## Invariants, Bisimulations and the Correctness of Coalgebraic Refinements (1997)

Venue: | Techn. Rep. CSI-R9704, Comput. Sci. Inst., Univ. of Nijmegen |

Citations: | 12 - 4 self |

### BibTeX

@INPROCEEDINGS{Jacobs97invariants,bisimulations,

author = {Bart Jacobs},

title = {Invariants, Bisimulations and the Correctness of Coalgebraic Refinements},

booktitle = {Techn. Rep. CSI-R9704, Comput. Sci. Inst., Univ. of Nijmegen},

year = {1997},

pages = {276--291}

}

### OpenURL

### Abstract

. Coalgebraic specifications are used to formally describe the behaviour of classes in object-oriented languages. In this paper, a general notion of refinement between two such coalgebraic specifications is defined, capturing the idea that one "concrete" class specification realises the behaviour of the other, "abstract" class specification. Two (complete) proof-techniques are given to establish such refinements: one involving an invariant (a predicate that is closed under transitions) on the concrete class, and one involving a bisimulation (a relation that is closed under transitions) between the concrete and the abstract class. The latter can only be used if the abstract class is what we call totally specified. Parts of the underlying theory of invariants and bisimulations in a coalgebraic setting are included, involving least and greatest invariants and connections between invariants and bisimulations. Also, the proof-principles are illustrated in examples (which are fully formalise...

### Citations

1398 |
A Calculus for Communicating Systems
- Milner
- 1980
(Show Context)
Citation Context ...R T2 (x 2 ; y 2 )g R T A = Qshev ffis\Theta id; ev ffis0 \Theta idi (R T ) = f(f 1 ; f 2 ) j 8a 2 A R T (f 1 (a); f 2 (a))g: Bisimulations have received a lot of attention in process theory (see e.g. =-=[22]-=-), but also in coalgebra, see e.g. [1, 26, 27]. The greatest bisimulation on two coalgebras is usually written as $. It captures behavioural indistinguishability. A standard result is that elements of... |

1154 | Temporal and Modal Logic
- Emerson
- 1990
(Show Context)
Citation Context ... P , and of P \Gamma as the predicate of states which are "direct successors" of states satisfying P . Briefly, P + is NextTime P (or flP ), and P \Gamma is LastTime P from temporal logic 5 =-=(see e.g. [3]-=-). Notice that we leave the dependence on ff implicit. (ii) Call the predicate P ` X an (ff-)invariant if P ` P + , or equivalently, if P \Gamma ` P . The equivalence mentioned in (ii) holds because P... |

421 |
Proof of correctness of data representations
- Hoare
(Show Context)
Citation Context ... 5 Refinements with invariant and bisimulation proofs A refinement establishes a relation between two specifications. Usually one says that an abstract specification is refined by a concrete one, see =-=[10, 23, 4]-=- (and also Section 2). This means that the behaviour that is specified in the abstract specification can be realised by the concrete specification. The latter often contains more details about how to ... |

316 | Universal coalgebra: a theory of systems
- Rutten
(Show Context)
Citation Context ...gebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, transition systems and hybrid systems, see e.g. =-=[27, 20, 11]-=-. A coalgebraic specification (as developed in [13]) formally captures several crucial aspects of classes in object-oriented languages: it consists of a (hidden) state space (typically written as X) t... |

214 | PVS: Combining specification, proof checking, and model checking
- Owre, Rajan, et al.
- 1996
(Show Context)
Citation Context ... in a precondition-effect like style. (2) On the other hand, it is also relatively straightforward to describe coalgebraic specifications in a formal (logical) system, like that of the proof-tool PVS =-=[24]-=-. The two main refinement results in this paper (Propositions 5.4 and 6.1) have been fully checked 1 in PVS. This requires some work, but is in principle not difficult. The paper is organised as follo... |

204 |
An algebraic definition of simulation between programs
- MILNER
- 1971
(Show Context)
Citation Context ... 5 Refinements with invariant and bisimulation proofs A refinement establishes a relation between two specifications. Usually one says that an abstract specification is refined by a concrete one, see =-=[9, 21, 4]-=- (and also Section 2). This means that the behaviour that is specified in the abstract specification can be realised by the concrete specification. The latter often contains more details about how to ... |

200 |
Abstraction and Specification in Program Development
- Liskov, Atkinson, et al.
- 1981
(Show Context)
Citation Context ...science. For example, as loop invariants in correctness proofs in the style of Floyd and Hoare. But also in automata-based verification, see e.g. [19]. And they occur in an object-oriented setting in =-=[18] in the fo-=-rm of "representation invariants" for implementations of data abstractions in CLU. There is some variation in what precisely constitutes an invariant: it can be (1) a predicate which is clos... |

