Secondly, a loose semantics for graph transformation systems is dened, which

Transcription

1 Double-Pullback Transitions and Coalgebraic Loose Semantics for raph Transformation Systems Reiko Heckel, Hartmut Ehrig and Uwe Wolter TU Berlin, FR 6-1, Franklinstrasse 28/29, Berlin, ermany freiko, ehrig, Andrea Corradini y CWI, Kruislaan 413, 1098 SJ Amsterdam, The Netherlands andrea@cwi.nl March 10, 1997 Abstract. The aim of this paper is an extension of the theory of graph transformation systems in order to make them suitable for the specication of reactive systems. For this purpose two main extensions of the algebraic theory of graph transformations are proposed. Firstly, graph transitions are introduced as a loose interpretation of graph productions, dened using a double pullback construction in contrast to classical graph derivations based on double-pushouts. Two characterisation results relate graph transitions to the classical double-pushout derivations and to amalgamated derivations, respectively. Secondly, a loose semantics for graph transformation systems is dened, which associates with each system a category of models (deterministic transition systems) dened as coalgebras over a suitable functor. Such category has a nal object, which includes all nite and innite transition sequences. The coalgebraic framework makes it possible to introduce a general notion of a logic of behavioural constraints. Instances include start graphs, application and consistency conditions, and temporal logic constraints. We show that the considered semantics can be restricted to a nal coalgebra semantics for systems with behavioural constraints. Key words: graph rewriting, graph transformation systems, categorical models, reactive systems, loose semantics, behavioural constraints, nal coalgebra semantics 1. Introduction The theory of graph transformation systems basically studies a variety of formalisms which extend the theory of formal languages in order to deal with structures more general than strings, like graphs and maps. A graph transformation system allows one to describe nitely a (possibly innite) collection of graphs, i.e., those which can be obtained from a start graph through repeated applications of graph productions. Each Research partially supported by the erman Research Council (DF) and the TMR network ETRATS y A. Corradini is on leave from Dipartimento di Informatica, Pisa. He is also supported by the EC Fixed Contribution Contract n. EBRFMBICT960840

2 2 Heckel, Ehrig, Wolter, and Corradini production can be applied to a graph by replacing an occurrence of its left-hand side with its right-hand side. The form of graph productions and the mechanisms stating how a production can be applied to a graph and what the resulting graph is, depend on the specic formalism. Among the various formulations of graph transformation, the \algebraic, Double Pushout (DPO) approach" [1, 2] is one of the most successful, mainly because of its exibility. In fact, since the basic notions of production and direct derivation are dened in terms of diagrams and constructions in a category, they can be dened in a uniform way for a wide range of structures. Moreover, many results can be proved once and for all using categorical techniques. raph transformation systems have been widely used to model graphical structures and their evolution in Computer Science and Biology. In Computer Science, main application areas have been programming languages, data base and information systems, term rewriting with shared substructures, and generation as well as analysis of languages based on graphs instead of words and trees (see [3, 4, 5]). During the last years, 1 the theory of graph transformation systems developed towards a fundamental semantical model for concurrency (generalising Petri nets [6]) and for the specication of software systems [7]. Traditionally the semantics of a graph transformation system is dened as the collection of all its direct derivations or derivation sequences (for example, in [8, 9] these are generated from the system via a free construction). Such a semantics assumes that the behaviour of the system is completely specied. However, there are many situations where such an assumption is no longer adequate, as in the case of specication of reactive systems, and of parametrised or modular specications. raph transformations have been used recently to specify reactive systems in the erman-brazilian project RAPHIT, where in cooperation with an industrial partner a telephone system has been specied [10]. It turned out that graph transformations seem to have a great potential as a specication technique for reactive systems, provided that the classical theory of graph transformation systems is extended to handle open semantics and control aspects in terms of some kind of behavioural constraints. For such systems, in fact, the actual behaviour depends on the interaction with the external environment. Another current stream of research concerns the enrichment of graph transformation based specication with modularity and parametrisation techniques [11, 12]. Also in this case, an open or loose semantics has to be provided for modules with import/export interfaces or 1 Mainly in the framework of two European projects, the Esprit Basic Research Working roups COMPURAPH I and II ( ). apcs.tex; 10/03/1997; 15:17; no v.; p.2

3 Double-Pullback Transitions and Coalgebraic Loose Semantics... 3 for parametrised specication components, because they cannot be assumed to specify completely the behaviour of a system. A similar problem has been addressed in the eld of algebraic specications too, where a well-accepted solution is a loose semantics that associates with a specication the category of all algebras satisfying it [13]. Therefore we propose in this paper a loose semantics for graph transformation systems, based on two main technical ingredients: An original loose interpretation of graph productions, that takes into account also the possible eect of interactions with the environment, and a category of models dened via coalgebraic techniques. Concerning the rst point, the usual interpretation of a graph production (in the DPO approach) is that it determines the changes to the current state for the matched subgraph. The remaining part is considered as a context, and it is left unchanged: This can be interpreted as an implicit frame condition, stating that nothing must happen beyond what is explicitly specied. If, on the other hand, productions are considered as incomplete descriptions of the transformations to be performed, this assumption is no longer valid. The production still determines the changes to the matched subgraph, but for the context anything can happen. This idea is captured by the notion of graph transition. A graph transition ensures that we preserve, delete, and add at least as much as it is specied by the production, but it allows to model also addition and deletion of other items which may be caused by the environment. Technically speaking, graph transitions are based on a double-pullback construction, unlike direct derivations that are classically dened using a double-pushout construction. Two important results characterise graph transitions in terms of extended direct derivations, and of amalgamated graph derivations (using the union of two productions along a common subproduction), respectively. Concerning the second point, the category of models of a graph transformation system is dened as the category of coalgebras with respect to a suitable functor, based on the transitions of the system. More precisely, a model for a graph transformation system is dened as a transition system with terminal states that takes no input and at each step outputs a transition of. The category of models has a nal object: The full transition system over, containing all its nite and innite transition sequences. It is worth stressing that unlike the theory of algebraic specication, where the loose semantics is a category of algebras, we use a coalgebraic approach: This is consistent with the fact that coalgebras are often suggested as models of behaviours for objects and systems. Furthermore, while in a purely rule-based framework it is usually dicult to control the order and frequency of rule applications (control aspects that are very important for the speciapcs.tex; 10/03/1997; 15:17; no v.; p.3

