Angelic Nondeterminism in the Unifying Theories of Programming Ana Cavalcanti  Jim Woodcock and Steve Dunne Department of Computer Science University of York York Y O DD England School of Computing U
217K - views

Angelic Nondeterminism in the Unifying Theories of Programming Ana Cavalcanti Jim Woodcock and Steve Dunne Department of Computer Science University of York York Y O DD England School of Computing U

Hoare and Hes unifying theories of programming UTP is a model of alphabetised relations expressed as predicates it supports development in several programming paradigms The aim of Ho are and Hes work is the uni64257cation of languages and techniques

Download Pdf

Angelic Nondeterminism in the Unifying Theories of Programming Ana Cavalcanti Jim Woodcock and Steve Dunne Department of Computer Science University of York York Y O DD England School of Computing U

Download Pdf - The PPT/PDF document "Angelic Nondeterminism in the Unifying T..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation on theme: "Angelic Nondeterminism in the Unifying Theories of Programming Ana Cavalcanti Jim Woodcock and Steve Dunne Department of Computer Science University of York York Y O DD England School of Computing U"— Presentation transcript:

Page 1
Angelic Nondeterminism in the Unifying Theories of Programming Ana Cavalcanti , Jim Woodcock and Steve Dunne Department of Computer Science, University of York, York, Y O10 5DD, England School of Computing, University of Teesside, Middlesbroug h, TS1 3BA, England Abstract. Hoare and He’s unifying theories of programming (UTP) is a model of alphabetised relations expressed as predicates; it supports development in several programming paradigms. The aim of Ho are and He’s work is the unification of languages and techniques, so t hat we can benefit from results in

different contexts. In this paper, we i nvestigate the integration of angelic nondeterminism in the UTP; we pro pose the unification of a model of binary multirelations, which is iso morphic to the monotonic predicate transformers model and can express angelic and demonic nondeterminism. 1 Introduction Angelic nondeterminism is a specification and programming c oncept that is typ- ically available in unified languages of refinement calculi [ Mor94,BW98], and in concurrent constraint programming languages [JSS91]. In p rogram development techniques, it is

reflected in choice constructs in which the choice is not arbitrary, but made to guarantee success, if possible. In programming l anguages, it is re- flected in the use of backtracking in exhaustive searches. Th e work in [MGW96] explores angelic nondeterminism in tactics of proofs. In contrast, demonic nondeterminism is related to an arbitr ary choice con- struct that provides no guarantees; success is still a possi bility, but it does not influence the choice. Demonic choice is commonly used to mode l abstraction and information hiding; in this case, choice is used in a

spec ification to explicitly indicate options that are left open to the programmer. In [GM91], Gardiner and Morgan identify angelic choice with the least up- per bound in the lattice of monotonic predicate transformer s. In [MG90], they use this construct to define logical constants, which are per vasive in refinement techniques, and sometimes named logical, auxiliary, or ang elic variables. They play a fundamental rˆole in the formalisation of data refinem ent of recursive pro- grams, and, more importantly, they are used in calculationa l simulation rules for

specification statements and guarded commands. In [Mor94] Morgan proposes an algebraic approach to refineme nt. In that work, logical constants are at the heart of the formalisatio n of initial variables, which are used in specification statements: they appear in po stconditions to refer to values of variables before the execution of the program. L ogical constants are also central to the stepwise calculational development of s equences and loops.
Page 2
Back and von Wright’s work [BW98] has also explored the use of angelic non- determinism. They have extensively

studied the set of monot onic predicate trans- formers as a lattice with the refinement ordering. They have i dentified interesting sublattices, in which choice can be angelic or demonic, and a complete base lan- guage, which can describe any monotonic predicate transfor mer [BW89,BW90]. More recently, they have suggested the use of angelic choice to model user in- teractions with a system, and game-like situations. Morgan’s refinement calculus has been adapted to handle Z spe cifications; the resulting calculus is called ZRC [CW99]. It is incorpora ted in Circus

[WC02], a combination of Z and CSP that supports refinement of state-r ich, reactive pro- grams. The design of Circus follows the trend to combine notations; it has been successfully applied in case studies, and has a refinement te chnique that sup- ports decomposition of the state and behaviour of centralis ed systems [CSW03]. Extensions of Circus include constructs to handle, for example, time and mobilit y. The semantics of Circus is based on Hoare and He’s unifying theories of programming (UTP) [HJ98,WC04]. This is a predicate-based r elational model that links constructs in

several paradigms: imperative, co ncurrent, logical, and others. By providing a framework for the study of state and re active aspects of a program, the UTP is a solid basis for the model of Circus and of its extensions. Nevertheless, logical constants and, more generally, ange lic nondeterminism are not considered. Since we adopt Morgan’s calculational refin ement style, we have pursued the possibility of modelling angelic nondetermini sm in the UTP. Angelic nondeterminism has been extensively studied using weakest pre- condition semantics. There are results on the relationship between

relational and predicate transformer models in which relations are set s of pairs of states and predicates are sets of states [Hes92,CW98]. These resul ts establish that a straightforward relational model that associates initial with final states cannot capture angelic and demonic nondeterminism. In this paper, firstly, we consider a set-based relational mo del for the UTP. Secondly, we propose a predicate transformer model; conjun ctive predicate trans- formers correspond to the set-based relations, and therefo re to UTP relations. These models clarify some aspects of the UTP, and

establish t hat the general model of UTP relations does not cover angelic nondeterminis m. In [CW05] we have proposed a UTP theory that can cover both ang elic and demonic nondeterminism based on the model of binary mult irelations in- troduced in [Rew03]. We based our proposal on an isomorphism between binary multirelations and predicate transformers suggested in [R ew03]. We have stud- ied refinement and some programming operators, including se quence and angelic nondeterminism in that theory. It was unfortunate that the r efinement relation had a definition different

from that adopted in all other UTP th eories: implica- tion, instead of reverse implication. Also, we had a quite el aborate definition for sequence. Here, we consider a different isomorphism between binary mul tirelations and predicate transformers; in the new UTP theory that it sugges ts, refinement is reverse implication. From the point of view of unification, w hich is, of course, a
Page 3
central concern in the UTP, this is very pleasing. It means th at the new theory can be combined with the existing UTP theories using the appr oach already illustrated

in [HJ98]. In the context of the new theory, we co nsider the definition of all programming operators studied in the general theory o f relations, and designs, which are basically specification statements. We a lso give a definition of sequence that is much simpler than that in [CW05]; this mak es our theory much more tractable and attractive. In the next section, we present an overview of the UTP. In Sect ion 3, we consider a set-based relational model and a predicate trans former model for the UTP. In Section 4, we enrich the UTP with a theory to cope with a ngelic and

