Abstract. In this paper we study clausal specications over built-in algebras. To keep things simple, we consider built-in algebras only that

Transcription

1 Partial Functions in Clausal Specications? J. Avenhaus, K. Madlener Universitat Kaiserslautern favenhaus, madlener Abstract. In this paper we study clausal specications over built-in algebras. To keep things simple, we consider built-in algebras only that are given as the initial model of a Horn clause specication. On top of this Horn clause specication new operators are (partially) dened by positive/negative conditional equations. We dene three types of semantics for such a hierarchical specication: model-theoretic, operational, and rewrite-based semantics. We show that all these semantics coincide, provided some restrictions are met. We associate a distinguished algebra A spec to a hierachical specication spec. This algebra is initial in the class of all models of spec. 1 Introduction In this paper we are interested in algebraic specications. In order to comply more realistically with the needs of applications, the specication language should allow for sucient expressiveness, admit a well-dened semantics, allow for formal reasoning. We are interested in executable specication, so we require the axioms to be conditional equations. Normally a conditional equation is of the form B =) l = r where B is a conjunction of equations. Furthermore, the specication denes the operators totally. We allow for several extensions: (1) We allow the axioms to be positive/negative conditional equations, i.e., in B =) l = r we allow also negative equations of the form u 6= v. From the logical point of view this is a clause. So we speak of clausal specications. (2) One would like to have xed built-in structures such as the integers, the rationals, or lists. To keep things simple, in this paper we consider built-in algebras only which are themselves given by algebraic specications. (3) The specication of interest may dene new operators on top of the built-in algebra only partially. We study how to assign natural semantics to such a specication. We will dene denotational semantics (based on the notion of models), operational semantics (based on equational reasoning on ground terms) and rewrite semantics (based on conditional rewriting). Provided some restrictions are met, all these? This report was supported by the Deutsche Forschungsgemeinschaft, SFB 314 (D4- Projekt)

2 semantics coincide. This denes the notion of validity of a clause. We discuss a proof method to prove (or disprove) a clause to be valid elsewhere [AM95]. Our denition of the semantics is based on the following principles: (a) If a ground equation s = t is valid then this should be supported by E. (This ensures initiality.) (b) If a ground equation s = t is valid then it should remain valid if the specication is extended by adding new axioms. We call this \monotonic extendability of specications". A specication spec consists of a signature sig, a base algebra A and a set E of positive/negative equations. The algebra A is given as the initial algebra of a specication spec 0 = (sig 0 ; E 0 ), where sig 0 is a subsignature of sig and E 0 E consists of positive conditional equations. The axioms in E 1 = E? E 0 partially dene the new operators. We associate to spec the quotient algebra A spec = T erm(f )== E of the free term algebra T erm(f ) according to a suitably dened E-equality = E. Note that we have to dene carefully how to apply a positive/negative conditional equation, in particular how to evaluate the negative conditions. Since we do not restrict to positive conditional equations, an initial model of spec in the sence of rst order logic may not exist. Nevertheless, A spec is dened such that it contains (an isomorphic copy of) A and is initial in a natural class of models of spec. Hence we dene \A clause is valid in spec i it is valid in A spec ". We now demonstrate by some examples which problems arise with the specications we consider and how these problems are solved in our approach. Example 1 Partially dened operators. Let A be the initial model of E 0 over F 0 = f0; s; +g: E 0 : x + 0 = x, x + s(y) = s(x + y). Then 0 + x = x is valid in A. Now we partially dene the operator? by E 1 : E 1 : x? 0 = x, s(x)? s(y) = x? y. Let E = E 0 [ E 1. Note that s(0)? 0 is a dened term, i.e., it is E-equal to a base term t 2 T erm(f 0 ). But 0? s(0) is not dened, so it is a junk term. We want 0+x = x to hold in the distinguished model A spec specied by E. For that we have to say over which terms a variable x in an equation may range. If we allow x to range over all ground terms then we may also substitute the junk term t 0? s(0) for x, but 0 + t = E t does not hold. As a consequence, the principle of monotonic extendability for a specication does not hold. Hence, we allow x to range over the dened terms only, then 0+x = E x holds. One may prove that (x + y)? y = E x also holds under this interpretation. This is true despite the fact that? is only partially dened by E 1. We may extend the denition of? in dierent ways. E.g., adding to E the axiom 0? s(y) = 0 denes? to be \minus on N", and adding the axiom 0? s(y) = s(y) denes? to be x? y =j x? y j on N. In both extensions E to E 0 we have (x + y)? y = E 0 x. So the principle of monotonic extendability of specications is fullled.