164 |
A final coalgebra theorem
- Aczel, Mendler
- 1989
(Show Context)
Citation Context ...of its objects is not fully determined by the specification. class spec: Abstract methods: val: X \Gamma! R inc: X \Gamma! X assertions: s:inc:val 2 [s:val + 3 4 ; s:val + 5 4 ] R creation: new:val 2 =-=[0; 1]-=- R end class spec class spec: Concrete methods: val: X \Gamma! R inc: X \Gamma! X dec: X \Gamma! X assertions: s:dec:val 2 [s:val \Gamma 5 4 ; s:val \Gamma 3 4 ] R s:val ! 0 ` s:inc:val 2 [s:val + 1 2... |

96 |
An approach to object semantics based on terminal co-algebras
- Reichel
- 1995
(Show Context)
Citation Context ... F.3.2, D.1.5 (CR'91). 1 Introduction This paper is part of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see =-=[25, 13, 10, 12, 14, 5, 6]-=-, building on earlier work [29, 2, 15]. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, tran... |

70 | Structural induction and coinduction in a fibrational setting
- Hermida, Jacobs
- 1998
(Show Context)
Citation Context ...ctor T . Polynomial functors T as defined above gives rise to two adjoint operations on predicates: P(X) (\Gamma) T ,, ? P(T (X)) (\Gamma) T The operation (\Gamma) T is written as Pred(T )(\Gamma) in =-=[8, 11, 9]-=-, but here we choose to use a shorter notation with superscripts. Its left adjoint operation (\Gamma) T a (\Gamma) T is new. We shall 1 There are at least two reasonable additional clauses imaginable,... |

70 | Objects and classes, co-algebraically
- Jacobs
- 1996
(Show Context)
Citation Context ... F.3.2, D.1.5 (CR'91). 1 Introduction This paper is part of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see =-=[25, 13, 10, 12, 14, 5, 6]-=-, building on earlier work [29, 2, 15]. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, tran... |

48 |
Forward and backward simulations. I. Untimed systems
- Lynch, Vaandrager
- 1995
(Show Context)
Citation Context ...ction 3. Invariants have a long tradition in computer science. For example, as loop invariants in correctness proofs in the style of Floyd and Hoare. But also in automata-based verification, see e.g. =-=[19]. And they-=- occur in an object-oriented setting in [18] in the form of "representation invariants" for implementations of data abstractions in CLU. There is some variation in what precisely constitutes... |

48 | On the foundations of final semantics: nonstandard sets, metric spaces, partial orders
- Rutten, Turi
- 1993
(Show Context)
Citation Context ...heta id; ev ffis0 \Theta idi (R T ) = f(f 1 ; f 2 ) j 8a 2 A R T (f 1 (a); f 2 (a))g: Bisimulations have received a lot of attention in process theory (see e.g. [22]), but also in coalgebra, see e.g. =-=[1, 26, 27]-=-. The greatest bisimulation on two coalgebras is usually written as $. It captures behavioural indistinguishability. A standard result is that elements of the state spaces of two arbitrary T -coalgebr... |

44 |
Final algebra semantics and data type extensions
- Wand
- 1979
(Show Context)
Citation Context ...art of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see [25, 13, 10, 12, 14, 5, 6], building on earlier work =-=[29, 2, 15]-=-. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, transition systems and hybrid systems, see... |

37 |
Algebraic specifications of data types: a synthetic approach
- Lehmann, Smyth
- 1981
(Show Context)
Citation Context ...l be given below. 3.1. Lemma. These newly defined predicates satisfy 3 The polynomial functors T on Sets that we use here, all have a terminal coalgebra, which can be obtained via standard techniques =-=[17, 28]-=- as limit of the chain 1 / T (1) / T 2 (1) / \Delta \Delta \Delta. See [13] for a concrete description of the terminal coalgebras of the kind of functors used below. 4 In earlier work [7, 10, 8] the f... |

37 |
The category theoretic solution of recursive domain equations
- Smyth, Plotkin
(Show Context)
Citation Context ...l be given below. 3.1. Lemma. These newly defined predicates satisfy 3 The polynomial functors T on Sets that we use here, all have a terminal coalgebra, which can be obtained via standard techniques =-=[17, 28]-=- as limit of the chain 1 / T (1) / T 2 (1) / \Delta \Delta \Delta. See [13] for a concrete description of the terminal coalgebras of the kind of functors used below. 4 In earlier work [7, 10, 8] the f... |

30 | Mongruences and cofree coalgebras
- Jacobs
- 1995
(Show Context)
Citation Context ... and verified in pvs). 1 Introduction This paper is part of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see =-=[26, 14, 11, 13, 15, 5, 6]-=-, building on earlier work [30, 2, 17]. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, tran... |