demonic nondeterminism. The definition of programming oper ators in the new theory is the subject of Section 5. Finally, in Section 6 we pr esent our conclusions and directions for future work. 2 Unifying theories of programming The objective of Hoare and He’s work on unifying theories of p rogramming is to study and compare programming paradigms. The main concern i s with program development; using the framework of the UTP, it should be pos sible to take advantage of different techniques and approaches whenever c onvenient. In the general theory of relations of the UTP, a relation

is a p air ( ), where is a set of names of observational variables, and is a predicate. The set of variables is the alphabet of the relation; it conta ins both the set in of undashed names of the observational variables, and the se out of dashed names. The undecorated name of a variable refers to it s value before the execution of the program, and the dashed name refers to its va lue in a subsequent observation. The free variables of must be contained in Each observational variable records information relevant to characterise the behaviour of a program. For example, program variables are o

bservational vari- ables; the model of an assignment := , if the program variables are , and , is as follows. := = ( The alphabet is . The assignment sets the final value of which is represented by , to ; all the other variables are unchanged. The program II = ( ) skips: it does not change the observational variables . We write as an abbreviation for a conjunction of equalities that stat that the final value of each variable is equal to its initial va lue. A sequence is defined as relational composition, if, for each dashed variable in the alphabet of , the undashed variable

is in the alphabet of The set in is obtained by dashing all variables in ) ; ) provided out in The notation ) emphasises that may have free occurrences of observational variables ; the later reference to ) refers to the predicate obtained by
Page 4
substituting for the free occurrences of in . Similarly, for ) and ). In all cases, , and stand for lists of variables. The nondeterministic choice of relations and with the same alphabet is demonic. It behaves like either or The set of relations with a particular alphabet is a complete lattice, with order ; this is the refinement

ordering in this setting. More formal ly, the program denoted by is refined by that denoted by when [ ]; in that case we write . As a matter of fact, and can be either programs (assignments, sequence, choices, and others) or any relation used to speci fy a program; they are all relations. The square brackets denote universal qua ntification over all the alphabet. In contrast with the other operators, the greatest lower bou nd of a set of relations is defined algebraically: [ = ([ ] for all in ). The bottom of this lattice is the program true , which is called abort

Incidentally, the top element is false ; it is written and called miracle. Recursion is modelled using least fixed points. If ) is a relation, in which is used as a recursion variable, the recursive program is wri tten ). This is the least fixed point of the function Hoare and He point out what they regard an infelicity. The rec ursive program is supposed to model an infinite loop; it is equivalent to or true Nonetheless, if the alphabet is , then the sequence ( ) ; = 3 is equivalent to = 3, even though it should not be possible to recover from a program that does not

terminate. The solution proposed by Hoare and He is the introduction of a n extra boolean observational variable ok to record termination. If ok has value true , it means that the program has started; if ok has value true , then the program has terminated. In this new theory, relations take the form of de signs = ( ok ok The predicates and are the program’s pre and postcondition. If the design has started and the precondition holds, then it terminates and establishes the postcondition In this new theory, assignment and skip are redefined. Below, and stand for the observational variables

other than and := true II true The new definitions use designs to take ok and ok into account. Four healthiness conditions on relations are regarded of interest in the theory of designs; they are summarised in Table 1. Healthine ss condition H1 states that any restrictions on the behaviour of only need to hold if it has started. The second healthiness condition states that cannot require non- termination: if it holds when ok is false , then it also holds when ok is true Together, H1 and H2 characterise the designs: a predicate is H1 and H2 if and only if it can be written as a design.

Page 5
H1 = ( ok ) No predictions before startup H2 false ok true ok ]] Non-termination is not required H3 II Preconditions do not use dashes H4 true true Feasibility Table 1. UTP Healthiness conditions The healthiness conditions H3 and H4 are expressed as equations between programming constructs. Results presented in [HJ98] clari fy that H3 designs can be expressed using preconditions that do not refer to das hed observational variables, and that H4 designs model feasible or implementable programs. Designs form a UTP theory characterised by an alphabet that i ncludes ok and ok , and

by the healthiness conditions H1 and H2 . For reactive programs, for instance, we have a theory of relations whose alphabets incl ude six other obser- vational variables, and that satisfy two other healthiness conditions. Alphabets and healthiness conditions are the basis to compare and comb ine different the- ories. Later on, we present a theory for angelic (and demonic ) nondeterminism; beforehand, we study set-based models for the UTP. 3 Set-based models In this section, we consider two set-based models for the UTP : relations, charac- terised by sets of pairs, and predicate

transformers, with p redicates characterised by sets. These models further clarify the role of the healthi ness conditions in Ta- ble 1 and the internalized model of nontermination based on ok and ok . Most importantly, however, they provide guidance in the definiti on of a UTP theory based on binary multirelations. It is this theory that can ca pture both angelic and demonic nondeterminism. 3.1 Relations The set-based relational model is that of sets of pairs of sta tes. A state associates names (of observational variables) to their values. The set of all states on an alphabet contains

the records with a component for each variable in . Each such state is an observation of the behaviour of a program. A r elation, like a UTP predicate, is a pair ( ), where is the alphabet, and is a relation between the elements of in and out . Such a relation models a program by associating an observation of an initial state with a poss ible observation of a later state. The model for abort is the universal relation: in out ; when the pred- icate (or relation ) is not relevant, instead of writing in (or in ) and out (or out ), we simply write in and out . Partiality models miracles. If a

state is not in the domain of the relation, then it is miracul ous at that state: it
Page 6
can achieve any required result. In particular, the model of miracle is the empty relation. It is not difficult to see that the first general predicate-base d theory of the UTP is isomorphic to this set-based model. A simple proof is presented in [CW04]; it is based on the functions sb and sb Definition 1. sb = ( in out in out sb = ( in out in out )) The first, sb , transforms a UTP relation into a set-based relation; the se cond, sb is its inverse: it transforms a

set-based relation into a UTP relation. Both sb and sb do not change the alphabet of the relations. A similar set-ba sed model is used by Hoare and He when they discuss denotational s emantics. The set-based relation defined by sb for a predicative relation is formed by pairs of states and such that holds when the observational variables take the values associated to them by and . The predicate ] is obtained by replacing with , for all in The predicate defined by sb for a relation is an existential quantification over pairs of states and in . For each pair, a conjunction of

equalities requires that each observational variable takes the value i n the corresponding state. Since alphabets are finite, the conjunction is finite. If we use as an abbreviation for the state on alphabet that associates each component of name in with the value of the variable , then sb α, ) can be ex- pressed as ( in , out . The proof is a straightforward application of the one-point rule. The existential quantification probabl y accounts for a clearer definition for sb ; in proofs the shorter formulation is more convenient. Standard work on relational

