This paper suggests that input and output are basic primitives of programming and that parallel composition of communicating sequential processes is a fundamental program structuring method. When combined with a development of Dijkstra's guarded command, these concepts are surprisingly versatile. Their use is illustrated by sample solutions of a variety of a familiar programming exercises.

/pdf/communicating-sequential-processes-2j6tdrg5nx.pdf

Communicating sequential processes

https://www.inf.ed.ac.uk/teaching/courses/seoc/2005_2006/resources/statecharts.pdf

Statecharts: A visual formalism for complex systems

https://cmi.ac.in/~madhavan/courses/verification-2011/alur-dill-tcs-94.pdf

A theory of timed automata

A program denotes computations in some universe of objects. Abstract interpretation of programs consists in using that denotation to describe computations in another universe of abstract objects, so that the results of abstract execution give some information on the actual computations. An intuitive example (which we borrow from Sintzoff [72]) is the rule of signs. The text -1515 * 17 may be understood to denote computations on the abstract universe {(+), (-), (±)} where the semantics of arithmetic operators is defined by the rule of signs. The abstract execution -1515 * 17 → -(+) * (+) → (-) * (+) → (-), proves that -1515 * 17 is a negative number. Abstract interpretation is concerned by a particular underlying structure of the usual universe of computations (the sign, in our example). It gives a summary of some facets of the actual executions of a program. In general this summary is simple to obtain but inaccurate (e.g. -1515 + 17 → -(+) + (+) → (-) + (+) → (±)). Despite its fundamentally incomplete results abstract interpretation allows the programmer or the compiler to answer questions which do not need full knowledge of program executions or which tolerate an imprecise answer, (e.g. partial correctness proofs of programs ignoring the termination problems, type checking, program optimizations which are not carried in the absence of certainty about their feasibility, …).

/pdf/abstract-interpretation-a-unified-lattice-model-for-static-2jfaix0dre.pdf

Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints

A unified approach to program verification is suggested, which applies to both sequential and parallel programs. The main proof method suggested is that of temporal reasoning in which the time dependence of events is the basic concept. Two formal systems are presented for providing a basis for temporal reasoning. One forms a formalization of the method of intermittent assertions, while the other is an adaptation of the tense logic system Kb, and is particularly suitable for reasoning about concurrent programs.

