagram commutes for each i in J:

\xymatrix{∐_{J} F \ar[r]^{h_{μ}} & c \\ F (i) \ar[u]^{ι_{i}^{F}} \ar[ur]_{μ_{i}}}

We call the ι_{i}^{F} co-cone morphisms from F (i) into ∐_{J} F and J the shape of F. Usually, we will omit J in ∐_{J} F and write ∐ F instead.

Note that the colimit object is only unique up to isomorphism.

The initial object of a category C is the colimit object ∐ F of the unique functor F : 0 → C. The co-cone morphisms are given by the unique natural transformation from F to Δ(∐ F). Since there exists for all objects c from C a unique natural transformation μ from F to Δc, the universal property of ∐ F guarantees the existence of a unique morphism h_{μ} : ∐ F → c.

Let F and G be functors from J to C and μ a natural transformation from F to G. We write ∐ μ for the unique morphism from ∐ F to ∐ G given by the universal property of ∐ F and the natural transformation ν from F to Δ(∐ G) defined by ν_{i} = μ_{i}; ι_{i}^{G}.

\xymatrix{∐ F \ar[r]^{∐ μ} & ∐ G \\ F (i) \ar[r]_{μ_{i}} \ar[u]^{ι_{i}^{F}} \ar@{-->}[ur]_{ν_{i}} & G(i) \ar[u]_{ι_{i}^{G}}}

Note that if G is Δc then ∐ ν is the unique morphism given by the universal property of ∐ F and ν because ∐(Δc) = c:

[figure: ∐ F; ∐ ν; c; F (i); ν_{i}; ι_{i}^{F}; ν_{i}; c]

Definition 2.2 (Cocomplete) A category C is (finitely) cocomplete if any (finite) functor F : J → C has a colimit for (finite) categories J. A category is finite its collection of objects and arrows are finite.

Fact 2.3 The categories Set and Cat are cocomplete.

It is well known that the categories Set and Cat are cocomplete. In Set a colimit of a functor F from J to Set is the set {(i, a) | a ∈ F (i)}/≡. The relation ≡ is the smallest equivalence relation such that (i, a) ≡ (j, b) if there exists f : i → j in J with F (f)(a) = b.

The co-cone morphisms ι_{i}^{F} from F (i) to the colimit of F are defined by ι_{i}^{F} (a) = [(i, a)]_{≡}.

The construction of the colimit category of F : J → Cat is similar to the construction of the colimit in Set. The objects of ∐ F are the equivalence classes of the relation ≡. The relation ≡ is the smallest relation such that (i, c_{i}) ≡ (j, c_{j}) if there exists f : i → j in J with F (f)(c_{i}) = c_{j} for objects c_{i} ∈ F (i), c_{j} ∈ F (j), and i, j ∈ J.

Similarly, the collection of arrows of ∐ F are the equivalence classes of the smallest equivalence relation satisfying (i, g_{i} : c_{i} → c′_{i}) S (j, g_{j} : c_{j} → c′_{j}) if there exists f : i → j in J with F (f)(g_{i}) = g_{j}.

Note that the category FCat of finite categories is only finitely cocomplete since, for example, the colimit of the functor F from a discrete category J to Cat mapping each i ∈ J to the category 1 is the discrete category with objects pairs (i, 1) for each i ∈ J. This category is infinite if J is infinite.

Fact 2.4 The functor category D^{C} is (finitely) cocomplete if D is.

Proof. Let F be a functor from J to D^{C}. Define the family of functors F_{c} : J → D by F_{c}(i) = F (i)(c) and F_{c}(f) = F (f)(c) for objects i and morphisms f : i → j in J. The colimit ∐ F is a functor from C to D given by (∐ F)(c) = ∐ F_{c} and (∐ F)(g : c → c′) = ∐ μ where μ is the natural transformation from F_{c} to Δ(∐ F_{c′}) defined by μ_{i} = F (i)(g) for each i ∈ J. □

In particular, the initial object in D^{C} is the functor mapping every object in C to the initial object in D and every morphism to the identity on the initial object.

In case where F is a functor from a discrete category {1, 2} to C, the colimit ∐ F is called the coproduct F (1) ⊎ F (2) of F (1) and F (2). The disjoint union of two sets S_{1} and S_{2},

S_{1} ⊎ S_{2} = {(1, s_{1}) | s_{1} ∈ S_{1}} ∪ {(2, s_{2}) | s_{2} ∈ S_{2}},

is a coproduct of S_{1} and S_{2} with the co-cone morphisms ι_{i} : S_{i} → S_{1} ⊎ S_{2} being defined by ι_{i}(s) = (i, s) for all s in S_{i} and i ∈ {1, 2}.

The coproduct of two categories C_{1} and C_{2} in Cat is the disjoint union of their collection of objects and the disjoint union of their collection of arrows.

The notion of coproducts can be extended to functors of the form F : K_{n} → C for arbitrary n. We may write F (1) ⊎ ⋯ ⊎ F (n) instead of ∐_{K_{n}} F.

Definition 2.5 (Coequalizer) A coequalizer is the colimit of a functor F from ↓↓ to C.

This means that for any object c and arrow h : F (2) → c in C with F (f); h = F (g); h there exists a unique arrow h′ from ∐ F to c such that ι_{2}; h′ = h:

\xymatrix{F (1) \ar[r]^{F (f)} \ar[r]_{F (g)} & F (2) \ar[r]^{ι_{2}} \ar[dr]_{h} & ∐ F \ar@{-->}[d]^{∃_{1}h′} \\  &  & c}

The coequalizer of two functions f_{1}, f_{2} : S_{1} → S_{2} in Set is given by the quotient S_{2}/_{≡} where ≡ is the smallest equivalence relation generated by the relation

{(s, s′) | ∃s_{1} ∈ S_{1} f_{1}(s_{1}) = s and f_{2}(s_{1}) = s′}.

The co-cone morphism ι_{2} maps s_{2} ∈ S_{2} to [s_{2}]_{≡} and ι_{1} is f_{1}; ι_{2}, which is the same as f_{2}; ι_{2}.

The collection of objects of the coequalizer in Cat of two functors F_{1}, F_{2} : C → D is the coequalizer of the collection of objects of C and D, and the collection of arrows of the coequalizer is the coequalizer of the collection of arrows of C and D.

Definition 2.6 (Pushout) A pushout is the colimit of a functor F from V to C.

For any object c in C and pair of arrows μ_{1} : F (1) → c and μ_{2} : F (2) → c such that F (g); μ_{1} = F (f); μ_{2} there exists a unique arrow h_{μ} : ∐ F → c such that ι_{1}; h_{μ} = μ_{1} and ι_{2}; h_{μ} = μ_{2}:

\xymatrix{ & c \\  & ∐ F \ar@{.>}[u]_{h_{μ}} \\ F (1) \ar@{-->}[ur]^{ι_{1}} \ar[uur]^{μ_{1}} &  & F (2) \ar@{-->}[ul]_{ι_{2}} \ar[uul]_{μ_{2}} \\  & F (0) \ar@{-->}[ul]^{F (f)} \ar@{-->}[ur]_{F (g)} \ar@{-->}[uu]_{ι_{0}}}

For the pushout of a functor F : V → C we may write F (1) +_{(F (f),F (g))} F (2). We may write F (1) +_{F (0)} F (2) if F (f) and F (g) are “canonic”, for example, in Set this means that F (f) and F (g) are the inclusions of F (0) into F (1) and F (g), respectively.

Pushouts can be constructed by first taking the coproduct F (1)⊎F (2) and then the coequalizer of F (f); ι_{1} and F (g); ι_{2}

\xymatrix{ & ∐ F \\  & F (1) ⊎ F (2) \ar[u]_{ι} \\ F (1) \ar@{-->}[ur]_{ι_{1}} \ar@{-->}[uur]^{ι_{1}^{F}} &  & F (2) \ar@{-->}[ul]^{ι_{2}} \ar@{-->}[uul]_{ι_{2}^{F}} \\  & F (0) \ar@{-->}[ul]^{F (f)} \ar@{-->}[ur]_{F (g)}}

In Set the pushout is (F (1) ⊎ F (2))/_{≡} with ≡ being the smallest equivalence relation generated by

{((1, s_{1}), (2, s_{2})) | ∃s_{0} ∈ F (0) F (f)(s_{0}) = s_{1} and F (g)(s_{0}) = s_{2}}

The co-cone morphisms are ι_{i}(s_{i}) = [(i, s_{i})]_{≡} for i ∈ {1, 2} and

ι_{0}(s_{0}) = [(1, F (f)(s_{0}))]_{≡} = [(2, F (g(s_{1})))]_{≡}.

Fact 2.7 A category is cocomplete if it has initial objects and pushouts or initial objects, coequalizer and all coproducts. A category C has all coproducts if every functor from a discrete category to C has a colimit.

This fact is useful since it allows to show that a category is cocomplete by exhibiting initial objects and the construction of pushouts.

A proof of Fact 2.7 can be found, for example, in the book by Mac Lane [43]. Above we have seen how to construct pushouts in terms of coproducts and coequalizers. Conversly, coproducts F (1) ⊎ F (2) can be expressed by pushouts F (1) +_{⊥} F (2) where ⊥ is the initial object of the category.

Definition 2.8 (Preservation of Colimits) The functor G : C → D preserves colimits if for any functor F : J → C for which the colimit (ι^{F} , ∐ F) exists, (G(ι^{F}), G(∐ F)) is a colimit of the functor F; G.

The next fact is a consequence of Fact 2.7.

Fact 2.9 Let C be cocomplete then a functor F from C to D preserves colimits if it preserves initial objects and pushouts, or if it preserves initial objects, all coproducts and coequalizers.

It is important that C is cocomplete to ensure that the colimit of a functor F : J → C can be decomposed in initial objects and pushouts, or initial objects, coproducts and coequalizer. If C is not cocomplete then the corresponding diagrams may not have colimits and thus one cannot use the preservation of initial objects etc. to construct the colimit in D.

Definition 2.10 (Creation of Colimits) A functor G : C → D creates colimits if for any functor F : J → C for which the colimit (ι^{F;G}, ∐(F; G)) of F; G exists there exists a colimit (ι^{F} , ∐ F) of F such that

G(∐ F) = ∐(F; G) and ι^{F}; G = ι^{F;G}.

It is easy to see that if F : C → C′ and G : C′ → D both preserve colimits, so does the composition F; G, and similar for creation of colimits.

Fact 2.11 If a functor G : C → D creates colimits and D is cocomplete then C is cocomplete.

Proof. Consider a functor F : J → C. Since D is cocomplete, the colimit of F; G always exists and therefore the colimit of F exists since G creates colimits. □

2.3 Limits

A concept dual to that of colimits is the concept of limits. If we reverse the direction of all arrows in the definition of colimits, we get the definition of limits.

\underline{2.3 Limits 23}

Definition 2.12 (Limit) Given a functor F : J → C. The limit of F consists of a pair (π^{F} , ∏_{J} F) where ∏_{J} F is an object of C and π^{F} a natural transformation π^{F} : Δ(∏_{J} F) ⇒ F such that for any object c and natural transformation μ : Δc ⇒ F from C there exists a unique arrow h_{μ} : c → ∏_{J} F such that h_{μ}; π_{i}^{F} = μ_{i} for all i ∈ J, that is, the following diagram commutes for all i ∈ J:

\xymatrix{∏_{J} F \ar[d]_{π_{i}^{F}} & c \ar[l]_{h_{μ}} \ar[dl]^{μ_{i}} \\ F (i)}

We call the morphisms π_{i}^{F} the cone morphisms of the limit of F.

As with colimits, limits are only unique up to isomorphism.

A terminal object c of a category C is an object of C such that for all objects d in C there exists a unique arrow h : d → c in C. The concept of terminal objects is dual to that of initial objects. As with initial objects, terminal objects are only unique up to isomorphism. The terminal object is the limit of the unique functor F : 0 → C.

Any set with one element is a terminal object in Set and any category with one object and one arrow, the identity, is a terminal object in Cat. In particular the category 1 is a terminal object in Cat.

We can now formally establish the duality between limits and colimits. Consider a functor F : J → C with colimit (ι^{F} , ∐ F) then ((ι^{F})^{op}, ∐ F) is a limit of the functor F^{op} : J^{op} → C^{op}. Similarly, if (π^{F} , ∏ F) is a limit of F then ((π^{F})^{op}, ∏ F) is a colimit of F^{op}.

Given two functors F and G from C to D such that both F and G have a limit. Let μ be a natural transformation from F to G then ∏ μ denotes the unique morphism from ∏ F to ∏ G given by the limit property of ∏ G with respect to the natural transformation ν = π^{F}; μ.

\xymatrix{∏ F \ar[d]_{π_{i}^{F}} \ar[r]^{∏ μ} \ar@{-->}[dr]_{ν_{i}} & ∏ G \ar[d]^{π_{i}^{G}} \\ F (i) \ar[r]_{μ_{i}} & G(i)}

The concept dual to that of coproducts is that of products. In case where F is a functor from the discrete category {1, 2} to C, the limit of F is called the product F (1) × F (2) of F (1) and F (2). The cartesian product of two sets S_{1} and S_{2} is a product of S_{1} and S_{2} in Set:

S_{1} × S_{2} = {(s_{1}, s_{2}) | s_{1} ∈ S_{1} and s_{2} ∈ S_{2}}

The cone morphisms π_{i} : S_{1} × S_{2} → S_{i} are defined by π_{i}((s_{1}, s_{2})) = s_{i} for all s_{i} in S_{i} and i ∈ {1, 2}.

The product C_{1} × C_{2} of two categories C_{1} and C_{2} is the cartesian product of their collection of objects and arrows. Given a pair of arrows f : c_{1} → c′_{1} in C_{1} and g : c_{2} → c′_{2} in C_{2} then (f, g) : (c_{1}, c_{2}) → (c′_{1}, c′_{2}) is an arrow in C_{1} × C_{2}.

As with coproducts, we write F (1) × … × F (n) for the limit of a functor F : K_{n} → C.

Definition 2.13 (Equalizer) An equalizer is the limit of a functor F from ↓↓^{op} to C.

This means that for any object c and arrow h : c → F (2) in C, with h; F (f) = h; F (g), there exists a unique arrow h′ from c to ∏ F such that h′; π_{2} = h.

\xymatrix{F (1) & F (2) \ar[l]^{F (f)} \ar[l]_{F (g)} & ∏ F \ar[l]_{π_{2}} \\  &  & c \ar[ul]^{h} \ar@{-->}[u]_{∃_{1}h′}}

The equalizer of two functions f_{1}, f_{2} : S_{1} → S_{2} in Set is the set

{s ∈ S_{2} | f_{1}(s) = f_{2}(s)}

with π_{2}(s) = s as the cone morphism.

The equalizer of two functors F_{1}, F_{2} : C_{1} → C_{2} in Cat is the subcategory of C_{2} with objects c from C_{1} such that F_{1}(c) = F_{2}(c) and morphisms f : c → c′ such that F_{1}(f) = F_{2}(f).

Definition 2.14 (Pullback) A pullback is the limit of a functor F : V^{op} → C.

If μ_{1} : c → F (1) and μ_{2} : c → F (2) are two arrows in C with μ_{1}; F (f) = μ_{2}; F (g) then there exists a unique h : c → ∏ F with μ_{1} = h; π_{1} and μ_{2} = h; π_{2}.

\xymatrix{ & c \ar[ddl]_{μ_{1}} \ar[ddr]^{μ_{2}} \ar@{.>}[d]^{h} \\  & ∏ F \ar@{-->}[dl]^{π_{1}} \ar@{-->}[dr]_{π_{2}} \\ F (1) \ar[dr]_{F (f)} &  & F (2) \ar[dl]^{F (g)} \\  & F (0)}

For the pullback of a functor F : V^{op} → C we may write F (1) ×_{(F (f),F (g))} F (2) or, if F (f) and F (g) are “canonic”, for example, inclusions in Set, we may write F (1) ×_{F (0)} F (2).

In Set the pullback is the set

{(s_{1}, s_{2}) ∈ F (1) × F (2) | F (f)(s_{1}) = F (g)(s_{2})}

with cone morphisms π_{i}((s_{1}, s_{2})) = s_{i} for i ∈ {1, 2} and

π_{0}((s_{1}, s_{2})) = F (f(s_{1})) = F (g(s_{2}))

The pullback in Cat is the subcategory of F (1) × F (2) with objects

{(s_{1}, s_{2}) ∈ F (1) × F (2) | F (f)(s_{1}) = F (g)(s_{2})}

and morphisms (f, g) : (c_{1}, c_{2}) → (c′_{1}, c′_{2}) such that F (f)(f) = F (g)(g).

Definition 2.15 (Complete) A category C is (finitely) complete if every (finite) functor F : J → C has a limit.

Fact 2.16 A category is complete if it has terminal objects and pullbacks or terminal objects, equalizers and all products.

A category C has all products if the limit of every functor from a discrete category to C exists.

Fact 2.17 The categories Set and Cat are complete and the category FCat is finitely complete.

We have already shown that Set and Cat have terminal objects and pullbacks. However, to give a feeling of limits in Set, we give one possible construction for them.

The limit of a functor F : J → Set is the set

{(m_{1}, …, m_{i}, …) | m_{i} ∈ F (i), i ∈ J, F (f)(m_{i}) = m_{j}, f : i → j ∈ J}

with cone morphisms π_{i}^{F}, mapping (m_{1}, …, m_{i}, …) to m_{i}.

Fact 2.18 The functor category C^{D} is complete if C is complete.

Proof. For a functor F : J → C^{D}, the limit is the following functor ∏ F : D → C defined by

(∏ F)(d) = ∏ F_{d},

where F_{d} is a functor from J to C defined as F_{d}(i) = F (i)(d) and F_{d}(f) = F (f)(d) for objects i and morphism f : i → j in J.

Let μ be a natural transformation from ΔG to F. Define the natural transformation h_{μ} : G ⇒ ∏ F with the help of the unique morphisms h_{μ_{d}} : G(d) → ∏ F_{d} given by the universal property of ∏ F_{d} and μ_{d} : Δ(G(d)) ⇒ ∏ F_{d}, defined by (μ_{d})_{i} = (μ_{i})_{d}. □

Theorem 2.19 Given two natural isomorphic functors G and H from J to C then G has a (co)limit if and only if H has a (co)limit.

Proof. Let μ : G ⇒ H be the natural isomorphism from G to H with inverse μ^{−1} : H ⇒ G. Let c be a colimit of G and ι^{G} : G ⇒ Δc the co-cone morphisms. Then c is a colimit of H with co-cone morphisms ι^{H} = μ^{−1}; ι^{G}.

Given a natural transformation ν : H ⇒ Δc′ then ν̄ = μ; ν is a natural transformation from G to Δc′ and since (ι^{G}, c) is a colimit of G, there exists a unique homomorphism h : c → c′ with ι_{i}^{G}; h = ν̄_{i} for all i ∈ J. We have to show that also ι_{i}^{H}; h = ν_{i} for all i ∈ J holds. Let i be an object of J then

ι_{i}^{H}; h = μ_{i}^{−1}; ι^{G}; h | ι_{i}^{H} = μ_{i}^{−1}; ι_{i}^{G}
= μ_{i}^{−1}; ν̄_{i}  | ι_{i}^{G}; h = ν̄_{i}
= μ_{i}^{−1}; μ_{i}; ν_{i} | ν̄_{i} = μ_{i}; ν_{i}
= ν_{i}.

The proof for limits is analog. □

Theorem 2.20 Let G and H be two natural isomorphic functors from C to D then G preserves (co)limits if and only if H preserves (co)limits.

Proof. Assume that G preserves colimits. Given a functor F : J → C with colimit (ι^{F} , c) then (G; ι^{F} , G(c)) is a colimit of F; G. Since G and H are natural isomorphic with isomorphism μ : G ⇒ H, so are F; G and F; H with isomorphism F; μ and thus G(c) is a colimit of F; H. Because G(c) is isomorphic to H(c), H(c) is also a colimit of F; H with co-cone morphisms ι^{F;G}; μ_{c}.

The proof for limits is analog. □

2.4 Adjoints

Given two categories C and D. Two functors F : C → D and U : D → C form an adjunction if there is a bijection φ between the morphisms from c to U(d) and the morphisms from F (c) to d for each c ∈ C and d ∈ D:

[figure: c; f; U(d); F (c); φ(f); d] .

An example of an adjunction in the domain of algebraic specifications is the free term functor, which, given a signature Σ = (S, Ω), constructs the free term algebra T_{Σ}(X) of an S-indexed family of sets X, together with the forgetful functor that maps a Σ-algebra to its family of carrier sets (cf. Section 3.1).

Let C be the category of S-indexed families of sets Set^{S} and D the category Alg(Σ) of Σ-algebras. The functor U takes a Σ-algebra A and yields the S-indexed family of carrier sets of A. The functor F takes an S-indexed family of carrier sets X : S → Set and returns the free term algebra T_{Σ}(X) over X. The free term algebra has as carrier sets the smallest family of sets such that

• X(s) ⊆ T_{Σ}(X)(s) for s ∈ S and

• ω(t_{1}, …, t_{n}) ∈ T_{Σ}(X)(s) for all ω ∈ Ω(s_{1}, …, s_{n}, s), t_{i} ∈ T_{Σ}(X)(s_{i}), s in S and s_{i} in S for all 1 ≤ i ≤ n.

For operations ω in Ω(s_{1}, .., s_{n}, s) we define

T_{Σ}(X)(ω)(t_{1}, …, t_{n}) = ω(t_{1}, …, t_{n})

for each t_{i} ∈ T_{Σ}(s_{i}) and 1 ≤ i ≤ n.

Any S-indexed family of functions h between X and the carrier sets of a Σ-algebra B extends uniquely to a homomorphism φ(h) from T_{Σ}(X) to B by

• φ(h)_{s}(x) = h(x) for x ∈ X(s) and

• φ(h)_{s}(ω(t_{1}, …, t_{n})) = B(ω)(φ(h)_{s_{1}}(t_{1}), …, φ(h)_{s_{n}}(t_{n}))

for ω ∈ Ω(s_{1}, …, s_{n}, s), t_{i} ∈ T_{Σ}(X)_{s_{i}} and 1 ≤ i ≤ n.

On the other hand, if g is a homomorphism between T_{Σ}(X) and a Σ-algebra B then a family of functions φ^{−1}(g) is given by φ^{−1}(g)_{s}(x) = g_{s}(x) for all s ∈ S and x ∈ X(s).

Thus we have a bijection between natural transformations h : X ⇒ U(B), which are the morphisms in Set^{S} and homomorphisms φ(h) : T_{Σ}(X) → B:

[figure: X; h; U(B); T_{Σ}(X); φ(h); B] .

Definition 2.21 (Adjunction) An adjunction from a category C to a category D is a pair of functors F : C → D and U : D → C such that there exists a bijection φ between the collection of arrows from c to U(d) in C and the collection of arrows from F (c) to d in D for each object c ∈ C and d ∈ D, which is natural in c and d. The naturality conditions require that

\xymatrix{c \ar[dd]_{f_{1}} \ar[r]^{g_{1}} & U(d) \ar[dd]^{U(f_{2})} &  & F (c) \ar[dd]_{F (f_{1})} \ar[r]^{φ(g_{1})} & d \ar[dd]^{f_{2}} \\  &  & commutes if and only if \\ c′ \ar[r]_{g_{2}} & U(d′) &  & F (c′) \ar[r]_{φ(g_{2})} & d′}

commutes for morphisms g_{1}, g_{2} and f_{1} in C and f_{2} in D.

An alternative definition of an adjunction is:

Definition 2.22 Let U be a functor from D to C then the functor F : C → D is left adjoint for U, if there exists a natural transformation η : Id_{C} ⇒ F; U such that for every object d ∈ D and morphism f : c → U(d) in C there exists a unique morphism f̃: F (c) → d such that the following diagram commutes:

\xymatrix{c \ar[r]^{η_{c}} \ar[dr]_{f} & U(F (c)) \ar[d]^{U(f̃)} \\  & U(d)}

Similarly, let F be a functor from C to D then the functor U : D → C is right adjoint for F if there exists a natural transformation ϵ : U; F ⇒ Id_{D} such that for every object c ∈ C and arrow g : F (c) → d in D there exists a unique morphism g̃ : c → U(d) such that the following diagram commutes:

\xymatrix{d & F (U(d)) \ar[l]_{ϵ_{d}} \\  & F (c) \ar[ul]^{g} \ar[u]_{F (g̃)}}

Given an adjunction (F, U, φ) from C to D then F is a left adjoint for U and U is a right adjoint for F. We call the natural transformations η : Id_{C} ⇒ F; U the unit and ϵ : U; F ⇒ Id_{D} the co-unit of the adjunction.

Theorem 2.23 Given functors F : C → D and U : D → C. The following definitions are equivalent:

1. (F, U, φ) is an adjunction from C to D,

2. F is left adjoint for U and

3. U is right adjoint for F.

Proof. Let (F, U, φ) be an adjunction from C to D. Define η : Id_{C} ⇒ F; U by η_{c} = φ^{−1}(id_{F (c)}) for every object c ∈ C, and for a given morphism f : c → U(d) let f̃ = φ(f). The naturality of φ ensures that η is a natural transformation, that η_{c}; U(f̃) = f and that f̃ is unique with that property. This makes F a left adjoint for U.

Similarly, define ϵ : U; F ⇒ Id_{D} by ϵ_{d} = φ(id_{U(d)}) for every object d in D, and given a morphism g : F (c) → d in D let g̃ = φ^{−1}(g). This makes U a right adjoint for F.

On the other hand, if F is a left adjoint for U, define φ(f) = f̃ for every morphism f : c → U(d). Then naturality of φ is given by the uniqueness property of f̃ and the fact that η̃_{c} : F (c) → F (c) is the identity on F (c). Similarly, if U is right adjoint for F then φ^{−1}(g : F (c) → d) = g̃. □

Fact 2.24 Let (F, U, φ) be an adjunction from C to D and (F′, U′, φ′) an adjunction from D to D′. Then (F; F′, U′; U, φ; φ′) is an adjunction from C to D′.

This fact can be rephrased as follows: the composition F; F′ of a left adjoint F for U with a left adjoint F′ for U′ yields a left adjoint for U′; U and similar for right adjoints.

Theorem 2.25 A functor F preserves colimits if F has a right adjoint U.

Proof. Let (F, U, φ) be an adjunction from C to D and G : J → C a functor that has a colimit (ι^{G}, ∐ G). We want to show that F (∐ G) is a colimit of G; F with co-cone morphisms ι^{G}; F. Assume an object d in D and a natural transformation ν : G; F ⇒ Δd then we define a natural transformation ν′ : G ⇒ ΔU(d) by ν′_{i} = φ^{−1}(ν_{i}) for every i ∈ J. Because G has a colimit, there exists a unique morphism h from ∐ G to U(d) making for each i ∈ J the following diagram commute:

\xymatrix{∐ G \ar[r]|{h} & U(d) \\ G(i) \ar[u]^{ι_{i}^{G}} \ar@{-->}[ur]_{ν′_{i}=φ^{−1}(ν_{i})}}

Then φ(h) is a morphism from F (∐ G) to d and for each i ∈ J the following diagram commutes because of the naturality of φ:

\xymatrix{F (∐ G) \ar[r]^{φ(h)} & U(d) \\ F (G(i)) \ar[u]^{F (ι_{i}^{G})} \ar@{-->}[ur]_{ν_{i}}}

□

Note that if F has a right adjoint U then F is left adjoint to U. Thus the last theorem is equivalent to saying that left adjoint functors preserve colimits.

The dual of Theorem 2.25 is the following theorem:

Theorem 2.26 A functor U preserves limits if it has a left adjoint F.

2.5 Indexed Categories

In [58] Tarlecki, Burstall and Goguen develop indexed categories as a tool for theoretical computer science. An indexed category models in a uniform way a family of categories indexed by the objects of an index category. The morphisms in the index category generate additional relations between the component categories.

An example of an indexed category is the family of the categories of Σ-algebras Alg(Σ) for each many-sorted signature Σ. The index category is the category of many-sorted signatures Sig and the component categories are the categories of Σ-algebras Alg(Σ). For each signature morphism σ : Σ → Σ′ in Sig there exists a functor Alg(σ) : Alg(Σ′) → Alg(Σ), the σ-reduct (cf. Section 3.1).

Each indexed category has associated a single category given by the disjoint union of the objects of the component categories plus some additional morphisms. This category is the flat category associated with an indexed category. Together with a projection functor from the flat category to the index category, which assigns to each object in the flat category the index of the category where it originates from, this yields the “fibered category” presented by the indexed category (cf. Grothendieck [31]).

An indexed category C indexed by a category E is a family of categories C_{e} for each e ∈ E and a family of functors C_{f} from C_{e′} to C_{e} for each morphism f : e → e′ in E such that C_{id_{e}} is the identity functor Id_{C_{e}} and if f : e → e′ and g : e′ → e′′ are morphisms in E then C_{f;g} = C_{g}; C_{f}.

Thus an indexed category C determines a contravariant functor C from E to Cat defined by C(e) = C_{e} and C(f) = C_{f} for each object e and morphism f in E.

Flattening an indexed category C yields the category Flat(C), whose collection of objects is the disjoint union of the collection of objects of C_{e} for every e ∈ E. Thus the objects of Flat(C) are pairs (e, c) where e is an object of E and c is an object of C_{e}. An arrow from (e, c) to (e′, c′) in Flat(C) is a pair (f, g) where f : e → e′ is a morphism in E and g : c → C_{g}(c′) is a morphism in C_{e}. The identity of an object (e, c) in Flat(C) is the pair (id_{e}, id_{c}). The composition of two arrows (f_{1}, g_{1}) from (e, c) to (e′, c′) and (f_{2}, g_{2}) from (e′, c′) to (e′′, c′′) is given by (f_{1}; f_{2}, g_{1}; C_{f_{1}}(g_{2})).

\xymatrix{c \ar[r]^{g_{1}} & C_{f_{1}}(c′) \ar[r]^{C_{f_{1}}(g_{2})} & C_{f_{1}}(C_{f_{2}}(c′′)) \\  & c′ \ar@{|->}[u] \ar[r]_{g_{2}} & C_{f_{2}}(c′′) \ar@{|->}[u]}

Flattening the indexed category Alg : Sign^{op} → Cat yields the category Flat(Alg). Objects in Flat(Alg) are pairs (Σ, A) where Σ is a signature and A is a Σ-algebra. Morphisms from (Σ, A) to (Σ′, A′) in Flat(Alg) are pairs (σ, h) where σ is a signature morphism from Σ to Σ′ and h is a homomorphism from A to A|_{σ}.

Another example of flattening an indexed category is the category of many-sorted signatures Sig (cf. Section 3.1). The indexed category MS is a contravariant functor MS : Set^{op} → Cat. An object Ω in MS_{S} is an S^{+} indexed family of operation symbols, that is, an element of Set^{S^{+}}. A function σ_{s} : S → S′ induces a function \overline{σ}_{s} from S^{+} to S′^{+} by \overline{σ}_{s}(s_{1}, …, s_{n}) = σ_{s}(s_{1}), …, σ_{s}(s_{n}). Then MS_{σ_{s}} is a functor from Set^{S′^{+}} to Set^{S^{+}} given by MS_{σ_{s}}(Ω′) = \overline{σ}_{s}; Ω′, that is, MS_{σ_{s}}(Ω′)(w) = Ω′(\overline{σ}_{s}(w)) for every w ∈ S^{+}, and MS_{σ_{s}}(σ_{Ω}) = \overline{σ}_{s} for a natural transformation σ_{Ω} : Ω_{1} ⇒ Ω_{2}, that is, MS_{σ_{s}}(σ_{Ω})_{w} = (σ_{Ω})_{\overline{σ}_{s}(w)} for every w ∈ S^{+}.

Then Flat(MS) has as objects pairs (S, Ω) where S is a set and Ω is an S^{+}-indexed family of operations names. A morphism from (S, Ω) to (S′, Ω′) in Flat(MS) is a pair (σ_{s}, σ_{Ω}) where σ_{s} is a function from S to S′ and σ_{Ω} a natural transformation from Ω to MS_{σ_{s}}(Ω′), which is an S^{+} indexed family of functions (σ_{Ω})_{w} : Ω(w) → Ω′(\overline{σ}_{s}(w)), mapping operation symbols of type w in Ω to operations symbols of type \overline{σ}_{s}(w) in Ω′. Thus Flat(MS) is the category of many-sorted signatures Sig.

Similar to indexed categories one can define indexed functors between indexed categories. An indexed functor F : C → D with index category E is a family of functors F_{e} : C_{e} → D_{e} such the following diagram commutes

\xymatrix{C_{e} \ar[d]_{F_{e}} & C_{e′} \ar[l]_{C_{f}} \ar[d]^{F_{e′}} \\ D_{e} & D_{e′} \ar[l]^{D_{f}}}

for all morphisms f : e → e′ in E. In other words, F s a natural transformation between the indexed categories C : E^{op} → Cat and D : E^{op} → Cat.

As with indexed categories, we can flatten an indexed functor, which yields the functor Flat(F) : Flat(C) → Flat(D) given by

• Flat(F)((e, c)) = F_{e}(c) and

• Flat(F)((f, g)) = (f, F_{e}(g))

for each object (e, c) and morphism (f, g) : (e, c) → (e′, c′) in Flat(C). F_{e}(g) is indeed a morphism from F_{e}(c) to C_{f}(F_{e′}(c′)) because, by the definition of indexed functors, F_{e′}; D_{f} is the same as C_{f}; F_{e}.

The limit of a functor F : J → Flat(C) in Flat(C) is a pair (e, c) where e is the limit of the projection of F to the objects and morphisms in E; this requires E to have limits of shape J. The object c in C_{e} is given by the limit of the functor \overline{F} : J → C_{e}, which is defined by constructing for each i ∈ J and F (i) = (e_{i}, c_{i}) an appropriate object \overline{c}_{i} in C_{e}. This requires that C_{e} has colimits of shape J.

Theorem 2.27 (Tarlecki, Burstall and Goguen [58]) Given an indexed category C with index the category E. The category Flat(C) has limits of shape J if

• E has limits of shape J and

• the category C_{e} has limits of shape J for every e ∈ E.

• the functor C_{f} : C_{e′} → C_{e} preserves limits of shape J for every morphism f : e → e′ in E.

Proof. Let F be a functor from J to Flat(C). Let F (i) be (e_{i}, c_{i}) where e_{i} ∈ E and c_{i} ∈ C_{e_{i}} for i ∈ J and let F (f) be (f^{f} : e_{i} → e_{j}, f^{g} : c_{i} → C_{f^{f}} (c_{j})) for f : i → j ∈ J.

To construct the limit (e, c) of F, we first construct the limit of the functor F_{E} : J → E defined by F_{E}(i) = e_{i} and F_{E}(f) = f^{f}. The limit e of F_{E} exists because E has limits of shape J.

In the next step we define a functor \overline{F} : J → C_{e} by \overline{F} (i) = C_{π_{i}^{F_{E}}} (c_{i}) for i ∈ J and \overline{F} (f) = C_{π_{i}^{F_{E}}} (f^{g}) for f : i → j ∈ J.

Note that f^{g} is a morphism from c_{i} to C_{f^{f}} (c_{j}) in C_{i} and C_{π_{i}^{F_{E}}} maps f^{g} to a morphism from

C_{π_{i}^{F_{E}}} (c_{i}) to C_{π_{i}^{F_{E}}} (C_{f^{f}} (c_{j})) in C_{e}. Because we have π_{i}^{F_{E}}; f^{f} = π_{j}^{F_{E}} we get

C_{π_{i}^{F_{E}}} (C_{f^{f}} (c_{j})) = C_{π_{i}^{F_{E}};f^{f}} (c_{j}) = C_{π_{j}^{F_{E}}} (c_{j})

and thus \overline{F} is well-defined.

Now the limit (e, c) of F is given by the limit e of F_{E} in E and the limit c of \overline{F} in C_{e}, which exists because C_{i} has limits of shape J for all i ∈ J. The cone morphisms π_{i}^{F} : (e, c) → (e_{i}, c_{i}) are given by the pairs (π_{i}^{F_{E}}, π\overline{F} ; i) for each i ∈ J.

To show that (e, c) is indeed a limit of F, consider a natural transformation μ : Δ(e′, c′) ⇒ (e, c). Then we have to show that there exists a unique morphism h = (h^{f}, h^{g}) from (e′, c′) such that the following diagram commutes for all i ∈ J:

\xymatrix{(e, c) \ar[d]_{(π_{i}^{F_{E}} ,π\overline{F} ; i)} & (e′, c′) \ar[l]_{(h^{f} ,h^{g})} \ar[dl]^{(μ_{i}^{f} ,μ_{i}^{g})} \\ (e_{i}, c_{i})}

That is, we have to show that the following two diagrams commute for all i ∈ J:

\xymatrix{e \ar[d]_{π_{i}^{F_{E}}} & e′ \ar[l]_{h^{f}} \ar[dl]^{μ_{i}^{f}} \\ e_{i}} and \xymatrix{C_{h^{f}} (c) \ar[d]_{C_{h^{f}} (π\overline{F} ; i)} & c′ \ar[l]_{h^{g}} \ar[dl]^{μ_{i}^{g}} \\ C_{μ_{i}^{f}} (c_{i})}

The morphism h^{f} : e → e′ with the property h^{f}; π_{i}^{F_{E}} = μ_{i}^{f} for all i ∈ J is uniquely given by the limit property of e with respect to F_{E} and the natural transformation given by the family of morphisms μ_{i}^{f} : e′ → e_{i} for all i ∈ J.

Now we have to find h^{g} : c′ → C_{h^{f}} (c). Since C_{g} preserves limits of shape J for all g : e_{1} → e_{2} in E, we know that C_{h^{f}} (c) is a limit of the functor \overline{F}; C_{h^{f}}. Further, because h^{f}; π_{i}^{F_{E}} = μ_{i}^{f}, we get

C_{μ_{i}^{f}} (c_{i}) = C_{h^{f};π_{i}^{F_{E}}} (c_{i}) = C_{h^{f}} (\overline{F} (i)).

Thus, μ_{i}^{g} : c′ → C_{μ_{i}^{f}} (c_{i}) for i ∈ J is also a family of morphisms from c′ to C_{h^{f}} (\overline{F} (i)). Using the limit property of \overline{F}; C_{h^{f}} we get a morphism h^{g} : c′ → C_{h^{f}} (c), unique with the property

h^{g}; C_{h^{f}} (π\overline{F} ; i) = μ_{i}^{g} for all i ∈ J:

\xymatrix{C_{h^{f}} (c) \ar[d]_{C_{h^{f}} (π\overline{F} ; i)} & c′ \ar[l]_{h^{g}} \ar[dl]^{μ_{i}^{g}} \\ C_{h^{f}} (\overline{F} (i))}

□

We can use the last theorem to check if the category of many-sorted signatures has limits of shape J. To apply the theorem we have to check that Set has limits of shape J and that Set^{S^{+}} has limits of shape J. We have seen in the previous sections that Set is complete and thus has limits for all categories J and that Set^{S^{+}} has limits of shape J if Set has limits of shape J.

It remains to show that MS_{σ_{S}} : Set^{S′^{+}} → Set^{S^{+}} preserves limits for every function σ_{S} : S → S′. Let Ω′ be the limit of the functor F : J → Set^{S′^{+}} and Ω be the limit of the functor F; MS_{σ_{S}}. It suffices if we can show that MS_{σ_{S}}(Ω′) = σ_{S}; Ω′ is the same as Ω.

By the construction of limits in functor categories we get Ω′(w′) = ∏_{J} F_{w′} where F_{w′}(i) = F (w′)(i) and F_{w′}(f) = F (f)_{w′} for all w′ ∈ S′^{+}, f : i → j ∈ J and i ∈ J. Further, for each w ∈ S^{+} we have Ω(w) = ∏_{J}(F; MS_{σ_{S}})_{w} where (F; MS_{σ_{S}})_{w}(i) = (F; MS_{σ_{S}})(i)(w) = F (i)(σ_{S}(w)) and (F; MS_{σ_{S}})_{w}(f) = F (f)_{σ_{S}(w)} for each f : i → j ∈ J and i ∈ J

Thus for every w ∈ S^{+} we have

(σ_{S}; Ω′)(w) = Ω′(σ_{S}(w)) = ∏_{J} F_{σ_{S}(w)} = ∏_{J}(F; MS_{σ_{S}})_{w} = Ω(w).

As a result we get Sig = Flat(MS) has limits of shape J for all categories J, in other words, Sig is complete.

Note that the terminal object Σ_{⊤} in Sig is ({1}, Ω_{⊤}) where Ω_{⊤} : {1}^{+} → Set maps each non-empty word over {1} to the one element set. Thus Σ_{⊤} is a signature with one sort and infinite many operation symbols, for each possible function type one.

Colimits in Flat(C) can be constructed in a similar way as limits, that is, as colimits of functors F_{E} : J → E and \overline{F} : J → C_{e}. However, there is one problem in defining \overline{F}. Since the co-cone morphism ι_{i}^{F_{E}} is a morphism from e_{i} to e and thus C_{ι_{i}^{F_{E}}} is a functor from C_{e} to

C_{e_{i}}, we cannot use C_{ι_{i}^{F_{E}}} to define \overline{F} (i). A solution to this problem is to require that each functor C_{f} : C_{e′} → C_{e} has a left adjoint L_{f} : C_{e} → C_{e′} for each f : e → e′ in E.

Note that, because C_{f} is required to have a left adjoint, C_{f} preserves limits; however, this property is not used in the following proof.

Theorem 2.28 (Tarlecki, Burstall and Goguen [58]) Given an indexed category C with index the category E. The category Flat(C) is cocomplete if • E is cocomplete,

• the category C_{e} is cocomplete for every e ∈ E and

• the functor C_{f} : C_{e′} → C_{e} has a left adjoint for every morphism f : e → e′ in E.

Proof. Let C be an indexed category from E to Cat and F a functor from J to Flat(C). Let further F (i) be (e_{i}, c_{i}) where e_{i} ∈ E and c_{i} ∈ C_{e_{i}} for i ∈ J and let F (f : i → j) be (f^{f} : e_{i} → e_{j}, f^{g} : c_{i} → C_{f^{f}} (c_{j})) for f ∈ J.

To construct the colimit (e, c) of F we first construct the colimit of the functor F_{E} : J → E defined by F_{E}(i) = e_{i} and F_{E}(f) = f^{f}. Since we have assumed that E is cocomplete, the colimit e of F_{E} with co-cone morphisms ι_{i} : e_{i} → e exists.

Then each c_{i} is translated by the left adjoint of C_{ι_{i}} to an object c̄_{i} of C_{e} and each morphism f^{g} : c_{i} → C_{f^{f}} (c_{j}) gives rise to a unique morphism f̄^{g} from c̄_{i} to c̄_{j} by the universal property of c̄_{i}. Note that ι_{i} = f^{f}; ι_{j} because ι_{i} and ι_{j} are co-cone morphism, which implies that C_{ι_{i}} and C_{ι_{j}}; C_{f^{f}} are the same. Let η_{c_{j}} be the unit morphism from c_{j} to C_{ι_{j}}(c̄_{j}) given by the left adjoint of C_{ι_{j}}. Then, for the morphism f^{g}; C_{f^{f}} (η_{c_{j}}) from c_{i} to C_{f^{f}} (C_{ι_{j}}(c̄_{j}) = C_{ι_{i}}(c̄_{j}) there exists a unique morphism f̄^{g} from c̄_{i} to c̄_{j} such that the following diagram commutes:

\xymatrix{c_{i} \ar[rr]^{η_{c_{i}}} \ar[dr]_{f^{g}} &  & C_{ι_{i}}(c̄_{i}) \ar[d]^{C_{ι_{i}}(f̄^{g})} \\  & C_{f^{f}} (c_{j}) \ar[r]_{C_{f^{f}} (η_{c_{j}})} & C_{ι_{i}}(c̄_{j})}

Thus the functor F : J → Flat(C) gives rise to a functor F̄ : J → C_{e} by F̄(i) = c̄_{i} and F̄(f) = f̄^{g}. Then c is the colimit of F̄, which exists since we have assumed that C_{e} is cocomplete. The co-cone morphisms of the colimit of F are the pairs (ι_{i}, ι_{i}^{F}) given by the co-cone morphisms of F_{E} and F̄ where ι_{i}^{F} from c_{i} to C_{ι_{i}}(c) is η_{c_{i}}; C_{ι_{i}}(ιF̄ ; i).

To show that (e, c) is a colimit of F, consider a natural transformation μ : F → Δ(e′, c′). Then we have to show the existence of a unique morphism h = (h^{f}, h^{g}) from (e, c) to (e′, c′) such that the following diagram commutes for all i ∈ J:

\xymatrix{(e, c) \ar[r]^{(h^{f} ,h^{g})} & (e′, c′) \\ (e_{i}, c_{i}) \ar[u]^{(ι_{i},ι_{i}^{F})} \ar@{-->}[ur]_{(μ_{i}^{f} ,μ_{i}^{g})}}

that is, we have to show

\xymatrix{e \ar[r]^{h^{f}} & e′ \\ e_{i} \ar[u]^{ι_{i}} \ar[ur]_{μ_{i}^{f}}} and \xymatrix{C_{ι_{i}}(c) \ar[r]^{C_{ι_{i}}(h^{g})} & C_{ι_{i}}(C_{h^{f}} (c′)) \\ c_{i} \ar[u]^{ι_{i}^{F}} \ar[ur]_{μ_{i}^{g}}}

The morphism h^{f} is given unique with the above property by the colimit property of e with respect to the functor F_{E} and the natural transformation given by the family of functions μ_{i}^{f} for each i ∈ J.

The morphism h^{g} : c → C_{h^{f}} (c′) is given by colimit property of c with respect to F̄ and the natural transformation given by μ̃_{i}^{g} : F̄(i) → C_{h^{f}} (c′) for each i ∈ J:

\xymatrix{c \ar[r]^{h^{g}} & C_{h^{f}} (c′) \\ c̄_{i} \ar[u]^{ιF̄ ; i} \ar[ur]_{μ̃_{i}^{g}}}

We get μ̃_{i}^{g} by the left adjoint of C_{ι_{i}}. First note that C_{μ^{f}} (c′) = C_{ι_{i}}(C_{h^{f}} (c′)) because ι_{i}; h^{f} = μ_{i}^{f} by the colimit property of e. Since c̄_{i} is a free extension of c_{i} with respect to C_{ι_{i}}, we can extend a morphism μ_{i}^{g} : c_{i} → C_{ι_{i}}(C_{h^{f}} (c′)) in a unique way to a morphism μ̃_{i}^{g} : c̄_{i} → C_{h^{f}} (c′) such that the following diagram commutes:

\xymatrix{c_{i} \ar[r]^{η_{c_{i}}} \ar[dr]_{μ_{i}^{g}} & C_{ι_{i}}(c̄_{i}) \ar[d]^{C_{ι_{i}}(μ̃_{i}^{g})} \\  & C_{ι_{i}}(C_{h_{f}} (c′))}

The following diagram is a combination of the last two diagrams where the first diagram is translated by C_{ι_{i}}:

\xymatrix{C_{ι_{i}}(c) \ar[r]^{C_{ι_{i}}(h^{g})} & C_{ι_{i}}(C_{h^{f}} (c′)) \\ C_{ι_{i}}(c̄_{i}) \ar[u]^{C_{ι_{i}}(ιF̄ ; i)} \ar@{-->}[ur]^{C_{ι_{i}}(μ̃_{i}^{g})} \\ c_{i} \ar[u]^{η_{c_{i}}} \ar[uur]_{μ_{i}^{g}}}

Note that ι_{i}^{F} is defined as η_{c_{i}}; C_{ι_{i}}(ιF̄ ; i) and thus we get ι_{i}^{F}; C_{ι_{i}}(h^{g}) = μ_{i}^{g}, which finishes our proof. □

To show that the category of many-sorted signatures has colimits of shape J, we have to show that Set has colimits of shape J, that Set^{S^{+}} has colimits of shape J for each set S and that each functor MS_{σ_{s}} : Set^{S′^{+}} → Set^{S^{+}} has a left adjoint L_{σ_{s}} : Set^{S^{+}} → Set^{S′^{+}}. Set is cocomplete for categories J and Set^{S^{+}} has colimits of shape J, whenever Set has colimits of shape J. Thus it remains to show that each functor MS_{σ_{s}} has a left adjoint L_{σ_{s}}.

Given a family of operation symbols Ω : S → Set, we define a family of operation symbols Ω′ : S′ → Set by letting Ω′(w′) be the disjoint union of all sets Ω(w) such that \overline{σ}_{s}(w) = w′ for all w′ ∈ S′^{+}. If there is no such w then Ω′(w′) is the empty set. Given a natural transformation σ_{Ω}; Ω_{1} ⇒ Ω_{2} in Set^{S^{+}} then L_{σ_{s}}(σ_{Ω}) is a natural transformation from L_{σ_{s}}(Ω_{1}) to L_{σ_{s}}(Ω_{2}). Let w′ be a non-empty word over S′ and op an operation symbol in L_{σ_{s}}(Ω_{1})(w′) then L_{σ_{s}}(σ_{Ω})_{w′}(op) = (σ_{Ω})_{w}(op) if op ∈ Ω_{1}(w) and \overline{σ}_{s}(w) = w′.

The unit morphism μ : Id_{Ω} ⇒ L_{σ_{s}} is the family of inclusions of Ω_{w} into L_{σ_{s}}(Ω)_{\overline{σ}_{s}(w)} for every w ∈ S^{+}.

Given a functor F : J → Sig with F (i) = (S_{i}, Ω_{i}) for i ∈ J and F (f) = (σ_{s}^{f}, σ_{Ω}^{f}) for f : i → j in J then the colimit of F is given as (S, Ω) where S is the colimit of F_{S} defined by F_{S}(i) = S_{i} and F_{S}(f) = σ_{s} and Ω is the colimit of the functor \overline{F} : J → Set^{S^{+}} defined by \overline{F} (f)_{w}(op) = L_{σ_{s}}(f)_{w}(op) for all w ∈ S^{+} and op ∈ \overline{F} (i)(w).

3 Institutions

The notion of institutions is an attempt to formalize the informal notion of a logical system and was developed by Goguen and Burstall [25] as a means to define the semantics of the specification language Clear [13] independent from a particular logic. Many constructs and results in the theory of abstract datatypes are independent of the underlying logical system, and in Chapter 4 we shall give a brief presentation of these constructs and results.

The main aspect of an institution is the notion of satisfaction between formulas and models. Both, formulas and models are given with respect to a certain vocabulary, called signature. Signatures are related by signature morphisms and induce a translation from formulas over one signature to formulas over the other, going in the direction of the signature morphism, and a translation of models in the reverse direction. We require that the notion of satisfaction is compatible with these translations; this requirement is called the satisfaction condition.

The notion of institutions does not cover proof theoretic aspects of a logical system like, for example, a deduction system. To address this problem, for example, Meseguer [44] combines institutions with entailment systems.

The main construction of this thesis will be the institution R_{I} presented in Section 5.3, which is parameterized by a another suitable institution I.

Here, we will only recall the definition of institutions; for more details see the article by Goguen and Burstall [25].

Definition 3.1 (Institution) An institution I = ⟨Sign_{I}, Str_{I}, Sen_{I}, ⊧^{I}⟩ consists of

• a category of signatures Sign_{I},

• a contravariant functor Str_{I} : Sign_{I}^{op} → Cat assigning to each signature Σ the category of Σ-structures and to each signature morphism σ : Σ → Σ′ a forgetful functor |_{σ} : Str_{I}(Σ′) → Str_{I}(Σ),

• a functor Sen_{I} : Sign_{I} → Set assigning to each signature Σ the set of Σ-formulas and to each signature morphism σ : Σ → Σ′ a translation \overline{σ} of Σ-formulas to Σ′-formulas, and

• a family of satisfaction relations ⊧^{I}_{Σ} ⊆ Str_{I}(Σ) × Sen_{I}(Σ) for Σ ∈ Sign_{I} indicating whether a Σ-formula φ is valid in a Σ-structure m, written m ⊧^{I}_{Σ} φ or for short m ⊧^{I} φ,

such that the satisfaction condition holds: for all signature morphisms σ : Σ → Σ′, formulas φ ∈ Sen_{I}(Σ), and structures m′ ∈ Str_{I}(Σ′) we have

m′|_{σ} ⊧^{I} φ if and only if m′ ⊧^{I} \overline{σ}(φ).

For notational convenience we may write M ⊧^{I} φ for a class of Σ-structures and a Σ-formula instead of ∀m ∈ M.m ⊧^{I} φ, and similar for m ⊧^{I} Φ and M ⊧^{I} Φ for a set Φ of Σ-formulas. We may also write Φ ⊧^{I} Φ′ for two sets of Σ-formulas Φ and Φ′ to denote that if m ⊧^{I} Φ then m ⊧^{I} Φ′ for all m ∈ Str_{I}(Σ). We shall omit the superscript I if the institution is clear from the context.

In the following sections we give three examples of institutions. The first section presents the well-known institution of equational logic EQ. Using the techniques of Goguen and Burstall [25], we add data– and partitioned-by constraints to EQ and get the institution EQC.

The last section introduces the institution LSL, which formalizes the logical system underlying the Larch Shared Language [34]. The Larch Shared Language will be used in some of our examples. The main difference of LSL with respect to EQC is that signatures in LSL contain the sort bool with its usual operations, and that for each sort in the signature we have the equality as a boolean function. The structures in LSL are those algebras where these symbols have their usual meaning. This makes it quite convenient to write specifications in LSL; however, since the sort bool with its operations and the equality can be specified using equations and constraints, we can use EQC to reason about specifications in LSL (cf. Theorem 3.42).

Another example of an institution is the institution SET presented in Section 9.1, which formalizes the logical system underlying the specification language Z [56].

3.1 Equational Logic

To pave the road for the definition of the institution LSL in Section 3.4, we shall first present the institutions EQ of equational logic and EQC of equational logic with constraints. Signatures in these institutions are many sorted signatures, structures are algebras, and formulas are equations ∀X s = t. In addition to equations EQC has generating and partitioned-by constraints as formulas.

The institutions for equational logic and equational logic with data-constraints are already given in Goguen and Burstall [25]. Adding partitioned-by constraints and the institution LSL are new.

Signatures

Definition 3.2 (Many-sorted Signatures) A many sorted signature Σ = (S, Ω) consists of a set S of sorts and a functor Ω : S^{∗} × S → Set mapping pairs (w, s) to sets of operation symbols Ω(w, s). We require that for all w ∈ S^{∗} and s, s′ ∈ S we have Ω(w, s) ∩ Ω(w, s′) = {}. For an operation symbol ω ∈ Ω(w, s) we shall write ω : w → s. If w is the empty string, ω is called a constant of sort s and we write ω : s. A signature is finite if the set of sorts and the union of all Ω(w, s) is finite.

A signature morphism σ from (S, Ω) to (S′, Ω′) is a pair of a function σ : S → S′ and a natural transformation σ : Ω ⇒ σ̂; Ω′ where σ̂ is the extension of σ : S → S′ to a function σ̂ : S^{∗} × S → S′^{∗} × S′ given by

σ̂((s_{1} … s_{n}), s) = (σ(s_{1}) … σ(s_{n}), σ(s)),

that is, σ is an S^{∗} × S indexed family of functions

σ_{(w,s)} : Ω((w, s)) → Ω(σ̂((w, s))).

We do not require that the sets Ω(w, s) are disjoint. This allows us to overload operation names, that is, have the same operation symbol with different types. A possible application is the use of the same symbol + for the addition of natural numbers and for the addition of integers.

However, to ensure that certain constructions on terms, like the evaluation of terms, are well-defined, we need that the sets of terms of sort s ∈ S are disjoint. A sufficient criteria is that the sets Ω(w, s) and Ω(w, s′) are disjoint for all w ∈ S^{∗} and s, s′ ∈ S (cf. Loeckx et al. [42]).

Note that in the definition of Ω as a functor from S^{∗} × S to Set, S^{∗} × S is viewed a discrete category.

The category Sig has as objects many-sorted signatures and as arrows signature-morphisms. The category FSig has as objects finite many-sorted signatures and is a full subcategory of Sig.

The following fact is well-known, for example [19]:

Fact 3.3 The category Sig is cocomplete.

Proof. Let F : J → Sig be a functor with F (i) = (S_{i}, Ω_{i}) and F (f : i → j) = σ_{f} : (S_{i}, Ω_{i}) → (S_{j}, Ω_{j}) for i and f : i → j in J. In the following we construct the colimit (S_{cl}, Ω_{cl}) of F with the co-cone morphisms ι_{i}^{F}. The set S_{cl} is given by the colimit of the functor F_{S} : J → Set, and Ω_{cl} : S_{cl}^{∗} × S_{cl} → Set is the colimit of the functor F_{Ω} : J → Set^{S_{cl}^{∗} ×S_{cl}}.

F_{S}(i) is S_{i} for objects i of J, and F_{S}(f) is the sort function of σ_{f} for arrows f of J.

Let (w, s) be an element of S_{cl}^{∗} ×S_{cl}, then F_{Ω}(i)(w, s) is the disjoint union of all sets Ω_{i}(w_{i}, s_{i}) with ι_{i}^{F_{S}}(w_{i}, s_{i}) = (w, s) for some (w_{i}, s_{s}i) ∈ S_{i}^{+}.

F_{Ω}(f : i → j)(w, s) is the extension of the family of functions σ_{f}(w_{i}, s_{i}) : Ω((w_{i}, s_{i})) → Ω(σ_{f}((w_{i}, s_{i}))) with ι_{i}^{F_{S}}((w_{i}, s_{i})) = (w, s) to a function from F_{Ω}(i)(w, s) to F_{Ω}(j)(w, s).

We have to take the disjoint union because we did not require the Ω_{i}(w_{i}, s_{i}) to be disjoint, and if ι_{i}^{F_{S}} identifies sorts, then two operators with the same name but different sorts could be mapped to the same operator. Note that the colimit of F_{Ω} exists since the functor category Set^{S_{cl}^{∗} ×S_{cl}} is cocomplete because Set is cocomplete (cf. Fact 2.4).

The sort part of the co-cone morphisms ι_{i}^{F} is given by the co-cone morphism ι_{i}^{F_{S}} : S_{i} → S_{cl}, and the operation part is the composition of the inclusion of Ω_{i}(w_{i}, s_{i}) into F_{Ω}(i)(w, s) with ι_{i}^{F_{Ω}^{w,s}} for every i in J.

Then the colimit property of (S_{cl}, Ω_{cl}) is a consequence of the definition of S_{cl} and Ω_{cl} as colimits of F_{S} and F_{Ω}. □

The initial object in Sig is Σ_{⊥} = ({}, Ω_{⊥}) where Ω_{⊥} is the unique function from {} to Set because {} is the initial object in Set.

Pushouts (S_{po}, Ω_{po}) for functors

\xymatrix{Σ(1) &  & Σ(2) \\  & Σ(0) \ar@{-->}[ul]^{σ_{1}} \ar@{-->}[ur]_{σ_{2}}}

are given by the following pushouts in Set:

\xymatrix{ & S_{po} \\ S_{1} \ar@{-->}[ur]^{ι_{1}} & & S_{2} \ar@{-->}[ul]_{ι_{2}} \\ & S_{0} \ar[ul]^{σ_{1}} \ar[ur]_{σ_{2}} \ar@{-->}[uu]_{ι_{0}}} and \xymatrix{ & Ω_{po}(w, s) \\ \overline{Ω}_{1}(w, s) \ar@{-->}[ur]^{ι_{1}(w,s)} & & \overline{Ω}_{2}(w, s) \ar@{-->}[ul]_{ι_{2}(w,s)} \\ & \overline{Ω}_{0}(w, s) \ar@{-->}[ul]^{\overline{σ}_{1}(w,s)} \ar@{-->}[ur]_{\overline{σ}_{2}(w,s)}}

where \overline{Ω}_{i}(w, s) is the disjoint union of all Ω_{i}(w_{i}, s_{i}) such that ι_{i}(w_{i}, s_{i}) = (w, s) for every (w, s) ∈ S_{po}^{∗} × S_{po}, (w_{i}, s_{i}) ∈ S_{i}^{∗} × S_{i}, and i ∈ {0, 1, 2}.