semantics [HH85] singles out a s pecial state to indicate non-termination; this is not the case in our model. If an initial state is associated with all possible final states, then we cannot say whether the final state is simply arbitrary or we have a possibility of non-ter mination. In standard relational semantics, the model for abort that we presented above is actually the model for a program that always terminates, but whose final st ate is arbitrary. The isomorphism characterised by sb and sb suggests that the general UTP model of relations is not able to capture

non-terminatio n. As already men- tioned, Hoare and He pointed out a paradox in the fact that, if the alphabet is , then ( ); := 3 is equivalent to := 3. This is not really a paradox: the value of ( ) is the bottom of the lattice , which is not an aborting program, but the program that terminates and giv es an arbitrary value to . If, in sequence, we assign 3 to , then the arbitrariness is irrelevant. Their model is sensible, for terminating programs. (Their a ttempt to solve the supposed paradox by giving a strongest fixed point semantics to recursion was always doomed to fail.)

Page 7
For designs, the alphabet includes ok and ok ; therefore, these variables are also part of the alphabet of the corresponding set-based rel ations. In Table 2, we present healthiness conditions SBH1 SBH2 , and SBH3 over such relations; we omit the obvious types of and . The theorem below, proved in [CW04], establishes that H1 H2 , and H3 correspond to SBH1 SBH2 , and SBH3 in the set-based model. Theorem 1. For every UTP relation that satisfies H1 , p sb satisfies SBH1 . Conversely, for every set-based relation that satisfies SBH1 , sb satisfies H1 . The

same holds for H2 and SBH2 , and for H3 and SBH3 The condition SBH1 requires that, in a healthy relation , all states for which ok is false are related to all possible final states. This means t hat a state in which the program has not started is not miraculous and leads to no controlled behaviour. In relations that are SBH2 -healthy, if a state is related to a state for which ok is false, then is also related to ⊕{ ok 7 true . This is the same state as , except that the value of ok is true . This means that if it is possible not to terminate from , it is also possible to

terminate. Its behaviour, however, may not be completely arbitrary: it is not required that relates to all possible final states; this is what is required by SBH3 SBH1 ok false SBH2 ok false ⊕{ ok 7 true SBH3 ok false Table 2. Set-based healthiness conditions We believe that it is not difficult to observe that SBH3 relations are neces- sarily SBH2 . If the initial state is related to all possible final states, then it is also related to ⊕{ ok 7 true . This rather obvious result seems to be not so clear in the predicate setting. It means that, at least for the

purpose of the study of total correctness of sequential programs, Hoare an d He did not need to consider four healthiness conditions, but only three of the m: H1 H3 , and H4 It turns out, however, that non- H3 designs are important for the modelling of more sophisticated programming paradigms like CSP, for ins tance. The healthiness condition H4 requires feasibility. It is not relevant for us, as miracles are an important part of Morgan’s refinement calcul us and ZRC. 3.2 Predicate transformers In the model of predicate transformers, we regard predicate s as sets of states. The model is

composed of pairs ( PT PT ), where PT is the alphabet of the transformer, and PT is a total monotonic function from out PT to in PT A program is modelled by its weakest precondition transform er [Dij76].
Page 8
Isomorphisms between predicate transformers and set-base d relational mod- els have been studied [Hes92]; the one below is similar to tha t in [CW98]. We define functions sb pt and pt sb ; the first transforms a set-based relation into a weakest precondition, and the second transforms a weakest precondition back into a set-based relation. For simplicity, we ignore

alphab ets, which are main- tained by both functions. Definition 2. sb pt . dom( pt sb PT in PT out PT PT { In the definition of sb pt is a postcondition, or rather, a set of states on out , which is given as argument to the transformer sb pt . The relation models all executions of that do not lead to a state that satisfies ; the operator is range subtraction. In dom( ), we have all initial states in which it is possible not to achieve . The complement dom( ) contains all initial states in which we are guaranteed to reach a state that satisfies : the required

weakest precondition. The relation pt sb PT associates an initial state to a final state if is not in the weakest precondition that guarantees that PT does not establish Since it is not guaranteed that PT will not establish , then it is possible that it will. The possibility is captured in the relation. Since the general set-based relations can only model termin ating programs, we cannot expect an isomorphism between them and the whole se t of predicate transformers. In fact, we prove that they are isomorphic to t he set of universally conjunctive predicate transformers PT : those that

satisfy the property below. PT ) = PT . (1) An important and well-known consequence of this isomorphis m is that UTP re- lations cannot model angelic as well as demonic nondetermin ism. Since we have an isomorphism between UTP relations and set-based relatio ns, and another between set-based relations and universally conjunctive p redicate transformers, then UTP relations are isomorphic to universally conjuncti ve predicate trans- formers. As already said, the angelic choice in which we are intereste d is the least upper bound of the lattice of monotonic predicate transform ers. Joins in the

lattice of universally conjunctive predicate transformer s are not preserved in the lattice of monotonic predicate transformers [BW92]. We nee d a relational model isomorphic to the monotonic predicate transformers. We investigate, next, the set of predicate transformers tha t correspond to UTP designs. In this case, ok is in the alphabet of the states in a precondi- tion, and ok is in the alphabet of the states in a postcondition. Table 3 gi ves healthiness conditions over such predicate transformers PT . The first healthiness condition, PTH1 , requires that the weakest precondition for

PT to establish any is included in the set of initial states for which ok is true. In other words, in order to guarantee a postcondition, PT must start. The only exception is the postcondition out PT , which imposes no restrictions whatsoever.
Page 9
PTH1 PT . ⊆{ in PT ok true provided out PT PTH3 PT . PT ok true provided out PT Table 3. Predicate transformers healthiness conditions The healthiness condition PTH3 states that, in calculating PT . , we can ignore all the states in for which ok is false. In other words, even if we have and ⊕{ ok 7 true in , so that

termination is not required, if PT can guarantee or ⊕{ ok 7 true , then it can guarantee ⊕{ ok 7 true Moreover, if is in , but ⊕{ ok 7 true is not, so that non-termination is actually required, then PT cannot do it. Consequently, predicate transformers do not capture information related to the possibility of non -termination. Again, the postcondition out PT is an exception. As stated in the theorem below, which is proved in [CW04], PTH1 and PTH3 correspond to H1 and H3 Theorem 2. For every set-based relation R that satisfies SBH1 , sb pt R satis- fies PTH1 .