3 Example 2 Another semantics for spec. The last example suggests to dene \A clause is valid in spec i it holds in all total models of spec", see [KM86]. We show that this denition is unappropriate in our context. Let A be given by F 0 = f0; s; nil; :g and E 0 = ;. Let E = E 0 [ E 1, where E 1 denes the operators push, pop and top on lists: E 1 : push(x; l) = x:l pop(x:l) = l top(x:l) = x So top and pop are dened on non-empty lists only. According to our semantics the clause G pop(l) = nil =) push(top(l); pop(l)) = l is valid. This is true, because the assumption pop(l) = nil is satised only if l has the form l x:nil. This is in accordance with the \natural intention" on the specication. But, G is not valid according to the denition mentioned above: G is not valid in any model of spec that satises pop(nil) = nil and x:l 6= nil. Example 3 Problems with negative conditions. Let A be given by F 0 = f0; sg und E 0 = ;. We dene operators f and g by E 1 : E 1 : f(s(x); y) = f(x; s(s(y))) f(x; y) = f(y; x) =) g(x; y) = 0 f(x; y) 6= f(y; x) =) g(x; y) = s(0) Here the question is how to evaluate the conditions of a conditional equation. By standard practice we evaluate the conditions before applying the conclusion. Clearly, for any x s i (0) we have g(x; x) = E 0. But what about g(0; s 2 (0))? Obviously, we have no support from E to prove f(0; s 2 (0)) = f(s 2 (0); 0), so it is tempting to conclude g(0; s 2 (0)) = E s(0). But that would contradict the principle of monotonic extendability of specications: If we extend E to E 0 by adding f(0; y) = 0 then we have f(x; y) = E 0 0 for all x s i (0), y s j (0), and hence g(0; s 2 (0)) = E 0 0. To resolve this problem, we dene the condition t 1 6= t 2 to be E-satised, if there are base terms t 0 ; 1 t0 2 T (F 2 0) such that t i = E t 0 for i i = 1; 2 and not t 0 1 = E 0 t 0 2. In the example above, neither g(0; s 2 (0) = E 0 nor g(0; s 2 (0)) = E s(0) holds according to this denition. The term g(0; s 2 (0)) is a junk term. From an operational point of view, there are two reasons for a function f to be partial. Either the computation of f(t) stops without producing a base term as output, or the computation does not stop. The rst case splits into two subcases: (1) One wants to extend the specication later to dene the new operators for more inputs. This was discussed in Example 1. (2) One does not want to dene each new operator totally. This is examplied in Example 2. Here it does not make sense to dene top(nil). Also, it does not make sense to dene division by zero. We now give an example for non-terminating computations. Example 4 Nonterminating computations. Let A be given by F 0 = f0; s; +g and E 0 : x + 0 = x x + s(y) = s(x + y) We dene the operators search and div by E 1 :

4 E 1 : x = v =) search(x; y; u; v) = u x 6= v =) search(x; y; u; v) = search(x; y; s(u); v + y) y 6= 0 =) div(x; y) = search(x; y; 0; 0) It is easy to see that the rewrite system R associated to E = E 0 [E 1 is ground conuent but not terminating (see below). We have div(s i (0); s j (0))?! R s k (0) i i = j k, j > 0. If j > 0 and j is not a divisor of i then the computation of div(s i (0); s j (0)) does not stop. In this case div(s i (0); s j (0)) is a junk term. To our knowledge there are almost no papers on abstract data types dened by clausal specications. We mention the book of Padawitz [Pad92], but here the emphasis is more on logic programming than on functional programming. There are many papers on positive conditional specication. If no partiality is allowed then the initial model of the specication is considered to dene the semantics of spec [Wec92]. The classical way to model partiality is to consider partial algebras, see e.g. [BWP84]. Here the problem arises how to dene the equality appropriately. Both proposals, strong equality and existential equality, are unsatisfactory, as can be sen from Example 3. In [KM86] an equation t 1 = t 2 is dened to be valid in spec i t 1 = t 2 holds in all total F 0 -generated models of spec. This is in conict with the design principle (a) from above. In this paper we follow the concept of [WG93, WG94a]. Here the negative conditions are evaluated constructively in the base algebra A as indicated in Example 3. The paper is organized as follows: We dene the syntax of hierarchical specications in section 2 and the semantics in section 3. In section 4 we study hierarchical term rewriting systems and so dene the rewrite semantics of a specication. Due to lack of space we omit all proofs. They can be found in [AM95]. 2 Hierarchical Specications In this section we rst review some main notations from equational logic. The reader may consult [DJ90] or [Ave95] for more details. A signature sig = (S; F; V; ) consists of a set S of sorts, a set F of function symbols (or operators), a set V of variables, and a function : F! S + which xes the input and output sorts for each f 2 F. We write f : s 1 ; : : :; s n! s instead of (f) = s 1 s n s. The variable system V for sig is a system V = (V s ) s2s such that V s T Vs 0 = ; for s 6= s 0. By abuse of notation we also write V = S s2s V s. We denote by T erm s (F; V ) the set of terms of sort s constructed from F and V. Then T erm(f; V ) = S s2s T erm s(f; V ). T erm(f ) = T erm(f; ;) is the set of ground terms (variable-free terms). We assume T erm s (F ) = T erm s (F; ;) to be nonempty for each s 2 S. We write sort(t) = s if t 2 T erm s (F; V ). We denote by O(t) the set of positions of t, by t=p the subterm of t at position p 2 O(t), and by t[u] p the term resulting from t by replacing the subterm t=p with term u. We use to denote the syntactic identity on terms.