28 | Proof of correctness of object representation. in
- Goguen, Malcolm
- 1994
(Show Context)
Citation Context ... and verified in pvs). 1 Introduction This paper is part of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see =-=[26, 14, 11, 13, 15, 5, 6]-=-, building on earlier work [30, 2, 17]. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, tran... |

27 | Inheritance and cofree constructions
- Jacobs
- 1996
(Show Context)
Citation Context ... F.3.2, D.1.5 (CR'91). 1 Introduction This paper is part of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see =-=[25, 13, 10, 12, 14, 5, 6]-=-, building on earlier work [29, 2, 15]. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, tran... |

23 | Final data types and their specification - Kamin - 1983 |

20 |
Parametrized Data Types Do Not Need Highly
- Arbib, Manes
- 1982
(Show Context)
Citation Context ...art of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see [26, 14, 11, 13, 15, 5, 6], building on earlier work =-=[30, 2, 17]-=-. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, transition systems and hybrid systems, see... |

17 | Proof principles for datatypes with iterated recursion
- Hensel, Jacobs
- 1997
(Show Context)
Citation Context ...t adjoint operation (\Gamma) T a (\Gamma) T is new. We shall 1 There are at least two reasonable additional clauses imaginable, allowing (finite) powersets, and fixed points of existing functors (see =-=[7]-=- for the latter); such extensions are not needed for what follows. 2 The polynomial functors T on Sets that we use here, all have a terminal coalgebra, which can be obtained via standard techniques [1... |

14 |
A algebraic approach to refinement
- Goguen
- 1990
(Show Context)
Citation Context ... 5 Refinements with invariant and bisimulation proofs A refinement establishes a relation between two specifications. Usually one says that an abstract specification is refined by a concrete one, see =-=[10, 23, 4]-=- (and also Section 2). This means that the behaviour that is specified in the abstract specification can be realised by the concrete specification. The latter often contains more details about how to ... |

12 | Verification and specification of concurrent programs
- Lamport
- 1994
(Show Context)
Citation Context ...tions and holds for all initial states. Clearly, (3) implies (2) and (2) implies (1). Invariants are well-established as a proof-method for refinements (or implementations) between automata, see e.g. =-=[16]-=- for a discussion. Here we extend this approach to a coalgebraic setting, thereby giving it a firm semantical basis. The present work on refinement, with its invariant and bisimulation proof-principle... |

12 |
Formal verification of data type refinement — theory and practice
- Nipkow
(Show Context)
Citation Context ...chnical, and readers may wish to first have a look at the definition of refinement and the associated proof-principles in Section 5. In the final Section 6 we describe a non-trivial application (from =-=[23]) in which a memory -=-specification is refined to a specification of a memory with a cache. 2 An illustration We present a very simple example of a "concrete" class specification, refining an "abstract"... |

10 |
An extended abstract of a hidden agenda
- Goguen, Malcolm
- 1996
(Show Context)
Citation Context ... and verified in pvs). 1 Introduction This paper is part of a recent research line of applying coalgebraic and coinductive notions and techniques in the formalisation of object-oriented concepts, see =-=[26, 14, 11, 13, 15, 5, 6]-=-, building on earlier work [30, 2, 17]. Coalgebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, tran... |

9 | B.: An algebraic view of structural induction
- Hermida, Jacobs
- 1995
(Show Context)
Citation Context ...ctor T . Polynomial functors T as defined above gives rise to two adjoint operations on predicates: P(X) (\Gamma) T ,, ? P(T (X)) (\Gamma) T The operation (\Gamma) T is written as Pred(T )(\Gamma) in =-=[8, 11, 9]-=-, but here we choose to use a shorter notation with superscripts. Its left adjoint operation (\Gamma) T a (\Gamma) T is new. We shall 1 There are at least two reasonable additional clauses imaginable,... |

9 | Coalgebraic specifications and models of deterministic hybrid systems
- Jacobs
- 1996
(Show Context)
Citation Context ...is theory aims at proving the correctness of refinements between classes in object-oriented languages, using modern proof tools. We expect that this theory scales up smoothly to the hybrid setting of =-=[12]-=-, since the underlying concepts are of the same (coalgebraic) nature. Current research (in collaboration with Hensel, Huisman and Tews) focusses on the development of a (front-end) tool for reasoning ... |

7 | Behaviour-Refinement of Coalgebraic Specifications with Coinductive Correctness
- Jacobs
- 1997
(Show Context)
Citation Context |

1 |
Algebraic Appoaches to Program Semantics. Texts and Monogr
- Manes, Arbib
- 1986
(Show Context)
Citation Context ...gebras consist of a state space together with a transition function and can be used to describe various kinds of dynamical systems, including automata, transition systems and hybrid systems, see e.g. =-=[27, 20, 11]-=-. A coalgebraic specification (as developed in [13]) formally captures several crucial aspects of classes in object-oriented languages: it consists of a (hidden) state space (typically written as X) t... |