Conversely, for every predicate transformer PT that satis fies PTH1 pt sb PT satisfies SBH1 . The same holds for SBH3 and PTH3 The healthiness conditions PTH1 and PTH3 restrict the behaviour of the predi- cate transformers for postconditions different from out PT . This postcondition, however, is of special interest. Standard universally conjunctive predicate transformers can only model ter- minating programs; this is because, if (1) holds for the empt y set, then PT out in In words, for the postcondition that does not impose any rest rictions, any initial state is

satisfactory. Nevertheless, the postcondition th at does not impose any restriction still requires termination. Therefore, it is r equired that the program always terminates. In the context of predicate transformers that involve state s on ok and ok however, the situation is different. The postcondition out does not require termination: it accepts any final state , even those for which ok false Similarly, the precondition in does not even require the program to start. Therefore, the universal conjunctivity of the predicate tr ansformers correspond- ing to designs does not imply

that only terminating programs can be modelled. Unfortunately, conjunctivity is still an issue: the predic ate transformers that are PTH1 and PTH3 healthy are conjunctive. As a consequence, they cannot mode angelic nondeterminism. We need a model isomorphic to monot onic, not neces- sarily conjunctive, predicate transformers. This is pursu ed in the next section. As an aside, we observe that when we consider H3 -healthy designs, we get a model isomorphic to standard conjunctive weakest precondi tions; in [CW04] we present an isomorphism between the predicate transformers above and those on

postconditions and preconditions that do not refer to ok and ok . In [Dun01], different healthiness conditions that lead to a theory of gen eral correctness are proposed.
Page 10
4 Binary Multirelations A relational model isomorphic to monotonic predicate trans formers is presented in [Rew03]; in that work, the relations are called binary mul tirelations. We stud- ied that model in the context of the UTP in [CW05]. We defined a b inary multirelation as a pair ( BM BM ), where BM is an alphabet, and BM is a relation between in BM and postconditions: elements of out BM .

Intuitively, BM captured the behaviour of a program by associating each init ial state with all the postconditions that the program can angelically cho ose to satisfy. The encoding of this model in the UTP leads to a theory in which re nement is captured by implication, instead of reverse implication. In this section, we explore a similar model of binary multire lations in which behaviour is captured by relating an initial state to all the sets of states from which an angelic choice can be made to determine a final state f or the program. The choice between the sets of states themselves

is demonic. The model for abort , for example, is the universal relation; this means that we can demonically choose any set of states as options open for t he angelic choice. In other words, the demonic choice prevails, since any set of options whatsoever, including the empty set, can be left for the angelic choice. M iracle, on the other hand, is the empty relation; this means that there are no demo nic choices to be made. In general, a computation characterised by a binary mu ltirelation BM is at risk of not terminating when executed from any starting st ate such that BM . On the other hand,

execution is miraculous from any state ou tside the domain of BM . All this is, of course, in sympathy with the set-based model of Section 3. The binary multirelation for an assignment := relates every initial state with every set that includes ⊕{ 7 . The state is obtained from by dashing the names of each of the variables in its domain. Ther efore, ⊕{ 7 is a final state in which the value for each variable of out is , except for , whose value is . If executed in , the assignment := reaches the final state ⊕{ 7 . The fact that the binary multirelation associates

to all sets that include this state, instead of just to the singleto n set ⊕{ 7 }} needs further explanation. In fact, given any two states and , providing the set of angelic choices, in addition to the set , as an extra option available for demonic choice is immaterial. Since cannot be guaranteed to be available for the an- gelic choice, there can be no guarantee that the program will achieve . More generally, in algebraic terms, we have that ) = , where and represent demonic and angelic choice; this property can be e asily proved in the predicate transformer model, for example. In

general, in the binary multirelation model, if an initial state is associated with a set of states ss , then associating to a superset of ss does not add to the options that are actually available for angelic choice. We could provide a definition of refinement that takes this fact into account, an d regards the relation that associates only to ss and a relation that associates to ss and to one or more of its supersets as equal. We are striving, however, for a simple definition of
Page 11
refinement. Therefore, we choose to identify one of those bin ary

multirelations as the unique model of the program that actually only provide s the states in ss for angelic choice. Inspired by the model in [Rew03], we choo se the set of binary multirelations that are upward closed. This is captu red in the following healthiness condition. BMH ac ac ac BM ac ac ac BM This states that, if from an initial state , the set of angelic choices ac is available for demonic choice, so are all the supersets ac of ac The binary multirelation that models the angelic choice := 0 := 1, with alphabet , is ac |{ 7 0) 7 1) } ac . It associates to each initial state the sets

of angelic choices that include ( 7 0) and ( 7 1). This is because the angel can ensure the final value of to be either 0 or 1, as required. We use ( 7 ) to denote a record with a single component named whose value is . For the demonic choice, := 0 := 1, the range of the binary multirelation includes the supersets of 7 0) and 7 1) . In this case, the demon is in control: the final value of is arbitrarily chosen to be 0 or 1. For := 0 := 1 := 2), which is a program that involves an angelic and a demonic choice, the model is ac |{ 7 0) 7 1) } ac ∨{ 7 0) 7 2) } ac The demonic

choices available cannot prevent the angelic ch oice of 0 for the final value of : all sets ac that can be demonically chosen include the state ( 7 0). The options ( 7 1) and ( 7 2), however, are left open for demonic choice. The functions below define an isomorphism between binary mul tirelations and predicate transformers. Definition 3. bm pt BM . BM pt bm PT , PT The function bm pt converts a binary multirelation to a weakest precondition transformer. We have that bm pt BM is guaranteed to establish a postcondition in all initial states for which there is not a set of

states disjoint from that can be demonically chosen. If, in all sets of states availabl e for demonic choice, there is at least one state that is acceptable from the point o f view of , or in other words, belongs to , the angelic choice is guaranteed to select such a state to satisfy . In the definition of bm pt , we consider specifically whether the complement of is associated to . If any set disjoint from is associated to then upward closedness guarantees that the complement of is also associated with Conversely, the multirelation pt bm PT associates an initial state with all the

postconditions that PT is not guaranteed not to establish from . These are the sets of states that may be reached from . They are taken as available for demonic choice. This isomorphism is simpler than that presented in [Rew03], which constructs the binary multirelation corresponding to a predicate tran sformer using prime filter representations of states. Our proof that bm pt and pt bm characterise an
Page 12
isomorphism between predicate transformers and binary mul tirelations is very simple, although slightly more complex than that in [CW05]. Theorem 3. pt bm bm pt BM ) = BM