5 Terms are used to build more complex syntactic units. An equality atom over sig has the form u = v with u; v 2 T erm s (F; V ) for some s 2 S. A deniteness atom (a def-atom, for short) has the form def(t) with t 2 T erm(f; V ). Here def is a meta-symbol, later interpreted as \dened". An atom is an equality atom or a def-atom. A clause has the form? =) where? and are multisets of atoms. We call? the antecedens and the succedens of the clause. We will write?; u = v instead of? [ fu = vg and =) instead of ; =). A positive/negative conditional equation (a conditional equation, for short) has the form? ; =) u = v. Its clausal form is? =) u = v;. So a conditional equation results from a clause? =) u = v; by singling out an equality axiom from the succedens. We call the elements from? the positive conditions and the elements from the negative conditions of? ; =) u = v. We speak of a positive conditional equation if = ;. We then write? =) u = v. If in addition? = ; then we write =) u = v. This is an unconditional equation. A signature sig 0 = (S 0 ; F 0 ; V 0 ; 0 ) is a subsignature of sig = (S; F; V; ) if (i) S 0 S, (ii) F 0 F, (iii) V 0;s = V s for s 2 S 0 and (iv) 0 is the restriction j F 0 of to F 0. We then call sig an enrichment of sig 0. After xing some syntactical notions we now turn to some semantical notions. Let sig = (S; F; V; ) be given. A sig-algebra is a pair A = ((A s ) s2s, (f A ) f2f ) such that (i) A s is a non-empty set (the carrier set for sort s), for all s 2 S and (ii) f A is a function f A : A s 1 A sn! S A s if f : s 1 ; : : :; s n! s, for all f 2 F. We write jaj s = A s and jaj = A = A s2s s. Now asume that sig 0 = (S 0 ; F 0 ; V 0 ; 0 ) is a subsignature of sig and A 0 is a sig 0 -algebra. We say A 0 is a subalgebra of A if (i) j A 0 j s j A j s for all s 2 S 0 and f A0 is the restriction of f A to j A 0 j for all f 2 F 0. If A 0 is generated by T erm(f 0 ) then we call A 0 the base-reduct of A. We now describe our specication mechanism. We start with the usual notion of a specication. A specication spec = (sig; E) consists of a signature sig = (S; F; V; ) and a set of conditional equations E. If E contains positive conditional equations only, then we speak of a positive conditional specication or a Horn clause specication. If spec 0 = (sig 0 ; E 0 ) is a specication and sig 0 = (S 0 ; F 0 ; V 0 ; 0 ) is a subsignature of sig, then spec 0 is called a subspecication of spec. Now we turn to hierarchic specications spec. Denition1. Let spec = (sig; E) be a specication and spec 0 = (sig 0 ; E 0 ) a subspecication. Let sig = (S; F; V; ), sig 0 = (S 0 ; F 0 ; V 0 ; 0 ), S 1 = S?S 0, F 1 = F? F 0 and E 1 = E? E 0. Let E 0 consist of positive conditional equations only which do not contain a def-atom. Let for each conditional equation? ; =) s = t in E 1 the conclusion s = t contain an operator f 2 F 1 and let contain no defatom. Then spec is called a hierarchical specication over the base specication spec 0. A term t 2 T erm(f 0 ; V 0 ) is called a base term. A syntactic object (atom, clause,...) is a base object if it contains base terms only. It is called a ground object if it contains ground terms only.