The union of signatures Σ_{1} ∪ Σ_{2} where Σ_{i} = (S_{i}, Ω_{i}) for i ∈ {1, 2} is the signature (S, Ω) where S is the union of S_{1} and S_{2}, and Ω(w, s) = Ω̄_{1}(w, s) ∪ Ω̄_{2}(w, s) for w ∈ S^{∗} and s ∈ S.

Ω̄_{i} is the extension of Ω_{i} from an S_{i}^{∗} × S_{i}-indexed family of sets to an S^{∗} × S-indexed family of sets and is given by Ω̄_{i}(w, s) = Ω_{i}(w, s) if (w, s) ∈ S_{i}^{∗} × S_{i} and Ω(w, s) = {} otherwise for i ∈ {1, 2}.

Note that the union of signatures can be viewed as a pushout of Σ_{1} and Σ_{2} with respect to Σ_{1} ∩ Σ_{2} and the inclusions of Σ_{1} ∩ Σ_{2} into Σ_{1} and Σ_{2}, respectively, where Σ_{1} ∩ Σ_{2} has as sorts S = S_{1} ∩ S_{2} and as operations Ω(w, s) = Ω_{1}(w, s) ∩ Ω_{2}(w, s) for (w, s) ∈ S^{∗} × S.

Note that the colimit of an infinite diagram of signatures, in general, is not a finite signature. For instance, consider a functor F : J → Sig where J is an infinite, discrete category. For each i ∈ J, F (i) is the signature ({s}, {ω : s → s}). By the construction of colimits in Sig the colimit of F is a signature with sorts the set {(i, s) | i ∈ J} and operations {(i, ω) : (i, s) → (i, s) | i ∈ J}. Since J is infinite, the resulting signature has infinitely many sorts and operations. Thus, while Sig is cocomplete, FSig is only finitely cocomplete.

Algebras

Definition 3.4 (Algebras and Homomorphisms) Let Σ = (S, Ω) be a signature. A Σ-algebra A consists of a functor A from the set S, viewed as a discrete category, to Set mapping each sort s in S to its carrier set A(s), together with a family of total functions A(ω) from A(w) to A(s) for each ω ∈ Ω(w, s) where A(w) = A(s_{1}) × … × A(s_{n}) for w = s_{1} … s_{n}.

A Σ-homomorphism h : A → B is a natural transformation h : A ⇒ B between the functors A and B from S to Set compatible with the operations in Ω, that is, for each ω : w → s and a_{1}, …, a_{n} in A(w)

h_{s}(A(ω)(a_{1}, …, a_{n})) = B(ω)(h_{s_{1}}(a_{1}), …, h_{s_{n}}(a_{n})).

Σ-algebras and Σ-homomorphisms form the category Alg(Σ). A homomorphism h : A → B is an isomorphism if h_{s} is an isomorphism between A(s) and B(s) for every sort s. Two algebras A and B are isomorphic if there exists an isomorphism h : A → B.

The forgetful functor U_{Σ} from the category of Σ-algebras to the functor category Set^{S} maps Σ-algebras A to their family of carrier sets and Σ-homomorphisms h : A → B to their natural transformations h : A ⇒ B between their family of carrier sets.

Definition 3.5 (σ-Reduct) Given a signature morphism σ from (S, Ω) to (S′, Ω′) and a Σ′-algebra A, the σ-reduct of A, written A|_{σ}, is the Σ-algebra defined by

A|_{σ} = σ; A
(A|_{σ})(ω) = A(σ(ω)) for all ω : w → s and (w, s) ∈ S^{+}.

For each Σ′-homomorphism h : A → B a Σ-homomorphism h|_{σ} : A|_{σ} → B|_{σ} is defined by

h|_{σ} = σ; h.

The σ-reduct is a functor from the category of Σ′-algebras to the category of Σ-algebras.

Definition 3.6 (Alg) Alg is a contravariant functor from Sig to Cat mapping every signature Σ to the category of Σ-algebras Alg(Σ) and every signature morphism σ : Σ → Σ′ to the functor |_{σ} : Alg(Σ′) → Alg(Σ).

Equations

Definition 3.7 (Term-algebra) Let Σ = (S, Ω) be a signature and X an S-indexed family of sets, the term algebra T_{Σ}(X) has as carrier sets the smallest S-indexed family of sets such that

X(s) ⊆ T_{Σ}(X)(s) for each s ∈ S and
ω(t_{1}, …, t_{n}) ∈ T_{Σ}(X)(s) for each ω : w → s in Ω and t_{1}, …, t_{n} ∈ T_{Σ}(X)(w)

and for every operation symbol ω : w → s in Ω

T_{Σ}(X)(ω)(t_{1}, …, t_{n}) = ω(t_{1}, …, t_{n}).

The elements in T_{Σ}(X)(s) are called terms of sort s.

If X is the family of empty sets, that is, X(s) = {} for all sorts s in S, then T_{Σ}(X) is called the ground term algebra, and we may write T_{Σ} instead of T_{Σ}(X).

The functor T_{Σ} from Set^{S} to Alg(Σ) maps each family of sets X : S → Set to the term algebra T_{Σ}(X) and each natural transformation h : X ⇒ Y to the unique homomorphism from T_{Σ}(X) to T_{Σ}(Y) satisfying T_{Σ}(h)_{s}(x) = h_{s}(x) for every x ∈ X(s), s ∈ S and

T_{Σ}(h)_{s}(ω(t_{1}, …, t_{n})) = ω(T_{Σ}(h)_{s_{1}}(t_{1}), …, T_{Σ}(h)_{s_{n}}(t_{n}))

for every operation ω : w → s ∈ Ω.

The functor T_{Σ} is left adjoint to the forgetful functor U_{Σ} : Alg(Σ) → Set^{S}, which means that for each algebra B and natural transformation h : X ⇒ U_{Σ}(B) there exists a unique extension of h to a homomorphism h̃ from T_{Σ}(X) to B such that h = η; U_{Σ}(h̃) where η is the natural transformation from X to U_{Σ}(T_{Σ}(X)) given by the inclusions of X(s) into T_{Σ}(X)(s). The homomorphism h̃ is uniquely defined by h̃_{s}(x) = h_{s}(x) for x ∈ X(s), and s ∈ S and h̃(ω(t_{1}, …, t_{n})) = B(ω)(h̃_{s_{1}}(t_{1}), …, h̃_{s_{n}}(t_{n})) for ω : w → s ∈ Ω.

The natural transformation h̃ from T_{Σ}(X) to B evaluates a term t ∈ T_{Σ}(X) in B with respect to h. If X is the family of empty sets then there exists a unique natural transformation h : X ⇒ U_{Σ}(B) for each Σ-algebra B, and we shall write B(t) for the evaluation of a ground term t ∈ T_{Σ} in B instead of h̃(t).

The ground-term-algebra T_{Σ} is an initial object in Alg(Σ) because the family of empty sets is an initial object in Set^{S} and left adjoints preserve initial objects (cf. Section 2.4). The unique homomorphism h_{B} from T_{Σ} to an arbitrary Σ-algebra B is given by h_{B}(t) = B(t).

Note that in the definition of algebras and homomorphisms (cf. Definition 3.4) we used the same symbol A for a Σ-algebra A and its family of carrier sets A : S → Set, and we used the same symbol h for a Σ-homomorphism from A to B and the natural transformation h : A ⇒ B in Set^{S}. Thus, in the following, we shall leave the application of the forgetful functor U_{Σ} : Alg(Σ) → Set^{S} implicit. For example, if A is a Σ-algebra, we write T_{Σ}(A) instead of T_{Σ}(U_{Σ}(A)).

Fact 3.8 Let A be a Σ-algebra and η : Id_{Set}^{S} ⇒ T_{Σ}; U_{Σ} be the unit of the adjunction of T_{Σ} and U_{Σ}. Then we have

η_{A}; ĩd_{A} = id_{A}

in Set^{S}.

Proof. By definition, ĩd_{A} is the the unique homomorphism from T_{Σ}(X) to A such that η_{A}; ĩd_{A} = id_{A} in Set^{S}. □

Fact 3.9 The following diagram in Alg(Σ) commutes for every homomorphism h : A → B in Alg(Σ):

\xymatrix{T_{Σ}(A) \ar[r]^{T_{Σ}(h)} \ar[d]_{_{ĩd_{A}}} \ar[dr]^{h̃} & T_{Σ}(B) \ar[d]^{_{ĩd_{B}}} \\ A \ar[r]_{h} & B}

Proof. Let Σ = (S, Ω) be a many-sorted signature. First, we show that

\xymatrix{T_{Σ}(A) \ar[d]_{_{ĩd_{A}}} \ar[dr]^{h̃} \\ A \ar[r]_{h} & B}

commutes in Alg(Σ). Since we have

η_{A}; ĩd_{A}; h = id_{A}; h = h

in Set^{S}, and the homomorphism h̃ is unique with the property η_{A}; h̃ = h, we have h̃ = ĩd_{A}; h in Alg(Σ).

Next, we show that the following diagram commutes in Alg(Σ):

\xymatrix{T_{Σ}(A) \ar[r]^{T_{Σ}(h)} \ar[dr]_{h̃} & T_{Σ}(B) \ar[d]^{_{ĩd_{B}}} \\  & B}

Since η is a natural transformation we have η_{A}; T_{Σ}(h) = h; η_{B}. By composing both sides of the equation with ĩd_{B} we get

η_{A}; T_{Σ}(h); ĩd_{B} = h; η_{B}; ĩd_{B} = h.

Again, since h̃ is unique with the property η_{A}; h̃ = h, we get that h̃ = T_{Σ}(h); ĩd_{B} in Alg(Σ). □ Given a recursive enumerable set V. A functor X : S → Set is a family of variables for the signature Σ = (S, Ω) if X(s) ⊆ V for each sort s in S and X(s) ∩ X(s′) = {} for two sorts s ≠ s′ in S.

For a Σ-algebra A and a family of variables X ∈ Set^{S}, a natural transformation ρ from X to the family of carrier sets of A is called a variable assignment.

In the following we may write, for example, X = {x, y : s_{1}, z : s_{2}} for the family of variables X : {s_{1}, s_{2}, s_{3}} → Set given by X(s_{1}) = {x, y}, X(s_{2}) = z and X(s_{3}) = {}. If the sorts of the variables are clear from the context we may omit the declaration of sorts and just write X = {x, y, z}.

Definition 3.10 (Translation of Terms) Let σ : Σ → Σ′ be a signature morphism with Σ = (S, Ω) and Σ′ = (S′, Ω′), and let X : S → Set be a family of variables. Define a new family of variables X′ : S′ → Set by taking for X′(s′) the union of all X(s) such that σ(s) = s′ for each s′ in S′. We set X′(s′) = {} if there is no s ∈ S with σ(s) = s′.

The signature morphism σ defines an S-indexed family of functions \overline{σ}_{s} from T_{Σ}(X)(s) to T_{Σ}(X′)(σ(s)) by

\overline{σ}(x) = x for x ∈ X(s) and s ∈ S
\overline{σ}(ω(t_{1}, …, t_{n})) = σ(ω)(\overline{σ}(t_{1}), …, \overline{σ}(t_{n}))

for ω ∈ Ω(w, s), t_{1}, …, t_{n} ∈ T_{Σ}(w) and w ∈ S^{∗}.

A Σ-equation has the form ∀X t = r where X is a family of variables and t and r are terms in T_{Σ}(X)(s) for some sort s ∈ S.

Definition 3.11 (Eqn) The functor Eqn from Sig to Set maps a signature Σ to the set of Σ-equations and a signature morphism σ : Σ → Σ′ to the function Eqn(σ) mapping a Σ-equation ∀X r = t to a Σ′-equation ∀X′ \overline{σ}(r) = \overline{σ}(t).

Definition 3.12 (Satisfaction) A Σ-algebra A satisfies a Σ-equation ∀X t = r, written A ⊧ ∀X t = r, if ρ̃(t) = ρ̃(r) for all variable assignments ρ : X ⇒ A.

When writing an equation ∀{x_{1} : s_{1}, …, x_{n} : s_{n}} r = t, we shall omit the braces and write ∀x_{1} : s_{1}, …, x_{n} : s_{n} r = t instead, or ∀x_{1}, …, x_{n} r = t if the sorts of the variables are clear from the context.

Lemma 3.13 If A and B are isomorphic Σ-algebras, then

A ⊧ ∀X t = r if and only if B ⊧ ∀X t = r

for all Σ-equations ∀X t = r.

Proof. (⇐) Let B ⊧ ∀X t = r and ρ be an arbitrary variable assignment from X to A. We have to show that ρ̃(t) = ρ̃(r).

Define a variable assignment from X to B by ρ′ = ρ; ι where ι is the isomorphism from A to B. Note that ρ̃′ is the same as ρ̃; ι. Then we have ρ̃′(t) = ρ̃′(r) because B ⊧ ∀X t = r.

By applying ι^{−1} to each side of the equation ρ̃′(r) = ρ̃′(t) we get ρ̃′; ι^{−1}(r) = ρ̃; ι; ι^{−1}(r) = ρ̃(r) and ρ̃′; ι^{−1}(t) = ρ̃; ι; ι^{−1}(t) = ρ̃(t) and thus ρ̃(r) = ρ̃(t).

(⇒) The argument is the same as for the previous case but with the rôles of ι an ι^{−1} reversed. □

Definition 3.14 (Institution EQ) The institution of equational logic EQ is given by the category Sig of many sorted signatures, the contravariant functor Alg from Sig to Cat, mapping many sorted signatures Σ to the category of Σ-algebras, the functor Eqn from Sig to Set, mapping signatures Σ to the set of Σ-equations, and the family of satisfaction relations ⊧_{Σ}⊆ Alg(Σ) × Eqn(Σ).

It remains to show that the satisfaction conditions holds for EQ. To show this, the following lemma is needed.

Lemma 3.15 Let σ : Σ → Σ′ be a signature morphism, A a Σ′-algebra, ρ : X ⇒ A|_{σ} a variable assignment ,and let ρ′ : X′ ⇒ A be the variable assignment defined by ρ′_{s′}(x) = ρ_{s}(x) if x ∈ X(s) and s′ = σ(s) where X′ is defined as in 3.10. Then

ρ̃(t) = ρ̃′(\overline{σ}(t))

for all terms t from T_{Σ}(X).

Note that ρ′ is well-defined because X(s) ∩ X(s′) = {} for all s, s′ ∈ S with s ≠ s′.

Proof. The proof is done by induction on the structure of terms from T_{Σ}(X). If t = x and x ∈ X(s), then

ρ̃_{s}(x) = ρ_{s}(x) = ρ′_{σ(s)}(x) = ρ̃′_{σ(s)}(\overline{σ}(x))

and if t = ω(t_{1}, …, t_{n}), then

ρ̃(ω(t_{1}, …, t_{n})) = (A|_{σ})(ω)(ρ̃(t_{1}, …, t_{n}))  | Def. of ρ̃
= A(σ(ω))(ρ̃′(\overline{σ}(t_{1}), …, \overline{σ}(t_{n}))) | Def. of A|_{σ} and Ind. Hyp.
= ρ̃′(\overline{σ}(ω(t_{1}, …, t_{n})))  | Def. of ρ̃′
□

Theorem 3.16 (Satisfaction condition) Let σ be a signature morphism from Σ to Σ′, A a Σ′-algebra, and ∀X r = t a Σ-equation. Then

A|_{σ} ⊧ ∀X r = t if and only if A ⊧ Eqn(σ)(∀X r = t)

Proof. (⇐) Let A ⊧ Eqn(σ)(∀X t = r). Fix an arbitrary ρ : X ⇒ A|_{σ} and define ρ′ : X′ ⇒ A as in Lemma 3.15. Since A ⊧ \overline{σ}(∀X r = t), we have ρ̃′(\overline{σ}(r)) = ρ̃′(\overline{σ}(t)), and because of Lemma 3.15 we get ρ̃(r) = ρ̃′(\overline{σ}(r)) = ρ̃′(\overline{σ}(t)) = ρ̃(t).

(⇒) Let A|_{σ} ⊧ ∀X r = t and ρ′ be a variable assignment from X′ to A. Define ρ : X ⇒ A|_{σ} by ρ_{s}(x) = ρ′_{σ(s)}(x). Since A|_{σ} ⊧ ∀X r = t and because of Lemma 3.15, we have ρ̃′(\overline{σ}(r)) = ρ̃(r) = ρ̃(t) = ρ̃′(\overline{σ}(t)). □

3.2 Amalgamation

An important property of institutions, that is also required for the construction of the institution R_{I} in Section 5.3, is that the contravariant structure functor Str_{I} from Sign_{I} to Cat preserves colimits. That is, if F is a functor from J to Sign_{I} such that the colimit (ι^{F} , ∐ F) of F exists, then (ι^{F}; Str_{I}, Str_{I}(∐ F)) is a limit of the functor F; Str_{I} : J^{op} → Cat.

Given a colimit diagram F : I → Sign_{I} with F (i) = Σ_{i} and a Σ_{i}-structure m_{i} for each i ∈ I, then the m_{i} can be glued together to form one structure m over the colimit signature of F provided that the colimit of F exists and that m_{j}|_{F (f)} = m_{i} for all morphisms f : i → j in J.

Str_{I} preserves colimits if Str_{I} maps the initial object in Sign_{I} to the terminal object in Cat and if pushouts in Sign_{I} are mapped to pullbacks in Cat.

Definition 3.17 We call an institution exact if the contravariant structure functor Str_{I} from Sign_{I} to Cat preserves colimits.

The institutions EQ, EQC, LSL, and SET all have amalgamation, and since their structure functors also preserve initial objects, they are all exact.

Definition 3.18 (Amalgamated Sum) An institution I has amalgamation if for any pushout diagram F : V → Sign_{I} for which a pushout ∐ F exists and for any pair of structures m_{1} ∈ Str_{I}(F (1)) and m_{2} ∈ Str_{I}(F (2)) such that m_{1}|_{F (f)} = m_{0} = m_{2}|_{F (g)} there exists a unique m ∈ Str_{I}(∐ F) with m|_{ι_{1}} = m_{1} and m|_{ι_{2}} = m_{2}. m is called the amalgamated sum of m_{1} and m_{2} with respect to m_{0} and is written as m_{1} +_{m_{0}} m_{2}.

Similarly, there has to exist for each pair of homomorphisms h_{1} : m_{1} → m′_{1} and h_{2} : m_{2} → m′_{2} with h_{1}|_{F (f)} = h_{2}|_{F (g)} a unique homomorphism h from the amalgamated sum of m_{1} and m′_{1} to the amalgamated sum of m_{2} and m′_{2} such that h|_{ι_{1}} = h_{1} and h|_{ι_{2}} = h_{2}.

Note that if an institution has amalgamation, the objects and homomorphisms in Str_{I}(∐ F) are exactly the amalgamated sums of objects and homomorphisms from Str_{I}(F (1)) and Str_{I}(F (2)). To see this, consider an object m in Str_{I}(∐ F) and let m_{0} = m|_{ι_{0}}, m_{1} = m|_{ι_{1}}, and m_{2} = m|_{ι_{2}}. Because ι_{0}, ι_{1}, and ι_{2} are co-cone morphisms we have σ_{1}; ι_{1} = ι_{0} = σ_{2}; ι_{2}, and therefore m_{1}|_{σ_{1}} = m_{0} = m_{2}|_{σ_{2}}. Thus the amalgamated sum of m_{1} and m_{2} exists. Then m_{1} +_{m_{0}} m_{2} is the same as m because of the uniqueness of the amalgamated sum.

Fact 3.19 An institution I has amalgamation if and only if the contravariant functor Str_{I} preserves pushouts.

Proof. (⇒) Assume that I has amalgamation. Let ∐ F be a pushout of the functor F : V → Sign_{I}, then we have to show that Str_{I}(∐ F) is a pullback in Cat. Consider a category C with two functors F : C → Str_{I}(F (1)) and G : C → Str_{I}(F (2)) such that F; Str_{I}(σ_{1}) = G; Str_{I}(σ_{2}). We have to construct a unique functor H : C → Str_{I}(∐ F) with H; Str_{I}(ι_{1}) = F and H; Str_{I}(ι_{2}) = G. Define H(c) = F (c) +_{m_{0}} G(c) where F (c)|_{σ_{1}} = m_{0} = G(c)|_{σ_{2}}, and in a similar manner H(h : c → c′) = F (h) +_{h_{0}} G(h). Note that H is unique because of the uniqueness of the amalgamated sum. Now we have

Str_{I}(ι_{1})(H(c)) = (F (c) +_{m_{0}} G(c))|_{ι_{1}} = F (c)

for all c ∈ C and similar

Str_{I}(σ_{2})(H(c)) = (F (c) +_{m_{0}} G(c))|_{ι_{2}} = G(c).

(⇐) Assume that the Str_{I} preserves colimits and let F be a functor from V to Sign_{I}. We have to show that I has amalgamation. Consider a F (1)-structure m_{1} and a F (2)- structure m_{2}. These structures define functors M_{1} from 1 to Str_{I}(F (1)) and Str_{I}(F (2)) by mapping the only element of 1 to m_{1} and m_{2}, respectively. If m_{1}|_{σ_{1}} = m_{0} = m_{2}|_{σ_{2}}, then M_{1}; Str_{I}(σ_{1}) = M_{2}; Str_{I}(σ_{1}), and thus there exists a unique functor M from 1 to Str_{I}(∐ F) with M; Str_{I}(ι_{1}) = M_{1} and M; Str_{I}(ι_{2}) = M_{2} because Str_{I}(∐ F) is a pullback in Cat. Now M(1) has all the required properties of an amalgamated sum of m_{1} and m_{2} with respect to m_{0}.

Similarly, two homomorphisms h_{1} : m_{1} → m′_{1} and h_{2} : m_{2} → m′_{2} define two functors H_{1} and H_{2} from 2 to Str_{I}(F (1)) and Str_{I}(F (2)) by mapping the arrow f from 1 to 2 in 2 to h_{1} and h_{2}, respectively. As before, if h_{1}|_{σ_{1}} = h_{0} = h_{2}|_{σ_{2}}, then there exists a unique functor H from 2 to Str_{I}(∐ F) with H; Str_{I}(ι_{1}) = H_{1} and H; Str_{I}(ι_{2}) = H_{2} and H(f) is the amalgamated sum of h_{1} and h_{2} with respect to h_{0}. □

Fact 3.20 The institution EQ has amalgamation.

Proof. Given a pushout diagram F : V → Sig with pushout object ∐ F and co-cone morphisms ι_{i} : F (i) → ∐ F.

\xymatrix{ & ∐ F \\ F (1) \ar@{-->}[ur]^{ι_{1}} &  & F (2) \ar@{-->}[ul]_{ι_{2}} \\  & F (0) \ar@{-->}[ul]^{σ_{1}} \ar@{-->}[ur]_{σ_{2}} \ar@{-->}[uu]_{ι_{0}}}

Let A_{1} be in Alg(F (1)) and A_{2} in Alg(F (2)) such that A_{1}|_{σ_{1}} = A_{0} = A_{2}|_{σ_{2}}. The amalgamated sum of A_{1} and A_{2} with respect to A_{0} is given by:

(A_{1} +_{A_{0}} A_{2})(s) = A_{i}(s_{i}) for ι_{i}(s_{i}) = s and s_{i} is a sort of F (i)

for each sort s of ∐ F and

(A_{1} +_{A_{0}} A_{2})(ω) = A_{i}(ω_{i}) for ι_{i}(ω_{i}) = ω and ω_{i} is an operation of F (i)

for each operation ω of ∐ F.

To show that A = A_{1} +_{A_{0}} A_{2} is well-defined, consider s_{i} and s_{j} with ι_{i}(s_{i}) = s = ι_{j}(s_{j}). It suffices to assume that there exists a morphism f from i to j in V and thus a signature morphism Σ(f) = σ from Σ(i) to Σ(j). In this case we have σ(s_{i}) = s_{j} and A_{j}|_{σ} = A_{i}, and therefore A(s) = A_{i}(s_{i}) = A_{j}|_{σ}(s_{i}) = A_{j}(σ(s_{i})) = A_{j}(s_{j}).

A similar argument shows that A(ω) is well-defined.

Let g : A_{1} → A′_{1} be a F (1)-homomorphism and h : A_{2} → A′_{2} be a F (2)-homomorphism such that g|_{σ_{1}} = f = h|_{σ_{2}}. Then a ∐ F -homomorphism g +_{f} h from A_{1} +_{A_{0}} B to A′_{1} +_{A′_{0}} A′_{2} is defined by:

(g +_{f} h)_{s} = \begin{cases}g_{s_{1}} & if ι_{1}(s_{1}) = s and s_{1} is a sort of F (1) \\ h_{s_{2}} & if ι_{2}(s_{2}) = s and s_{2} is a sort of F (2) \end{cases}

□

Corollary 3.21 The contravariant functor Alg : Sig^{op} → Cat preserves colimits.

Proof. A functor preserves colimits if it preserves pushouts and initial objects (cf. Lemma 2.9). Since EQ has amalgamation, the functor Alg preserves pushouts. The initial object of Sig is the signature ({}, Ω_{⊥}) with no sorts and no operations. The only object of the category of ({}, Ω_{⊥})-algebras is the algebra with no carrier sets and no functions. Thus Alg(({}, Ω_{⊥})) is isomorphic to 1 and therefore a terminal object of Cat. □

3.3 Constraints

The problem with the institution EQ is that EQ is not powerful enough to express certain classes of algebras by sets of equations only. For example, it is impossible to specify a class of algebras where the carrier set of a sort is isomorphic to the natural numbers.

One reason for this is that algebras whose carrier sets contain junk, that is, some elements in their carrier sets cannot be expressed by ground-terms, cannot be excluded.

Another reason is that the class of algebras satisfying a set of equations always contains the trivial algebra T. The trivial algebra for a signature Σ = (S, Ω) has either T (s) = {1} or T (s) = {} for a sort s from S depending on whether the ground term algebra has an element of this sort or not. The operations ω : s_{1} … s_{n} → s ∈ Ω are interpreted as the unique function from the empty set to any other set if T (s_{i}) = {} for some 1 ≤ i ≤ n, that is, T (s_{1}) × … × T (s_{n}) is isomorphic to the empty set, or T (ω)(1, …, 1) = 1. Note that, if T (s_{i}) is not empty for 1 ≤ i ≤ n, then T (s) cannot be empty because if T (s_{i}) is not empty, there exists ground terms t_{i} of sort s_{i}. Then ω(t_{1}, …, t_{n}) is a ground term of sort s and thus T (s) = {1}.

The trivial algebra T satisfies all equations ∀X t = r from Eqn(Σ). In order to see this, consider a variable assignment ρ : X ⇒ T. If a variable assignment ρ from X to T exists, then either X(s) is empty or X(s) is non-empty; in this case T (s) has to be non-empty too. Then ρ(x) = 1 for all x ∈ X(s) which implies ρ̃(r) = 1 = ρ̃(t) and thus T ⊧ ∀X t = r.

Adding constraints as formulas to Eqn(Σ) enhances the expressive power of equational specifications. Generating constraints address the junk-problem by requiring that each element of a generated sort can be expressed by an appropriate term of that sort. For proving properties of elements of generated sorts one can use induction over the term structure. Free generating constraints add disequalities between the constructors of a generated sort and thus help exclude the trivial algebra while partitioned-by constraints add a limited form of behavioral equivalence.

For example, the constraint

N generated by zero, succ

ensures that for each algebra A satisfying that constraint and each element e of A(N) there exists a term t of the form succ(… (zero) …) such that A(t) = e. Since each element of A(N) can be represented by a term, one can use induction on the structure of terms to prove properties φ about elements of sort N, i.e. if A ⊧ φ[x/zero] and if A ⊧ φ implies A ⊧ φ[x/succ(x)], then A ⊧ φ. However, the generating constraint does not ensure that different terms correspond to different elements in A(N). Thus an algebra A with A(N) = {0}, A(zero) = 0 and A(succ) = λx.x satisfies the generating constraint. To make sure that A(succ)(x) ≠ x one has to use the following free generating constraint:

N generated freely by zero, succ.

Let S be the sort of sets with elements of sort E, isEmpty a function from S to bool testing whether a set is empty or not, and a function ∈ from E × S to bool yielding true if the element e is in the set s and false otherwise. For all algebras A that satisfy the constraint

S partitioned by isEmpty, ∈

and elements s_{1} and s_{2} of A(S): if s_{1} and s_{2} are not equal, then they can be distinguished by using the operations isEmpty or ∈, that is, either isEmpty(s_{1}) and not isEmpty(s_{2}) or vice versa, or there exists an element e of A(E) such that e ∈ s_{1} and e ∉ s_{2} or e ∉ s_{1} and e ∈ s_{2}.

Thus we can assume the following deduction rule:

if isEmpty(s_{1}) ⇔ isEmpty(s_{2}) and ∀e : E e ∈ s_{1} ⇔ e ∈ s_{2} then s_{1} = s_{2}.

This rule cannot be expressed as an equation even if we have the boolean operations with their usual meanings in our signature since the universal quantification of e appears on the left side of an implication. Replacing the implication by a disjunction we get an existential quantifier

∀s_{1}, s_{2} : S isEmpty(s_{1}) ⇎ isEmpty(s_{2}) ∨ ∃e : E. e ∈ s_{1} ⇎ e ∈ s_{2} ∨ s_{1} = s_{2}.

Data Constraints

In the following we add data-constraints to EQ using the method of Goguen and Burstall [25].

Definition 3.22 (Σ-generating constraints) Let Σ′ = (S′, Ω′) be a signature, s a sort from S′, Ω_{c} ⊆ Ω′ a set of operations and σ a signature morphism from Σ′ to Σ = (S, Ω). The following are Σ-constraints:

s generated by Ω_{c} wrt σ s generated freely by Ω_{c} wrt σ

If σ is the identity we write

s generated (freely) by Ω_{c}

instead of s generated (freely) by Ω_{c} wrt id.

Definition 3.23 (Satisfaction) Given a Σ-algebra A and a Σ-constraint

c = s generated (freely) by Ω_{c} wrt σ.

Then A satisfies c, A ⊧ c, if A|_{σ} satisfies the constraint

c′ = s generated (freely) by Ω_{c} wrt id.

Let Σ_{c} be (S, Ω_{c}). The Σ-algebra A satisfies the constraint s generated by Ω_{c},

A ⊧ s generated by Ω_{c},

if for all a in A(s) there exists a term t in T_{Σ_{c}}(Ā) such that h̃(t) = a where Ā ∈ Set^{S} is defined by Ā(s′) = A(s′) for every sort s′ ≠ s in S and Ā(s) = {}; and h : Ā ⇒ A is given by h_{s′}(a) = a for every sort s′ ≠ s in S and every a ∈ Ā(s′) and h_{s} is the unique function from the empty set to A(s).

A satisfies s generated freely by Ω_{c} if t is unique.

Definition 3.24 (Translation of constraints) Let σ from Σ_{1} to Σ_{2} and μ from Σ to Σ_{1} be two signature morphisms then

\overline{σ}(s generated (freely) by Ω_{c} wrt μ) = s generated (freely) by Ω_{c} wrt μ; σ

Note that \overline{σ}(c) is not defined as σ(s) generated (freely) by σ(Ω_{c}) as it is done in the Larch Shared Language because the satisfaction condition would not hold. Consider a signature Σ with one sort and two constants c_{1} and c_{2} and a signature morphism from Σ to a signature Σ′ with one sort and one constant c, mapping c_{1} and c_{2} to c. Let A be a Σ′-algebra and let A(s) contain two elements then A|_{σ} is generated by c_{1} and c_{2}, however A is not generated by σ(c_{1}) = c = σ(c_{2}).

Theorem 3.25 Given a Σ′-algebra A, a Σ-constraint s generated by Ω_{c} wrt μ and a signature morphism σ : Σ → Σ′ then

A ⊧ \overline{σ}(s generated by Ω_{c} wrt μ; σ) iff A|_{σ} ⊧ s generated by Ω_{c} wrt μ.

and similar for a constraint s generated freely by Ω_{c} wrt μ.

Proof.

A ⊧ s generated by Ω_{c} wrt μ; σ iff A|_{(μ;σ)} ⊧ s generated by Ω_{c}
iff (A|_{σ})|_{μ} ⊧ s generated by Ω_{c}
iff A|_{σ} ⊧ s generated by Ω_{c} wrt μ
□

Theorem 3.26 The satisfaction of data-constraints is closed under isomorphism.

Proof. Let A and A′ be two isomorphic Σ-algebras with isomorphism ι : A → A′. We have to show that A ⊧ s generated (freely) by Ω_{c} if and only if A′ ⊧ s generated (freely) by Ω_{c}.

Assume that A ⊧ s generated (freely) by Ω_{c} then we have to find for each a′ ∈ A′(s) a term t′ ∈ T_{Σ}(Ā′) with h̃′(t′) = a′ where Ā′(s′) = A(s′) for all sorts s′ ≠ s and Ā′(s) = {}, and h′_{s′}(a) = a for all a ∈ Ā′ and sorts s′ ≠ s and h′_{s} is the unique morphism from {} to A′(s).

Since A ⊧ s generated (freely) by Ω_{c} and ι^{−1}(a′) is in A(s), there exists a term t ∈ T_{Σ}(Ā) such that h̃(t) = ι^{−1}(a′) where Ā and h : Ā → A are defined as in Definition 3.23. Let ῑ be the natural transformation from Ā to Ā′, given by ῑ_{s′}(a) = ι_{s′}(a) for every sort s′ ≠ s and ῑ_{s} is the unique function from the empty set to the empty set.

Choose t′ as T_{Σ}(ῑ)(t). It remains to show that h̃′(t′) = a′.

The definition of h, h′ and ῑ makes the following diagram commute in Set^{S}:

\xymatrix{Ā \ar[r]^{h} \ar[d]_{ῑ} & A \ar[d]^{ι} \\ Ā′ \ar[r]_{h′} & A′}

By the functor property of T_{Σ} this implies that the left rectangle of the following diagram in Alg(Σ) commutes:

\xymatrix{T_{Σ}(Ā) \ar[r]^{h} \ar[d]_{T_{Σ}(ῑ)} & T_{Σ}(A) \ar[d]^{T_{Σ}(ι)} \ar[r]^{^{ĩd^{A}}} & A \ar[d]^{ι} \\ T_{Σ}(Ā′) \ar[r]_{T_{Σ}(h′)} & T_{Σ}(A′) \ar[r]_{_{ĩd_{A′}}} & A′}

The right rectangle commutes because of Theorem 3.9. Also because of theorem 3.9, we have that h̃ = T_{Σ}(h); ĩd_{A} and h̃′ = T_{Σ}(h′); ĩd_{A′}. Thus we get:

h̃′(t′) = h̃′(T_{Σ}(ῑ)(t)) = ι(h̃(t)) = ι(ι^{−1}(a′)) = a′.

For free generating constraints, the uniqueness of t′ is a consequence of the facts that ι and ῑ are isomorphisms and that functors preserve isomorphisms.

The proof for the other direction, that is, if A′ satisfies the data-constraint then A satisfies the data-constraint, is similar. □

Partitioned-By Constraints

A partitioned-by constraint s partitioned by Ω_{o} defines with Ω_{o} a set of observers that can be used to distinguish between elements of the sort s. An algebra A satisfies a partioned-by constraint if for two values a and b of sort s there exists an operation ω in Ω_{o} and values a_{1}, …, a_{n} such that A(ω)(a_{1}, …, a, …, a_{n}) does not equal A(ω)(a_{1}, …, b, …, a_{n}). On the other hand, if for all operations ω in Ω_{o} and values a_{1}, …, a_{n} we have

A(ω)(a_{1}, …, a, …, a_{n}) = A(ω)(a_{1}, …, b, …, a_{n})

then a = b.

For example, when given a specification of sets, one would like to have each model A of that specification satisfy the constraint

Set partitioned by isEmpty, ∈ ,

as we would like to regard to sets s_{1} and s_{2} as equal, if either both sets are empty or not empty or if e is an element of s_{1} then e is also an element of s_{2} and vice versa.

Behavioral abstraction [49, 24, 9] is similar to the partioned-by constraint in that it defines observations used to distinguish elements from some sort. The difference is that with behavioral abstraction, in general, infinitely many observations have to be checked, while with the partitioned-by constraint only finitely many observations need to be checked. However, Bidoit and Hennicker [9] have shown that with the help of additional function symbols it is possible to check behavioral equivalence with finite many observations and to express behavioral equivalence using partitioned-by constraints.

Definition 3.27 (Partitioned-by) Given a signature Σ = (S, Ω), a sort s in S and a set of operation symbols Ω_{o} ⊆ Ω. A partitioned-by constraint over Σ is of the form

s partitioned by Ω_{o}

Given a signature morphism σ : (S, Ω) → (S′, Ω′) then the translation of s partitioned by Ω_{o} by σ is

σ(s) partitioned by σ(Ω_{o}).

Definition 3.28 (Satisfaction) Given a signature Σ and Σ-algebra A then A satisfies the constraint s partitioned by Ω_{o},

A ⊧ s partitioned by Ω_{o},

if for all elements a ≠ b of A(s) there exists an operation ω : s_{1} … s_{n} → s in Ω_{o}, elements a_{i} ∈ A(s_{i}) for i = 1 … n and an argument position j ∈ {1, …, n} with s_{j} = s such that

A(ω)(a_{1}, …, a_{j−1}, a, a_{j+1}, …, a_{n}) ≠ A(ω)(a_{1}, …, a_{j−1}, b, a_{j+1}, …, a_{n}).

Theorem 3.29 For all signature morphisms σ : Σ → Σ′ and Σ′-algebras A we have:

A|_{σ} ⊧ s partitioned by Ω_{o} iff A ⊧ σ(s) partitioned by σ(Ω_{o}).

Proof. (⇒) For two elements a ≠ b in A(σ(s)) we have to find an operation ω′ : s′_{1} … s′_{n} → σ(s) in σ(Ω_{o}) and values a′_{i} ∈ A(s′_{i}) such that

A(ω′)(a′_{1}, …, a, …, a′_{n}) ≠ A(ω′)(a′_{1}, …, b, …, a′_{n}).

Since A|_{σ}(s) is defined as A(σ(s)), the values a and b are in A|_{σ}(s) and because A|_{σ} satisfies s partitioned by Ω_{o} there exists ω : s_{1} … s_{n} → s and values a_{i} ∈ A|_{σ}(s_{i}) with

A|_{σ}(ω)(a_{1}, …, a, …, a_{n}) ≠ A|_{σ}(ω)(a_{1}, …, b, …, a_{n}).

Now choose ω′ as σ(ω) and a′_{i} as a_{i}. Then

A(σ(ω))(a_{1}, …, a, …, a_{n}) = A|_{σ}(ω)(a_{1}, …, a, …, a_{n})

≠ A|_{σ}(ω)(a_{1}, …, b, …, a_{n}) = A(σ(ω))(a_{1}, …, b, …, a_{n})

(⇐) This direction is similar to ⇒. However, for one operation ω′ in σ(Ω_{o}) there may be several operations ω_{i} such that σ(ω_{i}) = ω′. This does not pose a problem because they have all the same interpretation, that is, A|_{σ}(ω_{i}) = A(σ(ω_{i})) = A(ω′). □

Theorem 3.30 The satisfaction of partitioned-by constraints is closed under isomorphism.

Proof. Let A and A′ be isomorphic Σ-algebras where the isomorphism is ι : A → A′ then we have to show that A ⊧ s partitioned by Ω_{o} if and only if A′ ⊧ s partitioned by Ω_{o}.

Assume that A ⊧ s partitioned by Ω_{o}. Then we have to find for every pair (a′, b′) from A′(s) such that a′ ≠ b′ an operation ω′ : s_{1} … s_{n} → s in Ω_{o}, elements a′_{i} ∈ A′(s_{i}) and an argument position j′ ∈ {1, …, n} with

A′(ω′)(a′_{1}, …, a′_{j′−1}, a′, a′_{j′+1}, …, a′_{n})

≠ A′(ω′)(a′_{1}, …, a′_{j′−1}, b′, a′_{j′+1}, …, a′_{n}).

Let (a′, b′) be an arbitrary pair from A′(s) with a′ ≠ b′ then (ι^{−1}(a′), ι^{−1}(b′)) is a pair of elements from A(s) with ι^{−1}(a′) ≠ ι^{−1}(b′) because ι is an isomorphisms. Since A ⊧ s partitioned by Ω_{o}, we have an operation ω : s_{1} … s_{m} → s in Ω_{o}, elements a_{i} ∈ A(s_{i}) and an argument position j ∈ {1, …, m} with

A(ω)(a_{1}, …, a_{j−1}, ι^{−1}(a′), a_{j+1}, …, a_{m})

≠ A(ω)(a_{1}, …, a_{j−1}, ι^{−1}(b′), a_{j+1}, …, a_{m}).

Now set ω′ = ω, n = m, a′_{i} = ι(a_{i}) for all i ∈ {1, …, m} and j′ = j. Then we have

A′(ω′)(a′_{1}, …, a_{j′−1}, a′, a′_{j′+1}, …, a′_{n})

= A′(ω)(ι(a_{1}), …, ι(a_{j−1}), ι(ι^{−1}(a′)), ι(a_{j+1}), …, ι(a_{m}))

= ι(A(ω)(a_{1}, …, a_{j−1}, ι^{−1}(a′), a_{j+1}, …, a_{m}))

because ι; ι^{−1} = id_{A} and ι is a homomorphism, and similar

A′(ω′)(a′_{1}, …, a′_{j′−1}, b′, a′_{j′+1}, …, a′_{n})

= ι(A(ω)(a_{1}, …, a_{j−1}, ι^{−1}(b′), a_{j+1}, …, a_{m})).

Since

A(ω)(a_{1}, …, a_{j−1}, ι^{−1}(a′), a_{j+1}, …, a_{m})

≠ A(ω)(a_{1}, …, a_{j−1}, ι^{−1}(b′), a_{j+1}, …, a_{m})

and ι is an isomorphism, we have

A′(ω′)(a′_{1}, …, a′′_{j′−1}, a′, a′_{j+1}, …, a′_{n}) ≠ A′(ω′)(a′_{1}, …, a_{j′−1}, b′, a′_{j+1}, …, a′_{n}).

The proof that A′ ⊧ s partitioned by Ω_{o} implies A ⊧ s partitioned by Ω_{o} is similar. □

The Institution EQC

The institution EQC of equational logic with constraints is similar to EQ; the difference being that data-constraints and partitioned-by constraints are added to the sentences of EQ.

Definition 3.31 (Institution EQC) The institution EQC has Sig as its category of signatures, Alg as its structure functor and EqnC as the sentence functor where EqnC(Σ) is the union of Eqn(Σ) with the set of (free) generating and partitioned-by constraints over Σ. The satisfaction relation is the satisfaction relation of EQ extended by the satisfaction of constraints.

The satisfaction condition of EQC is a consequence of Facts 3.16, 3.25 and 3.29.

Note that, because the category of signatures and the structure functor of EQC are the same as in the institution EQ, the category of signatures of EQC is finitely cocomplete and EQC is exact.

3.4 The Institution LSL  55

3.4 The Institution LSL

In the following section we define the institution LSL, which is an approximation of the logic used by the Larch Shared Language [34]. Basically LSL is the institution EQC of equational logic with constraints. The differences are that each signature in LSL includes the sort bool together with its usual operations ¬, ∧, ∨, ⇒, and ⇔; for each sort s of the signature the equality symbol as a boolean function ≡ : s, s → bool; and the conditional

if then else : bool, s, s → s.

Σ-structures in LSL are Σ-algebras such that the interpretation of the equality symbols, conditionals, and the sort bool with its operations have their usual meaning.

This allows to write formulas in LSL in a more natural form than possible in EQC. If we adopt the convention that we write p instead of p = true for terms p of sort bool, then we can write formulas like ∀X s_{1} ≡ t_{1} ⇔ s_{0} ≡ t_{0}, instead of ∀X (s_{1} ≡ t_{1} ⇔ s_{0} ≡ t_{0}) = true.

Note that ≡ is different from =. While the first is a boolean function that can appear anywhere where a term of sort bool is expected, the second is the logical equality only allowed to build formulas ∀X r = t from EqnC(Σ). But due to the restrictions we pose on the structures of LSL, ≡ and = are interpreted as the identity, that is,

A ⊧ ∀X (s ≡ t) = true

iff A ⊧ ∀X s = t iff ρ̃(s) = ρ̃(t) for all ρ : X ⇒ A.

For this reason we shall use the symbol = for both types of equality in later sections. For example, we shall write ∀X s_{1} = t_{1} ⇔ s_{0} = t_{0} instead of ∀X (s_{1} ≡ s_{1} ⇔ s_{0} ≡ t_{0}) = true.

Bool

The signature Σ_{Bool} is given by the sort bool, the constants true and false of sort bool and operation symbols ⇒, ⇔, ∧ and ∨ of type bool, bool → bool and ¬ of type bool → bool. The set Φ_{Bool} is given by the following list of equations and constraints.

bool freely generated by true, false
¬ true = false
¬ false = true
∀ b:bool  (true ∧ b) = b
∀ b:bool  (false ∧ b) = false
∀ b:bool  (false ∨ b) = b
∀ b:bool  (true ∨ b) = true
∀ b:bool  (true ⇒ b) = b
∀ b:bool  (false ⇒ b) = true

∀ b:bool  (true ⇔ b) = b
∀ b:bool  (false ⇔ b) = ¬ b

The generating constraint ensures that if a Σ_{Bool}-algebra A satisfies Φ_{Bool} then A(bool) = {A(true), A(false)} and A(true) ≠ A(false).

For all Σ_{bool}-algebras A satisfying Φ_{Bool} the operation symbols in Σ_{bool} are interpreted as expected. For example the graph of A(∧) is:

A(∧) = { (A(true), A(true), A(true)),

(A(true), A(false), A(false)), (A(false), A(true), A(false)), (A(false), A(false), A(false)) }.

This can be checked by choosing for each element in the graph of A(bool) an appropriate axiom from Φ_{Bool} and a variable assignment from the variables of the axiom to A. For example, to show that (A(false), A(true), A(false)) is in the graph of A(∧) we choose the axiom false ∧ b = false and define ρ from {b : bool} to A by ρ(b) = A(true). Now we get

ρ̃(false ∧ b) = A(∧)(A(false), ρ(b)) = A(false) = ρ̃(false)

and therefore A(∧)(A(false), A(true)) = A(false).

Theorem 3.32 Let A be a Σ-algebra, σ a signature-morphism from Σ_{Bool} to Σ such that A|_{σ} ⊧ Φ_{Bool} and p and q two terms in T_{Σ}(X)_{σ(bool)} then

A ⊧ ∀X p ∧ q = true iff A ⊧ ∀X p = true and A ⊧ ∀X q = true.

Though it is possible that σ renames ∧ and bool, we assume this is not the case to avoid writing σ(∧) and σ(bool) all the time.

Proof. (⇒) Let ρ_{1} and ρ_{2} from X to A be two arbitrary variable assignments then we have to show that ρ̃_{1}(p) = A(true) and ρ̃_{2}(q) = A(true). Since A ⊧ ∀X p ∧ q = true we have

ρ̃_{1}(p ∧ q) = A(∧)(ρ̃_{1}(p), ρ̃_{1}(q))
= A(true)

which implies ρ̃_{1}(p) = A(true) because the graph of A(∧) is the same as the graph of ∧. Similar we get ρ̃_{2}(q) = A(true).

(⇐) Let ρ be a variable assignment from X to A then we have to show that A(∧)(ρ̃(p), ρ̃(q)). Since we have A ⊧ ∀X p = true and A ⊧ ∀X q = true we have ρ̃(p) = true and ρ̃(q) = true and thus A(∧)(ρ̃(p), ρ̃(q)) = A(true). □

Note that, in general, A ⊧ ∀X p ∨ q = true is not equivalent to A ⊧ ∀X p = true or A ⊧ ∀X q = true. Consider: ∀x x = 3 ∨ x = 4 and (∀x x = 3) ∨ (∀x x = 4). However, if we first rename x to y in the second equation and then from the disjunction then ∀{x, y} x = 3 ∨ y = 4 and (∀x x = 3) ∨ (∀x x = 4) are equivalent.

Lemma 3.33 Let A be a Σ-algebra, σ a signature-morphism from Σ_{Bool} to Σ such that A|_{σ} ⊧ Φ_{Bool}, p ∈ T_{Σ}(X_{1})_{σ(bool)} and q ∈ T_{Σ}(X_{2})_{σ(bool)} then

A ⊧ ∀X p′ ∨ q′ = true iff A ⊧ ∀X_{1} p = true or A ⊧ ∀X_{2} q = true,

where X(s) is the disjoint union of X_{1}(s) and X_{2}(s) for each sort s of Σ and p′ and q′ are p and q translated by the injections ι_{1} and ι_{2} from X_{1} and X_{2} into X, respectively.

Proof. (⇒) Assuming that ρ̃(p′ ∧ q′) = A(true) for all variable assignments ρ : X ⇒ A, we have to show that ρ̃_{1}(p) = A(true) for all variable assignments ρ_{1} : X_{1} ⇒ A or ρ̃_{2}(q) = A(true) for all variable assignments ρ_{2} : X_{2} ⇒ A.

Let the variable assignment ρ : X ⇒ A be the unique family of morphisms with the property (ι_{1})_{s}; ρ_{s} = (ρ_{1})_{s} and (ι_{2})_{s}; ρ_{s} = (ρ_{2})_{s} for every sort s in Σ, given by the universal property of the disjoint union. Then ρ̃_{1}(p) = (ι_{1}; ρ̃)(p) = ρ̃(p′) and ρ̃_{2}(q) = ρ̃(q′). Thus we have to show

ρ̃(p′) = A(true) or ρ̃(p′) = A(true), for all ρ : X ⇒ A.

Assume now that A ⊧ ∀X p′ ∨ q′ = true then ρ̃(p′ ∨ q′) = A(true), which is equivalent to ρ̃(p′) = A(true) or ρ̃(q′) = A(true).

(⇐) Because of the universal property of disjoint union, the class of variable assignments ρ from X to A is the same the as the class of variable assignments ρ_{1} from X_{1} to A and ρ_{2} from X_{2} to A. Therefore all steps above are equivalent transformations. □

Equality

The signature Σ_{Eq(s)} for some sort s includes the signature Σ_{bool} and has as sorts s and bool with two operation symbols ≡ and ≢ of type s, s → bool. The set Φ_{Eq(s)} is given by the union of Φ_{Bool} with the following list of EQC-formulas:

s partitioned by ≡
∀ x:s  (x ≡ x) = true
∀ x,y:s  (x ≡ y) = (y ≡ x)
∀ x,y:s  ((x ≡ y) ∧ (y ≡ z) ⇒ (x ≡ z)) = true
∀ x,y:s  (x ≢ y) = ¬ (x ≡ y)

Note that the signature Σ_{Eq(bool)} has only one sort, which is bool.

Note that the partitioned-by constraint cannot be replaced by the formula ∀{x, y : s}.(x ≡ y) = true ⇒ x = y because this is not a formula of EQC.

If an algebra A satisfies Φ_{Eq(s)} then the interpretation of ≡ in A is the same as the identity, that is:

Theorem 3.34 Let A be Σ_{Eq(s)}-algebra with A ⊧ Φ_{Eq(s)} then

A(≡)(a, b) = A(true) if and only if a = b,

for all a, b in A(s).

Proof. Note that A(≡) can be viewed as relation in the following way:

(a, b) ∈ A(≡) iff A(≡)(a, b) = A(true).

Then A(≡) is reflexive, transitive and symmetric because of the corresponding axioms of Eq(s).

(⇐) This direction is trivial since A(≡)(a, a) = A(true) holds because of the reflexivity axiom of Eq(s).

(⇒) Assume that a ≠ b then we have to show that A(≡)(a, b) ≠ A(true). Note that this is equivalent to A(≡)(a, b) = A(false) because Φ_{Eq(s)} includes Φ_{Bool}. Since A models s partitioned by ≡, we can find a value c from A(s) with A(≡)(c, a) = A(true) and A(≡ )(c, b) ≠ A(true). Assume now that A(≡)(a, b) is A(true) then by transitivity of A(≡) we get A(c, b) is A(true), which contradicts A(c, b) ≠ A(true). □

Theorem 3.35 Given a Σ-algebra A and a signature morphism σ from Σ_{Eq(s)} to Σ such that A|_{σ} ⊧ Φ_{Eq(s)} then

A ⊧ ∀X (t ≡ r) = true if and only if A ⊧ ∀X t = r.

Proof. Assume that ρ : X ⇒ A is a variable assignment then

ρ̃(s ≡ t) = A(true) iff
A(≡)(ρ̃(s), ρ̃(t)) = A(true) iff
ρ̃(s) = ρ̃(t)

Thus we have A ⊧ ∀X (s ≡ t) = true if and only if A ⊧ ∀X s = t. □

Conditional

The signature Σ_{Cond(s)} contains for some sort s the signature Σ_{bool}, the sorts s and bool and an operation if then else of type bool, s → s. Φ_{Cond(s)} is the union of Φ_{Bool} with:

∀ x,y:s  (if true then x else y) = x
∀ x,y:s  (if false then x else y) = y

Bse(S)

For a sort s, the signature Σ_{Bse(s)} is the union of the signatures Σ_{Eq(s)} and Σ_{Cond(s)}. For a set of sorts S, the signature Σ_{Bse(S)} is the union of all signatures Σ_{Bse(s)} for s ∈ S. Similar Φ_{Bse(s)} is the union of Φ_{Eq(s)} and Φ_{Cond(s)} for a sort s and Φ_{Bse(S)} is the union of all Φ_{Bse(s)} for s ∈ S.

Fact 3.36 Let S be a set of sorts and ν be a signature morphism from Σ_{Bool(S)} to Σ_{Bool(ν(S))}, which is the identity on operation symbols and on the sort bool. Then

ν(Φ_{Bse(s)}) = Φ_{Bse(ν(s))}.

Fact 3.37 For two sets of sorts S_{1} and S_{2} we have

Σ_{Bse(S_{1}∪S_{2})} = Σ_{Bse(S_{1})} ∪ Σ_{Bse(S_{2})} and Φ_{Bse(S_{1}∪S_{2})} = Φ_{Bse(S_{1})} ∪ Φ_{Bse(S_{2})}.

Signatures The category Sign_{LSL} is a subcategory of Sig such that each Σ = (S, Ω) in Sign_{LSL} contains the sort bool and such that there exists a signature morphism ι_{Σ} from Σ_{Bse(S)} to Σ which is the identity on sorts. Note that, because bool is a sort of Σ, the signature Σ_{Bse(bool)} is included into Σ_{Bse(S)}. In the following we shall use the notation ι_{Σ}^{bool} for the corresponding inclusion morphism.

A signature morphism σ from Σ = (S, Ω) to Σ′ = (S′, Ω′) in Sign_{LSL} is a signature morphism from Sig, that is, the identity on the sort bool and commutes with ι_{Σ} and ι_{Σ′} in the following way:

\xymatrix{Σ \ar[rr]^{σ} &  & Σ′ \\ Σ_{Bse(S)} \ar[rr]_{ν_{σ}} \ar[u]^{ι_{Σ}} &  & Σ_{Bse(S′)} \ar[u]_{ι_{Σ′}} \\  & Σ_{Bse(bool)} \ar[ul]^{ι_{Σ}^{bool}} \ar[ur]_{ι_{Σ′}^{bool}}}

where ν_{σ} is the same as σ on sorts and the identity on the operation symbols.

Theorem 3.38 The category Sign_{LSL} is cocomplete.

Proof. Given a functor F : J → Sign_{LSL} then we show that the colimit of F in Sign_{LSL} is the colimit of F_{⊥} : J_{⊥} → Sig in Sig. The difference between the functors F_{⊥} and F is that F_{⊥} has in addition to the nodes and edges of F a node F_{⊥}(⊥) for Σ_{Bse(bool)} and edges from Σ_{Bse(bool)} to each Σ_{i} given by ι_{Σ_{i}}^{bool}; ι_{Σ_{i}}. This ensures that the sort for boolean with its operations is included only once in the colimit of F.

Because colimits are only unique up to isomorphism, we choose ∐ F_{⊥} = (S_{cl}, Ω_{cl}) such that bool ∈ S_{cl} and ι_{i}^{F_{⊥}}(bool) = bool for all i ∈ J_{⊥}.

The category J_{⊥} is the category freely generated by adding ⊥ to J and morphisms f_{i} : ⊥ → i for each i ∈ J where ⊥ and the f_{i} do not occur in J. Note that ⊥ is not necessarily an initial object in J_{⊥}, as there is no guarantee that f_{i} = f_{j}; f, where f is a morphism from i to j in J.

Then F_{⊥} is defined by

• F_{⊥}(i) = F (i) for i ∈ J,

• F_{⊥}(⊥) = Σ_{Bse(bool)},

• F_{⊥}(f : i → j) = F (f) for f : i → j ∈ J and

• F_{⊥}(f : ⊥ → i) = ι_{F (i)}^{bool} for i ∈ J.

To show that ∐ F_{⊥} = Σ_{cl} = (S_{cl}, Ω_{cl}) is the colimit of F we have to verify

1. that ∐ F_{⊥} is in Sign_{LSL}, for which we have to provide morphisms ι_{Σ_{cl}} from Σ_{Bse(S_{cl} )} to Σ_{cl} and ι_{Σ_{cl}}^{bool} from Σ_{Bse(bool)} to Σ_{Bse(S_{cl} )},

2. that the co-cone morphisms ι_{i}^{F} = ι_{i}^{F_{⊥}}, for i ∈ J, are morphisms in Sign_{LSL} and

3. that for each natural transformation μ : F ⇒ Δ(Σ, Ω) there exists a unique morphism h_{μ} from ∐ F to (Σ, Ω).

For 1) we define ι_{Σ_{cl}} from Σ_{Bse(Σ_{cl} )} to Σ_{cl} as follows: ι_{Σ_{cl}} is the identity on sorts and maps an operation symbol ω : w → s to ι_{i}^{F_{⊥}}(ι_{Σ_{i}}(ω_{i} : w_{i} → s_{i})) where ι_{i}^{F_{⊥}}(ω_{i} : w_{i} → s_{i}) = ω : w → s and ω_{i} : w_{i} → s_{i} is in Σ_{Bse(S_{i})} for some i ∈ J. ι_{Σ_{cl}} is well-defined because Σ_{Bse(S_{cl} )} is the union of Σ_{Bse(ι_{i}^{F_{⊥}}(S_{i}))}.

For 2) we have to show that the following family of diagrams commutes for each i ∈ J:

\xymatrix{Σ_{i} \ar[r]^{ι_{i}^{F_{⊥}}} & Σ_{cl} \\ Σ_{Bse(S_{i})} \ar[r]_{ν_{ι{F_{⊥} \atop i}}} \ar[u]^{ι_{Σ_{i}}} & Σ_{Bse(S_{cl} )} \ar[u]_{ι_{Σ_{cl}}}}

This follows directly from the definition of ι_{Σ_{cl}} and because ν_{ι_{i}^{F_{⊥}}} is the identity on operation

symbols and the same as ι_{i}^{F_{⊥}} on sorts.