Proof. pt bm bm pt BM ) [definition of pt bm , bm pt BM [definition of bm pt , ∈{ BM }} [property of sets] , ∈{ , BM }} [property of set comprehension] , , BM [property of sets] BM Theorem 4. bm pt pt bm PT ) = PT Proof. bm pt pt bm PT . [definition of bm pt pt bm PT [definition of pt bm ∈{ , PT }} [property of set comprehension] PT [property of sets] PT . [property of sets] PT . The following two theorems establish that monotonic predic ate transformers correspond to BMH -healthy multirelations. First of all, healthy binary mult ire- lations

define monotonic predicate transformers. Theorem 5. For a BMH -healthy binary multirelation BM, bm pt BM is mono- tonic. Proof. We consider two postconditions and [property of sets] BM is healthy] BM BM [predicate calculus] BM BM [definition of bm pt bm pt BM . bm pt BM .
Page 13
Now, a monotonic predicate transformer corresponds to a hea lthy binary mul- tirelation. Theorem 6. For a monotonic PT, the binary multirelation pt bm PT is BMH healthy. Proof. We consider two postconditions and , and an initial state [property of sets] PT is monotonic] PT PT ) [property of sets]

PT PT ) [property of sets] PT PT ) [definition of pt bm = ( , pt bm PT , pt bm PT In conclusion, we have a model isomorphic to monotonic predi cate transform- ers. What we need now is a way of expressing multirelations as alphabetised predicates. 4.1 Predicative theory sb2p pt2sb bm2pt binary multirelations predicate transformers Set-based relations UTP predicates pt2bm sb2pt p2sb Fig.1. Models and isomorphisms The key point to define a UTP theory based on binary multirelat ions is the choice of alphabet. We propose a view of a binary multirelati on as a relation between a state on

an alphabet in and a state on ac . The value of ac is the set of angelic choices available to the program: a set of s tates on an alphabet out Figure 1 summarises the isomorphisms we have defined so far. W e are looking for a way of representing binary multirelations as UTP predi cates. We cannot use pt sb in the transformation because it cannot handle non-conjunc tive predicate transformers. Instead, we define an isomorphism between bin ary multirelations and set-based relations with alphabet in ∪{ ac . It is based on the functions below.
Page 14

4. bm sb BM in ac ac BM sb bm ACR in ss out ac 7 ss )) ACR Using bm sb , we get a standard set-based relation in which the sets in the range of the original binary multirelation are wrapped in re cords with a single component ac ; the function sb bm unwraps these records. The proof that bm sb and sb sm establish an isomorphism is trivial. Since predicate transformers are the standard setting for t he study of angelic nondeterminism, we aim at expressing predicate transforme rs as predicates using pt bm bm sb , and sb . In our calculations, we name the composition of pt bm bm sb , and sb as pt

sb bm sb pt bm . The next theorem is useful. Theorem 7. pt PT in PT ac We omit its simple proof. Figure 2 shows the additional isomo rphism and func- tion that we use in the sequel. For example, the predicate tra nsformer abort maps all postconditions to the empty set: it can never guaran tee anything. In the UTP, it corresponds to true Theorem 8. pt abort true Proof. pt abort [Theorem 7] in abort ac ) [definition of abort in [property of sets] true The everywhere miraculous program is represented by false . Other relations are considered in Section 5. 4.2 Healthiness condition In the

UTP, the healthiness condition for binary multirelat ions is as follows. PBMH ; ( ac ac ) = This requires that, if, after executing , we execute a program that enlarges ac then the result could have been obtained by itself. A healthy characterises ac not by defining a particular value for it, but the smallest set of elements it should include. All the supersets should be allowed. Healthy binary multirelations correspond to PBMH -healthy predicates. Theorem 9. If BM is BMH -healthy, then sb bm sb BM is PBMH -healthy.
Page 15
sb2p pt2sb bm2pt binary multirelations predicate

transformers Set-based relations UTP predicates pt2bm sb2pt p2sb pt2p bm2sb sb2bm Fig.2. Extra isomorphism Proof. sb bm sb BM ); ( ac ac ) [definition of bm sb sb in ac ac BM ; ( ac ac [definition of sb = ( in α, ac ∈{ in ac ac BM ; ( ac ac [property of sets] = (( in α, ac BM ); ( ac ac ) [definition of sequence] ac in α, ac BM ac ac BM is BMH -healthy and predicate calculus] = ( in α, ac BM [definitions of sb and bm sb sb bm sb BM This proof is simpler than that of the corresponding theorem in [CW05]. Theorem 10. If P is a PBMH -healthy

predicate, then sb bm sb is BMH healthy. Proof. Let and be such that , sb bm sb [definition of sb = ( , sb bm in α, ac [definition of sb bm = ( , ∈{ in ss ac ac 7 ss )) ∈{ in α, ac }}
Page 16
[property of sets] = ( ac 7 )) ∈{ in α, ac [property of sets] , in α, ac is PBMH -healthy] = ( ac ac )[ , in α, ac [substitution] in ]; ac [definition of sequential composition] ac ac in α, ac ac ac ac in α, ac ac [definition of sequential composition, and substitution] = ( ; ( ac ac ))[ , in α, ac ] [ is PBMH

-healthy] , in α, ac ] [definitions of sb and sb bm = ( , sb bm sb It is pleasing that the healthiness condition can be cast in a quite simple way, and also in terms of the fixpoint of an idempotent function PBMH defined as PBMH ) = ac ac . This is important for the approach to linking theories encouraged by the UTP. 4.3 Refinement The refinement relation is reverse implication, as in all the ories of the UTP. We prove that this corresponds to the refinement relation of the model of binary multirelations. Definition 5. BM BM BM BM BM The pre-order

proposed in [Rew03] for binary multirelation s becomes a partial order in the restricted setting of healthy binary multirela tions; also, it collapses to set inclusion. We have adopted the inverse order here, which is also the standard definition of refinement for set-based relations. It is reassuring that this order corresponds to the usual re nement relation in the model of predicate transformers, which we present bel ow. Definition 6. PT PT PT PT . PT . The next theorem establishes that the above notions of refine ment are indeed compatible. Theorem 11. BM BM BM if,

and only if, bm pt BM PT bm pt BM
Page 17
Proof. bm pt BM PT bm pt BM [definition of PT bm pt BM . bm pt BM . [definition of bm pt •{ BM }⊆{ BM [property of sets] ψ, BM BM [property of sets] ψ, BM BM [predicate calculus] ψ, , , BM , BM [property of sets] ψ, , , BM , BM [predicate calculus] , , BM , BM [property of sets] BM BM [definition of BM BM BM BM The correspondence between UTP and binary multirelation re finement is estab- lished below. Theorem 12. Q if, and only if, sb bm sb BM sb bm sb Proof. sb bm sb BM sb bm sb )