6 Now we have to model the restriction that base variables may range over base terms only. This is done by the denition of a substitution. Denition2. Let spec be a hierarchical specication over the base specication spec 0. Let V be a variable system for spec. A substitution is a mapping : V! T erm(f; V ) such that (i) dom() = fx j (x) 6 xg is nite, (ii) sort(x) = sort((x)) for all x 2 V and (iii) (x) is a base term if x is a base variable (i.e. sort(x) 2 S 0 ). We extend as usual to : T erm(f; V )! T erm(f; V ) by (f(t 1 ; : : :; t n )) f((t 1 ); : : :; (t n )). We call a ground substitution if (x) is a ground term for all x 2 dom(). We also write = fx 1 t 1 ; : : :; x n t n g if dom() = fx 1 ; : : :; x n g and t i (x i ). 3 Semantics of hierarchical specications In this chapter we are going to dene the denotational and operational semantics of a hierarchical specication spec = (sig; E). The denotational semantics is given by dening the models of spec. The operational semantics is given by dening the E-equality on T erm(f ). We will dene a special model A spec spec and show that, under reasonable conditions, it is initial in the class of all models of spec. We start with the denotational semantics. Let spec = (sig; E) be a hierarchical specication over spec 0 = (sig 0 ; E 0 ) as in Denition 1. In order to dene the models of spec we proceed in two steps. First we associate to spec 0 the initial model A. Then a sig-algebra B is a model of spec if its base-reduct is isomorphic to A and it satises all conditional equations in E. Given the positive conditional specication spec 0 = (sig 0 ; E 0 ) with sig 0 = (S 0 ; F 0 ; V 0 ; 0 ), to dene the initial algebra A of spec 0 we proceed in the classical way: We dene congruence relations 2 ( i ) i2non T erm(f 0 ) in the following way. We have s 0 t i s t. Given i, then i+1 is the smallest equivalence relation such that s i+1 t if (1) s i t or (2) there is a conditional equation? =) l = r, a substitution and a position p 2 O(s) such that s=p (l), t s[(r)] p and (u) i (v) for all u = v in?. Then = E 0= S i2n i is the E 0? equality. Denition3. Let spec 0 = (sig 0 ; E 0 ) be a positive conditional specication. For t 2 T erm(f 0 ) let [t] denote the = E 0-equivalence class of t. Then the initial model A of spec 0 is dened as follows A s = f[t] j t 2 T erm s (F 0 )g f A ([t 1 ]; : : :; [t n ]) = [f(t 1 ; : : :; t n )] It is well known (and easy to prove) that the functions f A are well dened (i.e., [t i ] = [s i ] implies f A ([t 1 ]; : : :; [t n ]) = f A ([s 1 ]; : : :; [s n ])) and that A is a of 2 A congruence relation on T erm(f ) is an equivalence relation such that s i t i implies f(s 1; : : : ; s n) f(t 1; : : : ; t n) for all f 2 F.

7 model of spec 0 in the sense of rst order logic. We associate to spec 0 its initial model A. Before dening the models of spec we need to clarify the notion of \a sigalgebra B satises a conditional equation? ; =) l = r". Denition4. Let spec = (sig; E) be a hierarchical specication over spec 0 = (sig 0 ; E 0 ) as above. Let B = ((B s ) s2s, (f B ) f2f ) be a sig-algebra and B 0 the base-reduct of B. Let B =jb j and B 0 =jb 0 j. a) A function ' : V! B is an evaluation function if '(x) 2 B s if sort(x) = s and '(x) 2 Bs 0 if sort(x) 2 S 0. Then ' is extended to ' : T erm(f; V )! B by '(f(t 1 ; : : :; t n )) = f B ('(t 1 ); : : :; '(t n )). b) (B; ') satises an equality axiom u = v i '(u) = '(v) in B and it satises a def-atom def(t) i '(t) 2 B 0. Finally, (B; ') satises a clause? =) if it satises an atom in whenever it satises all atoms in?. c) B satises a clause? =) (or? =) is valid in B) if, for each evaluation function ', (B; ') satises? =). We write B j=? =) if B satises? =). We write B j= A (for an atom A) if B satises =) A. In this case we say that B satises A. With these denitions, B satises a conditional equation? ; =) s = t i B satises the clause? =) s = t;. Now we can dene the models of spec. Denition5. Let spec = (sig; E) be a hierarchical specication over spec 0 = (sig 0 ; E 0 ). A sig-algebra B is a model of spec i (1) The base-reduct B 0 of B is isomorphic to the initial algebra A of spec 0. (2) B satises every conditional equation in E. Denition6. Let spec be a hierarchical specication over sig 0. Then Mod(spec) is the class of all models of spec. Note that M od(spec) may be empty. This may happen because the equations in E? E 0 may produce \confusion" on A. For example, if one adds the equation 0? 