4 4 Heckel, Ehrig, Wolter, and Corradini cation of reactive system), the coalgebraic loose semantics we propose allows us to handle in a very satisfactory way a large class of constraints imposed on the behaviour of a graph transformation system. A logic of behavioural constraints is introduced, together with a notion of satisfaction of constraints by transition systems. It is shown that for each such behavioural constraint, the restriction to the behaviours that satisfy the constraint is a cofree construction. The paper is organised as follows. After recalling the basic notions of the double-pushout approach to graph transformation systems in Section 2, in Section 3 we introduce graph transitions via a double-pullback construction, and relate them to the classical notion of direct derivations and to amalgamated derivations. Next in Section 4 we dene the category of models for a graph transformation system as a suitable category of coalgebras, called graph transition systems. Section 5 introduces the notion of logic of behavioural constraint, and presents several instances including start graphs, application and consistency conditions, and temporal logic constraints. 2. Basic Notions of Typed raph Transformation Systems This section reviews basic notions and denitions of the algebraic double-pushout (DPO) approach to the transformation of typed graphs [2, 14]. A directed graph = (V; E; s; t) consists of a set of vertices V, a set of edges E, and two mappings s; t : E! V which provide a source and a target vertex for every edge. A graph morphism f :! H is a pair of functions (f V : V! H V ; f E : E! H E ) which is compatible with the graph structure, i.e., f V s = s H f E and f V t = t H f E. raphs and total graph morphisms constitute a category which is called raph. iven a graph T 2 jraphj, the category raph T of typed graphs over T and typed graph morphisms is the comma category (raph # T ). The category raph has all limits and colimits. Hence, the comma category (raph # T ) has all limits and colimits as well, and the construction of pushouts and pullbacks coincides in raph and (raph # T ) up to the additional typing information. If not stated otherwise, graphs and graph morphisms will be assumed to be typed over T in the following. raph productions according to the DPO approach are specied by spans of injective graph morphisms L l? K?! r R. The left-hand side L contains the items that must be present for an application of the apcs.tex; 10/03/1997; 15:17; no v.; p.4

5 Double-Pullback Transitions and Coalgebraic Loose Semantics... 5 production, the right-hand side R those that are present afterwards, and the context graph K species the \gluing items\, i.e., the objects which are read during application but are not consumed. Denition 1 (graph production and transformation system). A graph production p : s is composed of a production name p and of a span of injective graph morphisms s = (L l? K?! r R), called production span. If no confusion is possible, we will sometimes make reference to a production p : s simply as p, or also as s. The reverse production of p is p?1 : (R r? K?! l L). A (typed) graph transformation system = ht ; P; i consists of a type graph T, a set of production names P, and a mapping associating with each production name p a production span (p). If p 2 P is a production name and (p) = s, we say that p : s is a production of. A (typed) graph grammar = h; 0 i is a typed graph transformation system = ht ; P; i together with a start graph 0 2 jraph T j. 4 Direct derivations in the DPO approach are dened as double pushout constructions. Denition 2 (DPO derivation). A double-pushout d is a diagram like in the left of Figure 2 on page 8, where top and bottom are production spans and (1) and (2) are pushouts. If p : (L l? K?! r R) is a production, a direct derivation from to H is denoted by =) p=d H. We also write p=d if and H are understood, and denote by In; Out, and pn the projections In(p=d) = ; Out(p=d) = H, and pn(p=d) = p. A derivation in a graph transformation system is a nite or p 1 =d 1 p 2 =d 2 innite sequence of direct derivations 0 =) 1 =) 2 : : : where p 1 ; p 2 ; : : : are production names of. A derivation in a grammar = h; 0 i is a derivation in that starts in 0. 4 The existence of a direct derivation is characterised by the gluing conditions [2]: Characterisation 3 (gluing conditions). Let p : (L l? K?! r R) be a production and d L : L! be a graph morphism, called match for p. Then, there exists a direct derivation =) p=d H if and only if the following two conditions are satised: identication condition: Whenever there are vertices or edges x; y 2 L with d L (x) = d L (y), then x = y or x; y 2 l(k), i.e., both are preserved by the production. apcs.tex; 10/03/1997; 15:17; no v.; p.5

6 6 Heckel, Ehrig, Wolter, and Corradini HookOff : ( HookOn HookOff Phone Ring T Ph Figure 1. Telephone example. HookOn L K HookOff R (3) (4) HookOn HookOff Ring Ring D Ring ) dangling condition: For each deleted vertex x 2 d L (L? l(k)) and each edge y 2 with s(y) = x or t(y) = x also y is deleted i.e., y 2 d L (L? l(k)). Actually, the gluing conditions only characterise the existence of the pushout complement, i.e., the context graph D and morphisms l and d K such that subdiagram (1) in the left of Figure 2 is a pushout. Then, also pushout (2) exists since raph T is cocomplete. Operationally speaking, the application of a production p : (L l? K?! r R) to a graph consists of three steps. First, the match d L : L! has to be chosen, providing an occurrence of L in, such that the gluing conditions are satised. Then, all objects of matched by L? l(k) are removed. This leads to the context graph D. Finally, the objects of R? r(k) are added to D leading to the derived graph H. Hence, the application of p deletes and creates exactly what is specied by the production, i.e., there is an implicit frame condition stating that everything that is not rewritten explicitly by the production is left unchanged. Our sample graph transformation system P h = ht P h ; fhookoff; g; P h i models (part of) the user's interaction with a telephone (see [10] for the full case study). Type graph T P h and production HookOff : (L K! R) are shown in Figure 1, and : (; ;! ;) is the empty production. The typing is indicated by the inscription of vertices and the phone icon. Using production HookOff, the user may change the hook status of the phone, while models an idle step of the user. A direct derivation using HookOff is given by the pushout diagrams (3) and (4) in Figure 1. The parallel application of productions p 1 and p 2 (without any synchronisation) is modelled by the application of the so-called parallel production p 1 + p 2 constructed as the disjoint union (coproduct) of p 1 and p 2. If both productions are intended to share certain objects and eects, this may be specied by a common subproduction p 0. This means that p 0 is embedded into p 1 and p 2, by double-pullback diagrams, 4 apcs.tex; 10/03/1997; 15:17; no v.; p.6