For 3) define h_{μ} as the unique morphism given by the colimit property of ∐ F_{⊥} and a natural transformation μ_{⊥} : F_{⊥} ⇒ ΔΣ. The natural transformation μ_{⊥} is defined by (μ_{⊥})_{i} = μ_{i} for i ∈ J and (μ_{⊥})_{⊥} = ι_{Σ}^{bool}; ι_{Σ}. We have to show that h_{μ} is a morphism in Sign_{LSL}, that is, we have to show that the following diagram commutes

\xymatrix{Σ_{cl} \ar[r]^{h_{μ}} & Σ \\ Σ_{Bse(S_{cl} )} \ar[r]_{ν_{hμ}} \ar[u]^{ι_{Σ_{cl}}} & Σ_{Bse(S)} \ar[u]_{ι_{Σ}}}

where Σ = (S, Ω). The sort parts of the diagram commute because ι_{Σ_{cl}} and ι_{Σ} are the identity on sorts and ν_{h} is defined as h on sorts. The operation part is the same because the μ_{i} are required to be morphisms in Sign_{LSL}.

□

The initial object of Sign_{LSL} is Σ_{Bse(bool)} because for any other signature Σ there exists a signature morphism ι_{Σ}^{bool}; ι_{Σ} from Σ_{Bse(bool)} to Σ. This signature morphism is unique in Sign_{LSL} since if there were another signature morphism σ from Σ_{Bse(bool)} to Σ then, because of the definition of signature morphisms in Sign_{LSL}, we have ι_{Σ_{Bse(bool)}}^{bool}; ι_{Σ_{Bse(bool)}}; σ = ι_{Σ}^{bool}; ι_{Σ}. Since ι_{Σ_{Bse(bool)}}^{bool} and ι_{Σ_{Bse(bool)}} are the identity this gives us σ = ι_{Σ}^{bool}; ι_{Σ}.

Structures Let Σ be a signature from Sign_{LSL} and let 𝔹 be an arbitrary but fixed Σ_{Bse(bool)}- algebra satisfying the formulas of Φ_{Bse(bool)}. The category Str_{LSL}(Σ) of Σ-structures is the full subcategory of Σ-algebras A such that A|_{ι_{Σ}^{bool};ι_{Σ}} = 𝔹 and A|_{ι_{Σ}} ⊧^{EQC} Φ_{Bse(S)} where S are the sorts of Σ. The functor Str_{LSL}(σ) from Str_{LSL}(Σ′) to Str_{LSL}(Σ) is the same as Alg(σ) for a signature morphism σ : Σ → Σ′ in Sign_{LSL}. For Str_{LSL}(σ) to be well-defined we have to show that A′|_{σ} is an object of Str_{LSL}(Σ) for each algebra A′ ∈ Str_{LSL}(Σ′).

That is, we have to show A′|_{ι_{Σ}^{bool};ι_{Σ};σ} = 𝔹 and A′|_{ι_{Σ};σ} ⊧^{EQC} Φ_{Bse(S)}, provided that A′|_{ι_{Σ′}^{bool};ι_{Σ′}} = 𝔹 and A′|_{ι_{Σ′}} ⊧^{EQC} Φ_{Bse(S′)} where S′ are the sorts of Σ′.

Because σ is a signature morphism in Sign_{LSL}, we have ι_{Σ}; σ = ν_{σ}; ι_{Σ′} and thus A′|_{ι_{Σ};σ} = A′|_{ν_{σ};ι_{Σ′}}.

The satisfaction condition of EQC implies that A′|_{ν_{σ};ι_{Σ′}} ⊧^{EQC} Φ_{Bse(S)} is equivalent to

A′|_{ι_{Σ′}} ⊧^{EQC} ν_{σ}(Φ_{Bse(S)}),

which is the equivalent to A′|_{ι_{Σ′}} ⊧^{EQC} Φ_{Bse(ν_{σ}(S))} (cf. Fact 3.36).

By definition of Φ_{Bse(S)} we have that Φ_{Bse(ν_{σ}(S))} is a subset of Φ_{Bse(S′)} because ν_{σ}(S) is a subset of S′ and since A′|_{ι_{Σ′}} ⊧^{EQC} Φ_{Bse(S′)} we are done.

In addition we have ι_{Σ}^{bool}; ι_{Σ}; σ = ι_{Σ′}^{bool}; ι_{Σ′} and thus

A′|_{ι_{Σ}^{bool};ι_{Σ};σ} = A′|_{ι_{Σ′}^{bool};ι_{Σ′}} = 𝔹.

Note that it is not enough to require that A|_{ι_{Σ}^{bool};ι_{Σ}} satisfies Bse(bool) for A to be in Str_{LSL}(Σ) because in this case the functor Str_{LSL} would not preserve the initial object, as the initial object of Sign_{LSL}, Σ_{Bse(bool)}, would be mapped to a category of Σ_{Bse(bool)}-algebras containing isomorphic algebras. Requiring A|_{ι_{Σ}^{bool};ι_{Σ}} to be 𝔹 ensures that Str_{LSL}(Σ_{Bse(bool)}) contains only one object and one morphism — the identity — and thus is a terminal object of Cat.

Theorem 3.39 The institution LSL has amalgamation.

Proof. Consider a functor F : V → Sign_{LSL} with colimit Σ_{cl} = (S_{cl}, Ω_{cl}) and co-cone morphisms ι_{i}^{F} : F (i) → Σ_{cl}:

\xymatrix{ & Σ_{cl} \\ F (1) \ar@{-->}[ur]^{ι_{1}^{F}} &  & F (2) \ar@{-->}[ul]_{ι_{2}^{F}} \\  & F (0) \ar@{-->}[ul]^{F (f)} \ar@{-->}[ur]_{F (g)}}

Assume further a F (1)-algebra A_{1} and a F (2)-algebra A_{2} with A_{1}|_{F (f)} = A_{0} = A_{2}|_{F (g)} then we have to show the existence of a unique Σ_{cl}-algebra A with A|_{ι_{1}^{F}} = A_{1} and A|_{ι_{2}^{F}} = A_{2}.

Σ_{cl} is the colimit of the functor F_{⊥} : J_{⊥} → Sig in Sig:

\xymatrix{ & Σ_{cl} \\ F (1) \ar[ur]^{ι_{1}^{F}} &  & F (2) \ar[ul]_{ι_{2}^{F}} \\  & F (0) \ar@{-->}[ul]_{F (f)} \ar@{-->}[ur]^{F (g)} \\  & Σ_{Bse(bool)} \ar[uul]^{ι_{F (1)}^{bool};ι_{F (1)}} \ar[u] \ar[uur]_{ι_{F (2)}^{bool};ι_{F (2)}}}

Note that we have A_{1}|_{ι_{F (1)}^{bool};ι_{F (2)}} = 𝔹 = A_{2}|_{ι_{F (2)}^{bool};ι_{F (2)}} because A_{1} and A_{2} are algebras from Str_{LSL}(F (1)) and Str_{LSL}(F (2)), respectively. Since Alg preserves colimits, there exists a unique ∐ F_{⊥}-algebra A with A|_{ι_{1}^{F_{⊥}}} = A_{1} and A|_{ι_{2}^{F_{⊥}}} = A_{2}. □

Theorem 3.40 The contravariant functor Str_{LSL} from Sign to Cat preserves colimits.

Proof. Since LSL has amalgamation (cf. Lemma 3.39) we only have to show that the initial object of Sign_{LSL} is mapped to the terminal object of Cat.

The initial object in Sign_{LSL}, Σ_{Bse(bool)}, is mapped to the class of algebras A with

                            A|_{ι_{Σ_{Bse(bool)}}^{bool};ι_{Σ_{Bse(bool)}}} = 𝔹.

Since ι_{Σ_{Bse(bool)}}^{bool} and ι_{Σ_{Bse(bool)}} are the identity we have A = 𝔹. As a consequence, the category Str_{LSL}(Σ_{Bse(bool)}) has only one element and one morphism (the identity) and is therefore a terminal object in Cat. □

Definition 3.41 (Institution LSL) The institution LSL has Sign_{LSL} as its category of signatures and Str_{LSL} as its structure functor. The sentence functor Sen_{LSL} is defined by Sen_{LSL}(Σ) = EqnC(Σ) and Sen_{LSL}(σ) = EqnC(σ) for every signature Σ and every signature morphism σ in Sign_{LSL}, and the family of satisfaction relations (⊧^{LSL}_{Σ})_{Σ∈Sign_{LSL}} is given by A ⊧^{LSL}_{Σ} φ if and only if A ⊧_{Σ}^{EQC} φ for all signatures Σ ∈ Sign_{LSL}, algebras A ∈ Str_{LSL}(Σ) and formulas φ ∈ Sen_{LSL}(Σ).

The satisfaction condition holds for LSL because Str_{LSL}(Σ) is a subcategory of Alg(Σ), Sen_{LSL}(Σ) is the same as EqnC(Σ) and A ⊧^{LSL} φ if and only if A ⊧^{EQC} φ for every A ∈ Str_{LSL}(Σ), φ ∈ Sen_{LSL}(Σ) and Σ ∈ Sign_{LSL}.

As noted before, in case where p is a term of sort bool, we shall write ∀X p as an abbreviation of ∀X p = true.

The following theorem establishes the relation between the consequence relation in LSL and the consequence relation in EQC. The idea is that the set

{A ∈ Str_{LSL}(Σ) | A ⊧ Φ}

is almost the same as

{A ∈ Alg(Σ) | A ⊧ Φ ∪ ι_{Σ}(Φ_{Bse(S)})}.

Almost means that, while the second set is closed under isomorphisms with respect to Alg(Σ), the first is not closed under isomorphisms with respect to Alg(Σ) because A|_{ι_{Σ}} is fixed to be 𝔹. Note however that the first set is still closed under isomorphisms with respect to Str_{LSL}(Σ).

Theorem 3.42 Suppose we are given a set of Σ-formulas Φ and a Σ-formula φ where Σ has sorts S. Then

Φ ⊧^{LSL} φ if and only if Φ ∪ ι_{Σ}(Φ_{Bse(S)}) ⊧^{EQC} φ.

Proof. (⇐) Assume that A ∈ Str_{LSL}(Σ) and A ⊧^{LSL} Φ then, because A ∈ Str_{LSL}(Σ), we have that A|_{ι_{Σ}} ⊧^{EQC} Φ_{Bse(S)} and A ⊧^{EQC} Φ. Since Φ ∪ ι_{Σ}(Φ_{Bse(S)}) ⊧^{EQC} φ we get A ⊧^{EQC} φ, which implies A ⊧^{LSL} φ.

(⇒) Assume that Φ ⊧^{LSL} φ, A ∈ Alg(Σ) and A ⊧^{EQC} Φ ∪ ι_{Σ}(Φ_{Bse(S)}). We have to show that A ⊧^{EQC} φ. To use Φ ⊧^{LSL} φ, we have to find an algebra A′ and in Str_{LSL}(Σ), such that A′ ⊧^{LSL} Φ. Then we have A′ ⊧^{LSL} φ. Because of the definition of ⊧^{LSL} this is equivalent to A′ ⊧^{EQC} φ. If we choose A′ such that A′ is isomorphic to A then A′ ⊧^{EQC} φ implies A ⊧^{EQC} φ because ⊧^{EQC} is closed under isomorphisms (cf. Lemmata 3.13, 3.26 and 3.30).

In the following, we shall abbreviate ι_{Σ}^{bool}; ι_{Σ} by σ.

The carrier sets of A′ are defined by A′(σ(bool)) = 𝔹 and A′(s) = A(s) for every s ≠ σ(bool) ∈ S. The natural transformation ι : A′ ⇒ A is the identity on all sorts s ≠ bool and maps true to A(true) and false to A(false) for bool. Note that ι_{bool} and therefore ι is an isomorphism because, since A satisfies ι_{Σ}(Φ_{Bse(S)}), we have A(bool) = {A(true), A(false)}. Then we define for operations ω : w → s in Ω:

A′(ω)(a_{1}, …, a_{n}) = ι^{−1}(A(ω)(ι(a_{1}), …, ι(a_{n}))).

ι is a homomorphism because

ι(A′(ω)(a_{1}, …, a_{n})) = ι(ι^{−1}(A(ω)(ι(a_{1}), …, ι(a_{n}))))
= A(ω)(ι(a_{1}), …, ι(a_{n})).

It remains to show that A′ is in Str_{LSL}(Σ) and that A′ ⊧^{LSL} Φ. Since A satisfies Φ ∪ ι_{Σ}(Φ_{Bse(bool)}) and ⊧^{EQC} is closed under isomorphisms we get A′ ⊧^{EQC} Φ and A′ ⊧^{EQC} ι_{Σ}(Φ_{Bse(bool)}), which is equivalent to A′|_{ι_{Σ}} ⊧^{EQC} Φ_{Bse(bool)} because of the satisfaction condition of EQC. Since by construction we have A′|_{ι_{Σ}^{bool};ι_{Σ}} = 𝔹, we have A′ ∈ Str_{LSL}(Φ), and by the definition of ⊧^{LSL} we have A′ ⊧^{LSL} Φ. □

4 Specifications of Abstract Datatypes

4.1 Abstract Datatypes

Traditionally, an abstract datatype (Σ, M) is a specification of a datatype in a software system. The signature Σ defines the external interface as a collection of sort and function symbols, and M is a class of Σ-algebras considered admissible implementations of that datatype.

In the context of an arbitrary institution I an abstract datatype is a pair (Σ, M) where Σ is an element of Sign_{I} and M is a full subcategory of Str_{I}(Σ). Depending on the institution, Σ may be a many sorted signature with sorts and function symbols, and M a category of Σ-algebras; or it may denote something totally different. The main construction of this thesis is the definition of an institution such that abstract datatypes in this institution are relations between abstract datatypes from another institution (cf. Section 5.3).

The category of abstract datatypes Adt_{I} has as objects abstract datatypes and as morphisms σ : (Σ, M) → (Σ′, M′) signature morphisms σ : Σ → Σ′ such that m′|_{σ} is in M for all m′ in M′.

A structure m of Str_{I}(Σ) is a model of (Σ, M) if m is in M. In this case we may write m ⊧^{I} (Σ, M). An abstract datatype is called monomorphic if all its models are isomorphic. As before we shall omit the subscript I if the institution is clear from the context.

Note that we do not require the category of models of an abstract datatype to be closed under isomorphism as done, for example, in Loeckx, Ehrich and Wolf [42]. One reason is that nothing in the definition of an institution guarantees that a class of structures satisfying a set of formulas is closed with respect to isomorphism, though, using the institution EQ, EQC or LSL they will. A second reason is that the derive operation introduced in Section 4.2 does not necessarily preserve isomorphism classes, for example, in EQ this is the case if the signature morphism is not injective on sorts (cf. Sannella and Tarlecki [50]).

Two forgetful functors are associated with the category Adt: the covariant functor Sig^{A} from Adt to Sign and the contravariant functor Mod^{A} from Adt to Cat. The functor Sig^{A} maps abstract datatypes to their signatures and abstract datatype morphisms to the their signature morphisms while the functor Mod^{A} maps abstract datatypes to their category of models and an abstract datatype morphism σ : (Σ, M) → (Σ′, M′) to the functor |_{σ} : Str(Σ′) → Str(Σ) restricted to M′.

Sig^{A} creates colimits, and if Str_{I} preserves colimits, then so does Mod^{A}. The fact that Sig^{A} creates colimits implies that one can paste together a collection of abstract datatypes in a unique way if one can paste together their signatures.

Fact 4.1 The functor Sig^{A} : Adt_{I} → Sign_{I} creates colimits.

Proof. Let F : J → Adt be a functor such that the functor F; Sig^{A} : J → Sign has a colimit (ι^{F;Sig^{A}}, ∐(F; Sig^{A})) in Sign. We have to show that there exists a colimit (ι^{F} , ∐ F) in Adt with

Sig^{A}(∐ F) = ∐(F; Sig^{A}) and Sig^{A}(ι^{F}) = ι^{F;Sig^{A}}.

Let F (i) = (Σ_{i}, M_{i}) for each i ∈ J and (ι^{F;Sig^{A}}, Σ_{cl}) be a colimit of F; Sig^{A}. A colimit of F is given by the co-cone morphisms ι^{F} defined by Sig^{A}(ι^{F}) = ι^{F;Sig^{A}} and the colimit object (Σ_{cl}, M_{cl}) where M_{cl} is the full subcategory of Str(Σ_{cl}) with objects

{m ∈ Str(Σ_{cl}) | ∀i ∈ J m|_{ι_{i}^{F}} ∈ M_{i}}.

To show that the abstract datatype (Σ_{cl}, M_{cl}) with co-cone morphisms ι^{F} is indeed a colimit of F we have to show that

1. ι_{i}^{F} : (Σ_{i}, M_{i}) → (Σ_{cl}, M_{cl}) is an Adt-morphisms for i ∈ J and that

2. for each natural transformation μ : F ⇒ Δ(Σ, M) there exists a unique Adt-morphism h_{μ} from (Σ_{cl}, M_{cl}) to (Σ, M) such that

ι_{i}^{F}; h_{μ} = μ_{i}

for all i ∈ J.

(1) The reduct m|_{ι_{i}^{F}} is in M_{i} for each m ∈ M_{cl} and i ∈ J by the definition of M_{cl}.

(2) Note that μ; Sig^{A} is a natural transformation from F; Sig^{A} to Δ(Σ), thus there exists a unique signature morphism h_{μ} from the colimit Σ_{cl} of F; Sig^{A} to Σ with ι_{i}^{F;Sig^{A}}; h_{μ} = (μ; Sig^{A})_{i} for all i ∈ J.

It remains to show that the signature morphism h_{μ} is also an Adt-morphism, that is, m|_{h_{μ}} is in M_{cl} for all m ∈ M. The reduct m|_{h_{μ}} is in M_{cl} if (m|_{h_{μ}})|_{ι_{i}^{F;Sig^{A}}} is in M_{i} for all i ∈ J by the definition of M_{cl}. Because μ_{i} is an Adt-morphism we have m|_{μ_{i}} is in M_{i}, and because μ_{i} = ι_{i}^{F;Sig^{A}}; h_{μ} we get

(m|_{h_{μ}})|_{ι_{i}^{F;Sig^{A}}} = m|_{ι_{i}^{F;Sig^{A}};h_{μ}} = m|_{μ_{i}}.
□

A diagram F : J → Adt has a colimit if the diagram F; Sig^{A} : J → Sign_{I} has a colimit. Thus, if every diagram in Sign has a colimit, then every diagram in Adt has a colimit (cf. Theorem 2.11).

Corollary 4.2 The category Adt_{I} of abstract datatypes is (finitely) co-complete if the category of signatures Sign_{I} is (finitely) co-complete.

The initial object in Adt is (Σ_{⊥}, Str(Σ_{⊥})) where Σ_{⊥} is the initial object in Sign.

Note that it could well be that the colimit of a functor F : J → Adt_{I} exists while F; Sig^{A} has no colimit. However, in the following theorem we prove that Sig^{A} has a right adjoint which implies that Sig^{A} preserves colimits (c.f. Theorem 2.25).

Theorem 4.3 Let U_{Sig} be the functor from Sign_{I} to Adt_{I} defined by

U_{Sig}(Σ) = (Σ, {}) and U_{Sig}(σ) = σ.

Then U_{Sig} is a right adjoint for Sig^{A}.

Proof. The unit of the adjunction is the natural transformation η : Id_{Adt_{I}} ⇒ Sig^{A}; U_{Sig} where η_{(Σ,M)} : (Σ, M) → (Σ, {}) is given by the identity on Σ.

If σ is an Adt_{I}-morphism from (Σ, M) to U_{Sig}(Σ′) for some signature Σ′, then the unique morphism σ̃ from (Σ, M) to (Σ′, {}) is given by the signature morphism σ. Since η_{(Σ,M)} is the identity on Σ we get η_{(Σ,M)}; Sig^{A}(σ̃) = σ. □

Corollary 4.4 The functor Sig^{A} preserves colimits.

If the contravariant functor Str_{I} from Sign_{I} to Cat preserves colimits, so does the contravariant functor Mod^{A} from Adt to Cat. This means that every model m of the colimit of a functor F : J → Adt_{I} is uniquely determined by a family of models m_{i} ∈ Mod^{A}(F (i)) for each i ∈ J. This is the amalgamation lemma of Ehrig and Mahr [19].

Fact 4.5 The contravariant functor Mod^{A} from Adt_{I} to Cat preserves (finite) colimits if the contravariant functor Str_{I} from Sign_{I} to Cat does.

Proof. Let F from J to Adt be a functor with colimit (ι^{F} , (Σ_{cl}, M_{cl})). To show that (Mod^{A}(ι^{F}), Mod^{A}((Σ_{cl}, M_{cl})) is a limit of F; Mod^{A} consider a natural transformation μ : ΔC ⇒ F; Mod^{A} where C is a category. Let F (i) = (Σ_{i}, M_{i}). Since, by the definition of abstract datatypes, Mod^{A}(F (i)) is a subcategory of Str_{I}(Sig^{A}(F (i))), μ is also a natural transformation from ΔC to F; Sig^{A}; Str_{I}. Because Str_{I} and Sig^{A} preserve colimits, the category Str_{I}(Sig^{A}((Σ_{cl}, M_{cl}))) = Str_{I}(Σ_{cl}) is a limit object of F; Sig^{A}; Str_{I} and therefore there exists a unique functor h_{μ} from C to Str_{I}(Σ_{cl}) with

h_{μ}(c)|_{ι_{i}^{F}} = μ_{i}(c)

for each c ∈ C and i ∈ J.

It remains to show that h_{μ} is also a functor from C to M_{cl}, that is, h_{μ}(c) is an object of M_{cl} and h_{μ}(f) is a morphism of M_{cl} for all objects c and morphisms f in C. Let c be an object of C, then h_{μ}(c)|_{ι_{i}^{F}} equals μ_{i}(c), which is an element of Mod^{A}(F (i)) because of the definition of μ. If f is a morphism in C, then a similar argument shows that h_{μ}(f) is a morphism in M_{cl}. □

4.2 The Specification Language SL_{I}

In this section we are going to define an ASL-like specification language SL_{I} based on the operations Σ (signature), I_{Φ} (impose), D_{σ} (derive), T_{σ} (translate), and + (union) (cf. Sannella and Wirsing [53]). The semantics of an SL_{I}-expression is an abstract datatype in Adt_{I}. A signature Σ, as a specification expression, denotes the abstract datatype with signature Σ and with the category of models the category of Σ-structures.

Impose allows to impose additional requirements on a specification. The semantics of an expression I_{Φ}Sp is the abstract datatype with the same signature as the signature of the abstract datatype denoted by Sp and with models all the models of Sp satisfying the set of formulas Φ.

The translate operation can be used to rename symbols in a signature, but also to add new symbols to a signature. If σ is a signature morphism from Σ to Σ′, then the expression T_{σ}Sp denotes an abstract datatype of signature Σ′ with models all extensions of models of Sp with respect to Str_{I}(σ).

The derive operation allows to hide parts of a signature. D_{σ}Sp denotes the abstract datatype having as signature the domain of σ and as models the translations of the models of Sp by Str_{I}(σ).

At last, the union operation is used to combine two specifications. Since for arbitrary institutions the union of signatures is not defined, we have to require that both specifications have the same signature.

The semantics of Sp_{1} + Sp_{2} is the abstract datatype with signature the signature of Sp_{1}, which is the same as the signature of Sp_{2}, and as models the intersection of the category of models of Sp_{1} and Sp_{2}.

To form the union of two specifications Sp_{1} and Sp_{2} of different signatures Σ_{1} and Σ_{2}, one has to provide a signature Σ, signature morphisms σ_{1} : Σ_{1} → Σ and σ_{2} : Σ_{2} → Σ, and write T_{σ_{1}}Sp_{1} + T_{σ_{2}}Sp_{2}. In an institution where the union of two signatures is defined, like EQ (cf. Section 3.1), Σ could be the union of Σ_{1} and Σ_{2}. In this case σ_{i} is the inclusion of Σ_{i} into Σ for i ∈ {1, 2}.

In Chapter 8 we add disjunction (Sp_{1} ∨ Sp_{2}) to SL_{I} having as semantics the union of the category of models of Sp_{1} and Sp_{2}. This operation will be useful in the construction of new relations (cf. the example in Chapter 8).

The specification language SL_{I} is mainly intended for theoretical studies and not as a specification language used in practice. However, the semantics of more practical specification languages like Pluss [8], CASL [45], and the Larch Shared Language [34] can be given in the terms of the constructs of SL_{I}.

4.2 The Specification Language SL_{I}  69

Note that SL_{I} does not contain constructs for behavioral abstraction and restriction to minimal models, which, for example, can be found by Sannella and Tarlecki [50] or Farrés-Casals [21]. We assume that these issues are dealt with on the level of the institution itself by means of appropriate constraints, like generating and partitioned-by constraints (cf. Section 3.3). In Section 5.9 we use SL_{I} as the basis for the language RSL used for the construction of relations. Definition 4.6 (Abstract Syntax of SL_{I}) Given an institution I, signatures Σ, Σ_{1}, and Σ_{2}, the abstract syntax of the specification language SL_{I} is given by:

Sp ::= Σ | I_{Φ}Sp | D_{σ}Sp | T_{σ}Sp | Sp + Sp

where Φ is a finite set of Σ-formulas and σ is a signature morphism. The signature Sig(Sp) of a specification expression Sp is defined inductively as follows:

Sig(Σ) = Σ  Sig(I_{Φ}Sp) = Sig(Sp)
Sig(D_{σ}Sp) = dom(σ)  Sig(T_{σ}Sp) = cod(σ)
Sig(Sp_{1} + Sp_{2}) = (Sig(Sp_{1}) = Sig(Sp_{2}))

A specification expression Sp from SL_{I} is well-formed if • Sp = Σ and Σ ∈ Sign_{I}.

• Sp = I_{Φ}Sp′, Φ ⊆ Sen_{I}(Sig(Sp′)), and Sp′ is well-formed.

• Sp = D_{σ}Sp′, σ is a signature morphism from Σ to Sig(Sp′), and Sp′ is well-formed.

• Sp = T_{σ}Sp′, σ is a signature morphism from Sig(Sp′) to Σ, and Sp′ is well-formed.

• Sp = Sp_{1} + Sp_{2}, Sig(Sp_{1}) = Sig(Sp_{2}), and Sp_{1} and Sp_{2} are well-formed.

The semantics of a well-formed specification expression in SL_{I} is an abstract datatype in Adt_{I} with the same signature. Definition 4.7 (Semantics of SL_{I}) Given well-formed specification expressions Sp, Sp_{1}, and Sp_{2}, then the semantics [ [ ] ] : SL_{I} → Adt_{I} is defined as follows:

• [ [Σ] ] = (Σ, Str_{I}(Σ))

• \begin{matrix}[ \\ [ & I_{Φ}Sp & ] \\ ] \end{matrix} = (Sig(Sp), \{m ∈ Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix}) | m ⊧^{I} Φ\})

• \begin{matrix}[ \\ [ & D_{σ}Sp & ] \\ ] \end{matrix} = (dom(σ), \{m|_{σ} | m ∈ Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix})\})

• \begin{matrix}[ \\ [ & T_{σ}Sp & ] \\ ] \end{matrix} = (cod(σ), \{m ∈ Str_{I}(cod(σ)) | m|_{σ} ∈ Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix})\})

• [ [Sp_{1} + Sp_{2}] ] = (Sig(Sp_{1}), Mod^{A}(\begin{matrix}[ \\ [ & Sp_{1} & ] \\ & ] \end{matrix}) ∩ Mod^{A}(\begin{matrix}[ \\ [ & Sp_{2} & ] \\ & ] \end{matrix}))

For any specification expression Sp from SL_{I} we have Sig(Sp) = Sig^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix}). The objects of the category SL_{I} are specification expressions and the morphisms σ : Sp_{1} → Sp_{2} are those signature morphisms σ from Sig(Sp_{1}) to Sig(Sp_{2}) which are also Adt_{I}- morphisms σ from [ [Sp_{1}] ] to [ [Sp_{2}] ].

We extend [ [ ] ] to a functor form SL_{I} to Adt_{I} by mapping SL_{I}-morphisms σ to their corresponding Adt_{I}-morphisms.

In analogy to M ⊧^{I} φ we write Sp ⊧^{I} φ and Sp ⊧^{I} Φ to denote Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix}) ⊧^{I} φ and Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix}) ⊧^{I} Φ, respectively, and further we write Sp_{1} ⊧^{I} Sp_{2} to denote Mod^{A}(\begin{matrix}[ \\ [ & Sp_{1} & ] \\ & ] \end{matrix}) ⊆ Mod^{A}(\begin{matrix}[ \\ [ & Sp_{2} & ] \\ & ] \end{matrix}) for two specification expressions Sp_{1} and Sp_{2} of the same signature. We also write m ⊧^{I} Sp and m ∈ Sp for m ∈ Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix}). We have Sp_{1} = Sp_{2} if Sp_{1} ⊧^{I} Sp_{2} and Sp_{2} ⊧^{I} Sp_{1} or, equivalently, if [ [Sp_{1}] ] = [ [Sp_{2}] ].

Fact 4.8 The operations I_{Φ}, D_{σ}, T_{σ}, and + are monotonic with respect to model inclusion, for example, if

Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix}) ⊆ Mod^{A}([[Sp′]])

then

Mod^{A}(\begin{matrix}[ \\ [ & I_{Φ}Sp & ] \\ ] \end{matrix}) ⊆ Mod^{A}([[I_{Φ}Sp′]]).

Monotonicity allows to conclude from Sp_{1} ⊧ Sp_{2} the facts that T_{σ}Sp_{1} ⊧ T_{σ}Sp_{2}, D_{σ}Sp_{1} ⊧ D_{σ}Sp_{2}, and I_{Φ}Sp_{1} ⊧ I_{Φ}Sp_{2}. Similar union is monotonic if one argument is fixed, that is, Sp + Sp_{1} ⊧ Sp + Sp_{2} holds if Sp_{1} ⊧ Sp_{2} holds.

Union is associative and commutative, and therefore we may write Sp_{1} + ⋯ + Sp_{n} instead of, e.g., (⋯ (Sp_{1} + Sp_{2}) + ⋯) + Sp_{n}).

What follows are some useful equalities relating the operations of SL_{I} to each other.

Fact 4.9 Let Sp, Sp_{1} and Sp_{2} be specification expressions and σ, σ_{1}, and σ_{2} signature morphisms.

First some special cases:

I_{{}}Sp = Sp  Sp + Sp = Sp
Sp + Σ = Sp  D_{id}Sp = Sp
T_{id}Sp = Sp

Rules for Impose:

I_{Φ_{1}}I_{Φ_{2}}Sp = I_{Φ_{1}∪Φ_{2}}Sp  I_{Φ}(Sp_{1} + Sp_{2}) = I_{Φ}Sp_{1} + I_{Φ}Sp_{2}
I_{Φ}Sp = I_{Φ}Σ + Sp  I_{Φ}D_{σ}Sp = D_{σ}I_{σ(Φ)}Sp

Rules for Translate:

T_{σ_{1}}T_{σ_{2}}Sp = T_{σ_{2};σ_{1}}Sp  T_{σ}I_{Φ}Sp = I_{σ(Φ)}T_{σ}Sp
T_{σ_{1}}D_{σ_{2}}Sp = D_{σ′_{2}}T_{σ′_{1}}Sp  T_{σ}(Sp_{1} + Sp_{2}) = T_{σ}Sp_{1} + T_{σ}Sp_{2}
T_{σ}dom(σ) = cod(σ)

The equation T_{σ_{1}}D_{σ_{2}}Sp = D_{σ′_{2}}T_{σ′_{1}}Sp is true only if the pushout of σ_{1} and σ_{2} exists and I has amalgamation. In this case σ′_{1} and σ′_{2} are the co-cone morphisms of the following pushout in Sign_{I}:

\xymatrix{ & Σ_{cl} \\ Σ_{1} \ar[ur]^{σ′_{2}} &  & Σ_{2} \ar[ul]_{σ′_{1}} \\  & Σ \ar[ul]^{σ_{1}} \ar[ur]_{σ_{2}}}

Rules for Derive:

D_{σ_{1}}D_{σ_{2}}Sp = D_{σ_{1};σ_{2}}Sp  D_{σ}(Sp_{1} + T_{σ}Sp_{2}) = D_{σ}Sp_{1} + Sp_{2}
D_{σ}cod(σ) ⊧ dom(σ)  D_{σ}I_{Φ}Sp ⊧ I_{σ^{−1}(Φ)}D_{σ}Sp
D_{σ}(Sp_{1} + Sp_{2}) ⊧ D_{σ}Sp_{1} + D_{σ}Sp_{2}  D_{σ}T_{σ}Sp ⊧ Sp

σ^{−1}(Φ) is the set of all dom(σ)-formulas φ such that σ(φ) is in Φ.

Proof. As examples we show

1. D_{σ}Sp_{1} + Sp_{2} = D_{σ}(Sp_{1} + T_{σ}Sp_{2}) and

2. T_{σ_{1}}D_{σ_{2}}Sp = D_{σ′_{2}}T_{σ′_{1}}Sp.

(1)(⊆) Let m be in D_{σ}Sp_{1} + Sp_{2}, we have to show that there exists m_{1} in Sp_{1} + T_{σ}Sp_{2} such that m_{1}|_{σ} = m. Since m ∈ D_{σ}Sp_{1}, there exists a model m′ of Sp_{1} such that m′|_{σ} = m. Set m_{1} = m′. Then we have to show that m_{1} ∈ T_{σ}Sp_{2}, which is implied by m ⊧ Sp_{2} and m_{1}|_{σ} = m.

(⊇) Let m be in D_{σ}(Sp_{1} + T_{σ}Sp_{2}), which means there exists m_{1} with m_{1} ⊧^{I} Sp_{1}, m_{1} ⊧^{I} T_{σ}Sp_{2}, and m_{1}|_{σ} = m. Then we have m ⊧ D_{σ}Sp_{1} and m ⊧ Sp_{2}.

(2)(⊆) To show that T_{σ_{1}}D_{σ_{2}}Sp = D_{σ′_{2}}T_{σ′_{1}}Sp, let first m_{1} be a model of T_{σ_{1}}D_{σ_{2}}Sp. Then we have to show that m_{1} is a model of D_{σ′_{2}}T_{σ′_{1}}, that is, there exists m ∈ Str_{I}(Σ_{cl}) with m|_{σ′_{2}} being a model of Sp and m|_{σ′_{1}} = m_{1}.

Since m_{1} is a model of T_{σ_{1}}D_{σ_{2}}Sp, there exists a model m_{2} of Sp such that m_{1}|_{σ_{1}} = m_{2}|_{σ_{2}}. Then m is the amalgamated sum of m_{1} and m_{2}.

(⊇) On the other hand, if m_{1} is a model of D_{σ′_{2}}T_{σ′_{1}}Sp, then we have to show that there exists a model m_{2} of Sp with m_{1}|_{σ_{1}} = m_{2}|_{σ_{2}}. Since m_{1} is a model of D_{σ′_{2}}T_{σ′_{1}}Sp, there exists m ∈ Str_{R_{I}}(Σ_{cl}) with m|_{σ′_{1}} = m_{1} and we have

m|_{σ_{1};σ′_{2}} = (m|_{σ′_{2}})|_{σ_{1}} = m|_{σ_{2};σ′_{1}} = m_{1}|_{σ_{2}}

because σ_{1}; σ′_{2} = σ_{2}; σ′_{1}. Then m_{2} is m|_{σ′_{2}}. □

Note that dom(σ) ⊧^{I} D_{σ}cod(σ) holds only if each dom(σ)-structure can be extended to a cod(σ)-structure. In EQ this is for example not possible if the signature morphism is not injective. Consider a signature morphism with σ(s_{1}) = σ(s_{2}) = s and a dom(σ)-algebra A with A(s_{1}) ≠ A(s_{2}), then it is impossible to find a cod(σ)-algebra A′ with A′|_{σ} = A because A′|_{σ}(s_{1}) = A′(s) = A′|_{σ}(s_{2}).

Also note that D_{σ}Sp_{1} + D_{σ}Sp_{2} does not imply D_{σ}(Sp_{1} + Sp_{2}). The problem is that in the first case two extensions m_{1} ⊧^{I} Sp_{1} and m_{2} ⊧^{I} Sp_{2} of a structure m have to exist while in the second case one extension m̄ ⊧^{I} Sp_{1} + Sp_{2} has to exist.

Let Sp_{1} be an extension of Nat by a constant c : ℕ with the constraint c = 3 and Sp_{2} be an extension of Nat with c = 4. Then Sp_{1} + Sp_{2} has no models while D_{σ}Sp_{1} = Nat = D_{σ}Sp_{2} and therefore D_{σ}Sp_{1} + D_{σ}Sp_{2} = Nat.

However, we have the following theorem:

Theorem 4.10 Provided that the institution I has amalgamation and that the pushout of σ_{1} : Σ_{0} → Σ_{1} and σ_{2} : Σ_{0} → Σ_{2} exists with co-cone morphisms σ′_{1} and σ′_{2}, then

D_{σ_{1};σ′_{2}}(T_{σ′_{2}}Sp_{1} + T_{σ′_{1}}Sp_{2}) = D_{σ_{1}}Sp_{1} + D_{σ_{2}}Sp_{2}.

Proof. The problematic direction is to show

D_{σ_{1}}Sp_{1} + D_{σ_{2}}Sp_{2} ⊧^{I} D_{σ_{1};σ′_{2}}(T_{σ′_{2}}Sp_{1} + T_{σ′_{1}}Sp_{2})

because we are given two extensions m_{1} ∈ Mod^{A}(\begin{matrix}[ \\ [ & Sp_{1} & ] \\ & ] \end{matrix}) and m_{2} ∈ Mod^{A}(\begin{matrix}[ \\ [ & Sp_{2} & ] \\ & ] \end{matrix}) of every m in D_{σ_{1}}Sp_{1} + D_{σ_{2}}Sp_{2}, but we have to find just one extension m′ in T_{σ′_{2}}Sp_{1} + T_{σ′_{1}}Sp_{2}.

Since the pushout of σ_{1} and σ_{2} exists and I has amalgamation, we set m′ to be the amalgamated sum of m_{1} and m_{2} with respect to m. Then we have m′|_{σ′_{2}} is a model of Sp_{1} because m′|_{σ′_{2}} = m_{1} and similar m′|_{σ′_{1}} is a model of Sp_{2}. □

The above theorem is related to the middle distributive law of Goguen and Diaconescu [27]. The difference is that Goguen and Diaconescu define hiding on theories and not on model classes as it is done here. Thus they have to require other properties in addition to amalgamation.

It is well-known, for example Ehrig, Wagner and Thatcher [18], Breu [11], Bergstra, Heering and Klint [7], and Cengarle [14], that using the equalities given in Fact 4.9 any specification expression Sp in SL_{I} can be brought into the form D_{σ}I_{Φ}Σ.

Theorem 4.11 (Normal-form) Given an institution I with a cocomplete category of signatures Sign_{I} and such that I has amalgamation. For any well-formed specification expression Sp in SL_{I} there exists a well-formed specification expression D_{σ}I_{Φ}Σ such that [ [Sp] ] =

\begin{matrix}[ \\ [ & D_{σ}I_{Φ}Σ & ] \\ ] \end{matrix}.

Proof. The theorem follows from the application of the equalities of Fact 4.9. For example, Σ is equivalent to D_{id}I_{{}}Σ, and

D_{σ_{1}}I_{Φ_{1}}Σ_{1} + D_{σ_{2}}I_{Φ_{2}}Σ_{2} = D_{σ_{1}}(I_{Φ_{1}}Σ_{1} + T_{σ_{1}}D_{σ_{2}}I_{Φ_{2}}Σ_{2})
= D_{σ_{1}}(I_{Φ_{1}}Σ_{1} + D_{σ′_{2}}T_{σ′_{1}}I_{Φ_{2}}Σ_{2})
= D_{σ_{1}}D_{σ′_{2}}(T_{σ′_{2}}I_{Φ_{1}}Σ_{1} + T_{σ′_{1}}I_{Φ_{2}}Σ_{2})
= D_{σ_{1};σ′_{2}}(I_{σ′_{2}(Φ_{1})}Σ_{cl} + I_{σ′_{1}(Φ_{2})}Σ_{cl})
= D_{σ_{1};σ′_{2}}I_{σ′_{2}(Φ_{1})∪σ′_{1}(Φ_{2})}Σ_{cl}

where σ′_{1} and σ′_{2} are the co-cone morphisms from Σ_{1} and Σ_{2} into the pushout signature Σ_{cl}. □

Derived Operations

The category SL_{I} is finitely cocomplete if Sign_{I} is. Let F : J → SL_{I} be a functor such that J is finite, and its collection of objects is given by the set {i_{1}, …, i_{n}}. Then the expression

T_{ι_{i_{1}}^{F;Sig}}F (i_{1}) + ⋯ + T_{ι_{in}^{F;Sig}}F (i_{n})

is the colimit of F. The co-cone morphisms are the co-cone morphisms of the colimit of F; Sig. Assume that μ is a natural transformation from F to ΔSp, then μ; Sig is a natural transformation from F to ΔSig(Sp), and thus there exists a unique signature morphism σ from ∐ F; Sig to Sig(Sp) with ι_{i}^{F;Sig}; σ = μ_{i} for all i ∈ J. Let m be a model of Sp, we have to show that m|_{σ} is a model of ∐ F. By the definition of ∐ F this is equivalent to showing that (m|_{σ})|_{ι_{i}^{F;Sig}} is a model of F (i) for all i ∈ J. This is true because ι_{i}^{F;Sig}; σ = μ_{i} and μ_{i} is an SL_{I}-morphism.

Note that SL_{I} still has only finite colimits even if Sign_{I} has also colimits of infinite diagrams because it is impossible to express a union of infinitely many specifications in SL_{I}.

The existence of finite colimits in SL_{I}, provided that Sign_{I} is finitely cocomplete, motivates the following extensions to SL_{I}

Sp ::= … | colim F | Sp_{1} +_{(σ_{1},σ_{2})} Sp_{2} | Sp_{1} +_{Sp_{0}} Sp_{2}

where F is a functor from J to SL_{I} with J being a finite category, and σ_{1} : Sp_{0} → Sp_{1} and σ_{2} : Sp_{0} → Sp_{2} are SL_{I}-morphisms.

Then colim F is defined as an abbreviation for the specification expression

T_{ι_{i_{1}}^{F;Sig}}F (i_{1}) + ⋯ + T_{ι_{in}^{F;Sig}}F (i_{n})

where i_{1}, …, i_{n} are the objects of J. For the special case where F is a pushout diagram, we write Sp_{1} +_{(σ_{1},σ_{2})} Sp_{2} instead of colim F. Also we may write Sp_{1} +_{Sp_{0}} Sp_{2} if σ_{1} and σ_{2} are the “canonic” SL_{I}-morphisms from Sp_{0} to Sp_{1} and Sp_{2}, for example in LSL this would be given by the inclusion of signatures.

The following theorem shows that the semantics of colim F is a colimit of F; [ [ ] ] in Adt_{I}.

Theorem 4.12 The functor [ [ ] ] from SL_{I} to Adt_{I} preserves colimits, that is, given a specification expression colim F then

\begin{aligned}[ \\ [ & colim F & ] \\ & ] \end{aligned} = ∐ F; [ [ ] ] ,

for functors F : J → SL_{I}.

Proof. The theorem is a consequence of the construction of colimits in Adt_{I}, given in the proof of Theorem 4.1. □

If each F (i) has the form I_{Φ_{i}}Σ_{i}, then the following is a consequence of the definition of colim F and the equalities I_{Φ_{1}}Sp + I_{Φ_{2}}Sp = I_{Φ_{1}∪Φ_{2}}Sp and T_{σ}I_{Φ}Sp = I_{σ(Φ)}T_{σ}Sp:

Theorem 4.13 Given a functor F mapping objects in J to specification expressions of the form I_{Φ_{i}}Σ_{i} in SL_{I} and morphisms f : i → j to SL_{I}-morphisms F (f) from I_{Φ_{i}}Σ_{i} to I_{Φ_{j}}Σ_{j}, then

colim F = I_{Φ}Σ_{cl}

where Σ_{cl} is the colimit of F; Sig and Φ is the union of all Φ_{i} translated by the co-cone morphisms ι_{i}^{F;Sig} for i ∈ J.

For institutions with many sorted signatures, like EQ, EQC and LSL, we use

introduces sorts S
introduces Ω
asserts Φ

as an abbreviation for I_{Φ}Σ where Σ is the signature with sorts S and operation symbols Ω, and

includes Sp[y_{1} for x_{1}, ..., y_{n} for x_{n}]
introduces sorts S
introduces Ω
asserts Φ

as an abbreviation for I_{Φ}T_{σ}Sp where σ is a signature morphism from Sig(sp) = (S_{1}, Ω_{1}) to (S_{1} ∪ S, Ω_{1} ∪ Ω) such that σ(x_{i}) = y_{i} for compatible operation or sort symbols x_{i} and y_{i} (1 ≤ i ≤ n). We may not mention the set of sorts explicitly if it can be deduced from the family of operations Ω. We are omitting any of the introduces or asserts part if the corresponding family of operation symbols or set of axioms is empty. These abbreviations are modeled after the syntax of the Larch Shared Language [34]. If we want to give a specification expression a name, for example, Name = I_{Φ}T_{σ}Sp, we write

Name : trait
includes Sp
introduces Ω
asserts Φ

For specification expressions Sp, Sp_{1} and Sp_{2} and signature inclusions ι_{1} from Sig(Sp) to Sig(Sp_{1}) and ι_{2} from Sig(Sp) to Sig(Sp_{2}), we write Sp_{1} +_{Sp} Sp_{2} instead of Sp_{1} +_{(ι_{1},ι_{2})} Sp_{2}.

4.3 Proving Specification Entailment in SL_{I}  75

4.3 Proving Specification Entailment in SL_{I}

We are interested in the problem of proving that a formula φ is a consequence of the specification Sp and that Sp′ is entailed by Sp for specification expressions Sp and Sp′ in SL_{I}. Since proving that φ is a consequence of Sp is the same as proving that the specification expression I_{{φ}}Σ is entailed by Sp, we restrict our attention to specification entailment.

Using the normal-form theorem of the previous section, the problem of showing Sp_{1} ⊧ Sp_{2} can be reduced to the problem of showing D_{σ_{1}}I_{Φ_{1}}Σ_{1} ⊧ D_{σ_{2}}I_{Φ_{2}}Σ_{2}. Consider for now that σ_{2} is the identity, the case where σ_{2} is not the identity is treated in Section 4.4.

If we are given a sound inference system, that is, a family of relations

(⊢_{Σ}^{I} ⊆ 2^{Sen_{I}(Σ)} × Sen_{I}(Σ))_{Σ∈Sign_{I}}

such that Φ ⊢_{Σ}^{I} φ, or for short Φ ⊢^{I} φ, implies Φ_{1} ⊧^{I} φ, then to prove D_{σ_{1}}I_{Φ_{1}}Σ_{1} ⊧ I_{Φ_{2}}Σ_{2}, it suffices to prove Φ_{1} ⊢^{I} σ_{1}(Φ_{2}), which is short for Φ_{1} ⊢^{I} φ for all φ ∈ σ_{1}(Φ_{2}).

However, this strategy does not make use of the structure of Sp_{1} and Sp_{2}. For example, to prove Sp + Sp_{1} ⊧ Sp + Sp_{2}, it suffices to prove Sp + Sp_{1} ⊧ Sp_{2}, and therefore we need only compute the normal-form of Sp_{2} instead of Sp + Sp_{2}. In addition, in Chapter 8 we shall extend the specification language SL_{I} with disjunction, and for the extended specification language the normal-form theorem does not hold anymore for all specification expressions. Therefore, we introduce a set of inference rules that allow to reduce the goal of proving a specification entailment into a sequence of subgoals which, for example, could be proved using the strategy of computing the normal-form, in case it exists.

A first set of inference rules are extensions of the rules for proving Sp ⊢ φ using the structure of Sp found by Sannella and Tarlecki [50] or Wirsing [61] to rules for proving specification entailment. For example,

\frac{Sp ⊢ σ(φ)}{D_{σ}Sp ⊢ φ}

is extended to

\frac{Sp ⊢ T_{σ}Sp′}{D_{σ}Sp ⊢ Sp′}

The first rule is an instance of the second rule if we set Sp′ to I_{{φ}}Σ.

L1 \frac{Sp ⊢ Sp′}{I_{Φ}Sp ⊢ Sp′}  L2 \frac{I_{Φ}Σ ⊢ Sp′}{I_{Φ}Sp ⊢ Sp′}  L3 \frac{I_{\{\}}Σ ⊢ Sp′}{Σ ⊢ Sp′}

L4 \frac{Sp ⊢ Sp′}{T_{σ}Sp ⊢ T_{σ}Sp′}  L5 \frac{Sp ⊢ T_{σ}Sp′}{D_{σ}Sp ⊢ Sp′}

L6 \frac{Sp ⊢ Sp_{1}}{Sp + Sp′ ⊢ Sp_{1}}  L6’ \frac{Sp′ ⊢ Sp_{1}}{Sp + Sp′ ⊢ Sp_{1}}

The next two rules connect the inference system for proving Sp ⊢ Sp′ with the inference system for proving Φ ⊢^{I} Φ′, which depends on the institution I.

L7 \frac{Φ′ ⊆ Φ}{I_{Φ}Σ ⊢ I_{Φ′}Σ}  L8 \frac{Sp ⊢ I_{Φ_{1}}Σ … Sp ⊢ I_{Φ_{n}}Σ (⋃_{i=1}^{n} Φ_{i}) ⊢^{I} Φ′}{Sp ⊢ I_{Φ′}Σ}

Note that the inference system is to be understood modulo the equalities of specification expressions given in Fact 4.9. For example, if we want to prove D_{σ}Sp ⊢ I_{Φ}Σ, we have to show Sp ⊢ T_{σ}I_{Φ}Σ. Since T_{σ}I_{Φ}Σ equals I_{σ(Φ)}Σ′, it suffices showing Sp ⊢ I_{σ(Φ)}Σ′. Thus the consequent can be guaranteed to be of the form I_{Φ}Σ after the application of the above rules if the consequent was in that form before.

The next set of rules allows the decomposition of the consequent into a set of rules Sp_{i} ⊢ I_{Φ_{i}}Σ_{i}. Similar rules can be found in Wirsing [61] and Hennicker, Wirsing, and Bidoit [38].

R1 \overline{Sp ⊢ Sig(Sp)}  R2 \frac{Sp ⊢ I_{Φ}Σ Sp ⊢ Sp′}{Sp ⊢ I_{Φ}Sp′}

R3 \frac{Sp ⊢ D_{σ}Sp′′ Sp′′ ⊢ Sp′}{Sp ⊢ D_{σ}Sp′}  R5 \frac{D_{σ}Sp ⊢ Sp′}{Sp ⊢ T_{σ}Sp′}

R4 \frac{Sp ⊢ Sp_{1} Sp ⊢ Sp_{2}}{Sp ⊢ Sp_{1} + Sp_{2}}

The third set of rules allows to exploit similarities between Sp and Sp′ in the proofs of Sp ⊢ Sp′. The rules for monotonicity of impose, union, and derive are derived rules using the above rules. The rule for monotonicity of translate is rule L4.

Id \overline{Sp ⊢ Sp}  Cut \frac{Sp ⊢ Sp′′ Sp′′ ⊢ Sp′}{Sp ⊢ Sp′}

M1 \frac{Sp ⊢ Sp′}{D_{σ}Sp ⊢ D_{σ}Sp′}  M2 \frac{Sp ⊢ Sp′}{I_{Φ}Sp ⊢ I_{Φ}Sp′}

M3 \frac{Sp ⊢ Sp′}{Sp + Sp′′ ⊢ Sp′ + Sp′′}  M3’ \frac{Sp ⊢ Sp′}{Sp′′ + Sp ⊢ Sp′′ + Sp}

For convenience we also provide rules for the four inequalities of Fact 4.9, although they are derived rules. Rule I3 is a consequence of rules R6, L4, and the monotonicity of derive; I4 can be proved using rule L5; I2 exploits the fact that σ(σ^{−1}(Φ)) ⊆ Φ; and I1 is an instance of rule R1.

I1 \overline{D_{σ}cod(σ) ⊢ dom(σ)}  I2 \overline{D_{σ}I_{Φ}Sp ⊢ I_{σ^{−1}(Φ)}D_{σ}Sp}

I3

D_{σ}(Sp_{1} + Sp_{2}) ⊢ D_{σ}Sp_{1} + D_{σ}Sp_{2}

I4 \overline{D_{σ}T_{σ}Sp ⊢ Sp}

4.4 Problems with Derive

Proving D_{σ}Sp ⊢ Sp′ poses no problems for this is the same as

∀m (∃m′ m′|_{σ} = m ∧ m′ ⊢ Sp) ⇒ m ⊧ Sp′

which is equivalent to

∀m, m′ m′|_{σ} = m ∧ m′ ⊧ Sp ⇒ m ⊧ Sp′,

and using m′|_{σ} = m we get

∀m′ m′ ⊧ Sp ⇒ m′|_{σ} ⊧ Sp′.

Note that m′|_{σ} ⊧ Sp′ is the same as m′ ⊧ T_{σ}Sp′, and therefore D_{σ}Sp ⊧ Sp′ can be proved by showing Sp ⊧ T_{σ}Sp′.

However, if D_{σ} occurs at the top of the consequent, i.e., Sp ⊧ D_{σ}Sp′, then we have to show that

∀m m ⊧ Sp ⇒ ∃m′ m′ ⊧ Sp′ ∧ m′|_{σ} = m.

The problem is to prove that all models m of Sp can be extended to a model m′ of Sp′.

One way to prove this is to provide a refinement Sp′′ of Sp′, that is, we have Sp′′ ⊧ Sp′, and show that each model of Sp can be extended to a model of Sp′′. The idea is that it is easier to prove Sp ⊧ D_{σ}Sp′′ than to prove Sp ⊧ D_{σ}Sp′. Thus we have the following rule, which is a consequence of the cut rule and monotonicity of derive:

R3 \frac{Sp ⊢ D_{σ}Sp′′ Sp′′ ⊢ Sp′}{Sp ⊢ D_{σ}Sp′}

The problem is to find an appropriate Sp′′ such that proving Sp ⊧ D_{σ}Sp′′ is easier than proving Sp ⊧ D_{σ}Sp′.

For example, if we choose Sp′′ = Sp′, then we get the original problem back.

On the other hand, if we choose Sp′′ = Σ′ where Σ′ is the codomain of σ, the proof obligations are Sp ⊢ D_{σ}Σ′ and Σ′ ⊢ Sp′. Since Sp′ ⊢ Σ′ by rule R1, it follows that Σ′ ⊧ Sp′ if and only if Str(Σ′) = Mod^{A}(Sp′).

One way to find Sp′′ comes from the observation that D_{σ}Sp′ corresponds to a, possible higher-order, existential quantifier. The idea is to provide an implementation Sp_{I} of the hidden symbols of Sp′ and prove T_{σ}Sp + Sp_{I} ⊢ Sp′. However we have to ensure that the implementation of the hidden symbols can be added to any Sp-model. Thus we have to ensure that T_{σ}Sp + Sp_{I} is a persistent extension of Sp, that is, Sp = D_{σ}(T_{σ}Sp + Sp_{I}). Since Sp ⊧ D_{σ}(T_{σ}Sp + Sp_{I}) if and only if Sp ⊧ D_{σ}Sp_{I}, we get the following rule, which is an instantiation of rule R3

∃^{2} \frac{T_{σ}Sp + Sp_{I} ⊢ Sp′ Sp ⊢ D_{σ}Sp_{I}}{Sp ⊢ D_{σ}Sp′}

A similar rule is used by Wirsing [61] and Hennicker, Wirsing, and Bidoit [38].

Farrés-Casals [21] remarks that the problem with the ∃^{2}-rule is that one has to provide an implementation Sp_{I} for the hidden symbols for the proof. However, in a lot of cases Sp′ can be decomposed in the union of two specifications Sp_{h} and Sp_{v} where Sp_{h} provides an implementation of the hidden symbols and Sp_{v} defines part of the visible symbols in terms of the hidden symbols. Then Sp_{I} in the ∃^{2}-rule is the same as Sp_{h}, and we get a somewhat simplified version of the inheriting rule of Farrés-Casals [21].

Ih \frac{T_{σ}Sp + Sp_{h} ⊢ Sp_{v} Sp ⊢ D_{σ}Sp_{h}}{Sp ⊢ D_{σ}(Sp_{v} + Sp_{h})}

4.5 Completeness

It is easy to check that the above inference system for Sp ⊢ Sp′ is sound, that is, Sp ⊢ Sp′ implies Sp ⊧ Sp′. If one restricts entailment to Sp ⊢ I_{{φ}}Σ, then the inference system is also complete. This assumes that the category of signatures is cocomplete, the institution has amalgamation, and that ⊢^{I} is complete.

To see this, assume that Sp ⊧ φ, that is, m ⊧ φ for each m ∈ Mod^{A}(\begin{matrix}[ \\ [ & Sp & ] \\ ] \end{matrix}). Because of Theorem 4.11, there exists a specification expression D_{σ}I_{Φ}Σ′ which has the same class of models as Sp. Given a Σ′-structure m′ such that m′ ⊧ Φ, then m′|_{σ} is a model of D_{σ}I_{Φ}Σ′ and thus a model of Sp. Since we have Sp ⊧ φ, we get that m′|_{σ} ⊧ φ which implies m′ ⊧ σ(φ) by the satisfaction condition. Thus we have Φ ⊧ σ(φ), and because of completeness of ⊢^{I} we get Φ ⊢^{I} φ. Because the inference system presented here is given modulo the equalities needed to show that Sp equals D_{σ}I_{Φ}Σ′, we just have to give a derivation for D_{σ}I_{Φ}Σ′ ⊢ I_{{φ}}Σ to prove completeness of the inference system.

I_{Φ}Σ′ ⊢ I_{Φ}Σ′ Φ ⊢^{I} {σ(φ)}
\overline{L8}
I_{Φ}Σ′ ⊢ I_{{σ(φ)}}Σ′
\overline{L5}
D_{σ}I_{Φ}Σ′ ⊢ I_{{φ}}Σ

For completeness it is important that we are able to restructure Sp, in particular, that we could replace Sp by its normal-form (cf. Wirsing [61]). If we only use the rules L1–L8 and are not allowed to apply the equalities of Fact 4.9 to the antecedent, only to the consequent to ensure that it remains in the form I_{Φ}Σ, then completeness depends on the institution I. In her PhD-thesis Cengarle [14] has shown that the inference system is complete for the institution of first-order logic, and Borzyszkowski [10] extends this proof to any institution that has a cocomplete category of signatures, amalgamation, is closed under conjunction and negation, and has the interpolation property.

An institution is closed under (finite) conjunction if for any (finite) set of formulas Φ of Sen_{I}(Σ), there exists a formula φ in Sen_{I}(Σ) such that m ⊧ Φ if and only if m ⊧ φ for all m ∈ Str_{I}(Σ). If the institution is compact, that is, for any set of Σ-formulas Φ and a Σ-formula φ with Φ ⊧ φ there exists a finite set Ψ ⊆ Φ with Ψ ⊧ φ, then it suffices for completeness to require that the institution is closed under finite conjunction only instead of arbitrary conjunction.

An institution is closed under negation, if for any formula φ in Sen_{I}(Σ), there exists ¬φ such that m ⊧ ¬φ if and only if m |̸= φ for all m ∈ Str_{I}(Σ).

