Table Of ContentLecture Notes ni
Computer Science
Edited yb .G Goos dna .J Hartmanis
160
ehT ATOI gnimmargorP metsyS
A Modular gnimmargorP tnemnorivnE
Edited yb .R amijakaN dna .T asauY
galreV-regnirpS
nilreB Heidelberg New York oykoT 1983
Editorial Board
D. Barstow W. 8rauer .P Brinch Hansen D. Gries D. Luckham
C. Moter A. Pnueli G. Seegm{Jller J. Stoer N. Wirth
Editors
Reiji Nakajima
Taiichi Yuasa
Research Institute for Mathematical Sciences
Kyoto University, Kyoto, Japan
CR Subject Classifications (1982): D.2.6, D.2.4, D.2.2, D.2.1, D.3.3, D.3.4,
E3.1, 1.2.3
ISBN 3-540-12693-7 Springer-Vertag Berlin Heidelberg New York Tokyo
ISBN 0-387-12693-? Springer-Vedag New York Heidelberg Berlin Tokyo
subject is work This ot .thgirypoc {tA rights ,devreser era rehtehw eht the of part or whole lairetam
is ,denrecnoc of those specifically ,noitalsnart reprinting, esu-er of ,snoitartsulli ,gnitsacdaorb
noitcudorper yb gniypocotohp enihcam ro similar ,snaem dna egarots data in .sknab rednU
§ the of 54 namreG Copyright waL copies where era edam private than other for ,esu is fee a
elbayap to tfahcsllesegsgnutrewreV" ,"troW .hcinuM
© yb gadeV-regnirpS Berlin Heidelberg 3891
detnirP in ynamreG
gnitnirP dna Beltz binding: ,kcurdtesffO .rtsgreBlhcabsmeH
012345-0413/5412
LIST OF AUTHORS
Tatsuya Hagino
Department of Computer Science
University of Edinburgh
Michio Honda
College of Economics
Kagawa University
Akihiko Koga
Research Institute for Mathematical Sciences
Kyoto University
Keiji Kojima
General Research Laboratory
Hitachi Ltd.
Reiji Nakajima
Research Institute for Mathematical Sciences
Kyoto University
Etsuya Shlbayama
Department of Information Science
Tokyo Institute of Technology
Taiichi Yuasa
Research Institute for Mathematical Sciences
Kyoto University
CONTENTS
Introduction .....................................................
Part .I Basic Concepts and Design Principles
Chapter 1. Language, Logical Foundation, Verification ......... 4
1.1 Introduction ........................................... 4
1.2 Specification Structures ............................... 6
1.3 Implementation Structures .............................. 11
1.4 Translating 'Abstract Axioms' into 'Concrete Axioms' ... 14
1.5 Verification Procedure ................................ 18
1.6 Type-Parameterization .................................. 23
Chapter 2. System Supports for Modular Programming ............ 3O
2.1 Introduction ........................................... 3O
2.2 Interactive Modular Programming ........................ 13
2.2.1 Detection and Correction of Syntactic Errors ...... 33
2.2.2 Syntax-directed Module Editing .................... 34
2.2.3 Maintaining Interface Consistency ................. 35
2.3 Separate Processing of Modules .......................... 4O
2.4 Formal Verification and Specification
Integrated into the IOTA System ..................... 14
2.4.1 Virtual Modules ................................... 14
2.4.2 Formal Specification and Program Development ...... 44
2.5 Supports for Cooperative Program Development ........... 45
Chapter 3. Strategies and Techniques for Interactive Proof .... 48
3.1 Introduction ........................................... 48
3.2 Effective Combination
of Interactive and Automatic Mechanisms ............. 5O
3.3 Module-wise Development
of Reduction and Simplification Rules ............... 52
3.4 Theory-focusing ........................................ 53
3.5 Theory Extractions ..................................... 56
3.6 Subformula Reductions .................................. 57
Part II. System Description and Implementation Issues
Chapter 4. Supports for Building Modules, Modulebase .......... 16
4.1 Introduction ........................................... 16
4.2 Interactive Creation and Modification of Modules ....... 62
4.2.1 The Text Editor and Syntactic Analysis ............ 63
4.2.2 Semantic Analysis ................................. 64
4.2.3 The Syntax-directed Editor ........................ 66
4.3 Supports for interface Modification .................... 67
4.4 Virtual Modules ........................................ 68
4.5 The Modulebase Management System ....................... 70
lV
Chapter 5- Language Processing ................................ 72
5.1 Introduction ........................................... 72
5.2 Information on Actual Type Parameters .................. 73
5.3 Runtime Linkage of Type Descriptions ................... 77