[definition of BM sb bm sb sb bm sb ) [property of sets] , , sb bm sb , sb bm sb [definitions of sb bm and sb , ,ψ/ in α, ac ,ψ/ in α, ac ] [predicate calculus] in α, ac [the alphabet is in ∪{ ac = [ ] [definition of refinement in the UTP] Refinement in the set-based model of the UTP is also reverse set inclusio n, like in the binary multirelation model. That this relation c orresponds to the others is not a surprising result; the proof that it correspo nds to refinement in the predicate model and in the binary multirelation

model, f or example, is a direct consequence of subset inclusion properties. In the n ext section, we use the following result. Theorem 13. PT PT PT if, and only if, pt PT pt PT
Page 18
Proof. pt PT pt PT [definition of pt sb bm sb pt bm PT )) sb bm sb pt bm PT )) [definition of sb and property of sets] bm sb pt bm PT bm sb pt bm PT [definition of bm sb and property of sets] pt bm PT BM pt bm PT [Theorem 11] bm pt pt bm PT PT bm pt pt bm PT ) [Theorem 4] PT PT PT Now, we have a UTP theory that corresponds to monotonic predi cate transform- ers. In the next section,

we explore the definition of the oper ators in our new theory; besides angelic choice, we consider operators defin ed the general theory of UTP relations and designs. 5 Operators We have already calculated the definition of abort in our new theory; the calcu- lation for miracle is equally simple. In this section, we use the function pt to justify the definitions of other relations and relational op erators in our theory of angelic nondeterminism. 5.1 Choice: angelic and demonic Of course, angelic choice is the first operator of interest. In the predicate

transformer model, it is characterised by disjunction (or u nion), which is the least upper bound operator. In our new UTP theory, it is characteri sed by conjunction. The program gives all the guarantees that can be provided by choosing , together with those that arise from the possibility of choo sing Theorem 14. pt ) = pt pt Proof. pt [Theorem 7] in ac ) [predicate transformer semantics of in ac ac )) [property of sets] in ac ac ) [property of sets] in ac in ac ) [Theorem 7] pt pt
Page 19
Like in the original UTP model, demonic choice is captured by disjunction. In the predicate

transformer model, it is captured by conjunct ion: a postcondition is guaranteed by only if both and can guarantee it, so that the arbitrary choice is not a problem. Theorem 15. pt ) = pt pt Proof. Similar to that of Theorem 14. Logical constants are defined as the least upper bound operat or in the complete lattice of monotonic predicate transformers [GM91], which is equal to that in the complete boolean lattice of predicate transformers [BW90] . It also corresponds to the least upper bound operator in our theory: universal qu antification. Theorem 16. pt con )) = pt Proof. pt con

)) [Theorem 7] in con )) ac [predicate transformer semantics of con in ac [property of lattice of predicate transformers] in ac [property of sets] in ac ) [Theorem 7] pt A similar proof establishes that the greatest lower bound op erator in the predi- cate transformer model corresponds to the greatest lower bo und operator in our theory. 5.2 Assignment Assignment can be defined as follows as a predicate transform er. := . ⊕{ 7 } (2) This corresponds to substitution: the standard weakest pre condition semantics of assignment, but it is expressed using sets. Moreover, the re is a

slight com- plication due to the fact that postconditions and precondit ions are predicates on different variables, or rather, states on in and on out . A similar weakest precondition semantics is considered in [CW99] for Z. In the above notation, := is guaranteed to establish when executed in an initial state , if the final state ⊕{ 7 obtained by dashing the variables of and associating to belongs to The theorem below gives a definition for assignment in our UTP theory of angelic nondeterminism.
Page 20
Theorem 17. pt := ) = ( in ⊕{ 7 } ac Proof. pt :=

[Theorem 7] in (( := ac ) [predicate transformer semantics of := (2)] in ∈{ ⊕{ 7 } ac [property of sets] = ( in ⊕{ 7 } ac The assignment is a deterministic command, which does not re ally involve either demonic or angelic choices. Therefore, the uniquely determ ined final state of the assignment is in all sets of angelic choices available for de monic choice. Moreover, since any set that includes that final state is available for d emonic choice, the angelic choice can provide no interesting guarantees. 5.3 Conditional We consider the conditional command ,

which behaves like , if the condition holds, and like otherwise. This is the form of conditional studied in the UTP, where is a condition: a predicate over the input alphabet, only. To convert to a set, we use the function sb , which is similar to sb , but it results in sets of states, instead of sets of pairs of state s; its inverse is sb which is similar to sb Definition 7. sb / sb in It is not difficult to establish an isomorphism between sets of states and condi- tions based on sb and sb The semantics of conditionals in our new theory is the subjec t of the next theorem. Theorem

18. pt ) = ( pt pt Proof. pt [Theorem 7] in ac ) [predicate transformer semantics of in sb ac sb ac )) [property of sets] in sb ac )) in sb ac )) [property of sets] = ( in sb in ac )) in sb in ac ))
Page 21
[property of sets and definition of sb = ( sb sb in ac )) sb sb in ac )) [definitions of sb and sb = ( in ac )) in ac )) [definition of pt = ( pt pt ) [predicate calculus] = ( pt pt Basically, the semantics of conditional is the same as that i n the general theory of relations. 5.4 Sequence Sequential composition cannot correspond to relational co mposition,

since the relations are not homogeneous. We provide here a much simple r definition than that suggested in [CW05], though. The weakest precondition semantics of sequence is function composition. In our setting, since preconditions are over states on in and postconditions are over states on out , the composition is not direct. The definition is as follows. . . (3) As usual, the weakest precondition for to establish is the weakest precon- dition for to establish the weakest precondition for to establish . However, the weakest precondition for to establish is not a postcondition,

since it is a set of initial states. The corresponding postcondition is . . For a set of initial states ss , the set ss contains states , for each initial state in ss ; more formally, in terms of the relational image operator: ss ss ). In the context of our UTP theory, the definition can be surpris ingly simple. The definition of sequence for binary multirelations is very intuitive. BM BM ss | ss ss BM ss ⊆{ ss BM }} (4) An initial state is associated to a set of angelic choices ss in ( BM BM ) if BM associates to a set ss of angelic choices such that, whatever state from ss

is chosen, the execution of BM from that state may lead to the availability of ss for angelic choice. This is the definition in [Rew03]. For hea lthy binary multirelations, it can be simplified as shown below. BM BM ss ss BM BM (5) In words, the set of angelic choices ss is available for ( BM BM ) from an initial state if all the initial states of BM from which ss is available is a set of angelic choices available for BM from . This can be expressed in the predicative theory using substitution.
Page 22
Theorem 19. pt ) = ( pt )[ pt )[ in ac Proof. pt [Theorem 7] in ac