7 Double-Pullback Transitions and Coalgebraic Loose Semantics... 7 i.e., diagrams like in Figure 2 on the left where (1) and (2) are pullbacks. The synchronised application of p 1 and p 2 sharing p 0 is described by the amalgamated production p 1 p0 p 2. It is constructed by gluing productions p 1 and p 2 over p 0 [15]. Denition 4 (parallel and amalgamated productions). If p i : l (L i r i? K i i?! Ri ) are graph productions for i = 1; 2, the parallel production p 1 + p 2 : (L 1 + L l r 2? K 1 + K 2?! R 1 + R 2 ) is obtained by componentwise coproduct constructions of left-hand side, interface, and right-hand side graphs, while the morphisms l and r are induced by the universal property of K 1 + K 2. A derivation p 1+p 2 =d =) H using the parallel production is called parallel derivation. l A subproduction morphism e 1 : p 0! p 1 for p 0 : (L 0 r 0? K 0 0?! R0 ) is a triple of graph morphisms e 1 = he 1L ; e 1K ; e 1R i with e 1X : X 0! X 1 for X 2 fl; K; Rg such that the two resulting squares are pullbacks. If p 0 is subproduction of p 1 and p 2, i.e., there are subproduction morphisms e i : p 0! p i for i = 1; 2, the amalgamated production l p 1 p0 p 2 : (L 3 r 3? K 3 3?! R3 ) is obtained componentwise by con- e structing the pushout X 1 X e 1?! X 2X e 3? X 2 of 1X e 2X X 1? X 0?! X2, while l 3 and r 3 are induced by the universal property of the pushout object K 3. A derivation p 1p 0 p 2 =d =) H using the amalgamated production is called amalgamated derivation From Double-Pushout Derivations to Double-Pullback Transitions In this section a loose notion of graph transformation is introduced, which we call graph transition. As anticipated in the introduction, a graph transition will ensure that we preserve, delete, and add at least as much as it is specied by the production, but it allows to model also addition and deletion of other items which may be caused by the environment. This means dropping the implicit frame condition of the previous section, which ensures that those parts of the graph that are not matched by the production are left unchanged. Instead, we allow to dene explicit frame conditions that protect only some explicitly given parts of the graphs from unspecied changes. Let us introduce now graph transitions, that are dened simply by replacing the double-pushout diagram of direct derivations with a double-pullback (DPB). Next graph transitions will be characterised as apcs.tex; 10/03/1997; 15:17; no v.; p.7

8 8 Heckel, Ehrig, Wolter, and Corradini L l K r R L d L l K r (1) d K (2) l D r R d R H d L d 0 L 0 H 0 e l 0 r 0 e H D H l (3) d K (4) d 0 R r d R Figure 2. DPO (resp., DPB) diagram d and characterisation of DPB as extended DPO. (1) (2) HookOn L K HookOff R (3) (4) HookOn HookOn HookOn HookOff Ring 0 D 1 1 D 2 2 Figure 3. A sample transition sequence. L2 Ring HookOn T Ph Phone Ring HookOff HookOn FC Ph Phone HookOff extended direct (DPO) derivations on the one hand, and as amalgamated and parallel derivations on the other hand. Denition 5 (graph transition). Let p : (L l? K?! r R) be a production and d be a DPB diagram as in Figure 2 on the left. Then, p=d ; H forms a graph transition from to H via p : s, shortly: p-transition. As for direct derivations, we omit and H if they are understood and denote by In; Out, and pn the corresponding projections. The set 2 of all transitions in a graph transformation system is denoted by ;. 4 A sequence of two transitions is shown in Figure 3. The rst one, given by pullbacks (1) and (2), uses the empty production. It represents a step where the phone starts ringing while the user is idle. The second transition (using HookOff) consists of pullbacks (3) and (4). It has the unspecied eect of turning the bell o. Let us investigate the notion of graph transition from a more operational point of view. As usual, a span l? D?! r H represents a transformation where? l (D) is deleted, l (D) is preserved as r (D) H, and R? r (D) is newly created. Then, referring to the left diagram of Figure 2: 2 In general, this is a class rather than a set. In order to avoid foundational problems, however, we assume that for all graphs in raph the sets of vertices and edges are chosen as subsets of a global set U of names. Then, raph is a small category and the transitions in form a set. apcs.tex; 10/03/1997; 15:17; no v.; p.8