Chapter 6. Verification System ................................ 8O
6.1 Introduction ........................................... 8O
6.2 Concrete Axioms ........................................ 82
6.2.1 Generation of Verification Conditions ............. 82
6.2.2 Generation of Termination Conditions .............. 84
6.3 Concrete Axioms for Recursive Functions ................ 87
6.3.1 Generation of Verification Conditions ............. 87
6.3.2 Generation of Termination Conditions .............. 19
6.3.3 Restriction to Domain Specifications .............. 19
6.4. Information Management ................................ 93
6.4.1 Difficulties of the Verification System ........... 93
6.4.2 Overcoming the Difficulties ....................... 95
6.5. Virtual Modules ....................................... 97
Chapter 7. Proof System ....................................... 99
7.~ Introduction ........................................... 99
7.2 Reduction Mechanisms ................................... 100
7.2.1 Reduction Rules ................................... 100
7.2.2 Assignable Variables .............................. 102
7.2.3 Resolution and Simplifiers ........................ 104
7.3 Interactive Development of Reduction Mechanisms ........ 106
7.3.1 Development of Reduction Rules .................... 106
7.3.2 Reduction Procedures .............................. 107
Chapter 8. Supports for Cooperative Modular Programming ....... 109
8.1 Introduction ........................................... 109
8.2 Flow of Information among Modulebases .................. 110
8.3 Module Distribution and Update ......................... 110
8.4 Information Hiding ..................................... 111
8.5 Consistency Checks at Loading Time ..................... 112
Part III. Program Development with the IOTA System
Chapter 9. KWIC Example ....................................... 11 4
9.1 Problem ................................................ 114
9.2 A Solution in the Language IOTA ........................ 114
9.3 Overview of the Script ................................. 123
9.4 Script ................................................. 126
9.4oi Developer session ................................. 127
9.4.2 Debugger session .................................. 135
9.4.3 Using virtual modules ............................. 137
9.4.4 Verifier session .................................. 141
9.4.5 Job Manager session ............................... 171
9.4.6 Using Executor ................................... 174
IIV
Appendix
I. Language Syntax .......................................... 176
II. Built-in Modules ......................................... 185
III. Formsl Eules snd Semsntics ............................... 191
IV. Structured Approach to Pointer Data Types ................ 198
Bibliography ..................................................... 214
Introduction
This monograph describes the work of the project of 10TA which began
in 1976 and was completed in 1983. The initial motivation of the work
derived from an attempt to formalize the concepts of abstraction and
to develop a mechanizable verification method for programming with
modules. The scope of the project later extended to include the
design of a programming and specification language IOTA for modular
programming, and then to develop a total programming system.
The language IOTA supports modular programming with abstraction
and parameterization mechanisms, and module specification in a
many-sorted first order logic. An informal introduction to the
language is given in Chapter ,I together with a formal view of the
program development with the language. A formal definition of the
language is presented in Appendices.
The IOTA system is a modula~ p~og~amming system which is intended
to providean integrated environment to enhance the goal of modular
programming. One of its most important design objectives is to enable
the programmer to concentrate on a single module at a time. Although
the interfaces between modules are supposed to be kept minimal not to
increase the complexity of the problem, objects belonging to different
modules are related with one another. Experiences with some
interactive LISP systems suggests that a module should be able to
processed, debugged and/or verified, independently, without waiting
for completion of other modules immediately after its creation. By
putting together thus constructed reliable modules, a reliable
software can be efficiently and naturally generated.