0 = s(0) to E 1 in Example 1 then 0 = s(0) holds in any algebra B satisfying all conditional equations in E. So the base-reduct of B is not isomorphic to A. We now come to the operational semantics. We now dene the E-equality = E for a hierarchical specication spec = (sig; E). If E only contains positive conditional equations, then this can be done in the classical way (as in the denition of the initial model in section 3.1). The problem is how to evaluate the negative conditions for applying a positive/negative conditional equation. As mentioned earlier, we here choose to evaluate the negation constructively in the built-in algebra A: A ground inequation u 6= v is evaluated to true i u and v evaluate to sig 0 -ground terms u 0, v 0 such that u 0 6= v 0 in A. This approach is taken from [WG93], [WG94b]. Let be a congruence relation on T erm(f ). We say satises u = v if u v satises def(t) if t t 0 for some t 0 2 T erm(f 0 )

8 satises u 6= v if u u 0 6= E 0 v 0 v for some u 0 ; v 0 2 T erm(f 0 ) satises? ; if satises all u = v, def(t) and u 0 6= v 0 such that u = v, def(t) 2? and u 0 = v 0 2. Denition7. Let spec = (sig; E) be a hierarchical specication over spec 0 = (sig 0 ; E 0 ). Let ( i ) i2nbe dened on T erm(f ) by 0 is = E 0 i+1 is the smallest congruence relation such that s i+1 t if (1) s i t or (2) there is a conditional equation? ; =) l = r in E, a ground substitution and a position p 2 O(s) such that s=p (l), t s[(r)] p and i satises (? ); (). Then = E = [ i2n i is the E-equality dened by spec. Remember that for any ground substitution we have (x) 2 T erm(f 0 ) if sort(x) 2 S 0 (by Denition 2). This realizes the restriction that base variables can be instantiated by base terms only. The next Lemma shows that the approximation ( i ) i2nof = E is monotonous. This is very similar to the case where only positive conditional equations are allowed in a specication. Lemma 8. If i satises u = v then i+1 satises u = v. If i satises def(t) then i+1 satises def(t). If i satises u 6= v then i+1 satises u 6= v. = E is a congruence relation. Now we are ready to associate a distinguished algebra A spec to a hierarchical specication spec. Denition9. Let spec = (sig; E) be a hierarchical specication over spec 0 = (sig 0 ; E 0 ). For t 2 T erm(f ) let [t] denote the E-equivalence class of t. Then A spec, the algebra specied by spec, is dened by A spec;s = f[t] j t 2 T erm s (F )g f Aspec ([t 1 ]; : : :; [t n ]) = [f(t 1 ; : : :; t n )] In general, A spec is not a model of spec. There are two reasons for that: (1) The base-reduct A 0 spec of A spec may not be isomorphic to the initial algebra A of spec 0. (2) We evaluate negative conditions constructively, but that may not be reected by the specication. We give some examples. For (1): Consider spec = (sig; E) with S 0 = S = fany g, F 0 = fa; bg, F = fa; b; cg, E 0 = ; and E = f=) c = a; =) c = bg. Then a = b is valid in A spec, but not in A. Hence, A spec 62 Mod(spec). For (2): Consider spec = (sig; E) with S 0 = S = fany g, F 0 = fag, F = fa; b; cg, E 0 = ; and E 1 = fa 6= b =) a = cg. Then a = c or a = b is valid in any model B of spec (since =) a = b _ a = c is the clausal form of a 6= b =) a = c). But neither a = b nor a = c is valid in A spec. So A spec 62 Mod(spec). We want to consider only those specications spec such that A spec 2 Mod(spec). This is captured by the next denitions.