The temporal logic of programs

/pdf/a-model-for-communicating-sequential-process-289ctui21l.pdf

A model for communicating sequential process

b e g i n p r o c e d u r e RANGESUM (a, b, c, d, e, f); rea l a , b , c , d , e , f ; c o m m e n t The term \"range number\" was used by P. S. Dwyer, Linear Computations (Wiley, 1951). Machine procedures for range ari thmetic were developed about 1958 by Ramon Moore, \"Automatic Error Analysis in Digital Computa t ion ,\" LMSD Report 48421, 28 Jan. 1959, Lockheed Missiles and Space Division, Palo Alto, California, 59 pp. If a _< x -< b and c ~ y ~ d, then RANGESUM yields an interval [e, f] such tha t e =< (x + y) f. Because of machine operation (truncation or rounding) the machine sums a -4c and b -4d may not provide safe end-points of the output interval. Thus RANGESUM requires a non-local real procedure ADJUSTSUM which will compensate for the machine ari thmetic. The body of ADJUSTSUM will be dependent upon the type of machine for which it is wri t ten and so is not given here. (An example, however, appears below.) I t is assumed tha t ADJUSTSUM has as parameters real v and w, and integer i, and is accompanied by a non-local real procedure CORRECTION which gives an upper bound to the magnitude of the error involved in the machine representat ion of a number. The output ADJUSTSUM provides the left end-point of the output interval of RANGESUM when ADJUSTSUM is called with i = --1, and the right end-point when called with i = 1 The procedures RANGESUB, RANGEMPY, and RANGEDVD provide for the remaining fundamental operations in range ari thmetic. RANGESQR gives an interval within which the square of a range nmnber must lie. RNGSUMC, RNGSUBC, RNGMPYC and RNGDVDC provide for range ari thmetic with complex range arguments, i.e. the real and imaginary parts are range numbers~ b e g i n e := ADJUSTSUM (a, c, 1 ) ; f : = ADJUSTSUM (b, d, 1) end RANGESUM; p r o c e d u r e RANGESUB (a, b, c, d, e, f) ; real a, b ,c , d ,e , f; c o m m e n t RANGESUM is a non-local procedure; b e g i n RANGESUM (a, b, d , --c, e, f) en d RANGESUB ; p r o c e d u r e RANGEMPY (a, b, c, d, e, f); real a, b, c, d, e, f; c o m m e n t ADJUSTPROD, which appears at the end of this procedure, is analogous to ADJUSTSUM above and is a nonlocal real procedure. MAX and MIN find the maximum and minimum of a set of real numbers and are non-local; b e g i n rea l v, w; i f a < 0 A c => 0 t h e n 1: b e g i n v : = c ; c : = a ; a : = v ; w : = d ; d : = b ; b : = w end 1; i f a => O t h e n 2: b e g i n i f c >= 0 t h e n 3 :beg in e : = a X e ; f := b X d ; g o t o 8 e n d 3 ; e : = b X c ; i f d ~ 0 t h e n 4: b e g i n f : = b X d ; g o t o 8 e n d 4; f : = a X d ; g o t o 8 5: e n d 2; i f b > 0 t h e n 6: b e g i n i f d > 0 t h e n b e g i n e := MIN(a X d, b X c); f : = MAX(a X c , b X d); go t o 8 e n d 6; e : = b X c; f : = a X c; go t o 8 e n d 5; f : = a X c ; i f d _-< O t h e n 7: b e g i n e : = b X d ; g o t o 8 e n d 7 ; e : = a X d ; 8: e : = ADJUSTPROD (e, 1 ) ; f := ADJUSTPROD (f, 1) e n d RANGEMPY; p r o c e d u r e RANGEDVD (a, b, c, d, e, f) ; real a, b, c, d, e, f; c o m m e n t If the range divisor includes zero the program exists to a non-local label \"zerodvsr\" . RANGEDVD assumes a non-local real procedure ADJUSTQUOT which is analogous (possibly identical) to ADJUSTPROD; b e g i n i f c =< 0 A d ~ 0 t h e n go to zer0dvsr; i f c < 0 t h e n 1: b e g i n i f b > 0 t h e n 2: b e g i n e : = b /d ; go t o 3 e n d 2; e : = b /c ; 3: i f a -->_ 0 t h e n 4: b e g i n f : = a /c ; go to 8 e n d 4; f : = a /d ; go to 8 e n d 1 ; i f a < 0 t h e n 5: b e g i n e : = a/c; go t o 6 e n d 5 ; e : = a /d ; 6: i f b > 0 t h e n 7: b e g i n f : = b/c ; go t o 8 e n d 7 ; f : = b /d ; 8: e := ADJUSTQUOT (e, 1 ) ; f : = ADJUSTQUOT (f,1) e n d RANGEDVD ; p r o c e d u r e RANGESQR (a, b, e, f); rea l a, b, e, f; c o m m e n t ADJUSTPROD is a non-10cal procedure; b e g i n i f a < 0 t h e n

Algorithm 63: partition

The power and convenience of a programming language may be enhanced for certain applications by permitting treelike data structures to be defined by recursion. This paper suggests a pleasing notation by which such structures can be declared and processed; it gives the axioms which specify their properties, and suggests an efficient implementation method. It shows how a recursive data structure may be used to represent another data type, for example, a set. It then discusses two ways in which significant gains in efficiency can be made by selective updating of structures, and gives the relevant proof rules and hints for implementation. The examples show that a certain range of applications in symbol manipulation can be efficiently programmed without introducing the low-level concept of a reference into a high-level programming language.

Recursive data structures

A proof is given of the correctness of the algorithm “Find.” First, an informal description is given of the purpose of the program and the method used. A systematic technique is described for constructing the program proof during the process of coding it, in such a way as to prevent the intrusion of logical errors. The proof of termination is treated as a separate exercise. Finally, some conclusions relating to general programming methodology are drawn.

C. A. R. Hoare

Papers

A model for communicating sequential process

Algorithm 63: partition

Recursive data structures

Proof of a program: FIND

The weakest prespecification