Finally, an institution has the interpolation property if given the pushout Σ_{cl} of σ_{1} : Σ_{0} → Σ_{1} and σ_{2} : Σ_{0} → Σ_{2}, a Σ_{1}-formula φ_{1}, and a Σ_{2}-formula φ_{2} such that {σ′_{1}(φ_{1})} ⊧ σ′_{2}(φ_{2}), then there exists a Σ_{0} formula φ such that {φ_{1}} ⊧ σ_{1}(φ) and {σ_{2}(φ)} ⊧ φ_{2} where σ′_{1} and σ′_{2} are the co-cone morphisms of the pushout.

For arbitrary specification expressions Sp′ the inference system for proving Sp ⊢ Sp′ is not complete. Consider Σ ⊧ D_{σ}Σ′ where σ is a signature morphism from Σ to Σ′. We have to find a derivation for Σ ⊢ D_{σ}Σ′. The only applicable rule is rule R3^{1}:

R3 \frac{Sp ⊢ D_{σ}Sp′′ Sp′′ ⊢ Sp′}{Sp ⊢ D_{σ}Sp′} .

Thus we have to find Sp′′ such that Σ ⊢ D_{σ}Sp′′ and Sp′′ ⊢ Σ′. The second condition holds trivially (rule R1), but the first condition is even more difficult than the original problem because instead of showing that each Σ-structure can be extended to a Σ′-structure we have to show that each Σ-structure can be extended to a Σ′-structure that is a model of Sp′′.

The problem is that to decide whether for a given signature morphism σ each Σ-structure can be extended to a Σ′-structure or not, requires knowledge about the particular institution that is not provided by the notion of institutions. For example, in the institution of equational logic a sufficient condition that each Σ-structure can be extended to a Σ′-structure is that σ is injective on sorts and operations, and that for each sort in Σ there exists at least one ground term of that sort. Thus there cannot be a complete, institution independent inference system for Sp ⊢ Sp′ that does not use, in one way or another, an explicit judgment of the form Sp_{1} ⊧ Sp_{2}.

For example the inference system introduced by Wirsing [61] and Hennicker, Wirsing, and Bidoit [38] is complete because they use the following variant of the ∃^{2}-rule:

\frac{T_{σ}Sp + Sp_{I} ⊢ Sp′ Sp ⊧ D_{σ}Sp_{I}}{Sp ⊢ D_{σ}Sp′}

Note that in the second premise of the ∃^{2}-rule ⊢ is replaced by ⊧.

To see the completeness of this rule, assume that Sp ⊧ D_{σ}Sp′. Then we have to give a derivation for Sp ⊢ D_{σ}Sp′. Let Sp_{I} be Sp′, then Sp ⊧ D_{σ}Sp′ holds trivially because that is our assumption; thus we only have to show T_{σ}Sp + Sp′ ⊢ Sp′ to apply the variant of the ∃^{2}-rule:

1The rules ∃^{2} and Ih need not be considered because they are instantiations of R3.

Sp′ ⊢ Sp′ \overline{L6’} T_{σ}Sp + Sp′ ⊢ Sp′ Sp ⊧ D_{σ}Sp′
Sp ⊢ D_{σ}Sp′

Therefore, to trivially complete our inference system, we add the rule

T \frac{Sp ⊧ Sp′}{Sp ⊢ Sp′} .

5 Relations as Abstract Datatypes

In this chapter we present the main construction of this thesis the institution R_{I}, which is based on an exact institution I with a cocomplete category of signatures. Abstract datatypes in R_{I} denote relations between abstract datatypes from I. First we motivate the construction by an example. Next the institution R_{I} is defined, and we show that R_{I} is exact and has a cocomplete category of signatures. Then we study the relationship between abstract datatypes in R_{I} and abstract datatypes in I which is later used in Section 7.1 to prove entailment of relations and in Section 9.3 to write Z-style specifcations of dynamic behavior using the Larch Shared Language instead of Z. The operations of the specification language SL_{I} defined in Section 4.2 are then used as a basis for the definition of RSL_{I}, a kernel specification language for the specifiation of relations.

5.1 Introduction

In the state as algebra approach the state space of a software system is modeled by an abstract datatype St = (Σ_{St}, M_{St}), and an operation transforming the state of the software system as a relation R ⊆ M_{St} × M_{St}. As an example consider a counter with an increment relation. The state of the counter is an algebra A with carrier set A(N) = ℕ and a constant A(c) ∈ A(N). The set of possible states of a counter is given by the following specification:

Counter : trait
   includes Nat
   introduces c : N

where Nat is:

Nat : trait
   introduces
      zero : N
      succ : N → N
      pred : N → N
       +  : N, N → N
       < : N, N → bool
       ≤ : N, N → bool
       > : N, N → bool
       ≥ : N, N → bool
   asserts
      N generated freely by zero, succ
   equations forall x,y : N

      zero + y = y;
      succ(x) + y = succ(x + y)
      pred(succ(x)) = x
      x ≠ zero ⇒ succ(pred(x)) = x
      ¬ (s(x) ≤ zero)
      zero ≤ x
      x ≤ y ⇒ s(x) ≤ s(y)
      x ≤ y ∧ x ≠ y ⇒ x < y
      ¬ (x < y) ⇒ x ≥ y
      x ≥ y ∨ x ≠ y ⇒ x > y

The increment operation increments the value of c by one. It is a relation

Inc ⊆ Mod^{A}(\begin{matrix}[ \\ [ & Counter & ] \\ ] \end{matrix}) × Mod^{A}(\begin{matrix}[ \\ [ & Counter & ] \\ ] \end{matrix})

with the property

if (A, B) ∈ Inc then B(c) = A(succ)(A(c))

For this equation to be defined, we have to require that A(N) = B(N). In addition we would like that succ and + are interpreted the same in A and B. That is, if ι is the inclusion of [ [Nat] ] into [ [Counter] ] then we require that A|_{ι} = B|_{ι}.

In Section 2.3 we have seen that \{(A, B) | A, B ∈ Mod^{A}(\begin{matrix}[ \\ [ & Counter & ] \\ ] \end{matrix}), A|_{ι} = B|_{ι}\} is a pullback ∏ F of a functor F : V^{op} → Set given by the following diagram:

\xymatrix{Mod^{A}(\begin{matrix}[ \\ [ & Counter & ] \\ ] \end{matrix}) \ar@{-->}[dr]_{|_{ι}} &  & Mod^{A}(\begin{matrix}[ \\ [ & Counter & ] \\ ] \end{matrix}) \ar@{-->}[dl]^{|_{ι}} \\  & Mod^{A}(\begin{matrix}[ \\ [ & Nat & ] \\ ] \end{matrix})}

The functor F can be given as the composition of the functor Γ : V → Adt:

                      \xymatrix{[ [Counter] ] &  & [ [Counter] ] \\  & [ _{[Nat]} ] \ar[ul]^{ι} \ar[ur]_{ι}}

with Mod^{A} : Adt^{op} → Cat, ignoring for the moment that Mod^{A}(Γ(i)) yields a category instead of a set for every i ∈ V.

Thus, the increment relation is a subset of ∏(Γ; Mod^{A}) such that (A, B) ∈ Inc if and only if B(c) = A(succ)(A(c)).

In each institution that has amalgamation, such as LSL, there exists for each pair (A, B) in ∏(Γ_{Inc}; Mod^{A}) a unique algebra A +_{C} B in Mod^{A}(∐ Γ_{Inc}), the amalgamated sum of A and B with respect to C, such that (A +_{C} B)|_{ι_{1}} = A and (A +_{C} B)|_{ι_{2}} = B. ι_{1} and ι_{2} from [ [Counter] ] to [ [DeltaCounter] ] are the co-cone morphisms of the colimit of Γ_{Inc}. ι_{1} is the inclusion of [ [Counter] ] into [ [DeltaCounter] ], and ι_{2} maps c to c′ and all other symbols to themselves.

The pushout ∐ Γ_{Inc} in Adt can be represented by the specification

DeltaCounter : trait
   includes Nat
   introduces c, c' : N

Therefore, the relation Inc is isomorphic to a class of algebras M_{Inc} from Mod^{A}(∐ Γ_{Inc}) such that, if A Inc B, then A +_{C} B ∈ M_{Inc}, and if D ∈ M_{Inc}, then D|_{ι_{1}} Inc D|_{ι_{2}}.

For D ∈ M_{Inc} we have D(c′) = D(succ)(D(c)), which is equivalent to writing D ⊧ c′ = succ(c) by the definition of satisfaction in LSL and since c′ = succ(c) is an equation of signature Sig^{A}(∐ Γ_{Inc}).

Thus we can define a binary relation R by providing its type, a functor from V to Adt, together with a set of formulas Φ from Sen(Sig^{A}(∐ Γ)). Then we have A R B if and only if (A, B) ∈ ∏(Γ_{Inc}; Mod^{A}) and A +_{C} B ⊧ Φ.

Operations with Input

If we have operations with inputs, like an Add operation that adds its argument to the counter, we can use the category

V_{in} = \xymatrix{in & 1 & 2 \\ & 0 \ar[ul] \ar[u] \ar[ur]}

and a functor Γ_{Add} : V_{in} → Adt as the type of the relation instead of a functor from V to Adt. We model the input parameter by

AddIn : trait
   includes Nat
   introduces n_{in} : N

Then the type of the Add operation is the functor Γ_{Add} : V_{in} → Adt depicted by

                  Γ_{Add} = \xymatrix{[ [AddIn] ] & [ [Counter] ] & [ [Counter] ] \\  & [ _{[Nat]} ] \ar[ul]^{ι_{n}} \ar[u]^{ι} \ar@{-->}[ur]_{ι}}

with ι_{n} being the inclusion of [ [Nat] ] into [ [AddIn] ]. Now Add is a subset of the limit of Γ_{Add}; Mod^{A} such that if (C, A, B) ∈ Add then

B(c) = A(+)(A(c), C(n_{in})).

Note that the properties of limits guarantee that C|_{ι_{n}} = A|_{ι} = B|_{ι} which implies C(N) = A(N) = B(N) = ℕ and that the above equation is well-defined.

As before we have that in an institution where Str and thus Mod^{A} preserves colimits of shape V_{in} we can find for each triple (C, A, B) in ∏(Γ_{Add}; Mod^{A}) a unique D ∈ Mod^{A}(∐ Γ_{Add}) with D|_{ι_{in}} = C, D|_{ι_{1}} = A and C|_{ι_{2}} = B.

The colimit of Γ_{Add} is given by the specification

DeltaCounter1 : trait
   includes Nat
   introduces n_{in}, c, c' : N

and we have that if (C, A, B) ∈ Add then D(c′) = D(+)(D(c), D(n_{in})). As before we can define Add by all triples (C, A, B) ∈ ∏(Γ_{Add}; Mod^{A}) such that D ⊧ c′ = c + n_{in}.

Arbitrary D

This treatment can be generalized from categories V and V_{in} to arbitrary categories D and from the institution LSL to arbitrary institutions I. We only have to require that the category of signatures of I has all colimits of shape D and that the structure-functor preserves colimits of shape D.

Take for example the discrete category K_{n} with objects {1, …, n}. Let Γ be a functor from K_{n} to Adt, then R ⊆ ∏(Γ; Mod^{A}) is an n-ary relation

R ⊆ Mod^{A}(Γ(1)) × … × Mod^{A}(Γ(n)).

Each morphism f : d → d′ in D adds the requirement that m_{d′}|_{Γ(f)} = m_{d} for each m ∈ ∏(Γ; Mod^{A}) where m_{d} = π_{d}(m), m_{d′} = π_{d′}(m), and π_{d} and π_{d′} are the projections from ∏ Γ; Mod^{A} to Mod^{A}(Γ(d)) and to Mod^{A}(Γ(d′)), respectively.

Given that Sign_{I} and thus Adt_{I} have colimits of shape D and Str_{I} preserves them, we can use sets of formulas Φ from Sen_{I}(Sig^{A}(∐_{D} Γ)) to define relations R ⊆ ∏_{D} Γ; Mod^{A}

Note, if we want to use equations to specify relations, we have to make sure that the signatures of the nodes Sig^{A}(Γ(i)) share, at least, a sort. For example, with D = K_{2} equations in Sen_{I}(∐ Γ; Sig^{A}) are of the form ∀X s = t where both s and t are terms over Sig^{A}(Γ(1)) or Sig^{A}(Γ(2)). Thus the only type of relations R ⊂ Mod^{A}(Γ(1)) × Mod^{A}(Γ(2)) we can define using these equations are relations R = A × B, where A and B are subsets of Mod^{A}(Γ(1)) and Mod^{A}(Γ(2)).

Changing the shape of relations

Consider a relation R ⊆ A × B × C. We can make R a relation R̄ ⊆ A × C by defining R̄ = {(a, c) | ∃b ∈ B (a, b, c) ∈ R}. On the other hand, if we are given a relation S ⊆ A × C, we can make S a relation Ŝ ⊆ A × B × C by defining Ŝ = {(a, b, c) | b ∈ B, (a, c) ∈ S}.

This can be generalized to relations of shape D and D′ provided there is a functor F from D to D′. In the example above D = K_{2}, D′ = K_{3}, F (1) = 1, and F (2) = 3.

Given a relation R of type Γ′ : D′ → Adt_{I}, we define the relation R̄ of type Γ = F; Γ′ by

R̄ = {F̄(m) | m ∈ R}

where F̄ is a functor from ∏_{D′} Γ′; Mod^{A} to ∏_{D} Γ; Mod^{A} given by the universal property of ∏_{D} Γ; Mod^{A} with respect to the natural transformation ν from Δ(∏ Γ′; Mod^{A}) to Γ; Mod^{A} given by ν_{d} = π_{F (d)}^{Γ′;Mod^{A}}:

\xymatrix{∏ Γ; Mod^{A} \ar[d]_{π_{d}^{Γ;Mod^{A}}} & ∏ Γ′; Mod^{A} \ar@{-->}[dl]^{ν_{d}=π_{F (d)}^{Γ′;Mod^{A}}} \ar[l]_{F̄} \\ Γ(d) = Γ′(F (d))}

In the example above π_{i}^{Γ′,Mod^{A}} maps a triple (a, b, c) to its i-th component and π_{j}^{Γ,Mod^{A}} a tuple (a, b) to its j-th component where i ∈ {1, 2, 3} and j ∈ {1, 2}. Then we get

π_{1}^{Γ;Mod^{A}}(F̄(a, b, c)) = π_{F (1)}^{Γ′;Mod^{A}}(a, b, c) = π_{1}^{Γ′;Mod^{A}}(a, b, c) = a

and

π_{2}^{Γ;Mod^{A}}(F̄(a, b, c))_{2} = π_{F (2)}^{Γ′;Mod^{A}}(a, b, c) = π_{3}^{Γ′;Mod^{A}}(a, b, c) = c.

Thus F̄ maps a triple (a, b, c) to a tuple (a, c).

In the same spirit we define for a relation S of shape Γ a relation of shape Γ′ by

Ŝ = {m′ ∈ ∏ Γ′; Mod^{A} | F̄(m′) ∈ S}.

5.2 The Category Rel

The category Rel of relations between abstract datatypes from I has as objects relations (Θ, M) where Θ = (D, Γ : D → Adt) is the type of the relation, the category D is the shape of the relation, and M, a full subcategory of ∏(Γ; Mod^{A}), is the graph of the relation.

A morphism f = (f^{F} , f^{μ}) in Rel from (Θ, M) to (Θ′, M′) has two components; the first component is a functor f^{F} : D → D′ from the shape category of Θ to the shape category of Θ′, and the second component is a natural transformation f^{μ} : Γ ⇒ f^{F}; Γ′, which is a D-indexed family of Adt_{I}-morphisms f_{d}^{F} : Γ(d) → Γ′(f^{F} (d)).

The functor f^{F} and the natural transformation f^{μ} give rise to a functor |_{f} from ∏_{D′} Γ′; Mod^{A} to ∏_{D} Γ; Mod^{A} by the universal property of ∏_{D} Γ; Mod^{A} and the natural transformation ν_{f} : Δ(∏_{D′} Γ′; Mod^{A}) ⇒ Γ; Mod^{A} given by (ν_{f})_{d} = π^{Γ′;Mod^{A}}; Mod^{A}(f_{d}^{μ}) for d ∈ D:

\xymatrix{∏ Γ; Mod^{A} \ar[d]_{π_{d}^{Γ;Mod^{A}}} & ∏ Γ′; Mod^{A} \ar[l]_{|_{f}} \ar[d]^{π_{f^{F} (d)}^{Γ′;Mod^{A}}} \ar[dl]^{(ν_{f})_{d}} \\ Mod^{A}(Γ(d)) & Mod^{A}(Γ′(f^{F} (d))) \ar[l]^{Mod^{A}(f_{d}^{μ})}}

Then we require M′|_{f} ⊆ M for f = (f^{F} , f^{μ}) to be a Rel-morphism, that is, m′|_{f} ∈ M for all m′ ∈ M′.

As an example take R = ((K_{2}, Γ_{R}), M_{R}) and S = ((K_{3}, Γ_{S}), M_{S}). A Rel-morphism f from R to S is a pair (f^{F} , f^{μ}) of a functor f^{F} : K_{2} → K_{3} and a natural transformation f^{μ} : Γ_{R} ⇒ f^{F}; Γ_{S}. Let f^{F} (1) = 1 and f^{F} (2) = 3, then f_{1}^{μ} is an Adt-morphism from Γ_{R}(1) to Γ_{S}(1), and f_{2}^{μ} is an Adt-morphism from Γ_{R}(2) to Γ_{S}(3). For f to be a Rel-morphism we have to check that (m_{1}|_{f_{1}^{μ}}, m_{3}|_{f_{2}^{μ}}) is in M_{R} for each (m_{1}, m_{2}, m_{3}) in M_{S}.

The identity id_{R} for an object R = (Θ, M) in Rel is the pair (Id_{D}, id_{Γ}).

Let f = (f^{F} , f^{μ}) be a Rel-morphism from (Θ_{1}, M_{1}) to (Θ_{2}, M_{2}) and g = (g^{F} , g^{μ}) a Relmorphism from (Θ_{2}, M_{2}) to (Θ_{3}, M_{3}). The composition of f and g is the Rel-morphism (f^{F}; g^{F} , f^{μ}; (g^{μ}; f^{F})):

\xymatrix{Γ_{1} \ar@{=>}[r]^{f^{μ}} & f^{F}; Γ_{2} \ar@{=>}[r]^{g^{μ};f^{F}} & f^{F}; g^{F}; Γ_{3} \\  & Γ_{2} \ar@{=>}[r]_{g^{μ}} \ar[u]^{f^{F}} & g^{F}; Γ_{3} \ar@{|->}[u]_{f^{F}}}

We have to show that M_{3}|_{f;g} ⊆ M_{1}. This holds because |_{f;g} = |_{g}; |_{f}. The proof of this will be given in the next section.

Theorem 5.1 The category Rel is (finitely) cocomplete if the category of signatures from the institution I is (finitely) cocomplete.

Proof. This follows from fact that Rel is the same as the category Adt_{R_{I}} of abstract datatypes in the institution R_{I} = < Sign_{R_{I}}, Str_{R_{I}}, Sen_{R_{I}}, ⊧^{R_{I}}> defined in the next section. Then Adt_{R_{I}} is (finitely) cocomplete because Sign_{I} and thus Sign_{R_{I}} are (finitely) cocomplete. □

5.3 The Institution R_{I}

5.3 The Institution R_{I}  87

In the previous sections we have seen how relations between classes of algebras, given as abstract datatypes, can be defined by a category D, a functor Γ from D to Adt, and a subset of ∏(Γ; Mod^{A}); and how sets of formulas over the signature ∐(Γ; Sig^{A}) can be used to define these subsets. What we have given are the ingredients of an institution R_{I} based on an institution I.

The category of signatures Sign_{R_{I}} has as objects pairs (D, Γ : D → Adt_{I}), the type of the relation, and morphisms f from Θ_{1} = (D_{1}, Γ_{1}) to Θ_{2} = (D_{2}, Γ_{2}) are pairs (f^{F} , f^{μ}) of a functor f^{F} from D_{1} to D_{2} and a natural transformations f^{μ} : Γ_{1} ⇒ f^{F}; Γ_{2}. The Θ-structures are elements of ∏(Γ; Mod^{A}), Θ-formulas are ∐(Γ; Sig^{A})-formulas from I, and the satisfaction relation ⊧^{R_{I}} is defined as m ⊧^{R_{I}} φ if \overline{m} ⊧^{I} φ. Here \overline{m} refers to the isomorphism between ∏(Γ; Mod^{A}) and Mod^{A}(∐ Γ), which exists in any exact institution I. That is, if m is an object in ∏(Γ; Mod^{A}), then \overline{m} is the isomorphic object in Mod^{A}(∐ Γ).

The institution R_{I} can be constructed for any exact base institution I with a cocomplete category of signatures. Examples of such institutions are EQ, EQC, LSL, SET (cf. Sections 3 and 9.1), and the institution of first-order logic (cf. [25, 17]). Thus, in the following, we assume that I = ⟨Sign_{I}, Str_{I}, Sen_{I}, ⊧^{I}⟩ is an institution with a cocomplete category of signatures Sign_{I} and a functor Str_{I} that preserves colimits.

Signatures Instead of directly defining Sign_{R_{I}} as the category with objects Θ = (D, Γ) and morphisms pairs f = (f^{F} , f^{μ}), as indicated above, we define Sign_{R_{I}} as an instance of the category of diagrams over a category T which is defined by Tarlecki et al. [58].

Definition 5.2 (Fun(T)) Given a category T, then we define the indexed category Fun(T) : Cat^{op} → Cat as follows: For an object D ∈ Cat we set Fun(T)_{D} = T^{D}, and for a functor F : D → D′ we define a functor Fun(T)_{F} : T^{D′} → T^{D} by

• Fun(T)_{F} (Γ′) = F; Γ′ for Γ′ ∈ T^{D′}, that is, (Fun(T)_{F} (Γ′))(d) = Γ′(F (d)) for every d ∈ D, and

• Fun(T)_{F} (μ) = μ; F for a natural transformations μ : Γ′_{1} ⇒ Γ′_{2} between functors Γ′_{1} and Γ′_{2} in T^{D′}, that is, (Fun(T)_{F} (μ))_{d} = μ_{F (d)} for every d ∈ D.

Let Id_{D} be the identity functor on D, then Fun(T)_{Id_{D}} is the identity on T^{D} because

Fun(T)_{Id_{D}}(Γ) = Id_{D}; Γ = Γ

and

Fun(T)_{Id_{D}}(μ) = μ; Id_{D} = μ

for functors Γ : D → T and natural transformations μ : Γ ⇒ Γ′.

For two functors F : D → D′ and G : D′ → D′′ we have Fun(T)_{F;G} = Fun(T)_{G}; Fun(T)_{F} because

Fun(T)_{F;G}(Γ′′ : D′′ → T) = F; G; Γ′′
= Fun(T)_{F} (G; Γ′′)
= Fun(T)_{F} (Fun(T)_{G}(Γ′′)),

and similar for the composition of natural transformations. Thus Fun(T) is indeed an indexed category.

Flattening Fun(T) yields the category Flat(Fun(T)) of diagrams over T (cf. Section 2.5), which has as objects pairs (D, Γ) — diagrams — where D is a category and Γ a functor from D to T. Morphisms f from (D, Γ) to (D′, Γ′) in Flat(Fun(T)) are pairs (f^{F} , f^{μ}) where f^{F} is a functor from D to D′ and f^{μ} is a natural transformation from Γ to f^{F}; Γ′.

The identity on Θ is the pair (id^{F} , id^{μ}) where id^{F} is the identity functor for D and id_{d}^{μ} is the identity on Γ(d) for all d ∈ D. The composition of (f^{F} , f^{μ}) from Θ_{1} to Θ_{2} with (g^{F} , g^{μ}) from Θ_{2} to Θ_{3} is defined as

f; g = (f^{F}; g^{F} , f^{μ}; (g^{μ}; f^{F})),

that is, (f; g)_{d}^{μ} = f_{d}^{μ}; g_{f^{F} (d)}^{μ} for all d ∈ D.

Now we define Sign_{R_{I}} as the category of diagrams over Adt_{I}.

Definition 5.3 (Sign_{R_{I}}) Let I be an institution, then define

Sign_{R_{I}} = Flat(Fun(Adt_{I})).

Structures The category of Θ = (D, Γ)-structures — Str_{R_{I}}(Θ) — is given by an arbitrary, but fixed limit of the contravariant functor Γ; Mod^{A} : D^{op} → Cat in Cat. Thus we can view objects in Str_{R_{I}}(Θ) as D-indexed families of structures m_{d} ∈ Mod^{A}(Γ(i)) such that if f : d → d′ is a morphism in J, then m_{d′}|_{Γ(f)} = m_{d}.

For a morphism f = (f^{F} , f^{μ}) from (D, Γ) to (D′, Γ′) in Sign_{R_{I}} the functor Str_{R_{I}}(f), from the limit of Γ′; Mod^{A} to the limit of Γ; Mod^{A}, maps a D′-indexed family of objects m′_{d′} ∈ Mod^{A}(Γ′(d′)) to a D-indexed family of objects m_{d} = m′_{f^{F} (d)}|_{f_{f^{F} (d)}^{μ}}.

Definition 5.4 (Str_{R_{I}}) Given an institution I. The functor Str_{R_{I}} maps a signature (D, Γ) to an arbitrary but fixed limit of Γ; Mod^{A} in Cat and a signature morphism (f^{F} , f^{μ}) from (D, Γ) to (D′, Γ′) to the unique functor from Str_{R_{I}}((D, Γ)) to Str_{R_{I}}((D′, Γ′)) given by the universal property of Str_{R_{I}}((D, Γ)) and the natural transformation ν from Δ(Str_{R_{I}}(Θ_{2})) to Str_{R_{I}}(Θ_{1}) defined by ν_{d} = π′_{f^{F} (d)}; Mod^{A}(f_{d}^{μ}) for all d ∈ D:

\xymatrix{Str_{R_{I}}((D, Γ)) \ar[d]_{π_{d}} & Str_{R_{I}}((D, Γ)) \ar@{-->}[l]_{Str_{R_{I}} (f)} \ar@{-->}[dl]^{ν_{d}} \ar[d]^{π′_{f^{F} (d)}} \\ Mod^{A}(Γ(d)) & Mod^{A}(Γ′(f^{F} (d))) \ar[l]^{Mod^{A}(f_{d}^{μ})}}

The functors π_{d} for d ∈ D and π′_{d′} for d′ ∈ D′ are the cone morphisms of the limit of Γ; Mod^{A} and Γ′; Mod^{A}, respectively.

The definition of Str_{R_{I}}(Θ) as the limit of Γ; Mod^{A} is well-defined because Cat is complete. We still have to show that Str_{R_{I}} is a functor, that is, Str_{R_{I}} preserves identity and composition.

The identity (id^{F} , id^{μ}) in Sign_{R_{I}} is mapped to the identity functor because, on the one hand, Str_{R_{I}}((id^{F} , id^{μ})) is unique as a functor from Str_{R_{I}}(Θ) to Str_{R_{I}}(Θ), and, on the other hand, the identity on Str_{R_{I}}(Θ) is a functor from Str_{R_{I}}(Θ) to Str_{R_{I}}(Θ).

Consider two morphisms f from (D_{1}, Γ_{1}) to (D_{2}, Γ_{2}) and g from (D_{2}, Γ_{2}) to (D_{3}, Γ_{3}) in Sign_{R_{I}}. Str_{R_{I}}(f; g) is defined as the unique functor from Str_{R_{I}}((D_{3}, Γ_{3})) to Str_{R_{I}}((D_{1}, Γ_{1})) satisfying

Str_{R_{I}}(f; g); π_{d} = π′′_{g^{F} (f^{F} (d))}; Mod^{A}(f_{d}^{μ}; g_{f^{F} (d)}^{μ})

for all d ∈ D_{1}. However, looking at the following diagram and using the fact that Mod^{A} is a functor, we see that Str_{R_{I}}(g); Str_{R_{I}}(f) has the same property, and therefore Str_{R_{I}}(f; g) = Str_{R_{I}}(g); Str_{R_{I}}(f).

\xymatrix{∏_{D} Γ; Mod^{A} \ar[d]_{π_{d}} & ∏_{D′} Γ′; Mod^{A} \ar@{-->}[l]_{Str_{R_{I}} (f)} \ar[d]^{π′_{f^{F} (d)}} & ∏_{D′′} Γ′′; Mod^{A} \ar@{-->}[l]_{Str_{R_{I}} (g)} \ar[d]^{π′′_{g^{F} (f^{F} (d))}} \\ Mod^{A}(Γ(d)) & Mod^{A}(Γ′(f^{F} (d))) \ar[l]^{Mod^{A}(f_{d}^{μ})} & Mod^{A}(Γ′′(g^{F} (f^{F} (d)))) \ar[l]^{Mod^{A}(g_{f^{F} (d)}^{μ})}}

Formulas Formulas in R_{I} are defined by using co-completeness of Sign_{I}. Co-completeness of Sign_{I} ensures that for each type Θ = (D, Γ) in Sign_{R_{I}} there exists a signature ∐_{D} Γ; Sig^{A} in Sign_{I}. Note that, because Sig^{A} preserves and creates colimits, this is the same as Sig^{A}(∐_{D} Γ) (cf. Theorem 5.8). Then the set of Θ-formulas in R_{I} is the same as the set of ∐ Γ; Sig^{A}-formulas in I.

Sen_{R_{I}} is given as the composition of the functors

• Flat(Fun(Sig^{A})) : Flat(Fun(Adt_{I})) → Flat(Fun(Sign_{I})),

• clim_{Sign_{I}} : Flat(Fun(Sign_{I})) → Sign_{I} and

• Sen_{I} : Sign_{I} → Set:

Flat(Fun(Sig^{A})) maps a diagram over Adt_{I} to a diagram over Sign_{I}; then clim_{Sign_{I}} maps this diagram over Sign_{I} to its colimit in Sign_{I}, and at last Sen_{I} maps the colimit signature to the set of sentences in I over this signature.

[figure: Sign_{R_{I}}; Flat(Fun(Sig^{A})); _{Sen_{R_{I}}}; Flat(Fun(Sign_{I})); clim^{^{Sign}^{I}}; Sign_{I}; ^{Sen^{I}}; Set]

The functor Flat(Fun(Sig^{A})) is the result of flattening the indexed functor

Fun(Sig^{A}) : Fun(Adt_{I}) ⇒ Fun(Sig^{A}).

Given a functor F : T → T′, then F induces an indexed functor Fun(F) from Fun(T) to Fun(T′) as follows:

Definition 5.5 For each category D, Fun(F)_{D} is the functor from T^{D} to T^{D′} given by

• Fun(F)_{D}(Γ : D → T) = Γ; F and

• Fun(F)_{D}(μ : Γ ⇒ Γ′) = μ; F.

We have to show that Fun(F) is indeed an indexed functor, that is, Fun(F) is a natural transformation from Fun(T) to Fun(T′). Let G be a functor from D to D′, then we have to show that the following diagram commutes:

\xymatrix{Fun(T)_{D} \ar[d]_{Fun(F)_{D}} & Fun(T)_{D′} \ar[l]_{Fun(T)_{G}} \ar[d]^{Fun(F)_{D′}} \\ Fun(T′)_{D} & Fun(T′)_{D′} \ar[l]^{Fun(T′)_{G}}}

For a functor Γ : D → T we have

Fun(F)_{D′}(Fun(T)_{G}(Γ)) = Fun(F)_{D′}(G; Γ)
= (G; Γ); F
= G; (Γ; F)
= Fun(T′)_{G}(Γ; F)
= Fun(T′)_{G}(Fun(F)_{D}(Γ)),

and similar for natural transformations.

The functor clim_{T} maps objects (D, Γ : D → T) to the colimit of Γ in T.

Definition 5.6 (clim_{T}) Given a cocomplete category T, then the functor clim_{T} from the category Flat(Fun(T)) defined as:

• clim_{T} ((D, Γ : D → T)) is an arbitrary, but fixed colimit of Γ in T for every (D, Γ) ∈ Flat(Fun(T)), and

• clim_{T} (f) = ∐_{D} (f^{μ}; (f^{F}; ι^{Γ′})) for every morphism f = (f^{F} , f^{μ}) from (D, Γ) to (D′, Γ′) in Flat(Fun(T)).

Because T is cocomplete, the functor clim_{T} is well defined, and since we have chosen a fixed colimit for each (D, Γ) in Flat(Fun(T)), the identity (Id_{F} , id_{Γ}) in Flat(Fun(T)) maps to the identity on clim_{T} ((D, Γ)) in T. clim_{T} preserves the composition of morphisms, that is,

clim_{T} (f; g) = clim_{T} (f); clim_{T} (g)

for all morphisms f from (D_{1}, Γ_{1}) to (D_{2}, Γ_{2}) and g from (D_{2}, Γ_{2}) to (D_{3}, Γ_{3}) because clim_{T} (f; g) is the unique morphism from clim_{T} (Θ_{1}) to clim_{T} (Θ_{3}) making the outer rectangle commute for all d ∈ D_{1} in the following diagram:

\xymatrix{clim_{T} (Θ_{1}) \ar[r]^{clim_{T} (f)} & clim_{T} (Θ_{2}) \ar[r]^{clim_{T} (g)} & clim_{T} (Θ_{3}) \\ Γ_{1}(d) \ar[u]^{ι^{Γ_{1}}(d)} \ar[r]_{f_{d}^{μ}} & Γ_{2}(f^{F} (d)) \ar[u]^{ι_{f^{F} (d)}^{Γ_{2}}} \ar[r]_{g_{g^{F} (f^{F} (d))}^{μ}} & Γ_{3}(g^{F} (f^{F} (d))) \ar[u]_{ι_{g^{F} (f^{F} (d))}^{Γ_{3}}}}

To define Sen_{R_{I}} as Flat(Fun(Sig^{A})); clim_{Sign_{I}}; Sen_{I}, we have to require that Sign_{I} is cocomplete because otherwise the functor clim_{Sign_{I}} would not be defined.

Definition 5.7 (Sen_{R_{I}}) Let I be an institution with a cocomplete category of signatures. Then

Sen_{R_{I}} = Flat(Fun(Sig^{A})); clim_{Sign_{I}}; Sen_{I}.

Note that we can always choose the colimits of Γ : D → Adt_{I} and Γ; Sig^{A} : D → Sign_{I} in such a way that Sig^{A}(∐ Γ) = ∐ Γ; Sig^{A} because there is a one-to-one correspondence between the class of colimits of Γ and the class of colimits of Γ; Sig^{A}. Assume that Γ has as a colimit (Σ, M) then, because Sig^{A} preserves colimits (cf. Theorem 4.4), we have that Σ is a colimit of Γ; Sig^{A}. On the other hand, if we have given a colimit Σ of Γ; Sig^{A} then, because Sig^{A} creates colimits (cf. Theorem 4.1), we can construct a class of Σ-structures M, such that (Σ, M) is a colimit of Γ. This leads to the following theorem:

Theorem 5.8 Provided that Adt_{I} is cocomplete, we have

Flat(Fun(Sig^{A})); clim_{Sign_{I}} = clim_{Adt_{I}}; Sig^{A}.

Proof. Let (D, Γ) be an object of Flat(Fun(Adt)), then

Flat(Fun(Sig^{A}))((D, Γ)) = (D, Γ; Sig^{A})

and clim_{Sign_{I}}((D, Γ; Sig^{A})) = ∐_{D} Γ; Sig^{A}. For the right-hand side we get:

Sig^{A}(clim_{Adt_{I}}((D, Γ))) = Sig^{A}(∐_{D} Γ).

Since Sig^{A} preserves and creates colimits, we have

∐_{D} Γ; Sig^{A} = Sig^{A}(∐_{D} Γ).
□

However, this relationship does not hold, in general, for limits of Γ; Mod^{A} and colimits of Γ. Consider for example the functor Γ : K_{2} → Adt_{EQ} in the institution EQ of equational logic. One possible choice for a limit of Γ; Mod^{A} is the cartesian product Mod^{A}(Γ(1)) × Mod^{A}(Γ(2)). For this limit it is impossible to find an abstract datatype (Σ, M) such that M = Mod^{A}(Γ(1))×Mod^{A}(Γ(1)) since there does not exist a many-sorted signature Σ = (S, Ω) such that Σ-structures are pairs of algebras (A_{1}, A_{2}). However, we can find an abstract datatype (Σ′, M′) such that M′ and Mod^{A}(Γ(1)) × Mod^{A}(Γ(2)) are isomorphic. This leads to the following theorem:

Theorem 5.9 The contravariant functor Str_{R_{I}} : Sign_{R_{I}}^{op} → Cat is natural isomorphic to the contravariant functor clim_{Adt_{I}}; Mod^{A} provided that the structure functor Str_{I} preserves colimits.

Proof. Since Str_{I} preserves colimits, so does Mod^{A} (cf. Theorem 4.5). Thus, the natural isomorphism μ : Str_{R_{I}} ⇒ clim_{Adt_{I}}; Mod^{A} is given for each Θ = (D, Γ) in Sign_{R_{I}} by the isomorphism between Mod^{A}(∐ Γ) and an arbitrary limit ∏ Γ; Mod^{A} of Γ; Mod^{A}. We have to show that the family of all isomorphisms μ_{Θ} : Str_{R_{I}}(Θ) → Mod^{A}(∐ Γ) is indeed a natural transformation, that is, the following diagram commutes for all morphisms f : Θ → Θ′ in Sign_{R_{I}}.

\xymatrix{Mod^{A}(∐ Γ) & Str_{R_{I}}(Θ) \ar[l]_{μ_{Θ}} \\ Mod^{A}(∐ Γ′) \ar[u]^{Mod^{A}(clim_{Adt_{I}} (f))} & Str_{R_{I}}(Θ′) \ar[u]_{Str_{R_{I}} (f)} \ar[l]^{μ_{Θ′}}}

First consider the following family of diagrams for d ∈ D:

\xymatrix{Mod^{A}(∐ Γ) \ar[ddrr]_{Mod^{A}(ι_{d}^{Γ})} &  &  &  & Str_{R_{I}}(Θ) \ar[llll]_{μ_{Θ}} \ar[ddll]^{π_{d}^{Γ;Mod^{A}}} \\  &  & (1) \\  & (2) & Mod(Γ(d)) & (4) \\  &  & Mod^{A}(Γ′(f^{F} (d))) \ar[u]_{Mod^{A}(f_{d}^{μ})} \\  &  & (3) \\ Mod^{A}(∐ Γ′) \ar[uurr]^{Mod^{A}(ι_{f^{F} (d)}^{Γ′})} \ar[uuuuu]^{Mod^{A}(clim_{Adt_{I}} (f))} &  &  &  & Str_{R_{I}}(Θ′) \ar[uuuuu]_{Str_{R_{I}} (f)} \ar[llll]^{μ_{Θ′}} \ar[uull]_{π_{f^{F} (d)}^{Γ;Mod^{A}}}}

The diagrams (1) and (3) commute because the functor Mod^{A} preserves colimits and Str_{R_{I}}(Θ) is defined as ∏_{D} Θ; Mod^{A}. Diagram (4) commutes because Str_{R_{I}}(f) is defined as the unique morphism making (4) commute, and similar diagram (2) commutes because of the definition of clim_{Adt_{I}}(f) and because a functor preserves composition.

Note that for this type of diagram, if the subdiagrams (1), (2), (3), and (4) commute for all d ∈ D, this does not immediately imply that the functors μ_{Θ′}; Mod^{A}(clim_{Adt_{I}}(f)) and Str_{R_{I}}(f); μ_{Θ} are the same.

However, because Mod^{A}(∐ Γ) is a limit of Γ; Mod^{A}, there exists a unique functor

H : Str_{R_{I}}(Θ′) → Mod^{A}(∐ Γ)

which makes the following diagram commute for all d ∈ D:

\xymatrix{Mod^{A}(∐ Γ) \ar[d]_{Mod^{A}(ι_{d}^{Γ})} & Str_{R_{I}}(Θ′) \ar[l]_{H} \ar[dl]^{π_{f^{F} (d)}^{Γ;Mod^{A}};Mod^{A}(f_{d}^{μ})} \\ Mod^{A}(Γ(d))}

Since μ_{Θ′}; Mod^{A}(clim_{Adt_{I}}(f)) and Str_{R_{I}}(f); μ_{Θ} have the same property, we get:

μ_{Θ′}; Mod^{A}(clim_{Adt_{I}}(f)) = H = Str_{R_{I}}(f); μ_{Θ}.
□

Satisfaction Theorems 5.8 and 5.9 from the previous section allow us to define the satisfaction relation ⊧^{R_{I}}.

On one hand, there exists a unique element \overline{m} = μ_{Θ}(m) in Mod^{A}(clim_{Adt_{I}}(Θ)) for each m in Str_{R_{I}}(Θ) given by the natural isomorphism μ between Str_{R_{I}} and clim_{Adt_{I}}; Mod^{A} (cf. Theorem 5.9), which, by the definition of the category Adt_{I}, is also an element of Str_{I}(Sig^{A}(clim_{Adt_{I}}(Θ))).

On the other hand, since Flat(Fun(Sig^{A})); clim_{Sign_{I}} and clim_{Adt_{I}}; Sig^{A} are equal (cf. Theorem 5.8), each formula φ ∈ Sen_{R_{I}}(Θ) is also an element of Sig^{A}(clim_{Adt_{I}}(Θ)). This allows us to define:

Definition 5.10 (⊧^{R_{I}}) Let Θ be a signature in Sign_{R_{I}}, m a structure in Str_{R_{I}}(Θ), and φ a formula in Sen_{R_{I}}(Θ), then

m ⊧^{R_{I}} φ if and only if \overline{m} ⊧^{I} φ.

For R_{I} to be an institution, it remains to show that the satisfaction condition holds.

Theorem 5.11 For all signature morphisms f : Θ → Θ′ in Sign_{R_{I}}, Θ′-structures m, and Θ-formulas φ we have:

m ⊧^{R_{I}} Sen_{R_{I}}(f)(φ) if and only if m|_{f} ⊧^{R_{I}} φ.

Proof. Let f be a morphism from Θ to Θ′ in Sign_{R_{I}}, m a Θ′-structure, and φ a Θ-formula, then we have:

m ⊧^{R_{I}} Sen_{R_{I}}(f)(φ)
iff  \overline{m} ⊧^{I} Sen_{I}(Sig^{A}(clim_{Adt_{I}}(f))) | Def. ⊧^{R_{I}}
iff \overline{m}|_{Sig^{A}(clim_{Adt_{I}} (f))} ⊧^{I} φ  | Sat. Cond. I
iff  \overline{m}|_{clim_{_{Adt}_{I}} (f)} ⊧^{I} φ  | Def. Adt_{I}-morph.
iff  \overline{m|_{f}} ⊧^{I} φ  | *
iff  m|_{f} ⊧^{R_{I}} φ  | Def. ⊧^{R_{I}}

Equivalence (∗) holds because the naturality of the isomorphism between the functors Str_{R_{I}} and clim_{Adt_{I}}; Mod^{A} implies \overline{m}|_{clim_{_{Adt}_{I}} (f)} = \overline{m|_{f}}. □

Definition of R_{I} To sum up the previous paragraphs, we define:

Definition 5.12 (R_{I}) Given an institution I with a cocomplete category of signatures Sign_{I} and a colimit preserving structure functor Str_{I}. The institution

R_{I} = (Sign_{R_{I}}, Str_{R_{I}}, Sen_{R_{I}}, ⊧^{R_{I}})

is defined as follows:

• Sign_{R_{I}} = Flat(Fun(Adt_{I})),

• Str_{R_{I}}(Θ) = ∏_{D} Γ; Mod^{A} and Str_{R_{I}}(f) = ∏_{D}(f^{F}; π^{Γ′;Mod^{A}}); (f^{μ}; Mod^{A}) for all morphisms f : Θ → Θ′ and objects Θ = (D, Γ) and Θ′ = (D′, Γ′) in Sign_{R_{I}},

• Sen_{R_{I}} = Flat(Fun(Sig^{A})); clim_{Sign_{I}}; Sen_{I}, and

• m ⊧^{R_{I}} φ iff \overline{m} ⊧^{I} φ for all m ∈ Str_{R_{I}}(Θ), φ ∈ Sen_{R_{I}}(Θ), and Θ ∈ Sign_{R_{I}}.

Note that the construction of the functors Str_{R_{I}} and Sen_{R_{I}} are very similar. Given an object (D, Γ) then Str_{R_{I}}((D, Γ)) is given by ∏_{D} Γ; Mod^{A}, while Sen_{R_{I}}((D, Γ)) is given by Sen_{I}(∐_{D} Γ; Sig^{A}). However, we have given an explicit definition of Str_{R_{I}} while Sen_{R_{I}} was given as a composition of functors. And indeed, we can define Str_{R_{I}} similar to Sen_{R_{I}} as

Str_{R_{I}} = Flat(Fun(Mod^{A})); lim_{Cat}.

Note, however, since Mod^{A} is a contravariant functor, Fun(Mod^{A}) is a family of contravariant functors indexed by Cat, that is, Fun(Mod^{A})_{D} is a contravariant functor from the functor category of covariant functors, Fun(Adt_{I})_{D} = Adt_{I}^{D}, to the category of contravariant functors from D to Cat, which we denote by CFun(Adt_{I})_{D} = Cat^{D^{op}}. Then flattening a family of contravariant functors yields a covariant functor from Flat(Fun(Adt_{I})) to Flat(CFun(Cat)^{op}). That is, a morphism

(f^{F} : D → D′, f^{μ} : Γ ⇒ f^{F}; Γ′)

in Flat(Fun(Adt_{I})) is mapped to the morphism

(f^{F} : D → D′, Mod^{A}(f^{μ}) : f^{F}; Γ′; Mod^{A} ⇒ Γ; Mod^{A})

in Flat(CFun(Cat)^{op}).

Then lim_{Cat} maps an object (D, Γ : D^{op} → Cat) in Flat(CFun(Cat)^{op}) to ∏_{D} Γ in Cat and a morphism (f^{F} : D → D′, f^{μ} : f^{F}; Γ′ ⇒ Γ) in Flat(CFun(Cat)^{op}) to the unique morphism ∏_{D′}(f^{F}; π^{Γ′}); f^{μ} from ∏_{D} Γ′ to ∏_{D} Γ given by the limit property of ∏_{D} Γ.

Note the similarity between the category of many-sorted signatures Sig (cf. Section 3.1) and the category Sign_{R_{I}}. Both can be defined by flattening an indexed category, MS : Set^{op} → Cat for Sig (cf. Section 2.5) and Fun(Adt_{I}) : Cat^{op} → Cat for Sign_{R_{I}}. For a set S, MS_{S} is the set of functions from S^{+} to Set, and for a category D, Fun(Adt_{I})_{D} is the set of functors from D to Adt_{I}. We shall see in the next section that also the construction of colimits is very similar.

Abstract datatypes in R_{I}, objects in Adt_{R_{I}}, are pairs (Θ, M) where M is a full subcategory of Str_{R_{I}}(Θ) = ∏ Γ; Mod^{A}. Morphisms f from (Θ_{1}, M_{1}) to (Θ_{2}, M_{2}) in Adt_{R_{I}} are type morphisms f = Θ_{f} from Θ_{1} to Θ_{2} such that Str_{R_{I}}(f)(M_{2}) ⊆ M_{1}. Thus we have the following fact:

Fact 5.13 The category of relations between abstract datatypes Rel, defined in Section 5.2, is the same as the category of abstract datatypes Adt_{R_{I}} in R_{I} for an institution I with a cocomplete category of signatures and a structure preserving structure functor.

Note that the definition of Rel does not require Sign_{I} to be cocomplete and Str_{R_{I}} to preserve colimits. This is only needed for the definition of formulas and satisfaction in R_{I}.

Example In the example of the counter the increment operation is the abstract datatype (ΘInc, M) in the institution R_{LSL} with LSL as the base institution where ΘInc ∈ Sign_{R_{LSL}} is the type (V, Γ_{Inc}). Γ_{Inc} can be depicted by the following diagram

Γ_{Inc} = [figure: [ ; [C] ; ]; [ ; [C] ; ]; [ _{[Nat]} ]]

where

C : trait
includes Nat
introduces c: N

and M is given by all pairs (A, B) in

∏ Γ_{Inc}; Mod^{A} = Mod^{A}([ ; [C] ; ]) ×_{Mod^{A}(\begin{matrix}[ \\ [ & Nat & ] \\ ] \end{matrix})} Mod^{A}([ ; [C] ; ]),

with B(c) = A(succ)(A(c)).

To fix a colimit of Γ_{Inc}; Sig^{A} for the definition of Sen_{R_{LSL}}(ΘInc) we use the convention that the components of the state after an operation is performed are decorated with a prime. Then the formulas in Sen_{R_{LSL}}(ΘInc) are the formulas in Sen_{LSL}(∐ Γ_{Inc}; Sig^{A}) where ∐ Γ_{Inc}; Sig^{A} is the signature

({N}, {zero : N, succ : N → N, c : N, c′ : N}).

Using the formulas in Sen_{R_{LSL}}(Γ_{Inc}), M can be characterized by all pairs (A, B) from Str_{R_{LSL}}(Γ_{Inc}) such that

(A, B) ⊧^{R_{LSL}} c′ = succ(c),

which is, by the definition of satisfaction in R_{LSL}, equivalent to

A +_{C} B ⊧^{LSL} c′ = succ(c),

where A +_{C} B is the amalgamated of A and B with respect to C = A|_{ι} = B|_{ι}.

With the specification language SL_{I} introduced in Section 4.2 and instantiated with I = R_{LSL}, we can write

Inc = I_{{c′=succ(s)}}ΘInc

to define the increment operation.

5.4 Colimits in Sign_{R_{I}}

Since Sign_{R_{I}} is defined as Flat(Fun(Adt_{I})), we can use Theorem 2.28 to prove that Sign_{R_{I}} is cocomplete. To apply this theorem, we have to check that

1. Cat is cocomplete,

2. Adt_{I}^{D} is cocomplete for each category D, and

3. the functor Fun(Adt_{I})_{F} : Adt_{I}^{D′} → D has a left adjoint for all functors F : D → D′.

Cat is cocomplete and since in the construction of R_{I} we have assumed that Sign_{I} is cocomplete, so is Adt_{I} and thus Adt_{I}^{D} is cocomplete for all categories D.

Thus it remains to show that Fun(Adt_{I})_{F} has a left adjoint for every functor F : D → D′. Given a functor Γ : D → Adt_{I}, we are looking for a functor L^{F} (Γ) : D′ → Adt_{I} such that for each functor Γ′′ : D′ → Adt_{I} and natural transformation μ : Γ ⇒ F; Γ′′ there exists a unique natural transformation \overline{μ} : L^{F} (Γ) ⇒ Γ′′:

[figure: Γ; μ; F; Γ′′; L^{F} (Γ); \overline{μ}; Γ′′] .

5.4 Colimits in Sign_{R_{I}}  97

As observed by Tarlecki, Burstall and Goguen [58], finding for each Γ : D → Adt_{I} a functor L^{F} (Γ) : D′ → Adt_{I} with the above properties is the same as finding the left Kan extension of Γ along F : D → D′.

Definition 5.14 (Left Kan Extension) Given categories T, D, and D′ and a functor F : D → D′. Let Γ be an object of T^{D}, that is, a functor from D to T, then the left Kan extension of Γ along F is a pair (Γ′, η) consisting of a functor Γ′ from D′ to T and a natural transformation η from Γ to F; Γ′ such that for all natural transformations ν : Γ ⇒ F; Γ′′ in T^{D′} there exists a unique natural transformation ν̄ : Γ′ ⇒ Γ′′ such that the following diagram commutes in T^{D}:

\xymatrix{Γ \ar@{=>}[r]^{η} \ar@{=>}[dr]_{ν} & F; Γ′ \ar@{=>}[d]^{F;ν̄} \\  & F; Γ′′}

Note that if each Γ in T^{D} has a left Kan extension Γ′ along F, then this determines a functor L^{F} : T^{D} → T^{D′} left adjoint to Fun(T)_{F} by L^{F} (Γ) = Γ′ and L^{F} (ν : Γ ⇒ Γ′′) = \overline{ν; η′′} where η′′ is the natural transformation associated to the left Kan extension of Γ′′ along F:

[figure: Γ; ν; Γ′′; η′′; F; L^{F} (Γ′′); L^{F} (Γ); L^{F} (ν); L^{F} (Γ′′)] .

As an example consider the following categories

D = \xymatrix{1 & & 2 \\ & 0 \ar[ul]^{f} \ar[ur]_{g}} and D′ = \xymatrix{ & 3 \\ 1 \ar[ur]^{f′} & & 2 \ar[ul]_{g′} \\ & 0 \ar[ul]^{f} \ar[ur]_{g}},

Let F be the inclusion of D into D′ and Γ an arbitrary functor from D to T.

The problem is to find Γ′(0), Γ′(1), Γ′(2), and Γ′(3). While it seems natural to choose Γ′(0) = Γ(0), Γ′(1) = Γ(1), and Γ′(2) = Γ(2), the question remains what to choose for Γ′(3). Intuitively Γ′(3) is the “smallest” object in T which “includes” Γ′(1) and Γ′(2), that is, Γ′(3) is the coproduct of Γ′(1) and Γ′(2).

To see that this indeed defines the left Kan extension of Γ along F, consider a functor Γ′′ : D′ → T and a natural transformation μ : Γ ⇒ F; Γ′′. Then we have to be able to extend μ to a natural transformation \overline{μ} from Γ′ to Γ′′. Again it is natural to choose \overline{μ}_{0} = μ_{0}, \overline{μ}_{1} = μ_{1} and \overline{μ}_{2} = μ_{2}. Now \overline{μ}_{3} : Γ′(3) → Γ′′(3) is given by the universal property of the coproduct Γ′(3) = Γ′(1) ⊎ Γ′(2) and because μ_{1}; Γ′′(f′) is a morphism from Γ′(1) to Γ′′(3) and μ_{2}; Γ′′(g′) is a morphism from Γ′(2) to Γ′′(3).

Theorem 1 on page 233 of Mac Lane’s book [43] provides a construction of the right Kan extension. The notion of right Kan extension is a dual to the notion of left Kan extension. Thus by reversing the arrows in the construction of the right Kan extension we get a left Kan extension.

Theorem 5.15 (Mac Lane [43]) Under the assumptions of Definition 5.14 the left Kan extension of Γ along F exists provided that T is cocomplete.

Proof. Here, we only provide the construction of the left Kan extension; the proof that this is indeed a left Kan extension can be found in [43]. Let Γ be a functor from D to T, then we have to provide a functor Γ′ from D′ to T. For each d′ ∈ D′ we take Γ′(d′) as the “smallest element” including Γ(d) if there exists a morphism f from F (d) to d′ in D′. Thus Γ′(d′) is the colimit of a functor F_{d′} from an appropriate category to T. The appropriate category is the comma category (F ↓ d′). Objects of (F ↓ d′) are pairs (d, f) consisting of an object d of D and an arrow f from F (d) to d′ in D′. Morphisms from (d_{1}, f_{1}) to (d_{2}, f_{2}) are arrows g : d_{1} → d_{2} in D such that the following diagram commutes in D′:

\xymatrix{F (d_{1}) \ar[rr]^{F (g)} \ar[dr]_{f_{1}} &  & F (d_{2}) \ar[dl]^{f_{2}} \\  & d′}

Then F_{d′} : (F ↓ d′) → T is given by

F_{d′}((d, f)) = Γ(d) and F_{d′}(g) = Γ(g)

for objects (d, f) and morphisms g : (d_{1}, f_{1}) → (d_{2}, f_{2}) in (F ↓ d′).

Now we can define Γ′(d′) as ∐ F_{d′} and Γ′(g : d_{1} → d_{2}) as ∐ ν where ν is the natural transformation from F_{d_{1}} to Δ(∐ F_{d_{2}}) given by ν_{(d,f)} = ι_{(d,f;g)}^{F_{d_{2}}}.

Note that if (d, f) is an object of (F ↓ d_{1}) and g is a morphism from d_{1} to d_{2}, then (d, f; g) is an object of (F ↓ d_{2}) and F_{d_{1}}((d, f)) = Γ(d) = F_{d_{2}}((d, f; g)).

The colimit of F_{d′} exists because T is cocomplete.

□

As an example of the construction of the left Kan extension, we define Γ′ : D′ → T from the previous example.

The category (F ↓ 0) has one object (0, id) and the identity as the only arrow. The functor F_{0} maps (0, id) to Γ(0). The colimit of F_{0} is Γ(0) and thus Γ′(0) = Γ(0).

The category (F ↓ 1) has two objects (0, f) and (1, id) and one arrow f from (0, f) to (1, id) other than the identity. Then Γ′(1) is Γ(1) because the colimit of F_{1} is Γ(1). Similar we get Γ′(2) = Γ(2).

(F ↓ 3) is the category freely generated by

\xymatrix{(1, f′) & (2, g′) \\ (0, f; f′) \ar[u]^{f} & (0, g; g′) \ar[u]_{g}}

and F_{3} can be depicted by

\xymatrix{Γ(1) & Γ(2) \\ Γ(0) \ar[u]^{Γ(f)} & Γ(0) \ar[u]_{Γ(g)}}

which has the coproduct of Γ(1) and Γ(2) as its colimit. Note that (0, f; f′) and (0, g; g′) are two different objects in (F ↓ 3), and therefore the colimit of F_{3} is the coproduct of Γ(1) and Γ(2) and not the pushout of Γ(1) and Γ(2) with respect to Γ(0).

The morphism Γ′(f) is Γ(f), Γ′(g) = Γ(g), Γ′(f′) is the injection ι_{1} of Γ(1) into the coproduct Γ(1) ⊎ Γ(2), and Γ′(g′) the injection ι_{2} of Γ(2) into Γ(1) ⊎ Γ(2). Thus Γ′ can be depicted as:

\xymatrix{ & Γ(1) ⊎ Γ(2) \\ Γ(1) \ar[ur]^{ι_{1}} &  & Γ(2) \ar[ul]_{ι_{2}} \\  & Γ(0) \ar@{-->}[ul]^{Γ(f)} \ar@{-->}[ur]_{Γ(g)}}

In the proof of the existence of a left Kan extension (cf. Theorem 5.15) we had to require cocompleteness of T because we needed the colimit of the functor F_{d′} : (F ↓ d′) → T. However, provided that D and D′ are finite categories, it suffices that T is finitely cocomplete because (F ↓ d)′ will be always finite if D and D′ are finite.

Corollary 5.16 Under the assumptions of Definition 5.14 the left Kan extension of Γ along F exists provided that T is finitely cocomplete and that D and D′ are finite.

Let T be a (finitely) cocomplete category, then Theorem 5.15 implies the existence of a left adjoint functor for Fun(T)_{F} for every functor F from a (finite) category D to a (finite) category D′. Together with Theorem 2.28 we get:

Theorem 5.17 The category Flat(Fun(T)) is (finitely) cocomplete if T is (finitely) cocomplete.

Since Adt_{I} is cocomplete, we get as a direct consequence:

Corollary 5.18 The category Sign_{R_{I}} is cocomplete.

The initial object in Sign_{R_{I}} is (0, Γ_{⊥}) where Γ_{⊥} is the unique functor from 0 to Adt.

In the following we study types of functors F : J → Sign_{R_{I}} which do not require the existence of left adjoint functors to construct their colimit. An example of these type of diagrams can be found in the definition of the sequential composition of relations from Adt_{R_{I}} (cf. Section 6.3).