9 Double-Pullback Transitions and Coalgebraic Loose Semantics =2 1 =2 1=2 1 1 Figure 4. Transitions that do not satisfy the gluing conditions.? Commutativity of (1) and (2) ensures that the image of K in is preserved in D and H, i.e., d L (l(k)) l (D) and d R (r(k)) r (D).? Pullback property of (1) ensures that at least every image of L? l(k) in is deleted, i.e., d L (L? l(k)) \ l (D) = ;.? Pullback property of (2) ensures that at least every image of R? r(k) in H is newly created, i.e., d R (R? r(k)) \ r (D) = ;. It is worth stressing that graph transitions may not only have additional eects but do also exist more frequently than DPO derivations. In general, the left-hand side morphism d L of a graph transition may satisfy neither the identication nor the dangling condition of the corresponding production, and so does the right hand side. Consider for example the transitions in Figure 4. The production in the left transition deletes two vertices 1 and 2 and generates 1 0 and 2 0. The match identies 1 and 2, i.e., it does not satisfy the identication condition (cf. Characterisation 3). Nevertheless there is a transition removing vertex 1 = 2 from the given graph. Symmetrically, on the right-hand side, the transition decides to generate only one vertex 1 0 = 2 0 instead of two as stated in the production. In the middle of Figure 4 there is another example of a match for a production violating the identication condition: At the same time, the production tries to preserve and to delete the vertex 1 = 2 of the given graph. Obviously, this leads to a conict, i.e., there is no transition using this match. Finally, on the right-hand side, a transition is shown where the lefthand side morphism does not satisfy the dangling condition. Here, the transition exists and removing the dangling edge is an unspecied eect. Symmetrically, it is possible to attach edges to newly created vertices, which is shown in the right-hand side. Summarising, transitions may not be faithful with respect to the number of deleted or generated elements and they may delete dangling edges. They are not able, however, to resolve conicts of preservation and deletion. Motivated by these observations we introduce faithful and safe transitions: apcs.tex; 10/03/1997; 15:17; no v.; p.9

10 10 Heckel, Ehrig, Wolter, and Corradini Denition 6 (faithful and safe transitions). A transition p=d ; H using p : (L l? K?! r R) is called faithful if d L : L! and d R : R! H satisfy the identication conditions of p and p?1, respectively. It is called safe if d L and d R satisfy the gluing conditions of p and p?1. 4 Both transitions in the sequence of Figure 3 are safe. The transition in Figure 4 on the left is not faithful, while the one on the right is faithful but not safe. Transitions are now related to direct derivations and to derivations via amalgamated productions. First, we show that each faithful transition is equivalent to a direct derivation, preceded by an additional deletion and followed by an additional insertion step, both represented by total injective graph morphisms. Theorem 7 (transitions are extended direct derivations). If p : s is a production, the following statements are equivalent: 1. There is a faithful transition p=d ; H with d = hd L ; d K ; d R i as in Figure 2 on the left. 2. There are a direct derivation 0 p=d 0 =) H 0 and injective graph morphisms e : 0! and e H : H 0! H such that e l 0 = l and e H r 0 = r (see Figure 2 on the right). Proof. 1. ) 2.: By pushout property of (3) and (4), e and e H exist. We show that e is injective, i.e., that for vertices and edges respectively, x; y 2 0 with e (x) = e (y) implies x = y. The same arguments apply to e H. Since (3) is a pushout, d 0 L and l0 are jointly surjective. Hence we have the cases (i) to (iii): If (i) x; y 2 l 0 (D), then x = y follows from commutativity of the lower triangle and injectivity of l. If (ii) x; y 2 d 0 L (L), then x = y follows from commutativity of the left triangle and the fact that d L satises the identication condition of p. Finally, if (iii) there is x 0 2 D and y 0 2 L such that l 0 (x 0 ) = x and d 0 L (y0 ) = y we have l (x 0 ) = d L (y 0 ) by commutativity of both triangles. By pullback construction there is z 2 K with d K (z) = x 0 and l(z) = y 0. Then, commutativity of (3) implies that x = l 0 (d K (z)) = d 0 L (l(z)) = y. 2. ) 1.: In raph, pushouts with injective horizontal morphisms are also pullbacks. Then, pullback properties of the outer squares follow by monomorphism property of e and e H. Since (3) and (4) are pushouts, the identication condition holds for d 0 and L d0 R. Due to injectivity of e and e H it holds for d L and d R. 2 apcs.tex; 10/03/1997; 15:17; no v.; p.10

11 Double-Pullback Transitions and Coalgebraic Loose Semantics The transition (3)+(4) in Figure 3, for example, can be simulated by rst removing from 1 the Ring-vertex and its edge, and then applying HookOf f to its own left-hand side L. The non-faithful transition in Figure 4 on the left, however, can not be represented in this way. This shows that the restriction to faithful transitions in 1. is indeed necessary. Now we want to characterise graph transitions by parallel and amalgamated derivations. The idea is, to regard a transitions as part of an application of an amalgamated derivations, i.e., a transition via p 1 means that p 1 is participating in a certain transformation (among other productions). The same relationship holds for safe transitions and parallel derivations. Theorem 8 (transitions vs. parallel/amalgamated derivations). If p 1 is a production, the following statements are equivalent: 1. There is a transition p 1=d ; 1 H. 2. There are a production p 2 and a common subproduction p 0 of p 1 and p 2 such that there exists a direct derivation p 1p 0 p 2 =d =) H using the amalgamated production p 1 p0 p 2. Moreover, there is a parallel derivation p 1+p 2 =e =) H if and only if the transition p 1=d ; 1 H is safe. Proof. Let e i : p 0! p i for i = 1; 2 be the subproduction morphisms into p 1 and p 2, and e i : p i! p 1 p0 p 2 be their morphisms to the amalgamated production. \2. =) 1.": It is easy to show that an amalgamated derivation p 1p 0 p 2 =d =) H induces a transition p 1=d ; 1 H by d 1 = d e 1, using the fact that each DPO diagram is a DPB diagram and that e 1 is a DPB diagram, too. \1. =) 2.": For the reverse direction, we use the following complement construction for graphs: If m : L! is a total graph morphism, the complement m : L! is the (embedding of the) smallest subgraph of such that a pullback of m and m is also pushout, i.e., such that (i) m and m are jointly surjective and (ii) x 6= y 2 L with m(x) = m(y) implies m(x) 2 L. Such a complement exists because m = id :! satises these properties, and they are closed under intersection of subgraphs of. Hence, the complement L can be constructed as the intersection of all subgraphs 0 satisfying (i) and (ii). Moreover, we use the following two pushout/pullback decomposition lemmata in raph (see left diagram of Figure 5): apcs.tex; 10/03/1997; 15:17; no v.; p.11

