Specification transformers: a predicate transformer approach to composition

Abstract

Abstract. This paper explores theories that help in (i) proving that a system composed from components satisfies a system specification given only specifications of components and the composition operator, and (ii) deducing desirable properties of components from the system specification and properties of the composition operator. The paper studies compositional systems in general without making assumptions that components are computer programs. The results obtained from such abstract representations are general but also weaker than results that can be obtained from more restrictive assumptions such as assuming that systems are parallel compositions of concurrent programs. Explorations of general theories of composition can help identify fundamental issues common to many problem domains. The theory presented here is based on predicate transformers.

Composing invariants

“…Elements from this theory are introduced in the remainder of this section. The reader is referred to [14] for more detail and for the proofs of the results used in this paper.…”

“…There is an overhead cost in specifying independent components, because a component is generally more difficult to verify than a closed system, including a closed system made of several components [12]. That cost can be balanced by the fact that a verified component is reused in building different systems, and therefore that the effort that went into its verification is reused as well [13,14].…”

“…Two such forms of invariants are defined in this article (Sections 5.1 and 5.3). Their definition relies on a theory of specification transformers described in [14]. Elements from this theory are introduced in the remainder of this section.…”

“…A challenge for component and system designers is to derive compositional (existential or universal) specifications from non-compositional ones. To help study this fundamental question, we have defined a collection of predicate transformers that do indeed transform a given specification into a corresponding compositional specification [14]. In this paper, we rely on one of these transformers, namely W E. The reader is referred to [14] for properties of W E and related proofs.…”

Mechanizing compositional reasoning for concurrent systems: some lessons

“…• existential and universal properties • the guarantees relation, which is part of the previous technique [CS00,CC03] • progress sets [MS00] We have had mixed results with these methods and attempt to summarise our findings below. In the interests of brevity, this paper keeps details to a minimum.…”