Instead of proving the next theorem for Sign_{R_{I}} = Flat(Fun(Adt_{I})), we give a proof for Flat(Fun(T)) where T is any category. Note that for this theorem we do not have to require that T is (finitely) cocomplete.

Theorem 5.19 Given a functor F from J to Flat(Fun(T)). Let F (i) = (D_{i}, Γ_{i}) and F (f) = (f^{F} , f^{μ}) such that f^{μ} is the identity on Γ_{i}, that is, Γ_{i} = f^{F}; Γ_{j} for all objects i and morphisms f : i → j in J. Let further F_{Cat} be the functor from J to Cat defined by F_{Cat}(i) = D_{i} and F_{Cat}(f) = f^{F} for every i and f in J. Then the colimit (D_{cl}, Γ_{cl}) of F is given by the colimit D_{cl} of F_{Cat} and the unique functor Γ_{cl} from D_{cl} to T given by the colimit property of D_{cl} w.r.t. the natural transformation ν : F_{Cat} ⇒ ΔT with ν_{i} = Γ_{i} for every i ∈ J.

Proof. First note that ν is indeed a natural transformation because

ν_{i} = Γ_{i} = f^{F}; Γ_{j} = F_{Cat}(f); ν_{j}

for all morphisms f : i → j in J:

[figure: D_{i}; ν_{i}=Γ_{i}; F_{Cat}(f)=f^{F}; T; (ΔT)(f)=id_{T}; D_{j}; ν_{j}=Γ_{j}; T]

Using the representation of colimits in Cat from Theorem 2.3 we can write the functor Γ_{cl} as

Γ_{cl}([(i, d)]_{≡}) = Γ_{i}(d) and Γ_{cl}([(i, f : d → d′)]_{≡}) = Γ_{i}(f).

The co-cone morphisms ι_{i}^{F} are given by ι_{i}^{F} = (ι_{i}^{F_{Cat}}, id) where ι_{i}^{F_{Cat}}(d) = [(i, d)]_{≡} for all i ∈ J and d ∈ D_{i}.

To show that (ι^{F} , ∐ F) is a colimit in Flat(Fun(T)), consider an object (D′, Γ′) and a natural transformation ϵ from F to Δ(D′, Γ′). We have to find a unique morphism h = (h^{F} , h^{μ}) from ∐ F to (D′, Γ′) such that the following diagram commutes for all i ∈ J:

\xymatrix{∐ F \ar@{-->}[r]^{(h^{F} ,h^{μ})} & (D′, Γ′) \\ (D_{i}, Γ_{i}) \ar[ur]_{ϵ_{i}=(ϵ_{i}^{F} ,ϵ_{i}^{μ})} \ar[u]^{(ι^{F_{Cat}},id)}}

h^{F} is given by the colimit property of ∐ F_{Cat} with respect to the natural transformation η from F_{Cat} to ΔD′ given by η_{i} = ϵ_{i}^{F} and is unique with the property ι^{F_{Cat}}; h^{F} = ϵ_{i}^{F}. Using the explicit representation of ∐ F_{Cat} the functor h^{F} can be written as:

h^{F} ([(i, d)]_{≡}) = ϵ_{i}^{F} (d) and h^{F} ([(i, f : d → d′)]_{≡}) = ϵ_{i}^{F} (f).

Define the natural transformation h^{μ} by (h^{μ})_{[(i,d)]_{≡}} = (ϵ_{i}^{μ})_{d} for [(i, d)]_{≡} ∈ ∐ F_{Cat}. We have to show that h^{μ} is well defined, that h^{μ} is a natural transformation from Γ_{cl} to F_{h^{μ}}; Γ′, and that ι^{F}; h = ϵ.

For proving the well-definedness of h^{μ} consider (i, d) ≡ (j, d′) and f : i → j in J with d′ = F_{Cat}(f)(d):^{1}

(h^{μ})_{[(j,d′)]_{≡}} = (ϵ_{j}^{μ})_{d′}  | Def. of h^{μ}
= (ϵ_{j}^{μ})_{F_{Cat}(f)(d)} | F_{Cat}(f)(d) = d′
= (F_{Cat}(f); ϵ_{j}^{μ})_{d} | Def. of F_{Cat}(f)(ϵ_{i}^{μ})
= (ϵ_{i}^{μ})_{d}  | *
= (h^{μ})_{[(i,d)]_{≡}}  | Def. of h^{μ}

The equation (*) holds because ϵ is a natural transformation from F to Δ(D′, Γ′) and thus ϵ_{i} = F (f); ϵ_{j}, which implies ϵ_{i}^{μ} = f^{μ}; F_{Cat}(f)(ϵ_{j}) by the definition of composition in Flat(Fun(T)). Then ϵ_{i}^{μ} = F_{Cat}(f)(ϵ_{j}) because f^{μ} is the identity natural transformation.

To show that h^{μ} is a natural transformation from Γ_{cl} to h^{F}; Γ′, consider a morphism [(i, f : d → d′)]_{≡} : [(i, d)]_{≡} → [(i, d′)]_{≡} in ∐ F_{Cat}. We have to show that the following diagram commutes

\xymatrix{Γ_{cl}([(i, d)]_{≡}) \ar[r]^{(h^{μ})_{[(i,d)]≡}} \ar[d]_{Γ_{cl} ([(i,f)]_{≡})} & Γ′(h^{F} ([(i, d)]_{≡})) \ar[d]^{Γ′(h^{F})([(i,f)]_{≡})} \\ Γ_{cl}([(i, d′)]_{≡}) \ar[r]_{(h^{μ})_{[(i,d′)]≡}} & Γ′(h^{F} ([(i, d′)]_{≡}))}

However, by the definition of ∐ F and h^{μ} this is the same as

\xymatrix{Γ_{i}(d) \ar[r]^{(ϵ_{i}^{μ})_{d}} \ar[d]_{Γ_{i}(f)} & Γ′(ϵ_{i}^{F} (d)) \ar[d]^{Γ′(ϵ_{i}^{F} (f))} \\ Γ_{i}(d′) \ar[r]_{(ϵ_{i}^{μ})_{d′}} & Γ′(ϵ_{i}^{F} (d′))}

for all i ∈ J, which commutes since ϵ_{i}^{μ} is a natural transformation from Γ_{i} to ϵ_{i}^{F}; Γ′.

Now we have to show that ι^{F}; h = ϵ, that is, we have to show

ι^{F_{Cat}}; h^{F} = ϵ_{i}^{F} and ι_{i}^{F_{Cat}}(h^{μ}) = ϵ_{i}^{μ}

1To show the well-definedness of a function h : A/≡_{R} → B defined by h([a]_{≡_{R}}) = g(a), it suffices to show that g(a) = g(a′) if a R a′ because equality is an equivalence relation.

for each i ∈ J. The first equation holds because of the definition of h^{F} and for the second equation consider d ∈ D_{i} and

(ι_{i}^{F_{Cat}}(h^{μ}))_{d} = (h^{μ})_{(ι_{i}^{F_{Cat}}(d))}
= (h^{μ})_{[(i,d)]_{≡}} | Def. ι_{i}^{F_{Cat}}
= (ϵ_{i}^{μ})_{d}  | Def. of h^{μ}.
□

Note that the construction of the above theorem does not work for arbitrary diagrams since, in general, ν, as defined above, is not a natural transformation because instead of ν_{i}(d) = Γ_{i}(d) being equal to (F_{Cat}(f); ν_{j})(d) = Γ_{j}(f^{F} (d)) for all d ∈ D_{i} we only know that Γ_{i}(d) and Γ_{j}(f^{F} (d)) are related by the T -morphism f_{d}^{μ}.

5.5 Preservation of Colimits

In this section we prove that Str_{R_{I}} preserves colimits, that is, Str_{R_{I}}(∐ F) is a limit of F; Str_{R_{I}} for functors F : J → Sign_{R_{I}}. Because of Theorem 5.9, we know that Str_{R_{I}} is natural isomorphic to clim_{Adt_{I}}; Mod^{A}, and Theorem 2.20 allows us to deduce from that fact and the fact that clim_{Adt_{I}}; Mod^{A} preserves colimits that Str_{R_{I}} preserves colimits.

We have that Str_{I} preserves colimits, and thus Mod^{A} preserves colimits. Because the composition of (co)limit preserving functors is again a (co)limit preserving functor, we are done if we can show that clim_{Adt_{I}} preserves colimits. To this end we prove that clim_{Adt_{I}} has a right adjoint functor U : Adt_{I} → Sign_{R_{I}}.

Lemma 5.20 Let U be the functor from Adt_{I} to Sign_{R_{I}} defined by

U((Σ, M)) = (1, Γ_{(Σ,M)}) and U(σ) = (Id_{1}, σ^{μ})

for each abstract datatype (Σ, M) and morphism σ in Adt_{I} where Γ_{(Σ,M)} maps the only object of 1 to (Σ, M) and σ_{1}^{μ} = σ. Then U is a right adjoint for clim_{Sign_{R_{I}}}.

Proof. The co-unit ε : Id_{Adt_{I}} ⇒ U; clim_{Adt_{I}} of the adjunction is given by ε_{(Σ,M)} = id_{(Σ,M)} for every (Σ, M) in Adt. And for a morphism σ from clim_{Sign_{I}}(Θ) to (Σ, M) the morphism σ̃ from Θ to U((Σ, M)) is given by (σ̃^{F} , σ̃^{μ}) where σ̃^{F} is the unique morphism from D to 1 because 1 is the terminal object in Cat and σ̃_{d}^{μ} = ι_{d}^{Γ}; σ for each object d in D. □

Theorem 2.25 and the previous lemma imply:

Corollary 5.21 The functor clim_{Sign_{I}} : Sign_{R_{I}} → Adt_{I} preserves colimits.

Altogether we get the main theorem of this section:

Theorem 5.22 The contravariant functor Str_{R_{I}} from Sign_{R_{I}} to Cat preserves colimits.

5.6 Relation between Adt_{R_{I}} and Adt_{I}  103

5.6 Relation between Adt_{R_{I}} and Adt_{I}

There is a strong relationship between objects (Θ_{R}, M_{R}) in Adt_{R_{I}} and objects (Σ, M) in Adt_{I} resulting from the preservation of colimits of Str_{I} and the fact that Sign_{I} and thus Adt_{I} are cocomplete.

Definition 5.23 The functor G^{A} : Adt_{R_{I}} → Adt_{I} is defined by

G^{A}((Θ_{R}, M_{R})) = (∐_{D_{R}} Γ_{R}; Sig^{A}, \{\overline{m} | m ∈ M_{R}\})
G^{A}(f) = clim_{Adt_{I}}(f)

where Θ_{R} = (D_{R}, Γ_{R}) and f is an Adt_{R_{I}}-morphism from R = (Θ_{R}, M_{R}) to S = (Θ_{S}, M_{S}), that is, f is an Sign_{R_{I}}-morphism from Θ_{R} to Θ_{S} such that M_{S}|_{f} ⊆ M_{R}.

For G^{A} to be well-defined we have to check that G^{A}(f) is indeed an Adt_{I}-morphism from G^{A}(R) to G^{A}(S), that is,

Mod^{A}(G^{A}(S))|_{G^{A}(f)} ⊆ Mod^{A}(G^{A}(R)).

Let \overline{m}_{S} be a model of Mod^{A}(G^{A}(S)), that is, m_{S} is an object of M_{S}. Then we have to show that \overline{m}_{S}|_{clim_{_{Adt}_{I}} (f)} is in Mod^{A}(G^{A}(R)). Since the isomorphism between Str_{R_{I}} and clim_{Adt_{I}}; Mod^{A} is natural, this is equivalent to showing that \overline{m_{S}|_{f}} is in Mod^{A}(G^{A}(R)). This holds by definition of G^{A} and because f is an Adt_{R_{I}}-morphism, and therefore m_{S}|_{f} is in M_{R}.

In the example of the counter G^{A}((Θ_{Inc}, M_{Inc})) is the abstract datatype (Σ_{I}, M_{I}) in the institution LSL where

                    Σ_{I} = ∐_{V} Γ_{Inc}; Sig^{A} = Σ_{Counter} +_{Σ_{Nat}} Σ_{Counter}

and

M_{I} = {A +_{C} B | (A, B) ∈ M_{Inc}}.

Conversely, if we are given M_{I}, we can get M_{Inc} by

M_{Inc} = {(D|_{ι_{1}}, D|_{ι_{2}}) | D ∈ M_{I}}

where ι_{1} and ι_{2} are the co-cone morphism of the colimit of Γ_{Inc}; Sig^{A}.

Fact 5.24 For every R in Adt_{R_{I}} there exists an isomorphism between the model category of R and the model category of G^{A}(R).

Proof. This is obvious since G^{A}((Θ, M)) is defined as (∐ Γ; Sig^{A}, \overline{M}) where \overline{M} is the category with objects all \overline{m} such that m ∈ M. □

Note however, though the model categories of R and G^{A}(R) are isomorphic, there is no isomorphism between Adt_{R_{I}} and Adt_{I} because it is impossible to recover the type of R from G^{A}(R).

Still, it is possible to define for each abstract datatype (Σ, M) a relation U((Σ, M)) in Adt_{R_{I}} which is universal in the sense that if σ is an Adt-morphism from G^{A}((Θ, M′)) to (Σ, M) for some object (Θ, M′) in Adt_{R_{I}}, then there exists a unique morphism σ̃ from (Θ, M′) to U((Σ, M)) with G^{A}(σ̃) = σ.

Let (Σ, M) be an abstract datatype in Adt_{I}, then

U((Σ, M)) = ((1, Γ_{Σ}), M′′)

where Γ_{Σ} : 1 → Adt_{I} maps 1 to (Σ, \{\}) and \overline{M′′} is the same as M.

Further, given an Adt-morphism σ from (Σ, M) to (Σ′, M′), then σ extends to an Adt_{R_{I}}- morphism f = (f^{F} , f^{μ}) from U((Σ, M)) to U((Σ′, M′)) by

f^{F} (1) = 1 and f_{1}^{μ} = σ.

Theorem 5.25 U as defined above is a functor from Adt to Adt_{R_{I}} right adjoint for G^{A}.

Proof. The co-unit ε : Id_{Adt_{I}} ⇒ U; G^{A} of the adjunction is given by ε_{(Σ,M)} = id_{(Σ,M)} for abstract datatypes (Σ, M). For a morphism σ from G^{A}((Θ, M′)) to (Σ, M) the morphism σ̃ from (Θ, M′) to U((Σ, M)) is given by (σ̃^{F} , σ̃^{μ}) where σ̃^{F} is the unique morphism from D to 1 since 1 is the terminal object in Cat and σ̃_{d}^{μ} = ι_{d}^{Γ;Sig^{A}}; σ for each object d in D. The morphism ι_{d}^{Γ;Sig^{A}} is the co-cone morphism from Sig^{A}(Γ(d)) to ∐ Γ; Sig^{A}, the signature of G^{A}((Θ, M)), where Θ = (D, Γ).

Let U((Σ, M)) = ((1, Γ_{Σ}), M′′). Note that by the definition of U we have \overline{M′′} = M.

For σ̃ to be an Adt_{R_{I}}-morphism it remains to show that M′′|σ̃ ⊆ M′. Note that, because σ̃ is unique with the property G^{A}(σ̃); ε_{(Σ,M)} = σ and ε_{(Σ,M)} is the identity, we have G^{A}(σ̃) = σ. Using the fact that the isomorphism between Str_{R_{I}} and clim_{Adt_{I}}; Mod^{A} is natural and noting that G^{A}(σ̃) = clim_{Adt_{I}}(σ̃) = σ, we get\overline{M′′|σ̃} = \overline{M′′}|_{σ} = M|_{σ}. Since σ is an Adt-morphism, we have M|_{σ} ⊆ \overline{M′} and thus \overline{M′′|σ̃} ⊆ \overline{M′}, which implies M′′|σ̃ ⊆ M′. □

The existence of a right adjoint for G^{A} implies:

Corollary 5.26 The functor G^{A} from Adt_{R_{I}} to Adt_{I} preserves colimits.

The following theorem is the core theorem for proving properties of relations (cf. Chapter 7). It allows us to prove (Θ_{R}, M_{R}) ⊧^{R_{I}} φ by proving G^{A}((Θ_{R}, M_{R})) ⊧^{I} φ and is a consequence of the isomorphism of the model categories of R and G^{A}(R).

Theorem 5.27 Let R = (Θ, M) be a relation in Adt_{R_{I}} and φ a formula in Sen_{R_{I}}(Θ), then

R ⊧^{R_{I}} φ if and only if G^{A}(R) ⊧^{I} φ.

Note though that this does not imply that if we are given a sound and complete inference system ⊢^{I} for proving Φ_{1} ⊧^{I} Φ_{2}, then we get a sound and complete inference system for proving Φ_{1} ⊧^{R_{I}} Φ_{2}. We can only conclude that if Φ_{1} ⊢^{I} Φ_{2}, then Φ_{1} ⊧^{R_{I}} Φ_{2}. The reason is that the category of all Θ_{R}-structures that satisfy Φ_{1} with respect to ⊧^{R_{I}} is only isomorphic to the subcategory of all Σ-structures that satisfy Φ_{1} with respect to ⊧^{I} where Σ is the signature of G^{A}(R) (cf. Section 7).

5.7 Operations on relations

One advantage of representing relations as abstract datatypes of the institution R_{I} is to use the language SL_{I′} (cf. Section 4.2) where I′ is RSL_{I} with its operations impose, translate, derive, and union to define relations.

A relation R = Θ is the universal relation. For example, if Θ = (K_{n}, Γ), then

(m_{1}, …, m_{n}) ∈ R iff (m_{1}, …, m_{n}) ∈ Str_{R_{I}}(Θ)
iff (m_{1}, …, m_{n}) ∈ Str_{I}(Γ(1)) × ⋯ × Str_{I}(Γ(n)).

Impose Let R = (Θ_{R}, M_{R}) be a relation in Adt_{R_{I}}. The operation I_{Φ}R allows to restrict the tuples in M_{R} to those satisfying Φ:

(m_{1}, …, m_{n}) ∈ I_{Φ}R if and only if (m_{1}, …, m_{n}) ∈ R and (m_{1}, …, m_{n}) ⊧^{R_{I}} Φ

For example, the increment operation of the counter can be defined using the impose operation as

Inc = I_{{c′=succ(c)}}ΘInc

and the decrement operation as

Dec = I_{{succ(c′)=c, c≠zero}}ΘInc.

Union The union operation can be used to combine several relations of the same type such that

(m_{1}, …, m_{n}) ∈ R_{1} + R_{2}

if and only if (m_{1}, …, m_{n}) ∈ R_{1} and (m_{1}, …, m_{n}) ∈ R_{2}

for relations R_{1} = (Θ, M_{R_{1}}) and R_{2} = (Θ, M_{R_{2}}).

Translate The translate operation allows to change the type of a relation, for example, so that the union of relations is defined. It can be used to add new state components and nodes/edges to the type of a relation.

Given a relation R of type Θ_{R} and a Sign_{R_{I}}-morphism from Θ_{R} to some type Θ_{S}, then T_{f}R yields a relation of type Θ_{S} as follows:

(m_{1}, …, m_{n}) ∈ T_{f}R if and only if (m_{1}, …, m_{n})|_{f} ∈ R.

For example, assume that we want to add a new component d of sort N to the state of the counter, that is, the new state is given by the following specification:

New : trait
   includes Counter
   introduces d : N

Further, we would like to extend the increment relation Inc to an increment relation Inc′ on the new state, that is, Inc′ is of the type

Θ_{Inc}′ = \xymatrix{[ [New] ] & & [ [New] ] \\ & [ _{[Env]} ] \ar[ul] \ar[ur]}

Let ι_{C} denote the inclusion of [ [Counter] ] into [ [New] ] and let f = (Id_{V}, f^{μ}) be the Sign_{R_{LSL}}- morphism from ΘInc to Θ_{Inc}′ such that f_{0}^{μ} : [ [Env] ] → [ [Env] ] is the identity, f_{1}^{μ} : [ [Counter] ] → [ [New] ] = ι_{C}, and f_{2}^{μ} : [ [Counter] ] → [ [New] ] = ι_{C}. Then Inc′ is T_{f}Inc, and we have:

Mod^{A}(Inc′) = \{(A, B) ∈ Mod^{A}(\begin{matrix}[ \\ [ & New & ] \\ ] \end{matrix}) × Mod^{A}(\begin{matrix}[ \\ [ & New & ] \\ ] \end{matrix}) | (A|_{ι_{C}}, B|_{ι_{C}}) ∈ [ [Inc] ]\}.

Note that Inc′ does not fix the relationship between A(d) and B(d). Thus any values for A(d) and B(d) are possible in case of A Inc′ B. To establish a relationship between these two values, we can use, for example, the impose operation as follows:

I_{{d′=succ(succ(d))}}Inc′

This ensures that B(d) = A(succ)(A(succ)(d)) for all (A, B) ∈ Inc2.

Derive By hiding state components the derive operation can be used to adapt the state space of relations so that, for example, the union of relations is defined. Hiding nodes by the derive operation is used in the definition of sequential composition (cf. Section 6.3), in the computation of the precondition of a state transformation (cf. Section 7.2), and can be used to define a relation with the help of auxiliary symbols, like the tracking map between sorts in Section 6.1.

If R is a relation of type Θ_{R} and f a Sign_{R_{I}}-morphism from a type Θ_{S} to Θ_{R}, then D_{f}R yields a relation of type Θ_{S} as follows:

(m_{1}, …, m_{n}) ∈ D_{f}R

if and only if ∃(m′_{1}, …, m′_{k}) ∈ R with (m′_{1}, …, m′_{k})|_{f} = (m_{1}, …, m_{n})

One use of the derive operation is to define the identity relation. Suppose, we are interested in specifying the identity relation for some abstract datatype St, that is, we want to define a relation Id_{St} of type

Θ = \xymatrix{[ [St] ] & & [ [St] ] \\ & [ _{[Env]} ] \ar@{-->}[ul] \ar@{-->}[ur]}

such that (m_{1}, m_{2}) ∈ Id_{St} if and only if m_{1} = m_{2} for structures m_{1} and m_{2} from Mod^{A}(St).

Consider the type

Θ′ = \xymatrix{[ [St] ] \\ [ _{[Env]} ] \ar[u]}

and the morphism ι = (ι^{F} , ι^{μ}) from Θ to Θ′ mapping each St in Θ to St in Θ′ and which is the identity on Env. That is, ι^{F} maps 0 of V to 0 of 2 and 1 and 2 of V to 1 of 2. ι_{0}^{μ} is the identity on [ [Env] ], and ι_{1}^{μ} = ι_{2}^{μ} is the identity on [ [St] ]. Then Id_{St} is given by Id_{St} = D_{ι}Θ′.

To show that Id_{St} really is the identity, let (A, B) in Id_{St}, that is, there exists some C in Str_{R_{I}}(Θ′) with C|_{ι} = (A, B). By the definition of Str_{R_{I}}(ι) we have

C|_{ι} = (C|_{ι_{ι^{F} (1)}^{μ}}, C|_{ι_{ι^{F} (2)}^{μ}})
= (C|_{ι_{1}^{μ}}, C|_{ι_{1}^{μ}})  | ι^{F} (1) = 1 = ι^{F} (2)
= (C, C)  | ι_{i}^{μ} = id

Thus we have (A, B) = (C, C) and therefore A = B = C.

On the other hand, it is obvious that (A, A) is in Id_{St} for each A ∈ Mod^{A}(St).

Colimit The colimit construction can be used to combine different relations on the same state sharing some common part or to combine relations on different states with the possibility of sharing state components. If F : J → SL_{R_{I}} is a diagram of relations such that the colimit of F; Sig exists, then

(m_{1}, …, m_{n}) ∈ colim F iff (m_{1}, …, m_{n})|_{ι_{i}} ∈ F (i) for all i ∈ J

where ι_{i} is the co-cone morphism from F (i) to the colimit of F; Sig for all i ∈ J.

As an example we define the relation Inc2 on the state space

                        C′ = [ [Counter] ] +[ [Nat] ] [ [Counter] ]

incrementing both copies of the counter simultaneously as Inc +_{Id_{Nat}} Inc where Id_{Nat} is the identity relation on Nat, which has type

Θ_{Nat} = \xymatrix{[ [Nat] ] & & [ [Nat] ] \\ & [ _{[Nat]} ] \ar[ur] \ar[ul]}

Let ι = (Id_{V}, ι^{μ}) be the Sign_{R_{I}}-morphism from Θ_{Nat} to Θ_{Inc} where ι_{0}^{μ} is the identity on Nat and ι_{1}^{μ} = ι_{2}^{μ} is the inclusion of Nat into Counter. The pushout Θ_{Inc} +_{(ι,ι)} Θ_{Inc} is the type

       Θ_{Inc2} = \xymatrix{[ [Counter] ] +[ [Nat] ] [ [Counter] ] &  & [ [Counter] ] +[ [Nat] ] [ [Counter] ] \\  & [ _{[Nat]} ] \ar[ul] \ar[ur]}

Let

PO : trait
   include Counter[c1 for c]
           Counter[c2 for c]

be the pushout [ [Counter] ] +[ [Nat] ] [ [Counter] ]. Then the co-cone morphism ι_{1} from ΘInc to Θ_{Inc2} is (Id_{V}, ι_{1}^{μ}) where (ι_{1}^{μ})_{0} is the identity morphism on [ [Nat] ] and (ι_{1}^{μ})_{1} = (ι_{1}^{μ})_{2} maps c : N to c_{1} : N and is the identity otherwise. The second co-cone morphism ι_{2} from ΘInc to Θ_{Inc2} is (Id_{V}, ι_{2}^{μ}) where (ι_{2}^{μ})_{0} is the identity morphism on [ [Nat] ] and (ι_{2}^{μ})_{1} = (ι_{2}^{μ})_{2} maps c : N to c_{2} : N.

Using the definition of the colim operator from Section 4.2 and the equalities of Fact 4.9 we get

                 Inc2 = Inc +_{Id_{Nat}} Inc

= T_{ι′_{1}}Inc + T_{ι′_{2}}Inc
= T_{ι′_{1}}I_{{c′=succ(c)}}ΘInc + T_{ι′_{2}}I_{{c′=succ(c)}}ΘInc
= I_{ι′_{1}({c′=succ(c)})}Θ_{Inc2} + I_{ι′_{2}({c′=succ(c)})}Θ_{Inc2}
= I_{{c′_{1}=succ(c_{1})}}I_{{c′_{2}=succ(c_{2})}}Θ_{Inc2}
= I_{{c′_{1}=succ(c_{1})}∪{c′_{2}=succ(c_{2})})}Θ_{Inc2}
= I_{{c′_{1}=succ(c_{1}), c′_{2}=succ(c_{2})}}Θ_{Inc2}

5.8 Finite Diagrams

5.9 The Language RSL_{I}  109

In the previous sections we have assumed that Sign_{I} is cocomplete. However, in many interesting institutions Sign_{I} is only finitely cocomplete. For example, if we restrict the signatures of the institutions EQ and EQC to finite many-sorted signatures, that is, instead of Sig we use the category of finite many-sorted signatures FSig. FSig is a full subcategory of Sig, but only finitely cocomplete (cf. Section 3.1).

To use an institution I with a finitely cocomplete category of signatures for the construction of R_{I}, we have to restrict the objects in Sign_{R_{I}} to pairs (D, Γ) where D is a finite category because the definition of Sen_{R_{I}} depends on taking colimits of shape D in Sign_{I}. Since all diagrams are finite, Str_{I} needs to preserve only finite colimits instead of arbitrary colimits. The definitions of Str_{R_{I}}, Sen_{R_{I}}, and ⊧^{R_{I}} are, in principle, unaffected.

Formally, instead of defining Sign_{R_{I}} as Flat(Fun(Adt_{I})), we define

Sign_{R_{I}} = Flat(FFun(Adt_{I}))

where FFun(T) : FCat^{op} → Cat is the indexed category FFun(T)_{D} = T^{D} for finite categories D and FFun(T)(Γ′) = F; Γ for functors F : D → D′ and Γ′ : D′ → T. Similar to Fun(G) we define FFun(G)_{D}(Γ) = Γ; G and FFun(G)_{D}(μ) = μ; G for finite categories D, functors Γ : D → T, and natural transformations μ : Γ_{1} ⇒ Γ_{2}.

Note that Flat(FFun(T)) is a full subcategory of Flat(Fun(T)), thus the new structure functor Str_{R_{I}} is the old structure functor Str_{R_{I}} with its domain restricted to Flat(FFun(T)).

Similarly, we get a functor clim_{T} : Flat(FFun(T)) → T by restricting the domain of the functor clim_{T} : Flat(Fun(T)) → T. Note that for clim_{T} : Flat(FFun(T)) → T to be welldefined we only have to require that T is finitely cocomplete. Then Sen_{R_{I}} is again defined as Flat(FFun(Sig^{A})); clim_{Sign_{I}}; Sen_{I}.

The results that Str_{R_{I}} is natural isomorphic to clim_{Adt_{I}}; Mod^{A} and that

Flat(FFun(Sig^{A})); clim_{Sign_{I}} = clim_{Adt_{I}}; Sig^{A}

carry over from Theorems 5.8 and 5.9. This allows again to define m ⊧^{R_{I}} φ by \overline{m} ⊧^{I} φ for all types Θ ∈ Sign_{R_{I}}, m ∈ Str_{R_{I}}(Θ), and φ ∈ Sen_{R_{I}}(Θ).

Theorem 5.17 ensures that Sign_{R_{I}} is also finitely cocomplete because Sign_{I} and thus Adt_{I} are finitely cocomplete.

Similarly, Str_{R_{I}} preserves colimits because Str_{R_{I}} is isomorphic to the composition clim_{Adt_{I}} followed by Mod^{A}, Mod^{A} preserves finite colimits if Str_{I} preserves them, and clim_{Adt_{I}} preserves colimits and thus also finite colimits.

5.9 The Language RSL_{I}

In the following we present the language RSL_{I} for the definition of relations and introduce some useful abbreviations. At first glance RSL_{I} expressions are the same as SL_{I′} expressions introduced in Section 4.2 where I′ is the institution R_{I}. However, the difference is that instead of functors Γ : D → Adt_{I} functors Γ : D → SL_{I} are used, where SL_{I} is the specification language for the base institution I of R_{I}. The idea is that not only the relations are defined by expressions but also the type of the relations. In addition this allows to define the translation of expressions in RSL_{I} to expressions in SL_{I} given in Section 7.1, which would be impossible otherwise.

To this end we define the category Type_{I}. Type_{I} is similar to Sign_{R_{I}}, however, using pairs (D, Γ : D → SL_{I}) instead of pairs (D, Γ : D → Adt_{I}). The morphisms f from Θ = (D, Γ) to Θ′ = (D′, Γ′) in Type_{I} are pairs (f^{F} , f^{μ}) where f^{F} is a functor from D, and f^{μ} is a natural transformation from Γ to f^{F}; Γ′.

Note that the category Type_{I} is the same as the flattened indexed category FFun(SL_{I}). Since SL_{I} is finitely cocomplete, this implies that Type_{I} = Flat(FFun(SL_{I})) is also finitely cocomplete (cf. Section 5.8).

The semantics functor [ [ ] ] : SL_{I} → Adt_{I} (cf Section 4.2) is extended to a functor [ [ ] ] from Type_{I} to Sign_{R_{I}} that maps an object (D, Γ : D → SL_{I}) in Type_{I} to an object (D, Γ; [ [ ] ] : D → Adt_{I}) in Sign_{R_{I}} and similar a Type_{I}-morphism f^{μ} to a Sign_{R_{I}}-morphism

(f^{F} , f^{μ}; \begin{matrix}[ \\ [ & ] \\ & ] \end{matrix}).

Definition 5.28 (Abstract Syntax of RSL_{I}) Given the institution R_{I} based on the institution I, types Θ and Θ′ in Type_{I}, and a Type_{I}- morphism f : Θ → Θ′, then the abstract syntax of the language RSL_{I} is given by

R ::= Θ | I_{Φ}R | T_{f}R | D_{f}R | R + R

where Φ is a set of formulas in the institution R_{I}.

The type type(R) of an expression R in RSL_{I} is an object of Type_{I} and is defined inductively on the structure of RSL_{I} as follows:

• type(Θ) = Θ

• type(I_{Φ}R) = type(R)

• type(T_{f}R) = cod(f)

• type(D_{f}R′) = dom(f)

• type(R_{1} + R_{2}) = type(R_{1}) = type(R_{2}).

An expression R from RSL_{I} is well-formed if

• R = I_{Φ}R′, Φ ⊆ Sen_{R_{I}}([[type(R′)]]), and R′ is well-formed.

• R = T_{f}R′, f is a morphism from type(R′) to type(R) in Type_{I}, and R′ is well-formed.

• R = D_{f}R′, f is a morphism from type(R) to type(R′) in Type_{I}, and R′ is well-formed.

• R = R_{1} + R_{2}, type(R_{1}) = type(R_{2}), and R_{1} and R_{2} are well-formed.

The semantics of a well-formed expression in RSL_{I} is an object of Adt_{R_{I}} and is defined in two steps: first an expression in RSL_{I} is converted to an expression in SL_{R_{I}}, and then the semantics of this expression yields a relation in Adt_{R_{I}}.

Let Θ be a type in Type_{I}, R a well-formed expression in RSL_{I}, f a Type_{I}-morphism from type(R) to Θ′, and g a Type_{I}-morphisms from Θ′ to type(R) for some Θ′ in Type_{I}, then

• [ [Θ] ]_{SL_{R_{I}}} = [ [Θ] ]

• \begin{aligned}[ \\ [ & I_{Φ}R & ] \\ & ] \end{aligned}_{SL_{R_{I}}} = I_{Φ} [ ; [R] ; ]_{SL_{R_{I}}}

• \begin{aligned}[ \\ [ & T_{f}R & ] \\ & ] \end{aligned}_{SL_{R_{I}}} = T[ ; [f] ; ] [ ; [R] ; ]_{SL_{R_{I}}}

• \begin{aligned}[ \\ [ & D_{g}R & ] \\ & ] \end{aligned}_{SL_{R_{I}}} = D[ ; [g] ; ] [ ; [R] ; ]_{SL_{R_{I}}}

• \begin{aligned}[ \\ [ & R_{1} + R_{2} & ] \\ & ] \end{aligned}_{SL_{R_{I}}} = \begin{aligned}[ \\ [ & R_{1} & ] \\ & ] \end{aligned}_{SL_{R_{I}}} + \begin{aligned}[ \\ [ & R_{2} & ] \\ & ] \end{aligned}_{SL_{R_{I}}}.

Finally, the semantics of an expression R in RSL_{I} is given by

[ ; [R] ; ]_{R} = \begin{aligned}[ \\ [ & [ ; [R] ; ]_{SL_{R_{I}}} & ] \\ & ] \end{aligned} .

Similar as with SL_{I} (c.f. Section 4.2), we make RSL_{I} a category by defining the morphsims f from R_{1} to R_{2} to be the Type_{I} morphisms (f^{F} , f^{μ}) having the property that [ ; [f] ; ] = (f^{F} , f^{μ}; \begin{matrix}[ \\ [ & ] \\ & ] \end{matrix}) is an Adt_{R_{I}}-morphism from \begin{aligned}[ \\ [ & R_{1} & ] \\ & ] \end{aligned}_{R} to \begin{aligned}[ \\ [ & R_{2} & ] \\ & ] \end{aligned}_{R}.

Fact 5.29 For any expression R in RSL_{I} we have

Sig^{A}([ ; [R] ; ]_{R}) = \begin{matrix}[ \\ [ & type(R) & ] \\ ] \end{matrix} and Mod^{A}([ ; [R] ; ]_{R}) ⊆ Str_{R_{I}}(\begin{matrix}[ \\ [ & type(R) & ] \\ ] \end{matrix}).

We say that a type Θ = (D, Γ) is included in a type Θ′ = (D′, Θ′) if Γ is a sub-diagram of Γ′. However, we also talk about inclusion if there are obvious inclusion morphisms between corresponding nodes. For example, given the following diagrams

Γ = \xymatrix{Γ(1) & & Γ(2) \\ & Γ(0) \ar@{-->}[ul]^{Γ(f_{1})} \ar@{-->}[ur]_{Γ(f_{2})}}

and

Γ′ = \xymatrix{ & Γ′(3) \\ Γ′(1) \ar@{-->}[ur]^{Γ(f_{3})} & & Γ′(2) \ar@{-->}[ul]_{Γ′(f_{4})} \\ & Γ′(0) \ar@{-->}[ul]^{Γ′(f_{1})} \ar@{-->}[ur]_{Γ′(f_{2})}}

then Γ is included in Γ′ if Γ(0) = Γ′(0), Γ(1) = Γ′(1), Γ(2) = Γ′(2), Γ(f_{1}) = Γ′(f_{1}), and Γ(f_{2}) = Γ′(f_{2}), or if there are inclusion morphisms ι_{0} from Γ(0) to Γ′(0), ι_{1} from Γ(1) to Γ′(1), and ι_{2} from Γ(2) to Γ(2).

Formally, we require that there exists a unique morphism ι = (ι^{F} , ι^{μ}) from Θ to Θ′ such that ι^{F} : D → D′ is faithful and ι_{d}^{μ} : Γ(d) → Γ′(ι^{F} (d)) is “canonic” for all d ∈ D.

Abbreviations

Since Type_{I} is finitely cocomplete, so is RSL_{I}, and, similar as with SL_{I}, we extend RSL_{I} by a colimit construct

R ::= … | colim F | R_{1} +_{(σ_{1},σ_{2})} R_{2} | R_{1} +_{R_{0}} R_{2}

where F is a functor from a finite category J to RSL_{I}. Then colim F is an abbreviation for

T_{ι_{i_{1}}^{F;type}}(F (i_{1})) + ⋯ + T_{ι_{in}^{F;type}}(F (i_{n}))

where ι_{i_{k}}^{F;type} are the co-cone morphisms of the colimit of F; type. Similarly, we use R_{1} +_{(f_{1},f_{2})} R_{2} for the pushout of R_{1} with R_{2} with respect to f_{1} and f_{2}, and R_{1} +_{R_{0}} R_{2} if f_{1} and f_{2} are the unique inclusion of R_{0} in R_{1} and R_{2}.

In Chapter 6 we mainly have to deal with relations whose types have the form

\xymatrix{Sp_{1} & … & Sp_{n} \\  & Env \ar[ur] \ar[ul]}

where the morphisms from Env to Sp_{i} are canonic, for example, in LSL this means that Env is included into Sp_{i} and that the morphisms are the corresponding inclusions of Env into Sp_{i}. We shall write <Sp_{1} × … × Sp_{n}>_{Env} for types of this form.

Then [e : E] in <[e : E] × Sp>_{Env} is an abbreviation for

includes Env
introduces e : E

For example, the type of the Add operation from page 83 can be now written as

                     <[n_{in} : Nat] × Counter × Counter>_{Nat}.

If R is a relation defined by I_{Φ}Θ then we may also write

R : Θ
asserts Φ

And

R : Θ
includes R'
asserts Φ

is the same as I_{Φ}T_{ι}R′ where ι is the canonic morphism from the type of R′ to Θ.

6 Abstract Machines

The motivation to study relations between classes of algebras is to model state-transitions in software systems. An example of such software systems are abstract machines. An abstract machines offers a set of operations to its clients. Depending on the operations that have been requested before, the same operation may yield different results. Thus abstract machines have memory. A typical abstract machine is the abstract machine of a stack. It provides the operations Push and Pop. The Push operation pushes its argument on the stack, and the Pop operation removes the topmost element of the stack and returns it. Depending on what Push and Pop operations have been performed before, different results are returned by the Pop operation. Thus an abstract machine consists of a set of states, a set of initial states, a subset of the set of states, and a set of services. A service is a relation between states with possible input and output values.

Abstract machines are often called abstract datatypes with states or simply abstract datatypes. However, to not confuse abstract datatypes with state with the notion of abstract datatypes introduced in Chapter 4, we stick to the term abstract machines.

In the framework of this thesis, the signature of an abstract machine is a 4-tuple (Env, I, O, τ) where the environment Env is an SL_{I}-expression, I is the name of the set of initial states, O is a set of names for the operations, and τ a function assigning to an operation name op in O a type τ(op) from Type_{I}. We require that τ(op) has the form

\xymatrix{I_{1} & … & I_{n} &  & O_{1} & … & O_{m} \\  &  &  & Env \ar[ulll]^{f_{1}} \ar[ul]_{f_{n}} \ar[ur]^{g_{1}} \ar[urrr]_{g_{m}}}

We shall also write τ(op) = <I_{1} × … × I_{n}> → <O_{1} × … × O_{m}> assuming that the morphisms f_{i} : Env → I_{i} and g_{j} : Env → O_{j} are “canonic”, which, for example, in LSL means that f_{i} and g_{j} are inclusions.

Since abstract machines encapsulate the state, the signature does not contain an SL_{I}-expres-sion for the state, and similar the type of an operation does not contain the state.

For the example, the signature of the stack is (Env, Empty, {Push, Pop}, τ) where τ(Push) = <[e : E]> → <>, τ(Pop) = <> → <[e : E]>, and Env is an abstract datatype containing at least the sort E.

Whenever convenient, we may also write

(Env, Empty, {Push : <[e : E]> → <>, Pop : <> → <[e : E]>})

for the the signature (Env, Empty, {Push, Pop}, τ).

An abstract machine M = (St_{M}, I_{M}, M_{O}) of signature (Env, I, O, τ) consists of an abstract datatype St_{M} from Adt_{I} such that Env is included in St_{M}, defining the state space; a relation I_{M} of type <St_{M}>_{Env} and a set of relations M_{O} = {op_{M} | op ∈ O} from Adt_{R_{I}} such that if τ(op) = <I_{1} × … × I_{n}> → <O_{1} × … × O_{m}>, then the type of op_{M} is

<I_{1} × … I_{n} × St_{M} × St_{M} × O_{1} × … O_{m}>_{Env}.

The initial states I_{M} are given as a unary relation of type <St_{M}>_{Env} instead of an abstract datatype from Adt_{I} because this ensures that the class of initial states are models of St_{M}, and this simplifies writing the condition of simulation in Section 7.2.

The abstract machine of a stack is given by

                      S = (Stack_{S}, Empty_{S}, {Push_{S}, Pop_{S}})

where Stack_{S} is the abstract datatype:

Stack_{S} : trait
includes Env
introduces s : Stack

and Empty_{S} is the abstract datatype

Empty_{S} : <Stack_{S}>
asserts s = empty

We assume that the following specification is part of the environment Env:

Stack : trait
introduces empty : Stack
           push : E, Stack → Stack
           pop : Stack → Stack
           top : Stack → E
asserts
  Stack freely generated by empty, push
  ∀ e:E, s:Stack  top(push(e,s)) = e
  ∀ e:E, s:Stack  pop(push(e,s)) = s

The Push_{S} operation is defined as

Push_{S} : <[e:E] × Stack_{S} × Stack_{S}>
asserts s' = push(e,s)

and the type of the operation Pop_{S} is <Stack_{S} × Stack_{S} × [e : E]>_{Env} and the operation is given by

Pop_{S} : <[e:E] × Stack_{S} × Stack_{S}>
asserts s' = pop(s)
        e = top(s)

6.1 State as Algebra Approach

In the state as algebra approach the state of a software system is modeled by an algebra. This corresponds to using one of the institutions EQ, EQC, or LSL as the base institution I for R_{I}. The state components in the state as algebra approach are constants (null-ary functions), functions, and sorts.

Constants

Let us first consider constants as state components. Suppose we are given the following state space:

State : trait
 includes Env
 introduces c : S

and a type Θ = <State × State>_{Env}. The formulas that can be used to define relations of type Θ are the formulas from LSL over the signature

Σ_{cl} = Sig(State) +_{Sig(Env)} Sig(State)
= Sig(Env) ∪ {c : S, c′ : S}.

For example, a relation R = I_{{c′=t[c]}}Θ where t is a term of signature Σ_{cl} not containing an occurrence of c′, defines for each algebra A a unique algebra B by B|_{Sig(Env)} = A|_{Sig(Env)} and B(c) = A(t) such that A R B. An example for this type of relation is the Inc relation on a counter from Section 5.1

Inc = I_{{c′=succ(c)}}ΘInc.

However, there are also other kinds of relations, like, for example the decrement operation on a counter, which has the form:

Dec = I_{{succ(c′)=c}}ΘInc.

Note that the decrement operation is undefined for an algebra A if A(c) = A(zero) as there is no n ∈ A(Nat) such that A(succ)(n) = A(zero).

If one wants to describe that the value of a state component c : S does not change one can define the relation R = I_{{c=c′}}Θ. Then A R B implies A(c) = B(c). A more general way to define the identity on (part of) the state was shown in Section 5.7; the method presented there has also the advantage that it is independent of the base institution.

Functions

Consider the state space of a dictionary, which we model by a function map from keys to values and a function dom from keys to bool. The intention is that only in the case where dom(x) yields true the value of map(x) is valid.

Dict : trait
  includes Env
  introduces
     map : Key → Value
     dom : Key → Bool

Then type Θ of the add operation, adding a new key, value pair to the dictionary, is

                  Θ = <[k : Key] × [v : Value] × Dict × Dict>_{Env}

A possible way to define the add operation seems to be as

Add = I_{{map′(k)=v, dom′(k)=true}}Θ.

However, this does not define the expected relation. Consider the relation defined by the above add operation. Add is the set of 4-tuples (A, B, C, D) such that A + B + C + D ⊧^{LSL} {map′(k) = v, dom′(k) = true}. Thus the only restrictions on map′ and dom′ are D(map)(A(k)) = B(v) and D(dom)(A(k)) = D(true). Nothing else is assumed, in particular it need not hold that D(map)(a) is the same as C(map)(a) if a ≠ A(k). This is in contrast, for example, to the Abstract State Machine approach of Gurevich, where D(map)(a) = C(map)(a) for a ≠ A(k) would be implied.

Therefore, to get the intended meaning of the add operation, we have to write Add = I_{Φ}Θ with Φ being the set:

    ∀ x:Key  map'(x) = (if x = k then v else map(x))
    ∀ x:Key  dom'(x) ⇔ x = k ∨ dom(x)

Note also that it is important that the sorts Key and Value are defined in the environment Env because otherwise, A(Key), C(Key) and D(Key) need not be the same set and thus a term of the form D(map)(A(k)) would be meaningless since A(k) ∈ A(Key) may not be an element of D(Key) as required by D(map) : D(Key) → D(Value).

Our choice to model dom and map as functions depends strongly on the base institution. For example, dom could have been a predicate instead of a boolean function in an institution with predicates, like first-order logic [25], or one could have omitted dom altogether and used a partial function map instead of a total one, in the institution of partial algebras [48]. And using SET (cf. Section 9.1) as the base institution, map could be a set of key, value pairs.

Sorts

Similar to constants and functions, sorts can be used as state components. Consider for example a state with a sort OID of object identifies, with a constant nil of sort OID:

State : trait
  includes Env
  introduces sorts OID
  introduces nil : OID

We want to define a relation R that adds a new element to OID. However, how can two sorts be related? In an algebraic institution no operations are defined on sorts, thus we cannot write OID′ = OID ∪ {o}. Another way to relate the sorts OID and OID′ is by a function f : OID → OID′, called tracking map in the D-oids approach of Astesiano and Zucca [4]. The problem with this approach is that in Sig(State) +_{Env} Sig(State), which is the same as

Sp_{cl} : trait
includes Env
introduces sorts OID, OID'
introduces nil : OID
           nil' : OID'

there are no functions between the sorts of the pre- and the post-state. However this can be helped by the use of the derive operation and a specification expression of type Θ′, where Θ′ is

                  \xymatrix{ & [f : OID → OID′, o : OID′] \\ State \ar[ur] &  & State \ar[ul] \\  & Env \ar[ul] \ar[ur]}

The notation [f : OID → OID′, o : OID′] is an abbreviation for

includes SP_{cl}
introduces
  f: OID → OID'
  o: OID'

Then adding a new element to OID is the following relation R = D_{ι}I_{Φ}Θ′, where Φ is:

    f(nil) = nil'
    f(x) = f(y) ⇒ x = y % f is injective
    f(x) ≠ o             % o is a new object identifier.

The type-morphism ι is the inclusion Θ = <State × State>_{Env} into Θ′.

An alternative is to define OID′ with the help of a generating constraint as R′ = D_{ι}I_{Φ′}Θ′ with Φ′ = {OID′ generated freely by {f, o}}. The derive operation D_{ι} forgets the node defining f and o.

Another problem is to access the newly created object identifier o. Since OID and OID′ are state components, we cannot use the following type for the new operation:

                         \xymatrix{State & State & [o : OID] \\  & Env \ar[ul] \ar[u] \ar[ur]}

as the sort OID and the constant o have nothing to do with the sort OID in State and the constant o used in the type Θ′. A solution is to allow the output parameter to be an extension of the state instead of the environment. This gives the output parameter direct access to the state components, which, in this case, is desirable. Thus the type of the new operation is

                     \xymatrix{State &  & State \ar[r] & [o : OID] \\  & Env \ar[ur] \ar[ul]}

Then we have to adapt Θ′ to

            \xymatrix{ & [f : OID → OID′, o : OID′] &  & [o : OID] \\ State \ar[ur] &  & State \ar[ul] \ar[ur] \\  & Env \ar[ul] \ar[ur]}

Note that still o in the output parameter and o in the hidden part of R are not identified, but the colimit ∐ Θ′ is:

∐ Θ' : trait
includes Env
introduces sorts OID, OID'
introduces nil: OID
           nil' : OID'
           f: OID → OID'
           o: OID'
           o': OID'

contains both constants o as o and o′. Note that the constant o′ is of sort OID′ because the sort OID of the post-state and the parameters are the same since the post-state is included into the output parameter. Then we can define R by D_{ι}I_{Φ}Θ′ with Φ being:

  OID' generated freely by f, o
  o = o'

6.2 Models of the State

In the following we use different approaches to model the state of an abstract machine. Though they are described using LSL as the base institution, the approaches are not limited to algebraic institutions.

One way to model the state is by providing a possible implementation of the state, that is, we give a concrete model of the state. A characteristic of the concrete model of the state is the existence of states which cannot be distinguished by the operations of the abstract machine. In this case the specification is biased towards an implementation of the specification (cf. Jones [40]). Note that a concrete model of the state does not prescribe the representation of the state space used by the final implementation of the abstract machine (cf. Section 7.3).

An abstract model of the state, or a two tiered model, uses a functional abstract datatype modeling the state space and as a component a constant of the sort of the functional abstract datatype. This approach is, for example, used in the Larch approach to specifications [34]. The Larch Shared Language is used to define functional abstract datatypes, which are then used in one of the Larch Interface Languages tailored to a specific programming language to specify an abstract datatype with state.

A third approach uses as state components possible observations on the state. In general, it is not possible to model all abstract machines with this technique because not all abstract machines can be defined in a finite way by the effect the state changing operations have on the observations. An example of this is the abstract machine of a stack as noted by Schoett [55]. The observers of a stack are isEmpty and top. However, just with these two state components it is impossible to describe the intended behavior of the Pop operation.

As an example of the different styles, we shall give the specification of a birthday book from the Z reference manual of Spivey [57] in each of the three styles. The task is to model a birthday book recording the names of people and their birthday. We define three operations on the birthday book: AddBirthday adds a name and a date to the birthday book assuming that not already a birthday for that name is recorded, FindBirthday returns the date of birth associated to a name in the birthday book, and Remind returns a set of names for persons whose birthday is recorded in the birthday book for a given date.

Thus the signature of the birthday book is

           (Env, InitBirthday, {AddBirthday, FindBirthday, Remind}, τ),

where τ is:

                 τ(AddBirthday) = <[n : Name] × [d : Date]> → <>
                τ(FindBirthday) = <[n : Name]> → <[d : Date]>

τ(Remind) = <[d : Date]> → <[s : NameSet]>.

The environment Env contains at least sorts Name, Date and the sort NameSet, of finite sets of sort Name.

Concrete State

In the concrete model of the state, the state of the birthday book is modeled by a finite set of names known, containing the names for which the birthday book contains an entry and a finite map birthday between names and dates. known is modeled as a constant of sort NameSet, defined in the specification Set and birthdate as a constant of sort NameToDate, defined in the specification FiniteMap. The environment Env is given by the specification:

Env : trait
includes Set[Name for E, NameSet for C]
         FiniteMap[Name for F, Date for T, NameToDate for M]
introduces sorts Name, Date

The specifications for Set and FiniteMap can be found in the appendix A.

The state of the birthday book is given by

BirthdayBook_{BC} : trait
   includes Env
   introduces
      known: NameSet
      birthday: NameToDate
   asserts
      ∀ n : Name  n ∈ known ⇔ defined(birthday,n)

The state invariant requires that if n is in known then the association with n as its key is valid in birthday. Note that, because in LSL all functions are total, apply(birthday, n) always has a value, however, the value is not specified, if defined(birthday, n) does not hold.

Of the three versions of the birthday book example presented here, this version is the closest to the original Z specification of Spivey [57].

The initial birthday book contains no entries.

InitBirthday_{BC} : <BirthdayBook_{BC}>
   asserts
         known = {}

The operation AddBirthday adds a new association to birthday provided that n is not in known. The type Θ_{AB} of the AddBirthday operation is:

          <[n : Name] × [d : Date] × BirthdayBook_{BC} × BirthdayBook_{BC}>_{Env}

Then AddBirthday_{BC} = I_{Φ}Θ_{AB} with Φ the set

   not(n ∈ known);
   birthday' = update(birthday,n,d)

As in Spivey [57] we have not defined the effect of AddBirthday to known′. In particular we would like to show that n is an element of known after executing the AddBirthday operation. This should be a consequence of the definition of AddBirthday and the state invariant of BirthdayBook. Thus we would like to show

                         AddBirthday ⊧^{R_{I}} n ∈ known′

In Chapter 7 we shall develop methods to do this.

FindBirthday returns the birthday d of a person with name n. The type Θ_{FB} of FindBirthday is:

          <[n : Name] × BirthdayBook_{BC} × BirthdayBook_{BC} × [d : Date]>_{Env}

Then FindBirthday_{BC} = I_{Φ}Θ_{FB} with Φ given as:

   n ∈ known
   d = apply(birthday,n)
   birthday' = birthday
   known' = known

For a given date d, the remind operation returns the set of names of persons whose birthday is recorded in the birthday book and who have their birthday at that date. The type of the remind operation is Θ_{R}:

         <[d : Date] × BirthdayBook_{BC} × BirthdayBook_{BC} × [s : NameSet]>_{Env}

And Remind_{BC} = I_{Φ}Θ_{R} with Φ being the set

  known' = known
  birthday' = birthday
  ∀ n : Name  n ∈ s ⇔ known(n) ∧ apply(birthday,n) = d

Abstract State

In the abstract state approach, the state space is modeled by a sort BBook defined in the environment, and the state consists of a constant bdb of this sort. The specification

BirthdayBookSpec defines the sort BBook with the functions initBirthday, addBirthday,

known, and findBirthday. These functions are later used to define the operations

AddBirthday, FindBirthday, and Remind.
BirthdayBookSpec : trait
   introduces
      initBirthday : BBook
      addBirthday : BBook, Name, Date → BBook
      known : BBook, Name → Bool
      findBirthday : BBook, Name → Date
   asserts
      BBook generated by initBirthday, addBirthday
      forall b:BBook, n,n1:Name, d,d1:Date
         ¬ known(initBirthday,n);
         known(addBirthday(b,n1,d),n) ⇔
            n = n1 ∨ known(b,n);
         findBirthday(addBirthday(b,n1,d),n) =
            (if n1 = n
            then d
            else findBirthday(b,n));

Note that it is possible to add several dates for the birthday of one person to the birthday book. However, only the birthday added last will be found using the operation findBirthday.

We require that Env includes BirthdayBookSpec:

Env : trait
   includes BirthdayBookSpec,
            Set[Name for E, NameSet for C]

Then the state space of the birthday book is given by:

BirthdayBook_{BA} : trait
   includes Env
   introduces bdb:  BBook

The initial state InitBirthday_{BA} initializes bdb to the constant initBirthday of type BBook.

InitBirthday_{BA} : <BirthdayBook_{BA}>
   asserts bdb = initBirthday

The operations on BirthdayBook may, but need not, rely on the operations provided by BirthdayBookSpec. For example, the AddBirthday-operation is given by:

AddBirthday_{BA}:<[n:Name]×[d:Date]×BirthdayBook_{BA}×BirthdayBook_{BA}>_{Env}
   asserts
      known(bdb,n)
      bdb' = addBirthday(bdb,n,d)
and FindBirthday:
FindBirthday_{BA}:<[n:Name]×BirthdayBook_{BA}×BirthdayBook_{BA}×[d:Date]>_{Env}
   asserts
      known(bdb,n)
      d = findBirthday(bdb,n)
      bdb' = bdb

Both, AddBirthday and FindBirthday have used in their definition the corresponding func-

tions addBirthday and findBirthday from the specification BirthdayBookSpec.
Remind_{BA}:<[d:Date]×BirthdayBook_{BA}×BirthdayBook_{BA}×[s:NameSet]>_{Env}
 asserts
  ∀ n:Name  n ∈ s ⇔ findBirthday(bdb,n) = d ∧ known(bdb,n)
      bdb' = bdb

The abstract state approach is similar to the two tiered approach of Larch. First we have given a functional abstract datatype of a birthday book in an algebraic institution LSL. Then we have used this trait to specify an abstract data type with state using formulas relating the components of the pre- and post-states of an operation. But instead of using a Larch Interface Language tailored to a specific programming language, we use the specification language RSL_{LSL} as a kind of abstract interface language that makes no references to a specific programming language.

Using Observers

The basic observations one can make about a birthday book are whether a name is in the birthday book or not and what the birth date is for a given name. Thus the state has two

6.2 Models of the State  123

components, a function known : Name → Bool and birthday : Name → Date.
BirthdayBook_{BO} : trait
includes Env
introduces
   known: Name → Bool
   birthday : Name → Date

In the initial state of a birthday book no names are known, that is,

InitBirthday_{BO} : <BirthdayBook_{BO}>
asserts
  ∀ n : Name  known(n) = false

The effect of the operations are described by their effect on the observers. Thus the AddBirthday operation is given by:

AddBirthday_{BO}:<[n:Name]×[d:Date]×BirthdayBook_{BO}×BirthdayBook_{BO}>_{Env}
asserts
 ¬ known(n)
 ∀ n' : Name  known'(n') ⇔ n' = n ∨ known(n')
 ∀ n' : Name  birthday'(n') = if n' = n then d else birthday(n')

The FindBirthday operation does not change the observers and returns for a given person with name n its birthday d, if known(n) is true.

FindBirthday_{BO}:<[n:Name]×BirthdayBook_{BO}×BirthdayBook_{BO}×[d:Date]>_{Env}
asserts
   known(n);
   d = birthday(n)
   ∀ n' : Name  known'(n') = known(n')
   ∀ n' : Name  birthday'(n') = birthday(n')

Instead of explicitly writing the formulas that the state of the birthday book does not change, we can define a relation IDBirthdayBook_{BO} that expresses this:

IDBirthdayBook:<BirthdayBook_{BO}×BirthdayBook_{BO}>
asserts
∀ n' : Name  known'(n') = known(n')
∀ n' : Name  birthday'(n') = birthday(n')

then we can write

FindBirthday_{BO}:<[n:Name]×BirthdayBook_{BO}×BirthdayBook_{BO}×[d:Date]>_{Env}
includes IDBirthdayBook
asserts
   known(n);
   d = birthday(n)

to stand for

                         I_{Φ}T_{σ}IDBirthdayBook_{BO}

where σ is the inclusion of the type of IDBirthdayBook_{BO} into the type of FindBirthday_{BO}, and Φ is the set {known(n), d = birthday(n)}.