12 12 Heckel, Ehrig, Wolter, and Corradini L 1 K 1 R 1 (1) (2) A B D H L 0 L 1 (1) (3) (4) (1) C D L 1 K L K R R 1 L 0 L 2 (2) (5) (6) (2) E F L 2 K 2 R 2 L 1 Figure 5. Proof of Theorem 8: Relating transitions and amalgamated derivations. 1. Special PO/PB Decomposition Lemma [15]: Let (1) be pushout, (1+2) be pullback, and E! F be monomorphism. Then (2) is a pullback. 2. Decomposition of Pushout Complements [16]: Let all vertical arrows be monomorphisms, (2) be pullback and (1+2) be pushout. Then, (1) is pushout. iven the transition p 1=d ; 1 H we construct a complementary transition p 2=d ; 2 H via a new production, p 2 and a common subproduction p 0 with e i : p 0! p i such that the bottom span D! H of the two transitions is equal to the amalgamated production p 1 p0 p 2. Then p 1p 0 p 2 =id =) H is an amalgamated DPO derivation. Consider the middle diagram of Figure 5, where pullbacks (1) and (2) form the DPB diagram d 1. Let L 1! and R 1! H be the complements of L 1! and R 1! H, and (3) and (4) be constructed as pullbacks. By building rst the pullback of K L! D and K R! D and then the pushout of the resulting morphisms one obtains K L! K 2 and K R! K 2. The morphism K 2! D is induced by the universal pushout property of K 2 s.t. the two triangles between D; K L ; K R, and K 2 commute. Now, building the pushouts (5) and (6) we obtain L 2! and R 2! H by their universal property. Since D! and D! H are injective we can apply the Special PO/PB Decomposition Lemma and conclude that d 2 = hl 2! ; K 2! D; R 2! Hi is a DPB diagram. Now forming the (componentwise) pullback of d 1 and d 2 we get the production p 0 and subproduction morphisms e i : p 0! p i for i = 1; 2. It follows from pullback composition and decomposition properties that these are DPB diagrams. The amalgamated production p 1 p0 p 2 is obtained as componentwise pushout of e 1 and e 2. It remains to show that the bottom span D! H is equal to the amalgamated production. Therefore, we show that the (componentwise) pullback of d 1 and d 2 is a (componentwise) pushout. By construcapcs.tex; 10/03/1997; 15:17; no v.; p.12

13 Double-Pullback Transitions and Coalgebraic Loose Semantics K 1 K 1 + K 2 l K 2 L 1 L 1 + L 2 L 2 e K d 1L e L l D Figure 6. Proof of Theorem 8: Relating safe transitions and parallel derivations. tion of L1! as complement of L 1!, the pullback diagram (1+2) in Figure 5 on the right is also a pushout. In the construction above, L 1! is then decomposed to L1! L 2!. It can be shown that both are injective. Building pullback (2) as part of the componentwise pullback construction of d 1 and d 2 above leads to the decomposition of (1+2), where L0! L 0 is obtained by the universal pullback property such that (1) commutes. It follows from Lemma Decomposition of Pushout Complements [16] above that (1) is a pushout. Hence, by pushout decomposition, also (2) is a pushout. The same arguments apply to the right hand sides, and it follows from the 3-cube lemma, part 1 in [8] that the pullback of the interface graphs is a pushout as well. Thus, p 1p 0 p 2 =id =) H forms an amalgamated derivation where production and bottom span are identical. Now we show the part on parallel derivations and safe transitions: For a parallel derivation p 1+p 2 =e =) H it follows from the Parallelism Theorem (see e.g., [17]) that (d in 1 ) L satises the gluing condition of p 1, where in 1 is the injection of p 1 into p 1 + p 2. By symmetry, (d in 1 ) R satises the gluing condition of p?1 1. Hence, p 1=d ; 1 H is a safe transition. For the reverse, the diagram of Figure 6 shows the left-hand sides of the given transition p 1=d ; 1 H, the transition p 2=d ; 2 H constructed above, and the parallel production p 1 + p 2. The square between L 1 + L 2 ; K 1 + K 2 ; and D, referred to as (1) in the following, is obtained by the universal coproduct property such that all subdiagrams commute. It shall form the left-hand side of the parallel derivation p 1+p 2 =e =) H, i.e., we have to show that (1) is a pushout. It is straightforward to show that a commutative diagram like (1), where l; l are injective and e L ; e K are surjective, is a pushout if e L (x) = e L (y) implies apcs.tex; 10/03/1997; 15:17; no v.; p.13