The IOTA system is constituted of five major subsystems:
Developer, Debugger, Verifier, Prover, and Executor. These subsystems
are highly integrated into an interactive system over a database of
modules (modulebase) which maintains ail information necessary for
each subsystem. The organization of the modulebase is given in
Chapter 6.
\,
: data flow
The Developer is the main interface between the user and the system~
Modules are input and modified with the Developer. When input, the
source text of a module is analyzed both syntactically and
semantically, translated into an inner representation, and stored into
the modulebaseo Modifications on modules are proceeded directly on
the inner representation through the Developer. In addition, the
Developer provides the programmer with various information necessary
to develop modules° The design principles and the system description
of the Developer are presented in Chapters 2 and 4, respectively. The
Debugger is an abstraction-oriented dynamic debugging aids.
The Verifier is an interactive verification system specially
designed for modular program development. It also manages information
concerning ongoing verification and, with help of the Prover, verifies
that the program realization of each module meets its specification.
Chapter I introduces a formalization of abstraction concepts as a
basis for module verification, and presents the verification method
which is implemented by the Verifier. Chapter 2 includes discussion
on the role of the verification and specification embedded in the
whole programming environment. The detailed behavior of the Verifier
is presented in Chapter 6.
The Prover is an interactive proof system for a many-sorted
first-order logic° Chapter 3 discusses the major difficulties with
machine proofs for realistic module verification and suggests a
solution which is adopted in the Prover as its proof strategies. The
features of the Prover are given in Chapter 7.
The Executor generates executable codes from the inner
representation of each module, loads them, and executes them. The
main implementation issue with this subsystem is separate processing
of modules, especially of those which are type-parameterized. The
solution in IOTA is discussed in Chapter 5-
While these subsystems work on a single modulebase, there is an
inter-modulebase utility system called the Job Manager, which supports
cooperation of more than a single programmers by managing data
transmission between multiple modulebases. The details of its
functions are presented in Chapter 8.
In Chapter 9, we show how we solve a problem in the language IOTA
and how the IOTA system supports development, verification, and
execution of modules.
The IOTA system currently runs on DECSystem 20 and M-series
(IBM-compatible machines by Fujitsu and Hitachi). Transplantations to
VAX-11 and Eclipse-MV are planned. Further information is available
from the editors.
Acknowledgement
The editors thank Tatsuyuki Akiyama, Makoto Murata, Hayao
Nakahara and Takashi Sakuragawa for their contribution to the
project.
Chapter .I Language, Logical Foundation, Verification
Reiji Nakajima
1.1 Introduction
The methodology of modular programming has been proven highly useful
to increase software reliability. A number of works have been shown
that writing programs in hierarchical structures with modularity by
the use of abstraction can ease difficulties in program specification
and reduce complexities involved in program validation.
Abstractions - data and procedural abstractions - used in modular
programming are characterized by the rigourous distinction between the
specification structures and the implementation structures. Several
proposals have been made as to techniques for abstraction
specifications In order to eliminate ambiguity and mechanize
processing, it is advantageous to choose formal specification
techniques with well-defined syntax and semantics such as axiomatic
approaches.
With an axiomatic specification method, specifications are given
in terms of formulas in a certain formal system. Therefore if we
focus on the specification structures, to give a program is to
determine a theory in the formal system in which the specifications
are written. Also program development can be regarded as a process of
extending theories in the formal system. In this chapter we discuss
program structuring, specification and verification with the
programming and specification language IOTA with which one can
modularly and hierarchically build up theories in a deviation of
many-sorted first order logic for specification and write their
implementation in an Algol-like syntax.
The first order logic is theoretically well established and its
understanding does not require much mathematical discipline
(cf. initial al6ebra approach [e.g. 6,14]). Besides the choice of
specification methods is by no means independent of the style of the
program to be specified, especially when we consider program
verification. Predicate logic should be a suitable specification