Another way to define IDBirthdayBook_{BO} is by using the derive operation with a morphism σ from Θ_{IDB} to Θ_{IDB}′ = <BirthdayBook_{BO}>_{Env}, mapping the environment component of Θ_{IDB} to the environment component of Θ_{IDB}′ and both state components to the single state component of Θ_{IDB}′ (cf. Section 5.7). Then IDBirthdayBook_{BO} = D_{σ}Θ_{IDB}′. To see that the definition of IDBirthdayBook_{BO} really does what it is supposed to do, we prove

             IDBirthdayBook_{BO} ⊧^{R_{LSL}} ∀n′ : Name known′(n′) = known(n′)

The proof that

                     ∀n′ : Name birthday′(n′) = birthday(n′)

follows from IDBirthdayBook_{BO} is analog.

Using the rules for proving properties of specification expressions SL_{I} from Section 4.3, it suffices to prove

Θ_{IDB}′ ⊧^{R_{LSL}} \overline{σ}(∀n′ : Name known′(n′) = known(n′))

Since the state components of Θ_{IDB} are mapped to the same state component of Θ_{IDB}′, we get that σ(known′) = known = σ(known) and therefore it suffices to show

Θ_{IDB}′ ⊧^{R_{LSL}} ∀n′ : Name known(n′) = known(n′),

which holds trivially.

The Remind operation is defined as follows:

Remind_{BO}:<[d:Date]×BirthdayBook_{BO}×BirthdayBook_{BO}×[s:NameSet]>_{Env}
   includes
      IDBirthdayBook
   asserts
      ∀ n : Name  n ∈ s ⇔ birthday(n) = d ∧ known(n)
      ∀ n : Name  known(n) = known(n)
      ∀ n : Name  birthday'(n) = birthday(n)

6.3 Extensions to RSL_{I}

In the following we shall introduce operations on relations that are useful for defining the operations of abstract machines, and that can be explained in terms of derive, translate, and union.

Sequential Composition

Consider two relations R ⊆ A × B and S ⊆ B × C. In the first step of the construction we extend R and S to three place relations in the following way:

(a, b, c) ∈ R̄ iff (a, b) ∈ R for every c ∈ C and
(a, b, c) ∈ S̄ iff (b, c) ∈ S for every a ∈ A.

6.3 Extensions to RSL_{I}  125

In the next step we form the intersection of R̄ and S̄, which yields

R̄ ∩ S̄ = {(a, b, c) | (a, b, c) ∈ R̄, (a, b, c) ∈ S̄}
= {(a, b, c) | (a, b) ∈ R, (b, c) ∈ S}

In the last step we forget about the middle component of R̄ ∩ S̄ and get a binary relation

ˆ (R̄ ∩ S̄) = {(a, c) | ∃b.(a, b, c) ∈ R̄ ∩ S̄}
= {(a, c) | ∃b.(a, b) ∈ R, (b, c) ∈ S},

which is the sequential composition R; S of the relation R with S. Now let R be a relation of type <Sp_{1} × Sp_{2}>_{Env} and S a relation of type <Sp_{2} × Sp_{3}>_{Env} in RSL_{I}. In a first step we form the pushout of S and R with respect to the inclusions of <Sp_{2}>_{Env} into R and S.

\xymatrix{R &  & S \\  & <_{Sp_{2}}>_{Env} \ar[ul]^{s_{1}} \ar[ur]_{s_{2}}}

where s_{1} and s_{2} are the inclusions of the relation <Sp_{2}>_{Env} into R and S. To construct the pushout in RSL_{I} we first take the pushout of the types of R and S, translate R and S by the co-cone morphism and form their union. Theorem 5.19 can be used to form the pushout of the following diagram in Type_{I}:

\xymatrix{_{Sp_{1}} &  & _{Sp_{2}} &  & _{Sp_{2}} &  & _{Sp_{3}} \\  & Env \ar[ul] \ar[ur] &  &  &  & Env \ar[ul] \ar[ur] \\  &  &  & _{Sp_{2}} \ar@{-->}[uul]^{(s_{1}^{μ})_{1}=id} \ar@{-->}[uur]_{(s_{2}^{μ})_{1}=id} \\  &  &  & Env \ar[u] \ar@{-->}[uull]^{(s_{1}^{μ})_{0}=id} \ar@{-->}[uurr]_{(s_{2}^{μ})_{0}=id}}

which is

Θ_{cl} = \xymatrix{_{Sp_{1}} & _{Sp_{2}} & _{Sp_{3}} \\ & Env \ar[ul] \ar[u] \ar[ur]}

with co-cone morphisms s′_{1}

\xymatrix{ &  & _{Sp_{1}} & _{Sp_{2}} & _{Sp_{3}} \\ _{Sp_{1}} \ar@{-->}[urr]^{id} &  & _{Sp_{2}} \ar@{-->}[ur] & Env \ar[ul] \ar[ur] \ar[u] \\  & Env \ar[ul] \ar[ur] \ar@{-->}[urr]_{id}}

and s′_{2}

\xymatrix{_{Sp_{1}} & _{Sp_{2}} & _{Sp_{3}} \\  & Env \ar[ul] \ar[ur] \ar[u] & _{Sp_{2}} \ar@{-->}[ul] &  & _{Sp_{3}} \ar@{-->}[ull]_{id} \\  &  &  & Env \ar[ul] \ar[ur] \ar@{-->}[ull]^{id}}

Then the pushout of R and S with respect to morphism s_{1} and s_{2} in RSL_{I} is T_{s′_{1}}R + T_{s′_{2}}S.

In the next step, we have to forget the Sp_{2} component of the pushout. This is done with the help of the derive operation. Then we get

R; S = D_{ι}(R +_{(<Sp_{2}>_{Env},s_{1},s_{2})} S) = D_{ι}(T_{s′_{1}}R + T_{s′_{2}}S),

where ι is the inclusion of <Sp_{1} × Sp_{3}>_{Env} into <Sp_{1} × Sp_{2} × Sp_{3}>_{Env}.

\xymatrix{_{Sp_{1}} & _{Sp_{2}} & _{Sp_{3}} \\ _{Sp_{1}} \ar@{-->}[u]^{id} & Env \ar[ul] \ar[ur] \ar[u] & _{Sp_{3}} \ar@{-->}[u]_{id} \\  & Env \ar[ul] \ar[ur] \ar@{-->}[u]^{id}}

Definition 6.1 (Sequential Composition) Let R be a relation of type <Sp_{1} × Sp_{2}>_{Env} and S a relation of type <Sp_{2} × Sp_{3}>_{Env}. Further, let s_{1} and s_{2} be the obvious inclusion morphisms of <Sp_{2}>_{Env} into the type of R and S. The type Θ = <Sp_{1} × Sp_{2} × Sp_{3}> is the colimit of s_{1} and s_{2}. Let further s be the morphism from <Sp_{1} × Sp_{3}> into Θ mapping Sp_{1} to the first component and Sp_{3} to the last component of Θ.

Then the sequential composition of R with S, R; S, is a relation of type <Sp_{1} × Sp_{3}> and defined by

R; S = D_{s}(R +_{(<Sp_{2}>_{Env},s_{1},s_{2})} S).

This definition can be extended to arbitrary relations R of type

<Sp_{1} × … × Sp_{n} × Sp′_{1} × … × Sp′_{m}>_{Env}

and S of type

<Sp′_{1} × … × Sp′_{m} × Sp′′_{1} × … × Sp′′_{k}>_{Env}.

Let Θ be <Sp′_{1} × … × Sp′_{m}>_{Env} and s_{1} = (s_{1}^{F} , id) a morphism from Θ to the type of R and s_{2} = (s_{2}^{F} , id) a morphism from Θ to the type of S. The result type of the composition of R with S is

Θ′ = <Sp_{1} × … × Sp_{n} × Sp′′_{1} × … × Sp′′_{k}>_{Env}.

Let s be the inclusion of Θ′ into the pushout of the type of R and S with respect to s_{1} and s_{2}, then we have

R; S = D_{s}(R +_{(Θ,s_{1},s_{2})} S).

Instantiation

If R is a binary relation R ⊆ A × B and S a subset of A then the instantiation of R with S, R(S), is the set {b | ∃a. (a, b) ∈ R, a ∈ S}. One can extend this to arbitrary relations R and S, where the type of S is a subtype of R. For example, let R ⊆ A × B × C be a relation and S ⊆ A × B. Then

R(S) = {c | ∃a, b. (a, b, c) ∈ R, (a, b) ∈ S}.

Definition 6.2 (Instantiation of Relations) Let R be a relation of type Θ_{R} = <Sp_{1} × … × Sp_{n}>_{Env} and S a relation of type Θ_{S} = <Sp_{1} × ⋯ × Sp_{m}>_{Env} for m ≤ n. The instantiation of R with S, R(S), is a relation of type Θ_{R(S)} = <Sp_{m+1} × ⋯ × Sp_{n}>_{Env} defined by

R(S) = D_{ι}(R + T_{ι_{S}}S),

where ι is the inclusion of Θ_{R(S)} into Θ_{R} and ι_{s} the inclusion of Θ_{S} into Θ_{R}.

The section about refinement (cf. Section 7.2) contains an example of the use of instantiation.

7 Proving Entailment of Relations

We are interested in methods for showing that a relation R entails another relation S, which, for example, is needed to prove the correctness of refinement (cf. Section 7.2). Applying the results of Section 4.3, the goal of proving R ⊧^{R_{I}} S, where R and S are expressions in SL_{R_{I}}, can be reduced to subgoals R_{i} ⊧^{R_{I}} S_{i} for 1 ≤ i ≤ n, which, in a lot of cases, can be further reduced to Φ_{j} ⊧^{R_{I}} Φ′_{j} for 1 ≤ j ≤ m. Thus the problem is how to prove Φ ⊧^{R_{I}} Φ′.

In Section 5.3 we have defined m ⊧^{R_{I}} φ iff \overline{m} ⊧^{I} φ. This might lead to the conclusion that Φ ⊧^{R_{I}} Φ′ if and only if Φ ⊧^{I} Φ′. However, while Φ ⊧^{I} Φ′ implies Φ ⊧^{R_{I}} Φ′, the converse is not always true.

Theorem 7.1 Let Φ and Φ′ be subsets of Sen_{R_{I}}(Θ) for Θ ∈ Sign_{R_{I}}, then Φ ⊧^{I} Φ′ implies Φ ⊧^{R_{I}} Φ′.

Proof. Let m be a Θ-structure. We have to show that m ⊧^{R_{I}} Φ implies m ⊧^{R_{I}} Φ′. By the definition of ⊧^{R_{I}} we have m ⊧^{R_{I}} Φ if and only if \overline{m} ⊧^{I} Φ. Because Φ ⊧^{I} Φ′, we have \overline{m} ⊧^{I} Φ′ and thus m ⊧^{R_{I}} Φ′. □

Let Θ be (D, Γ), the problem with the inverse direction is that the class of Θ-structures in R_{I} that satisfy Φ is usually only isomorphic to a subclass of ∐ Γ; Sig^{A}-structures in I that satisfy Φ because Str_{R_{I}}(Θ) is only isomorphic to a subcategory of Str_{I}(∐ Γ; Sig^{A}). However, if Str_{R_{I}}(Θ) is isomorphic to Str_{I}(∐ Γ; Sig^{A}) then we get:

Theorem 7.2 Let Φ and Φ′ be subsets of Sen_{R_{I}}(Θ) for Θ = (D, Γ) in Sign_{R_{I}}, and let Mod^{A}(clim_{Adt_{I}}(Θ)) be the same as Str_{I}(∐ Γ; Sig^{A}). Then Φ ⊧^{R_{I}} Φ′ implies Φ ⊧^{I} Φ′.

Proof. Assume that m is in Str_{I}(∐ Γ; Sig^{A}) with m ⊧^{I} Φ, then m is in Mod^{A}(clim_{Adt_{I}}(Θ)) because we have assumed that Str_{I}(∐ Γ; Sig^{A}) is the same as Mod^{A}(clim_{Adt_{I}}(Θ)). Since Str_{R_{I}} and clim_{Adt_{I}}; Mod^{A} are isomorphic, there exists m′ in Str_{R_{I}}(Θ) such that \overline{m}′ = m. By the definition of ⊧^{R_{I}} we have m ⊧^{I} Φ if and only if m′ ⊧^{R_{I}} Φ. Because Φ ⊧^{R_{I}} Φ′, we have m′ ⊧^{R_{I}} Φ′ and therefore m ⊧^{I} Φ′. □

However, in general, the condition Mod^{A}(clim_{Adt_{I}}Θ) = Str_{I}(∐ Γ; Sig^{A}) does not hold as clim_{Adt_{I}}Θ contains restrictions given by the datatypes defined in the environment and possible state invariants. Take the birthday book with the AddBirthday operation from Section 6.2 as an example.

Env : trait
includes Set[Name for E, NameSet for C]
         FiniteMap[Name for F, Date for T, NameToDate for M]
introduces sorts Name, Date

BirthdayBook : trait
   includes Env
   introduces
      known:  NameSet
      birthday:  NameToDate
   asserts
      ∀ n:Name  n ∈ known ⇔ defined(birthday,n)
AddBirthday = I_{Φ}Θ_{AB} with
               Φ = {n ∉ known, birthday′ = update(birthday, n, d)}

and

         Θ_{AB} = <[n : Name] × [d : Date] × BirthdayBook × BirthdayBook>_{Env}

We would expect the formula n ∉ known ⇒ n ∈ known′ to follow from Φ in R_{I} since otherwise the state invariant

                  ∀n : Name n ∈ known′ ⇔ defined(birthday′, n)

would not hold for the state after the AddBirthday operation; however, it is easy to see that the above formula is not a consequence of Φ in I. The problem is that we need, in addition to the formulas in Φ, the state invariant, which is part of the type Θ_{AB}, and the definition of defined, which is part of the FiniteMap trait included in the environment, to prove n ∉ known ⇒ n ∈ known′.

7.1 Translation of RSL_{I}-Expressions

Thus, to prove Φ ⊧^{R_{I}} Φ′, we have to prove that Φ′ holds in all models that satisfy Φ and are models of ∐ Γ. If we use the specification language SL_{I} to specify the abstract datatypes Γ(d) for d ∈ D, that is, if we provide a functor Γ′ from D to SL_{I} such that [[Γ′(d)]] = Γ(d), then we can reduce the task of proving Φ ⊧^{R_{I}} Φ′ to the task of proving that the SL_{I}-expression I_{{Φ′}}Σ_{cl} is entailed by I_{Φ}Σ_{cl} + colim Γ′ in I where Σ_{cl} is ∐ Γ; Sig^{A}.

Theorem 7.3 Let Γ be a functor from D to SL_{I} then Θ = (D, Γ; \begin{matrix}[ \\ [ & ] \\ & ] \end{matrix}) is an object of Sign_{R_{I}}. Let Φ and Φ′ be sets of Θ-formulas then

Φ ⊧^{R_{I}} Φ′ iff I_{Φ}Σ_{cl} + colim Γ ⊧^{I} I_{Φ′}Σ_{cl},

where Σ_{cl} = ∐_{D} Γ; Sig

We do not directly prove this theorem, but use a more general approach. To an RSL_{I}- expression R we associate an SL_{I}-expressions tr(R) such that G^{A}([ ; [R] ; ]_{R}) = \begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix}. For two RSL_{I}-expressions R and S this implies that R ⊧^{R_{I}} S if and only if tr(R) ⊧^{I} tr(S).

7.1 Translation of RSL_{I}-Expressions  131

Definition 7.4 Let R and S be well-formed expressions in RSL_{I} of type Θ_{R} and Θ_{S} = (D_{S}, Γ_{S}), respectively, Γ a functor from D to SL_{I}, Φ a set of (D, Γ; \begin{matrix}[ \\ [ & ] \\ & ] \end{matrix})-formulas and f : Θ_{R} → Θ_{S} an arrow in Type_{I}. Then

• tr((D, Γ)) = colim Γ

• tr(I_{Φ}R) = I_{Φ}tr(R)

• tr(T_{f}R) = T_{tr(f)}tr(R) + colim Γ_{S}

• tr(D_{f}S) = D_{tr(f)}tr(S)

• tr(R + S) = tr(R) + tr(S) and tr maps a morphism f in RSL_{I} to a morphism clim_{SL_{I}}(f) in SL_{I}.

Theorem 7.5 (Correctness of tr) Let R be an expression in RSL_{I} then

G^{A}([ ; [R] ; ]_{R}) = \begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix} .

Proof. The proof is done by induction over the structure of R.

G^{A}([ [Θ] ]_{R}) = G^{A}(([ [Θ] ] , Str_{R_{I}}([ [Θ] ])))  | Def. [ [ ] ]_{R}
= (∐ [ [Γ] ] ; Sig^{A}, \overline{Str_{R_{I}}([ [Θ] ])})

because of the definition of G^{A} and because Θ = (D, Γ),

= (∐ [ [Γ] ] ; Sig^{A}, Mod^{A}(clim_{Adt_{I}}([ [Θ] ])))

because Str_{R_{I}} is natural isomorphic to clim_{Adt_{I}}; Mod^{A}

= clim_{Adt_{I}}([ [Θ] ])

because (Sig^{A}(Sp), Mod^{A}(Sp)) is the same as Sp,

= ∐_{D} [ [Γ] ]  | Def. clim_{Adt_{I}}
= [ [colim Γ] ]  | Theorem 4.12
= [ [tr(Θ)] ]  | Def. tr,

where Θ = (D, Γ).

Impose Let [ ; [R] ; ]_{R} = (Θ_{R}, M_{R}) and Σ_{R} = ∐ Θ_{R}; Sig^{A}.

G^{A}(\begin{matrix}[ \\ [ & I_{Φ}R & ] \\ & ] \end{matrix}_{R}) = G^{A}((Θ_{R}, \{m | m ⊧^{R_{I}} Φ, m ∈ M_{R}\}))  | Def. [ [ ] ]_{R}
= (Σ_{R}, \overline{\{m | m ⊧^{R_{I}} Φ, m ∈ M_{R}\}})  | Def. G^{A}
= (Σ_{R}, \{\overline{m} | \overline{m} ⊧^{I} Φ, \overline{m} ∈ \overline{M}_{R}\})

because m ⊧^{R_{I}} Φ if and only \overline{m} ⊧^{I} Φ,

= (Σ_{R}, \{\overline{m} | \overline{m} ⊧^{I} Φ, \overline{m} ∈ Mod^{A}(G^{A}([ ; [R] ; ]_{R}))\})

because G^{A}((Θ, M_{R})) is the same as (Σ_{R}, \overline{M}_{R}),

= (Σ_{R}, \{\overline{m} | \overline{m} ⊧^{I} Φ, \overline{m} ∈ Mod^{A}(\begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix})\})

because of the induction hypotheses,

= \begin{matrix}[ \\ [ & I_{Φ}tr(R) & ] \\ ] \end{matrix}  | Def. [ [ ] ]
= \begin{matrix}[ \\ [ & tr(I_{Φ}R) & ] \\ ] \end{matrix}  | Def. tr.

Union Let [ ; [R] ; ]_{R} = (Θ, M_{R}), [ ; [S] ; ]_{R} = (Θ, M_{S}) and Σ_{cl} = ∐ Θ; Sig^{A}.

G^{A}(\begin{matrix}[ \\ [ & R + S & ] \\ & ] \end{matrix}_{R}) = G^{A}((Θ, M_{R} ∩ M_{S}))  | Def. [ [ ] ]_{R}
= (Σ_{cl}, \overline{M}_{R} ∩ \overline{M}_{S})  | Def. G^{A}
= (Σ_{cl}, Mod^{A}(G^{A}([ ; [R] ; ]_{R})) ∩ Mod^{A}(G^{A}([ ; [S] ; ]_{R})))

because G^{A}((Θ, M_{R})) = (Σ_{cl}, \overline{M}_{R}) and G^{A}((Θ, M_{S})) = (Σ_{cl}, \overline{M}_{S})

= (Σ_{cl}, Mod^{A}(\begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix}) ∩ Mod^{A}(\begin{matrix}[ \\ [ & tr(S) & ] \\ ] \end{matrix}))

because of the induction hypotheses we have G^{A}([ ; [R] ; ]_{R}) is the same as \begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix} and G^{A}([ ; [S] ; ]_{R}) is the same as \begin{matrix}[ \\ [ & tr(S) & ] \\ ] \end{matrix},

= \begin{matrix}[ \\ [ & tr(R) + tr(S) & ] \\ ] \end{matrix}  | Def. [ [ ] ]
= \begin{matrix}[ \\ [ & tr(R + S) & ] \\ ] \end{matrix}  | Def. tr.

Derive Let [ ; [R] ; ]_{R} = (Θ_{R}, M_{R}), [ ; [f] ; ] : Θ_{S} → Θ_{R}, Σ_{S} = ∐ Θ_{S}; Sig^{A} and Σ_{R} = ∐ Θ_{R}; Sig^{A}.

G^{A}(\begin{matrix}[ \\ [ & D_{f}R & ] \\ & ] \end{matrix}_{R}) = G^{A}((Θ_{S}, \{m|[ ; [f] ; ] | m ∈ M_{R}\}))  | Def. [ [ ] ]_{R}
= (Σ_{S}, \overline{\{m|_{[ ; [f] ; ]_{R}} | m ∈ M_{R}\}})  | Def. G^{A}

= (Σ_{S}, \{\overline{m}|_{clim_{_{Adt}_{I}} ([ ; [f] ; ]_{R})} | \overline{m} ∈ \overline{M}_{R}\})

because Str_{R_{I}} is natural isomorphic to clim_{Adt_{I}}; Mod^{A},

= (Σ_{S}, \{\overline{m}|_{clim_{_{Adt}_{I}} ([ ; [f] ; ]_{R})} | \overline{m} ∈ Mod^{A}(G^{A}([ ; [R] ; ]_{R}))\})

because G^{A}(R) = (Σ_{R}, \overline{M}_{R}),

= (Σ_{S}, \{\overline{m}|\begin{matrix}[ \\ [ & tr(f) & ] \\ ] \end{matrix} | \overline{m} ∈ Mod^{A}(\begin{matrix}[ \\ [ & tr(R)) & ] \\ ] \end{matrix})\})

because of the induction hypotheses,

= \begin{matrix}[ \\ [ & D_{tr(f)}tr(R) & ] \\ ] \end{matrix}  | Def. [ [ ] ]
= \begin{matrix}[ \\ [ & tr(D_{f}R) & ] \\ ] \end{matrix}  | Def. tr

Translate Let [ ; [R] ; ]_{R} = (Θ_{R}, M_{R}), [ ; [f] ; ] : Θ_{R} → Θ_{S}, Θ_{S} = (D_{S}, Γ_{S}), Σ_{R} = ∐ Θ_{R}; Sig^{A} and Σ_{S} = ∐ Θ_{S}; Sig^{A}.

G^{A}(\begin{matrix}[ \\ [ & T_{f}R & ] \\ & ] \end{matrix}_{R}) = G^{A}((Θ_{S}, \{m | m|_{[ ; [f] ; ]_{R}} ∈ M_{R}, m ∈ Str_{R_{I}}(Θ_{S})\}))

= (Σ_{S}, \overline{\{m | m|_{[ ; [f] ; ]_{R}} ∈ M_{R}, m ∈ Str_{R_{I}}(Θ_{S})\}})

= (Σ_{S}, \{\overline{m} | \overline{m}|_{clim_{_{Adt}_{I}} ([ ; [f] ; ]_{R})]} ∈ \overline{M}_{R}, \overline{m} ∈ Mod^{A}(clim_{Adt_{I}}(Θ_{S}))\})

= (Σ_{S}, \{\overline{m} | \overline{m}|\begin{matrix}[ \\ [ & tr(f) & ] \\ ] \end{matrix} ∈ Mod^{A}(G^{A}([ ; [R] ; ]_{R})), \overline{m} ∈ Mod^{A}(∐ Γ_{S})\})

= (Σ_{S}, \{\overline{m} | \overline{m}|\begin{matrix}[ \\ [ & tr(f) & ] \\ ] \end{matrix} ∈ Mod^{A}(\begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix}), \overline{m} ∈ Mod^{A}(∐ \begin{matrix}[ \\ [ & type(S) & ] \\ ] \end{matrix})\})

= (Σ_{S}, \{\overline{m} | \overline{m}|\begin{matrix}[ \\ [ & tr(f) & ] \\ ] \end{matrix} ∈ Mod^{A}(\begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix})\} ∩ Mod^{A}(\begin{matrix}[ \\ [ & colim type(S) & ] \\ ] \end{matrix}))

= (Σ_{S}, Mod^{A}(\begin{matrix}[ \\ [ & T_{tr(f)}tr(R) & ] \\ ] \end{matrix}) ∩ Mod^{A}(\begin{matrix}[ \\ [ & colim type(S) & ] \\ ] \end{matrix}))

= [ [T_{tr(f)}tr(R)) + colim type(S)] ]

= \begin{matrix}[ \\ [ & tr(T_{f}R) & ] \\ ] \end{matrix}

□

Since G^{A} preserves colimits, tr commutes with the construction of colimits, that is, the abstract datatypes denoted by tr(colim F) and colim F; tr are the same.

Theorem 7.6 Given a functor F from a finite category J to RSL_{I}, then

\begin{matrix}[ \\ [ & tr(colim F) & ] \\ ] \end{matrix} = \begin{matrix}[ \\ [ & colim F; tr & ] \\ ] \end{matrix} .

Proof.

\begin{matrix}[ \\ [ & tr(colim F) & ] \\ ] \end{matrix} = G^{A}(\begin{matrix}[ \\ [ & colim F & ] \\ & ] \end{matrix}_{R}) | Thm. 7.5
= G^{A}(∐_{J} F; [ [ ] ]_{R}) | Thm. 4.12
= ∐_{J} F; [ [ ] ]_{R}; G^{A} | Thm. 5.26
= ∐_{J} F; tr; [ [ ] ]  | Thm. 7.5
= \begin{matrix}[ \\ [ & colim F; tr & ] \\ ] \end{matrix}  | Thm. 4.12
□

Corollary 7.7 Let R and S be expressions in RSL_{I} then

R ⊧^{R_{I}} S iff tr(R) ⊧^{I} tr(S)

Proof. By Fact 5.24 we have R ⊧^{R_{I}} S if and only if G^{A}(R) ⊧^{I} G^{A}(S) and by Theorem 7.5 we get tr(R) ⊧^{I} tr(S). □

Now we can finish the proof of Theorem 7.3.

Proof of Theorem 7.3. We have

Φ ⊧^{R_{I}} Φ′ if and only if I_{Φ}Θ ⊧^{R_{I}} I′_{Φ}Θ.

By Corollary 7.7 we have I_{Φ}Θ ⊧^{R_{I}} I′_{Φ}Θ if and only if

tr(I_{Φ}Θ) ⊧^{I} tr(I′_{Φ}Θ).

Because tr(I_{Φ}Θ) = I_{Φ}colim Γ and tr(I_{Φ′}Θ) = I_{Φ′}colim Γ we are done if we can prove

I_{Φ}colim Γ ⊧^{I} I_{Φ′}colim Γ iff I_{Φ}Σ_{cl} + colim Γ ⊧^{I} I_{Φ′}Σ_{cl}.

Note that R and S are RSL_{I}-expressions and not SL_{R_{I}}-expressions. However, the semantics of RSL_{I}-expressions are defined by translating them to SL_{R_{I}}-expressions and therefore we can apply all the techniques developed in Section 4.3 to entailment of RSL_{I} expressions. Then we are done by the following derivations:

(⇒)

I_{Φ}colim Γ ⊧^{I} I_{Φ′}colim Γ
I_{Φ}Σ_{cl} + colim Γ ⊧^{I} I_{Φ′}Σ_{cl} + colim Γ

\overline{Id}

I_{Φ′}Σ_{cl} ⊧^{I} I_{Φ′}Σ_{cl}

\overline{L6’}

I_{Φ′}Σ_{cl} + colim Γ ⊧^{I} I_{Φ′}Σ_{cl}

\overline{Cut}

I_{Φ}Σ_{cl} + colim Γ ⊧^{I} I_{Φ′}Σ_{cl} (⇐)

I_{Φ}Σ_{cl} + colim Γ ⊧^{I} I_{Φ′}Σ_{cl}  \overline{Id} colim Γ ⊧^{I} colim Γ \overline{L6’} I_{Φ}Σ_{cl} + colim Γ ⊧^{I} colim Γ
\overline{R4}
I_{Φ}Σ_{cl} + colim Γ ⊧^{I} I_{Φ′}Σ_{cl} + colim Γ
I_{Φ}colim Γ ⊧^{I} I_{Φ′}colim Γ
□

The translation of AddBirthday yields:

                       tr(AddBirthday) = tr(I_{Φ}Θ_{AB})

= I_{Φ}(tr(Θ_{AB}))
= I_{Φ}(colim Γ_{AB}),

where colim Γ_{AB} is

colim Γ_{AB} : trait
includes Env
introduces
   n: Name
   d: Name
   known: NameSet
   birthday: NameToDate
   known': NameSet
   birthday': NameToDate
   asserts
   ∀ n:Name  n ∈ known ⇔ defined(birthday,n)
   ∀ n:Name  n ∈ known' ⇔ defined(birthday',n)

and

               Φ = {n ∉ known, birthday′ = update(birthday, n, d)}

To show that AddBirthday ⊧^{R_{I}} I_{{n∉known⇒n∈known′}}Θ_{AB} holds, we have to show

I_{Φ}(colim Γ_{AB}) ⊧^{I} n ∉ known ⇒ n ∈ known′,

which is implied by ∀n : Name n ∈ known′ ⇔ defined(birthday′, n), n ∉ known and defined(birthday′, n) and the definition of defined in the trait FiniteMap, included in the environment.

7.2 Refinement

Usually an abstract datatype denotes the class of possible realizations of a software system (cf. [51, 42, 52]). By making design decisions, the class of possible realizations is refined until one realization or a class of isomorphic realizations remain. Given a specification Sp, each design decision introduces a new specification Sp′, a refinement of Sp, such that Mod^{A}(Sp′) ⊆ Mod^{A}(Sp). In general, we have several refinement steps Sp_{1}, Sp_{2}, …, Sp_{n} with Mod^{A}(Sp) ⊇ Mod^{A}(Sp_{1}) ⊇ … ⊇ Mod^{A}(Sp_{n}). To prove that Sp_{i} is a refinement of Sp_{i−1}, we have to show that Sp_{i} ⊧ Sp_{i−1}. Of course, for a specification to be sensible, we require that Mod^{A}(Sp) is not empty.

A software component m is correct with respect to a specification Sp if m is a model of Sp. Let p[m] be a program that uses the software component m. Then p is correct with respect to specifications Sp′ and Sp if whenever m is a model of Sp′, then p[m] is a model of Sp.

In contrast, an abstract datatype in the institution R_{I} denotes one relation and not a class of relations. Therefore the above notion of refinement does not apply directly to objects from Adt_{R_{I}}. To apply the above notion of refinement, we use a function spec which given a relation R yields a set of relations spec(R). Then a relation S refines a relation R if spec(S) ⊆ spec(R).

In principle, the choice of the set spec(R) can be arbitrary because if p is proved correct with respect to spec(S) and spec(R), then for any relation S′ in spec(S) the result of p[S′] is in spec(R) regardless how spec is defined. For example, an extreme case is to define spec(R) as {R}.

The usual definition for spec(R) is as the set of all relations R′ such that R can be substituted by R′ in any context where R can be used. If R′ can substitute R in all contexts, we call R′ a simulation of R and write R′ ⊑ R. We get different sets spec(R) depending on the meaning of “context” and “R can be substituted by R′”. For example, compare the definition of Hehner [37], where R′ ⊑ R if R′ is a subset of R, with the definition of ⊑ below. Usually one requires ⊑ to be a partial order, that is, ⊑ is reflexive and transitive.

Note that, if spec(R) is defined as {R′ | R′ ⊑ R} where ⊑ is a partial order, then proving that S is a refinement of R, that is spec(S) is a subset of spec(R), can be simplified to proving S ⊑ R, and, similarly, it suffices to show that p[S] ⊑ R to show that a program p is correct with respect to spec(S) and spec(R).

The problem in defining ⊑ is to determine what the context where a relation can be used in is and what does it mean that R′ can substitute R in that context. In the following we use the most common approach [39, 36, 46, 40, 57], where a context is a program p which is viewed as partial, non-deterministic function from some input values I to some output values O. A program p′ implements a program p, denoted by p′ ≤ p, if p′ is defined on the same input values as p and produces correct output values, that is, if o is a possible output value of p′ for a given input value then o is also a possible output value of p for the same input value. Then R′ ⊑ R holds if for all programs p[R] that use R, R′ can be used instead of R, and p[R′] is an implementation of p[R]. Note that ≤, and therefore ⊑, are reflexive and transitive and that ⊑ ⊆ ≤ because R itself can be viewed as the program p[R] ≡ R.

In the literature, e.g. [39, 36, 46], it is shown that ⊑ is the same as ≤ for a suitable class of programming languages. Suitable means, for example, that a program p[R] can use a relation R as a component only as a partial, non-deterministic function f_{R}, that is, if R is a relation R ⊆ I × O, then f_{R} is a partial, non-deterministic function from I to O such that f_{R} is defined for all values i in the domain of R and if f_{R}(i) returns the value o, then (i, o) ∈ R. However, it is not possible for p to have access to all possible outcomes of f_{R}, that is, the set R(i) = {o | (i, o) ∈ R}.

As a counter-example consider the program

p[R] ≡ if R(1) = {1, 2} then 1 else 2.

Let R′ = {(1, 1)} and R = {(1, 1), (1, 2)}, although R′ ⊑ R, we have p[R′] ≰ p[R] since p[R′] yields the relation {(i, 2) | i ∈ I} while p[R] yields the relation {(i, 1) | i ∈ I}.

Thus, for the rest of this section we assume that relations are interpreted as partial, nondeterministic functions and that ⊑ = ≤. Then R′ ⊑ R if dom(R) ⊆ dom(R′) and R′(i) ⊆ R(i) for all i ∈ dom(R) where dom(R) is the set of all input values of R for which there exists an output value, that is, dom(R) = {i | ∃o (i, o) ∈ R}. Let S be a set, then R|_{S} denotes the restriction of the domain of R to S, that is, R|_{S} = {(i, o) | ∃o (i, o) ∈ R, i ∈ S}. Then we have R′ ⊑ R if and only if

dom(R) ⊆ dom(R′) and R′|_{dom(R)} ⊆ R.

In the framework of this thesis we are dealing with relations R = (Θ_{R}, M_{R}) of type Θ_{R} = <I_{1} × … × I_{n} × O_{1} × … × O_{n}>_{Env} where Θ_{i} = <I_{1} × … × I_{n}> is the input type of R and Θ_{o} = <O_{1} × … × O_{m}>_{Env} is the output type of R. Let f_{i} be the injection of Θ_{i} in Θ_{R} and f_{o} the injection of Θ_{o} in Θ_{R}. Then we define

dom(R) = D_{f_{i}}R.

As an example consider the Push operation on stacks. Push has the type

<[e : E] × Stack × Stack>_{E}.

The morphism f_{i} from <[e : E] × Stack>_{E} to type(Push) maps [e : E] to [e : E] and Stack to the first Stack component. Then the domain of Push is a relation of type Θ_{i} = <[e : E] × Stack>_{Env} given by

dom(Push) = D_{f_{i}}Push.

Let S be of type Θ_{i} then we define

R|_{S} = T_{f_{i}}S + R.

T_{f_{i}}S describes the relation {m ∈ Str_{R_{I}}(Θ_{R}) | m|_{f_{i}} ∈ Mod^{A}(S)}, that is, the domain of T_{f_{i}}S is S and the output values are all possible output values. Then the union of T_{f_{i}}S with R is the relation R with its domain restricted to S.

Now we can formulate R′ ⊑ R as an entailment of relations as follows:

Definition 7.8 (Simulation) Given relations R′ and R of type

Θ_{R} = <I_{1} × … × I_{n} × O_{1} × … × O_{m}>_{Env}.

R′ simulates R, denoted by R′ ⊑ R, if 1. dom(R) ⊧^{R_{I}} dom(R′)

2. R′|_{dom(R)} ⊧^{R_{I}} R

We prove that simulation is a preorder as an example of the use of the inference system of Section 4.3. Theorem 7.9 Simulation ⊑ is a preorder.

Proof. We have to show that ⊑ is reflexive and transitive. For reflexivity we have to show dom(R) ⊧^{R_{I}} dom(R) and R|_{dom(R)} ⊧^{R_{I}} R. The first condition is trivial and the second condition also if rewritten as T_{f_{i}}D_{f_{i}}R + R ⊧^{R_{I}} R. For transitivity we have to show that S′ ⊑ R if S′ ⊑ S and S ⊑ R. Thus we have to show D_{f}R ⊧^{R_{I}} D_{f}S′ and T_{f}D_{f}R+S′ ⊧^{R_{I}} R. Since S′ ⊑ S we have D_{f}S ⊧^{R_{I}} D_{f}S′ and therefore

D_{f}R ⊢ D_{f}S D_{f}S ⊢ D_{f}S′

\overline{Cut}

D_{f}R ⊢ D_{f}S′

Because S′ ⊑ S, we have T_{f}D_{f}S + S′ ⊧^{R_{I}} S′, and then we get

T_{f}D_{f}S + S′ ⊢ S ; \overline{M3’} ; T_{f}D_{f}R + T_{f}D_{f}S + S′ ⊢ T_{f}D_{f}R + S T_{f}D_{f}R + S ⊢ R

\overline{Cut}

T_{f}D_{f}R + T_{f}D_{f}S + S′ ⊢ R

and

D_{f}R ⊢ D_{f}S
\overline{L4}
T_{f}D_{f}R ⊢ T_{f}D_{f}S

Using the following derived rule (*)

\frac{Sp_{1} + Sp_{2} + Sp_{4} ⊢ Sp_{3} Sp_{1} ⊢ Sp_{2}}{Sp_{1} + Sp_{4} ⊢ Sp_{3}}

we get

T_{f}D_{f}R + T_{f}D_{f}S + S′ ⊢ R T_{f}D_{f}R ⊢ T_{f}D_{f}S
\overline{(*)}
T_{f}D_{f}R + S′ ⊢ R

The derivation for rule (*) is:

Sp_{1} ⊢ Sp_{2} \overline{M3’} Sp_{1} + Sp_{4} + Sp_{1} ⊢ Sp_{1} + Sp_{4} + Sp_{2} Sp_{1} + Sp_{2} + Sp_{4} ⊢ Sp_{3}

\overline{Cut}

Sp_{1} + Sp_{4} + Sp_{1} ⊢ Sp_{3}

Sp_{1} + Sp_{4} ⊢ Sp_{3}
□

7.3 Data-Refinement

The following section extends the notion of refinement of relations to refinement of abstract machines. Consider an abstract machine A = (St_{A}, I_{A}, A_{O}) of signature Σ = (Env, I, O, τ). Similar to the previous section, we have the problem that, to talk about the refinement of A, we have to define the class spec(A) of abstract machines for a given abstract machine A. One way to define spec(A) is to extend the definition of ⊑ to abstract machines. For an abstract machine C = (St_{C}, I_{C}, C_{O}) we have C ⊑ A if and only if St_{C} = St_{A}, I_{C} = I_{A}, and op_{C} ⊑ op_{A} for all o ∈ O. Then spec(A) = {C | C ⊑ A}.

However, this definition does not take into account the fact that the state of an abstract machine is only accessible by the operations of that abstract machine. That is, there may be abstract machines C and A for which C ⊑ A does not hold, but which cannot be distinguished by programs p, that is, p[C] ≤ p[A] holds for all programs p. As in the previous section p[A] and p[C] are programs whose semantics are non-deterministic, partial functions between input and output. The differences to the previous section are that the programs may refer to complete abstract machines instead of single relations only and that ⊑ now compares abstract machines while ≤ still compares non-deterministic, partial functions.

Therefore we can weaken the above definition and get:

Definition 7.10 (Simulation II) Let A and C be two abstract machines of signature (Env, I, O, τ), then C simulates A, denoted by C ⊑ A, if there exists a relation Sim of type <St_{A} × St_{C}>_{Env} such that I_{C} ⊧^{R_{I}} Sim(I_{A}) and for all operations op ∈ O:

1. Sim_{i}(dom(op_{A})) ⊧^{R_{I}} dom(op_{C})

2. (Sim_{i}; op_{C})|_{dom(op_{A})} ⊧^{R_{I}} op_{A}; Sim_{o}

where Sim_{i} is the extension of Sim to a relation of type

<I_{1} × … × I_{n} × St_{A} × St_{C} × I_{1} × … × I_{n}>

by the identity on the inputs. If τ(op) = <I_{1} × … × I_{n}> → <O_{1} × … × O_{m}>, then Sim_{i} is the colimit of Id_{I_{1}}, …, Id_{I_{n}}, and Sim with respect to the identity on the environment. Similarly, Sim_{o} is the colimit of Sim and Id_{O_{1}} … Id_{O_{m}}.

The second condition can be depicted by:

\xymatrix{I_{1} × … × I_{n} × dom(op_{A}) \ar[r]^{op_{A}} \ar[d]_{_{Sim_{i}}} & St_{A} × O_{1} × … × O_{m} \ar[d]^{_{Sim_{o}}} \\ I_{1} × … × I_{n} × St_{C} \ar[r]_{op_{C}} & St_{C} × O_{1} × … × O_{m}}

Note that Sim is a relation between abstract and concrete state values instead of a function from the concrete state space to the abstract state as, for example, in the seminal work of Hoare [39]. However, later work by Nipkow [46], Schoett [55], and He, Hoare and Sanders [36] have shown that A may be biased towards a particular implementation (cf. Section 6.2), that is, some states in St_{A} cannot be distinguished by the operations in A. In this case one concrete state may be related to several indistinguishable abstract states.

Note also that not every concrete state value needs to be related to an abstract state value since some of the states of St_{C} may not be reachable from the initial states and the operations of C.

In general, choosing the empty relation for Sim will not work because Sim has to relate at least the initial states of A to the initial states of C.

It was shown by He et al [36] and Nipkow [46] that simulation is sound and complete with respect to implementation, that is, C ⊑ A if and only if p[C] ≤ p[A] for all programs p provided that the programming language ensures the encapsulation principle.

7.4 An Example of Data-Refinement

As a non-trivial example of doing proofs using the methods introduced in this chapter and Chapter 4, we show that the abstract machine SI of a stack is a correct refinement of the abstract machine S introduced in Chapter 6.

The abstract machine SI uses the abstract machine C of a counter and an abstract machine A of an array to implement its operations.

Counter The abstract machine C of a counter has the following signature:

(Env, Zero, {Inc : <> → <>, Dec : <> → <>}),

The elements of the state space St_{C} of the counter have a state component c of type N. We assume that the specification Nat (cf. Section 5.1) is part of the environment Env.

St_{C} : trait
   includes Env
   introduces c : N

In the initial states Zero_{C}, c is set to the constant zero of sort N.

Zero : <St_{C}>
   includes Counter
   asserts c = zero

The increment operation is given by

Inc_{C} = I_{{succ(c)=c′}}<St_{C} × St_{C}>_{Env}.

The decrement operation decrements c only if c is not zero and is defined by

Dec_{C} = I_{{c≠zero, succ(c′)=c}}<St_{C} × St_{C}>_{Env}.

Array The abstract machine A of an array has an operation to update the array at a position i with a new value v and an operation to return the value of the array at a given position. Thus the signature of A is

(Env, Empty, { Update : <[i : N] × [v : E]> → <>,
Get : <[i : N]> → <[v : E]> }),

We assume that Env contains a sort E and that Nat is part of Env. The state St_{A} of A is similar to the state of the dictionary defined in Section 6.1. St_{A} has two functions map and dom as components. If dom(i) is true, map(i) yields the value of the array at position i. In the empty array, the function dom always yields false.

St_{A} : trait
   includes Env
   introduces
      map : N → E
      dom : N → Bool

                                                     Empty_{A} : trait
                                                        includes St_{A}
                                                        asserts ∀ n : N ¬ dom(n)

The update operation changes the function map such that map(i) = v is true and for all other j ≠ i map(i) remains the same.

Update_{A} : <[i:N] × [v:E] × St_{A} × St_{A}>
asserts
   ∀ n: N  map'(n) = if n = i then v else map(n)
   ∀ n: N  dom'(n) ⇔ n = i ∨ dom(n)

The get operation returns the value v for an index value i

Get_{A} : <[i:N] × St_{A} × St_{A} × [v:E]>
asserts
   dom(i)
   ∀ n:N  map'(n) = map(n)
   ∀ n:N  dom'(n) = dom(n)
   v = map(i)

Stack Implementation In Chapter 6 we have given the definition of an abstract machine of a stack S. Here we define another abstract machine for a stack SI, based on the abstract machine C of a counter and A of an array.

The state space of SI is the pushout of the state spaces for the counter and the array with respect to the environment Env and inclusions ι_{1} : Env → St_{C} and ι_{2} : Env → St_{A} such that all values smaller than the value of the counter have a value associated by the array.

St_{SI} = I_{{∀n : N n < c ⇒ dom(n)}}(St_{C} +_{(ι_{1},ι_{2})} St_{A}).

For simplicity we assume that the environment of C and A and are the same. If this is not the case, one can always use the translate operation to adapt the environments.

The initial states Empty_{SI} of the stack are basicly given by the pushout of the initial states of the counter and the array with respect to the inclusions e_{1} : <Env>_{Env} → St_{C} and e_{2} : <Env>_{Env} → St_{A}. However, the result type of Zero_{C} +_{(e_{1},e_{2})} Empty_{A} is <St_{C} +_{(ι_{1},ι_{2})} St_{A}>_{Env}, which does not include that state-invariant {∀n : N n < c ⇒ dom(n)}. Thus we have to translate the pushout of Zero_{C} with Empty_{A} by σ_{e}, the inclusion of <St_{C} +_{(ι_{1},ι_{2})} St_{A}>_{Env} into <St_{SI}>_{Env}, yielding

Empty_{SI} = T_{σ_{e}}(Zero_{C} +_{(e_{1},e_{2})} Empty_{A}).

Similarly, the push operation can be given as the pushout of the increment operation on counters and the update operation on arrays:

Push_{SI} = T_{σ_{ps}}(Inc_{C} +_{(ps_{1},ps_{2})} Update_{A}).

The parameter [i : N] of the update operation is given by the pre-state of the increment operation. Thus the Type_{I}-morphism ps_{1} has domain <[i : N] × Env × Env>_{Env} and codomain <St_{C} × St_{C}>, mapping [i : N] and the first Env to the first St_{C}. The morphism ps_{2} has the same domain as ps_{1} and codomain <[i : N] × [e : E] × St_{A} × St_{A}>, mapping [i : N] to [i : N], the first Env to the first St_{A} and the second Env to the second St_{A}. Thus we get the following pushout diagram:

\xymatrix{ & <[e : E] × St_{C} +_{(ι_{1},ι_{2})} St_{A} × St_{C} +_{(ι_{1},ι_{2})} St_{A}>_{Env} \\ _{<St_{C} × St_{C}>_{Env}} \ar@{-->}[ur]^{_{ps_{′}_{2}}} &  & _{<[i : N] × [e : E] × St_{A} × St_{A}>_{Env}} \ar@{-->}[ul]_{_{ps_{′}_{1}}} \\  & _{<[i : N] × Env × Env>_{Env}} \ar@{-->}[ul]^{_{ps_{1}}} \ar[ur]_{_{ps_{2}}}}

Note that ps_{1} maps [i : N] and the first Env to the same St_{C} implies that the co-cone morphism ps′_{1} identifies the argument [i : N] of the update operation with the c : N component of the counter. This means that the first input to the update operation is provided by the pre-state of increment operation.

As with Empty_{SI}, we have to add the state-invariant to the pre- and post-states of the push operation by translating Inc_{C} +_{(ps_{1},ps_{2})} Update_{A} by σ_{ps}, where σ_{ps} is the inclusion of <[e : E] × St_{C} +_{(ι_{1},ι_{2})} St_{A} × St_{C} +_{(ι_{1},ι_{2})} St_{A}>_{Env} into <[e : E] × St_{SI} × St_{SI}>_{Env}.

The normal-form of the push operation is

Push_{SI} : <[v:E] × St_{SI} × St_{SI}>
asserts
   c' = succ(c)
   ∀ n:N  map'(n) = (if n = i then v else map(n))
   ∀ n:N  dom'(n) ⇔ n = i ∨ dom(n)

The pop operation removes the top element from the stack and returns it in v. The pop operation is defined using the pushout of the decrement and the get operations. This time the c : N component of the post-state of the counter is identified with the i : N argument of the get operation:

Pop_{SI} = T_{σ_{po}}(Dec_{C} +_{(po_{1},po_{2})} Get_{A}).

The morphisms po_{1} and po_{2} form the following pushout diagram:

\xymatrix{ & <St_{C} +_{(ι_{1},ι_{2})} St_{A} × St_{C} +_{(ι_{1},ι_{2})} St_{A} × [v : E]>_{Env} \\ _{<St_{C} × St_{C}>_{Env}} \ar@{-->}[ur]^{_{po_{′}_{2}}} &  & _{<[i : N] × St_{A} × St_{A} × [e : E]>_{Env}} \ar@{-->}[ul]_{_{po_{′}_{1}}} \\  & _{<[i : N] × Env × Env>_{Env}} \ar@{-->}[ul]^{_{po_{1}}} \ar[ur]_{_{po_{2}}}}

po_{1} maps [i : N] and the second Env to the second St_{C} and po_{2} maps [i : N] to [i : N] and the first Env to the first St_{A} and the second Env to the second St_{A}.

σ_{po} is again the inclusion of

<St_{C} +_{(ι_{1},ι_{2})} St_{A} × St_{C} +_{(ι_{1},ι_{2})} St_{A} × [v : E]>_{Env}

into

<St_{SI} × St_{SI} × [e : E]>_{Env}.

The normal-form of Pop_{SI} is

Pop_{SI} : <St_{SI} × St_{SI} × [v:E]>
asserts
   c ≠ zero
   succ(c') = c
   dom(c')
   ∀ n:N  map'(n) = map(n)
   ∀ n:N  dom'(n) = dom(n)
   v = map(c')

Proof of Refinement

To show that SI is a refinement of S, we have to provide a simulation Sim of type <St_{S} × St_{SI}>_{Env}. The relation Sim is defined with the help of a function α : N → Stack, where α(n) is the stack consisting of the first n − 1 entries of map. Then the relation between St_{S} and St_{SI} is established by the equation s = α(c).

Formally Sim is defined as D_{a}(Alpha + Sim′) where Alpha defines the function α and Sim′ relates c to s:

Alpha : Θ_{Alpha}
asserts
   α(zero) = empty
   ∀ n:Nat  succ(n) ≤ c ⇒ α(succ(n)) = push(map(n),α(n))
Sim' : Θ_{Alpha}
asserts
   s = α(c)

The type Θ_{Alpha} is

                   Θ_{Alpha} = \xymatrix{ & [α : N → Stack] \\ _{St_{SI}} \ar[ur] &  & _{St_{S}} \ar[ul] \\  & Env \ar[ul] \ar[ur]}

with a being the inclusion of <St_{S} × St_{SI}>_{Env} into Θ.

To facilitate the following refinement proofs we use the following lemma:

Lemma 7.11

                        <St_{S} × St_{SI}>_{Env} ⊧^{R_{I}} D_{a}Alpha

Proof. We have to show that each <St_{S} × St_{SI}>_{Env}-structure (m_{1}, m_{2}) can be extended to an element m of Str_{R_{I}}(Θ) such that m|_{a} = (m_{1}, m_{2}) and m ⊧^{R_{I}} Alpha. What we have to do is to define the appropriate function m(α) : m_{1}(N) → m_{1}(N). Note that because (m_{1}, m_{2}) ∈ Str_{R_{I}}(<St_{S} × St_{SI}>_{Env}) and N is a sort in Env we have m_{1}(N) = m_{2}(N). Provided that Env restricts the interpretations of the sort N to be isomorphic to the natural numbers, the equations used in Alpha can be viewed as a functional program defining m(α) for each pair (m_{1}, m_{2}) in Str_{R_{I}}(<St_{S} × St_{SI}>_{Env}). □

Initial States

For the initial states of S and SI we have to show

                           Empty_{SI} ⊢^{R_{I}} Sim(Empty_{S})

This means that given a model m of Empty_{SI}, we have to find a pair (m_{1}, m_{2}) such that m_{1} = m, m_{2} is model of Empty_{S} and (m_{1}, m_{2}) is a model of Sim.

However, we prove a stronger result:

1. for each model m of Empty_{SI} there exists a pair (m_{1}, m_{2}) such that m_{1} = m and m_{2} is a model of Empty_{S} and

2. for all models m of Empty_{SI} and models m_{2} of Empty_{S}, the pair (m, m_{2}) is a model of

     Sim.

The first condition is formally written as

Empty_{SI} ⊢^{R_{I}} D_{f}T_{f′}Empty_{S},

where f is the inclusion of <St_{SI}> into <St_{S} × St_{SI}> and f′ is the inclusion of <St_{S}> into <St_{S} × St_{SI}>. The second condition is

                        T_{f}Empty_{SI} + T_{f′}Empty_{S} ⊢^{R_{I}} Sim.

This decomposition is an instance of Rule R3 because the original proof obligation can be rewritten as

Empty_{SI} ⊢^{R_{I}} D_{f}(Sim + T_{f′}Empty_{S}),

using the definition of instantiation.

To show that Empty_{SI} ⊢^{R_{I}} D_{f}T_{f′}Empty_{S}, we observe that f and f′ are the co-cone morphisms of the following pushout:

\xymatrix{ & _{<St_{S} × St_{SI}>_{Env}} \\ <_{St_{S}}>_{Env} \ar@{-->}[ur]^{f′} & & <_{St_{SI}}>_{Env} \ar@{-->}[ul]_{f} \\ & _{<>_{Env}} \ar[ul]^{g} \ar[ur]_{g′}} ,

where <>_{Env} denotes the type (1, Θ_{Env} : 1 → SL_{I}) with Θ_{Env}(1) = Env. Using the equalities of Fact 4.9 we can rewrite our proof obligation as Empty_{SI} ⊢^{R_{I}} T_{g′}D_{g}Empty_{S} and using Rule R5 we have to show

D_{g′}Empty_{SI} ⊢^{R_{I}} D_{g}Empty_{S}.

This means that given a model m of Empty_{SI}, we have to show that m|_{g′}, call it m_{Env}, can be extended to some model m′ of Empty_{S} such that m′|_{g′} = m_{Env}. We are done, if we can show that any model m_{Env} of Env can be extended to a model m′ of Empty_{S} such that m′|_{g} = m_{Env}, that is, if we can show

                             <>_{Env} ⊢^{R_{I}} D_{g}Empty_{S}

because we have D_{g′}Empty_{SI} ⊢^{R_{I}} <>_{Env} by Rule R1. By the definition of Empty_{S} we thus have to show:

<>_{Env} ⊢^{R_{I}} D_{g}I_{{s=empty}}St_{S}.

Let m_{Env} be a model of <>_{Env} then define m′ by m′|_{g} = m_{Env} and m′(s) = m′(empty) = m_{Env}(empty). Then m′ satisfies s = empty and thus m′ is a model of Empty_{S}. Therefore we have <>_{Env} ⊧^{R_{I}} D_{g}I_{{s=empty}}St_{S}. Since we have trivially completed our inference system (cf. Section 4.5) we get <>_{Env} ⊢^{R_{I}} D_{g}I_{{s=empty}}St_{S}.

In the next step we have to show that T_{f}Empty_{SI} + T_{f′}Empty_{S} ⊢^{R_{I}} Sim holds. Given the definition of Sim as D_{a}(Alpha + Sim′), we can use again Rule R3 to decompose our proof obligation into

1. T_{f}Empty_{SI} + T_{f′}Empty_{S} ⊢^{R_{I}} D_{a}Alpha and

2. T_{a}(T_{f}Empty_{SI} + T_{f′}Empty_{S}) + Alpha ⊢^{R_{I}} Sim′.

1. is a consequence of Lemma 7.11 and for 2. we note that

• T_{f}Empty_{SI} + T_{f′}Empty_{S} ⊢^{R_{I}} I_{{s=empty}}Θ,

• T_{f}Empty_{SI} + T_{f′}Empty_{S} ⊢^{R_{I}} I_{{c=zero}}Θ and

• T_{f}Empty_{SI} + T_{f′}Empty_{S} ⊢^{R_{I}} I_{{α(zero)=empty}}Θ

because the formula s = empty is included in the definition of Empty_{SI}, the formula c = zero is included in the definition of Zero_{C} and α(zero) = empty is part of the definition of Alpha. Since Sim′ = I_{{s=α(c)}}Θ_{Alpha} and using Rule L8, we are done if we can show that

{s = empty, c = zero, α(zero) = empty} ⊢^{R_{I}} {s = α(c)}.

Using Theorem 7.1 it suffices if we can show

{s = empty, c = zero, α(zero) = empty} ⊧^{LSL} {s = α(c)},

which is easy to see.

Operations

Next we have to show for the operations Push and Pop:

Sim_{i}(dom(Push_{S})) ⊢^{R_{I}} dom(Push_{SI})
(Sim_{i}; Push_{SI})|_{dom(Push_{S})} ⊢^{R_{I}} Push_{S}; Sim_{o}

and

Sim_{i}(dom(Pop_{S})) ⊢^{R_{I}} dom(Pop_{SI})
(Sim_{i}; Pop_{SI})|_{dom(Pop_{S})} ⊢^{R_{I}} Pop_{S}; Sim_{o}

As an example, we give the proof for Pop.

Entailment of Preconditions

Step 1 First we have to prove

Sim_{i}(dom(Pop_{S})) ⊢^{R_{I}} dom(Pop_{SI}).

By applying the definition of dom this is the same as

Sim_{i}(dom(Pop_{S})) ⊢^{R_{I}} D_{po_{i}}Pop_{SI},

where po_{i} maps <St_{SI}> to the first component of <St_{SI} × St_{SI} × [v : E]>. That is, for each model m of Sp = Sim_{i}(dom(Pop_{S})) we have to show that there exists a triple of structures (m_{1}, m_{2}, m_{3}), such that m_{1} = m and (m_{1}, m_{2}, m_{3}) is a model of Pop_{S}. To this end we define a relation Sp_{1} such that each <St_{SI}>_{Env}-structure m can be extended to a model (m, m_{2}, m_{3}) of Sp_{1}, that is, we prove

<St_{SI}> ⊢^{R_{I}} D_{po_{i}}Sp_{1},

and show that each model of T_{po_{i}}Sp + Sp_{1} is also a model of Pop_{S}, that is,

T_{po_{i}}Sp + Sp_{1} ⊢^{R_{I}} Pop_{SI}.

This procedure is justified by Rule R3, if we let Sp′′ in Rule R3 be T_{po_{i}}Sp + Sp_{1}. Then Sp ⊢^{R_{I}} D_{po_{i}}(T_{po_{i}}Sp + Sp_{1}) is implied by <St_{SI}> ⊢^{R_{I}} D_{po_{1}}Sp_{1} using monotonicity of union and the equalities of Fact 4.9. Sp_{1} is given by

Sp_{1} : <St_{SI} × St_{SI} × [v:E]>
asserts
   c' = pred(c)
   v = map(c)
   ∀ n : N  map'(n) = map(n)
   ∀ n : N  dom'(n) ⇔ dom(n)

Now let m be a <St_{SI}> then we define a <St_{SI}>-structure m_{2} by • m_{2}|_{Env} = m|_{Env}.