14 14 Heckel, Ehrig, Wolter, and Corradini x = y or x; y 2 l(k 1 + K 2 ), i.e., e L satises the identication condition. Notice that e L ; e K are surjective since d 1L ; d 2L and d 1K ; d 2K are pushout morphisms, and hence, jointly surjective. Let x; y 2 L 1 + L 2 with e L (x) = e L (y). We distinguish three main cases. If x; y 2 L 1, then x; y 2 l 1 (K 1 ) since by assumption d 1L satises the identication condition. If x; y 2 L 2 this implies that x = y since d 2L is by construction injective. In both cases this means x; y 2 l(k 1 + K 2 ). If, without loss of generality, x 2 L 1 and y 2 L 2, we have by construction of L 2 as pushout object of (5) that y has a preimage in K 2 or in L 1. In the rst case, y 2 l 2 (K 2 ), i.e., e L (y) is preserved by p 2. If now x 62 l 1 (K 1 ), then e L (y) is deleted by p 1 as well as preserved by p 2 which leads to a contradiction. In the second case, i.e., if y originates from L 1, we have by minimality of the complement construction additional cases (i) to (iii). In all three cases we shall show that x 2 l 1 (K 1 ) implying that y 2 l 2 (K 2 ) by a symmetric contradiction as above. (i) e L (x) is a vertex with an attached edge that is outside the match of d 1, i.e., the edge must be in L 1 in order to make m and m jointly surjective and the vertex e L (x) in order to make L 1 a graph. Assume that x 62 l 1 (K 1 ), i.e., e L (x) is deleted by p 1. Since there is a context edge attached to e L (x) this would violate the dangling condition of p 1, which contradicts the assumption of a safe transition, i.e., x 2 l 1 (K 1 ). (ii) e L (x) is a vertex or edge of with more than one preimage in L 1. Then x 2 l 1 (K 1 ) since d 1L satises the identication condition. (iii) e L (x) is a vertex of with an edge attached to it that ts in case (ii). Then, both preimages of the edge are preserved, and so is x by homomorphism properties of l 1. This shows that diagram (1) is a pushout. Since symmetric arguments apply to the right-hand side, we conclude that e is a doublepushout and p 1+p 2 =e =) H a parallel DPO derivation. 2 The eect of the transition (3)+(4) in Figure 3, for example, can be obtained by applying the productions HookOff and p 2 : (L 2 K 2! R 2 ) in the upper right of Figure 3 in parallel. Here, p 2 represents an internal operation of the telephone that complements the HookOf f action of the user. In order to ensure that, e.g., the hook status of the phone is protected from the inuence of the environment, we may declare a subgraph F C P h of the type graph T P h in Figure 3 as explicit frame condition. Then, the instances of the types of F C P h, i.e., Phone, HookOn, HookO and the edges in between, should only be created and deleted explicitly by the productions. If all types were protected (i.e., F C P h = T P h ), transitions would be restricted to direct derivations. In this way we apcs.tex; 10/03/1997; 15:17; no v.; p.14

15 Double-Pullback Transitions and Coalgebraic Loose Semantics are able to recover the classical DPO interpretation of productions as special case of the loose one. Denition 9 (reduct, explicit frame condition). Let T ; F C 2 jraphj be graphs and F C T. Then, for each typed graph g :! T 2 jraph T j its F C-reduct (g :! T ) F C is given by g 0 : 0! F C 2 jraph F C j in the inverse image square below, where 0 = g?1 (F C) and g 0 = gj F C is the codomain restriction of g to F C. The F C-reduct of a graph morphism f : (g 1 : 1! T )! (g 2 : 2! T 2 ) 2 raph T is (f) F C = fj 0 1 : (g 1 ) F C! (g 2 ) F C where fj 0 1 is the domain restriction of f to 0 1 = g 1?1 (T 0 ) 1. 0 g (1) g 0 T An explicit frame condition for a graph transformation system = ht ; P; i is a graph F C T. A transition p=d ; H in satises the frame condition F C if (d) F C, the F C-reduct of the double-pullback diagram d, is a double-pushout diagram. 4 Above, the F C-reduct is extended from objects and morphisms to diagrams in raph T. This is possible because it forms a functor ( ) F C : raph T! raph F C. Categorically speaking, diagram (1) above is a particular pullback square (where the horizontal arrows are inclusions) and the F C-reduct of a morphism is dened by the universal property. It follows from general pullback composition and decomposition properties that the reduct of a transition is a transition again. Constructing the F C P h -reduct of the transition sequence in Figure 3 results in removing the Ring vertex and the corresponding edge from the graph 1. The reduced sequence is a DPO derivation. Hence, the original transitions satisfy the explicit frame condition F C P h. F C 4. Coalgebraic Loose Semantics The semantics of a graph transformation system is often dened in an operational way as the collection of all its direct derivations or derivation sequences. Such a semantics implicitly assumes that the behaviour of the system is completely specied. If the graph transformation system is intended to model an open reactive system, however, this assumption is no longer adequate, because also the possible interactions with the environment have to be modelled in some way. Therefore, apcs.tex; 10/03/1997; 15:17; no v.; p.15

16 16 Heckel, Ehrig, Wolter, and Corradini there is a need for a loose semantics which allows one to model aspects of the environment even if they are not explicitly specied. The notion of graph transition introduced in the previous section allows us to model any possible interaction with the environment occurring at the level of individual derivation steps of the system. Considering now computations, a reasonable model is certainly provided by the collection of all transition sequences. However, such a model would be too much \permissive", because all possible interactions with the environment would be allowed for: One would also need some tool to constrain such interactions in some way. Therefore our proposal, elaborated in this and in the following sections, is to associate with each system a collection of models, together with some formal techniques that allows us to restrict the focus to a suitable subset of the models when additional information about the interaction with the environment is provided, usually in the form of behavioural constraints. The loose semantics we are introducing is therefore conceptually similar to the loose semantics of algebraic specications, dened by the category of all algebras satisfying the given specication where some algebras may satisfy additional properties. Recently graph transformation systems have been equipped with a categorical semantics where a free construction generates all the possible nite derivations [8, 9]. Similar semantics were dened for other rule-based formalisms as well, like Petri Nets [18] and Conditional Equational Term Rewriting [19]. The categorical framework would make easy the denition of a category of models where the free model is initial (as done for example in [19]). However, this approach would not allow for dening a model containing only a proper subset of the computations of the free one, as discussed below in this section. Rather than an algebraic setting, coalgebras seem more suitable for our purposes. Coalgebras are often suggested as models of behaviours for objects and systems (see e.g., [20, 21, 22]). Typical examples include nite state automata, various notions of transition systems, and streams (innite sequences) which have been used for example as semantics for CCS. Providing graph transformation systems with a coalgebraic semantics can make them comparable with specications written in other specication techniques. The coalgebraic framework provides handy techniques for both dening and reasoning about behaviours, including a general notion of bisimulation and a coinduction principle (see [21] for a tutorial introduction). Also, innite objects (transition sequences, derivation trees, unfoldings) are handled in an easy and natural way, see e.g., [20]. Since for many systems an innite (non-terminating) behaviour is assumed, apcs.tex; 10/03/1997; 15:17; no v.; p.16