9 Denition10. Let spec = (sig; E) be a hierarchical specication over spec 0 = (sig 0 ; E 0 ). a) spec is a consistent extension of spec 0 if for all base terms s; t 2 T erm(f 0 ) we have s = E t i s = E 0 t. b) A conditional equation? ; =) l = r is def-moderated if def(u); def(v) 2? for each equality atom u = v in. spec is def-moderated if each conditional equation in E is def-moderated. c) spec is admissible if it is a consistent extension of spec 0 and is def-moderated. Theorem 11. Let spec = (sig; E) be an admissible hierarchical specication over spec 0 = (sig 0 ; E 0 ). Then A spec is a model of spec. Corollary 12. For any clause G we have: A spec j= G i A spec j= (G) for all ground substitutions. Now we state that the principle of monotonic extendability of specications holds: Atoms valid in E remain valid if E is enlarged to E 0. Theorem 13. Let spec = (sig; E) and spec 0 = (sig; E 0 ) be two admissible hierarchical specications over spec 0 = (sig 0 ; E 0 ) such that E E 0. If s; t are sig-terms and A spec j= s = t, then A spec 0 j= s = t. If A spec j= def(t), then A spec 0 j= def(t). We now show that A spec is initial in the class of all models of spec. Denition14. Let A be a sig-algebra and K a class of sig-algebras. A is called initial in K if (i) A 2 K and (ii) for each B 2 K there is exactly one sighomomorphism : A! B. Let B be a sig-algebra. We dene t B for t 2 T erm(f ) by t B = c B if t c, (c) = s t B = f B (t B 1 ; : : :; t B n) if t f(t 1 ; : : :; t n ) B is term-generated if for all b 2 B there is a t 2 T erm(f ) such that b = t B. Theorem 15. Let spec = (sig; E) be an admissible hierarchical specication over spec 0 = (sig 0 ; E 0 ). Then A spec is initial in Mod(spec). Theorem 16. Let spec = (sig; E) be an admissible hierarchical specication over spec 0 = (sig 0 ; E 0 ). Let u; v 2 T erm(f; V ). Then A spec j= u = v i B j= u = v for all term-generated B 2 Mod(spec). These results may justify why we call A spec \the algebra specied by spec": We are interested in clauses that are valid in A spec. Denition17. Let spec be an admissible hierarchic specication over spec 0. A clause? =) is called an inductive theorem of spec if A spec j=? =).

10 4 Rewrite semantics Given the results obtained so far, there are two problems left: (1) We are interested in executable specications, so we want to eectively compute in A spec. (2) In order to apply the results of section 3.2 and 3.3, we have to prove that a given hierarchical specication spec is admissible. Since it is easy to check whether spec is def-moderated, the central problem is to prove that spec is a consistent extension of spec 0. In this chapter we are going to introduce hierarchical term rewrite systems. This will help us to solve these problems. Positive/negative conditional rewriting was introduced by Kaplan [Kap88]. Let sig 0 = (S 0 ; F 0 ; V 0 ; 0 ) be a subsignature of sig = (S; F; V; ) as in section 2.1. A positive/negative conditional rewrite rule is an oriented positive/negative conditional equation, so it has the form? ; =) l! r where contains no def-atom. We require Var(? ) [ Var() [ Var(r) Var(l). Denition18. A positive/negative conditional rewrite system R is the union of two rewrite systems R 0 and R 1. R 0 contains positive conditional rewrite rules? =) l! r over sig 0 only. No def-atoms appear in R 0. R 1 contains positive/negative conditional rewrite rules? ; =) l! r over sig such that l contains an operator f 2 F? F 0 and contains no def-atom. We are going to dene the rewrite relations?! R 0 and?! R. This is similar to the denition of = E 0 and = E in section 2.2. In particular, negative conditions u = v in a rewrite rule are constructively evaluated over sig 0 -term. Positive conditions are evaluated by joinability (see below). We need some notations. Let?! be a binary relation on T erm(f ). Then?! + (and?! and!) is the transitive (transitive-reexive and transitive-reexivesymmetric, respectively) closure of?!. Dene the relations?!, 1 # and # 1 by 1?! =?! [ and # =?!? and # 1 = (?! 1?) \ (?! 1?). Terms s and t are called (strongly) joinable if s # t (resp. s # 1 t) holds.?! is called conuent if! # holds.?! is called terminating if there is no innite sequence (t i ) i2nof terms such that t i! t i+1 for all i. We say?! satises u = v, if u # v holds?! satises def(t), if t?! t 0 for some t 0 2 T erm(f 0 )?! satises u 6= v, if u?! u 0, v?! v 0 and not u 0 # v 0 for some u 0 ; v 0 2 T erm(f 0 ).?! satises? ;, if?! satises all u = v, def(t) and u 0 6= v 0 for all u = v, def(t) 2? and u = v 2. For denoting specications we identify a conditional rewrite system with a set of conditional equations. This is done in the next denition. In the same spirit, = R is dened according to Denition 7. Denition19. Let spec = (sig; R) be a hierarchical specication over spec 0 = (sig 0 ; R 0 ).