• m_{2}(map) = m(map),

• m_{2}(dom) = m(dom),

• m_{2}(c) = m(pred)(m(c)) and and a <[v : E]>-structure m_{3} by

• m_{3}|_{Env} = m|_{Env} and

• m_{3}(v) = m(map)(m(c)), It is obvious that (m, m_{2}, m_{3}) is a model of Sp_{1} and thus we have

<St_{SI}> ⊧^{R_{I}} D_{po_{i}}Sp_{1},

which implies

<St_{SI}> ⊢^{R_{I}} D_{po_{i}}Sp_{1}.

Step 2 In the second step we have to prove

T_{po_{i}}Sp + Sp_{1} ⊢^{R_{I}} Pop_{SI}.

Bringing Pop_{SI} into its normal-form we get I_{Φ_{1}}<St_{SI} × St_{SI} × [v : E]>, where Φ_{1} is the set

{  dom(c)
   c ≠ zero
   succ(c') = c
   ∀ n:N  map'(n) = map(n)
   ∀ n:N  dom'(n) = dom(n)
   v = map(c) }

The normal-form of T_{po_{i}}Sp + Sp_{1} is D_{σ}I_{Φ_{2}}Θ′, where Φ_{2} is the set

{ α(zero) = empty
   n ≤ c ⇒ α(succ(n)) = push(map(n), α(n))
   s = α(c)
   s ≠ empty
   s' = pop(s)
   v' = top(s)
   c' = pred(c)
   ∀ n:N  map'(n) = map(n)
   ∀ n:N  dom'(n) = dom(n)
   v = map(c) }

and σ is the inclusion of <St_{SI} × St_{SI} × [v : E]> into Θ′, with Θ′ being the type:

\xymatrix{ & [α : N → Stack] \\ _{St_{S}} \ar[ur] & _{St_{S}} & _{St_{SI}} \ar[ul] & _{St_{SI}} & [v : E] \\  &  & Env \ar[ull] \ar[ul] \ar[u] \ar[ur] \ar[urr]}

Note that we have two components v and v′; v′ denotes the result of the operation Pop_{S} of the abstract stack, which is hidden by the dom operation and thus is distinct from the result v of the operation Pop_{SI} of the stack implementation.

Now we have to prove:

D_{σ}I_{Φ_{1}}Θ′ ⊢^{R_{I}} I_{Φ_{2}}<St_{SI} × St_{SI} × [v : E]>,

which is, by Rule L5, equivalent to

I_{Φ_{1}}Θ′ ⊢^{R_{I}} I_{σ(Φ_{2})}Θ′.

Because of Rule L7 we have nothing to do for formulas in Φ_{2} that also occur in Φ_{1}. The only formulas in Φ_{2} not already in Φ_{1} are dom(c), c ≠ zero and succ(c′) = c.

Thus it remains to show that dom(c), c ≠ zero and succ(c′) = c are consequences of Φ_{1} in the institution R_{LSL}. However, to prove this, we cannot apply Theorem 7.1 and simply prove

Φ_{1} ⊧^{I} {dom(c), c ≠ zero, succ(c′) = c},

as we did in the proof for Empty_{SI} ⊢^{R_{I}} Empty_{S}; Sim given in the previous section. The reason is that we need the state invariant ∀n : N n ≤ c ⇒ dom(n) given in St_{SI} and the definition of predecessor, given in the environment Env. Thus we have to apply Theorem 7.3 and prove

I_{Φ_{1}}Σ + colim Θ′ ⊧^{I} I_{{dom(c), c≠zero, succ(c′)=c}}Σ,

where Σ is the signature of SL_{LSL}-expression colim Θ′. Then dom(c) is a consequence of ∀n : N n ≤ c ⇒ dom(n), c ≠ zero is a consequence of α(zero) = Empty, s ≠ Empty and α(c) = s, and succ(c′) = c is a consequence of ∀n : N n ≠ zero ⇒ succ(pred(n)) = n and c′ = pred(c).

Entailment of Postconditions We have to show:

(Sim_{i}; Pop_{SI})|_{dom(Pop_{S})} ⊢^{R_{I}} Pop_{S}; Sim_{o}

Let Sp = Sim_{i}; Pop_{SI}. Using the definition of sequential composition, we have to show:

Sp|_{dom(Pop_{S})} ⊢^{R_{I}} D_{f_{3}}(Pop_{S} +_{(f_{1},f_{2})} Sim_{o}),

where f_{1} and f_{2} are Type_{I}-morphisms from <St_{S} × [v : E]> to the type of Pop_{S} and the type of Sim_{o}, respectively, and f_{3} is the inclusion of

<St_{S} × St_{SI} × [v : E]>_{Env}

into the pushout of the type of Pop_{S} and the type of Sim_{o} with respect to f_{1} and f_{2}, which is Θ = <St_{S} × St_{S} × [v : E] × St_{SI} × [v : E]>_{Env}.

\xymatrix{ & Θ \\ type(Pop_{S}) \ar@{-->}[ur]^{f′_{2}} &  & type(Sim_{o}) \ar[ul]_{f′_{1}} \\  & _{<St_{S} × [v : E]>_{Env}} \ar[ul]^{f_{1}} \ar@{-->}[ur]_{f_{2}}}

We can apply Rule R3 if we can show

1. Sp|_{dom(Pop_{S})} ⊢^{R_{I}} D_{f_{3}}T_{f′_{2}}Pop_{S} and

2. T_{f_{3}}(Sp|_{dom(Pop_{S})}) + T_{f′_{2}}Pop_{S} ⊢^{R_{I}} T_{f′_{1}}Sim_{o}.

Step 1 First we show:

Sp|_{dom(Pop_{SI})} ⊢^{R_{I}} D_{f_{3}}T_{f′_{2}}Pop_{S}

That is, given a model (m_{1}, m_{2}, m_{3}) of Sp|_{dom(Pop_{S})}, we have to find structures m′_{2} and m′_{3}, such that (m_{1}, m′_{2}, m′_{3}) is a model of Pop_{S}. Since we have restricted the domain of Sp|_{dom(Pop_{S})} to dom(Pop_{S}), we know that if (m_{1}, m_{2}, m_{3}) is a model of Sp|_{dom(Pop_{S})} then m_{1} is in dom(Pop_{S}) and thus there exists models m′_{2} and m′_{3} such that (m_{1}, m′_{2}, m′_{3}) is a model of Pop_{S}.

We prove this formally by observing that R|_{S} ⊢^{R_{I}} T_{f}S because R|_{S} is defined as R + T_{f}S. Thus we have

Sp|_{dom(Pop_{S})} ⊢^{R_{I}} T_{f}(dom(Pop_{S})),

where f maps St_{S} in <St_{S}>_{Env} to the first component of <St_{S} × St_{SI} × [v : E]>_{Env}. Using the definition of dom we get

Sp|_{dom(Pop_{S})} ⊢^{R_{I}} T_{f}D_{g}Pop_{S},

where g maps St_{S} of <St_{S}>_{Env} to the first component of <St_{S} × St_{S} × [v : E]>_{Env}.

Note that f_{3} and f′_{2} are the co-cone morphisms of the pushout of <St_{S} × St_{S} × [v : E]>_{Env} with <St_{S} × St_{SI} × [v : E]>_{Env} with respect to the morphisms f and g.

\xymatrix{ & Θ \\ type(Pop_{S}) \ar[ur]^{f′_{2}} &  & type(Pop_{S}; Sim_{o}) \ar[ul]_{f_{3}} \\  & <_{St_{S}}>_{Env} \ar[ul]^{g} \ar[ur]_{f}}

Using the equalities of Fact 4.9 we have T_{f}D_{g}Pop_{S} = D_{f_{3}}T_{f′_{2}}Pop_{S} and thus we get

Sp|_{dom(Pop_{S})} ⊢^{R_{I}} D_{f_{3}}T_{f′_{2}}Pop_{S}.

Step 2 Thus it remains to show

T_{f_{3}}(Sp|_{dom(Pop_{S})}) + T_{f′_{2}}Pop_{S} ⊢^{R_{I}} T_{f′_{1}}Sim_{o}.

Because Sp|_{dom(Pop_{S})} ⊢^{R_{I}} Sp we get

T_{f_{3}}(Sp|_{dom(Pop_{S})}) + T_{f′_{2}}Pop_{S} ⊢^{R_{I}} T_{f_{3}}Sp + T_{f′_{2}}Pop_{S}

by monotonicity of translate and union. By the Cut rule, we are done, if we can prove

T_{f_{3}}Sp + T_{f′_{2}}Pop_{S} ⊢^{R_{I}} T_{f′_{1}}Sim_{o}.

Sim_{o} is defined as D_{a}(Alpha + Sim′) +_{(ι_{1},ι_{2})} Id_{<[v:E]>}, where ι_{1} is the inclusion of <>_{Env} into the type of Sim, ι_{2} the inclusion of <>_{Env} into the type of Id_{[v:E]} and Id_{[v:E]} is defined as I_{{v=v′}}<[v : E] × [v : E]>_{Env}. Using the equalities of Fact 4.9 we get that

T_{f′_{1}}(D_{a}(Alpha + Sim′) +_{(ι_{1},ι_{2})} Id_{[v:E]}),

denotes the same relation as

D_{a′}(T_{h_{1}}Alpha + T_{h_{1}}Sim′ + T_{h_{2}}Id_{[v:E]}),

where a′ is the inclusion of Θ into Θ′, which is

\xymatrix{ &  & [α : N → Stack] \\ _{St_{S}} & _{St_{S}} \ar[ur] & [v : E] & _{St_{SI}} \ar[ul] & [v : E] \\  &  & Env \ar[ull] \ar[ul] \ar[u] \ar[ur] \ar[urr]}

h_{1} is the inclusion of Θ_{Alpha} into Θ′ and h_{2} is the inclusion of <[v : E] × [v : E]> into Θ′. To apply Rule R3 we have to show

1. T_{f_{3}}Sp + T_{f′_{2}}Pop_{S} ⊢^{R_{I}} D_{a′}T_{h_{1}}Alpha and

2. T_{a′}(T_{f_{3}}Sp + T_{f′_{2}}Pop_{S}) + T_{h_{1}}Alpha ⊢^{R_{I}} T_{h_{1}}Sim′ + T_{h_{2}}Id_{[v:E]}.

Step 3 We have <St_{S} × St_{SI}>_{Env} ⊢^{R_{I}} D_{a}Alpha (cf. Lemma 7.11) and h_{1} and a′ are the co-cone morphisms of the pushout of a and f′_{1}. Thus we get

T_{f′_{1}}<St_{S} × St_{SI}>_{Env} = Θ ⊢^{R_{I}} T_{f′_{1}}D_{a}Alpha = D_{a′}T_{h_{1}}Alpha

Since we have T_{f_{3}}Sp + T_{f′_{2}}Pop_{S} ⊧ Θ, we get T_{f_{3}}Sp + T_{f′_{2}}Pop_{S} ⊢^{R_{I}} D_{a′}T_{h_{1}}Alpha.

Step 4 In the next step we show T_{a′}(T_{f_{3}}Sp + T_{f′_{2}}Pop_{S}) + T_{h_{1}}Alpha ⊢^{R_{I}} T_{h_{1}}Sim′ + T_{h_{2}}Id_{<[v:E]>_{Env}}.

Using the equalities

Sim′ = I_{{s=α(c)}}<St_{S} × St_{SI}>_{Env}

and

Id_{<v:E>_{Env}} = I_{{v′=v}}<[v : E] × [v : E]>_{Env},

and using the equalities of Fact 4.9 to form the normal-form of the left and right hand side, we have to show:

D_{σ}I_{Φ}Θ′′′ ⊢^{R_{I}} I_{{s′=α(c′), v′=v}}Θ′.

Note that s and c are renamed to s′ and c′ by the SL_{I}-morphism

clim_{SL_{I}}(h_{1}) : clim_{SL_{I}}(type(Pop_{S})) → clim_{SL_{I}}(Θ′)

because s is from the post-state of the operation Pop_{S} and c is from the post-state of the operation Pop_{SI}.

Θ′′′ is the type

\xymatrix{[α : N → Stack] &  &  & [α : N → Stack] \\ _{St_{S}} \ar[u] & _{St_{SI}} \ar[ul] & _{St_{S}} \ar[ur] & [v : E] & _{St_{SI}} \ar[ul] & [v : E] \\  &  & Env \ar[ull] \ar[ul] \ar[u] \ar[ur] \ar[urr] \ar@{-->}[urrr]}

and σ the inclusion of Θ′ into Θ′′′.

Let s correspond to the first occurrence of St_{S}; map, dom and c to the first occurrence of St_{SI}; α_{1} to the first occurrence of [α : N → Stack]; α_{2} to the second occurrence of [α : N → Stack]; s′ to the second occurrence of St_{S} and map′, dom′ and c′ to the second occurrence of St_{SI}. Then the set Φ is given by the following list of formulas:

% Alpha: Def α_{1}
α_{1}(zero) = empty
∀ n:Nat  n < c ⇒ α_{1}(succ(n)) = push(map(n),α_{1}(n))
% Sim
s = α_{1}(c)
% PopSI = Get + Dec
dom(c)
c ≠ zero
succ(c') = c
∀ n:Nat  dom'(n) = dom(n)
∀ n:Nat  map'(n) = map(n)
v' = map(c')
% PopS
s ≠ empty
s' = pop(s)

v = top(s)
% Alpha: Def α_{2}
α_{2}(zero) = empty
∀ n:Nat  n < c' ⇒ α_{2}(succ(n)) = push(map'(n),α_{2}(n))

To prove D_{σ}I_{Φ}Θ′′′ ⊢^{R_{I}} I_{{s′=α(c′), v′=v}}Θ′, we can use Rule L5 and show

I_{Φ}Θ′′′ ⊢^{R_{I}} I_{{s′=α_{2}(c′), v′=v}}Θ′′′.

Step 5 Note that we cannot prove Φ ⊧^{I} {v′ = v, s′ = α_{2}(c′)} because we need properties of natural numbers and stacks for the proof, which are not present in Φ. Therefore we cannot use Theorem 7.1 to prove Φ ⊢^{R_{I}} {v′ = v, s′ = α_{2}(c′)}, instead we have to use Theorem 7.7 and show

I_{Φ}Σ_{cl} + colim Θ′′′ ⊧^{I} I_{{v′=v, s′=α_{2}(c′)}}Σ_{cl},

where Σ_{cl} is the signature of the colimit of Θ′′′.

Now we have v′ = map(c′) and v = top(s) and s = α_{1}(c) and succ(c′) = c thus v = top(α_{1}(c)). Since we have c ≤ c because ∀n : N n ≤ n is derivable from colim Θ′′′, we get v = top(push(map(c′), α_{1}(c′))) which yields v = map(c′) because

∀e : E, s : Stack top(push(e, s)) = e

is derivable from colim Θ′′′.

To prove s′ = α_{2}(c′) we need the lemma

∀n : N n ≤ c′ ⇒ α_{1}(n) = α_{2}(n),

which can be shown by induction on n as follows:

• n = zero: We have α_{1}(zero) = empty = α_{2}(zero).

• n = succ(n′): Assume that succ(n′) ≤ c′ then

α_{1}(n) = push(map(n), α_{1}(n′)).

Since n′ ≤ succ(n′) ≤ c′ we can apply the induction hypotheses and with n ≤ c we get α_{1}(n) = push(map(n′), α_{2}(n′)) and because ∀m : N map′(m) = map(m), we get α_{1}(n) = push(map′(n′), α_{2}(n′)), which is α_{2}(n), by the definition of α_{2}.

Note that the justification to use induction over n : N comes from the constraint that N is generated by zero and succ, derivable from colim Θ′′′.

Now we have

s′ = pop(s)  | s = pop(s) ∈ Φ
= pop(α_{1}(c))  | s = α_{1}(c) ∈ Φ
= pop(α_{1}(succ(c′))  | succ(c′) = c ∈ Φ
= pop(push(map(c′), α_{1}(c′))) | c ≤ c
= α_{1}(c′)  | c′ ≤ c′
= α_{2}(c′)

7.5 Conclusion

The proof that the abstract machine of a stack SI is an implementation of S is surprisingly quite complex.

One of the reasons is that we have to make explicit the relationship between the type of the relations by using Type_{I}-morphisms. This is due to the fact that we assumed that everything which is not related by morphisms is different even if the components have the same name. This requires to make explicit even simple inclusions of one type into another and to adapt the type of relations by using the translate operation.

In practice though it should be possible to hide a lot of these morphisms and the corresponding translate operations from the user.

Another reason for the complexity of the proofs is the use of the derive operation in the definition of the relations that occur on the right hand side of a turnstile. For example, expanding the right hand side of

(Sim_{i}; Pop_{SI})|_{dom(Pop_{S})} ⊢^{R_{I}} Pop_{S}; Sim_{o}

yields

D_{f_{3}}(T_{f′_{2}}Pop_{S} + D_{a′}(T_{h_{1}}Alpha + T_{h_{1}}Sim′ + T_{h_{2}}Id_{[v:E]})),

which contains two derive operations. To get rid of the derive operations we have to use two times the Rule R3, which introduces two proof obligations involving again derive: … ⊢^{R_{I}} D_{f_{3}}T_{f′_{2}}Pop_{S} and … ⊢^{R_{I}} D_{a′}T_{h_{1}}Alpha.

On some occasions, it helps to view the derive operation as an existential quantifier, and then use the base institution to deal with that quantifier. For example, let

Pop_{S} = I_{{s′=pop(s), v=top(s)}}Θ_{Pop_{S}}

where Θ_{Pop_{S}} = (D_{Pop_{S}}, Γ_{Pop_{S}}). D_{f_{3}}T_{f′_{2}}Pop_{S} corresponds to

I_{{∃s′:Stack,v:E s′=pop(s)∧v=top(s)}}Θ_{Pop_{S}}.

Then for any RSL_{I}-expression R we have R ⊧^{R_{I}} D_{f_{3}}T_{f′_{2}}Pop_{S} if and only if

R ⊧^{R_{I}} I_{{∃s′:Stack,v:E s′=pop(s)∧v=top(s)}}Θ_{Pop_{S}},

and because of Theorem 7.5 if and only if

tr(R) ⊧^{I} I_{{∃s′:Stack,v:E s′=pop(s)∧v=top(s)}}colim Γ_{Pop_{S}}.

Now we can use a theorem prover for the institution I to proof this entailment and thus deal with the derive operation.

However, this correspondence does not hold for all logics, for example, the above formula is not admissible in LSL. Also D_{a′}T_{h_{1}}Alpha requires a second order existential quantifier as it states the existence of an operation α : N → Stack.

8 Disjunction

A useful operation to define new relations is the disjunction of relations. Disjunction allows to define separate relations for each subset of input values and then define a relation on all input values by the disjunction of the component relations. For example in Spivey [57], the AddBirthday operation (cf. Section 6.2) is extended to yield an error message if n is already

in known.

Let us recall the definition of the state space of the birthday book

BirthdayBook_{BC} : trait
   includes Env
   introduces
      known: NameSet
      birthday: NameToDate
   asserts
      ∀ n:Name  n ∈ known ⇔ defined(birthday,n)

and the definition of the AddBirthday operation

AddBirthday_{BC}: Θ_{AB}
   not(n ∈ known)
   birthday' = update(birthday,n,d)

where the type Θ_{AB} is:

            <[n : Name] × [d : Date] × BirthdayBook × BirthdayBook>_{Env}

We define a new operation Success_{BC} of type:

                         Θ_{R} = <[result : Report]>_{Env}

Success_{BC} : Θ_{R}
   result = ok

We assume that Env contains a sort Report which is freely generated by constants ok and alreadyKnown. Given the type Θ_{RAB} as

    <[n : Name] × [d : Date] × BirthdayBook × BirthdayBook × [result : Report]>_{Env}

with inclusions f of Θ_{AB} into Θ_{RAB} and g of Θ_{R} into Θ_{RAB} then

                          T_{f}AddBirthday + T_{g}Success

is a relation that adds a name to the birthday book and has ok as the value of result. The relation AlreadyKnown_{BC} is defined by

AlreadyKnown_{BC} : <[n:Name]×BirthdayBook×BirthdayBook×[result:Report]>
   asserts
      known' = known
      birthday' = birthday
      n ∈ known
      result = alreadyKnown

AlreadyKnown_{BC} does not change known and birthday and the value of result is alreadyKnown. Then a robust version of the AddBirthday_{BC} is

      RAddBirthday_{BC} = (T_{f}AddBirthday_{BC} + T_{g}Success_{BC}) ∨ T_{h}AlreadyKnown_{BC}

with h being the inclusion of the type of AlreadyKnown_{BC} into Θ_{RAB}. The operation RAddBirthday_{BC} adds a birthday for a person which is not already in the birthday-book and reports ok, or does not change known and birthday and reports alreadyKnown_{BC}.

8.1 Adding Disjunction to SL_{I}

Similar to the union of two specification expressions Sp_{1} and Sp_{2}, which denotes the intersection of their model classes, we can define the disjunction of Sp_{1} and Sp_{2} in any institution I, having the union of their model classes as the semantics. If Sp_{1} is given as I_{Φ_{1}}Σ and Sp_{2} as I_{Φ_{2}}Σ then m is a model of Sp_{1} ∨ Sp_{2} if and only if m ⊧ Φ_{1} or m ⊧ Φ_{2}.

Disjunction as an operation to form abstract datatypes has not been treated in the literature (cf. Sannella and Wirsing [54], Sannella and Tarlecki [50], Loeckx, Ehrich and Wolf [42] and Farrés-Casals [21]). One reason for this is that in contrast to union, disjunction does not have a semantics on the presentation level independent from the choice of the institution. For example, for union we have

I_{Φ_{1}}Σ + I_{Φ_{2}}Σ = I_{Φ_{1}∪Φ_{2}}Σ,

while for disjunction

I_{Φ_{1}}Σ ∨ I_{Φ_{2}}Σ = I_{Φ}Σ

only holds in institutions, where one can express the disjunction of two sets of formulas again by a set of formulas (cf. Section 8.2).

The abstract syntax of specification expressions of section 4.2 is extended by

Sp ::= … | Sp ∨ Sp,

where Sp_{1} ∨ Sp_{2} is well-formed if Sig(Sp_{1}) = Sig(Sp_{2}) and Sp_{1} and Sp_{2} are well-formed. The signature of Sp_{1} ∨ Sp_{2} is the signature of Sp_{1} and the semantics of disjunction is

\begin{aligned}[ \\ [ & Sp_{1} ∨ Sp_{1} & ] \\ & ] \end{aligned} = (Σ, M_{1} ∪ M_{2})

with [ [Sp_{1}] ] = (Σ, M_{1}) and [ [Sp_{2}] ] = (Σ, M_{2}).

8.2 Proving Properties with Disjunction

One problem with proving entailment Sp_{1} ⊧^{I} Sp_{2} for specification expressions in SL_{I} with disjunction is that the normal-form result of Section 4.2 does not hold anymore.

In the case of union we could use the equation D_{σ}Sp_{1} + Sp_{2} = D_{σ}(Sp_{1} + T_{σ}Sp_{2}) to pull D_{σ} out from the union (cf. Section 4.2). However for disjunction only

D_{σ}(Sp_{1} ∨ T_{σ}Sp_{2}) ⊧^{I} D_{σ}Sp_{1} ∨ Sp_{2}

is valid, while

D_{σ}Sp_{1} ∨ Sp_{2} ⊧^{I} D_{σ}(Sp_{1} ∨ T_{σ}Sp_{2})

does not hold in general. Let σ be a signature morphism from Σ to Σ′ and let m ⊧^{I} D_{σ}Sp_{1} ∨ Sp_{2}, thus either there exists a Σ′-structure m′, which is a model of Sp_{1} and satisfies m′|_{σ} = m or m is a model of Sp_{2}. Assume that m is a model of Sp_{2}. Then, in general, m cannot be extended to a Σ′-structure m′ with m′|_{σ} = m. For example, in LSL this is the case if σ is not injective on sorts and function symbols.

In R_{I} this happens if σ identifies parts of the shape of a relation. Consider the relation

R = D_{f}<[c : N]> ∨ I_{{c′=0}}<[c : N] × [c : N]>,

where f is a morphism from <[c : N] × [c : N]> to <[c : N]> identifying both states. Then (m_{1}, m_{2}) ∈ R if m_{1} = m_{2} or m_{2}(c) = 0. However

S = D_{f}<[c : N]> ∨ T_{f}I_{{c′=0}}<[c : N] × [c : N]>,

is the same as D_{f}<[c : N]> because Θ ∨ Sp has the same models as Θ (cf. the equalities on page 161). Thus S and R do not describe the same relation.

Another problem with computing the normal-form is to find a set of formulas Φ that expresses the union of two model classes defined by sets of formulas Φ_{1} and Φ_{2} in an arbitrary institution. That is, Φ has the property

Mod^{A}(\begin{matrix}[ \\ [ & I_{Φ}Sp & ] \\ ] \end{matrix}) = Mod^{A}(\begin{matrix}[ \\ [ & I_{Φ_{1}}Sp ∨ I_{Φ_{2}}Sp & ] \\ ] \end{matrix}).

In some institutions, like the institution of first-order logic, the disjunction of two (finite) sets can be expressed as one formula.

Definition 8.1 Given two sets of Σ-formulas Φ_{1} and Φ_{2}. In the case, where a Σ-formula φ in an institution I exists such that for each Σ-structure m we have m ⊧^{I} φ if and only if m ⊧ Φ_{1} or m ⊧ Φ_{2}, we call φ the disjunction of Φ_{1} and Φ_{2} and write φ = ‘Φ_{1} ∨ Φ_{2}’.

Theorem 8.2 Given an institution I and a signature Σ in Sign_{I}. If ‘Φ_{1} ∨ Φ_{2}’ exists for sets of Σ-formulas Φ_{1} and Φ_{2} then for a specification expression Sp in SL_{I} with signature Σ we have

I_{Φ_{1}}Sp ∨ I_{Φ_{2}}Sp = I_{{‘Φ_{1} ∨ Φ_{2}’}}Sp.

Proof. (⊆) Assume m ⊧^{I} I_{Φ_{1}}Sp, that is, m ⊧^{I} Φ_{1} and m ⊧^{I} Sp. Because of the definition of ‘Φ_{1} ∨ Φ_{2}’, m ⊧^{I} Φ_{1} implies m ⊧^{I} ‘Φ_{1} ∨ Φ_{2}’ and therefore m ⊧^{I} I_{‘Φ_{1} ∨ Φ_{2}’}Sp. A similar argument holds if we assume m ⊧^{I} I_{Φ_{2}}Sp.

(⊇) If m ⊧^{I} I_{‘Φ_{1} ∨ Φ_{2}’}Sp then m ⊧^{I} ‘Φ_{1} ∨ Φ_{2}’ and m ⊧^{I} Sp. Because of the definition of ‘Φ_{1} ∨ Φ_{2}’ we have m ⊧^{I} Φ_{1} or m ⊧ Φ_{2}. Assume now that m ⊧^{I} Φ_{1} then m ⊧^{I} I_{Φ_{1}}Sp∨I_{Φ_{2}}Sp and similar if m ⊧^{I} Φ_{2}. □

In first-order logic the disjunction of two sets of formulas

Φ_{1} = {∀X F_{1}, ∀Y F_{2}} and Φ_{2} = {∀Z F_{3}}

is

‘Φ_{1} ∨ Φ_{2}’ = (∀X F_{1} ∧ ∀Y F_{2}) ∨ ∀Z F_{3}.

In LSL the situation is more complex because formulas in LSL can only be equations or constraints but not arbitrary first-order formulas, in particular, they cannot contain quantified sub-formulas. However, since each signature Σ in Sign_{LSL} contains the sort Bool with its operations and the equality symbol, and further each structure in Str_{LSL}(Σ) is required to satisfy the property of booleans, we get the following theorems:

Lemma 8.3 Given a finite set of Σ-formulas Φ = {φ_{1}, …, φ_{n}} such that each φ_{i} has the form ∀X s_{i} = t_{i}. Define ‘∧Φ’ as the equation ∀X (s_{1} ≡ t_{1} ∧ ⋯ ∧ s_{n} ≡ t_{n}) = true and let A be a Σ-algebra in Str_{LSL}(Σ) then

(∀φ ∈ Φ A ⊧ φ) if and only if A ⊧ ‘∧Φ’.

Proof.

A ⊧ ‘∧Φ’ iff A ⊧ ∀X (s_{1} ≡ t_{1} ∧ ⋯ ∧ s_{n} ≡ t_{n}) = true | Def. ‘∧Φ’
iff ∀1 ≤ i ≤ n A ⊧ ∀X (s_{i} ≡ t_{i}) = true  | Lemma 3.32
iff ∀1 ≤ i ≤ n A ⊧ ∀X s_{i} = t_{i}  | Lemma 3.35
□

Note that it is important that each equation ∀X s_{i} = t_{i} in Φ has the same set of variables X. An alternative could have been to allow each equation its own set of variables X_{i} and to define X in ‘∧Φ’ as the union of all X_{i} for 1 ≤ i ≤ n. However, this does not work in the presence of empty carrier-sets as the following example shows. Let Σ be the signature with two sorts S_{1} and S_{2} and with two constants c_{1} and c_{2} of sort S_{2}. Let Φ be the set consisting of the equations ∀x_{1} : S_{1} x_{1} = x_{1} and c_{1} = c_{2}. Let A be a Σ-algebra such that A(S_{1}) = {} and A(c_{1}) ≠ A(c_{2}). Then we have A ⊧ ∀x_{1} : S_{1} x_{1} = x_{1} ∧ c_{1} = c_{2} because there cannot be a variable assignment ρ from X to A because that would imply the existence of a function from a non-empty set, {x_{1}}, to the empty set. On the other hand, we have A ⊧ ∀x_{1} : S_{1} x_{1} = x_{1} but also A |̸= c_{1} = c_{2}. However, if we change Φ to be the set containing the equations ∀x_{1} : S_{1} x_{1} = x_{1} and ∀x_{1} : S_{1} c_{1} = c_{2} then we have A ⊧ ∀x_{1} : S_{1} c_{1} = c_{2}.

Theorem 8.4 Given finite sets of Σ-formulas Φ_{1} and Φ_{2} such that 1. Φ_{1} and Φ_{2} do not contain constraints and

2. Φ_{i} has the form {∀X^{i} s_{1}^{i} = t_{1}^{i}, …, ∀X^{i} s_{n_{i}}^{i} = t_{n_{i}}^{i}} for i ∈ {1, 2}. Let X be the co-product of X^{1} and X^{2} with injections ι_{1} : X^{1} ⇒ X and ι_{2} : X^{2} ⇒ X and let ‘∧Φ_{1}’ be ∀X^{1} c_{1} = true and ‘∧Φ_{2}’ be ∀X^{2} c_{2} = true. Then the disjunction ‘Φ_{1} ∨ Φ_{2}’ of Φ_{1} and Φ_{2} is given by

∀X ι_{1}(c_{1}) ∨ ι_{2}(c_{2}) = true.

Proof. We have to show that for each Σ-algebra A in Str_{LSL}(Σ) we have

A ⊧ Φ_{1} or A ⊧ Φ_{2} if and only if A ⊧ ‘Φ_{1} ∨ Φ_{2}’.

A ⊧ ‘Φ_{1} ∨ Φ_{2}’ iff A ⊧ ∀X ι_{1}(c_{1}) ∨ ι_{2}(c_{2}) = true  | Def. ‘Φ_{1} ∨ Φ_{2}’
iff A ⊧ ∀X^{1} c_{1} = true or A ⊧ ∀X^{2} c_{2} = true | Lemma 3.33
iff A ⊧ ‘∧Φ_{1}’ or A ⊧ ‘∧Φ_{2}’
iff A ⊧ Φ_{1} or A ⊧ Φ_{2}  | Lemma 8.3
□

If either Φ_{1} or Φ_{2} contains constraints then the disjunction ‘Φ_{1} ∨ Φ_{2}’ is not defined since a constraint cannot be used as a sub formula in LSL.

The Inference Rules

To the inference rules of Section 4.3 we add the following rules:

R6 \frac{Sp ⊢ Sp_{1}}{Sp ⊢ Sp_{1} ∨ Sp_{2}} R6’ \frac{Sp ⊢ Sp_{2}}{Sp ⊢ Sp_{1} ∨ Sp_{2}} ,

L9 \frac{Sp_{1} ⊢ Sp Sp_{2} ⊢ Sp}{Sp_{1} ∨ Sp_{2} ⊢ Sp}

and the rules for monotonicity of ∨:

M4 \frac{Sp ⊢ Sp′}{Sp ∨ Sp′′ ⊢ Sp′ ∨ Sp′′} M4’ \frac{Sp ⊢ Sp′}{Sp′′ ∨ Sp ⊢ Sp′′ ∨ Sp′} .

Disjunction is associative and commutative and the following equalities hold:

Sp ∨ Σ = Σ  D_{σ}(Sp_{1} ∨ Sp_{2}) = D_{σ}Sp_{1} ∨ D_{σ}Sp_{2}
Sp ∨ Sp = Sp  I_{Φ}(Sp_{1} ∨ Sp_{2}) = I_{Φ}Sp_{1} ∨ I_{Φ}Sp_{2}
T_{σ}(Sp_{1} ∨ Sp_{2}) = T_{σ}Sp_{1} ∨ T_{σ}Sp_{2}

and

I_{Φ_{1}}Sp ∨ I_{Φ_{2}}Sp = I_{‘Φ_{1} ∨ Φ_{2}’}Sp

if ‘Φ_{1} ∨ Φ_{2}’ exists.

8.3 Adding Disjunction to RSL_{I}

The language RSL_{I} is extended by disjunction as follows:

R ::= … | R ∨ R.

Then R ∨ S is well-formed if R and S are well-formed and have the same type. The type of R ∨ S is the type of R. The semantics of disjunction is defined by reduction to expressions in SL_{R_{I}}:

\begin{aligned}[ \\ [ & R ∨ S & ] \\ & ] \end{aligned}_{SL_{R_{I}}} = [ ; [R] ; ]_{SL_{R_{I}}} ∨ [ ; [S] ; ]_{SL_{R_{I}}} .

We also extend the translation of RSL expressions to SL_{I} expressions (cf. Chapter 8) to disjunction:

tr(R ∨ S) = tr(R) ∨ tr(S).

Then we have to show that G^{A}(\begin{matrix}[ \\ [ & R ∨ S & ] \\ & ] \end{matrix}_{R}) = \begin{matrix}[ \\ [ & tr(R) ∨ tr(S) & ] \\ ] \end{matrix}. Let [ ; [R] ; ]_{R} = (Θ, M_{R}) and [ ; [S] ; ]_{R} = (Θ, M_{S}), where Θ = (D, Γ), and let

G^{A}([ ; [R] ; ]_{R}) = (∐ Γ; Sig^{A}, \overline{M}_{R}) and G^{A}([ ; [S] ; ]_{R}) = (∐ Γ; Sig^{A}, \overline{M}_{S}).

The induction hypothesis gives us further G^{A}([ ; [R] ; ]_{R}) = \begin{matrix}[ \\ [ & tr(R) & ] \\ ] \end{matrix} and G^{A}([ ; [S] ; ]_{R}) = \begin{matrix}[ \\ [ & tr(S) & ] \\ ] \end{matrix}. Then we have:

G^{A}(\begin{matrix}[ \\ [ & R ∨ S & ] \\ & ] \end{matrix}_{R}) = G^{A}((Θ, M_{R} ∪ M_{S}))  | Def. ∨
= (∐ Γ; Sig^{A}, \overline{M}_{R} ∪ \overline{M}_{S})  | Def. G^{A}

= (∐ Γ; Sig^{A}, Mod^{A}(G^{A}([ ; [R] ; ]_{R})) ∪ Mod^{A}(G^{A}([ ; [S] ; ]_{R})))

= \begin{matrix}[ \\ [ & tr(R) ∨ tr(S) & ] \\ ] \end{matrix}

The Birthday-Book Example

As an example, the robust version of the AddBirthdayBook_{BC} relation from the beginning of this chapter is translated to SL_{LSL}.

  tr(RAddBirthday_{BC})
               = (T\overline{f}tr(AddBirthday_{BC}) + T\overline{g}tr(Success_{BC})) ∨ T\overline{h}tr(AlreadyKnown_{BC})

And we have tr(AddBirthday_{BC}):

includes colim Θ_{AB}
asserts
   not(n ∈ known)
   birthday' = update(birthday,n,d)

8.3 Adding Disjunction to RSL_{I}  163

And colim Θ_{AB} is

includes
BirthdayBook_{BC},
BirthdayBook_{BC}[known' for known, birthday' for birthday]
introduces
n : Name
d : Date

Then tr(Success_{BC}) yields

includes colim Θ_{R}
asserts
result = ok

with colim Θ_{R} being

includes Env
introduces
result : Result
And tr(AlreadyKnown_{BC}) is
includes colim <[n:Name]×BirthdayBook_{BC}×BirthdayBook_{BC}×[result: Report]>
asserts
known' = known
birthday' = birthday
n ∈ known
result = alreadyKnown
and colim <[n : Name] × BirthdayBook_{BC} × BirthdayBook_{BC} × [result : Report]> is
includes
BirthdayBook_{BC},
BirthdayBook_{BC}[known' for known, birthday' for birthday]
introduces
result :  Result
n :  Name

Then we get as tr(RAddBirthday_{BC}):

includes colim Θ_{RAB}
asserts
not(n ∈ known)
birthday' = update(birthday,n,d)
result = ok

∨

includes colim Θ_{RAB}
asserts
known' = known
birthday' = birthday
n ∈ known
result = alreadyKnown

with colim Θ_{RAB} being:

164  Disjunction

includes
BirthdayBook_{BC}
BirthdayBook_{BC}[known' for known, birthday' for birthday]
introduces
n :  Name
d : Date
result : Result

If we use I_{Φ_{1}}(colim Θ_{RAB}) ∨ I_{Φ_{2}}(colim Θ_{RAB}) = I_{‘Φ_{1} ∨ Φ_{2}’}(colim Θ_{RAB}), we get tr(RAddBirthday) equals

includes colim Θ_{RAB}
asserts
(not(n ∈ known)
   ∧ birthday' = update(birthday,n,d)
   ∧ result = ok)

∨

(n ∈ known
   ∧ known' = known
   ∧ birthday' = birthday
   ∧ result = alreadyKnown)

9 Z Specifications

This chapter compares in more detail the approach presented in this thesis for the specification of sequential system with the approach used by the model-oriented specification language Z (cf. The Z Base Standard [12]). To this end we first define the institution SET , which formalizes the logical system underlying Z. We show that the category of signatures Sign_{SET} of SET is cocomplete and that the covariant structure functor Str_{SET} : Sign_{SET}^{op} → Cat preserves colimits. Thus SET can be used as a base institution to construct R_{SET}.

As already noted by Spivey [56], schemata are closely related to signatures and schema-types to abstract datatypes of SET . We shall investigate this relationship further and show a correspondence between the operations on abstract datatypes given in Section 4.2 and the schema-expressions.

This correspondence and the relationship between Adt_{R_{SET}} and Adt_{SET}, elaborated in Section 5.6, allows to write Z-style specifications of sequential systems using any logical system, for which there is an exact institution with a (finitely) cocomplete category of signatures. In particular, we give an example specification using LSL.

9.1 The Institution SET

Signatures

A signature Σ in Sign_{SET} consists of a set of names for given-sets G and a set of identifiers O. Each identifier id in O is associated with a type τ(id) built from the names of given-sets and the constructors: cartesian product, power-set and schema-type.

Note that SET has no type constructors for function types. Instead, a function from T_{1} to T_{2} is identified with its graph and is of type P(T_{1} × T_{2}). This allows functions to be treated as sets and admits higher-order functions, as functions may take as argument the graph of a function and also return the graph of a function.

Definition 9.1 (Signatures) A signature Σ in Sign_{SET} is a tuple (G, O, τ) where G and O are finite subsets of a recursive enumerable set of names F. The function τ maps names in O to types in T (G) where T (G) is inductively defined by:

• G ⊆ T (G)

• (product) T_{1} × ⋯ × T_{n} ∈ T (G) for T_{i} ∈ T (G), 1 ≤ i ≤ n

• (power-set) P(T) ∈ T (G) for T ∈ T (G)

• (schema-type) <x_{1} : T_{1}, …, x_{n} : T_{n}> ∈ T (G) for T_{i} ∈ T (G) and x_{i} ∈ F and x_{i} ≠ x_{j} for 1 ≤ i, j ≤ n.

G and O need not be disjoint. If a name is used in an expression that occurs both in G and in O then it is interpreted as an identifier from O and not as a given-set from G; this means that the identifiers in O hide the identifiers in G.

The function T , mapping a given-set G to T (G), is extended to a functor from Set to Set by the canonical extension of a function f : G → G′ to a function T (f) : T (G) → T (G′) given by the definition of T (G), that is:

• T (f)(g) = g for g ∈ G,

• T (f)(T_{1} × … × T_{n}) = T (f)(T_{1}) × … × T (f)(T_{n}) for T_{1}, …, T_{n} ∈ T (G),

• T (f)(P(T)) = P(T (f)(T)) for T ∈ T (G),

• T (f)(<x_{1} : T_{1}, …, x_{n} : T_{n}>) = <x_{1} : T (f)(T_{1}), …, x_{n} : T (f)(T_{n})> for T_{1}, …, T_{n} ∈ T (G).

A signature morphism σ : (G, O, τ) → (G′, O′, τ′) is a pair of maps between the given-sets and the set of identifiers such that if id is the name of a given-set from G \ O then it has to be mapped to G′ \ O′. This requirement is important for the proof of Lemma 9.14, which in turn is needed in the proof of the satisfaction condition (cf. Theorem 9.15).

Definition 9.2 (Signature-Morphisms) A signature morphism σ from a signature (G, O, τ) to signature (G′, O′, τ′) is a pair of functions σ_{G} : G → G′ and σ_{O} : O → O′ such that σ_{G} and σ_{O} are compatible with τ and τ′, that is τ; T (σ_{G}) = σ_{O}; τ′. We require that if id is in G \ O then σ_{O}(id) is in G \ O.

Definition 9.3 (Sign_{SET}) The category Sign_{SET} has as objects signatures Σ = (G, O, τ) and as morphisms signature morphisms σ = (σ_{G}, σ_{O}) as defined above.

The colimit of a functor F : J → Sign_{SET} is given by the colimits of the set of given-set names and the set of identifiers. Note that Sign_{SET} is only finitely cocomplete because we have assumed that the set of given-set names and the set of identifiers are finite.

Theorem 9.4 The category Sign_{SET} is finitely cocomplete.

Proof L. et F be a functor from J to Sign_{SET} and let F (i) = Σ_{i} = (G_{i}, O_{i}, τ_{i}) and F (f) = σ_{f} = (σ_{G}^{f}, σ_{O}^{f}). Define F_{G} : J → Set by F_{G}(i) = G_{i} and F_{G}(f) = σ_{G}^{f}, and define F_{O} : J → Set by F_{O}(i) = O_{i} and F_{O}(f) = σ_{O}^{f}. Then ∐ F = (G, O, τ), where G is the colimit of F_{G}, O the colimit of F_{O} and τ is given as the unique function satisfying ι^{F_{O}}; τ = τ_{i}; T (ι^{F_{G}}) for all i ∈ J given by the colimit property of F_{O}.

\xymatrix{O \ar[r]^{τ} & T (G) \\ O_{i} \ar[r]_{τ_{i}} \ar[u]^{ι_{i}^{F_{O}}} & T (G_{i}) \ar[u]_{T (ι_{i}^{F_{G}})}}

9.1 The Institution SET  167

The co-cone morphisms ι_{i}^{F} = ((ι_{G}^{F})_{i}, (ι_{O}^{F})_{i}) from Σ_{i} to ∐ F are given by the co-cone morphisms ι_{i}^{F_{G}} from G_{i} to G and ι_{i}^{F_{O}} from O_{i} to O. Note that, by the above diagram, (ι_{G}^{F})_{i} and (ι_{O}^{F})_{i} are compatible and therefore ι_{i}^{F} is a signature morphism.

Given a natural transformation μ : F ⇒ Δ(G′, O′, τ′) then the unique function μ̄ = (μ̄_{G}, μ̄_{O}) from ∐ F to (G′, O′, τ′) with the property ι_{i}^{F}; μ̄ = μ_{i} for all i ∈ J is given by the unique functions μ̄_{G} and μ̄_{O} given by the colimit property of G and O. For μ̄ to be a signature morphisms we have to show that μ̄_{O}; τ′ = τ; T (μ̄_{G}). We show this by using the colimit property of O in Set for the following J-indexed families of diagrams

\xymatrix{O \ar[r]^{τ} & T (G) \ar[r]^{T (μ̄_{G})} & T (G′) & O \ar[r]^{μ̄_{O}} & O′ \ar[r]^{τ′} & T (G′) \\ O_{i} \ar[u]^{(ι_{O}^{F})_{i}} \ar[r]_{τ_{i}} & T (G_{i}) \ar[u]^{T ((ι_{G}^{F})_{i})} \ar[ur]_{T ((μ_{G})_{i})} &  &  & O_{i} \ar[ul]^{(ι_{O}^{F})_{i}} \ar[u]_{(μ_{O})_{i}} \ar[r]_{τ_{i}} & T (G_{i}) \ar[u]_{T ((μ_{G})_{i})}}

In the first family of diagrams the diagrams commute because the right triangle commutes since μ̄_{G} is defined as the unique function that satisfies (ι_{G}^{F})_{i}; μ̄_{G} = (μ_{G})_{i}, and the left rectangle commutes because ι^{F} is a signature morphism. The diagrams in the second family commute because the μ_{i} are signature morphisms (right rectangle) and μ̄_{O} is defined as the unique function satisfying (ι_{O}^{F})_{i}; μ̄_{O} = (μ_{O})_{i} (left triangle). Then τ; T (μ̄_{G}) = μ̄_{O}; τ′ because of the uniqueness of the function from O to T (G′) making the outer quadrangles of the diagrams commute. □

The initial object in Sign_{SET} is ({}, {}, τ) where τ is the unique function from the empty set to T ({}) = {}.

Structures

Given a signature Σ = (G, O, τ) a Σ-structure A interprets each given-set in G by a set from Set and each identifier id in O by a value of the set corresponding to the type of id.

Definition 9.5 (Σ-structures) For a given signature Σ = (G, O, τ) the category Str_{SET} (Σ) of Σ-structures has as objects pairs (A_{G}, A_{O}), where A_{G} is a functor from the set G, viewed as a discrete category, to Set and A_{O} is the set {(o_{1}, v_{1}), …, (o_{n}, v_{n})} for O = {o_{1}, …, o_{n}} and v_{i} ∈ Ā_{G}(τ(o_{i})), where the functor Ā_{G} : T (G) → Set is given by:

• Ā_{G}(T) = A_{G}(T) for T = g and g ∈ G

• Ā_{G}(T_{1} × ⋯ × T_{n}) = (Ā_{G}(T_{1}) × ⋯ × Ā_{G}(T_{n})) for T_{1} × ⋯ × T_{n} ∈ T (G)

• Ā_{G}(P(T)) = 2^{Ā_{G}(T)} for P(T) ∈ T (G)

• Ā_{G}(<x_{1} : T_{1}, …, x_{n} : T_{n}>)

= {{(x_{1}, v_{1}), …, (x_{n}, v_{n})} | v_{i} ∈ Ā_{G}(T_{i}), i ∈ 1 … n}

for <x_{1} : T_{1}, …, x_{n} : T_{n}> ∈ T (G).

A morphism h from a Σ-structure A to a Σ-structure B is a family of functions between the interpretations of the given-sets which is compatible with the interpretations of the identifiers in O.

Definition 9.6 (Σ-homomorphism) A Σ-homomorphism h from a structure A = (A_{G}, A_{O}) to a structure B = (B_{G}, B_{O}) is a natural transformation h : A_{G} ⇒ B_{G} for which h̄_{τ(o)}(v_{A}) = v_{B} for all o ∈ O, (o, v_{A}) ∈ A_{O} and (o, v_{B}) ∈ B_{O} holds, where h̄ is the extension of h : A_{G} ⇒ B_{G} to h̄ : Ā_{G} ⇒ B̄_{G} given by:

• h̄_{T} (v) = h_{T} (v) for T ∈ G

• h̄_{T} ((v_{1}, …, v_{n})) = (h̄_{T_{1}}(v_{1}), …, h̄_{T_{n}}(v_{n})) for T = T_{1} × ⋯ × T_{n} ∈ T (G)

• h̄_{P(T)}(S) = {h̄_{T} (v) | v ∈ S} for P(T) ∈ T (G)

• h̄_{T} ({(x_{1}, v_{1}), …, (x_{n}, v_{n})}) = {(x_{1}, h̄_{T_{1}}(v_{1})), …, (x_{n}, h̄_{T_{n}}(v_{n}))} for T = <x_{1} : T_{1}, …, x_{n} : T_{n}> ∈ T (G)

Definition 9.7 (σ-reduct) Given a signature morphism σ from Σ = (G, O, τ) to Σ′ = (G′, O′, τ′) in Sign_{SET} and a structure A = (A_{G}, A_{O}) in Str_{SET} (Σ′) the σ-reduct of A, written A|_{σ}, is the structure B = (B_{G}, B_{O}) given by:

• B_{G} = σ_{G}; A_{G}

• B_{O} = {(o, v) | (σ_{O}(o), v) ∈ A_{O}, o ∈ O}

For a Σ′-homomorphism h : A → B the σ-reduct is defined as h|_{σ} = σ_{G}; h.

Definition 9.8 (Str_{SET}) The contravariant functor Str_{SET} from Sign_{SET} to Cat assigns to each signature Σ the category having as objects Σ-structures and as morphisms Σ-ho-momorphisms, and to each Sign_{SET} -morphism σ from Σ to Σ′ a functor from the category Str_{SET} (Σ′) to the category Str_{SET} (Σ) mapping a Σ-structure A and a Σ-homomorphism to their σ-reduct.

Theorem 9.9 The functor Str_{SET} preserves finite colimits.

The functor Str_{SET} maps the initial object ({}, {}, τ) in Sign_{SET} to the category with one element (A_{G}, {}) where A_{G} is the unique functor from the category with no objects to the category Set. If Str_{SET} in addition preserves pushouts, then Str_{SET} preserves finite colimits. The functor Str_{SET} preserves pushouts if the institution SET has amalgamation.

Theorem 9.10 The institution SET has amalgamation.

Proof L. et F be a pushout diagram with F (i) = Σ_{i} = (G_{i}, O_{i}) for i ∈ {0, 1, 2}, F (f) = σ_{f} = (σ_{G}^{f}, σ_{O}^{f}) for f ∈ V, and let Σ_{cl} = (G_{cl}, O_{cl}) be the pushout of F with co-limit morphisms ι_{i}; Σ_{i} → Σ_{cl} for i ∈ {0, 1, 2}. Given Σ_{i}-structures A_{i} = (A_{G}^{i}, A_{O}^{i}) such that A_{1}|_{σ_{f}} = A_{0} = A_{2}|_{σ_{g}}, where f : 0 → 1 and g : 0 → 2. Then we define the amalgamated sum A = (A_{G}, A_{O}) of A_{1} and A_{2} with respect to A_{0} by

A_{G}(g) = A_{G}^{i}(g_{i}) if (ι_{G})_{i}(g_{i}) = g for some i ∈ {0, 1, 2} and g_{i} ∈ G_{i}

and

A_{O} = {(o, v_{i}) | ∃i ∈ {0, 1, 2} (o_{i}, v_{i}) ∈ A_{O}^{i}, (ι_{O})_{i}(o_{i}) = o},

For A_{G} to be well-defined consider i, j with (ι_{G})_{i}(g_{i}) = g = (ι_{G})_{j}(g_{j}). Then we have to show that A_{G}^{i}(g_{i}) = A_{G}^{j}(g_{j}). Assume that there exists f : i → j in V then we have σ_{O}^{f}(g_{i}) = g_{j} and A_{j}|_{σ_{f}} = A_{i}, which by the definition of σ-reduct implies σ_{G}^{f}; A_{G}^{j} = A_{G}^{i}, and therefore A_{G}^{j}(g_{j}) = A_{G}^{j}(σ_{G}^{f}(g_{i})) = A_{G}^{i}(g_{i}).

A similar argument shows that if (o, v_{i}) ∈ A_{O} and (o, v_{j}) ∈ A_{O} then v_{i} = v_{j}. □

Formulas

The Σ-formulas are first-order formulas over expressions denoting sets and elements in sets. Expressions can be tested for equality and membership. An important category of expressions, called schema-expressions, denote sets of elements of schema-type.

Expressions Expressions describe either given-sets or values in sets constructed from givensets; the values can, of course, be themselves sets. These expressions are built from names in G and O, formation of tuples, selection of an element in a tuple, formation of an element of schema-type, selection of a component of an element of schema-type and function application.

E ::= id | (E, …, E) | E.i | <x_{1} := E, …, x_{n} := E> | E.x | E(E)

An identifier id in O denotes a value of the set Ā_{G}(τ(id)) and a given-set name g in G denotes a given-set A_{G}(g), which is an element of the set Ā_{G}(P(g)) = 2^{A_{G}(g)}. The function application E_{1}(E_{2}) is well-defined if E_{1} is of type P(T_{1} × T_{2}) and E_{2} is of type T_{1}. The result is of type T_{2}. If E_{1} represents the graph of a total function then E_{1}(E_{2}) yields the result of that function applied to E_{2}. However, if E_{1} is the graph of a partial function or not a functional at all then an arbitrary value from the Ā_{G}(T_{2}) is chosen as the result for the situations where E_{2} is not in the domain of that function or if several results are associated with E_{2} in E_{1}.

The remaining expressions denote sets. These are set-extension and comprehension, powerset construction, cartesian product and schemas.

E ::= … | {E, …, E} | {S • E} | P(E) | E × … × E | S

Let V be a recursive enumerable set of variable names such that V and F are disjoint. Given a signature Σ = (G, O, τ) and a set of variables X ⊆ V together with a function τ_{X} : X → T (G) then an environment ϵ is a pair (Σ, (X, τ_{X})). An expression E is well-formed with respect to ϵ if • E = id and id ∈ X ∪ O ∪ G. The type of E w.r.t. ϵ is

τ^{ϵ}(E) = \begin{cases}τ_{X}(id) & if id is in X, \\ τ(id) & if id is in O and \\ P(id) & if id is in G \ O. \end{cases}

• E = (E_{1}, …, E_{n}) and each E_{i} is well-formed for all 1 ≤ i ≤ n. Then τ^{ϵ}(E) = τ^{ϵ}(E_{1}) × … × τ^{ϵ}(E_{n}).

• E = E′.i, τ^{ϵ}(E′) = T_{1} × … × T_{n} and 1 ≤ i ≤ n. The type of E is T_{i}.

• E = <x_{1} := E_{1}, …, x_{n} := E_{n}>, x_{i} ∈ V, x_{i} ≠ x_{j} and each E_{i} is well-formed. The type of E is <x_{1} : τ^{ϵ}(E_{1}), …, x_{n} : τ^{ϵ}(E_{n})>.

• E = E′.x, τ^{ϵ}(E′) = <x_{1} : T_{1}, …, x_{n} : T_{n}> and x = x_{i} for some 1 ≤ i ≤ n. The type of E is T_{i}.

• E_{1}(E_{2}), τ^{ϵ}(E_{1}) = P(T_{1} × T_{2}) and τ^{ϵ}(E_{2}) = T_{1}. The type of E is T_{2}.

• E = {E_{1}, …, E_{n}}, each E_{i} is well-formed and all E_{i} have the same type T for 1 ≤ i ≤ n. The type of E is P(T).

• E = {S • E′}, S is well-formed and has type P(<x_{1} : T_{1}, …, x_{n} : T_{n}.> and E′ is well-formed with respect to ϵ[<x_{1} : T_{1}, …, x_{n} : T_{n}>], where ϵ[<x_{1} : T_{1}, …, x_{n} : T_{n}>] = (Σ, (X′, τ′_{X})) is given by X′ = X ∪ {x_{1}, …, x_{n}} and

τ′_{X}(id) = \{ \begin{matrix}T_{i} & if id = x_{i} for some 1 ≤ i ≤ n \\ τ_{X}(id) & else \end{matrix} )

The type of E is P(τ^{Σ′}(E′)).

• E = P(E′) and E′ is well-formed. The type of E is P(τ^{ϵ}(E′)).

• E = E_{1}×…×E_{n} and each E_{i} is well-formed. The type of E is P(τ^{ϵ}(E_{i})×…×τ^{ϵ}(E_{n})).

• E = S and S is well-formed schema-expression with respect to Σ, where well-formedness of schema-expressions are defined on page 172. The type of E is the type of S with respect to ϵ.

Let E be an expression well-formed with respect to ϵ = (Σ, (X, τ_{X})) and let A = (A_{G}, A_{O}) be a Σ-structure. The semantics of an expression E with respect to the environment ? β = (A, A_{X}), where A_{X} = {(x_{1}, v_{1}) … (x_{n}, v_{n})}, X = {x_{1}, …, x_{n}} and v_{i} ∈ Ā_{G}(τ_{X}(x_{i})) for all 1 ≤ i ≤ n, is defined as follows:

• \begin{matrix}[ \\ [ & id & ] \\ ] \end{matrix}^{β} = v if (id, v) ∈ A_{X} and id ∈ X or (id, v) ∈ A_{O} and id ∈ O or \begin{matrix}[ \\ [ & id & ] \\ ] \end{matrix}^{β} = A_{G}(id) if

id is in G \ O.

• \begin{matrix}[ \\ [ & (E_{1}, …, E_{n}) & ] \\ ] \end{matrix}^{β} = (\begin{matrix}[ \\ [ & E_{1} & ] \\ & ] \end{matrix}^{β} , …, \begin{aligned}[ \\ [ & E_{n} & ] \\ & ] \end{aligned}^{β}).

• \begin{matrix}[ \\ [ & E.i & ] \\ ] \end{matrix}^{β} = v_{i} if [ ; [E] ; ]^{β} = (v_{1}, …, v_{n}).

• \begin{matrix}[ \\ [ & <x_{1} := E_{1}, …, x_{n} := E_{n}> & ] \\ ] \end{matrix}^{β} = \{(x_{1}, \begin{aligned}[ \\ [ & E_{1} & ] \\ & ] \end{aligned}^{β}), …, (x_{n}, \begin{aligned}[ \\ [ & E_{n} & ] \\ & ] \end{aligned}^{β})\}.

• \begin{matrix}[ \\ [ & E.x & ] \\ ] \end{matrix}^{β} = v_{i} if [ ; [E] ; ]^{β} = \{(x_{1}, v_{1}), …, (x_{n}, v_{n})\} and x = x_{i}.

• \begin{matrix}[ \\ [ & E_{1}(E_{2}) & ] \\ ] \end{matrix}^{β} = v if v is unique with (\begin{matrix}[ \\ [ & E_{2} & ] \\ & ] \end{matrix}^{β} , v) in \begin{aligned}[ \\ [ & E_{1} & ] \\ & ] \end{aligned}^{β}. If another v′ with (\begin{matrix}[ \\ [ & E_{2} & ] \\ & ] \end{matrix}^{β} , v′) in

\begin{aligned}[ \\ [ & E_{1} & ] \\ & ] \end{aligned}^{β} exists or if none exists then v is an arbitrary element of Ā_{G}(T_{2}), where τ^{ϵ}(E_{1}) = P(T_{1} × T_{2}).