17 Double-Pullback Transitions and Coalgebraic Loose Semantics this is a desirable feature for the semantics of graph transformation systems as well. We present now a coalgebraic loose semantics for a graph transformation systems based on graph transitions. A model for is a deterministic transition system with terminal states that at each step outputs a transition of. Such models are dened as coalgebras over a suitable functor, and they form a category having a nal object, the full transition system over, that includes all nite and innite transition sequences. Let T be an endofunctor of a category C. A T -coalgebra (see [23]) is a pair hc; i consisting of an object C and a morphism : C! T (C) in C. A morphism f : hc; i! hc 0 ; 0 i of coalgebras is a morphism f : C! C 0 in C such that T (f) = f 0. This denes category C T, called the category of T -coalgebras. Denition 10 (category of graph transition systems). Let T : Set! Set be the endofunctor dened by T (S) = ( ; S) + 1 on objects and T (f) = (id ; f) + id 1 on arrows (recall that ; is the set of all transitions in, while 1 denotes the nal object f?g in Set). Then, a graph transition system T = hs; step : S! ( ; S) + 1i over is a T -coalgebra such that step(s) = ht; s 0 i and step(s 0 ) = ht 0 ; s 00 i implies that Out(t) = In(t 0 ). The category rats() of graph transition systems over is the full subcategory of the category Set T of T -coalgebras having all graph transition systems as objects. 4 Intuitively, a graph transition system T = hs; stepi is a deterministic automaton with nal states hs; next : S! S; first : S! ; i. The partial functions first and next are dened for all states s 2 S where step(s) = ht; s 0 i, and in this case next(s) = s 0 and first(s) = t. Hence, step(s) =? represents the case where both next(s) and first(s) are undened, i.e., the termination of the automaton [20]. A state transition from s to s 0 in S requires no input, but produces a graph transition in ; as output (observation). Due to the absence of input, the future behaviour of the system is fully determined by its current state. In terms of next and first, the condition in Denition 10 can be reformulated as Out(f irst(s)) = In(f irst(next(s))), i.e., the output graph of the rst transition equals the input graph of the second, and so on. We dene next i as the ith iteration of next by next 0 = id S and next i+1 = next next i. The loose semantics of a graph transformation system is dened as the category rats() of all graph transition systems over : This is regarded as the category of its \models". apcs.tex; 10/03/1997; 15:17; no v.; p.17

18 18 Heckel, Ehrig, Wolter, and Corradini Construction 11 (full transition system). Let be a graph transformation system. Then, the full transition system T S() = hs; stepi over is given by? the set S of all partial function s : IlN! ; where IlN are the natural numbers, such that dom(s) is a prex of IlN and Out(s(n? 1)) = In(s(n)) for all 0 < n < jdom(s)j (for all n > 0 if dom(s) = IlN).? step(s) = hs(0); s 0 i if dom(s) 6= ;, where dom(s 0 ) = dom(s)? jdom(s)j (dom(s 0 ) = dom(s) if dom(s) = IlN) and 8n 2 dom(s 0 ):s 0 (n) = s(n + 1). If dom(s) = ;, then step(s) =?. 4 The full transition system over is nal in rats(): Theorem 12 (nal coalgebra semantics). For each graph transformation system, the full transition system T S() over is nal in rats(). The unique morphism for some T 2 jrats()j is denoted by T : T! T S(). Proof. Let T = hs 0 ; step 0 i be an object of rats(). Then, T : T! T S() is uniquely determined by T (s 0 )(i) = first 0 (next 0i (s 0 )) for all s 0 2 S 0. 2 If s 0 2 S 0 is a state of T, then T (s 0 ) is a transition sequence representing the behaviour of s 0. Two states with the same behaviour are bisimilar [21]. For the full transition system T S() this means that if two transition sequences are bisimilar, then they are already equal, i.e., T S() provides a minimal representation of all possible behaviours of. It is worth summarising here some advantages of having dened the category of models rats() via coalgebraic instead of algebraic techniques, obtaining for example an initial model by a free construction, as in [8, 9]. First of all, the free construction in the mentioned papers only generates nite sequences, while the full transition system contains both nite and innite sequences. But more importantly, in the algebraic approach all models have to include a homomorphic image of all the computations of the initial model, thus there are no models corresponding to some kind of restriction of behaviour. On the contrary, the coalgebraic framework allows for the denition of various expressive techniques for considering models that realize only part of the behaviours of the nal model. Such techniques, based on various kinds of constraints, will be described in more detail in the next section. Before concluding this section, it is worth stressing that in the coalgebraic framework introduced above, it is possible to dene various apcs.tex; 10/03/1997; 15:17; no v.; p.18