11 a) We dene (?! 0 i ) i2non T erm(f ) by:?! 0 0 = is the identity relation and s?! 0 i+1 t if s?! 0 i t or for some rule? =) l! r in R 0, p 2 O(s) and substitution we have s=p (l), t s[(r)] p and?! 0 i satises (? ). Then?! R 0= S i2n?!0 i. b) We dene (?! i ) i2non T erm(f ) by?! 0 =?! R 0 and s?! i+1 t if s?! i t or for some rule? ; =) l! r in R, p 2 O(s) and substitution we have s=p (l), t s[(r)] p and?! i satises (? ); (). Then?! R = S i2n?! i. We say R is conuent (resp. terminating) if?! R is. Note that?! R 0?! i for all i. It is well known that = R 1 =! R 1 = # R 1 for any positive conditional non-hierarchical rewrite system R 1 [Kap84]. This can be translated to our setting. Theorem 20. Let spec = (sig; R) be a hierarchical specication over spec 0. If R is conuent then = R =! R = # R. Now we use the general assumption on hierarchical rewrite systems that, for a rule? ; =) l! r in R 1 = R?R 0, the term l contains an operator f 2 F?F 0. So, no term u 2 T erm(f 0 ) is reducible by a rule in R 1. Furthermore, if u?! R 0 u 0 then u 0 2 T erm(f 0 ) also. So u # R v implies u # R 0 v for u; v 2 T erm(f 0 ). Theorem 21. Let spec = (sig; R) be a hierarchical specication over spec 0 = (sig 0 ; R 0 ). If R is conuent then spec is a consistent extension of spec. Corollary 22. Let spec = (sig; R) be a hierarchical specication over spec = (sig 0 ; R 0 ). Let R be conuent and def-moderated. Then spec is admissable. 2 Notice that these results require no termination assumption on R. It is easy to check whether R is def-moderated. So it remains to develop conditions under which R is conuent. This is done by using the notion of critical pairs. Denition 23. a) Let R be a hierarchical rewrite system. Let? i ; i =) l i! r i, i = 1; 2 be (variable-disjoint) rules in?. Let p 2 O(l 1 ), l 1 =p 62 V and let = mgu(l 1 =p; l 2 ). Then (? 1 [? 2 ); ( 1 [ 2 ) =) (r 1 ) = (l 1 [r 2 ] p ) is a critical pair for R. Let CP (R) be the set of all critical pairs. b) A critical pair? ; =) u = v is (strongly) joinable if for any ground substitution such that?! R satises (? ); () we have (u) # R (v) (resp. (u) # R;1 (v)). We rst study sucient conditions for R to be conuent without the assumption that R is terminating. For this we use the fact that (x) 2 T erm(f 0 ) for all x 2 V, sort(x) 2 S 0 and all substitutions. So (x) is not reducible by any rule? ; =) l! r in R? R 0. Theorem 24. Let spec = (sig; R) be a hierarchical specication over spec 0 = (sig 0 ; ;) such that S 0 = S. If all critical pairs in CP (R) are strongly joinable then R is conuent.