)[predicate transformer semantics of sequence (3)] in ac )) [property of sets] in ac )) ) [property of sets] in { ac ) [property of substitution] in { in ac ))[ in ) [Theorem 7] in { pt )[ in ) [property of substitution] = ( in ac ))[ pt )[ in ac ] [Theorem 7] = ( pt )[ pt )[ in ac In conclusion, this theorem supports the following definiti on for sequence. in ac It states that a set of angelic choices ac for is a set that is available for when it is executed in any of the states of a set of angelic choices for . This is a definition that is possibly not

obvious, but could be calc ulated using the isomorphism between predicate transformers and the UTP pre dicative theory. An example of a simple sequence of two assignments can be illu minating; we consider := 2; := + 1. We assume that is the only variable in the input alphabet. := 2; := + 1 [semantics of assignment and sequence] = (( 7 2) ac )[ (( 7 + 1) ac )[ ac [property of substitution] = (( 7 2) ac )[ 7 + 1) ac ac [property of substitution] = ( 7 2) ∈{ 7 + 1) ac [property of sets] = ( 7 7 2) + 1) ac [property of states] = ( 7 2 + 1) ac [semantics of assignment] := 3
Page 23

As should be expected, the sequence of assignments is equiva lent to := 3. In our second example, we consider a sequence involving an ange lic choice. := 0 := 1); := + 1 [semantics of assignment, angelic choice, and sequence] = (( 7 0) ac 7 1) ac )[ 7 + 1) ac ac [property of substitution] = ( 7 0) ∈{ 7 + 1) ac } 7 1) ∈{ 7 + 1) ac [property of sets] = ( 7 7 0) + 1) ac 7 7 1) + 1) ac [property of states] = ( 7 1) ac 7 2) ac [semantics of assignment and angelic choice] := 1 := 2 Since the angelic choice := 0 := 1 is followed by an assignment that increments , the program actually

guarantees to take the value 1 or 2, as required. 5.5 Recursion Finally, we consider recursion. Theorem 20. pt ))) = pt ))( Proof. pt )) [property of pt PT ) [Theorem 16] pt PT [Theorem 13] pt pt pt [property of sets] pt )( [property of pt ))( As usual, recursion is given by the least fixed point operator
Page 24
5.6 Designs The theory of angelic nondeterminism captures termination ; this should not come as a surprise since we have a model isomorphic to monoton ic predicate transformers. A program that aborts includes the empty set a s an option for demonic choice. For example,

we have already established th at abort is true ; on the other hand, the program that can lead to an arbitrary final state, but always terminates is ac In particular, abort is the left zero for sequence. Theorem 21. abort abort Proof. abort [definitions of abort and sequence] true in ac ] [property of substitution] true [definition of abort abort As as consequence of this result, the paradox that motivated the definition of the theory of designs is not a concern in our theory. Therefore, t here is no need to include the extra observational variables; at least, not ju st

to model termination. In order to give the weakest precondition semantics of a desi gn, we need to define universal quantification and alphabet extension for p redicates defined as sets of states. The usual semantics of designs, or rather, of specifications given by a precondition and a postcondition, is as follows. . out in ) (6) This is basically in direct correspondence with the perhaps more familiar predica- tive definition; a similar set-based formulation is used in [ CN02]. The definition of universal quantification is as follows. ) = ⊕{ 7

} (7) In (6) we use a universal quantification over the whole output alphabet; the extension of the above definition for sets of variables is str aightforward. Also, in (6), is a set of states over the joint alphabet in out ; the postcondition , however, is a set of states on out . We use the operator to extend the alphabet of to in out . Its definition is as follows; basically, the values of the extra variables are left unconstrained. ) = (8) Again, in (6) we apply to a set of names in , instead of to a single variable The definition above can be extended in the

obvious way. The next theorem gives a semantics for designs in our new theo ry. We take and to be predicates, and use sb to convert then to sets of states.
Page 25
Theorem 22. pt ) = out out ac Proof. pt [definition of pt in ac ) [predicate transformer semantics of designs] in sb out sb ac in )) [property of sets] in sb in α / out sb ac in ) [definition of sb sb sb in α / out sb ac in ) [ sbc sb ) = in α / out sb ac in [definition of (7) and predicate calculus] in ⊕{ out 7 sb ac in ) [property of sets] in ⊕{ out 7 } sb in ⊕{ out 7 }

ac in [definition of (8) and property of sets] in ⊕{ out 7 } sb in ⊕{ out 7 } ac in [definition of (8)] in ⊕{ out 7 } sb in in ⊕{ out 7 } ac [property of in ⊕{ out 7 } sb ∧{ out 7 } ac [predicate calculus] out in out sb out ac [definition of sb out sb sb out ac sbc sb ) = out out ac [predicate calculus] out out ac In words, if holds, then ac is any set that contains a state that satisfies ; the nondeterminism in a design is demonic. We observe that is not a predicate over in ac , but over in out , where out is the alphabet of the

states in ac
Page 26
6 Conclusions The central objective of Hoare and He’s UTP is to formalise di fferent program- ming paradigms within a common semantic framework, so that t hey may be directly compared and new compound programming languages a nd refinement calculi may be developed. This ambitious research programm e has only just been started. An important question to ask is: what are the theore tical limits to this investigation? Angelic nondeterminism is a valuable concept: it plays an im portant rˆole in refinement calculi, and it is used as an abstraction in

search -based and constraint- oriented programming, hiding details of how particular str ategies are imple- mented. The main contribution of this paper is a predicative account of binary multirelations that allows the unification of angelic nonde terminism into the UTP. We describe the UTP predicative theories of alphabetised re lations and of designs, where it is possible to observe the start and termin ation of a program. Designs enable reasoning about total correctness, and a set -based model of rela- tions brings this fact sharply into focus. We show that there is an isomorphism

between our set-based relations and universally conjuncti ve predicate transform- ers. This establishes a connection with an existing result: conjunctive predicate transformers cannot capture angelic nondeterminism. A relational model that can capture both angelic and demonic nondeter- minism is presented in [Rew03]. We cast that model in the UTP p redicative style, including a healthiness condition and the refinement relation. This allows its use in an integrated framework that covers, for instance , concurrency and higher-order programming. We are going to use this model to e xtend the

exist- ing semantics of Circus [WC02], our combined formalism, and prove refinement laws. It is unavoidable that the definition of sequence is more comp licated than that in the original UTP model. It is part of the philosophy of the UTP to study constructs and concepts in isolation: we have provide d a theory for angelic nondeterminism which can be incorporated to the other theor ies as needed. Moreover, our calculations revealed a tractable definition based on substitution. In [BW98], Back and von Wright present another relational mo del isomor- phic to predicate

transformers; it is actually a functional model called choice semantics. In that work, a program is a function from initial states to the set of postconditions that can be satisfied when is executed in . The choice semantics is, of course, isomorphic to binary multirelatio ns. Since in the UTP relations are defined punctually, it was more convenient to b ase our work on binary multirelations rather than on choice semantics. The work in [MGW96] presents a functional semantics for a tac tic language which includes angelic nondeterminism. The semantics of an gelic choice is a list

that contains all the options available to the angel; demoni c nondeterminism is not included. In [MCR04], the set-based model of binary re lations is used to support angelic and demonic nondeterminism in a calculus for functional
Page 27
programs. They adopt two refinement relations, one of which i s the same as ours. Both [Rew03] and [MCR04] present operations that model, for example, an- gelic nondeterminism and sequence. Our contribution is to c ast these operations at the level of UTP predicates, where they can be integrated i nto more power- ful theories of programming.