19 Double-Pullback Transitions and Coalgebraic Loose Semantics other kinds of models for graph transformation systems by considering coalgebras with respect to other functors. For example, let P and A be the endofunctors on Set dened as P (S) = P f ( ; S) and A (S) = A! ( ; S), where P f is the nite powerset functor, and A is a set of actions. Then P -coalgebras are (bounded) non-deterministic transition systems that at each step output a transition over and pass to a new state, chosen from a nite set of possible alternatives. A - coalgebras are instead non-terminating transition systems with input set A and output set ;. Most notions and results presented in this and the next sections can be rephrased, mutatis mutandis, for these other kinds of coalgebras, and for many others (see [21] for further examples of transition systems as coalgebras). We leave the analysis of these variations and of their relevance for the theory of graph transformation systems as a future topic of research. 5. Behavioural Constraints for raph Transformation Systems While the rule-based approach of graph transformations is well-suited to describe state transformations where the states are modelled by graphs, it is dicult to control the order and frequency of rule applications in a purely rule-based framework. Such control aspects, however, are most important for the specication of reactive systems, but the theory of graph transformations oers only little help for this problem up to now. For this reason we study behavioural constraints for graph transformation systems. We introduce logics of behavioural constraints as a general framework including, for example, start graphs, explicit frame conditions (as introduced in Section 3), application and consistency conditions (as studied in [24, 25]) and temporal logic constraints (as dened in [26]). These constraints are dened explicitly at the end of this section. The main result of this section (see Theorem 16) shows that the full transition system can be restricted to those transition sequences satisfying the behavioural constraints such that we obtain a nal coalgebra semantics with behavioural constraints. Denition 13 (logic of behavioural constraints). A logic of behavioural constraints for graph transformation systems LOBC = hconstr; j=i is given by a class Constr() of behavioural constraints and a satisfaction relation j= jrats()jconstr() for each graph transformation system, such that for each c 2 Constr() apcs.tex; 10/03/1997; 15:17; no v.; p.19

20 20 Heckel, Ehrig, Wolter, and Corradini the empty graph transition system satises c, and satisfaction is closed under homomorphic images and union of subcoalgebras. 3 The satisfaction relation is extended to sets of behavioural constraints C Constr() in the obvious way. 4 A constrained graph transition system is one which satises certain behavioural constraints: Denition 14 (constrained graph transition systems). A graph transformation system with behavioural constraints C = h; Ci consists of a graph transformation system together with a set of behavioural constraints C Constr(). The category of (constrained) graph transition systems rats(c) over C is the full subcategory of rats() where for each T 2 jrats(c)j we have that T j= C. 4 Proposition 15 (restriction is right adjoint). For each graph transformation system with constraints C = h; Ci, the inclusion functor E C : rats(c)! rats() has a right adjoint j C : rats()! rats(c). Proof. iven T 2 rats(), let Tj C 2 rats(c) be the union of all transition systems T 1 T such that T 1 j= C. It follows from Denition 13 that Tj C satises C. Hence Tj C is the largest subcoalgebra of T with this property. Let T be the corresponding inclusion. In order to show the universal property assume T 0 2 jrats(c)j and f : T 0! T 2 rats(). The unique restriction f C : T 0! Tj C of f is then given by i f e where f e is the restriction of f to f(t 0 ) T and i the inclusion of f(t 0 ) Tj C. This inclusion exists because by Denition 13 satisfaction is closed under homomorphic images, i.e., f(t 0 ) j= C, and Tj C is the largest subsystem of T with this property. Uniqueness of f C for T f C = f follows from monomorphism property of T. T f T 0 T TjC i f e f(t 0 ) 3 A transition system T 0 = hs 0 ; step 0 i is a subcoalgebra of T = hs; stepi, written T 0 T, if S 0 S and step 0 = stepj S 0 is the restriction of step to S. The homomorphic image of a coalgebra T under a morphism f : T! T 0 is the subcoalgebra f(t) T 0 determined by f(s), the set-theoretical image of S. Coalgebras are closed under set-theoretical union just like algebras are closed under set-theoretical intersection. 2 apcs.tex; 10/03/1997; 15:17; no v.; p.20

21 Double-Pullback Transitions and Coalgebraic Loose Semantics Now, the nal coalgebra semantics can be lifted to graph transformation systems with constraints: Theorem 16 (nal coalgebra semantics with beh. constraints). For each graph transformation system with behavioural constraints C = h; Ci, the constrained transition system T S()j C is nal in rats(c). Proof. Directly from Theorem 12, Proposition 15, and the fact that cofree constructions preserve nal objects. 2 A particular way of restricting the behaviour of a system is to specify an initial state. In the case of graph transformation, this is done by adding a start graph, which turns a graph transformation system into a grammar. In order to have a nal coalgebra semantics for graph grammars as well we dene start graphs as behavioural constraints: Denition 17 (start graphs as behavioural constraints). iven a graph transformation system = ht ; P; i, a graph 0 2 jraph T j, and a graph transition system T = hs; stepi 2 rats(), we say that s 2 S is reachable from 0 if there are n 2 IlN (including zero) and s 0 2 S such that In(first(s 0 )) = 0 and next n (s 0 ) = s. Now let Start = hconstr; j=i be given by Constr() = jraph T j and T j= 0 i s is reachable from 0 for all s 2 S. 4 Proposition 18 (start graphs). Start = hconstr; j=i as dened above forms a logic of behavioural constraints. Proof. It is obvious that for each 0 2 jraph T j all sequences of the empty transition system are reachable from 0, and that this property is closed under the union of subcoalgebras. For the preservation by homomorphic images assume f : T! T 0 2 rats(). We have to show that if s 2 S T is reachable from 0 then so is f(s). Let n 2 IlN and s 0 2 S T such that In(first(s 0 )) = 0 and next n (s 0 ) = s. By homomorphism property of f we have that f(next(s)) = next 0 (f(s)) and first(s) = first 0 (f(s)) provided that next(s) and first(s) are dened. Thus, there is f(s 0 ) 2 S T 0 such that next 0n (f(s 0 )) = f(next n (s 0 )) = f(s) and In(first 0 (f(s 0 )) = In(first(s 0 )) = 0. Denedness of first(s 0 ) and next n (s 0 ) follows by assumption. 2 This denes categories rats() of graph transition systems over a graph grammar. apcs.tex; 10/03/1997; 15:17; no v.; p.21