12 Now we assume that R is terminating. Let be a reduction ordering ([DJ90]) and > the subterm ordering. Then st = ( [ >) + is well-founded. Denition25. A hierarchical rewrite system R is decreasing with respect to the recution ordering if for each rule? ; =) l! r we have?! R and (l) st (s) for all s 2 fu; v j u = v 2? [ g [ ft j def(t) 2? g and all substitutions. R is decreasing if it is decreasing with respect to some reduction ordering. For example, if is a reduction ordering and l r and l st s for all s 2 fu; v j u = v 2? [ g [ ft j def(t) 2? g holds, then R is decreasing. If R is nite and decreasing then?! R is eectively computable. Theorem 26. Let R be a decreasing hierarchical rewrite system. If all critical pairs are joinable then R is conuent. We conclude this chapter by giving some examples. All the examples discussed in section 1.1, except Example 4 are easily proved to be conuent by using Theorem 26. We consider Example 3. There is only one critical pair ff(x; y) = f(y; x)g; ff(x; y) = f(y; x)g =) 0 = s(0) (This is our formal way of writing f(x; y) = f(y; x); f(x; y) 6= f(y; x) =) 0 = s(0).) For any substitution we have (x) s i (0). One easily proves that (f(x; y)) does not reduce to a constructor term s k (0). So there is no such that?! R satises (? ); () with? = = ff(x; y) = f(y; x)g. Hence all critical pairs are joinable. Since R is decreasing, R is conuent. Let us go into some more detail here. For non-hierarchical decreasing rewrite systems the following is known [AL94]: To prove conuence of R, those critical pairs? =) u = v need not be considered where? contains s = t 1 and s = t 2 and t 1 6 t 2 and (t 1 ), (t 2 ) are irreducible for all ground substitutions. (This holds, for example, it t 1 and t 2 are irreducible ground terms.) Clearly, this holds for hierarchical rewrite systems also. In [Wir95] it is proved that critical pairs? ; =) u = v often need not be considered if? \ 6= ;. So the rewrite system of Example 3 is conuent by Theorem 65 of [Wir95]. This holds also if f(0; y) = y is added to E 1. We now turn to Example 4. Let F 0 = f0; sg, F = F 0 [ f+; search; divg, R 0 = ; and R: x + 0! x x + s(y)! s(x + y) x 0! 0 x s(y)! (x y) + x y 6= 0 =) div(x; y)! search(x; y; 0; 0g x 6= v =) search(x; y; u; v)! search(x; y; s(u); v + y) x = v =) search(x; y; u; v)! u Here R is not terminating. One easily proves by induction on the term structure of t: It t 1 R? t?! R t 2 then t 1?! R R? t 2. (Notice 1 1 that

13 (z) s i (0) for any ground substitution and any z 2 dom().) So?! R is strongly conuent and hence conuent. Using techiques described in [AM95] one can prove that the following in an inductive theorem of spec: def(div(x; y)) =) div(x; y) y = x References [AL94] J. Avenhaus and C. Lora-Saenz. On conditional rewrite systems with extra variables and deterministic logic programs. In Proc. Int. Conference on Logic Programming and Automated Reasoning, volume 822 of Lecture Notes in Computer Science, pages 215{229. Springer-Verlag, [AM95] J. Avenhaus and K. Madlener. Theorem proving in hierarchical specications. SEKI-Report SR-95-14, Fachbereich Informatik, Universitat Kaiserslautern, [Ave95] J. Avenhaus. Reduktionssysteme (in German). Springer-Verlag, [BWP84] M. Broy, M. Wirsing, and C. Pair. A systematic study of models of abstract data types. Theoretical Computer Science, pages 139{174, [DJ90] N. Dershowitz and J.-P. Jouannaud. Rewrite systems. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science, volume B, chapter 6, pages 243{320. Elsevier, [Kap84] S. Kaplan. Conditional rewrite rules. Theoretical Computer Science, 33:175{ 193, [Kap88] S. Kaplan. Positive/negative conditional rewriting. In Proc. 1 st International Workshop on Conditional Term Rewriting Systems, volume 308 of Lecture Notes in Computer Science, pages 129{143. Springer-Verlag, [KM86] [Pad92] [Wec92] D. Kapur and D.R. Musser. Inductive reasoning with incomplete specications. In Proc. 1 st Annual IEEE Symposium on Logic in Computer Science, pages 367{377. IEEE Computer Society Press, P. Padawitz. Deduction and declarative programming. Cambridge University Press, W. Wechler. Universal algebra for computer scientists, volume 25 of EATCS Monographs on Theoretical Computer Science. Springer-Verlag, [WG93] C.-P. Wirth and B. Gramlich. A constructor-based approach for positive/negative conditional equational specications. In Proc. 3 rd International Workshop on Conditional Term Rewriting Systems, volume 656 of Lecture Notes in Computer Science, pages 198{212. Springer-Verlag, [WG94a] C.-P. Wirth and B. Gramlich. A constructor-based approach to positive/negative-conditional equational specications. Journal of Symbolic Computation, 17:51{90, [WG94b] C.-P. Wirth and B. Gramlich. On notions of inductive validity for rst-order equational clauses. In Proc. 12 th International Conference on Automated Deduction, volume 814 of Lecture Notes in Articial Intelligence, pages 162{ 176. Springer-Verlag, June [Wir95] C.-P. Wirth. Syntactic conuence criteria for positive/negative-conditional term rewriting systems. SEKI-Report SR-95-09, Fachbereich Informatik, Universitat Kaiserslautern, This article was processed using the LaT E X macro package with LLNCS style