• \begin{matrix}[ \\ [ & \{E_{1}, …, E_{n}\} & ] \\ ] \end{matrix}^{β} = \begin{cases}[ \\ [ & E_{1} & ] \\ & ] \end{cases}^{β} , …, \begin{aligned}[ \\ [ & E_{n} & ] \\ & ] \end{aligned}^{β}\}.

• \begin{matrix}[ \\ [ & \{S • E\} & ] \\ ] \end{matrix}^{β} = \{[ ; [E] ; ]^{β[v]} | v ∈ [ ; [S] ; ]^{β}\}.

For a value v = {(x_{1}, v_{1}), …, (x_{n}, v_{n})} from [ ; [S] ; ]^{β}, β[v] is the environment (A, A_{X}[v]) such that

A_{X}[v] = A_{X} \ {(id, v′) | (id, v′) ∈ A_{X}, ∃1 ≤ i ≤ n : id = x_{i}} ∪ v

• \begin{matrix}[ \\ [ & P(E) & ] \\ ] \end{matrix}^{β} = 2^{[ ; [E] ; ]^{β}}.

• \begin{aligned}[ \\ [ & E_{1} × … × E_{n} & ] \\ & ] \end{aligned}^{β} = \begin{aligned}[ \\ [ & E_{1} & ] \\ & ] \end{aligned}^{β} × … × \begin{aligned}[ \\ [ & E_{n} & ] \\ & ] \end{aligned}^{β}.

Schema-expressions A schema denotes a set of elements of schema-type which have the form {(x_{1}, v_{1}), …, (x_{n}, v_{n})} and are called bindings. A simple schema of the form x_{1} : E_{1}, …, x_{n} : E_{n} defines the identifiers of a schema and a set of possible values for each identifier.

We require that the identifiers of a schema are not taken from the same set F as the given-set names in G and the identifier names of O. Thus we assume a recursive enumerable set V with V ∩ F = {} from which the identifiers of a schema are taken. The reason is that the identifier names of a schema can be bound by a quantifier and that we have to prevent that an identifier is renamed by a signature morphism to the name of a bound identifier. This would lead to problems with the satisfaction condition for SET .

Given a schema S we can a define a new schema S|P having as elements all the elements of S satisfying the predicate P. We can form the negation, disjunction, conjunction and implication of schema-expressions, which correspond to the complement, union and intersection of the sets denoted by the arguments. For the disjunction, conjunction and implication of schema-expressions the type of the arguments have to be compatible, that is, if two components have the same name, they have to have the same type. The type of the result has as components the union of the components of the arguments, with all duplicates removed. Adjustments of the type of schemas can be made by using hiding and renaming, where hiding hides some components of a schema-type and renaming renames some identifiers. An existentially quantified schema ∃S_{1}.S_{2} denotes the set of all bindings of the identifiers of S_{2} without the ones in S_{1} such that there exists a binding in S_{1} such that the union of the bindings is an element of S_{2}. An universally quantified schema ∀S_{1}.S_{2} is an abbreviation for ¬∃S_{1}.¬S_{2}.

S ::= x_{1} : E, …, x_{n} : E | (S|P) | ¬S | S ∨ S | S ∧ S | S ⇒ S
| ∀S.S | ∃S.S | S \ [x_{1}, …, x_{n}] | S[x_{1}/y_{1}, …, x_{n}/y_{n}]
| S Decor | E

A schema-expression S is well-formed with respect to an envrionment ϵ = (Σ, (X, τ_{X})) with Σ = (G, O, τ), if

• S = x_{1} : E_{1}, …, x_{n} : E_{n}, x_{i} ∈ V and E_{i} is well-formed and has type P(T_{i}) for each 1 ≤ i ≤ n. The type of S is P(<x_{1} : T_{1}, …, x_{n} : T_{n}>).

• S = S′|P and P is well-formed with respect to ϵ′ = ϵ[T], where T is the type of S′ with respect to ϵ. The type of S is T.

• S = ¬S′ and S′ is well-formed. The type of S is τ^{ϵ}(S′).

• S = S_{1} op S_{2}, S_{1} and S_{2} have compatible types, and S_{1} and S_{2} are well-formed for each op ∈ {∨, ∧, ⇒}. Two schema-types <x_{1} : T_{1}, …, x_{n} : T_{n}> and <x′_{1} : T′_{1}, …, x′_{m} : T′_{m}> are compatible if for all i, j such that x_{i} = x′_{j} we have T_{i} = T′_{j}. The type of S has as components the union of the components of the type of S_{1} and S_{2} with the duplicates removed.

• S = ∃S_{1}.S_{2}, S_{1} and S_{2} are well-formed with respect to ϵ and their types are compatible. The type of S is the type of S_{2} with all the identifiers removed which occur in S_{1}.

• S = S′ \ [x_{1}, …, x_{n}] and S is well-formed. Note that it is not required that the x_{i} have to be identifiers of the type of S′. The type of S is the type of S′ without the identifier x_{i} if x_{i} occurs in the type of S for all 1 ≤ i ≤ n.

• S = S′[x_{1}/y_{1}, …, x_{n}/y_{n}] and S is well-formed. Note that it is not required that the x_{i} have to be identifiers of the type of S′. The type of S is the type of S′ where x_{i} is replaced by y_{i} if x_{i} is an identifier of S′. Note that the function from the identifiers of the type of S′ to the identifiers of the type of S defined by this replacement has to be injective.

• S = S′ Decor and S′ is well-formed. Decor is a finite sequence of elements from {′,!,?}. The type of S is P(<x̄_{1} : T_{1}, …, x̄_{n} : T_{n}>) if S′ is of type P(<x_{1} : T_{1}, …, x_{n} : T_{n}>) x̄_{i} is the decorated form of x_{i}, for example, if Decor is ! then x̄_{i} is x_{i}!.

• S = E and E is well-formed with type P(<x_{1} : T_{1}, …, x_{n} : T_{n}>) The type of S is P(<x_{1} : T_{1}, …, x_{n} : T_{n}>)

If a schema-expression S is well-defined with respect to ϵ, its semantics [ ; [S] ; ]^{β} with respect to a structure A = (A_{G}, A_{O}) and an environment β = (A, A_{X}) is defined as follows:

• \begin{aligned}[ \\ [ & x_{1} : E_{1}, …, x_{n} : E_{n} & ] \\ & ] \end{aligned}^{β} = \{\{(x_{1}, v_{1}), …, (x_{n}, v_{n})\} | v_{i} ∈ \begin{aligned}[ \\ [ & E_{i} & ] \\ & ] \end{aligned}^{β} , 1 ≤ i ≤ n\}.

• \begin{aligned}[ \\ [ & S|P & ] \\ & ] \end{aligned}^{β} = \{v ∈ [ ; [S] ; ]^{β} | β[v] ⊧^{SET} P \}. The satisfaction relation ⊧^{SET} is defined on page 174.

• \begin{aligned}[ \\ [ & ¬S & ] \\ & ] \end{aligned}^{β} = \{v | v ∉ [ ; [S] ; ]^{β}\}.

• \begin{aligned}[ \\ [ & S_{1} op S_{2} & ] \\ & ] \end{aligned}^{β} = \{v ∈ Ā_{G}(T) | v = v_{1} ∪ v_{2}, v_{1} ∈ \begin{aligned}[ \\ [ & S_{1} & ] \\ & ] \end{aligned}^{β} op v_{2} ∈ \begin{aligned}[ \\ [ & S_{2} & ] \\ & ] \end{aligned}^{β}\} for op ∈ \{∨, ∧, ⇒\},

where T is the type of S_{1} op S_{2}. Note that v ∈ Ā_{G}(T) guarantees that if (x, a) ∈ v_{1}, (x, a′) ∈ v_{2} and v = v_{1} ∪ v_{2} then a = a′.

• \begin{aligned}[ \\ [ & ∃S_{1}.S_{2} & ] \\ & ] \end{aligned}^{β} = \{v ∈ Ā_{G}(τ^{ϵ}(∃S_{1}.S_{2})) | ∃v_{1} ∈ \begin{aligned}[ \\ [ & S_{1} & ] \\ & ] \end{aligned}^{β} v_{1} ∪ v ∈ \begin{aligned}[ \\ [ & S_{2} & ] \\ & ] \end{aligned}^{β}\}. Note that the ele-

ments of \begin{aligned}[ \\ [ & S_{2} & ] \\ & ] \end{aligned}^{β} contain at most one pair (x_{i}, v_{i}) for each identifier x_{i} and therefore if

v_{1} ∪ v is in \begin{aligned}[ \\ [ & S_{2} & ] \\ & ] \end{aligned}^{β} then for all (x_{i}, v_{i}) ∈ v and (x′_{j}, v′_{j}) ∈ v_{1} with x_{i} = x′_{j} we have v_{i} = v′_{j}.

• \begin{matrix}[ \\ [ & S \ [y_{1}, …, y_{n}] & ] \\ ] \end{matrix}^{β} = \{v|_{\{x_{1},... ,x_{m}\}} | v ∈ [ ; [S] ; ]^{β}\}, where \{x_{1}, …, x_{m}\} is the set of identi-

fiers of the type of S without the identifiers y_{1}, …, y_{n} and v|_{X} denotes the binding v restricted to the identifiers in the set X.

• [[S[y_{1}/y′_{1}, …, y_{n}/y′_{n}]]]^{β} = {f̄(v) | v ∈ [ ; [S] ; ]^{β}}, where f is the function from the identifiers of type S to the identifiers of type S′ defined by [y_{1}/y′_{1}, …, y_{n}/y′_{n}] as follows:

f(id) = \{ \begin{matrix}y′_{i} & if y_{i} = id for some 1 ≤ i ≤ n \\ id & else \end{matrix}

and f̄ is the extension of f to bindings.

• [[S′ Decor]]^{β} = {{(x̄_{1}, v_{1}), …, (x̄_{n}, v_{n})} | {(x_{1}, v_{1}), …, (x_{n}, v_{n})} ∈ [[S′]]^{β}}. x̄_{i} is the identifier x_{i} decorated with Decor. For example, if Decor is ′ then x̄_{i} is x_{i}′.

Formulas The formulas in Sen_{SET} (Σ) are the usual first-order formulas built on the membership predicate and the equality between expressions.

P ::= true | false | E ∈ E | E = E | ¬P | P ∨ P | P ∧ P
| P ⇒ P | ∀S.P | ∃S.P

A formula P is well-formed in an environment ϵ = (Σ, (X, τ_{X})) if • P = E_{1} ∈ E_{2}, τ^{ϵ}(E_{2}) = P(τ^{ϵ}(E_{1})) and E_{1} and E_{2} are well-formed.

• P = (E_{1} = E_{2}), τ^{ϵ}(E_{1}) = τ^{ϵ}(E_{2}) and E_{1} and E_{2} are well-formed.

• P = ¬P′ and P′ is well-formed.

• P = P_{1} op P_{2} and P_{1} and P_{2} are well-formed for op ∈ {∨, ∧, ⇒}.

• P = ∀S.P′, S is well-formed and has type T and P′ is well-formed with respect to ϵ[T].

• P = ∃S.P′, S is well-formed and has type T and P′ is well-formed with respect to Σ[T]. Given a signature-morphism σ : Σ → Σ′ and a formula P well-formed with respect to ϵ = (Σ, (X, τ_{X})) then the formula σ̄(P) is well-formed with respect to (Σ′, (X, τ′_{X})), where τ′_{X} = τ_{X}; T (σ_{G}), and σ̄(P) is given by:

• σ̄(id) = id if id ∈ X, σ̄(id) = σ_{O}(id) if id ∈ O and σ̄(id) = σ_{G}(id) if id ∈ G \ O.

• σ̄((E_{1}, …, E_{n})) = (σ̄(E_{1}), …, σ̄(E_{n})).

• σ̄(E.i) = σ̄(E).i.

• σ̄(<x_{1} := E_{1}, …, x_{n} := E_{n}>) = <x_{1} := σ̄(E_{1}), …, x_{n} := σ̄(E_{n})>.

• σ̄(E.x) = σ̄(E).x.

• σ̄(E_{1}(E_{2})) = σ̄(E_{1})(σ̄(E_{2})).

• σ̄({E_{1}, …, E_{n}}) = {σ̄(E_{1}), …, σ̄(E_{n})}.

• σ̄({S • E}) = {σ̄(S) • σ̄(E)}.

• σ̄(P(E)) = P(σ̄(E)).

• σ̄(E_{1} × … × E_{n}) = σ̄(E_{1}) × … × σ̄(E_{n}).

• σ̄(x_{1} : E_{1}, …, x_{n} : E) = x_{1} : σ̄(E_{1}), …, x_{n} : σ̄(E_{n}).

• σ̄(S|P) = σ̄(S)|σ̄(P).

• σ̄(¬S) = ¬σ̄(S).

• σ̄(S_{1} op S_{n}) = σ̄(S_{1}) op σ̄(S_{n}) for op ∈ {∨, ∧, ⇒}.

• σ̄(∃S_{1}.S_{2}) = ∃σ̄(S_{1}).σ̄(S_{2}) and σ̄(∀S_{1}.S_{2}) = ∀σ̄(S_{1}).σ̄(S_{2}).

• σ̄(S \ [x_{1}, …, x_{n}]) = σ̄(S) \ [x_{1}, …, x_{n}].

• σ̄(S[x_{1}/y_{1}, …, x_{n}/y_{n}]) = σ̄(S)[x_{1}/y_{1}, …, x_{n}/y_{n}].

• σ̄(E_{1} ∈ E_{2}) = σ̄(E_{1}) ∈ σ̄(E_{2}).

• σ̄(E_{1} = E_{2}) = σ̄(E_{1}) = σ̄(E_{n}).

• σ̄(true) = true and σ̄(false) = false.

• σ̄(¬P) = ¬σ̄(P).

• σ̄(P_{1} op P_{2}) = σ̄(P_{1}) op σ̄(P_{2}) for op ∈ {∨, ∧, ⇒}.

• σ̄(∀S.P) = ∀σ̄(S).σ̄(P) and σ̄(∃S.P) = ∃σ̄(S).σ̄(P). Definition 9.11 (Sen_{SET}) The functor Sen_{SET} from Sign_{SET} to Set maps each signature Σ to its set of Σ-formulas and each signature morphism σ from Σ to Σ′ to the translation of Σ-formulas to Σ′-formulas given by σ̄.

Validity of a well-formed formula P in β = (A, A_{X}), β ⊧^{SET} P, is defined by:

• β ⊧^{SET} true.

• β ⊧^{SET} E_{1} ∈ E_{2} iff \begin{aligned}[ \\ [ & E_{1} & ] \\ & ] \end{aligned}^{β} ∈ \begin{aligned}[ \\ [ & E_{2} & ] \\ & ] \end{aligned}^{β}.

• β ⊧^{SET} E_{1} = E_{2} iff \begin{aligned}[ \\ [ & E_{1} & ] \\ & ] \end{aligned}^{β} = \begin{aligned}[ \\ [ & E_{2} & ] \\ & ] \end{aligned}^{β}.

• β ⊧^{SET} ¬P iff not β ⊧^{SET} P.

• β ⊧^{SET} P_{1} op P_{2} iff β ⊧^{SET} P_{1} op β ⊧^{SET} P_{2} for op ∈ {∨, ∧, ⇒}.

• β ⊧^{SET} ∀S.P iff β[v] ⊧^{SET} P for all v ∈ [ ; [S] ; ]^{β}.

• β ⊧^{SET} ∃S.P iff β[v] ⊧^{SET} P for some v ∈ [ ; [S] ; ]^{β}.

Definition 9.12 (Satisfaction) Given an signature Σ, a formula P which is well-formed with respect to (Σ, ({}, τ_{X})) and a Σ-structure A then A ⊧_{Σ}^{SET} P if (A, {}) ⊧^{SET} P.

Theorem 9.13 (The Institution SET ) The category Sign_{SET}, the functor Str_{SET}, the functor Sen_{SET} and the family of satisfaction relations given by ⊧_{Σ}^{SET} define the institution SET = ⟨Sign_{SET} , Str_{SET} , Sen_{SET} , ⊧^{SET} ⟩.

For SET to be an institution we have to show that the satisfaction condition holds. For the proof of the satisfaction condition we need that the value of a translated expression σ̄(E) in β = (A′, A′_{X}) is the same as the value of E in the σ-reduct of A′ and A′_{X}.

Lemma 9.14 Let A′ be a Σ′-structure, σ a signature morphism from Σ to Σ′ and E a wellformed expression with respect to Σ. Then

\begin{matrix}[ \\ [ & σ̄(E) & ] \\ ] \end{matrix}^{β′} = [ ; [E] ; ]^{β′|_{σ}}

where β′|_{σ} = (A′, A′_{X})|_{σ} is defined as (A′|_{σ}, A′_{X}).

Proof L. et Σ = (G, O, τ) and Σ′ = (G′, O′, τ′), σ = (σ_{G}, σ_{O}) be a signature morphism from Σ to Σ′ and A′ = (A′_{G}, A′_{O}) a Σ′-structure. We give the proof only for the less obvious cases.

Let E = id where id ∈ X then \begin{matrix}[ \\ [ & σ̄(id) & ] \\ ] \end{matrix}^{β′} = \begin{matrix}[ \\ [ & id & ] \\ ] \end{matrix}^{β′} = v where (id, v) ∈ A′_{X} and by the definition

of β′|_{σ} we have \begin{matrix}[ \\ [ & id & ] \\ ] \end{matrix}^{β′|_{σ}} = v.

Let E = id where id ∈ O then \begin{matrix}[ \\ [ & σ̄(id) & ] \\ ] \end{matrix}^{β′} = \begin{matrix}[ \\ [ & σ_{O}(id) & ] \\ ] \end{matrix}^{β′} = v where (σ_{O}(id), v) ∈ A′_{O}. Applying

the definition of σ-reduct we get (id, v) ∈ A′|_{σ} and thus \begin{matrix}[ \\ [ & id & ] \\ ] \end{matrix}^{β′|_{σ′}} = v.

If id is in G \ O then by the definition of signature morphisms we have σ(id) ∈ G′ \ O′ and

\begin{matrix}[ \\ [ & σ̄(id) & ] \\ ] \end{matrix}^{β′} = A′_{G}(σ_{G}(id)) = (A′|_{σ})(id) = \begin{matrix}[ \\ [ & σ̄(id) & ] \\ ] \end{matrix}^{β′|_{σ}} .

Let E = {S • E} then

\begin{matrix}[ \\ [ & σ̄(\{S • E\}) & ] \\ ] \end{matrix}^{β′} = \begin{matrix}[ \\ [ & \{σ̄(S) • σ̄(E)\} & ] \\ ] \end{matrix}^{β′}

= \{\begin{matrix}[ \\ [ & σ̄(E) & ] \\ ] \end{matrix}^{β′[v]} | v ∈ \begin{matrix}[ \\ [ & σ̄(S) & ] \\ ] \end{matrix}^{β′}\}

= {[ ; [E] ; ]^{β′[v]|_{σ}} | v ∈ [ ; [S] ; ]^{β′|_{σ}}}

= \begin{matrix}[ \\ [ & \{S • E\} & ] \\ ] \end{matrix}^{β′|_{σ}} .

For the last equation to hold we have to show that β′[v]|_{σ′} = (β′|_{σ})[v].

(A′, A′_{X})[v]|_{σ} = (A′, A′_{X}[v])|_{σ}
= (A′|_{σ}, A′_{X}[v])
= (A′|_{σ}, A′_{X})[v]
= ((A′, A′_{X})|_{σ})[v].

Let S = x_{1} : E_{1}, …, x_{n} : E_{n} then

\begin{matrix}[ \\ [ & σ̄(S) & ] \\ ] \end{matrix}^{β′} = \begin{matrix}[ \\ [ & x_{1} : σ̄(E_{1}), …, x_{n} : σ̄(E_{n}) & ] \\ ] \end{matrix}^{β′}

= \{\{(x_{1}, v_{1}), …, (x_{n}, v_{n})\} | v_{i} ∈ \begin{matrix}[ \\ [ & σ̄(E_{i}) & ] \\ ] \end{matrix}^{β′} , 1 ≤ i ≤ n\}

= \{\{(x_{1}, v_{1}), …, (x_{n}, v_{n})\} | v_{i} ∈ \begin{aligned}[ \\ [ & E_{i} & ] \\ & ] \end{aligned}^{β′|_{σ}} , 1 ≤ i ≤ n\}

= \begin{aligned}[ \\ [ & x_{1} : E_{1}, …, x_{n} : E_{n} & ] \\ & ] \end{aligned}^{β′|_{σ}} .

□

Theorem 9.15 (Satisfaction Condition) For all signature morphisms σ from Σ to Σ′ in Sign_{SET}, all structures A in Str_{SET} (Σ′) and formulas φ in Sen_{SET} (Σ) we have

A′|_{σ} ⊧^{SET} φ iff A′ ⊧^{SET} σ̄(φ).

Proof A. ssume that we are given a signature morphism σ : Σ → Σ′ and a Σ′-structure A′. Let φ be the formula E ∈ E′ from Sen_{SET} (Σ). We have A ⊧^{SET} σ̄(E ∈ E′) iff A ⊧^{SET}

σ̄(E) ∈ σ̄(E′) iff \begin{matrix}[ \\ [ & σ̄(E) & ] \\ ] \end{matrix}^{β} ∈ [[σ̄(E′)]]^{β}, where β = (A, \{\}). Now we have \begin{matrix}[ \\ [ & σ̄(E) & ] \\ ] \end{matrix}^{β} = [ ; [E] ; ]^{(A′|_{σ},\{\})}

and similar [[σ̄(E′)]]^{β} = [[E′]]^{(A′|_{σ},\{\})}. Thus we get \begin{matrix}[ \\ [ & σ̄(E) & ] \\ ] \end{matrix}^{β} ∈ [[σ̄(E′)]]^{β} iff \begin{matrix}[ \\ [ & σ̄(E) & ] \\ ] \end{matrix}^{(A′|_{σ},\{\})} ∈

[[σ̄(E′)]]^{(A′|_{σ},{})} iff A′|_{σ} ⊧^{SET} E ∈ E′.

The argumentation is similar for the other formulas. □

9.2 Abstract Machines in Z

In Z, schemas are used for modeling the state space, the initial states and the operations of abstract machines.

The state space of the counter is given by the following schema:

       Counter

c : N

and the initial state:

       Init
       Counter
       c = zero

Then the increment and decrement operation are given as

       Inc
       ΔCounter

c′ = succ(c)

and

       Dec
       ΔCounter

¬(c = zero) succ(c′) = c

where ΔCounter is the default notion for the schema that has as components the components of the state before and after the operation: ΔCounter = Counter ∧ Counter′.

Abstracting from the Z-syntax we can reformulate the above example in SL_{SET} as I_{Φ}Σ_{C} where

Σ_{C} = ({N}, {zero, succ, Counter, Init, Inc, Dec}, τ) with

• τ(zero) = N

• τ(succ) = P(N × N)

• τ(Counter) = τ(Init) = P(<c : N>)

• τ(Inc) = τ(Dec) = P(<c : N, c′ : N>)

The set of formulas Φ is the union of Φ_{C} and Φ_{N}, where Φ_{N} restricts the interpretation of N to be isomorphic to the set of natural numbers with 0 and the successor function, and Φ_{C} is the set:

            { Counter = c : N,

              Init = (Counter | c = zero),
              Inc = (Counter ∧ Counter′ | c′ = succ(c)),

              Dec = (Counter ∧ Counter′ | succ(c′) = c ∧ ¬(c = zero)) }

A possible model of I_{Φ}Σ_{C} is the Σ_{C}-structure A = (A_{G}, A_{O}), where A_{G}(N) = ℕ and

A_{O} = { (zero, 0), (succ, {(n_{1}, n_{2}) | n_{2} = n_{1} + 1, n_{1} ∈ ℕ, n_{2} ∈ ℕ }), (Counter, {(c, v) | v ∈ ℕ }), (Init, {(c, 0)}), (Inc, {{(c, v), (c′, v′)} | v′ = v + 1}), (Dec, {{(c, v), (c′, v′)} | v′ + 1 = v, v ≠ 0}) }

Let Σ = (G, O, τ) be a signature in SET . A schema-type

T = <x_{1} : T_{1}, …, x_{n} : T_{n}>

defines a signature Σ′ = (G, O ∪ {x_{1}, …, x_{n}}, τ),where τ′(x_{i}) = T_{i} and τ′(id) = τ(id) for id ∈ O.^{1}

Given a Σ-structure A = (A_{G}, A_{O}) then an element {(x_{1}, v_{1}), …, (x_{n}, v_{n})} of schema-type T defines a Σ′-structure A′ = (A_{G}, A_{O} ∪ {(x_{1}, v_{1}), …, (x_{n}, v_{n})}).

Definition 9.16 Given a signature Σ = (G, O, τ), a schema-expression S of type P(<x_{1} : T_{1}, …, x_{n} : T_{n}>) and a Σ-structure A = (A_{G}, A_{O}). Define an abstract datatype (Σ_{S}, M_{S}^{A}) by

• Σ_{S} = (G, O ∪ {x_{1}, …, x_{n}}, τ_{S}), where τ_{S}(x_{i}) = T_{i} for 1 ≤ i ≤ n and τ_{S}(id) = τ(id) for id ∈ O and

• M_{S}^{A} = {(A_{G}, A_{O} ∪ v_{S}) | v_{S} ∈ [ ; [S] ; ]^{((A_{G},A_{O}),{})}}.

This definition can be extended to abstract datatypes Sp = (Σ, M) in Adt_{SET} by taking the union of all M_{S}^{A} for A ∈ M:

Sp_{S} = (Σ_{S}, ⋃_{A∈M} M_{S}^{A}).

Since a specification of an abstract machine in Z consists of a schema for the state space, the initial states, and the operations, a specification of an abstract machine in Z can be also viewed as a collection of abstract datatypes for the state space, the initial states, and the operations.

In the example of the counter, let Σ = (G, O, τ), where G = {N}, O = {zero, succ}, τ(zero) = N and τ(succ) = P(N × N). Then the schema for the increment operation

                       (Counter ∧ Counter′ | c′ = succ(c)),

which is the same as

(c : N, c′ : N | c′ = succ(c)),

defines the abstract datatype Sp_{Inc} = (Σ_{Inc}, M_{Inc}), where Σ_{Inc} is the signature

({N}, {zero, succ, c, c′}, τ_{Inc})

with τ_{Inc}(c) = τ_{Inc}(c′) = N, τ_{Inc}(zero) = N and τ_{Inc}(succ) = P(N × N), and

M_{Inc} = \{(A_{G}, A_{O} ∪ \{(c, v), (c′, v′)\}) | v′ = \begin{matrix}[ \\ [ & succ(c) & ] \\ ] \end{matrix}^{((A_{G},A_{O}),\{\})} , (A_{G}, A_{O}) ∈ M\}.

Note that we get similar abstract datatypes when using RSL_{SET} to define the counter and translating them to abstract datatypes in Adt_{SET} (cf. Section 7.1).

Also the operations on schemas are similar to the operations found in SL_{SET}. Let Sp be an SL_{SET} expression with semantics (Σ, M). If

1Note that Σ′ is not a signature as defined in Definition 9.1 because {x_{1}, …, x_{n}} is not a subset of F since, for technical reasons, we had to require that the set of variable names and the set of identifier names are disjoint. However, we can assume that O′ is the set O ∪ {x̄_{1}, …, x̄_{n}} where the x̄_{i} are suitable renamings of x_{i} to symbols in F not occurring in O.

• S = x_{1} : E_{1}, …, x_{n} : E_{n} then [ [Sp] ]_{S} = \begin{matrix}[ \\ [ & I_{\{x_{i}∈E_{i}|1≤i≤n\}}T_{σ}Sp & ] \\ ] \end{matrix}, where σ is the inclusion

of Σ into Σ_{S}.

• S = S′|P then [ [Sp] ]_{S} = \begin{aligned}[ \\ [ & I_{\{P \}}Sp_{S′} & ] \\ & ] \end{aligned}.

• S = S_{1} ∧ S_{2} then [ [Sp] ]_{S} = \begin{aligned}[ \\ [ & T_{σ_{1}}Sp_{S_{1}} + T_{σ_{2}}Sp_{S_{2}} & ] \\ & ] \end{aligned}. The signature morphisms σ_{1} and σ_{2} are the inclusions of the signatures Σ_{S_{1}} and Σ_{S_{2}} into Σ_{S_{1}∧S_{2}}. This is needed because, in contrast to the union of abstract datatypes, the types of S_{1} and S_{2} are only required to be compatible in the union of S_{1} and S_{2}.

• S = S_{1} ∨ S_{2} then [ [Sp] ]_{S} = \begin{aligned}[ \\ [ & T_{σ_{1}}Sp_{S_{1}} ∨ T_{σ_{2}}Sp_{S_{2}} & ] \\ & ] \end{aligned}. The signature morphisms σ_{1} and σ_{2} are the same as defined for the union of schemas.

• S = S′ \ [x_{1}, .., x_{n}] then [ [Sp] ]_{S} = [[D_{σ}Sp_{S′}]], where σ is the inclusion of Σ_{S} into Σ_{S′}.

• S = S′[x_{1}/y_{1}, .., x_{n}/y_{n}] then [ [Sp] ]_{S} = [[T_{σ}Sp_{S′}]], where σ_{G} is the identity and σ_{O}(x) = y_{i}, if x = x_{i} for some i and σ_{O}(x) = x if x ≠ x_{i} for all i.

However, we do not have corresponding SL_{SET} operations for ¬S, S ⇒ S, ∀S.S and ∃S.S. While their semantics could be easily defined, for example, \begin{matrix}[ \\ [ & ¬(Σ, M) & ] \\ ] \end{matrix} = (Σ, \{m ∈ Str_{I}(Σ) | m ∉ M}), one would need additional proof rules for the entailment of specification, as in the case of disjunction (cf. Chapter 8).

There are some important differences between modeling the operations as schemas and as abstract datatypes. Defining the operations as schemas depends on the base institution to provide schemas. This fixes the institution to SET . In contrast, in the approach presented in this thesis, we have separated the logic for defining the operations of an abstract machine from the base institution. Thus our approach applies to any institution whose category of signatures is (finitely) cocomplete and whose structure functor preserves (finite) colimits. On the other side, since schemas are part of the institution SET , it is possible to reason within SET itself about the operations of an abstract machine. In our approach only the operations in RSL_{SET} can be used to refer to other operations.

Another difference is that expressions in RSL_{SET} carry information about the type of the relation. The type of an operation in the Z style specification of abstract machines is kept informal. Conventions, like the use of ΔCounter and descriptive text that surrounds a schema definition, provides this information.

9.3 Z-style specifications using LSL

The theory of relations, presented in the previous chapters, is based on a newly constructed institution R_{I} with respect to an, arbitrary exact institution I with a (finitely) cocomplete category of signatures. Then the language RSL_{I} is used to define relations. However, the problem with this approach is that RSL_{I} is an abstract language, which is intended mainly as a vehicle for more concrete languages to define their semantics in and for theoretical studies. Another problem is that no tools exist for RSL_{I}.

To address this problem we shall adopt a method used by the Z community for the specification of sequential systems [57]. The specification language Z itself almost has no language support for defining sequential system. It is a matter of convention and the explanations used in the text surrounding a Z schema, whether this schema is to be interpreted as a definition of a relation or the specification of a state space.

In the following, we shall use a similar approach based on the Larch Shared Language. The advantage is that we can use tools designed for the Larch Shared Language, like the Larch Shared Language checker and the Larch Prover to check our specifications and to prove properties. However, since some information, for example, whether a specification is meant as specifying a state space or defining a relation, is left implicit, the use of these tools is limited.

Note that we could have used any suitable specification language, that is, a specification language with loose semantics, like Pluss [8] or CASL [45].

That this approach is possible, is the result of the strong relationship between Adt_{R_{I}} and Adt_{I} established in Section 5.6.

Definition 9.17 An abstract datatype Sp = (Σ, M) from Adt_{I} is a relation of type Θ_{R} if there exists a relation R = (Θ_{R}, M_{R}) of type Θ_{R} = (D_{R}, Γ_{R}) in Adt_{R_{I}} and an Adt_{I}- morphism σ from ∐ Γ_{R}; Sig^{A} to Σ such that M|_{σ} = \overline{M}_{R}.

As an example we shall give the birthday book specification of Spivey [56], which we have discussed in Section 6.2.

The state of a birthday book is given by the predicate known, a boolean function, and the (total) function birthday, mapping the name of a person to his birthday. The value of birthday for a name n is arbitrary if known(n) is not true.

BirthdayBook : trait
   introduces
      known: Name → Bool
      birthday : Name → Date

The initial birthday book contains no entries.

InitBirthday : trait
   includes
      BirthdayBook
   asserts
      ∀ n:Name ¬ known(n)

The trait DeltaBirthdayBook introduces two copies of known and birthday, an unprimed copy for the state components before the operation and a primed copy for the state components after the execution of the operation. Any operation that wants to change the state of the birthday book includes DeltaBirthday.

DeltaBirthdayBook : trait
   includes
      BirthdayBook,
      BirthdayBook(known' for known,
                   birthday' for birthday)
DeltaBirthday is the colimit of the type <BirthdayBook × BirthdayBook>_{Env}.

In contrast, the trait ThetaBirthdayBook is included in the trait of all operations that do not want to change the state of the birthday book.

ThetaBirthdayBook : trait
   includes
      BirthdayBook,
      BirthdayBook(known' for known,
                   birthday' for birthday)
   asserts
      forall n:Name
         known'(n) ⇔ known(n);
         birthday'(n) = birthday(n)

The operation adding a new birthday to a birthday book is specified by the trait AddBirthday. The input parameters are the name of the person to add, name_{in}, and the birthday of that person, date_{in}. The operation is defined only when that person does not already have an entry in the birthday book.

AddBirthday : trait
   includes
      DeltaBirthdayBook
   introduces
      name_{in}:  Name
      date_{in}:  Date
   asserts
      forall n:Name
         ¬ known(name_{in});
         known'(n) ⇔ n = name_{in} ∨ known(n);
         birthday'(n) = (if n = name_{in}
                         then date_{in}
                         else birthday(n))

AddBirthday is a relation of type

           <[name_{in} : Name] × [date_{in}] × BirthdayBook × BirthdayBook>.

The FindBirthday operation returns for a given person with name name_{in} its birthday date_{out}. The inclusion of ThetaBirthdayBook guarantees that the state of the birthday book is not changed.

182  Z Specifications

FindBirthday : trait
includes
ThetaBirthdayBook
introduces
name_{in}:  Name
date_{out}: Date
asserts
equations
   known(name_{in});
   date_{out} = birthday(name_{in})

For a given date today_{in}, the Remind operation returns the set of persons whose birthday is

today_{in}.
Remind : trait
includes
ThetaBirthdayBook,
Set(Name,NameSet)
introduces
today_{in}: Date
cards_{out}: NameSet
asserts
forall n:Name
   n ∈ cards_{out} ⇔
      birthday(n) = today_{in} ∧ known(n)

10 Conclusion

In this thesis we have defined a framework for the specification of dynamic behavior of software systems. This framework is motivated by the state as algebra approach and the model-oriented language Z. From the state as algebra approach we have used the idea of modeling the environment and the state components as structures of an institution. However, in contrast to the state as algebra approach, states in our framework are modeled by structures from any suitable institution not only those having algebras as their structures. From Z we have used the idea that environment, state spaces, and relations between state spaces are specified using the same logic, and how more complex relations can be constructed from simpler ones by means of the schema calculus. However, we differ from Z in that our framework can be instantiated by different institutions while the approach of Z can only work because of the particular logical system used by Z.

We have defined a new institution R_{I}, which is based on an exact institution I with a cocomplete category of signatures. Abstract datatypes in R_{I} are relations between abstract datatypes from I; this means that a relation is a pair (Θ, M) consisting of a diagram Θ = (D, Γ : D → Adt_{I}) and a set M of families of structures m_{d} ∈ Mod^{A}(Γ(d)) for d ∈ D such that m_{d′}|_{Γ(f)} = m_{d} for each morphism f : d → d′ in D.

Most of the known institutions have a cocomplete category of signatures, and their structure functor preserves colimits. In addition, we have defined two new institutions, the institution LSL, which is a variant of equational logic with constraints, used to model the logical system of the Larch Shared Language, and the institution SET , which models the logical system of the specification language Z and which is based on set theory. Further, it is possible, by defining a new institution, to instantiate our framework with models of the state more appropriate to the problem domain. For example, one could define an institution whose structures model states having components that denote arrays and pointer structures.

We have shown that the category of signatures of R_{I} is cocomplete and that the structure functor of R_{I} preserves colimits. This implies, for example, that relations on complex states can be uniquely constructed by relations on simpler states. As an example consider two state spaces given by abstract datatypes Sp_{1} and Sp_{2} such that both are extensions of the abstract datatype Env. Further, let R_{1} be a relation of type <Sp_{1} × Sp_{1}>_{Env} and R_{2} be a relation of type <Sp_{2} × Sp_{2}>. Now we can form a state space Sp which consists of the components of Sp_{1} and Sp_{2} sharing the components of Env. Thus, Sp is the pushout of Sp_{1} and Sp_{2} with respect to Env. Then we can define the relation R of type <Sp × Sp>_{Env} acting as R_{1} on the state components from Sp_{1} and as R_{2} on the state components from Sp_{2} as the pushout of R_{1} and R_{2} with respect to the identity on Env. That this is always possible is a consequence of the fact that Sign_{R_{I}} is cocomplete; then the fact that Str_{R_{I}} preserves colimits implies that the pairs (A, A′) in R can be uniquely constructed from pairs (A_{1}, A′_{1}) in R_{1} and pairs (A_{2}, A′_{2}) in R_{2} as the amalgamated sums A = A_{1} +_{A_{0}} A_{2} and A′ = A′_{1} +_{A′_{0}} A′_{2}. Here, A_{0} is the environment that A_{1} and A′_{1} have in common and A′_{0} is the environment that A_{2} and A′_{2} have in common. Note that A_{0} and A′_{0} have to be the same environment to make the construction work.

The advantage of modeling relations as abstract datatypes in R_{I} is that we could reuse the institution independent theory of abstract datatypes. For example we could use the specification language SL_{I}, which is based on the operations impose, translate, derive, and union, as the foundation of the specification language RSL_{I} for the specification of relations. RSL_{I} is not intended to be a specification language used in practice, but as more practical specification languages, like CASL [45], can be defined in terms of the operations of SL_{I}, more practical specification languages for the specification of relations could be defined using the operations of RSL_{I}.

In this thesis we have added disjunction to the operations on abstract datatypes. The disjunction of two abstract datatypes over the same signature forms the union of their model classes. Disjunction was not treated before mainly because the disjunction of two abstract datatypes given by sets of formulas Φ_{1} and Φ_{2} cannot be represented by one set of formulas in every institution. This is only possible for restricted classes of sets of formulas and for certain logics, like finite sets of formulas and first-order logic. This is in contrast to the union of two abstract datatypes for which I_{Φ_{1}}Σ + I_{Φ_{2}}Σ is the same as I_{Φ_{1}∪Φ_{2}}Σ in any institution. While the usefulness of disjunction for the definition of classical abstract datatypes is questionable, this is not the case for the construction of relations because disjunction allows to combine relations defined on different domains to a relation defined on the union of these domains.

There are two ways of proving properties of relations and entailment of relations. The first way takes advantage of modeling relations as abstract datatypes because this allows us to apply the proof calculus for proving properties from abstract datatypes to prove properties from relations and to prove entailment between relations.

A second way is given by the translation tr of RSL_{I}-expressions to SL_{I}-expressions, which is defined in Section 7.1. One property of this translation is that it preserves entailment, that is, R ⊧^{R_{I}} φ if and only if tr(R) ⊧^{I} φ and, similarly, R ⊧^{R_{I}} R′ if and only tr(R) ⊧^{I} tr(R′). This makes it possible to reuse theorem provers for the institution I for the institution R_{I}.

Both strategies can be combined by first applying the rules of the proof calculus to reduce a goal R ⊧^{R_{I}} R′ into subgoals R_{1} ⊧^{R_{I}} φ_{1} to R_{n} ⊧^{R_{I}} φ_{n} and then proving tr(R_{i}) ⊧^{R_{I}} φ_{i} by using a theorem prover for I.

We have already discussed that RSL_{I} can be used as the basis for a more practical specification language for the specification of the dynamic behavior of software systems. However, there is a second way to use the results of this thesis to specify software systems. This way has the advantage that it can be used with any specification language whose semantics are abstract datatypes.

The idea is that each relation R = (Θ, M_{R}) in Adt_{R_{I}} corresponds to an abstract datatype (Σ_{cl}, M′_{R}) in Adt_{I} such that M_{R} and M′_{R} are isomorphic. This correspondence can be used to interpret an abstract datatype (Σ, M) with respect to I as a relation (Θ, M_{R}) provided that we know the type of the relation. We need to know the type of the relation because from Σ it is impossible to get the type of the relation back as there may be several relations having the same signature Σ_{cl} as the colimit of Γ_{R}; Sig^{A}. If we keep the type of a relation as an informal annotation with the specification of abstract datatypes in I, then we can use any specification language having abstract datatypes in I as the semantics of its specifications for the specification of the dynamic behavior of software systems. As an example of this style we have given in Section 9.3 a specification of the birthday book example of the Z-reference manual using the Larch Shared Language. Another example of this style can be found in Baumeister [6].

Note that this approach is similar to the way the dynamic behavior of software systems are specified in Z. In Z states and operations on states are both presented as schemata, which correspond to abstract datatypes (cf. Section 9.2); only naming conventions and the text surrounding a Z-schema determine whether a schema represents an operation or a state space.

10.1 Future Work

Since the results of this thesis are parameterized by any suitable institutions, we can apply our framework to all the other state as algebra approaches with the exception of Gurevich’s Abstract State Machines. We cannot apply our results directly to Gurevich’s Abstract State machines because the state of an Abstract State Machine is modeled as an unsorted algebra, and for the institutions of unsorted equational and first-order logic the structure functor does not preserve coproducts (cf. Diaconescu et al [17]), and thus it does not preserve arbitrary colimits, which is required by the construction of R_{I}. However, the structure functor preserves colimits of all diagrams D that have a unique bottom element, that is, D has an element ⊥ and for all objects d ≠ ⊥ in D there exists a morphism f : ⊥ → d in D. This is the type of diagrams we are mostly interested in because they are used in the type of relations of the form <Sp_{1} × ⋯ × Sp_{n}>_{Env}. Thus we could, in the construction of R_{I}, restrict ourself to types (D, Γ : D → Adt_{I}) where D has this bottom element. This allows a lot of the results in this thesis to be applied to Gurevich’s Abstract State Machines. However, modularity results, that is, that the category of signatures constructed in that way is cocomplete and that the structure functor preserves colimits, do not carry over. The problem here is that the colimit of a diagram of types which have a unique bottom element need not yield a signature (D_{cl}, Γ_{cl}) where D_{cl} has a unique bottom element.

One application of our results could be, for a particular instantiation of our framework, to extend RSL_{I} by additional operations, like the local function update of Gurevich or the elementary modifiers of the implicit state approach. Then the inference system has to be extended by special rules coping with these new operations. For example, if R is given by an update instruction f(t) := t′ in the style of Abstract State Machines, then one would get additional inference rules R ⊢ f′(t) = t′, R ⊢ x ≠ t ⇒ f′(x) = f(x), and R ⊢ g′(x) = g(x) for all function symbols in the state signature which are not f. However, the translation of RSL_{I}-expressions to SL_{I}-expression may not be possible anymore.

A closer look at the institution independent proof-calculus for entailment between abstract datatypes is needed, in particular, for entailments where the right side contains a derive operation. As we have seen in Section 7.4, this appears quite often when proving refinement, and proving them can get quite tedious. One possibility would be to encode RSL_{I} and its proof-calculus into a higher-order logic framework, for instance Isabelle [47], and make it parametric by a suitable encoding of the logical-system used to model the states.

What we could only touch in this thesis is a theory of abstract machines based on our approach (cf. Chapter 6). One problem is how to combine abstract machines, for example, use abstract machines as arguments to the operations of other abstract machines. In the current approach it is possible to pass the state of an abstract machine as an argument, but information hiding is lost because the operation has access to all the state components. Similarly, one would want to use abstract machines as state components. The modularity results allow us to use the state of another abstract machine as a sub-state of another, but again loosing encapsulation.

A Larch Traits

In the following we present the traits FiniteMap and Set, which are based on the traits SetBasics and DerivedOrders from the library of the Larch Shared Language. A description of this library can be found in the book about Larch by Guttag and Horning [34].

A.1 FiniteMap

FiniteMap (M, D, R): trait
% An M is a map from D's to R's.
introduces
{}: → M
update: M, D, R → M
apply: M, D → R
defined: M, D → Bool
asserts
M generated by {}, update
M partitioned by apply, defined
∀ m: M, d, d1, d2: D, r: R
  apply(update(m, d2, r), d1) ==
    if d1 = d2 then r else apply(m, d1);
  ¬ defined({}, d);
  defined(update(m, d2, r), d1) ==
    d1 = d2 ∨ defined(m, d1)
implies
Array1 (update for assign, apply for [],
        M for A, D for I, R for E)
converts apply, defined
  exempting ∀ d: D apply({}, d)

A.2 Set

Set (E, C): trait
% Common set operators
includes
SetBasics,
Integer,
DerivedOrders (C, ⊆ for ≤, ⊇ for ≥,

188  Larch Traits

               ⊂ for <, ⊃ for >)

introduces
∉ : E, C → Bool
delete: E, C → C
{}: E → C
 ∪ , ∩ , -: C, C → C
size: C → Int
asserts
∀ e, e1, e2: E, s, s1, s2: C
  e ∉ s == ¬ (e ∈ s);
  { e } == insert(e, {});
  e1 ∈ delete(e2, s) == e1 ≠ e2 ∧ e1 ∈ s;
  e ∈ (s1 ∪ s2) == e ∈ s1 ∨ e ∈ s2;
  e ∈ (s1 ∩ s2) == e ∈ s1 ∧ e ∈ s2;
  e ∈ (s1 - s2)  == e ∈ s1 ∧ e ∉ s2;
  size({}) == 0;
  size(insert(e, s)) ==
    if e ∉ s then size(s) + 1 else size(s);
  s1 ⊆ s2 == s1 - s2 = {}
implies
AbelianMonoid (∪ for ∘, {} for unit, C for T),
AC (∩, C),
JoinOp (∪, {} for empty),
MemberOp ({} for empty),
PartialOrder (C, ⊆ for ≤, ⊇ for ≥,
              ⊂ for <, ⊃ for >)
C generated by {}, {}, ∪
∀ e: E, s, s1, s2: C
  s1 ⊆ s2 ⇒ (e ∈ s1 ⇒ e ∈ s2);
  size(s) ≥ 0
converts
  ∈, ∉, {}, delete, size, ∪, ∩, -:C,C→C,

⊆, ⊇, ⊂, ⊃

A.3 SetBasics

SetBasics (E, C): trait
% Essential finite-set operators
introduces
{}: → C
insert: E, C → C
∈ : E, C → Bool
asserts
C generated by {}, insert
C partitioned by ∈
∀ s: C, e, e1, e2: E

A.4 DerivedOrder  189

  ¬ (e ∈ {});
  e1 ∈ insert(e2, s) == e1 = e2 ∨ e1 ∈ s
implies
InsertGenerated ({} for empty)
∀ e, e1, e2: E, s: C
  insert(e, s) ≠ {};
  insert(e, insert(e, s)) == insert(e, s);
  insert(e1, insert(e2, s)) ==
    insert(e2, insert(e1, s))
converts ∈

A.4 DerivedOrder

DerivedOrders (T): trait
% Define any three of the comparison operators,
% given the fourth
introduces
≤, ≥, <, >: T, T → Bool
asserts ∀ x, y: T
x < y == x ≤ y ∧ ¬ (x = y);
x ≥ y == y ≤ x;
x > y == y < x
implies
∀ x, y: T
  x ≤ y == x < y ∨ x = y
converts ≥, <, >
converts ≤, <, >
converts ≤, ≥, >
converts ≤, ≥, <

Bibliography

[1] Jean-Raymond Abrial. The B-Book. Assigning Programs to Meanings. Cambridge University Press, first edition, 1996.

[2] Jiri Adamek, Horst Herrlich, and Georg Strecker. Abstract and concrete categories. Wiley, 1990.

[3] Egidio Astesiano and Martin Wirsing. An introduction to ASL. Technical Report MIP– 8609, Universität Passau, May 1986.

[4] Egidio Astesiano and Elena Zucca. D-oids: a model for dynamic data–types. Mathematical Structures in Computer Science, 5(2):257–282, 1995.

[5] Michael Barr and Charles Wells. Category Theory for Computing Science. Prentice Hall, New York, 1990.

[6] Hubert Baumeister. Using algebraic specification languages for model-oriented specifications. Technical Report MPI-I-96-2-003, Max-Planck-Institut für Informatik, Saarbrücken, Germany, February 1996.

[7] J. A. Bergstra, J. Heering, and P. Klint. Module algebra. Journal of the ACM, 37(2):335– 372, April 1990.

[8] Michel Bidoit. Pluss, un langage pour le developement de specifications algebriques modulaires. PhD thesis, Université de Paris-sud, 1989.

[9] Michel Bidoit and Rolf Hennicker. Behavioural theories and the proof of behavioural properties. Theoretical Computer Science, 165(1):3–55, September 30 1996.

[10] Tomasz Borzyszkowski. Correctness of the logical system for structured specifications. In Francesco Parisi Presicce, editor, Recent Trends in Algebraic Development Techniques, 12 International Workshop, WADT ’97, June 1997, Selected Papers, pages 107–121, Tarquinia, Italy, June 1998. Springer.

[11] Ruth Breu. A normal form for structured algebraic specifications. Technical report, MIP, 1989.

[12] Stephen Brien and John Nicholls. Z base standard version 1.0. Oxford University Computing Laboratory Programming Research Group, November 30 1992.

[13] R. M. Burstall and J. A. Goguen. The semantics of Clear, a specification language, February 1980.

[14] María Victoria Cengarle. Formal Specifications with Higher-Order Parameterization. PhD thesis, Fakultät für Mathematik, Ludwig-Maximilians-Universität, München, 1994.

[15] Ingo Claßen, Hartmut Ehrig, and Dietmar Wolz. Algebraic specification techniques and tools for software development: the ACT approach. Number 1 in AMAST series in computing. World Scientific, London, 1993.

[16] P. Dauchy and M.-C. Gaudel. Algebraic specifications with implicit state, February 1994.

[17] Răzvan Diaconescu, Joseph Goguen, and Petros Stefaneas. Logical support for modularisation. In Gerard Huet and Gordon Plotikin, editors, Proceedings of a Workshop on Logical Frameworks, 1991. Revision of 24 March 1993.

[18] H. Ehrig, E. G. Wagner, and J. W. Thatcher. Algebraic constraints for specifications and canonical from results. In Proceeding of the 10th International Colloquium on Automata, Languages and Programming, number 154 in LNCS, pages 188–202. Springer, 1983.

[19] Hartmut Ehrig and Bernd Mahr. Fundamentals of Algebraic Specification 1: Equations and initial Semantics. Number 6 in EATCS Monographs on Theoretical Computer Science. Springer, 1985.

[20] Hartmut Ehrig and Fernando Orejas. Dynamic abstract data types, an informal proposal. Bulletin of the EATCS, 53:162–169, June 1994.

[21] Jorge Farrés-Casals. Verification in ASL and Related Specification Languages. PhD thesis, Department of Computer Science, The University of Edinburgh, July 1992. Published as technical reports ECS-LFCS-92-220 and CST-92-92.

[22] Loe M. Feijs and H. B. Jonkers. Formal Specification and Design, volume 35 of Cambridge tracts in theoretical computer science. Cambridge Univ. Press, Cambridge, 1992.

[23] Harald Ganzinger. Programs as transformations of algebraic theories (extended abstract). Informatik Fachberichte, 50:22–41, 1981.

[24] J. Goguen and J. Meseguer. Universal realization, persistent interconnection and implementation of abstract modules. In Proceedings, ICALP, number 140 in LNCS, pages 265–281. Springer, 1982.

[25] J. A. Goguen and R. Burstall. Institutions: Abstract model theory for specification and programming. Journal of the Association for Computing Machinery, 39(1):95–146, January 1992.

[26] Joseph Goguen and Grant Malcolm. A hidden agenda. Report CS97–538, University of California at San Diego, April 1997.

[27] Joseph A. Goguen and Răzvan Diaconescu. Towards an algebraic semantics for the object paradigm. In Hartmut Ehrig and Fernando Orejas, editors, Recent Trends in Data Type Specification, 9th Workshop on Specification of Abstract Data Types Joint with the 4th COMPASS Workshop, Selected Papers, Caldes de Malavella, Spain 1992, number 785 in LNCS, 1993.

[28] Joseph A. Goguen, Timothy Winkler, José Meseguer, Kokichi Futatsugi, and Jean-Pierre Jouannaud. Introducing OBJ. Technical report, SRI International, October 1993.

[29] Martin Große-Rhode. Specification of Transition Categories, An Approach to Dynamic Abstract Data Types. PhD thesis, Fachbereich 13 — Informatik, Technische Universität, Berlin, 1995.

[30] Martin Große-Rhode. Transition specifications for dynamic abstract data types. Applied Categorical Structures, 5:265–308, 1997.

[31] Alexandre Grothendieck. Catégories fibrées et descente. In Revêtements étales et groupe fondamental, Séminaire de Géométrie Algébraique du Bois-Marie 1960/61, Exposé VI. Institut des Hautes Études Scientifiques, 1963. Reprinted in Lecture Notes in Mathematics, Volume 224, Springer, 1971, pp. 145–194.

[32] Yuri Gurevich. Evolving algebras: An attempt to discover semantics. Bulletin of the EATCS, 43:264–284, February 1991.

[33] Yuri Gurevich. Evolving algebras 1993: Lipari guide. In Egon Börger, editor, Specification and Valication Methods, pages 7–36. Clarendon Press, Oxford, 1995.

[34] John V. Guttag and J. Horning. LARCH: Languages and Tools for Formal Specification. Texts and Monographs in Computer Science. Springer, New York, 1993.

[35] David Harel. Dynamic logic. In Dov M. Gabbay and Franz Guenthner, editors, Handbook of philosophical logic : vol. 2: extensions of classical logic, volume 165 of Synthese library, pages 497–604. Kluwer, Dordrecht, 1984.

[36] J. He, C. A. R. Hoare, and J. W. Sanders. Data refinement refined, resume. In Bernard Robinet and Reinhard Wilhelm, editors, ESOP ’86: European Symposium on Programming, Saarbrücken, number 213 in LNCS, pages 187–196. Springer, March 17–19 1986.

[37] Eric C. R. Hehner. A Practical Theory of Programming. Texts and Monographs in Computer Science. Springer, 1993.

[38] Rolf Hennicker, Martin Wirsing, and Michel Bidoit. Proof systems for structured specifications with observability operators. Theoretical Computer Science, 173(2):393–443, February 28 1996.

[39] C. A. R. Hoare. Proving correctness of data representations. Acta Informatica, 1:271– 281, 1972.

[40] Cliff B. Jones. Systematic Software Development Using VDM. Prentice Hall international series in computer science. Prentice Hall, New York, second edition, 1990.

[41] Thomas Lehmann and Jacques Loeckx. The specification language of OBSCURE. In Don Sannella and Andrzej Tarlecki, editors, Proceedings of the 5th Workshop on Recent Trends in Data Type specification, number 332 in LNCS, pages 131–153, Gullane, Scotland, September 1988. Springer.

[42] Jacques Loeckx, Hans-Dieter Ehrich, and Markus Wolf. Specification of Abstract Data Types. Wiley-Teubner, 1996.

[43] Saunders Mac Lane. Categories for the working mathematician. Graduated Texts in Mathematics. Springer, fourth edition, 1988.

[44] José Meseguer. General logics. technical report SRI-CSL-89-5, SRI International, March 1989.

[45] Peter D. Mosses. CoFI: The common framework initiative for algebraic specification and development. In Michel Bidoit and Max Dauchet, editors, TAPSOFT ’97: Proceedings of the Seventh Joint Conference on Theory and Practice of Software Development, 7th International Joint Conference CAAP/FASE, number 1214 in LNCS, Lille, France, April 1997. Springer.

[46] Tobias Nipkow. Non-deterministic data types: Models and implementation. Acta Informatica, 22:629–661, 1986.

[47] Lawrence C. Paulson. Isabelle: a generic theorem prover; with contributions by Tobias Nipkow. Number 828 in LNCS. Springer, Berlin, 1994.

[48] H. Reichel. Partial algebras — a sound basis for structural induction. In P. Burmeister, B. Ganter, C. Herrman, K. Keimel, W. Poguntke, and R. Wille, editors, Universal Algebra and its links with logic, algebra, combinatorics and computer science. Proceedings of the ‘25. Arbeitstagung über Allgemeine Algebra’, R&E: research and exposition in mathematics, pages 230–240. Heldermann Verlag, Berlin, Darmstadt, 1983.

[49] H. Reichel. Software specification by behavioural canons. TU Magdeburg, 1986.

[50] Donald Sannella and Andrzej Tarlecki. Specifications in an arbitrary institution. Information and Computation, 76(2/3):165–210, February/March 1988.

[51] Donald Sannella and Andrzej Tarlecki. Toward formal development of programs from algebraic specifications: Implementation revisited. Acta Informatica, 25:233–281, 1988.

[52] Donald Sannella and Andrzej Tarlecki. Essential concepts of algebraic specification and program development. Formal Aspects of Computing, 9:229–269, 1997.

[53] Donald Sannella and Martin Wirsing. A kernel language for algebraic specification and implementation. In M. Karpinski, editor, Colloquium on Foundations of Computation Theory, number 158 in LNCS, pages 413–427, Berlin, 1983. Springer.

[54] Donald Sannella and Martin Wirsing. Specification languages. In E. Astesiano, H.-J. Kreowski, and B Krieg-Brückner, editors, Algebraic Foundations of Systems Specifications, chapter 7. Chapman and Hall, September 15th 1995. draft.

[55] Oliver Schoett. Data Abstraction and the Correctness of Modular Programming. PhD thesis, University of Edinburgh, 1986.

[56] J. M. Spivey. Understanding Z: A Specification Language and its Formal Semantics, volume 3 of Cambridge tracts in theoretical computer science. Cambridge Univ. Press, Cambridge, GB, repr. 1992 edition, 1988.

[57] J. Michael Spivey. The Z Notation: A Reference Manual. International series in computer science. Prentice Hall, New York, 2nd edition, 1992.

[58] A. Tarlecki, R. Burstall, and J. Goguen. Some fundamental algebraic tools for the semantics of computation, Part 3: Indexed categories. Theoretical Computer Science, 91:239–264, 1991.

[59] Roel Wieringa. Equational specification of dynamic objects. Technical Report 91-1, Faculty of Mathematics and Computer Science, Vrije Universiteit Amsterdam, 1991.

[60] Roel J. Wieringa. A formalization of objects using equational dynamic logic. Technical Report 91-2, Faculty of Mathematics and Computer Science, Vrije Universiteit Amsterdam, 1991.

[61] Martin Wirsing. Structured specifications: Syntax, semantics and proof calculus. In Friedrich L. Bauer, Wilfried Brauer, and Helmut Schwichtenberg, editors, Logic and algebra of specification: proceedings of the NATO Advanced Study Institute on Logic and Algebra of Specification, Marktoberdorf, Germany, July 23-August 4, 1991, number 94 in NATO ASI series, pages 411–442. Springer, 1992.