Moreover, our comparatively s imple definition of sequence takes advantage of the healthiness condition of th e model of binary mul- tirelations. We also go further in that we consider logical c onstants, recursion, assignments, conditionals, and designs. Acknowledgements The authors are grateful to Will Harwood for extensive discu ssions, and to Car- roll Morgan for pointing out the work on binary multirelatio ns. This work is partially funded by QinetiQ and the Royal Society. References [BW89] R. J. R. Back and J. Wright. A Lattice-theoretical Bas is for a Specification Language.

In J. L. A. van de Snepscheut, editor, Mathematics of Program Construction: 375th Anniversary of the Groningen Universi ty , volume 375 of Lecture Notes in Computer Science , pages 139 – 156, Groningen, The Netherlands, 1989. Springer-Verlag. [BW90] R. J. R. Back and J. Wright. Duality in Specification La nguages: A Lattice- theoretical Approach. Acta Informatica , 27(7):583 – 625, 1990. [BW92] R. J. R. Back and J. Wright. Combining angels, demons a nd miracles in program specifications. Theoretical Computer Science , 100:365 – 383, 1992. [BW98] R. J. R. Back and J. Wright.

Refinement Calculus: A Systematic Introduc- tion . Graduate Texts in Computer Science. Springer-Verlag, 199 8. [CN02] A. L. C. Cavalcanti and D. A. Naumann. Forward simulat ion for data re- finement of classes. In L. Eriksson and P. A. Lindsay, editors FME 2002: Formal Methods — Getting IT Right , volume 2391 of Lecture Notes in Com- puter Science , pages 471 – 490. Springer-Verlag, 2002. [CSW03] A. L. C. Cavalcanti, A. C. A. Sampaio, and J. C. P. Wood cock. A Refinement Strategy for Circus Formal Aspects of Computing , 15(2 - 3):146 — 181, 2003. [CW98] A. L. C. Cavalcanti

and J. C. P. Woodcock. A Weakest Pre condition Se- mantics for Z. The Computer Journal , 41(1):1 – 15, 1998. [CW99] A. L. C. Cavalcanti and J. C. P. Woodcock. ZRC—A Refinem ent Calculus for Z. Formal Aspects of Computing , 10(3):267—289, 1999. [CW04] A. L. C. Cavalcanti and J. C. P. Woodcock. Angelic Nond eterminism and Unifying Theories of Programming (Extended Version). Tech nical report, University of Kent - Computing Laboratory, 2004. [CW05] A. L. C. Cavalcanti and J. C. P. Woodcock. Angelic Nond eterminism and Unifying Theories of Programming . In J. Derrick and E. Boite n, editors,

REFINE 2005 , volume 137 of Eletronic Notes in Theoretical Computer Sci- ence . Elsevier, 2005. [Dij76] E. W. Dijkstra. A Discipline of Programming . Prentice-Hall, 1976.
Page 28
[Dun01] S. Dunne. Recasting Hoare and He’s Unifying Theorie s of Programs in the Context of General Correctness. In A. Butterfield and C. Pahl , editors, IWFM’01: 5th Irish Workshop in Formal Methods , BCS Electronic Work- shops in Computing, Dublin, Ireland, July 2001. [GM91] P. H. B. Gardiner and C. C. Morgan. Data Refinement of Pr edicate Trans- formers. Theoretical Computer Science , 87:143 –

162, 1991. [Hes92] W. H. Hesselink. Programs, Recursion and Unbounded Choice – Predicate Transformation Semantics and Transformation Rules . Cambridge Tracts in Theoretical Computer Science 27. Cambridge University Pre ss, 1992. [HH85] C. A. R. Hoare and Jifeng He. The Weakest Prespecificat ion. Technical Monograph TM-PRG-44, Oxford University Computing Laborat ory, Oxford – UK, 1985. [HJ98] C. A. R. Hoare and He Jifeng. Unifying Theories of Programming . Prentice- Hall, 1998. [JSS91] R. Jagadeesan, V. Shanbhogue, and V. Saraswat. Ange lic non-determinism in concurrent constraint

programming. Technical report, X erox Park, Jan- uary 1991. [MCR04] C. E. Martin, S. A. Curtis, and I. Rewitzky. Modellin g Nondeterminism. In Mathematics of Program Construction , Lecture Notes in Computer Science, pages 228 – 251, 2004. [MG90] C. C. Morgan and P. H. B. Gardiner. Data Refinement by Ca lculation. Acta Informatica , 27(6):481—503, 1990. [MGW96] A. P. Martin, P. H. B. Gardiner, and J. C. P. Woodcock. A Tactical Calculus. Formal Aspects of Computing , 8(4):479–489, 1996. [Mor94] C. C. Morgan. Programming from Specifications . Prentice-Hall, 2nd edition, 1994. [Rew03]

I. Rewitzky. Binary Multirelations. In H. Swart, E. Orlowska, G. Schmidt, and M. Roubens, editors, Theory and Application of Relational Structures as Knowledge Instruments , volume 2929 of Lecture Notes in Computer Science pages 256 – 271, 2003. [WC02] J. C. P. Woodcock and A. L. C. Cavalcanti. The Semantic s of Circus . In D. Bert, J. P. Bowen, M. C. Henson, and K. Robinson, editors, ZB 2002: For- mal Specification and Development in Z and B , volume 2272 of Lecture Notes in Computer Science , pages 184 – 203. Springer-Verlag, 2002. [WC04] J. C. P. Woodcock and A. L. C. Cavalcanti. A

Tutorial In troduction to Designs in Unifying Theories of Programming. In E. A. Boiten , J. Derrick, and G. Smith, editors, IFM 2004: Integrated Formal Methods , volume 2999 of Lecture Notes in Computer Science , pages 40 – 66. Springer-Verlag, 2004. Invited tutorial.